commit 9e478f1591aa460c02b0605e4e5c707793c962f2
Author: zhongluofeng <zhongluofeng@sinways.com.cn>
Date:   Fri Aug 21 18:28:33 2026 +0800

    init

diff --git a/5G-Modem-Support b/5G-Modem-Support
new file mode 160000
index 0000000..b1d9a12
--- /dev/null
+++ b/5G-Modem-Support
@@ -0,0 +1 @@
+Subproject commit b1d9a12ac4c209b82fb9db533b067c3fec95a9a6
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..851e37c
--- /dev/null
+++ b/README.md
@@ -0,0 +1,190 @@
+# LEDE 5G 固件构建与分析记录
+
+> 日期：2026-08-21
+> 仓库：https://github.com/Atieei/lede（fork 自 coolsnowwolf/lede）
+> 提交：`a09ade8` add 5G modem support (RM520N-GL MBIM) with luci management and CI build
+> 目标：飞牛OS (fnOS) KVM 虚拟机 + PCIe 直通 RM520N-GL，编译带自写管理界面的精简稳定版 LEDE 固件
+
+---
+
+## 一、实测经验核心结论（固件设计依据）
+
+以下结论来自 RM520N-GL 在 fnOS KVM + PCIe 直通环境下的实测，是整个固件方案的基石：
+
+| 结论 | 详情 |
+|---|---|
+| MBIM 是唯一可行模式 | RM520N-GL 在 PCIe/MHI 下 QMI 通道不可用，驱动必须以 `mhi_mbim_enabled=1` 加载 |
+| 拨号命令禁用 -i 参数 | MBIM 模式下 `quectel-CM -s <APN>` 即可，传 `-i rmnet_mhi0` 会导致异常 |
+| 驱动版本 | pcie_mhi V1.3.8（源码来自 Siriling/5G-Modem-Support 的 quectel_MHI） |
+| 拨号工具 | quectel-CM V1.6.8（QConnectManager，MBIM 路径实测通过） |
+| AT 通道与拨号并存 | `/dev/mhi_DUN`（sms_tool AT）与 `/dev/mhi_MBIM` 拨号可同时使用 |
+| SYS_ERR 故障 | 模块失联时 VM 内 reboot 无法恢复（不切断 PCIe 供电），需阶梯式自愈或宿主机断电 |
+| 数据接口 | 拨号成功后 IP 出现在 `rmnet_mhi0.1` |
+
+---
+
+## 二、固件包结构（package/5g-modem/）
+
+```
+package/5g-modem/
+├── pcie-mhi/                 # 内核驱动 kmod-pcie-mhi (V1.3.8)
+│   ├── Makefile              # 外部内核模块编译 (kbuild, 产出 pcie_mhi.ko)
+│   ├── src/                  # 驱动源码 (core/controllers/devices)
+│   └── files/etc/modules.d/90-pcie_mhi   # 开机自动加载: pcie_mhi mhi_mbim_enabled=1
+├── quectel-cm/               # 拨号工具 quectel-cm (V1.6.8)
+│   ├── Makefile              # musl-gcc 单命令编译 (与实测通过的编译命令一致)
+│   └── src/                  # QConnectManager 源码
+├── sms-tool/                 # AT 命令工具 (obsy/sms_tool + 中文编码修正补丁)
+└── luci-app-5gmodem/         # 自写 LuCI 管理应用
+    ├── luasrc/controller/5gmodem.lua          # 菜单 + API (status/dial/at)
+    ├── luasrc/model/cbi/5gmodem/settings.lua  # 设置页 (APN/认证/PIN/守护开关)
+    ├── luasrc/view/5gmodem/status.htm         # 状态页 (轮询+控制+AT控制台)
+    └── root/
+        ├── etc/config/5gmodem                 # UCI 默认配置
+        ├── etc/init.d/5gmodem                 # procd 拨号服务 (START=95)
+        ├── usr/bin/5gmodem-guard              # SYS_ERR 自愈守护
+        └── usr/libexec/5gmodem-status.sh      # 状态采集 (JSON 输出)
+```
+
+依赖声明：`luci-app-5gmodem` → `+kmod-pcie-mhi +quectel-cm +sms-tool +luci-compat`
+
+---
+
+## 三、LuCI 管理界面功能
+
+菜单：网络 → 5G 拨号（状态 / 拨号设置）
+
+**状态页（10 秒轮询）**
+- 服务与驱动：quectel-CM 运行状态/PID、守护状态、pcie_mhi 加载、MBIM/DUN 通道就绪、PCI 设备地址
+- 连接信息：`rmnet_mhi0.1` 的 IP、上下行流量（自动格式化 B/KB/MB/GB）
+- 模块信息：型号/制造商/固件/IMEI/IMSI/SIM 状态/运营商（PLMN 数字映射中文名）/网络模式/频段信道
+- 信号质量：RSRP/SINR/RSRQ/RSSI，带优/中/差彩色分级标签
+- 拨号控制：启动/停止/重启（POST + token，防 CSRF）
+- AT 控制台：自由输入 + 15 条常用命令快捷下拉（QCSQ/QNWINFO/QENG="servingcell"/QTEMP 等），输出区滚动显示
+- 拨号日志：/tmp/quectel_cm.log 尾部 12 行实时展示
+
+**设置页**
+- 开机自动拨号、APN（默认 wonet）、PAP/CHAP 用户名密码（明文显示便于调试）、认证方式、PIN 码、AT 串口路径、自愈守护开关
+
+**API（控制器）**
+- `api_status`：GET 状态 JSON
+- `api_dial`：POST start/stop/restart/reload（白名单校验）
+- `api_at`：POST AT 命令，正则白名单校验（`^AT` 开头，允许字母数字空格 `+ " = % ? , . : / # * ( ) -`，禁单引号保证 shell 拼接安全），串口路径二次校验 + 存在性检查
+
+---
+
+## 四、SYS_ERR 自愈守护（5gmodem-guard）
+
+基于实测故障经验设计，procd 托管、每 15 秒巡检，恢复阶梯：
+
+1. **阶段 1**：`echo <bdf> > /sys/bus/pci/drivers/mhi_q/bind`（实测有效的手动唤醒法，每 30s 重试）
+2. **阶段 2**：PCI remove + rescan，重走 BHI 固件下载（故障 120s 后，每 60s 一次）
+3. **阶段 3**：rmmod pcie_mhi + 重加载 MBIM 模式（故障 300s 后，每 90s 一次）
+4. **阶段 4**：日志提示需宿主机断电（故障 600s 后，每 300s 提示；VM 内无法切断 PCIe 供电属物理限制）
+
+附加：设备在但 quectel-CM 进程死亡超过 60s 时自动 restart 拨号服务。日志写入 `/tmp/5gmodem_guard.log`（超 200 行自动截半）。
+
+设备识别：扫描 `/sys/bus/pci/devices/*/vendor` 匹配移远 `0x17cb`/`0x1eac`。
+
+---
+
+## 五、兼容性验证记录（关键分析）
+
+### 5.1 LuCI 分支兼容性（openwrt-25.12）
+
+feeds.conf.default 使用 `coolsnowwolf/luci;openwrt-25.12` 分支，该分支 ucode dispatcher 为新架构。逐项读源码实证：
+
+1. **Lua controller 支持**：`modules/luci-base/ucode/dispatcher.uc` 中 `glob('/usr/lib/lua/luci/controller/*.lua')` 扫描并通过 `runtime.call('luci.dispatcher', 'process_lua_controller', file)` 桥接处理 → 旧式 controller 完全可用
+2. **依赖链完整**：`luci-compat` (Makefile: `LUCI_DEPENDS:=+luci-lua-runtime`) → `luci-lua-runtime` 模块存在（含 dispatcher.lua/template.lua 等），luci-base 依赖 `ucode-mod-*` 全套
+3. **模板桥接**：`luci-lua-runtime/luasrc/template.lua` 的 `include()` 在 Lua 视图目录找不到时回退 `L.include(name)`（ucode 主题模板），因此 `<%+header%>`/`<%+footer%>` 正确渲染主题框架；bootstrap 主题提供 `ucode/template/themes/bootstrap/header.ut|footer.ut`
+4. **同模式先例**：该分支有 68 个 luasrc/controller 文件、150 个 CBI 文件（docker/diskman/lucky/nfs 等应用均为旧式 Lua 写法）
+5. **CBI Flag 类**：`luci-compat/luasrc/cbi.lua` Flag 构造器初始化 `enabled="1"/disabled="0"`，设置页默认值逻辑正确
+
+### 5.2 内核驱动 6.12/6.18 兼容性
+
+- pcie_mhi 源码版本守护完善：42 处 `LINUX_VERSION_CODE` 条件编译
+- 关键破坏点 `class_create` 已适配：`mhi_uci.c:954` 与 `mhi_init.c:2678` 均有 `>= 6.4.0` 单参数版本分支
+- `mhi_netdev_quectel.c` 有 6.1 分界适配（netdev/dm/timer API）
+
+### 5.3 重要发现与修正：virtio 配置冗余
+
+原计划在 `target/linux/x86/config-6.12` base 配置添加 KVM guest 支持。复查发现 **`target/linux/x86/64/config-6.12`（6.18 同）子目标配置已内建全套支持**（`HYPERVISOR_GUEST`/`KVM_GUEST`/`PARAVIRT`/`PARAVIRT_CLOCK`/`VIRTIO`/`VIRTIO_PCI`/`VIRTIO_NET`/`VIRTIO_BLK`/`VIRTIO_BALLOON`/`SCSI_VIRTIO`/`HW_RANDOM_VIRTIO`/`DRM_VIRTIO_GPU` 等全为 y，且子目标配置覆盖合并 base）。
+
+**处置**：回退 base config 修改。fork 相对上游 diff 仅剩纯新增的 3 个目录（`.github/workflows/`、`configs/`、`package/5g-modem/`），后续同步上游零冲突。
+
+### 5.4 内核竞争配置检查
+
+确认内核主线 MHI 相关配置（`CONFIG_MHI_BUS` 等）未启用，与外部 pcie_mhi 驱动无符号竞争。
+
+---
+
+## 六、本地校验记录（提交前）
+
+| 项目 | 方法 | 结果 |
+|---|---|---|
+| 4 个 shell 脚本 | Git Bash `sh -n`（status.sh / guard / init.d / modules.d） | 全部通过 |
+| status.htm 内嵌 JS（145 行） | Node `new Function()` 语法检查（LuCI 模板占位符替换后） | 通过 |
+| 2 个 Lua 文件 | 自写块结构平衡检查器（剥离注释/字符串后统计 function/if/do/end 配对） | 通过 |
+| 行尾检查 | 逐文件统计 CRLF | 仅 sms-tool/Makefile 为 CRLF，已规范化为 LF |
+| 执行位 | `git update-index --add --chmod=+x` 三个脚本 | 索引中 100755 确认 |
+| 行尾入库保障 | `package/5g-modem/.gitattributes`（*.sh/*.lua/*.htm/Makefile 强制 LF） | 已设置 |
+
+---
+
+## 七、Git 提交与推送
+
+- 克隆采用 `--depth=1 --filter=blob:none` + sparse-checkout（仅 target/linux/x86 等），提交前将新目录加入 sparse 规则
+- 提交 `a09ade8`：80 个文件，45600 行插入
+- 已推送 `master` → `origin/master`（81636b7..a09ade8）
+- 三个可执行脚本（init.d/5gmodem、5gmodem-guard、5gmodem-status.sh）以 100755 模式入库（Linux 上 procd 直接执行必需）
+
+---
+
+## 八、新镜像构建与产物
+
+### 构建方法（手动触发）
+
+1. 打开 https://github.com/Atieei/lede/actions
+2. 左侧选 **Build 5G-Modem LEDE (x86_64)**
+3. **Run workflow** → 直接 Run（首编约 2-3 小时）
+4. 可选输入：勾选"忽略缓存全量重编"（首次构建或缓存异常时使用）
+
+### 工作流特性
+
+- 运行环境 ubuntu-22.04，lede 官方 CI 同款依赖安装 + jlumbroso/free-disk-space 磁盘清理
+- toolchain/dl 缓存（key 含 feeds.conf.default 与种子配置哈希），重编大幅提速
+- `.config` 由 `configs/x86_64-5gmodem.config` 种子 + `make defconfig` 生成，并强校验 5G 五个包必须被选中（否则立即失败）
+- 编译失败自动重试 `make -j1 V=s` 并产出日志 artifact
+
+### 产物（3 个 artifact）
+
+| Artifact | 内容 |
+|---|---|
+| lede-5gmodem-firmware-x86_64 | 固件镜像（BIOS+EFI 双启动 squashfs+gzip，位于 bin/targets/x86/64/） |
+| lede-5gmodem-packages | 全部 .ipk（可装进现有系统调试，无需重刷固件） |
+| lede-5gmodem-buildinfo | *.buildinfo / *.manifest（精确还原配置） |
+
+### 精简配置说明（configs/x86_64-5gmodem.config）
+
+- 关闭：CPU 微码、声卡全套、物理显卡（amdgpu/i915）、物理网卡（igb/i40e/mlx5/r8125 等 17 种）、USB 网卡、f2fs/mmc/传感器/自动挂载
+- 保留：e100/e1000/e1000e（KVM 常见网卡）+ virtio（内核内建）+ PCIe 直通 + LuCI 中文界面 + 5G 全套包
+
+---
+
+## 九、部署指南
+
+1. 下载固件 artifact，解压取 `*-x86-64-generic-squashfs-combined-efi.img.gz`（fnOS KVM 用 EFI）
+2. `gunzip` 后作为磁盘导入 KVM 虚拟机，vCPU/内存按需，PCIe 直通 RM520N-GL
+3. 首次启动后 LAN 口（默认 192.168.1.1）访问 LuCI → 网络 → 5G 拨号
+4. 设置页填 APN（联通 wonet）保存即自动拨号；或状态页手动"启动拨号"
+5. 多 WAN 需手动配置（固件按需求不预置策略路由）
+
+## 十、故障排查速查
+
+| 现象 | 排查 |
+|---|---|
+| 状态页全灰 | `lsmod | grep pcie_mhi`、`ls -l /dev/mhi_*`、`cat /tmp/5gmodem_guard.log` |
+| 拨号无 IP | `cat /tmp/quectel_cm.log`（完整日志）、AT 控制台发 `AT+CPIN?` 查 SIM |
+| 自愈不成功 | 看守护日志阶段提示；600s 仍未恢复需宿主机断电（物理限制） |
+| AT 控制台无响应 | 确认 `/dev/mhi_DUN` 存在；串口路径在设置页可改 |
+| ipk 调试 | artifacts 的 packages 里直接 `opkg install` 对应 ipk 到现有系统 |
diff --git a/RM520N-5G/README.md b/RM520N-5G/README.md
new file mode 100644
index 0000000..7e17062
--- /dev/null
+++ b/RM520N-5G/README.md
@@ -0,0 +1,21 @@
+# RM520N-GL 5G 模块 MBIM 拨号成功路线打包
+
+## 内容
+- 在线参考 https://blog.siriling.com:81/2023/03/18/openwrt-5g-modem/
+- 在线参考 https://github.com/Siriling/5G-Modem-Support
+- **文档/**：完整成功路线说明（主文档 `RM520N-MBIM拨号成功路线.md`）
+- **文件/binaries/**：musl 静态编译的 Quectel-CM V1.6.8 及 proxy 工具（部署到 /usr/bin 用）
+- **文件/source/**：V1.6.8 完整源码（含官方 PDF 文档）
+- **文件/configs/**：iStoreOS 上的配置（modem 配置、驱动参数、开机脚本）
+- **文件/logs/**：成功拨号日志 + 移远官方参考日志
+
+## 快速开始
+1. 切换驱动到 MBIM：`insmod pcie_mhi.ko mhi_mbim_enabled=1`
+2. 部署 `binaries/quectel-CM` 到 `/usr/bin/`
+3. 拨号：`/usr/bin/quectel-CM -s wonet`
+4. 开机自启：复制 `configs/init.d_modem5g` 到 `/etc/init.d/` 并 enable
+
+详见 `文档/RM520N-MBIM拨号成功路线.md`。
+
+## 关键结论
+**RM520N-GL 在 PCIe 直通 + pcie_mhi 驱动下，QMI 模式不通（模块不响应），MBIM 是正解。**
diff --git a/RM520N-5G/RM520N系列资料/01 SPEC/Quectel_RM520N系列_5G_模块产品规格书_V1.1.pdf b/RM520N-5G/RM520N系列资料/01 SPEC/Quectel_RM520N系列_5G_模块产品规格书_V1.1.pdf
new file mode 100644
index 0000000..0b87b16
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/01 SPEC/Quectel_RM520N系列_5G_模块产品规格书_V1.1.pdf differ
diff --git a/RM520N-5G/RM520N系列资料/02 PPT/Quectel_RM520N系列_5G_模块产品介绍_V1.1.pdf b/RM520N-5G/RM520N系列资料/02 PPT/Quectel_RM520N系列_5G_模块产品介绍_V1.1.pdf
new file mode 100644
index 0000000..a8378fe
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/02 PPT/Quectel_RM520N系列_5G_模块产品介绍_V1.1.pdf differ
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_Anatel_Certificate.zip b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_Anatel_Certificate.zip
new file mode 100644
index 0000000..d770ef1
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_Anatel_Certificate.zip differ
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_CE(RED)_Certificate.pdf b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_CE(RED)_Certificate.pdf
new file mode 100644
index 0000000..dc40daf
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_CE(RED)_Certificate.pdf differ
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_FCC(C2PC)_Certificate.zip b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_FCC(C2PC)_Certificate.zip
new file mode 100644
index 0000000..753167d
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_FCC(C2PC)_Certificate.zip differ
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_FCC_Certificate.zip b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_FCC_Certificate.zip
new file mode 100644
index 0000000..bc8db89
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_FCC_Certificate.zip differ
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_GCF_Certificate.pdf b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_GCF_Certificate.pdf
new file mode 100644
index 0000000..aa70b38
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_GCF_Certificate.pdf differ
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_IC(ISED)_Certificate.pdf b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_IC(ISED)_Certificate.pdf
new file mode 100644
index 0000000..4037542
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_IC(ISED)_Certificate.pdf differ
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_JATE_Certificate.pdf b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_JATE_Certificate.pdf
new file mode 100644
index 0000000..4c5ddda
--- /dev/null
+++ b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_JATE_Certificate.pdf	
@@ -0,0 +1,2706 @@
+%PDF-1.3
+%����
+1 0 obj
+<<
+/Type /Outlines
+/Count 0
+>>
+endobj
+2 0 obj
+
+[/PDF /Text /ImageC]
+endobj
+3 0 obj
+<<
+/Type /Pages
+/Count 4
+/Kids [21 0 R 32 0 R 42 0 R 45 0 R ]
+>>
+endobj
+4 0 obj
+<<
+/Type /Font
+/Subtype /TrueType
+/Name /F1
+/BaseFont /Arial,Bold
+/FirstChar 32
+/LastChar 255
+/Widths [
+277 333 474 556 556 889 722 237 
+333 333 389 583 277 333 277 277 
+556 556 556 556 556 556 556 556 
+556 556 333 333 583 583 583 610 
+975 722 722 722 722 666 610 777 
+722 277 556 722 610 833 722 777 
+666 777 722 666 610 722 666 943 
+666 666 610 333 277 333 583 556 
+333 556 610 556 610 556 333 610 
+610 277 277 556 277 889 610 610 
+610 610 389 556 333 610 556 777 
+556 556 500 389 279 389 583 0 
+556 0 277 556 500 1000 556 556 
+333 1000 666 333 1000 0 610 0 
+0 277 277 500 500 350 556 1000 
+333 1000 556 333 943 0 500 666 
+277 333 556 556 556 556 279 556 
+333 736 370 556 583 0 736 552 
+399 548 333 333 333 576 556 333 
+333 333 365 556 833 833 833 610 
+722 722 722 722 722 722 1000 722 
+666 666 666 666 277 277 277 277 
+722 722 777 777 777 777 777 583 
+777 722 722 722 722 666 666 610 
+556 556 556 556 556 556 889 556 
+556 556 556 556 277 277 277 277 
+610 610 610 610 610 610 610 548 
+610 610 610 610 610 556 610 556 
+ ]
+/Encoding /WinAnsiEncoding
+/FontDescriptor 5 0 R
+>>
+endobj
+5 0 obj
+<<
+/Type /FontDescriptor
+/FontName /Arial
+/Ascent 905
+/CapHeight 500
+/Descent 211
+/Flags 32
+/FontBBox [ -628 -376 2000 1018 ]
+/ItalicAngle 0
+/StemV 0
+>>
+endobj
+6 0 obj
+<<
+/Type /Font
+/Subtype /TrueType
+/Name /F2
+/BaseFont /Arial
+/FirstChar 32
+/LastChar 255
+/Widths [
+277 277 354 556 556 889 666 190 
+333 333 389 583 277 333 277 277 
+556 556 556 556 556 556 556 556 
+556 556 277 277 583 583 583 556 
+1015 666 666 722 722 666 610 777 
+722 277 500 666 556 833 722 777 
+666 777 722 666 610 722 666 943 
+666 666 610 277 277 277 469 556 
+333 556 556 500 556 556 277 556 
+556 222 222 500 222 833 556 556 
+556 556 333 500 277 556 500 722 
+500 500 500 333 259 333 583 0 
+556 0 222 556 333 1000 556 556 
+333 1000 666 333 1000 0 610 0 
+0 222 222 333 333 350 556 1000 
+333 1000 500 333 943 0 500 666 
+277 333 556 556 556 556 259 556 
+333 736 370 556 583 0 736 552 
+399 548 333 333 333 576 537 333 
+333 333 365 556 833 833 833 610 
+666 666 666 666 666 666 1000 722 
+666 666 666 666 277 277 277 277 
+722 722 777 777 777 777 777 583 
+777 722 722 722 722 666 666 610 
+556 556 556 556 556 556 889 500 
+556 556 556 556 277 277 277 277 
+556 556 556 556 556 556 556 548 
+610 556 556 556 556 500 556 500 
+ ]
+/Encoding /WinAnsiEncoding
+/FontDescriptor 7 0 R
+>>
+endobj
+7 0 obj
+<<
+/Type /FontDescriptor
+/FontName /Arial
+/Ascent 905
+/CapHeight 500
+/Descent 211
+/Flags 32
+/FontBBox [ -665 -325 2000 1006 ]
+/ItalicAngle 0
+/StemV 0
+>>
+endobj
+8 0 obj
+<<
+/Type /Font
+/Subtype /TrueType
+/Name /F3
+/BaseFont /TimesNewRoman
+/FirstChar 32
+/LastChar 255
+/Widths [
+250 333 408 500 500 833 777 180 
+333 333 500 563 250 333 250 277 
+500 500 500 500 500 500 500 500 
+500 500 277 277 563 563 563 443 
+920 722 666 666 722 610 556 722 
+722 333 389 722 610 889 722 722 
+556 722 666 556 610 722 722 943 
+722 722 610 333 277 333 469 500 
+333 443 500 443 500 443 333 500 
+500 277 277 500 277 777 500 500 
+500 500 333 389 277 500 500 722 
+500 500 443 479 200 479 541 0 
+500 0 333 500 443 1000 500 500 
+333 1000 556 333 889 0 610 0 
+0 333 333 443 443 350 500 1000 
+333 979 389 333 722 0 443 722 
+250 333 500 500 500 500 200 500 
+333 759 275 500 563 0 759 500 
+399 548 299 299 333 576 453 333 
+333 299 310 500 750 750 750 443 
+722 722 722 722 722 722 889 666 
+610 610 610 610 333 333 333 333 
+722 722 722 722 722 722 722 563 
+722 722 722 722 722 722 556 500 
+443 443 443 443 443 443 666 443 
+443 443 443 443 277 277 277 277 
+500 500 500 500 500 500 500 548 
+500 500 500 500 500 500 500 500 
+ ]
+/Encoding /WinAnsiEncoding
+/FontDescriptor 9 0 R
+>>
+endobj
+9 0 obj
+<<
+/Type /FontDescriptor
+/FontName /TimesNewRoman
+/Ascent 891
+/CapHeight 500
+/Descent 216
+/Flags 34
+/FontBBox [ -568 -307 2000 1007 ]
+/ItalicAngle 0
+/StemV 0
+>>
+endobj
+10 0 obj
+<<
+/Type /Font
+/Subtype /TrueType
+/Name /F4
+/BaseFont /Arial,BoldItalic
+/FirstChar 32
+/LastChar 255
+/Widths [
+277 333 474 556 556 889 722 237 
+333 333 389 583 277 333 277 277 
+556 556 556 556 556 556 556 556 
+556 556 333 333 583 583 583 610 
+975 722 722 722 722 666 610 777 
+722 277 556 722 610 833 722 777 
+666 777 722 666 610 722 666 943 
+666 666 610 333 277 333 583 556 
+333 556 610 556 610 556 333 610 
+610 277 277 556 277 889 610 610 
+610 610 389 556 333 610 556 777 
+556 556 500 389 279 389 583 0 
+556 0 277 556 500 1000 556 556 
+333 1000 666 333 1000 0 610 0 
+0 277 277 500 500 350 556 1000 
+333 1000 556 333 943 0 500 666 
+277 333 556 556 556 556 279 556 
+333 736 370 556 583 0 736 552 
+399 548 333 333 333 576 556 333 
+333 333 365 556 833 833 833 610 
+722 722 722 722 722 722 1000 722 
+666 666 666 666 277 277 277 277 
+722 722 777 777 777 777 777 583 
+777 722 722 722 722 666 666 610 
+556 556 556 556 556 556 889 556 
+556 556 556 556 277 277 277 277 
+610 610 610 610 610 610 610 548 
+610 610 610 610 610 556 610 556 
+ ]
+/Encoding /WinAnsiEncoding
+/FontDescriptor 11 0 R
+>>
+endobj
+11 0 obj
+<<
+/Type /FontDescriptor
+/FontName /Arial
+/Ascent 905
+/CapHeight 500
+/Descent 211
+/Flags 96
+/FontBBox [ -560 -376 1390 1018 ]
+/ItalicAngle -120
+/StemV 0
+>>
+endobj
+12 0 obj
+<<
+/Type /Font
+/Subtype /TrueType
+/Name /F5
+/BaseFont /TimesNewRoman,Bold
+/FirstChar 32
+/LastChar 255
+/Widths [
+250 333 555 500 500 1000 833 277 
+333 333 500 569 250 333 250 277 
+500 500 500 500 500 500 500 500 
+500 500 333 333 569 569 569 500 
+930 722 666 722 722 666 610 777 
+777 389 500 777 666 943 722 777 
+610 777 722 556 666 722 722 1000 
+722 722 666 333 277 333 581 500 
+333 500 556 443 556 443 333 500 
+556 277 333 556 277 833 556 500 
+556 556 443 389 333 556 500 722 
+500 500 443 394 220 394 520 0 
+500 0 333 500 500 1000 500 500 
+333 1000 556 333 1000 0 666 0 
+0 333 333 500 500 350 500 1000 
+333 1000 389 333 722 0 443 722 
+250 333 500 500 500 500 220 500 
+333 747 299 500 569 0 747 500 
+399 548 299 299 333 576 540 333 
+333 299 330 500 750 750 750 500 
+722 722 722 722 722 722 1000 722 
+666 666 666 666 389 389 389 389 
+722 722 777 777 777 777 777 569 
+777 722 722 722 722 722 610 556 
+500 500 500 500 500 500 722 443 
+443 443 443 443 277 277 277 277 
+500 556 500 500 500 500 500 548 
+500 556 556 556 556 500 556 500 
+ ]
+/Encoding /WinAnsiEncoding
+/FontDescriptor 13 0 R
+>>
+endobj
+13 0 obj
+<<
+/Type /FontDescriptor
+/FontName /TimesNewRoman
+/Ascent 891
+/CapHeight 500
+/Descent 216
+/Flags 34
+/FontBBox [ -558 -307 2000 1026 ]
+/ItalicAngle 0
+/StemV 0
+>>
+endobj
+14 0 obj
+<<
+/Type /Font
+/Subtype /TrueType
+/Name /F6
+/BaseFont /TimesNewRoman
+/FirstChar 32
+/LastChar 255
+/Widths [
+250 333 408 500 500 833 777 180 
+333 333 500 563 250 333 250 277 
+500 500 500 500 500 500 500 500 
+500 500 277 277 563 563 563 443 
+920 722 666 666 722 610 556 722 
+722 333 389 722 610 889 722 722 
+556 722 666 556 610 722 722 943 
+722 722 610 333 277 333 469 500 
+333 443 500 443 500 443 333 500 
+500 277 277 500 277 777 500 500 
+500 500 333 389 277 500 500 722 
+500 500 443 479 200 479 541 0 
+500 0 333 500 443 1000 500 500 
+333 1000 556 333 889 0 610 0 
+0 333 333 443 443 350 500 1000 
+333 979 389 333 722 0 443 722 
+250 333 500 500 500 500 200 500 
+333 759 275 500 563 0 759 500 
+399 548 299 299 333 576 453 333 
+333 299 310 500 750 750 750 443 
+722 722 722 722 722 722 889 666 
+610 610 610 610 333 333 333 333 
+722 722 722 722 722 722 722 563 
+722 722 722 722 722 722 556 500 
+443 443 443 443 443 443 666 443 
+443 443 443 443 277 277 277 277 
+500 500 500 500 500 500 500 548 
+500 500 500 500 500 500 500 500 
+ ]
+/Encoding /WinAnsiEncoding
+/FontDescriptor 15 0 R
+>>
+endobj
+15 0 obj
+<<
+/Type /FontDescriptor
+/FontName /TimesNewRoman
+/Ascent 891
+/CapHeight 500
+/Descent 216
+/Flags 34
+/FontBBox [ -568 -307 2000 1007 ]
+/ItalicAngle 0
+/StemV 0
+>>
+endobj
+16 0 obj
+<<
+/Type /Font
+/Subtype /TrueType
+/Name /F7
+/BaseFont /TimesNewRoman,Bold
+/FirstChar 32
+/LastChar 255
+/Widths [
+250 333 555 500 500 1000 833 277 
+333 333 500 569 250 333 250 277 
+500 500 500 500 500 500 500 500 
+500 500 333 333 569 569 569 500 
+930 722 666 722 722 666 610 777 
+777 389 500 777 666 943 722 777 
+610 777 722 556 666 722 722 1000 
+722 722 666 333 277 333 581 500 
+333 500 556 443 556 443 333 500 
+556 277 333 556 277 833 556 500 
+556 556 443 389 333 556 500 722 
+500 500 443 394 220 394 520 0 
+500 0 333 500 500 1000 500 500 
+333 1000 556 333 1000 0 666 0 
+0 333 333 500 500 350 500 1000 
+333 1000 389 333 722 0 443 722 
+250 333 500 500 500 500 220 500 
+333 747 299 500 569 0 747 500 
+399 548 299 299 333 576 540 333 
+333 299 330 500 750 750 750 500 
+722 722 722 722 722 722 1000 722 
+666 666 666 666 389 389 389 389 
+722 722 777 777 777 777 777 569 
+777 722 722 722 722 722 610 556 
+500 500 500 500 500 500 722 443 
+443 443 443 443 277 277 277 277 
+500 556 500 500 500 500 500 548 
+500 556 556 556 556 500 556 500 
+ ]
+/Encoding /WinAnsiEncoding
+/FontDescriptor 17 0 R
+>>
+endobj
+17 0 obj
+<<
+/Type /FontDescriptor
+/FontName /TimesNewRoman
+/Ascent 891
+/CapHeight 500
+/Descent 216
+/Flags 34
+/FontBBox [ -558 -307 2000 1026 ]
+/ItalicAngle 0
+/StemV 0
+>>
+endobj
+18 0 obj
+<<
+/Type /Font
+/Subtype /TrueType
+/Name /F8
+/BaseFont /DDACTR+MSUIGothic
+/FirstChar 0
+/LastChar 255
+/Widths [
+0 1000 0 0 0 0 0 0
+0 0 500 0 0 0 0 0
+0 0 0 0 0 0 0 0
+0 0 0 0 0 0 0 0
+304 218 500 500 500 500 593 203
+304 304 500 500 203 500 203 500
+500 500 500 500 500 500 500 500
+500 500 203 203 500 500 500 453
+667 632 636 664 648 566 550 679
+640 246 542 597 539 742 640 707
+617 707 625 601 589 640 632 742
+601 589 566 335 503 335 414 304
+414 476 496 500 496 500 304 460
+500 210 218 460 210 734 500 507
+496 496 347 460 351 500 476 648
+460 476 457 234 234 234 414 0
+664 0 203 628 347 1000 500 500
+457 1000 601 500 667 0 566 0
+0 500 500 500 500 203 503 667
+496 558 460 500 667 0 457 589
+304 218 500 667 511 589 226 1000
+500 667 355 667 640 0 667 667
+1000 1000 238 238 500 503 500 203
+203 238 355 667 511 511 511 453
+632 632 632 632 632 632 667 664
+566 566 566 566 335 289 433 335
+648 640 667 667 667 667 667 1000
+667 640 640 640 640 589 542 542
+476 476 476 476 476 476 667 500
+500 500 500 500 292 292 433 359
+511 500 507 507 507 507 507 1000
+507 500 500 500 500 476 496 476
+ ]
+/Encoding /WinAnsiEncoding
+/FontDescriptor 19 0 R
+>>
+endobj
+19 0 obj
+<<
+/Type /FontDescriptor
+/FontName /DDACTR+MSUIGothic
+/Flags 34
+/FontBBox [ -121 -137 1000 859 ]
+/ItalicAngle 0
+/CapHeight 500
+/Ascent 859
+/Descent -140
+/StemV 0
+/XHeight 519
+/FontFile2 20 0 R
+>>
+endobj
+20 0 obj
+<< /Filter /FlateDecode /Length 20039 /Length1 177988 >>
+stream
+x���	�fGu&�^f�������ʬ-�6�jQ��T��BB%U�J*m !!

�@,
B��m0^X��1���VCSj�B�4�c[�
�qc��xp��͸��=p��af47�Q�����6����x�b�q�ƍ�8��*z0���s�-{����?�7�Կ|�����{�����ȯFS�_������1���O�hj�<������Ǯ��;�����������|=���%Ͽ~��w�����Z�����G<�?��@u.��-��{��7�w�g��=�o~�k^������g~+�_0�/\w�]o�L����`�[|�]�����.��\S�s�}�{��O~/J��1��{�����7\����'���4zydJI���;����^w�j�<�g2���멨�^�����^�����uW����+�=��7ܲx뵋'_w�=�|�S����ѱ�y������h1�5�V~OF����^�L���"zS����
O�g2�Y�=��a4��Q4���hN~�5�ۋ��ۏ�[J닄֍�&R_Q�E��_���'m������{&ڵ�x���;_�x&z��Kg�X{&�뎻��>��b4u��w^��̔\O_}h��i�H�sF�3�ّ��zv�k<�(�3���xfr1���\�1��\�Գ����bA=k�^k<��ճ'׍���E_=r=0��]g�����gF��޿�}f�+2��x��yqpb�[o?�v��g�vE�f��	C�3�wI��WL�v-�Y��̢��V.�w~��?��u������g��Z�}fî���>�����3�A~f6�OgQ~�K�l��t��d[�'�*?�6�)/��j����O�C~z;姿K~��gx������x���^,?s��g�~���D~��ڃWK-n��\j�r�d�����g��\f�r��ʳMV�0Y9j�r���U&+�LV���\m�r�d���5&+ך��2Y��d�z��LVn4Y��d�9&+ϕ�L��7�����ɿ�W����(Kgo��'0���n��<K�;�|Vݱ���yA)(�޸����&���L�O!�}?W��g��B���V�.�_jަ�����Wi��Ko��*(�����۔�淁��Lk��VwJ�L���{���@o��K��nܬ��aA�W�Mr�Y�C�_`����#�v��:}'���Z��yC0qn�!\ʐ<\�RR����
b��ǥ_
͗A�߬e�	H���͡-��R�F:UO�}*���k;C��m7C���N+mj}^j؞�{����=�Ig���x��S�ot]�-5��Fm.�]tsh+Oŝ�>�A��<�	k����l\e������\"8��{@�ˁN�M�L�^
���Ӯ��|�!�
+�g<t���`�`����ZV��?�:��<�&�M��V��r�tx޴�m��t4��6�reЎ���<�ѢC<kZۿ)����q/ж���r��k&�5����2����Z�8��O�5:.�+��a�c��=a�ߌ�ۋ4���z�>;��G�tq׮=��vy�`�����< 8�צ�6mX�/Ұ��ߴ���g{5N&�k��З�4�����ڿ�ܮaj|�	�k8���1�<�Ap��}�`�q]Z�l��R�mml�浆� �wl{Լ��Rz��ώ(L޷��#������R��{g�c�z�
o�9�e�Vp\��[��0c���7)M�
�g���j�Fx���v�U�5��z������(�f�n=
������bug4L
+���N���3ж�0�L7�fW�W�\j��%Z���}��e�Z�i-��
=��K:��
+�!;��i�m��}M����Z�)p�
}� 
 �[��oV0�$nʞ�;7���}�q]~
+��;�7s(�H+�1h2y
��@�y���}�u�����1}S���\@�
�k�;�c���M?_�qv��m{�>>��\9��e��5����i�7(��sq��#o����j��۪�8�oW�E
{��oy��w��"�3�����0ᦵ
9z%�&�wT�g�M#/�V���C_5��Ѳ�W�W��Fy'Q>����}{��3�G�utt׶�IZ/V�$p��i{���`�c�k3���uL]ܯ2�A��W������qٌ�kU8�c�:M㐺��j��*
F�2���׮n��~�;�D���4��QY.S��)�N`�p2k����<{�0�g��ٱH�Œ�h�3$�&P�y�o�ʛB�0��֦.���,m��r����]�����m����B�L`.�i��ԩ{�mbV�w#��2ӆM�p[U�0�ż��*���H���?+�;�U�:�}Z�O]�ұ4�>h?�Am)�~��խ���оݜg5�(n윦6���"��7��N��_q����o
i�P9����k[�I���67MyD��>G��Q��ӷq���o��8�'T^�ӻ	�c�)�A��8f�=ëu�gxȏ(��<)w�5\3�v��0�g���n��yv+��i��婠�k�_�
+�f�
t�õEӆ�]�Q�e8�b�M8�7���,��9�s���z���]�2�{G�H��e�[1���*����@���i>1�����(���{��K���x�;��R89gQ�Ƭ5FF�v��}�˕�
�6�Y�N�c��-�
G:�KZPk�YvI���*�r��o:v��3/P��v�(�5~�:�Q�S��nҲl�糊J��TW��F緋�U.�Z��s���ʱ�T�q�ϵ\s93�qݨc˵:�nS��:��\���~I���zu��z���k��=^����\jA�9I:�i�X?���^���/2�`�e�u�Ie�m�?ui��ލ�B��6��a��v�ۦq�����S�-����G�pg5�E�۽���ۦe�H������s���ռ�u���n��]@0q�����|��M�i�k}�6�����X9ԺZ�<Ϊ߬�?ڦ�]P?�[�}r�\�آmv;����z����8�5΁�)�g�Uo��n���Uo_hi��ym���4>�����Q�߮z�����5Զ�1�)�)4��OWj�=�ׅ>�U��:���+�o������W�6�l��}o�b�­8Y+m�;�^�@��k�J����j@�������Z�rk(�սR�l�a7����������Y�(�q���S�k~w��5�=�nh�c���o�6�)\p���=��_�ma	�z��
k{_���| M�v�-�װ����@��ֈ�(�z���ֈjm*=���m�k����4�C��.Ӷ�OӸ[�����[5/����j^��c�����*x�qu����*���,�~�*�ӿ�������9-�P�X	|c�.�SG����t�q�*��Z�nԯ�����wwk�uW�q��~��yI����g�h~\�
���)�C͏{7Ӵ�����=�ǕkI�F��n�>���T��T@�꫄��5�@��x�B%�������D]M����Z�!�[��k+K0�WJ���>�ɮ����:���5�t��4䷂��i:�ͼ����9h�j۫q��M�2]Mc
��TǺR�L��`n�s��� ;8��]Wз��v���6�5�����Z�C�p�­�%z=�������2����0�w��l�zЦr�N�6�Ɂ>�8wͨ��r�/�-;���x��e}��ʑA�L5�No1����u�����]<�
���B�#�s���\��*�G�2�1h0q�Qe���w�T~]m|Q�Ӭʖ�~\���#h�#�#�4�9���_C�C��G�u�B�E��OJ�`75�9@C��m��c� ��:3��P�n|,�L�+��ȫj_�7H��'ր_���5��x��O
�	�`���s�x��+Z��0Nqܕ'<#�w2O8���\9џ㝡���BZq~Rb���N���t��r[�hΒ=�,��[�2��=׉����	�Q�+�eA.֕��z�tJ�YB�]zV@��Ho��%��9�_S}�4�`�q���3�ļ0
Q�K���ʓ���WJ�2O}g�ʖ����̛O4�_8�9��˅��L���N�G.�B��<�(�gJ��zڜ��O��vZ�Y��i8�)�gxH�S�ܮ�Ω��]h��ͮG�d���0V� #0m@v2v�c�,�P7�'��{*�4��d]���)�w׫,U�NՍ�k!��ߨr�F��a���@t�%�WC�o�4�>(+�@�Bt���P�>� M*�n@�Bٽ��@����
*�,(���\if��r�}}��k��4k`nRC����<�~��HD}D�l���]m��vуv���� 9:�8G$W��`�)z�(
9�1n-г�v�c`
�O!�@���>8O:�h�sϵ0'�A7����|��q��|�k:CБ�Y!��s�-�
+��w�v*p�[b{I��� ��{�a
ѥ9��kh}i������g��3Kk��4_c�}�WZ�}JM�Օ���	�)l�w���n�9뜮��Ж���WMzY���-��X.�=y�9��Ju	�S�MU@�5�S��7�@�t[=�/k4�
$��A��>�!=�[7���,���Z5�M�k���J���[�o�g�yDcN����\�����<�}g}st8#����#�/״^_���N��{��`4r���C�
�J�s�wD��!z� �a�>��ӟ�Aƫ)����G`��wi��;�PoH����)���9�:�Bg�C(�S�L�����)=�݈t�X}O=��-4�ב�N=�{���Ѓ�>��ӧ�<�4����Ѐ��#��`}��]��ِ�bx�d�>���#��c���\oD��S'�'|ef^��� /�����Y?�ѧ��@^�ЎT/X��
�Y��>4�H'3 9e���!�2h��E�a^7���@�5t�����<�3K������z�΂��ݏ�-��ʜٽ`��@;^��H����Z����&ʷ}��Z#k LM�}x7������<��wp��Gz��t�8�N���˂�`
��
��j�
�g���K�+k�\����Kct*h�_�;��3��O��t�=:��lFD��p-5�<Ud#�y���!���<�����w|oL�֗��f5�5����*im��yoC��ң͡�3�ߗ4��y��mM�X�xu��c}yZ�v{#Z[ts�
+�{#�;���ײK�s���U�6��[Nm����P^�#��
@7U�=~
}��{�!}�
H��������³n�yj��U�}c궲]]C�
SZ��ѥ"}&�_�������U���9:�%3��TT�}2SZ;����$���v���Q��=�1���-#���^*�j���y���]<�T$�e������=U	yH�y�}M�/#����������O��*�hR���2Q��xt�����w�t�5�j���s��g�]'w�,����<��Ü%��h����]�f�����Ⱦ��q=�&[.\wG>ِ-L�_��S|���j�ԅ�����%j�}�KF�K
+�()�����j��x�s
+��zԎѾ�G<k@}�!],��i쟇yY�e�����<ˁ�]�z��8][C��q>�x��CZ�s��1͑q�m~5��Z�[�g
t�u�
�#�S
���:K<���z�)D;��c�k\�N�񍡭�����b�y�
+�>c�3�<Q�uA��!{����/P^+�5 ה`��:��lO�z+�i�;��+������-2�ņtc��k���
�����<m{@�v�g|�����5����5�oh;0�w�?�
�ȣ_����nk�o��4�,=�q景�M^��\�rS�"�'t��n ���3�k���m�*�[ܟPxl{Tw#�1��s�oC_جm�mz��j<}����#� #�]DC|tH<�O��46�}w
cb�z�դG�u?��ރ�p=��Ko�����^��iۥG�ڣ����d�P����'}\[GY�H	���`:�3$�.�{2�Pzt�I�mj��}m��D����Lh�ty�h��6��2fd�-о�;����_
:�>��2�|ِn&
>ҧ�
+�ǒ�9�U�~mx+g3����~.
��x���$��{Q'�C=b�fI�����Ni�lrzėk�f7ޙ�.�K����pI���2��k�B�+�]�q�]CN����kr�[��L�kN��
���T_=�'�QϚ����q���3��
H��'�1��L|SD�>�-���0,��Ѯ�����+�I��{곦��ȏz�>�	F9m�{?�8&�+4�=���3J+rZ�b�?C<%�~���&}ME鲌���
+�
mC��(c����ȂtV�g�l�}cM��<�^�u�ޏu$��ƧF{��d��'�צ�>Ųv�����T��7{٦���fA��(;��Ԋ�m�U�AvM=k9�Km��8w��<�O���2z����ԣSjHf�=���=|�OzF�1/i�jI�z�Yoc�m�{+��ZA�kN�(Ұ��֤٘�+���]Me�i,H=s<mr�I{p���U$�s�=h��''��|{�K�ρk�)嫆�h�z��1%���>���p)��KSZ/f:D��xe�ٳ���ϞœtU�g��m
9��$��kߚ{�+*�;����G�`]b�j+X�w6�%���~��g�Z���y���ܳ���ˆl�q�3���.��<�d�9H�4�,]����*��Pe�>��C�Zr�Y��=���W���0eܧ���m���yظN0=R�t�=�tG�6�O�W%�T
i����>6�#H��ƀ1���A�=�cX�Pڸ�Q����_�!�z���+7�0�G	4m�LC��J��2�B��s������\:�!��d��:�1�1�[t�c����!��@�9��ul#*X[q��b���ƱyZ���Y��>���s<�
�R��MNs����}�ɜ���c^Z{l�p�0�9iѲ��O�z<~�$w��BFc�o~���\��<���,���m�����l�J�3x?�tK���B'^�(<z��3��0)��F�+=s�Ƴw=�=��*i�,<v�y��������C��=e���3��)�ts����S�5���6-{�]����u%<ch���P����оg�*�c��
[=��q�4�K���x�Y�+�A�<����}�Y?�=�0��N��eK���gL<|��
��g<m��lKy�{��~�{<K
�U�l�C�W���sg	p?�|O�KA<('�3����ndz�@ۭANG�n�xW��Ja�aJk6؟S��x����s�;ܦ�x��ؖy����wu`\���
�3M< �W�U��]�;K!��l��k
+�x�9��61�}��g���e�WY��<�z�<���x�m�$:���i��u��ߣx}��A;̈́������z[M�T����5d��*���:aIz�!��}0�	�Zw
s�~�~6��.=ki%��S,Z����,�K�x�y�G$%]�cB����j��*�<O��s��rޝ�Q�t�>�#�}���~�0�b�/L|7�|ސ]*ڃ6do��>��d�l�{d����=�3=�C7�O��r�z�����7��ܑa�]k���im��bg8��7d+�#���c�g���ֵ�y,ګ�d�g��<y)<y�(��C�l8zT��T�!�鑾��<��V�&��*��
�������P�k���=�=jF�5^ˬ=ez���<�)i���Ιmn{��`���gM�\C��s��d��#�Y��ܳo����H�RS}���X�^�u��=k
�w��Kj�C��]���Ѻ����j��1M|�	�D_8>�*�W�5X�~��ty���a�+���U�9U��nk5�*��G��s��ޟ�0)h
�^%�5�o��!��'+��<4�}�g
+���S�=w��=W�;�v��=
Zʔ�=m0?�J�W9�<kҩ�l�}��yK��34}�&e���:߁����~Vy��ʳY�<�ŝ��0&�!���:��x�#
i?�k��zd�q���<�~����O�+��g��Ȃ�x�y#�dž�"���G���L�u�~�x��U���%Ц����ߐL�<
+��sϑm�o�P����i�ꓳ�m4������HN���};�O�gS���Vأ=e��꣡=Ү>�{x[EkӥG��:��Yh�Gh.���6�{�}��ʣ_D;�
�g4V�?�w��'�^hcQ����
+O��K�ME��[���3{yOn�b��rrE�����6|�R�g�@�c�U��s���ʳF�{o2ϞG�cJ��-�MB���-�83�q����3�����X�ۛ���~�?����ߴ���fM�LRyl�r��|��"���ءW�[��cP���*{V����E�ὤm{�+���������A@���ֳ0����麳x�y�U������ι������J�랇�U���k�
؅��^�c{�{x� ^~m���K�t:x�p	���v7A�ۤ��7/��}�q6^~�,���lv���jڃߧ��Ύed	<+� =���g��>���d"<�G�Df!�dϊlp+�-9��6��h����I�ٷY���T[��<��9��xL�2�c���]���w�8��W��<{]}g���Y��Ӎ�g��y/��]�&7�yhA�*�K�
q�pߒ�/?�y>^~~�Ơ�x�ٌ86
�]<S��u�9�=Z��h�Ҿ	�8������o���ܒh�������ij�F�l6^yN(���4�$g�7����%������_�y�hS�g10/kC��_ܳ���t���Ư��_%����l�N��-��xѦ��vݣ{<Cz�<�
+����(I�Ii|O���I�d����{����ݑ.�"n}�Cs��R�+��o2�9-~������,<69]����]���x�qO	������[�i��[u����
+��c���YA���G��@�P�,�R^��j
+��}Ę�#�`cҥ�J�=���mgz��c�4����Ŷ��T�FT{�N������ث�������@#�7`[�1� J�����aI�s����;��O�5�'z��LE>� ���Gb��ʣ?��������%�*�#Jȟ�#�w�x��^2�^�*^yF��N�i��쳗�<��-��csT�����s�x��<��9γ���\����
�Z��&$�ϝ��ך�N�Y3�x�=��h<�58�x�ҡ״����z�w,�x��ګ�k�{���k���<k�����՞�_����"^~��\V�m���Z+�=�+>[�G�ؼǴO�n��)]���<s�^���FMke�?��;�|��g�&�x�ʳ����3_ھU�[#n<�B�|k<|��}�95�ζ7���9��K��߂�'k�?>7����l����M񼆌�1��|�fIk �ެ�qw�ݚ��8�u<v�n�ꐍvF����
;��_��ہ=�(�74����C��h�2�q���開[滙Go�{��a�<����{�88>}*����~�|�O�D�bG��$�5�˘~�'E���/�ܳ���Qz��c[��+�衫�4ƞ5*\?N=��"Y��-ڒ�
����
�n̷F��zs۾�t��Uo
��W�i�;w~��|{���be��MӒ�Xd��3�KO�±&�W~O��mO��#���=���IA�W����E����qI�/��2~[u��
�[��������$_��qmfr�g<���
����<^~n�`߹��֢�W�ݎgӱ~��،
i?	~%%���m�����Ў|/?W��ۿ+�6��!�-ԁ�����}�YKO��~�m}<��\����W��X{l ��:Ͼ��z�3��ɰY���h�0�q=#�l�$6�+�A�xx���.y<((,���s]��N��+�]�(<���G��M�MG�b��{�{�]k��p�(�2����k�g�9��VQ��H��1#������ۿ��cF/?g����u�7�x����h������{�s�tk�{`�ψM���7�[�������\/?�"�!�ȉg�u�G.�<s��e�}�٧�q}��l�{�SO��H�6^~v�+���ߞ�=W5���[�C�W葾
�=YR�|�{��xd+������o�դC�,�q���$kH���[ix~qI�d�]AqI����������@������P�%��鑍����m:�4�WT�%�[��/�����b�X��xD�F���>�)>O�G{��T_�s]|�C���y��,�d��G�o<re���Q����jɏh34����;�-��ON<ķ׌�'��iĐ���ߘB;���iO��Cޛ7���}�� ۄ�#Z{x�������,=6vl�����AK�iHыۿo�<�]߳�o�����S��"����;�g����ܔ�w����3��{li�kZ�[lr���+�{T�~�F>ҥ�/��Sګ4���/a��}�������}}��Q�{�ٛ�g��{�U��|�O�'r���msԚ�ܧ$7�~h
<����O�|?������m6�5ѐ�*<{�Y~�=��ԣ��x�v	#��:^ynKE��^���^��Bn3>[�£K�=aX'�']XI��I��{暾�8l���;����N>{
���gQ~{�[�g�
￮a�pN��h�J�}G�la��M�ڳo�������4(��߾彝)�bY��{��?�M��i�,����g*Ͼ��GXzt*U�?[��r���[3@����ŧk��>�����SZd�b;b{9�C�N�z��� �-[En�}�F��)ٯu��$�Ƅt�]�U`��xơ�l�:�Cqt��:%��2��
���	�K�G�„ʗz�;Ӗ�жr���p�R��r�3�מ�*�w
�n�INih�ѭ3%-�lFzc�5z��ob�d���#�j��ORZ�ru:�mn��R��g�+��g[�gV{�Ij����&��r|NB�<w�>Ͼ����5�y�oM���쉬[�|�}硎��V��+ϫ�������}õ��إǞ��ۿ�P�������}
+I�E�e�bS�+�
೾ʖ=(��Q�ϫ퍙�웨i
�n�%���{�C5��@mm������mձ����#�{b���H��^��3��-{a}gԗ���l��ǘ�t	؎�q~@랍G�������Am��}���w�Y����}�t]hW����h�<��u��OU}iMk�9�||��sO��y�6��C�Y�$��������o��0^y.
+��gtw�ݔ��6��k�F��3�b[���W��Fy���l�����[ᱍi[�*������%�<��#-�|�k�󬫖9s�{,<� ��FD��o��s�+oF�r����vu�y�>������>3�Ρ���~��W-vK�y�r�]{Nr��}ի�%�y���X������U��<^yG�9XM˸X��w�����j�	��%}�.���o]7�V���l�M��vD�a���g����2<������Y��Q��u�<6ЍG�����eO�ϯ ]���M�9}E���\�ѣ�-{y���ܾ>Q�+ϺhZd�ڣ#�HN���}��W�]:�Xq�[з��hiO�t/����	~�|�Y�@=̀�vƤOb>ʽ7��F9�O�!ޚt�5�
մo�g?7�W�[�tK����=�֊�x����U�v<���t��[t�x�y�����q��0=��_?n�gǶ���.=����Szl{�x��+J��]/�.|������gyd��կ��*mYW�!�ب�-���϶{}�[iK�y�ضVP���%���-�vY˳4^����C/�p(;���x�h�ٟ״繍�g=���}S�XEf�Zl�W_�g���V�����ą�.4��e�~V_[��s��c�L[�ʶ�I��t��[��(����v�z��
+ZsJWٟT�j��TP�|��L����p�-m5��[F6�Y��'����</<z�do�'��f-���'=���v���^��W~��gK�y泅dž��i���2�=	Y����OR�;}�8[����.n�;se
�ςm���ܙ4Cp1.w��HgA�q��[z#��l��L���,�[����������8^~��3��=o��ϩqy��v���q��l�y�ڏ��.������Bx��D�!�0σ�<�h�;S˹�艶����1�#�z���T�C��50g��[M6]m�m�Sd����t�����98��*�6�Xc�GяW~�߲�ö�}Z�����? �a��=�K�l�2��,���l���
+�s��<>�=��^����۽�o��u�£�B����KA���#���������f]�om�\e�.�y֞uּe?GA��c��ܞ��(C��ߖ�}�x��0^~^g�bk�kL,s5��&���>��;@�!|�M	���斝�9�����H�S����lt��=EB6(x�O�֞�x��>�
-�5a�� ���s�� l��z���<붔-9|�]�J�筥�f�}p�eo�l���
��ǭ��(�In��)#���Ǖ�/e99�W�
��O~�<6D	��
+[�羯�k�	��s҇fd�_{�JZ7O����V)�=�`�\�b���}����|�>�-6,���R�;b�s��޷6��^�j����K���-��\�a{��H�[rr�G^������3O��Ȗ���V�o�ˆ����l�l��ۤ�x�7S���4����|�c׍�(h,Ii~������.d��{7^�e.K�c��y��6q�D�ҡ<򙌙gl��؞xl>ٝ�W~ò��[x�k����<��|g��7��qp���4�6��&�f ��h�s��9��L��f���r�[鐬���ς�]#ی������7?�������vKN:T�W�������ob�mD��gB���g�;/�~I�ه�6eI��LЊ��V�gPǷN��kJc��#k /�oZH�׋�#���q�#���p�m�6ԋW�=���TO/<<������{.��ܣ��s�pm4��
Tī�x�=�ܸ�����=���*�Ti�~�kWe�A����<^��*���߂����إ����'���D��O�;��.����ߋh�o4�����@�}Bף��q���|7��x��R�|�����>T�k�n����W���:�Q���eC����D����Ǯ���d�m��oi��9M�
��JH��v��0�z֪qoH�n%�'�x�9�s���ߞ�
��g�����i~���u��ŵ���DI��<���~�$:��)�y�e~V�\۵=���ϖ�=!�k���y�xA��^��
E�s�C�tN=-����S�{�Ǟ>�[�KHP�ܸ�Y��+�j�}wG��m�o���5�5ćX�Έ3}�J���Z��޵��%&уQGP(E��
$�E�d�|����w����8�bY����y����)�+jX��˿Y�(Mp.���v���B��,8���P�Ӹ�#���m]{/��ع�'��E���	n׺=����A�+Z��nn\�a�͂+������z��ڮ�hZ�h<�m�s��w�;�vi~^�q�g'5������v{Pq�֭9��b����S�H���wB��	m��W�$x���h�W���y�^߮��|^���(-����?eڈ�G#8���\�nO0�\ï�wSE����}ӄ�Ѱ澫��ꗩ�}�i�������„i:�������7��Y�yh4�&�Z�I�e��1���yD�?�t�;���Q:��Di�D�X�t��q��7Z����Ħ�\W��D�J��+�m��;����r����R�_���%ܧ�}��=��_��<"��B�|��{X��)��)������Q	c܏�>$�%n��B��~H��Aq�'q�&�UҺM�_%�1e���#���m�˳�y����&:(�9�俗��^��-G�Mhj��!y@�{�����sZ�2#~]����$��L�/�<\&�^%~�h����'��#�_�h��Qy�BK'S�D���G��M����-M�yc��K�)�/Ͼ�v)���Jw��x�օ�m�)����SJ�G%M��'���a��.��wɵ���Z��+p��w��ۤ�"q�ni7���M�����S_�5e5�9ה���=m�-[]�F?,q|J��qߧ��|���iSm�#�O�M�����k������	�_)8.m��y���=>*���=�G^#m���V
L9&ύ{����;ƽͺQt������
�a�4K�^?��F�'�k��탦L�̺��g��+[]�gM�1�?T�6Oo���ɳ���S�ϙ6f���{���5m�B������{W~l�jݘv��g�x#���V}��O��Rg�I�
N~X޹[܇��QG&�~�]�.��2������\'ѝ�F�o��s�$�����V�^=$�?#��Ӿ�H�ƭ���Z`��Y�I���M:�Y[G�6/�x��\�5g*qw���w����
�)�OX��41�[��m�$��e�l�� q�#y�r�x紥͌�����ܛz1�+�_����Zg%��,���������
+\/��$x��6�4�]��7�q�Fh�F[%�K�}���\~�`���W���g�*�N*���yv��93ѵ�7�g��wʶm����#���Z7��^�&����s��n�����a���G�NVܣc�1�a�
��k������
+��|���/SR�#���h���<zP�+U.;�~�<�_�w�iG���u�������7̘���~���'�zʎ����>u��f�y��L��?O˳A�~������Rz������}�>?ώ)��l�h���.e��߯r�A�e��u���e7�{Jq������{v\��V=�{�͏��k'�ބ?a�»�6�����'����]����,o���8��!aOK;������#<�cy�[l,�ƕ���c�}!���0��OI���	��<`�vl|�m��Io�l�n,}���#�~���Z��keL�W��=����E�}�`�3:�_#;��Ǥ����ay�G���̓��:�;��8�{�^6/�|4��k�O��A�G��kd��Y����+z����O�8&c��U7�|����+-}f�{&?j�8�8�g�5t6�йZ�“'��{TFv�����%_?ci�[���%N瞶cC�q'��u]~N���V7qd6>#�Y����?[�uc�dl̥���$:��*8*�!���9�EAo2YY�e�I�W��=�����_��ѹyŬ��C��d�b��\B�2�6����MSa������lۿ^�H��~�)�=�#z�m����d,Km�����bi�/��ߐ�w[4V�?%~����Ԃ\���8h�����j��i���ʷ��N�}u2�8m�>e���۰�������:_��q�ꔄ�$ڮbyn�e���j|]۶~R��I[�i�g��GfZۿ]���6m��9Ya&�'���V_'�f$�KSS'�r}T��Ӓ�J����\`��I�C�.qߦ��ݶoM��K?��O��d�ݼ���va>յrӃV��b��K��Fk*CK���I��,��V�x�Y��ڭ�vl���)S:O��i�����m������O�w�}�nG�dO��Y���EǟN[>��l7�?)�w�l��&�>pֿ{�=��ù-G"|��ϱ��F��|��0��ɲ2��b����-Cb�߇��[�!+Cl�2.�,�,��;����{�;����jzm�l�~~2?5r��tF����£�nt��oo<�{y0�Ly�A
�UqPe#7X=��״~��7�8F*�l�뽪��B�L�zu��G���x�
��]�ұK48/���8��[':�_��������'�vwF]痺��U]��PGF&�	��?|�>p�5��C��@��\�^�u*g�.���?Km��ii�qnW�{P��\|=�
+3
�R�/��݄�1������]j�����;y�џ���(��(��u��Ȑ����#y�q���v�\f�b�·v�˿g������fO}>�<��=�k��
ߧc��s�T��ݽ	��Y��.��=�0�\�v��w��g��w�
+3��DsJ��)Ex����$m�����H���3Z�>J�>��[��a��I�/�`�����jyfpN�YT�1��Y
u��^���'sq��Zع���O��N/s6��O��t�>���3��xzTu�5�.��� i��U��+s��TT���֒�Q�{��c�W=ҕ�g7iY6��Y�7�l����`��"��;�����5��c��L3K�=�z"#�W1��8�Ս:�\���6ե��9�Ś�X�4;�������nb^���}N�`��I�æ2L���C�>zv�����!��~�������S6�̼
��.m�w���\��ݦ�<��ޮ~�4�\~5�}�E�sآ�����'YԸ�{{)�m`?�[˱��m�0���}�nV��-�V&��\u��׹�>-�~�����]���5V��5����x�^/����r�E�'��%�-`����Xi�V��j�O����n�l����C��:�����_�u�Ny�H���ޑ���o�������z�H����&�E�����������z}^�����»_�}�ܷ棯��o>(�O�\�{�$�ߓw�B�e�&�r����R���ߍ�#����;�����[`���������/K|&����ݳ{ߝ��z����r�X�,����H������H�������ѯ���,]��6ȵ����\�`Ok}C��}��פ�f]��/��s����e\�綽����$��(a?-���$�/IzR��7��/$�?��]L|�|_��W�:}W�_)to�<g�e�q�G[w��/��$�?��~�l�_���a��u������?���������K�M:i�S��>���X⚓w'0��3��$>���|�ꖫ��|�泒�L�������u�Rh_��?n�؋�i�ߒ����>ߵ��ڇ˻=�7t��w��w��)����WR�߱:����˻�۾}��C���w$���x��<7��sR��K{�����ǔ�1��Ei_��_�t��?�����N�l�U���ז�FnIy~���{<�@/�Hݕ�|M����Ɔ���W��L�طm��m8Ӯ~�ڑ������C��ܺ�i+��q,z��ωTof�߬�;��ީ
�Y�;�έ���g������J&�C��/���gw'=zZ�͜��Z��\�/��������>!m���VL�����"~_����������7k-��̳/��������k-f<إ2�H�����F��!��g%�	��{�Ց}�X$�Qt�������z���c�K���!��]����s���1;�2MG�����m6}C��U�8��{����h�����w�klC� ��-���tůkם�S�#��vm��>.�>,�Yw�Y�������i\F��A������!�O	>x@�i��x�/�����4Ο���|}D���]�(�Ϩ��/j��;�6Y��Jxc��^����s!t�Fϲ����&6w��.����`W��]]��vu��.����`W��]]��vu��.����`W��]]��vu��.����`W��]]�����]�Vk������O5�ɇ��~B�ߕ�>#�?am��_�p_�U�?!0����s2/�����*q���?Ae���{6�	~[��]�^&��K�na�~C�
������s�7Ͼ!yrxB��#�B;�!�×l<��׶\�-~���?��~Cm>�$ן�:�����Ӥ����9q���+��'�d֮�˖��nW�
	�%���:er_G�)�=l�k�G}Y��/H�_�y�I�L>�oa��	kf�y����D� [ZZ���Z�%|.������|�j�K��G�I���K}�r=��g�M=�����R������}I�qt�о��ҳ�4��O�|�r�[;�',�s�U�O�r�B����l[E� i}I��Z��K��K|�+����T^��'l�svu�m��>,a�����G��i>z�ک|V�ڮ��;$���� ��`Wvu�:�;�ϧ��RG����
+��Dh�B��Y��@�}S�?��e�I��în}��vu[vu�&�/�&;ћ����2�����ϓХ̒���ܳ�j�?+#H)���_)��������W��R��%~�D�Ȝ�viy'���g�x*�T�{����ke�v��8ϒg�K<'�}StL�:"�u�<{a���r�ϒ7�G/���Nik���B����YiOu���ϊ�0:$WC�4*)�X�U����;�䫒|n�!k�Yf�mn ��7�wk�;���</���%��M{�����Tb����y����Zw$y��ZB�WF��٢�Ƥ�]�Z��\/�m6���
��z�����w��e�p�l�~@�0�|f��|���5R�S�ۅ�*�m�I�])T0e���c�ߓ�Zr</4���s��u���H���ƒ�X���/����W��o���y��2����\�7�ߥ�5��M�x�K�0mkA0/�k������������]���,�#�ʿɹ��<?)5�d�Kjj���Y�c��#�������$_k$G�_C�-��^tE�_��]J|���K���Jj�����y�*7]L�5mv`ۼiw&7O����t��}XR��_&y�WZ������\#T8�B�*,��v��.w{����ډ�D�^I#��*y넔�xLh�&)ŵ��I=<�>y���.O�I�W����l�ϓ}�������[����^�M���k������C������Yj��/��V����l��n��)���_`�w��VIi��tQh�Cj�"����:�:!�Kf�<=)i�k�/�{��>��-�g�ͧ�u���TM͙r\,���\�s�����IS����Vq���!IkIpLR:&%6m��q�-����r�_����"x��������w���E~/�|�XJ�Z�-��d~���e�ZN��
��
+��W������0u�Ӗr�-�E�m�?�{��S���v]��\C;&56���g�_Z�X
+-
+;v
�X۵1�v,��7̈h�(�&s׳�+���v워K��m�Yf)=�ۄ���ifr��ѱ�8k��{Cc�J�gsӵ׹���۱צ�E�u_��>�v��?��/�O��L���֍�s��3�;��qt��g�3�Cw<v��h�c�.��=��.i׏]�]~�m��͛�gQZ�c��E;MZ��h�՛������v�Q��oܤצ�n���r���ni;�z���Ez�_Z��z}P��%�����$�� M�S�����s���\yT~�}��<K���]j2f�Υ�a�G��
+i,���U’���զ���5�(O��u������!_��ϕx��)}���+����9�6�ٰ3>�Ou�;3r;��ͣ��n��3�K��\����}�������#��1���̳�Q��]:N6_�����r����E������J���o
u������:'M�瘟�n�?�{������O��?�Y��x��yhq�Ik�9~<                                                                                                                                                                                                                                                                                                           ��G��q���F1ő�E��*^t��7�߮�q4�8����'�H�uO>��;��T���\L�'������F�(���(z��ߌ��4�*�Q2�I�f�4�z�U���@�
̋7_{���C��'�i��rt*�؟�;�~c�+���)���n��^�\�ߢ��,~�}�|��_������[�y?���ּ������5�����L�������"
+endstream
+endobj
+21 0 obj
+<</Type /Page
+/Parent 3 0 R
+/MediaBox [0 0 595 842]
+/Resources 22 0 R
+/Contents 23 0 R
+/Group << /S /Transparency /CS /DeviceRGB >>
+>>
+endobj
+22 0 obj
+<< /Font<</F1 4 0 R/F2 6 0 R/F3 8 0 R/F8 18 0 R>>
+/XObject<</im24 24 0 R /im26 26 0 R /im28 28 0 R /im31 31 0 R >>
+/ProcSet 2 0 R
+>>
+endobj
+23 0 obj
+<<
+/Length 1134 /Filter/FlateDecode
+>>
+stream
+xڥWMo�8=�@��[ eI��q�t{�����{Pd�֮>In�ߡDQJb�	l��39o��>@$(a
+(�EQL��5��Ԅ+�J���\�e
��n>m7o��=�X�H"Њ��m�ټ�=��
_�U�̾�}D����w�y��y4��4]~�gig�����i���v�	W�K�D�fv�$�關/���nM���~����W��|�!���FpЂ
%0�	U.,�S����tDD8b}�b��c��<��	����H)�Zu�N&�L
�)L��m]����Z�\���nG���	xQ%H�y��F�::�i�Ww���E%bI�:�������)?��ꞪZv�$���b�R�q�
A��bGx'’s�V����+��ؔE^��.�}ޥ��.��I�������4e^!d�k_�c]e}E��x<��
��	���v�{bݘ��H�����le��deJ�$��:���w�������t����0�����Enڳ���SL��A�}W�1\싾˥F8a2 �:-C]�Z7����u���,�Y�f�xN�S�#��c�ҕ�n���^�zuޫ����x�LY8w�c�xY]�Њ�$
e��)���IJ	I��3i;�E�j3��O�G]����o�R1/��]��6c��3f9�w��8��g�s���&�k�z�>�w�yQ�W�7LH��W��&�E	Q�\��]<c,����.9�,�)����#�ϘI'�=r/�<��DJ�՞]��C�V��lB]��l��Y4bs�w���:Y���ۃ������|�$y�LbX����p���9�%I�r�1e��׾��US�"���A{˸�mn�2S�<�n�g�%�V깮	�8�Y��I�g̤����8�������cH$Q�i�?;���X(�I�e���y��Ր�G��i�O��]�À����O�4���� 	/r&;TxK, ��]�Ϣ+�/�Q�V��%�i�ؙ6�W���YV7���Ǽ;�Yۄ�n��6N�R]�L/ْ�$�Οi���x����`�����>�
�����gw���%j؟s{�y����%3���]�@S�C�e��T��Jb���س����S��MG�nȿ<_�
+endstream
+endobj
+24 0 obj
+<</Type /XObject
+/Subtype /Image
+/Name /im24
+/Filter /DCTDecode 
+/Width 642
+/Height 638
+/BitsPerComponent 8
+/ColorSpace /DeviceRGB
+/SMask 25 0 R
+/Length 11198
+>>
+stream
+����JFIF


``��C
	
+
+

!(!0*21/*.-4;K@48G9-.BYBGNPTUT3?]c\RbKSTQ��C
''Q6.6QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ��~�
"

��







	
+���

}
!1AQa"q2���#B��R��$3br�	
+%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������










	
+���

w
!1AQaq"2�B����	#3R�br�
+$4�%�&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������
?��(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(�,���TfU2i�c�
@QU̎{�I'����:�I� �U�	�������4P�p�4y���4P�p�4y��j(5}��S֠��,oS�B��z�EZ��aКp��|�z*!7��	T��>�
��QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE���
+*6��5;7S@3��4�7���*)���z�mP ��(��(��(��kƗct�h�yo�K�?�2����yM@���?�[t�h��ñ���(��(��$a�?Zm
(��~U un��Q@�TUu���H��b�Q@ �9��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(���8��P8^}�I9'4
+M����D���)�(��(������R�}O�O��@���f�"c�=
�թ�%��E "����P
EP
EP
EP
EP
F3EҊ�SLJzdT�P&؃L(è�4PZ*�Un��a�)�
捗�~��QE���Y���tP�`�
-U*E���ME !�A�- 
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��^�������J���ZJ)�QE(������zԋ	�#��8R�E^��EQEQEQEQEQEQEQEQEQEQEQEQESY��u
DGNj2�V�
+��)�Z���#��Q���(��
 �T�(<7

j���W�T����-Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@#0Q�H�{�ŎM+�oaM��b
+(�"�z�zԩv���zS����)QEQEQEQEQESY�z�c��:��y��҉T�TP��Uur�?*�X0Ȥ�EQEQEQEQEQEQEQER2��)h�2��E2�S0܎
0 ���S�)(P	"�(d�7�RUZ�$�
�ց�QE�(��(��(��(��(��(��(��(��(��(��(��(��(��)��~�I&�Z���h$��ESQ@�
+�#���R.��T�QHaEP
EP
EP
EP
EP
EP
QJ��?|��}�0
+(�"L�ǥ��s�l;U�)�J�U�*I#�̵ S�QH�(��(��(��(��(��(��(��(��(�e0EB�稩�
+�T�u��*b
+(�����*pAV��P�P2���2)iQEQEQEQEQEQEQEQEQEQEQES$}��+���U��ɠ��h��b
+UR��R��*�D@�ޝE�(��(��(��(��(��(��(��+aq��R6��jmS���
+�*8W��IHaEP
F(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+d���u��@H����:�\�
0
+(��G(}�� ���N���jX��sE 
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+F`�&�����Y�@Ic�IE��
+@	8a ��b���QH�(��(��(��(��(��(��(�����N�j�U��QE:!���"p0�R�E!�Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@5�8��Q@H*ph��ǽW ��L�(�D�>�J����>~S׵$��)QEQEQEQEQEQEQEQE2W�0:�d����TtQLAE$I�����h��O��C
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��#��CN���6����pMCVa�c���@QEQEQEQEQEQEQEQEQEQEQEQEQEQEQE�p���@zQSJ���Z�����Q@�/�:�#mlՐr2)(��(��(��(��(��(��(��F!FMV$�ɧ��l��L�('�E���c�".��-!�Q@Q@Q@Q@Q@Q@Q@Q@#�M-E1�
+��(�!Te��5#/�J��Š(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(���0w�5d`�Z)]v�))�*H_�O�Q�@���n\ө(��(��(��(��(��)�6���Uys{Ph��b
+��#�Th��g�
+(��Q@Q@Q@Q@Q@Q@Q@Q@W����S�ڤ�j`QE&�aI��)a��0��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(
����J�QL��?`EEP!���5=U��m��(�(��Q@Q@Q@Q@�����)�6���`QO�w7��D����4�(�0��(��(��(��(��(��(��(��(��(9�T4�N\�qM�
J�,%I�gҁQE�QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE��E
Y��"���r7zT4���k{m
j�lm�=�ԆQEQEQE�jN�fl�=(:(����"�\w��\�{
+���QH�(��(��(��(��(��(��(��(����Z�c�ր!��)�*hF>�
YQ���ER��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�U�v�f��r7zP4QE1������J��*
�(�
EP
EPNj�9$��'֠�
E�70�%ڞ�E�QEQEQEQEQEQEQEQEQE�.}�bp	���(��*�f��|��TԆQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE��(�
+�`�EI0�g֣� ��<�Pӣ8q��,QE�(��(���c�ң�c�&�����u?�EV#A@�QE�(��(��(��(��(��(��(��(��(���c�ǭCO�����`QE'�a3�O�Q���Š(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��2�ۚ�V��1�J(��T�A��Br����QER9“KL��1�@QE�*��f��e��=!�Q@Q@Q@Q@Q@To(MHN:��:sP�,y4�����f��?ݨ�	��z�R ��	S�q@�'�bH���c�ǭ  ''4QE1*��$#�&�&��)(��Ϋ׭:���{)<���	�D��OYT�P袊(��(��(��(��(��@'QQ4��Fi�G=�@(��c�z��xP�P# �@Q@Q@Q@Q@t��w�QMY�
�P
ES�(��w�H��:�
��T>}jz�a��@�E�I	�����g*�!�Q@E9�
+�����
�QE1�8&��D1��QEQEQEQEPN:�N*	q��@�[���QE1T�Ƿ�ց�X���R�v�>�@0Ƈ�F��r*z(�+1lg��X�Jb
+(��
+��ϭAVTa@�b�E�HH�xj
+	�ɢ���r!s�R�I����s���M�C�B�u8 ���O�������E�(��I�F���	)�"���T��M%0$3�b�Y�Ri(�C�B�����ŎI����O��
+[��;�oj���+*pF)*�(a�U��H4��NEXV2*�9k{P�(��Q@��5�O�@���<�M+�S(�I=Nh��*�`OZ���ɠc�R~��'=h��Q@$���97pz��p��2�6A�4�:��QLAҭu��aP}(�(��Vs�?Z�UO$���(e})h��Š(��(��(��)��с��%|���GE�QO�7���c�=jJ(�0��(��(� �t��_��`QE�.X�a155!�G1��֤�g�(:(��� �S"9A�O�1���Ҡ�DdUi�QE��I$�xh��~5}���bX��E(��(��T�(
Ѧ�ҧ��QEÐjZd��(��b&�����*�{��QEWv���M��L"�,�K
+`2�(�AEP
J�X�P�X�*�jģ�4����E !�=���O1�c֠�
EP"�r��KH�p})i��~����e1O��PT�����d�QE ��Z��p�*�0
+U���IN��X��)(��(��(��	�ɪ�w1&������
EP!T 
+�Q�L�p7zԔ�QEQEQM��
@�,M%SQE
<#	���
�-!�C?�5E8���(�"H[
�Z�����VA��Ũ%]��jzB�EJa�4�)���
Pm@(dV�i�R
�5�Q�r����9$���(TЮ=�D�s
VhQE�(��)���4�d�s�(��bpA�UV��ʏ��(�
QL����w14�QE18T�&ѓ��1ʡF-R��F8Rh[/�JeSQE:5��,
�QHd}�™RO��GL����jX?��%��)�>��bO�j�0
+t�6���@�QE!�Q@Q@(�Jp�Z���&��)�)Tn`)*XW�P�(��C
+(��
+(��
+�s�T�^C�4�(����ˊmK��KER��2��EU����"���������EZ��r2(�0��(��(
��!�⠩&<�Q���(,#�T��6���QEQE�*Z�c�ǥ2�(� ���U��pP1�QE +a>�>V��ҙL�('��w6OAS�*�P)i(��)�	B:��Ҋ�T�4��*���:�Q�KE 
+(��"����Y����KSQT�u4
5QH��
W��ҫ��G��Si���@�QE!�Q@Q@C1�������.h
�QE1YA����
VhQE�(��(��F8Rj�M1��֡�
EP �(6�cs��@Š(�
EPS/F���
�EV#�(��KpV���v�5f�Š(��)�p��w14�QLAN�e�6��|���2J(��Q@Q@Vc�&�9�U��QE*�}����hp�aH�
+M-G3p� !<�E�,+�G���
��aER��(��(��(��(��()��������T�u5K�P�QE ���Uj�Ui�R��ZJ����C
+(��
+(��
+�y5e����(��>��T��KHaEP
EP
E��T��S��S(����($
+���֤�(�0��(��(�f\޵5#��"�+QE�b3�^�����(�
QLx������E�eF���e�X�aER��(��()�AQR�nbi)�(��U`*�A�gҧ�0��6�&����5^�Q@�a^�R�(ڠR�QEQEQEQEQEQE
�x}*:|�~�L�����h~����QE 
+��~�f��1!��E�YS�ږ��b�HaEP
EP?�o�V�-�OҫS��(,
KQAޥ�0��(��(�fl���+�MV''&�Q@���rwzTueWj�@Ţ���sޫ�I�9��*ܩ��S�
EP
EPyF��M�gQS�Dq �ҩ��,�E�#)5Z���@��i�QE��STp}���)(��(��)����4��#noa@
��)�(��F��&�a3�O�q��f��fn@��X剤� �D2�ڛSB0���2J(��Q@Q@Q@Q@Q@Q@��CM�c�'ޒ�����Tb1��ER�g�SS&L�PQE1@x"��!8|z��QEQET�V���}��h��I
�����G*�!�Q@R;m\�S7;EGA99����('�$�r����v���C9�
+���GL�Fr������ƀ$��)QE�՚�����z�4�(E�2�h��p	�2	N\�S(�E1Q@C�O֤��=EKHaEP
E��2h
����sPR�l�J`QE
+���{�q����)�6���+n� ESU�P*��f��QH�(��(��(��(��(��p	��)�f�+�E�d(]FX
+�@Š(�
H�*E-
V�t�:m18 ժ�S�r�ۊ>�(�
EP
Q̹\�T�u�
+�S�v�;Si�*�6��W�V*r(f��L;�(3/`M $$
�U��7��������(T���˜�����JQE "�t5X�w!�0
+��PT�P
@��)QEG$�h
�����(� �a^KT@p*ʍ��b�&8Lz��	�_��eQLAEP���5b�ӖB�u�EE���f����MW��jFb�M%0
+(��8I����T*�R�GJ@5�j�U��>��AL�
EP"HG͟J���|�ԝ)(�Zc��qR��
-Q@Q@Q@Q@Q@E9�
+�������(����2�ڧ��MKHaEP
EPs
��j��X�S�!l6=j:
��-QH�r�KHaEP
EP2�5]����4�4
Z�{DGNE2���(��(���➑�p*`EP���)QET2��Ҧ��*�	 �x���Qci�x������TtP�F=�*mP
GZUR�T�^z��ѓ֟E�	��U'$��S����(��*��>T��:Q䚚��h�$��OJ��Q@Q@*�c�NX�����B�
@�D=�w	N�f���H�{
Lgf�i(� ��(��(
�!Q�CH�0zSh��G�W��V����QH�(��(��(��(����MO)�~*
+`Q@ P"�c)�QHaEP
EP
P̸l����]�EW��)����jj�9�(۔-QH�(��(����QKEFa��O�_�KEF!�4�-QEQEQEQER��-
�OL�O'��ҥ��"���)�%ri�P
�(��
+(����=)��M�QJ�s
@�6��QE!�5�V�4�(#	�i<��*j(!�iꊽ:�(��)CZ(/'Ѩ�楢��/�RzS��ޓ�����"�G��DJ:�ԔP�b��(��(��(��(��(��	��C1�cң���h� �!l�Tu<C	��c袊@QEQEQEA*���*�.�"���L�ml��E-QL��.QO�0��(��(��(��(��(��(��(��(��(��(��(��(��(��8\zԕ^V��8��E�,+�j��YQ�@�b�E�(��(��(��(��(��(��(��(��(��(��(��(��(��(��*9��Z��;nbh
(��bF���P��ZC
+(��
+(��
+(��
+(��
+�d��?���E:D����bX�dU�AV��8=
'��)QEQEQEQEQEQEQEQEQEQEQEQE��T��RL܅��QE|K�ϥOL�v�֟HaEP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
E���V�㹨iY�14��
������
(QE!�Q@Q@Q@Q@Q@�pj�N
Z�H���AES4O����*�J�7�=�}Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@�d�QL�m���&�(� �"�`)�4+�ϭ$��)QEQEQEQEQEQEQEQEQEQEQEQEQEQETS7��Ƥvڹ�����
ES���d
+dK�rz�}!�Q@Q@Q@Q@Q@Q@Q@ʙ��Z��TR��C�TAȢ�XG=��TEN���i}Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@
85Y��&����~50
+(��
+����4ȗ����(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�EC+���5�s{Sh����n9=5T�`U�Z(��Q@Q@Q@Q@Q@Q@Q@Q@I�/�QU��H���L���J��oΥ���r��ҁ�(�V8��
EP
EP
EP
EP
EP
EP
EP
H͵sKU�}��A@
''&�(� �ƛ�����X�U�P���ER��(��(��(��(��(��(��(��(��(��(��(��(��(��k�Q�@	#�j
+	$��LA@⊚$��z��6��:�)(��(��(��(��(��(��(��(��(��(��������$pj�5�0�+�Nt+������R���󨨠]h���z�dV���1�QEQEQEQEQEQQ�&8^������Ƣ��b
+����Om���D�=��QHaEP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
E��FM�FMWf,rhf,ri)�QEIy���Bğ�
+��)(��(��(��(��(��(��(��(��(��(��(��(��*6�W����AS�1IV�`��M�M0"����QI@�+��<T�(=x�h�e�A�sEU�:S��;�,QP��p)|���@KEE�JC1�MH��F=��{�[���QE
+$�S�2�¦U
+8�cR0��4�(�
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
E��FM�FMWf,rhf,ri)�QEI{�=(�ǻ�ҧ��C
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+cD���O��!10��0�A�4PZ*�U=@����S
+*o$z�O'��Ҁ"���G��D+�h'��X��:�!X���X�{dӨ�
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
Eǐ/�@
+�{�ŎM!$��)�QEKx�*$q���SQE!�Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@�2i� _sP3<��Rx^GE�I��"�z��GjF�ɧ�E 
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+)�j&����J���ZRx
+a$�h�
E���^
'�H���R*��)i(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(���^������j6vn��&gU�j6���TtS'=h�zT�=x�Dt����T���4�5QW�N��@QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQFG���n��)��@��3��Lǰ�&��u��F=��0,w�Ҙf��EE8�ǽ6�	�3O1�2��B;��ª��FǶ>�"�S���@ t���(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��:�fX��Md
ր+�Sy+�h�W��*)}�|���'�Y
+����
+��	�7|
+��@F!�8F��:�(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(����
+endstream
+endobj
+25 0 obj
+<</Type /XObject
+/Subtype /Image
+/Width 642
+/Height 638
+/ColorSpace /DeviceGray
+/BitsPerComponent 8
+/Filter /FlateDecode
+
+/Length 15975
+>>
+stream
+x��+����
+�
+nX8а�p�������=i��&ZZ��r�޳-�qd�lwv�J�R�T*�J�br��cP�w��=�RI�pW�s�������±�c%�×ޝ��(�Q���*�o�ߗ��0�J�?�4��
+d/�1T�ŗ"����O��TgP>�V������h�ӻ�
V���qF����\�p�H�����߁�����N%��.�����b��k�^��T�Bd
+P�����?����׏����P��\N���
+�w�c<b5��f�oY�W�r���"�?��]
+��?����������X����P�p����z>�;.���"/	Ԙ�dV��\NuϤDa�޷��{
	c#���~K��K�&E g����������񟧫UC8?�Ⱦ�0\b<�o�;o\6���1���_�o<�Q��~�/��͛ǹ���,l�q8��sw�/���i��ƺ��yd���a���z�������au�S#�}�t>?�L�]�|=O6����w���,���1�5�
�D�1�|Uw��� �DaO��f@�����)�P�jR22C�_�se�U����1��]��q�� ����!����}?��G����#0@�o1?F�?~�-�W�}`SN�������˧�GT�������W	kmf(�Wt��+f=��c�+�4�$ k������y�˯z�kP�;�n^뙅^��vB�J�zx���?��
z��)I�x�7xzɭ�`��Z�?��17"����+�쳶@.�ɝ}5�V����@6rB3�WW�f�Q��5�Sؿ�E(�;�0��;��ƅ�͘��!���yX2�~7O�
��%�<��Ir
+��M�<<my��5�m�_C�^�u�U��W6P�s����j�һ���C�V3�%-��ߖH�^�tc�� 5�ksL���Z|�-�W�S؇$�P�H�8���f��47r�.�;ISW��0�'z����)9pM�l�%��'���Iȁk��I?��6C�SF}��_j��x�C�Ɏ�O�S�������c!?��\ܰ'�a�3�(?���?!�h�9�w)8�?ֵ���Ԭx�9q`���G�pD��۷I%�/6������u5<vx0�EN'!ľ��{L{o8G�N�t�aL����;+˼9gg���:�0�t�'�/l*�.�8ú�Y�3�3�Ȳ�Ȧ��p���h˨`$F��XW�qx��Y�yÃ�����<��x�~x¬��:�.F���,�~Z|a�L�`Rp1*��C�׵��s#n������KdB�
���#>#3�.�.]
��&�̑N�O
�E�
�3��,q��7�YX���0s�60��i1�#{�'��c�R��<�n�)������d��k|f)IV.����M=�
=(ffش��[loX�
+��������_��i�]����q�"�Η�}@�ю�E�\���*k+zp��o�����U�\�gJȉץ���^	�Ԛ�V
�E�P�^�
+zp�9��>�����-���1���.18�w���}04
Ou�E�n]E��P�}d�9c�NTDŽ�$�m�q{��ok�ά�e <���F�M��q�H,�	7x��7�WA��Ι���u� ��e��������m*�xՙ���y��CX�/�������9�?��Z�o����/Z
+8���ڠ�K6oN��ȂUС�s�����o{pB<!���?R6P@�.5�M�RAXWe�p�*L���}]L�D��P9�Z%��zdn#&�����{?��>�͘���3=(�c%�߬�3�[7�;J|�u� |��΁��D"��WK�`~�[�>Q�j�/x��ɜ,D
E��{43�-F�Q1�{�����T���!��R'�2P�V���Y���P�D�e( (�n��S1;�]
+Q��>�27=��=X����ޡ]J�3<>,�2M+ѥ(�^�^��
+���������j�K���֌O�1!*�X�������:'mJ�#Z�)G
�R̖�p�����|D2�r�Oڴn�`�5�W�
+�����`��~Æ�,�t�����p�N����ط�炦�%�z��y�N������2�8BQN�r~�|L\*X�1K��R@p���0aN\*X�\�Q�U��-j�3�>fCi��B�R@p(!2���H\�'eYHa���R�y�[
%E�{���GY
+��xa���
+�b��.,jNx[�4	.,f�2��2w��K��C&�r
+�B�YR�p��!�G����]Vδ�N��䶆�yz��P0�c,�H�/�	���K���
+ٯ/	�`r�>�"�sY}����ñJ`y��M��Mu�csd��VV	�{|
+�h�Z�F�'뙙8�H��]@����R��༗�H�Z^����K�T5����^�_eN���a��m�X?�#L~�[����5��\]��� '\�� ���\˗��y#Tr�%����X�@�$a��䶌#!�ek$�c
+L~��Lp���x?L|pd��p`�ۆ�i����2��Q�8<��{<���	׫�f��z�K�m '\Of1�
���Ҷ�#.u��=��-�72m]:�c�<&p����A�aA'��d=kQ�$�0��9e�́D&>�	�0�
�+���x�q��pa��K���S%��r܄�8�r&��
'���x�`���p=���u0b��\��p=���
�&���Qa��
}�$Ӷ��7S�`�`�X4XE�a��A<��WCJ�)
�k�;+8z2bǢ��g�w�a`
+�$Y=����F���Q������i�!S��٠_̪�4S�p&����?���:�b�
+�%X=��AE�`�����
��t���L{>,섋��e�d�/����;Şɺ�o���b�
+�ã٢h=52�y�N���?�|&b>u�Jd/��a`��a�y������;aa�; ����T�v\��a��'��(�Y��Á�pd�{x��t����`��hEG����ě]�-�섅�V�9��`����`'|c�9/=�4Wzb8��D+��}�6��zX�i����h�6kM������`�ê�zF3�,=
1~��\G/�ddȃf��m-��>PV<v22d$h���4�@�yr�n;.4�K��Ə �}�b
�;#��0�SF[��E��6eMo/Lz~��k����P�)ψLx~'\~Q<�1�a��iHi�F_<fEf���x�xwR�/��]�&��8X�����_��!x���Ҭ�O`�`x��mt,X~1��,�0����4�o�&\���P���c����#�{_�p���g�i�&Xp�)����>1�E`����QL[�	�VPo�P��4���U����DNx+h!XF��<��0��1�����aAa�F�G�l	,>�]
+��S�7T;2�"�j8$��1��*L����“J�&1|Xd�E`%R5��1J1�d������/9/���Ɩsd�e`�b�Y(����`d��Oa�E`9�e���uD&3�$2�2��p����F|��<D�lXN���Cc���Ep��B�y�����c��Aւ�*���L��k8<֊���y�BL�y�5/0��X��s"�,0�20k$�+TlĘ��;9ؤ�=r8�V�B�aaU���QK�β|B�|TX�>��V����ԘN����`dR�s��90�p
�a�#鸫�|<�G��p%� ��8�	���\�N82�J&OzZ��逸g��0��
+˜���9����2��E��}�%b�"In��fJg��9&\�f�ߨ�NX�h!X?wS��1r�7]�R��	&]�'�yOp�Ѕ&Y
+���gE��E�n�����N�Ƥ+=0�E�n���$K�t‘IW�`̽�
C-^��T򛊁IW�`���{�K)�vT�x�x�{�0,�xUxv�:ʤ+�0f_����n7>7�^���bx �-XS���ٱ��Rv��6�z2<�'�|X���1��r^D��p‹�����A�-���N����M@d�;���'l�T���J?7�(����b�����k8
�rh���q���\^�k,솹'��o1�����a^���o1{¶�a�n��c�%GGY��a�4�#Z� ��K�v�5�|D��A��ꖂyS��e�-f\��2o�/h!-�3M�@��0�`�T��_�?
1H��q
+�v‹YH���v $H�Q�.�����؁`@bK��'�������"f$�|�b~sԼ$�(�V�	3D��`	��A���ؾ�^��	���
+��Ch<�Sl
���nq��z
'G�V Cf,�Nh��r�yq�5��?o�B�F,2��y��v	�[�N���S����}��E�@"�3gE���a������lB�-Pd��������	�0pJp �++�D�������*Sم��y����Kā 	@ B��q��'�/9�}I�|�&qJ
�[�x�i�ǥ�	��AA"�~k�?{�E5>���}S�*)���}Z-��b̯Z�[4�"k�(��hS��d�:W��8a���s2%<�1��W�����K@�I�!��3�w�	�0���8�B{��w`D�����A�V;�"�T��.�՗c�
|p~|�@���
t��}�a�u�e ��Wap���KO���r@ ���l�����w�/ɑ�oD��E�N�����ÛA	����ᨅ�Vx���.��`���o)%�F�%9;�r������˞��k��i�砵�û�٥�l��W����"@����|8ȡ�?�M�D��/�/����}b?�?�T��P��4l��9 �jA��"��PX�\o=��9��e����5��k��-N�/f�	�}��A���������}[���6�z�өTsn�A��d���`
�|���-�k��
��Ĭ������s���4�߁����
�2�/u�[.w��%7��}�Q����*h����pH�_�ʜ����m��0j""4��$K�@Z����5�馼����r�G���5�Bt�ˣ��\�Z%��t����x ���Z�O��A�s�0�$���L����z�ڒ��������5�8b�6t����v �
+��C`��00m�ISA�L>Ӯ{�Y�~q��CS�E�`Zh��s��#B?>��F��/(&�P�����r
y�\��(���.=?�)��bbgh�S��#B��@Y��u~�ьۜ��r�o��ڛ>��45��|�y�T�`SexH��v�^=����.(���`�,��ܿ{����@�������Q�P��gY`S�{�t�|6�8�kQ&�����Jf���;��E`\S�M¦��HR?�6��Hw�4My�x�>��
�	|�HK�P���J4ܺ����gߒ��Rqph��-��e�^�f��G��볭ra�{�Yg]!f����`�<�d��~pD
Cw�����0�҃����E�._5䎨��	����SP�|	yVV���
]T7�F;vZ�����W@_� �������&�TupF/���³ezH�����0v�)�e���.��>�3�\$��8:��i�#��?�yP<&�g{H�+��W~<��epB��Ҟ�zkUR���.X:[m7�~p�20���P���Qޚ[$ԝ������@h(���aN��9��؜I%����yf��z�ˊ-E�;��|�Y��i�-;�AC_�?�1�u��F]R�8�O�Yyӳ��-y�vW�(H]�Z-B�V��4S��p
����n���>�B:��0P�Qih�8�S.�/�*��
+
+�tX���B���ۣ��a'��b�]_XX�P��F�DTׂjR���w��҂��Hߝ�W��@�Z����j=^hw��v��а$}��|~�.�NN�Z��7?�V@�� �1M�.��:Z�PZmjZ
�ٮ/lM�D!]�e�ڔ���嫀�(����ʆU:"�7
+����…[
�c��0C��#�O��Զ������fK���[�q`CL�mc�a����n���dj�+p��饪��5���#�I�:PƬ��b%�b�I�-�
mc@�v����)?�|�_x�ˉ�V��wCˣ��q���:1�p"�"!���Ö�vȉ���E��U�mï�E]�U�bD�� �	>x�?��Ư�_d���X0$���V��k���\|���.����d�mC�:c����1d��_Q�R������ځx!'3�D���@��������m��!�ςԏ����h�͵����1��[GgK�*���
3V�u�CzE���n NE������$&^�]�ڋ�C����)`4:�ͮ����"3��2ͭؽ�p�A{U-p�����;��L^s�:r�+E|�v�L��iPKyi����0�-�{��4cJ{��֠�O�1WZ��V�|��C��8;��4����9Z�N���'���r��ªA{ՠ��G�[����t�ߴ��>u�]	m`^�A`�K�;y����f(�H��,������J0�K�I�*M�_���)�x������c�rm](�/P��;�5
/�h%�3a���08�NiD�9�vO딂$!�r��lI4�q���N{8�Mh%��`��<m�y�VM��Qo])[s	bv�IE�b�i�����l����&�V���@���|����V��gQm�� A��ޘ�����d[A��i|iA�nY�ݐ�:@���0��@ݢ��EP��x��������S�J�݃"��ƗV�R:́�������,�nȊ*�$S8�b��	~T�,O�}��v:Z(�/����3$l�	�Š�V�(XH�?!c�Md�E(hp��:�9�@LjF4����k�l����杳�����_X�/GF&Xp�2�|��t�kջھz>�(*��L`vB�ܶ�7��}�l�İ�������AIJ�x�,�Ղ����m��a:��jY:��tn�40���A��d���cn�D�a$��
+8�Iܭ*������S!/�_��-7�SGC��d��1���c�'�&�蒈C��	M&��ύF=�@L``��n���\��������u�.�(���@��LxT�j��H@��v�3���ѵ�̛y]����x�L���%���˓	��‚?7�&�]�A"���
�����͵-I��2fF��N����je��`ˠ��y�h�L���1�ܵ��5��1�V��u$�O��|0I�#
+H@���M&�&o@O���ߴ�����rc�`u*�$�:��
˚�S5
I�S#�ߟ�db�)﫫�y�%.���`���>0X��Yx��]�c]�D�Qp�Ƀ����[D��M'�$���#�\ՎV��d��S������K�d�Qp����{�@��ߴmC���/�8�m0I���¯!AB��(8�dAJ1�X�V��
+;��6�v��u�׀���`��;���nU�6����q/>
^��SK�8wx��A���WKI���'4l�5�6�y O���M���62wXx�)���!s|#���",M���|hw�IM�(ϼ#O���M����`ᵫ�A�h��Uśwv�*�؂H^�n�����h��߅�bQ&Y"�_灙}9� Z�L������c��|TУ�Qp���vr�~��s1�����清٣cY�n

��+�FУ�Qm@�^l��������.�o�Y*��m��7�n��-PmP�N�ϛ�u���b\��h2��o�y���� Hl8=;<5
+�
�Ӌ�ⲭ�^���$�v��+f��N/��+"�AO�h�t2���7��	�&��V5��_��/�@�W�Ǐ����F
��7�q����w��z�x�����r��v�����4���A���S�����H��w�O�y�0['|o���������A
4�~��A�O�h#�S�;����
����;e���,Z�X�����xO.,�W��&n�/�),&
+������ً.f���7�E���Qp�I&�N�˄�E�;a���SS����2/Q�F���F���Qp�I���g&���'7�+;�qG]X�|*+�Mz��<5
+�6���A��	l��W }��
+���xij���Μ���ꃠ
�S��h��=g�^�9�4'ςʔ��̬{8a�T)k��2��i�=g�j1�{�M/�NXX=mP��0�JYI��#݂<5
+�6��s��c�hu65{қ�{��ZJd�B�~T;m��	�B@CG��r���w�
�D�Nz��f�-%2h�~�&e�F4�Q�!�x!�N�Z�C�w|#)rk`q��<�U~�c�����1������ O��	�S
t���9�9�"���@�X��c�N���A����(�G"x� �M�:���;=
+c;f^�^�f�u����{�:6<=�6\ET��E@���F�ЩӪD&mB�p�	�a�	F���`ɺ�D,�٣.�L@�x��8'^�� 0i�3�Y�U5�e'������g5$
�s#�D�Oz| L܂:��~W��:�j��	�7VU��^\o3��h�.=�6�eQ�	gY�`��r얳�Y?�7�>��Mj���z��o�KJ,>`F�ө�E��������IM`?
�_�f��2(�R����WG��YFl�}cU���Nt.������
+�j�"��N`�4/�\��:��r��k�ㄕ �P��}Ę�y�/�"h�v����¤
hq6{���'�
[�>f�;�[W�X���	F|iA�����L+��\�5��*�q8��2j�e��_Z!C/j��H/���;�ً�x;j�L���аC���L���G|i@+Q����Nd����#^C#�ĭ��cT4�iiL�>bT
�h@+G�2�au��pw��	�fM�͝ǝ#�)�X�=��,
$�4C���O���tG�yH��]�B�X�hءYX���f h$��,k{aG4��*�v��Wr>�|�h���ŰK,
ݯ�jk��d���Q�c:Ka�r�����1�g��f��c]�ѝΒ6��>>"��F"��@���� ����'c�0Y�ɛ!���=�Sv4t�
+��=�B&

E^ۡfZ�"�G�;Ga�ǧ�cZ��C�_s�<$��{,�G��ymA3�O��>}:b����	f h	���D��o:���'�C��¸�(}:�݉LBK1��@�5ef|���9�\C'���sP�12����Q�tz��0��bzx�rϷ��#?6�k��5�����ci��YP�tz��0b�R�K�C�X�w�k�XX��Qy��x�2pI�v'2a-������D(%�T��+X���q�Xm�q6� �VCq�sz��%O#�����3��g t���6�i�b��6;��L�@ow���aV��ա;5U% )]s
�-�������C�%j��Ӂ����1�l�wv/X�&JE�;�(�YF�<�M#���v�fE�:���N��lh��*� �|�'f��ĶT�M{����'�n9�U�&�e��2֝߷���?�`X���!�6G��:v
'�_B�-h��:�݉LX�V�BK <>E�3#�����:�E�^��$G�������1�Y,�ٝȄ5�	l�oo��#!�7]�.T�>��h��MB10;�M���@g�=R��Rޞkb��So�����,=�21;��e�fq�p<Jl��v[:@�5D&��h�J����ްh��^�Ӊv�:Zep2��A��ݶh!g���D����	l�KZ(�<P�1�l'�E�N����a�Ӗ�@��Q>	Z��m�1����G_��B矓.HG����'�E��D���-e!2�z�p���ҔAgw�p�`u��[+��fw������:�(2z����_1P�4�:��@@Ӭ6���7���\KM�� l�5w���D����CbG̘�~7hr�h8�m��r���&����nC����\�zI>�����AΧ���H[�XY��?p<ZT��ONkΠ0�<�<������m̜�+B�F�!v�"n���
��umEkL�ם��[�Z`|i��P)aPP{h����	�`j��H[�Z�I��`N�Z�8h�	�aL��D�#�}���9��߸!v�,��X}��]��++��Hd¯$�@�Z��{�iC�N8C#��N7�0&=)�&�����6��"~A��ȫ@�[%$��p�V#u����t������c� ���A
���?�WCڭ�h�t���5�1��p�>$����KC��~�h.��L
|Q���&'�5�1~���
ֻ͂��.�N��$��_��(f��}����8l�9^d�G¤���Y�r�%u��/��o��%8ϻ�7*��";�>+��v�*#���A'F���; �.Ҷ�~H[�{���JddY��m>
�'
�>'��>�����0vB"�B�	��D�	�J��5l�D�m?0H@ ��9�����F�۔�����P�;9�Y�[b�%��;Q�����~
+�#D�q����7���Ue)���+�;�W�M����탕�<$v�O*�	h�YOXe
+gzȿ�Ѣ�JS��B��}>��Bm��C�*�	8 (�V�/��rn��H)�Vi���@Z-}�g~�;���vQ�	���MZ	��ˀ�TZ�DM=Wk��}�v!���z�G���v��!Y���`7��Pwk��֭�xw���4��J����Pf��~���1
+.�	����\�gN��
)rQm��#�����1���R_�v��O�`!�
+����:k&��pݹ�uTw����y�������k��Q4e<g�B�������"v�D�K��F�u�����O%|�Q
_g��g�eُ�4���w&�-���$7���	|o,���c�-FЧ��n�WB�u�S�Ŕ�MYE�O�9b"܁�
5���r6��|�ާ���U��Ԝ
d
<~��i�,��P@È�k/���E���r�/z���}�W�TХ��Q�d�Y���W��^	�b(�n�<Tن�'�;6O�?]#Nw>�X������� �K��jȮz�r�z@��F���#Wz��>0�o�D.+��,�-��S�B2�
+��p�&a	��u����r��{�yM)�av�-�x��W����aR���N�/&�G��#5sJ�4vX�W��B�Ȥ~�F��c[�p<N`qzD��Z�+�,�k˷�����hJ<0,v7���Jx�||���;���(�37s똜C��@UgH��í�<7L}�%�z�Ñ-�oHf�FFh|K勱Cďp�#Ɇ�W~�J����=�g���?�;�Hr�A\�)�S��C�Ґf��	Y*�D��h>8=�uG�w����礻��
g���
+�q�e
B7���?�ҏ�T� �Q����/�tinp�B��Z*	H�Zp"{�NW�O+��k���_���e�����
+�Qx��p���n���Yrm��~�pQDHȚ�P��
+���s���Hz
��' ������������?R��9a�v�K���_���K�?����44&�m�c��倦�?���t��f��e@�� G?];.T|{�w�w���BWTz
���H_�1�
+��Nm���3��n6I��sK
r1��7��7������0���Ib�QA��H��4�^�&>^|�>x�����(��A��'zB|I�/C|.�H�����e�6����\�	L�4�ٹ�.�4 �)���y�����+���
^牠��p�H��X�LҢ�IH����4��	���3��X�$��NC+
����y�u���9�*����`���r�4��3
+�Uy�OhDs���}D�R�r�?��ul�NC��9aGKL煇�Z�gKx�z�/���1
+#?3J�N'ܐ����I"=�I
�����.�I�򹫧�������'_��E_=M��H��„��ڢ<���-��."���Π>�o�"{�§���]k������
+Ka.'��0�͋Ǟ�nh~�)�C��*�/]'����:_71��=UΙlHP1�'h\�Co���2��ا^�	>A�pw��іx&J��"��w�Y��N����Jݱ�����0�א��ڍ�gҜ�w�ӱ�
�m��B�b���<����o�|�w����t���׹봖����R�<�?�8a+�_�˿��-/���8�3M����F�\�-w=�G����������D�Od�	�;�:�9��=؃'~qiݥD'�G��W���*8)��Cx�?��	:�<;�W�
+Mt�;&���?ݓ��s�qÔ�'�����g������8�o��y�kb	��w��3�#�ۗ&���9�tpp��ZeO�Fd���8az�� !|4j��I7�o��c���	':a+�&�f����
V��L�4�)e��A�(E&�zp��n��k�2ɢ ��g�
��d�-\�&�?�fH]o��M�S��]+�	'�Vނω��?��յN�pj�au�JA�^t��mu�ۛ*����A
+-S��{��ج
rD*'�Y��dz�;�Lt��[�w��,�pj�W��Fp�!�}�5/�Yx~��%�.���jy�Ί�yH��F00��Ane�:�
�!��b�t��XLn���<$���a7W�!�b�C���]D��i�`�ɮ{G.?�Y	���8��X�Gv�6_ĥ�����=�J�Ȏ\�Pg`S�(!ž����;rs]��WMw��d���m�d`�S�_K����d׃]ܖ;P<7�7+�?��!�c�����:���A�b ����|�1� �	Ns&�K�e`7�tp�ֳ�a"�]$�V]���&���~���4l=�&p��HF�zD��'���&00Y/
?c�/���ɯ��M��4�d���[����0��'�OY�vr(a�y��>�,�{�?Bn(�~�Lc��_���5����E���a�oް����L���X���!������z.�B��mM?<`ݧ8~핿����fh�3�Q��Pec�!�@(�gfxh���:�z?�¸�0��~�j�iE�η͜
B�30�<���JsB�c1�8��'GG�����
Lx��-a��g&0�\,� Lx��-a��ވ���X�wN~ݕ�q�31�����.��%�<1�F'VI&0�QK1FN L�����������W��E&ۓ������7m&�f,_8�D���U���'1F2�N���k
+����y��B`UWT"�����yUE�IV�usB��R �����L��2���a�k9��;ަ�5�b�Le��
�d#V�{[W��L��2~�
+&��#�6�^q(�2�f�b��n�!J9�le#����r�L��XŊ)��8�&02�c������5]�
+(L~��t4�8�����&a���S�7c9,�,XM ���3|r1��h�&`U��V,X�	DD<+#�
�����rU��@@����RU��@���W�j2U�j
�i&;�!�e�`5�+��C��H���PLd�E�Y	LxT��`�*���m�Z+sF|gU*HL��)���GR��nK�#�����{���I)���{
tC.�m�\��R�_�Up�ZQ2��	����̴��V�s���3�|3�I&<�
+.��R4�b�?��I	Lx2�ύ."%&���2�1�$2�	!�1��|��U�#YeEƶ
+d��~��Vb�}Wa��BT0�^��JL`�+����	O
Q�ƒ�h~��b�Ȅ���`�?�U��hX?�VH%���%�ICTUsV�tiL������F}�y����S�B=�؃.u݌��1��#�*XbNl^�/uՌ�u3�d��q߹���`��"NL�u=��Rt�U��;� �h�����<y\xX�U�"��)!>���	3
.5�����T�a�}p�=
+f��ڔC�1�V�Sr�7*�Y�E��f�M!fЮE/�h��X��L�G�0������f��a���7�OS>(�s���W����I��X���k�bo��h�-)1��푆y+�A�6�S
�&��*�\�|)�N/$�sQ.nM���g�mM+]���X���"�0����
?��8�e���b*�"�����f)�إ�s�y�>�"p��(��%�%�|�a�%�u
+�
+'�Rl+��>G`�
+�剣�bO�)��.W..��Ɣgx�Ӷ�L犫v1��=����n�m\j�ݏU+��''�N��$YqU�.+W�/�W�
+�u՗CU���$*q���y�M;�
+�a%
+�K0���࿪����z���M_M��|�
+hz�5)�o�x�WF�A�KX���p�=/s�,��TH����`*`d�ğ�|���e�䪀V�\���>��#��D���آ�2�0�3�h?e�++�Q���6��oV����_6��Ҫ��̤�����c:�E�}��)7
f!z�
+��^��#S	�����:ٸ~qH��[|Ot�����UX7�*�.Co���<�7����0pCaI�~i�G2C�'ߙč���9��!1'��û(�p/��=n�V|a�H 1�sx�cZG��@�������)�kت
�
+���b��7ˠ*�N/g��|�V3;��mn��"��/���}Ok��H�d�UQ�pN�k�
+��VU���iLo|
���;rf���.oc)�g^��yfɿ
3#(��i�?����{�f,�˦���5�ϭ/O������r��G��m�0L�c/-�~�>b�
+�*�f7Ƚ�γ.�|i_5~�+��FH
+�~��4��y>V��ž��x參�9s����~�E����y������K�?>Bx�j�:죥[��P��Ϻ�2`ed��Va*�B.��*Le\�0��)��1�&��q!�WWs�ʸ�?�R�"Tƅ�>ٹ� �1aXw�7�*cC��i���
+���
�0Qe�m�Z��L���ވ��
+�S�����[��a�ʨ��9��o�l�ד0�Qa(�Z"TF��~��� �1���X�J>�nS֓X����*�.*�|���2"�x��E���[$�WS�ʈ���+���{h�(~e<��Bh�����8��f ������Q3��X8��SX'�J&��ֻ���p���T3��Hx�������ߖ�lhe\x��v��-��8�=�W��*#��k*�5
���?�U���ƿȔ�V��2�wG�W��2ogG�W��2��t���_e'���]��UF`d���se���n��_ex���~q�U�����ޮ�z��24�#��.�5���?g�w�}�"��_����͗���_�~+Csp�~��U�-83߆j�*���wv��.���ʀ��G�sO\k��2 ��;��q����P���/>k�2��)!�h�|��_eގ����_e(�bR��Pկ2�l�nU�*C�e�ΉQ߃��V�"�3,��s=�R�C��}��=�d��᜞n��e��ﭤ���y����q���G�`���"��G�L�|i_u����ņ�ƮEվ��w�J\��U��:%�y:ָ�����#}|�>aO�T��by�|��J=�`<W�W�E����j�Q�ω�Z�k<��W���x�R����Ty#{��×��*Ke,�����/��!a•J�R�T*�����@
+endstream
+endobj
+26 0 obj
+<</Type /XObject
+/Subtype /Image
+/Name /im26
+/Filter /DCTDecode 
+/Width 3000
+/Height 317
+/BitsPerComponent 8
+/ColorSpace /DeviceRGB
+/SMask 27 0 R
+/Length 49376
+>>
+stream
+����JFIF


``��C
	
+
+

!(!0*21/*.-4;K@48G9-.BYBGNPTUT3?]c\RbKSTQ��C
''Q6.6QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ��
=�
"

��







	
+���

}
!1AQa"q2���#B��R��$3br�	
+%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������










	
+���

w
!1AQaq"2�B����	#3R�br�
+$4�%�&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������
?��(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(�M-��ua��Qp����7诜�]�Q�&�|��\8��'�$z����
+��h����#׿�7���S��������)�ƀ>���v���^��ޣ��O�4�G��oQ�����&����={��z��?���	��A�G���h�+���֯x���/�%~!������4
�%���%~!������4��`kG�����h�	���b��������kF�⎿�ج��FA��e��������A�C6B?�o�|G���%Ķ�{O��
�QU����,��OX�6?*�@Q@Q@Q@Q@Q@Q@Q@Q@T���}�\^\G+��l
+����k❅�h��W�qǛ'ȟ��J�5Ox�R$5�[����c���
�7w�v+���u��@�ΰ��{�RCjk#�#>1�ׄ���^Ggs�f9&�@�?�=
+2DV����P?V��T��ՠ?��&a�ԠC^SEz�|\P�n�H�7X��)��n2>}��\������(�����<�6��[��ZV��5><ɮ-��=a'�A�x�
�U���]@�i�Z�Ǣy�7��y�:���t��ZIb�g�G�ܟ��Ƞ�(�.�~*�+�dz��?���
+�-'Yӵ�?N�I�}�~��(�Q@Q@Q@Q@Q@�|B�kojA+�"�xtb�~�GQ^)�����R��������W�?�z��/�����z��/����}E|������R�����������R��������W�?�z��/�����z��/����}E|������R�����������R��������W�?�z��/����H<G����=?���TW�)� �֯��v?�ը�o�h�WW������|��J��W��Ǚ<��H@��q[n��{�C �a���s���h�;M�����,�5����_�s�⺫K�[�D֗1\D�'?J��(��(��(��(��(��(��(��(�����#�t�����4���C�H�c�/��b��
��W��e�_�\�b��L�K�A���P��^
�	���1s��?�2�/�.1@�Ex�&^%�����(���Ŀ����{���x���?���/��b��
��W��e�_�\�b��L�K�A���P��_>���F�γv1������W��
^���@BQ_?����sǫf���~(�ui8��F�b�=��;��$����O�]!?��+b���ʐ/t��whd+��:�J+��>#�z���Yl���8��G���� ��f��9�n��
%Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@��Z�Ms&vB�#c�ɮ;�����{�~��@��������/����������^�ߡ��PmEq?�<=�����?��?�hx{������T
�Q\O�-r����*��2�SN���0�eܻ�=��Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@��[�k}
+ɡ��cs�Q�'�oJ��+��������4
���g�����\���?������������tW͟�W���q�[�h�ҿ�������@I�_:麍�j����f@A���=��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��+����"F�����k]s�?�H���_�
h�(��(��(��(��(��(��(��(������K��ё����������U'�o��8���y�B��������w6�����g����CAA�t^���X�ϴ�yNW잫�q�h��?
��L���eŒ���:����@Q@Q@Q@Q@Q@��T��z
+�/��MI��t�;.VI�
7��_�@'��#Zie�4��wc��?������ǿj�SV�5��q�]I<�����TP
EP
EP
EP
EP
EP
EP
S�^�i�Isg<�L�
AEz߄>#�|�c������s���O�O�z|�^����-f�i������w?�ec��~�N��EP
EP
EP
EP1�'�DMK���ԯ	�v���"&��l��jW��
EP
EP
EP
EP
EP
EP
EP
Vlo�4�=�̶�⍊���V��='ÿ&������>����������]F�.��I�~��#��}������u^��)~C����q�z���VG��Ce�=8]Z6�^%������=�^�
+(��
+(��
+(��
+(��
+(��
+(��<O���R���q���T���O���:�
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+��j���?����n���t?�R��=_�a�d��`��.P|�����8�W�F�,k$n��2�� �Pk�J��[�̶�E��X�L^��
��TV�0�[Gsm"��zjZ(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(������Q��Y�_8������5����A5�QEQE����M����f���<�"n��\G�4
�EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP��a����}�^E^���@_�����yQEQEZ���+i�]��B��|٥��V���'��+�:(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��+����"F�����k]s�?�H���_�
h�(��(��(��(��(��(��(��(��(��(�����{;��-�x���]5�^��Z�K
D�Z�S�f�z7�����v��ъ���)�ր>������1���
F���[(�����Ҁ
+(��
+(��
+(��
+(�{������6�o��?�=[��T
�|M�sK+�:|��8��O�?�ÿ��כR�3�f%���NI4�QEQEQEjh��uٌz}�H
�HxE�����@tW��	�
+���L[�vˀ?�M����� \���$�@@������7�_������K����xӌM���q�g�xU�Z�ˆ���:�+v��d�����gCԴ;�#Q�h����_�z΢�(��(��(�~x��S�^ɺ��s������}+�+��2�}/R���lK�_P}�⾊�o����{�s��@��߅Y��(��(��(����"&��l��jW�׻|I��R��_�5+�h��(��(��(��(��(��(��(��(��(GB�o4N;�7�/��Ƚ��W�蚽����hَAʞ������ƻ��#:>��s�,�F���[���{eQ@Q@Q@Q@Q@Q@'�S�G)?�ʸ��~*��'�q��W@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@��o��|�U��7
�,�9�����^�_1W��;�η��I�uݦ"���?��?0h���(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��� 
G��e��M|�_Gk�����_���4QEQEW���7K��#�������?���_�q���Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@��@_�����yz���Y������TQEQE
kK�����vO�W�u�f��![O��������(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�w���������tU��@��#S�q�5���(��(��(Ѿ��Wͪ�坽����e�_nw�t�K��H��L�R;�J������R�:�*�f�ύ���_��{�؃���*�
���&7��
�����J�?��5p0�<���?�+z��o~��۽իv�&��0'��cT�W�[��u�7j?�ǖ��~��v���Q�������Im��p��?�S���l�uf����x[�H��-�j�����c�����{�?Z�)H �F���(��(�	��类���C�0da�׾�S_��Z,w���|�F?���������N��!��gq���f���z(##�EQEQE�_���x��Q���v�Տ�����P�K
:��O�M!�k����y'��I#b{�rh:(��
+(��
+(�
K�Z֭t��g�7�Tr���I�O6��n�����b:�}=O�=�������-�aHaA�D�;X,�"���GJv���(��(��j:}��e%��49V��>�f��oxVo
j )i,�ɆS����?Z���h���%Ɵ(
�f6?���=�_<��M$2�Y#b��� ��eQ@Q@z��-L�h�:k�Z�M���v����ȫ��Wy�o$9����Ǹ��Z��(��
+(��
+(��9��?�"j_���F�xM{�ğ�5/�e��R�&�
+(��
+(��
+����>�{�4��L�����|�+�3�Ey{g¿�c���:���sA��&������9���N��T�
+Ӣ�3?���	��*�5�3�8��,����Es�>���!��������+��~[:�ҵ��Gp7)����(�MoAԴ+�'P�h��\r��5�_I�Zu��e%��4�[����ׄx�óxoXkG%�q�	q���GC�נ:(��
+(��
+(��>��^�u�Z];n�G�7���O�`�5�^]�v���5�Vt��[��z�QEQEQEQEQEx��O����1�*㫱���#����?�\uQEQEi�iU�O���ek�Ad�W�ٶ��m�~��+�<1�#V��_���b���
+�ٶ��m�~��(�Ͱ��o����V��
+�ٶ��m�~��(�Ͱ��o����V��
+o��c~�h��?ҫ���
+p|�ē����Ԣ�9G�LJ/�6�Y���l�ʼ����k���,�&X�?�^�^E{�# ��TWw��)��5M>=�S61�'��?��\%QEQE��4�N���af�7��a�~�����Ky���+��$�é� �P�4TvӭͬW	�%@��#5%QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEP��
��׬��	��k��w�@��z�����ƀ
+(��
+(��
+����&���3_?����7K��#��ݢ�(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��0�������V�"�]��� /����Z���
+(��
+(��-i�������
+�N�l���+i�]��B��QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE��@��#S�q�5���߈�$j�/���
��QEQEQEz��������^�^c�c�c?���jW�P
EP
EP
EP
EP��B�J�I��qb�F�Q��z����ׯ�Wӵ��24�Dj�����c�@�9:��������(��(��(�>kgW��C+�/����\~�������|U,؆�y?�?t�|~5��QEQE
��F�6�	���I�1�������o�rl�k��.�x�u�����(��(�����ˬ_��*�ر��My�z��]���n���z����4
��QEQEQEQE��4�c��A��E�s��A?�{�y�ō���M�����;ȉ�n#8u?�ye����@MG�
_�(��s^��&�����
�Ej�9��Q��W�
+?�׿�	���+��e�߃&�<a�>q��O������#���
5����>$��G��4������Pd��{�Q@Q@Q@�ğ�5/�e��R�&���O�������ѩ^@Q@Q@{g¿�c���:�:�υ�&��]��t
��EQEQEW#�3J]G’Ϋ��3�)�g�˟�W]U�qw�\��4M�P�TQEQEQEu�M���8Y��?��#��ʾ}�c��a��?
+?>?�}@Q@Q@Q@Q@Q@'�S�G)?�ʸ��~*��'�q��W@Q@Q@����H����1_D������H����1_D�
EP
EP
EP
EP=cO�U�n����x�g��?���+��x'�Wl��F��j��6���z�`c3y�?�Z���(��(��(�_�g����9�2/>�Ҷ+���t�F?p
n�
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EAsyif�]Co��\�3U����
+Y����EP���?�)e���h���?�)e���h�C�oH������O��oH������O��U[}KO��ʷ���Lglr���@Q@����N�����$d'W?E�}�_O�����c��q?΀=����z[��`�e$�*�ſ��/�\B�
��Sc2$p0N��(��(��(��(��(��(��(��(��(��(�
+���5����A5�}���Q��Y�_8�
EP
EP
_@x�D�/����k������&���3@�QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEy���Y������U��
e�__�+W�P
EP
EP�/�B����?�!_I�͚_��m?��B����(��(��(��(��(��(��*����k�yT7�ր/�\��>�$��#�D��.*�X����?����u�W7�|/9
uUS����b�l�M;P��+�{����~��(��
+(��
+(��
+(��
+(��
+(��
+(��
+(�K,p��dT_V8�*���|�V�1��p���G��Ҍǫظ�>[�?ր4(���t2����RP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
\���5?��CZ諝���"F�����k@	EP
EP
EP��������ڕ���??�3�l?��zuQEQEQEQE���Qkz-Ν.��+�aʟ��h����K{� �J�e=�8"���⎗�5�."�A(�MÆ�@�5��
EP
EP��%���0e#���?J�]KJ��L
<K&bG"�m�j�U}��	v9kY�?����B#�Ί(��(���o�-��v�������U�m�ǂoJ��E$���ׅP
EP
EP
]�­M,�Nֲ�Լ��3������*���,NRD`�è#�h�+��_��|Cj��ũ"����/�ӵutQEQEQEQEQEQEQEQEQEQE
�|I��R��_�5+�kݾ$�ȉ��/���4QEQEW�|+��6?��'��l�W�"l��O�@�Q@Q@Q@#�X�
�4���+�a��B��ܯ�����|�EP
EP
EPσ��n���?�}	^�L�5��B��ʓ�+�(��(��(��(��(��(��*��'�q��W]��O����1�*���(��(S��5i����+�����5i����+�(��(��(��(��+��"H$�Τ��2/���^�̨����d��W�:�����{}���g\��?,P(��
+(��
+(�/��U���ʡ����
{�lm<?�[��j~�FZ�EQEQEQEQEr�&�֕��O�/GLg�?�7o�&�:����I,�_����e����"��^񎷮�K��������~��~�=;P���];J��I������^%��.x-�� ����q�PA'��M!�j��B����?��틏��`�@L�Q	�Q�I!C��5�e�_S��{��N�������P��_��r���x���s�����m�`��f��9�n���=^ҵ�GG����� ~�O��Q��4
�}����kz�k�"Z�x���>���_J�`�H*FA
-Q@Q@Q@PHPI 
�&�
++��č/L-����U������yγ�M{X,�^�0��co�/ӎO�M{N��
KȾԭ�a����sw�4	[t��=�F���^3Ez|��qo�q�$��/��O�cT'��m{�?ּ����Z�������b��~?�iv�����y�
��l\���W�)O綺;�^�T�V?�p������>���D���S�i�󞓮�4����a�%
�7�O�'�_m��-����S��O�g�:�קҀ=�ln�ƲF���*�r��@Q@Q@Q@Q@#2��bG$��+��7�]7I/m`����?�C�{��+���k럷^;E��S�~��@����úad�gڥ�l7���w��N����$i�\h;4�[?���5��:ۏ��'���q@=#��`j������:���`!XP���Ī��b�#��U���'����0��?��)Ez5�ŋ� _�J;�.P�G5��_<=��I.�S�7#h���G���(��IcY#uta��r�ӫ�}�Z��.�>��\���ꧏǭz���!�k���l�'�rc����iEP
EP
EP
EP
E���k��7ī9��IE��	�ҟ��߇�
ݳ*)f!TrI8��O�>�K,��� �q��q�׍k>"���&��I�@�A�
~=k*�=R��պ�,��vi���c\|T�$8���!��1�п�p�P\�<N�"���������G����~�+���;�%x�>��I��B?�+B�⾮��E������O�k��[����H@�Ӯ-Ϭl$�+���Y���-��	��C���c?�|�E};Ex��sD*��fX����L{w��>�����[M��zx�~W?��<�h���(��(��(��1�:V���N�?���y5z��'öM�����+�h��(��(��i'���ċ���?ҽμ��y^2��8��0G���wXѝ�*(�3=k��]�%ٞ�@m�8k�9?����K�/��Q��HӥŔgH��s�����4��+K4�$�r��I'ܚeP
EP��������Z���=a�q�K@Q@Q@���n�o�j7I?u:����5�~(�\3E����v�@C�t�z���m�yR(׫��5�����VD��D�?�/�ǧ�^#}�^�3y׷S\I�#���ҫP�\�X��m�]K��S�T$���~�C�\��e�2��=:?���ԭ���Z��� \�]��\�W��@�����w�,z�Q9����~��#��2�A ��u���z��&�>�h9�Uo��T�h��+��?�I�����?�K��z5�ݵ��\�N���*���&��(��(��� 
G��e��M|�_Gk�����_���4QEQEW���7K��#�������?���_�q����ʊY�U$��y���&Z�;�h��ܣ�;�ۻ~��@�݂��pa_x��vVmVa�0�O��-[]�u����3���裁Y�
��|Q��g	���V���n �_��B&-���P�[�M���y�u�t�8��I��?���@��-ݏDf����5��
�����oE*-/��?匿:~G����
|HӵFKmIE���19����΀;�(##�EQEQEQEQEQEQEQEQEQEQEy���Y������U��
e�__�+W�P
EP
EP�/�B����?�!_I�͚_��m?��B����(�)�����'�3Z�j/
����N29�=k���������O�?�+���v�u��,?�q4
���u��I�|'�Q�	׊?�-'���\�
���u��I�|'�Q�	׊?�-'���\�
��
u{�g���jy��@n�#��5�W��|�鎗���+��5k=N���]�'A��e��r�4�H�ƃ,�p�&��O��-���y�dF>��~�����ڇ��
+�l����OV�5��ޫ��wVf�V�(���(����_Ʊ(��
+(��
+Ub�Ir�IEt�7���%�Eٺ�u����=G�^��iZ�-��gz��<9�e��85ᴠ��ph��+�|	��I#ҵ��Fp��9�O`������*(��(��(��(���ֺm���ΐ��,��O�yO�>%^^��уZ[�3�������P�k^%��%�O�D�/���?�pZ��y���t�E�%����GO�כ��,�$���rY�I4�޿񗈯��uY�O��|����%�I�|�4���&�EQE9�p�#�N����O#����Q�7���f�(�H�~+\�*j�	*w���a�
<�W}�x�H�W��Ld��+���J���C"��:��)����TW��S�T��,�����]
������_�z�������"��r��ƀ$��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�w���������tU��@��#S�q�5���(��(��(���g���J��������R�:�
+(��
+(��
+(��
+(��
+(��8��"m�����I�V��k�+߼wm��jq�;b�?��W��
EP
EP
^��r�mާfO�D�� ��B�ڻ/�wO���?렒?�w��@�EP
EPmF�5
6��O�<M>��|�q���ʻd��0� ���5��#a�
N$?g��������(��(��(�G#�"��:��)���������:�_n�q��Q��oǟzਠ}�|i��X*�~������>��k�##�_1V���j�V��<
+?�>W��<~�
�]��w�=f�{mov������8�+���(�[�nl۹+�G�9�(���t�h����o+���O5�@Q@Q@Q@Q@Q@Q@Q@�ğ�5/�e��R�&���O�������ѩ^@Q@Q@{g¿�c���:�:�υ�&��]��t
��EQEQEW�|Z֖�I�G��}t���jx����S�_��sO7NV�~i�z��}cT��u9���t���tQ�a@���(��(���>��S%�-�����	�e�?�C�4K�A�
s.�>���r*�
+(��(��(��(��(���?���9I�\c�U�Wc�S�G)?�ʸ�(��(�������ZG�~�����&�v����ZG�~�����&�
+(��
+(��
+(��
+(���O�ݱ2����������z����Ҵ&��L]ނ�V?�?�O��W���[S��5o�$�4�>�;
�S��(��(��/��Zk�ne�T`�s�G���Mp��n��Z+Q�r�#QՏ���M�����,mWl0����ܞh�Q@Q@Q@#0U,�$������/��i4m2\Z!�<��-Ou�����_�C��Ӵ9JC��t�3�'������I$�J(��(��(��(��(��(����8��$KK��i8�բ�_oj���-.������U�r:��*Z�?��.}�Y^9:l��g�X��!������ԆP�A�GzZ(��
+(�M,pB�J�#�K31�u4
���iV2^��"�1���S�^1��_��G������D��z���>�j��ojgad���~��s�+���(��(��(��(��(��(����5����o9{�9��y��á�k�-.������U�Wr:��+��~���5Ѯ��D�o�?��=����ހ=��(��(��)�:EI#E���;�n.!�����E�(Գ�+�|g��e���Y�����o�����*��]~�����|�����>ރ��>�
+(��
+(��
+(��
+(��
+(��
+(��=�?�Oh��bF���Rs�E�}W���"+�FVS�G�|�^������h�=FO�i-�c����c���x��(��
+(��
+d�Eo�4�Q�fv8
+sO�(���f���6�b�nH�'��?�Ҁ3<k㫝rG��g�M�M�ރ����(��
+(��
+(��
+(��
+(��
+(��
+(��=��?��H��nm��+�<���߷ӧ��_1W�|-�;^[�M�@��ُ,��~��}(�袊(���~/)>� p��O�������QO��O���QEQE
��<�iRs���N=7����^":6�,�m��T���װ�}+ƭ%^C1�G"��sZ�0����Cqz��������'�J(��
+(��
+(��>����X�_�R�V�������Z(��+���4�%���{��R#�O�A�Ҫ|D�Y4m*\\��S������=��<��,^��jOuy;�3�����>�^�(��(��(��(��(�x�Q��ؚ�S���[��{�_~��E}	�X�����d��,,~h����k�V��5(ﬤ)"Gg^�Gpk�<?�[k�LW��
�t=Q�U4
�EP
w�@��z�����ƾ���
��׬��	��h��(��(�|�l�[�N�i8��s;<��:���Is�7A�fX!�}����_��J���k�=��4:j�q��ݽ�����EQEQEQEQEv���։$vW��q�g���z�oʽ����h�m�Ya�C#���_3�o���o�j	�^HM��aw�.z�{�~��j(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��<����,����ej�*�ߌ?��������Ȩ��(��(֗�![O��������/�B����?�!_I�
EP��_��������Cz�+�����&�&���ڸ
+(��(���߄���i�ܷ�ˑ��Q����G��%��&��1d����#�+�}�ʲ����O���M�\�4���}>l���
EP
EP
EP
EP
EP
^����
���M�V�]�2G����k�*擨M�j����@���Ќ�ƀ>���������[tS"ȇ��SP
EP
Y��e�i�{{&�^G�v�zջ��,�e���GJ]���ž$��&��Y-���?u}O���֠x�ķ�$��d(O����>��h��
+(��
+(��
+(��
+(��
+(��
+���]�&-.�#~�>�����w�V��f���x�-�Y!�C#���RW��,�1���»��3m������ֽb�
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+�~ ȑ������E\���5?��CZ�J(��
+(��
+(��=?������ԯN�1�1�1��a��+Ө��(��(��(��(��(�����Ì���&1��E|�_ML�d.�಑_2�
EP
EP
]�%�m�6q�e�ԏ�\�mx5�x�J#��P~g
�Q@Q@g��E���ϧ܏�A�9F}+B���X���mJ[��K�هfƩW�x��֞&�	!]�?s8#�����_I��o����Ӹa�q@h��(��(��(��(��+WO�&���Y�w1���/��r+*��ߊ��[�H.��7?���+���$�~�p��H{L�_��g��x�
���ݵ�"kK����x�0��M_5Y_]��	��e���ѹS�Wm�|QԭvǪ����E�$��C�@�Ec�^'�5����S.2`�E�;�FElP
EP
EP
EP
EP1�'�DMK���ԯ	�v���"&��l��jW��
EP
EP
^��h��ѫʊ|���Ũ��>�o�=����i������B�g��>�{�8�w����&��
3j�q��Ө���
��=�͚��+3������#�|U�Eh�{/+=&��o�G�&�֊�}}u��=���<���������P
EP
EP
R[�%��v�ye`���'Tu�
+�>o5'�n��l9������
��&��N�i�ǂ �)#���W���
+(��
+(��
+(��
+(��
+(��<O���R���q���T���O���:�
+(��
+(��.�Q��v�n򠸎W�2p�	��^��C��ܽ��C�����=������{�~��G�-r����*�b���Z������U�<=�����?���(���c�]���C���w4���m܇��O�My%
���u��h��+=�����
+��[��i�y$s�w9$��eQEQE(8�J������Y�Bd��'�Pz��+�����SW)=굅��.?x��{}O�^���~�d-t�i՘��}X��
+~�ͯ���"/�\I�4�r���·(��
+(��
+(��
+(�o.�����v�(]Ϡ&�8߉�':N�4�I1yv�s�q�'�zƼj�뚤�֯q�\}��!{*���QEQEWA��3^֑e��1�܉�;�Q���u�_�mZ����h��|��Ňv�����t
��&�d����?�F�?3�I�_*f
V����d��z�
�߄5�
L�ve�f��A��#��`�Ӥ<k˾!x( �Y�!؉�\[����h�袊(��+�~���X��t���s	'�����X��"��.�6���j}�\6?�:����>����+�8n�m�L����2*j+�~,�k�ã�����D`�?��Ы�|u�G�����G!�=�|����Q@Q@kh��Cra��*�~W����X��}}ogl�,k�Rq_Dh�U����ah�c�rq˷v>�8�/�^�
++jWs�I�c��R1[���Ѯѥ)�i\��
+�J(���w����xX�s?�$�Ҹ��/����4{��U�� L{�~��TP�l��U������'�LJ���-r�0�f��������=kͨ��(�V*������RQ@CxSV�������O����k^�����}?Q�$�)U����?:�j(��+��*x�������k�SۨO�z�5�V-E��e�S*��cđ_<]��yw-�×�W.�{�rh(��
+(��
+)�E$�$1#<��UTd�z
^��Z��y~�>��<��/����
�zG��C� �Z�X�G�;3�`�Һ�ݔM^n�b$~y��P���'ԑsm�[Jޒ+'��rZ׆���P�x�'U������5�=2h��'�h�H�a��A�P̴Ww��K��=5O��$}|�z�O�\%QEQE{���{E�nu��BO.�����=묯������+{��@�ʜz���p
+��A�EQEP�u%�4K�A�>De���G�H��&�I�i\��1vcԒrMz������S�q8��U�=��QEQEWM����C.�ء��FwE��]#O�Uխl"��&}s���'O���l!��@�¡T_�z��|�i1��O�YYgc���O���G�g��?��)�P&��TB.4�U����|��חx��wZ5壵Հ��G����=��^�M�4�'�TW��VV��̔V׋�o�/�X�L ����G���Z(��*摨K�j�ڄ~	��w���j�
�ʹ��Z�s	���#"��O����u�1��;@G�º�(���*��d����:�:�ϊ��&��]��u�tQEQEQEQEQEQE
�ů�z����*�����X�_�R�
\Ǐ<J<=��\�!��o���]3��3�U$��}�v����./w$.=�t���4
�����ř�I'$�mP
EP
E��M�M]m�)m�<��W�{���j���ږ�9�N��vx�~��+���^�"n���#��]��p��YӴ�M.�;;(���>�ޭP�j�
��L��s��l���`ҹz�v���o�b>��D���4�__�ր<��(��(��߇^!:.��L���"93�[�[�8>�ڹ*(��+����|/gv��`�\�����[�
C]����^���&�q�����j?��/��k�(��(��(��(��xsP���D��g�c����:��IEy���eA�^��Mx�����Ž��Hз��G�K>�v�;��_GF��pF�P�dbGPi+��OE�5h�_��>F72����G�^U�_ɢ�چ�^{ˡ����_~߭p�QEQEQE{πu��x^�I_u�����#��F?Z�+���&j�Nf�."ޣ��?�O�^�@Q@Q@Q@Q@Q@Q@Q@Q@Q@��@_�����yz���Y������TQEQE
kK�����vO�W�u�f��![O��������(Ⱦ0��~����f�?�@���!�/���ٚ���
+(��
+(��
+(��h^#Ւ���A�K)����P=3L�ծ�����)죀=I����J�Q+��������?���^������XB#A���9�c�օqq�1��&��\���/?����T?e���~�`���ֻ�(�|G�-_C��-��e���e��dW)_Nד|J�|z�Nt؂[1��(���F��v?^<�(��(��(�n�_~o|L�{Y����l~�י|�%5[bx9�@�!^�@UMV�-/K����Ar=q�~'��"/2h6υLIs�窯��G�y�O{u5���w
�i���rsPP
EP
EP�I4R��P2I=���)���R�]_>�����?���?�ֳ~xyn.$�.c�B|�pG����}O�z�AkgigK[h`A�X�(�*����#V���O�B�n}sZtP�x���xnaqn�6�+a\��?�o�k����M>
SM���]�L�O����_:�6R�ڍŌ���Hco|�
Z�(��(��#�*K�2���k�o
j˭�����
��?1_;W���K[���q�x�׆�K���QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEW;��D�O����ֺ*�~ ȑ�������QEQEQE
��?�3�l?��zuy���������^�@Q@Q@Q@Q@Q@
�����N+�J�OU���o%� v��M|�@Q@Q@l�8��$O�Jֱ���o�
��s�)4
�QEQEQE��h�~�dmu��Xp�}T��
+(��M��TыOh��s��A���Q�W_N�5�h���^�]|�	?�������]����\�KIj�P�?����rF�H�Ȍ��X`�€EP
EP
EP
EP
EP
EP���d��NU����
z�~%\[2Zk�������=��kΨ��-�`�����T�U��R׃�?��~�
+KMa!�������������P����U�	Wr2�
=Q@Q@Q@�ğ�5/�e��R�&���O�������ѩ^@Q@Q@Q@Q@Q@Q@Q@Q@U�H�֯���$���
+V=�I�h�Z�����ܻ�׻�Jӭ��6D�+�z�R}�泼)�_
i�g�\I�M1������(��(��(��(��(��(���?���9I�\c�U�Wc�S�G)?�ʸ�(��(��(��(��(��(��(��)Uw8\�����)(�B�>5������-���x��@�<'�hxk;53�m/�����b�g��(����2[1������>��z>�g�i��X˾'�;��v4
z�(��(��(��(���Z���`�#l=�������N?#]�xgčD�0�Ps�/�����h���(��(��ᎀ���on5���H~��0O�+��u�s��?����$��ß]�?��(���(��(�eWR����FA�P��2ѿ��Isf�1�a�q�Ñ�Vz��;b�u^Ah\���M^]@Q@Q@��U7��O��%����6H�w~��W��.�>����-����>����A��^�@
!A$�$���ii����c�&���<ȝ	�`E|�ARA���(��(�
�ȑx�Ji�
+?��M}_2#�n��U�����x��\����T�R+#p$>����@mQ@Q@~4�eռ+}gfI�U�Q���y� �(��L����{�
�������2�i�4�����}��׽Q@�/�?�'����G� �(��L����{�
���?�躵��6/o�`1e9`Î�k�(��
+(��<����Zk=6�Ty�ܜ���"�ҵ�S��Wķ��ʼ�'���_�
+ɠ�(��(�H�M�,�ˮ\&V�����������U����I�퍎�4q
��[�&�(��(��(�Xo�洸@�̅Opk�mkN�H�.��yh$+����5�}x����m�`\���e8�Eh���(��(�w�y��W�v��t�����z�W�W���<�R�Nc���~�pF�(�(���.�`%o��+���+�/N�u{�[�Q�3B�@�Ȫ���h?�ӿ�?€>u�����sA��&������9���N��T�
+�֊�+�����w���Q���@M;�
S�(ɾB%�nq�a����f�l�V�F�c7�g��[ˍ��Q��*�QEQEy_�K@�ze�3������Ѝy�z��$΍����pW�S��QEQE
�_�	��-I�Z9���
+���o��cX�"��7�
�ׯY��(�C��\������׈׸�N��"�����1^@Q@Q@Q@Koo5���O4�p��X��K�i�:��
��{晶��=ϰ�t�l|7d%ݸ������ڀ<�F�]��(�S�����Q�?チ���m��~s����H��ڊ�Ï@��{�ߏ֪\�-�eS��yv!�ȏ�]���ˉ�S���9����<+$1�&�o c�ޭ�q�׈Ww�oP7#��[䴄dz3rM��P
EP
EP
^���E7� ޸��yr9�c��xׇl?�<AabFVY�8�g9o��,QEɢ�xd�T�Q�� �O��>p���ҵ����%d���0j�v�m+[�\۫����� +���(��(�R�9|L��Dže�׆�K^�^3�s�$���ο�S�+٨��� 
G��e��M|�_Gk�����_���4QEQEU�M�X�m��a�ɛn{(�O�5J�7����g\�żg�����:�H��4Ȭl�* 廻wc�j�P
EP
H讌����# �Z(��o���[h��4�̓�Oo��~U�׮|_���w�4��e���������(��(o��f���\��3�g��)�u�|���~�0a���
+��2��2
-Q@Q@Q@Q@Q@Q@Q@Q@Q@��@_�����yz���Y������TQEQE
kK�����vO�W�u�f��![O��������(Ⱦ0��~����f�?�@���!�/���ٚ���
+(��
+(��
+�?�:2�>�VL\^
4�����I�ӭM�kh83̑�D�_I�,h��*������(��(�/m!�����wE2a�F*z(��g����O��}A��Unx�~1�UF
������QEQEz��1��E��m�F_�]��F�|Y0�wZ8�ǐ�J�J+��.�F�E�ӑ��Ro�S��G�^�^)�R��^/x
��đ�$n?��@mQ@Q@(�O
+J��}���Y�[�ܦuv�~c�@���5t���FQ���yc��Z4Q@Q@x�ŋ
m℻Q���1?�/�@���?l�k-2�#,c��������<�������O����k���'��h**_�\�	?�Gٮ?焟�ɠ���Yr`�Qg�>!�?�n��k��5�����5��X��zc�\4�J��H��
�4QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE��@��#S�q�5���߈�$j�/���
��QEQEQEz��������^�^c�c�c?���jW�P
EP
EP
EP
EP
EP'�'��d=��?ﯗ��ϵ�?����y��#ǰ�좼Z�
+(��
+(��
+�~C�x����H���ֹ*������ے8��g��?��@�EP
EP
EP
EP
EP
T5MK��٨X�q�2���Ñ��Eyޫ��mϥ��nݣ�o_ς?Z�?x�N,E����lw����J�Z(�Y��	sF�ꮤ�e}+yag�yi
�zKl~u�j?
�9y�2ٹ���d~X���P�Ov�m?S�Q�'B����+��|�=;&]2YP���?@��F��:�a�`�mQEQEQE�|2�3i���n��C�l!'�\���z}q�\-(%H �G ��r���~�u�
Z^9��|��^	�z�5�@Q@Q@�ğ�5/�e��R�&���O�������ѩ^@Q@Q@U�-3P��+���a��n}p8�
+�V��#���
5����{�������P]����@MG�
_�(��s^��&�����
�Ej�9��Q��W�
+rxc�H%��z���
�Et0����f�(�}�?��k����5���B���8�P$����{D!�
JY�R?3��]���E����$�Ն����#�)����[Ve��M��s*���S�ƽoD���
+�Z��_�s�9�c޴h��(��(��(��(��(��(��(����#����?�\uv??�r���������(��(��+��υ�����I����a-�@>�ր<����T���O�Ϋ���s�j����"h�(���ᧉ-�1Got����sW�V��>��)��@dB
���)�EQEQEWA���xkS�g)xs�z�q�֮~��^���H���Ya�C#�B
M^;��ş�w�I���
+v��1�'?��?ƽ��
+(��
+(��
+(��4�M!�F���
����w����C�����NM{���
��uIA��; ?�|�־|��(��(�U,�Td��+�kH��d��F�>�b�j��r���T�3ӊ���e���z��ߑ@�Ex��,���[��(����_��o�~E{e���K�=m��ȣ�_�筿��
�W�����/�����"��Y~%������Ps�Z!'���>]�7N�G����X񶵭i�az��B�
��s\�QEQE\�.͆�ex<��C�_H��U�?�tK�ɖ�7���_:x���x�P�#9�/����1_Eג�\њ
N
b5��ˆ�>�������(��
+(��
+(��:'ƾ �B�7�,K�)ǘ�Ny���M�����z�l���[�k��{�|o��G=J8\�����x��t�"F��e9�d�v��������-ʃ���*+��߉����ȽA�=k~k����ߊzM���{F=Yx����(���i�ޗ�&�>��3�[�U<�ʯ�
EP
EP
Y�#�����v8��k��\�����@q�������<B�(��(���6��^����q�a��Vt�ٴ��/m��аt�22=��J+���e���z��ߑG�,���[��(�(�����_��o�~E��K�=m��Ƞl��O�_�筿�����/�����"�=����$@��swY0��o�_�筿����x�V��v�������bm9�?�aQEQEWA�;����M�<<�Q��
+�2+����P��)U�� �ҴQEQEQQ�<6д�ʑD�,��@���W
��N��G��%������<���/R���+ܬ�f��)�>���
���d�+>�]��2.5K8��N��Y��o5=B��y}qq���+7�5R�=�o�^VF?�F���R��W��;f��������*(ٟ◇�r!�c�"_���-]�}5����]x�
�x��zo�t�{k(.�x��	�Tm#�Z�h��
+(��
+(��=��������fZ���/������_��k�h��(����"E�����b�:���w���������(��(��(��T��Q�c�(��hko�I�ʃι%"'�c�̏�W��].�4�.��<m�%�끌ժ(��(��(����Ak,Ǥh_���<Uvo�Q�\g!�/���~�VM+1f,�$��I@Q@Q@�‹_?��q[���8_��״ו��5�>9H�L�K���R�
+(��
+(��9�>o�g,Q��++oRw�t�ιo�T�������b���T��������T�������b���T��������T�������b��<%����j2��*"��E ��WE
C]����^���&�q�����j?��/��k�(��(��+�>�!�U���m$��-x}{��o�4��k��^�:z(��
+(��
+(��9��	|�z����u���	�{���"F�����k^	@Q@Q@}'����Y��ۡC�_�W͕�v�� 
;��b��E_��(��(��(��(��(��(��(��(��(��0�������V�"�]��� /����Z���
+(��
+(��-i�������
+�N�l���+i�]��B��QEy���ׯ�������?e�^��3W��
EP
EP����e����� O�����#�����
^�@Q@Q@Q@��G}O�������� �������9@Q@Q@��o����_��{=x��v��V�p?0�{E�.~��}N|�5˅>��?@+�v!T�8�k�i�2���v,eQ@Q@v
+��b�c>L���j�+оG�r�^2��}�a�
�tQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE��@��#S�q�5���߈�$j�/���
��QEQEQEz��������^�^c�c�c?���jW�P
EP
EP
EP
EP
E����(���j6z��ea���_ּ浼S�lx���6cy������VMQEQE���z-����=�c^G_@x&��;�:tp���V���?
+ݢ�(��(��(��(��(��(��(��(��(����ڜ{/���3"G����_t��i7g'h������@��>v�<?��-Bؠo�"��?ӭe�ҷ�V��������H0�����^�/I�`ۂ^�Q�	R�����`QEQEQE
��/�u9�,�?����k���>Lb������7��^�@Q@Q@�ğ�5/�e��R�&���O�������ѩ^@Q@Q@z������ߏ�5y]z������ߏ�5zMQ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@'�S�G)?�ʸ��~*��'�q��W@Q@Q@}��N��X��_8�����4�����A
~�(��,q�G*,��XdEqz��}RV��g�u���d��o�J�{�����
+��%^Q���u��j����j�2Y�B���z��c�@6�[�-����M��%��4��/������@Q@Q@{7�o�k��ٷ�f��~V'�c�~���+�j֙�\�Z�֏�h[r���cҀ>����^�\� �-�� ��<��~��@Q@Q@���|�]���x���W�W�|Xb< <��j�z(��(��(��(��(��(��(��(��(��+�/9���Q8��u�Ҿ}�{��"F����m@P�4�}oI�O�$���n�>���@8kUލ�Kax�e���ócTk��b�Ķ>U���L�gQ�!��ڼS_�����&���e���Zɢ�(��(��(��(��(
���F*�r8"���&�����O�ێ�1���~��k���=�Þ0�<Bv�n�ͼ�
�{𮂾dGh�]�)�`pA�O�G�##Ǧk���������?Z��(��
+���2�A����;�%#�f�@�6��O�����$�����EQEQEQEQEQEQEQEQEQE
����4�iV�O�OTt/�i�����*�Q^}���8�������i�����/�@
_x���������y)�S���:�+ȵ�j��Ǜ�\��~X��O��^����Ř�brI9$�P
EP
EP
EP
EP
EP
EP
EP�|�����z���^�^C�}����jH�5���(����'ȑw�����q���"E�����b�:�
+(��
+(��
+���boi��u���g֧�?�j�?���P�4QEQEQE��G1�gUq����g��ZU���uo���@=QEQEQE
�Ћ=U���1��o�I�:�9� �G��/��^�@Q@Q@Q@Q@Q@Q@5��j?��/��k��;]����^���&�q��(��(�������o���ѯ^^����DM7����נ��(��(��(�w���������x%{���5?��CZ�J(��(��+���@w�z�����ƾ�п�
�׬_���QEQEQEQEQEQEQEQEQEy���Y������U��
e�__�+W�P
EP
EP�/�B����?�!_I�͚_��m?��B����(�"���!�/���ٚ����������fj��(��(����������W�W��?���L�}���z��(��(��(����#������\�t?�w���_�
k���(��(���_��Q��?�{ex�¿����2*��������v�����k�]A�u�e�`3�5�UQEQE���Q����?�^o^��q��u4�bC��4
��QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE��@��#S�q�5���߈�$j�/���
��QEQEQEz��������^�^c�c�c?���jW�P
EP
EP
EP
EP
\��mlh��(�7��1����8��]D��/4��)ff8�ׂx��
�-vK�$Z����Q��z�C�`QEQEQE
���5�}z��FDҀ��9c�_E�p�,�C�o���e_�1�E�S��`~&�N�
+(��
+�,�|"�.S?�Wk\����*�w$lx�h�@!EP
EP
EP��ptK��"��G�W�W�|�u[by�r
�}�+�h��(��(��(��(�3⦞�^k����Ep{��?P
+��ǁO��M�<��p��@EP
EP
EPS�԰�֞pD��ym^�^'�#'��q�,�����^�@Q@Q@�ğ�5/�e��R�&���O�������ѩ^@Q@Q@z������ߏ�5y]z������ߏ�5zMQ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@'�S�G)?�ʸ��~*��'�q��W@Q@Q@}��N��X��_8�����4�����A
~�(��(��(�?�1��B��\/���;}C���)9��*�z�;W�u��Q�x�_��8�${���&�8�(��
+(��
+(��:��~&:�-�dŅ�
+�<Fݛ�o�{u|�^���Ŀ��_�m����p	<�@~���(���(��(����"���&��m���J�dѷӜZ�*(��(��(��i�z��-l/м�ʆ+����W�¹���I���hè�q��s���������
+�����'�������υ���O����G�+��ϔ����ƀ<:���W>��)?�����|/�>R�����+��\�_�|�����4¹���I���hè�q��s���������
+�����'�������υ���O����G�+��ϔ����ƀ<:���*S�Z`=|�6&�¹���I���k���Ӭa��R�B�QI'�h�Q@Cwko{n��P$и�#�A���:�~���6�s�f<�e��n���V𞻤n��|��-c�Q���}E|�E}�xkD�rot�$s���s�5�j?
+�ɲ�}��������My�j?
|Cg��8os�_�l~��^�N�����m'�oIP�:�EP
EP
EP
EP�|0�S_��b�HZ��ǗA�?Q����5�f�6��[�[�K����WѶw1^��w	�S"ȇ،�����/�z�_�����&���yҴ�q�ge����
��QEQEQ]oíN׵��]F6��Ƞ9^C(���J���W>��)?�����|/�>R�����+��\�_�|�����4¹���I���hè�q��s���������
+�����'�������υ���O����G�+��ϔ����ƀ<:���W>��)?�����|/�>R�����+��\�_�|�����4¹���I���hè�q��s���������
+�����'���
�z%�em�L�5��*�aO$I8�9_����e��\�b�`w÷�xk3;�v,�rI9$�׋���|Esx�A���:~}Ġ�(��(�������[{H$�f葩c�WC��\��s+���6Ē�c����U��F��h���O�HW��3�Rz��/ᆹv��=���q��Ki�J���S7�3?��@��9�xe
m3�V���*f�y�V\
0����Z��(�>#xSH�t�[�:���m��O�y�z��'Ƌ`��pN~�Ƽ��
+(��
+(��;���5]ד��i^�^;���F�����
+ب��(����"E�����b�:���w���������(��(��+S��5i����+.�<1�#V��_���b�>���(��(��(�� 
+j���<�?�Z�WT��ү!��O�H��(��(��(���?�N
����<GP��^�^S�nm�����#��H�٫ը��(��(��(��(��(��(��� 
G��e��M|�_Gk�����_���4QEQEW�|6��M����5��kݾȉ���_��
��EQEQE
��@��#S�q�5��{���"F�����k^	@Q@Q@}��N��X��_8�����4�����A
~�(��(��(��(��(��(��(��(��(�?��� /����Z���w���,����ej�*(��(������V���'��+�:��K�����vO�W�tQE
�_�?e�^��3W�נ|a�����z���^@Q@Q@��������@j���_���;������TQEQEQE
�?�w���_�
k������������-s�QEQE
��+���?��'�l��W�#���O�^�@����ԣ�7U85��|�����Q��w2(�n8��(��
+(��
+�K�ėq�����u��k��aq�x��	��9#��K�
�QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE��@��#S�q�5���߈�$j�/���
��QEQEQEz��������^�^c�c�c?���jW�P
EP
EP
EP
A I�GV�4���jQ���?3{
���0��޸�e`�k`xn~yG�X�=�\���Q��4�3f�L��i��?����袀
+(��
+(��
+��.n#�/,�u$�
Qף�(���۔��YKpG�n���R}(�<=�G�hv�|x&$��X�u�EQEV�m����R03�|������Q]@�V�[I�%FF�������-�%��bH��B
G@Q@Q@�DX��(���h�L����^�_2�,�M�9I#`�è �����> � ���!fA�:��=�k�EQEQEQEW�N�Z�E��a��X��w�ƻ"@��+�>!x�u�wm�8��#�M�� (���(��(��(�>Y���o��#XA��r�^�\��m0��w\KvM�}�������(��(����"&��l��jW�׻|I��R��_�5+�h��(��(�T�5������&�+�T�5������&�I��(��(��(��(��(��(��(��(��(��(��(��(��(��*��'�q��W]��O����1�*���(��(���/�i�����+��;B����^��"�/�EQEQEW5�H���Ҫ�kq���^�����
�h�*+W��g�?���@�G!1��y_Њʠ�(��(��h��ƍ�������qهp~���@I�z�����jۡ�woP}��W�|,�ص�ܾ-�0�~잟��ǭz�QEs�>��x+SA�0������u���k��.����x^?��k��X�#�(
(��(����J!���/�?�{�|ߣ]�g�6W�����_H�@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@6X�3����V�Q@ޥ�Oj9-�����폗��q�W�|+��4�E��(�E/����J��(��;�����H&^��PW��#����l��0$�S
�F}����5K	��J���bX�c��#؎h�Q@Q@{��[�u�@�-<G�9���I>������J��
��+ �nQ�І_���Z���|��H��>�wJ���(��(������["��KW_�yO��"�^i��´�Q��`��"�=��(��(��(��(��(��(��(����'L����q$��Վ�I�+��>��pSD��e�s�O�@GEP
EP
V��u=R�����L�O�֪W]�%�ƶ��&8�e�����e�,-��:T	*G��>��V���
+(��
+(��<��,�C�A�KJ�}6��k˫���z'�46�r-��FbO��\-QEQEw?�j���'��ҽ��w���W_����W�P
EP'�;�D�������xu{����.�ߏ�C��QEQEV��?�j�?���V]jxc�F�#��a���}EP
EP
EP
EPͺ����o-Ǔ3��1R���6?b��	pe�F�<
r�QEQE
��)��<`"'�> x�,7��^�_;�b�i�%Ӯ���:�?쓃�_DP
EP
EP7�|Kc�hg��yWآ��Es��t������u���4�@yI}p�5�T
�_�t������t�����Q��i��׎�@��WA��MG����G�-]�}5����]x�
�g�}Sԭ�`�����i�O��]�x/����i���ߒ1���T
C]����^���&�q�����j?��/��k�(��(��+ݾȉ���_���5��
��D�����z�袊(��(���~ ȑ�����ׂW��@��#S�q�5���(��(���п�
�׬_���k���@w�z�����EP
EP
EP
EP
EP
EP
EP
EP
EP��a����}�^E^���@_�����yQEQEZ���+i�]��B��|٥��V���'��+�:(���/�?����_������>0��~����f�?��(��(�������g����5{�x/��������@j��(��(��(���_��;������WG��G}O������(��(���~����q��W�W��+���?��'�l��7�]��<it���*L����A�r�3�ŧ���������/�j��(��
+(��
+�����<I�]���7�I��	��(��+/�:�ռ;c}�sI��7�
jP
EP
\Gś����"9V��W������z�όw����=O1�L��p?�@u�����'��h�M������5
/�n?缟�ѣ�7��O���TP�i�����F�h�O>����J|˘�
�v�+{�����Z\`gl�O����
��QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE��@��#S�q�5���߈�$j�/���
��QEQEQEw���/E:�Ԯ���򼼫�w�>��	|i�PF�o���+�(���+����������j���
+����c�8:ũ�u������/8�L��!s���TP�^�V�bZX�\7�{cS��ҹ�S�v�x�,�=�o���WEMuus{;Ou<���^F,O�j(��(��(��*ޙ�]j��YYDd�C�A�}���n<E�GeV?�4�����}+߬� �����10�DQ�
+��m�7�-�8y�
4����a�5�@Q@Q@Q@�+K:w�g�W]�:�O��A?�ru��43�xt�B���̫��?�~@¼J�
+(��
+(��
+�𧉮�5���~��L	�'�ބv5�E}�k6���N$O�^��чcW���?Q��.�͍̖��C��C�=�w�G�[��c�lR��k	�߈�J�z+����ᫀ<ˉ���,$��9�񧆙C
b{�Jߢ�ƞU,u�1��*��ďۃ���rGh�?�6(���n ��{���Pe���y���bVR�^��{Ip���G��
�kڦ�/���I0*�~�8���?:�ri�;�o�Y��J=���ۿ�QEQEQE��}��~��A�ٷJ��Pu?��Ed׶|8���4�wu����v_�s�zP^��Ʊ��E:
N��(��(���>$�ȉ��/���5���DԿ���J�(��(��+�>
Ǯ���ɫ���>
Ǯ���ɨ�h��(��(��(��(��(��(��(��(��(��(��(��(���?���9I�\c�U�Wc�S�G)?�ʸ�(��(��+���@w�z�����ƾ�п�
�׬_���QEQEQEQEyW�
7e厨�Īa���W�'�7�w���h�:�*�K|\/���:Z�"�
+(��
+(��
+(�������YNAA�{�W��:s�k��w��������^]�<B�ף����o�ο��o�������H�����R29R�
_?��O���n�n�2������~�y��
$���#^����O���P��EQEW��WDžmd-��D��^��?�x%t��1�汙�67I��o�
����v���\B�C"����r�@Q@Se�!����#@Y���&�9/����w�^}��0�pp@����kž�q�=����ox��_�k�,D��
��qݿ��(_���y?�G�n?缟�Ѩ��	~�q�=����i�����F���=��mf�wwe��'$���������!�0h7w��73mS�?ĵw�
�|O�uM�O�M�{1�_h<uZ���N�Q�Ai?��
+�/�V�oEp��{�b� ��Ex�t�x�����	��u��I�|'�W9Et�x�����	��u��I�|'�W9Ez���̺���\I�Ǖ��������5������� o�M�����W�#�������*���@��(��(�����2vO��#?ב���i�D�'�W	)ff8��z�N�5�^j�.G�y�����@4QEQE�
+��>Yǟ;�=�/��^*
b����������0�¡���ߩ4
�M�H�7P����4�(��R���R��L�V�'�3U+�����]z-I�w��?��
�6����
EP
N��9Db��2��M��>��5H���P��@X�a���+ƾ��4k�ӯ��cp�Wn�?����=��AA��(��(�����m��M2)
+�3�����^�O�;]�����e5�ܢ8"R�������K�K��������A�����n?缟�ѣ�7��O���TP�i�����F����y?�QQ@����{��}�O��#iڕ̎�T@X���j�j�?������˵�Y�#�p?��(��2�ͻ��񝹛?_�ֽ6���
�}��#����.�Z�J(��
+(��
+�>^�����	+O�?\W7NGdutb�� ����tV�|G��T�pq�	�7�����jߠ�(�������[��$Q!wc�
�jJ򿉞/��6��J5o��W���z����ֵյ��B@A�B����0*�P
EP
EPw���F�����
+ث�>0_�V�p?�?ҽ��
+(��9?���$]����+ë�~'ȑw������(��(��<1�#V��_���b��S��5i����(�(��
+(��
+(��
+(��<���d����1�C�y_�μ���״����N�Ό�'�[����_;\C%�ĐL�%��:����(:(��
+(��
+����|3ew�2l����>��|�]�������u&�[�6�<$����
�QEQ\��<G�tY$Wl��N����A����>#jCR�}���v�[��w����-J�Y�1%��'����(��(���5���R\��۳gܐ�M{-p��o����k�v��T�������
+���5����A5�}���Q��Y�_8�
EP
EP
^����DM7����ׯ	�v�m�"&��m�k�OEP
EP
EP;��D�O����ּ�����������x%QEQE�v�� 
;��b��E|�_Gh_�ӿ��/�P�(��
+(��"E�#D���P-�x�G��It�n� 7QJ����S|<T��1/�^K�_>��]�>s<�&`O�U:�����PK�)�0���D���\������ҼB��D���f:�'��I��
:��S����C%��(�s���ھ{�t�u�j�N� ��3�^�
��&��+Kh��@�D�G`�	(��(��(��(�����?��������ȫ�~0�������V�"��(��(�Z_��m?��B����4��
+��d�Ѕ}'@Q@E��C�_����5y�z���ׯ�����QEQE
��?���L�}���z���#�����
^�@Q@Q@Q@��G}O�������� �������9@Q@Q@�¿����2*���?��9G�\d�U�VG�����
�X�̌���}y���Z�P�d$Ai+�����#�Oub��2�:�!����!@Q@Q@���\Ui�9���{��_�:�
+����{+����1�G��o�,<An�K"[�a�c���=~�G�@ETs�
�-4�Q �;�P�4�eHayep���f=�_=x�W:�n�|�|Fd/�3��W��&�iZK��3��y���������QEQEW{������ҹKhp�1��W^���H:_���E�ׇ�oe?t~\�4
�ה|K�5m;����qo�ѶG!Q��5����nO��O��
��	_��5{�������W����5
��	_��5{�������W����5
�xC�z�ߊ��{�V�Xd�G�������<�#���]��5��QEQEQEQEQEQEQEQEQEQEQEQEQEQEW;��D�O����ֺ*�~ ȑ�������QEQEQEQEQEQEQEQEQEQEu^�6���O"�KϜ���^�
������Y�Be��'�Tz��W�xK¶~�)%��~�r0[�z
+��h�~�d-l!�]�,�ՏzѠ�(��(��(��(���Exo��0��e��.Ih�!oo�{�R���MgM���=�H;uS؃؊�����G��<7�{�^Ɇp>W���Ġ�(��(��(��(��(��(��(��(��P2p95��	�z�z��H~�v�0_���~���o��u,zޥ-����ُ��������T*�:
+Z(��(��(���>$�ȉ��/���5���DԿ���J�(��(��+�>
Ǯ���ɫ���>
Ǯ���ɨ�h��(��(��(��(��(��(��(��(��(��(��(��(���?���9I�\c�U�Wc�S�G)?�ʸ�(��(��+���@w�z�����ƾ�п�
�׬_���QEQEQEQE2h�xd�A�$R�=A5�m����6r}�%h��Wҵ��,>���	r�2�#�S@�Q@Q@Q@Q@���_�Q�n_76c�y��v��}1]�|��躽��n~h�%s�/p~������Q�����C2S�h�Qִ�u�"�O��L�s�������(��I�/f��B�B�{���[◅��_۶Q�X�*�Q�����^S@Q@Q@G�<m�xsc�V$���}���U�O��=�"��me=c���zμ��f�M�ʒ��0#��;�jY�*���|�G����;>��=�U���c6���e
��q��H�-���|B��6�Ɍ�����뒢�
+(��
+(��
+��.n#�/,�u$�
Qף�*��Mru��uV����o����P�hzji-���0���n��'&�QEgx�M��{��h�L�9_�
+��ѣ��u*�H ����������S�[�~�vٓ�������(��(��+��_���#K
E^��}�^^/�����WE}��zf��O��|��
�U<��_1�`�H#�Gjч�ݸ^�tQp���@E�
S[�4x����P`d)l��(�ׂM�rpD�������f�Y�س�z�s��|i�ٵ�k
=^����_A�\MP
EP
E=���בZZ�d�V
+�;��~�m���)�L�ّ4��-�#���
{�cxS@�ú,vI����H?��_�t�@Q@^2����;=�
����$�|v�FG�^���J��F5��y'��;îY���;~�T}�����?�y�Q@Q@v~��}�F�w�o,����=�q�1\e
��_��=� 0�QD��Y�|�����rG*����*r+�JUb�It"�>��h�M�ȑ�����c�~ґ��V�a�+c����?:��K1,I'�4�
�x��ڇ�f. �C�����Os\�P
EP
EP�M�W��t�~��?���2k�xc����%�HG����6Vm�]lj�l�V?�~?�{סP
\��4�xB�$]�F�r}T����t4@ �A�����h������BO�	�C����V-QEQE^�5k��/,&1J�{��w�:/�2�5MZ����/����אQ@AG��H��Y��y����+���RE��X�ǁ�ׅQ@���"�:�ok`��ц�̎=�a�?:�h��
+)ѣ�"��v!UTd�{T����m��w 	� 888�(�Q@Q@�‡�������i�
�g/��{%�bȿ��?ҽʀ
+(��9?���$]����+ë�~'ȑw������(��(��<1�#V��_���b��S��5i����(�(��
+(��
+(��
+(��
+�O��6��kv����$�v@8?����[��������cv��v���#�h��+S�Z%ׇ�ilnFq�rc���@Q@Q@��o�3��%���@�	2�(�9����]�<,�����h$������(׵�Ze�L�]��sc��lA�O��^]�귺�����d���
+;;
+�EQEQEcO��Q����wM3�Q��W�X�]�v���v�<M2��OUCտ��Z���t�2���pF\u?S֭QEP��
��׬��	��k��w�@��z�����ƀ
+(��
+(��
+��?�$Z�'��kë�~�ȑi�������(��(��(�w���������x%{���5?��CZ�J(��(��+���@w�z�����ƾ�п�
�׬_���QE��C���xT�K�-�����]5yW�G}페�����V�~��t
��QEQWt}:m_V���<�?���2
+�����e>�2|��(s��~c��?�5��
��66p�[��a@�=��M@Q@Q@Q@Q@��@_�����yz���Y������TQEQE
kK�����vO�W�u�f��![O��������(Ⱦ0��~����f�?�@���!�/���ٚ���
+(��
+(��:?���;������U���w�?�o�
�ި��(��(��(�~ �������9]���?���@Z�(��(��(��W�#���O�^�^'��G(�댟ʽ��
+(��1�U�E�k����s�:�c�k�.�������3�1WF���������x�������5������@9E)��QER�������5`�&�o�-b�Pt_9�>��K�J�P`׷�ܑ�͐�>���P
EP
EP
EsJ�n�}B+(�ɥ8��'�
���?�u��u?d�\7�?������^��B�
@����h��R�4��\s#z�=k�
^1�g�F���T�m^�^1�g�F���T�m@MQ@Q@����K������������a��{�QEQEQEQEQEQEQEQEQEQEQEQEQEQE��@��#S�q�5���|qo=׃�-��i],q�f?0�x����@MG�
_�(��s^��&�����
�Ej�9��Q��W�
+?�׿�	���+��e�Z���k������G5��j?�
+��@tV��#���
5����{�������P]����@MG�
_�(��s^��&�����
�El/��B�h��>�0�b���0F�����Ţ��O��8�&��Q��\��ϊ$?=�q�:�MrtW�Z�)դ �_�B?�����[�
+��Hk�ۛ�;(��g��"'�]��}{X*�hm�?�����O�+�4�
�N
��n:HWs��G&�h���ý#I)5��}��t��S������QEQEQEQEQEQEQEU���=Z���Y�~�{P{z�|=�4v{�<=�_�fHǸ~���i��>b�����u�Ҽf�<��aI>��~��z��Mnij����;_��MqTT�vwV2�Wv�����P��j
+(��(��(��(��(� �k�DV���X��WQ�|<�����l�?�pv���d�`P'Z��u]zo.�՝
�J�,k�o�9�P�>��e�w�&�m��G_ğ�v��,PƑƃ
+��=��S¾Ӵ"�7^_D�>X��#��~��QEQEQEQEQEs�DԿ���J�����~���	'����ĥ��E'{
+��G5��j?�
+��@tV��#���
5����{�������P]����@MG�
_�(��s^��&�����
�^��k�=u_���M^���@MG�
_�+�~���}��/l�-K�eD�2n�n���QEQEQEQEQEQEQEQEQEQEQEQEQE
�?�r������������R���q�QEQEW����4�����A�}��N��X��@袊(��(��(��+��1��7PQ�Y�s���W�W-�&��� e�+2��&�<.�(��(��(��(��/�?�|�_A���%�{����4�mn&������MF��P�Vg�u����P�ȸ��8����1Zt����T�z�x*M��-:"�s��(ɀ��>��O���:,���a��A�
��-�k���@�Z1������Z����kY���P�ԩ���(��(��(��(��(��P2p95�xS�����u����밌I ��?�z��g�.<I~��#��}�_��g���ᴶ���5��*"�Sll���8�,�H`�aQG���S�
EP
U�mN�k+�ĐL�YO����f��?xV��W�[t�r�ώ����:��k�+mB�KK�h$dq��>���)�o{���h���z��ʟ�P�s�ހ8*)YJ�V08 ��QEQEQEQEQEt��>���K�K3ϟ0�G�#�/z����o���C�D&���
�Ð����2��H��W�����4�[쳏t�1$�˿�a[TQEQETW6���Imq��UѺjZ(¼i��^b
.�+~�^�?�o~����6�]��osK��2�)�_�k�F{�5ſSo�D�x~�Z��)Ό�Qԫ)�`�M��(��(��(��(��)���ȱƌ��
+�2I��]��<������b9��v��>���ixK�Ӳ^k�b��ڃ��ǰ����S�(��!�5�4
U`(���*�P;R�EQEr�=������G���О��t�{{׆:4r4n�]I�`�;W�u��������tбj�М,������x�5ݥō��]��̇�0EC@Q@Q@Q@5�����[���L�
+��'�X�W���ǏQ��x�4p�V#�}[��
Ï5�[���Ha�xX��#����Ӈ��l�3�ރ��5����1x���J������
��EQE
�����
)�n?ﯗ���U�E���������9����DWC�a�}E-Q@����.�ߏ�C���?��H��~?�W�P
EP
EP
Z����H����1Yu���������C
�MQ@Q@Q@Q@Q@�+�ݯ�t�o.#�2a�(���Z��{�_���&)W�a؃�W�����,���Y#�J�<g��@;Q]?����҄7VC������^��P
EP
EP
EP
EP
EMiiq{p���I<�¤k�k�|#��-�/u���9[Pr����������'�U�c+d�1B����g��+׀�`
+(��(��� 
G��e��M|�_Gk�����_���4QEQEW��1��"���?�3^^����D�O�����u�QEQEQEs�?�H���_�
k�+�� ȑ�����ׂP
EP
EP
_Gh_�ӿ��/�W�5�v�� 
;��b��E_��(���]�j��P�
��#?��?A����?�>���C��|���_<P
EP
^���C�Ʒ:r���>����5��e�ڞ�ocn3,�}����}�YC����V�("���
f�(��(��(��(��(�?��� /����Z����⭍���g���.���r��yw�#���
5���+S��{�������Q���@MG�
_�(.����s^��&������9��Q��W�
+����V���'��+�:��N���������*��I6���
QEy���ׯ������t�J�[���O��E��ZY�;���G5��j?�
+��@tV��#���
5����{�������P]����@MG�
_�(��s^��&�����
�����g����5{�x���=b��t�:U�1#�i$�uQ򞤊��(��(��(���_��;������We�X��=��{4N�VH�ݔ�����׿�	���+��e�Z���k������G5��j?�
+��@tV��#���
5����{�������P�¿����2*�����>�e����/-���,��z�^�@Q@Q@/���_P҂C}����{���^Ewkqer��P�3!�#�_K�V���/_���-�8IW�O�����ފ�5����i4�R��p�
�<��.����o&��[y?�*?�W��(��(��(���6��I�O����������]����e�\�u�<�����p������[�ø�+p��R�Z��xb��V>U��.l�>g>��ڵ,lm4�T���H!N����}��QE��nO��O�������R��5��wq��w�:�-�@�<��?�׿�	���+����k�����€2�O�G5��j?�
+��G�#���
5��^���K�������hZͷ�4٧�o��&���UFRE{}QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEG<�Db�$�3�]C����7��I/���?q�WEEpW?
+�Y	0^^B}+
�g���~w�[�����N��<��_���-��Q�j/�U��,����]��<�>�E~}N�@�j�_	?����o��W�Q@�!0n/�%?��A��mY��6�����3�������������?.��(#��H~B���(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��c�������k����*Z(/�[����G٭���ȩh���o�<#��Ef�����"���"�5������(�Q@Q@Q@Q@Q@!
����Z(/�[����G٭���ȩh���o�<#��Ef�����"���"�5������}���xG�|���������?��Q�k����*Z(/�[����G٭���ȩh��$c����:�(��(��cA���|�F�%#�G_�kJ���c�L�ZM"�:���`��C��+��|'�饾ӥϴk�/湯����*H �8 �WҗZ}��vV���%o�+*xjs��������"�<��G�y�V\
4���O��'��
+���Y���F�����fl�!8��g�d֝���Ymt�X�*��
�:���H���2���2��<~��i_5;���]Eh��?x������(A�v�����͸��o�����袀
+(��
+(��
+(��
+(��1u�
+���Z��|�1�G��:�9�U�Sug���{G8�ߘ�?��V��<���#�'��gu���;�Ś	��l��z:�?�}3Hʮ�YC؊����JM/N��e���<�U�&��@�/���@8԰[Op�`�I[��򯣣�4���X[&9bQ�*�
T
�
+�/����+H�P{�<���b�m3�M��[R�����
�׬�@���G*�Z}�q�-n>s�����EQEQEQEQEQEck����&��y���?�A���s^��*����W��'���q��?�z�
��oM'�z]�`up�����_N�;�+M�ɻ��g'��+�P��W����ϝ�D#?�,�Ȋ���,�Ɯ����V����~xUWL,}L�F�P�3�P���n���4
� d�rk_N𾻩�].��v]��}6{宝ae��V����%_�*�yF���R��_$	���ߙ�~���t�?�-e���H��0+^�(��(��(��(����t/\�E��$�~��u�0�W��(`K�:�#�w#���
+�
+(��<	�kBs�<���X>s�VL�.�
��]�g��J�>�����A�PG����ZN��5��
����<EzG��\�=�_,~m���7R2��|��x����<ֽZ���<?��P�z}��H��<�}I�]+N�(�GŞ�ĺ�w�|�̱��a��'=G��]u
���-��3'���U�-��3'���UzM
���-��3'���U�-��3'���UzM
���-��3'���Uz�l�z}��Je0ı��lgb�(����q�������<��B�с<����W>(��(����{�
���|Q�>Q����?�\���|�����5�4P�¹�G��G���h��s�������׸�@�
+������O���|Gg�i�S�F�Cs�D�p��=�{QEQEQEQEQEQEW/��A�٤�9���d�����O�5�Q@C�|+�`%�/ �OG�m�G�\�߃�GfH�G�lw�|���澁��>j�����'���Ϋ�ӴP�``O@*ݾ���`[��Sg�y����}#ExM��|MxG�K��w	�ï�]^��5e}[P/�������
+��(���i�4N�g
+z�f����j�P
EP
EP�����Զ�4m�g��^{�
+����2߁��W��@m�
+����2߁��Q�
+����2߁��W��@m�
+����2߁��Q�
+����2߁��W��@m�
+����2߁��Wi�t
-5'3���v�$���j�@Q@Q@Q@����֋s���8x\���p��-��3'���UzM
���-��3'���U�-��3'���UzM
���-��3'���U�-��3'���UzM
���-��3'���Uz������
�Cǻ�3�T�P
EP��`Լ�>�LF��s3����~d����|FԿ�|aw���-����-\�QV,,��/���]�L�{��_�zZ�\�8���!�רUM'O�Jҭ� ���{����5n�
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+�h!���<I,g����5%
�]�#�7��4�����
+ʛ�w��9I/b�IW���ڊ�?�Ti����?�H����T��k���8�>xv"����(��e��X�a�m����������*�R�EQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEWT�M;K���`��ǮqV�����}���f����.?�_���G�@74�4�,�Y݋1=���(��
+􏄚��}ne�"�Pduc���8�My���חp�����"��p+�L�Fѭt�pV
+[y������EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
^3�_R�_���[)gR?�o���*�j�~!����cTMN����cf��!�'$��@1En?�`u��描h��J��{Gl�i����K@o�m��2�3/Y��r�����+���i�����tpG��	���潪ٝ��y
+�d���hJ(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��?��
+endstream
+endobj
+27 0 obj
+<</Type /XObject
+/Subtype /Image
+/Width 3000
+/Height 317
+/ColorSpace /DeviceGray
+/BitsPerComponent 8
+/Filter /FlateDecode
+
+/Length 26976
+>>
+stream
+x���u���s��N[3@��I8��<��2�%[���@R�o��=��h4� H==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
��z�����������}��^�/H!� � �V<���gF��f���+�AAA=V�����z��&�>#� � � ܬ߿�ȟ�}���� � ���e} \���d<����;�)A,��D�F�AЏ
+&t3���o�-��RX�}�P4(�?z�_���o?�ⶈ�^����|�������x�AܲF+�-	iA?*�v��׽-ڶ�޾�U*lS���nTd��J�sꄮ�)��ɿ.��&����,�N�����}_�GUژ�#���
A}h��3�s������6��ރ ��=X6�}����>��R�x�
����@=h��s~o��÷��xk=�A�������Ʒ�}-�e��.1�l�|Kv_��s��ۏW�� �?>��xC��C��`�t�63�����#��e$P���.fn�}���呢 ��p'$�8�o�
?�����������%�vq@Mw`��0������?q	��n��$�������{��k�l����<���ӷ�g��j�� �'��;!��!|{�l��ߊ�ܬ�[w����;�j��>��,2[�>��A0w��;!��!|{�l��ߐ�̬��k����j�#�S�}���#� �~�NH�q�,~���k��X5�\;$��	�6�2�s��o��R8� J�wB��C��`��ӿ5�ؖI����]�ע&;3��ܷ���y
�`��wB��C��`��ӿ��N��~`W��M�bo�_������_
+�`��wB��C��`��ӿM�ex�v����%	j�?�Y���I�k� �9�����=X6����d������'IPs���9�%�����nAp?�wB��C��`��ӿ�lȮ�Q�zQ��;jm*ߛXY�oo�a� ��p'$�8�o�
?�;���x/s8#�î�oC�M�n��*���]��A~�NH�q�,~��d�P��2�wd��i�Q[S1�Y�����>�A��_��|·ˆ��}��ܑ}C��LE㎚��O���,ǷW=9�{�_��|·ˆ�����vX�u�;��;ji:�r_�o��&���/�	I>�ۃe�O����r�D��j�54!߽���|{� n��$�������t�r��m�o�+]:jgJz�E��0�A\�/�	I>�ۃe�O�)��I���m����E�LJ�k��,�>ɫ�A�~�NH�q�,~�OB󟏜�m��P�M�V���q_�o���Ap	�p'$�8�o�
?�'��5^Q��P�-�F&��q_�o߷�����$�������T���Ȝ~n���6���S����^r��>��$�������d�;�ڢ�'��mCmLN��/����蒂 x$��;!��!|{�l��?�>�x�܃Pa351=�Nq/Ϸ7>%���׬�$���������^��H������0Zݕ�0���Y� �~�NH�q�,~�OJ�M�����Oʠf��}�F��ۻ'���/�	I>�ۃe�O�i�o�g~�����j`T8db��ݟ
A�
�����=X6��������8��H��,�2�H�'e� ��_��|·ˆ��SSٸS���f�~��l*~]r����g��8��e����L?�wB�����'������5�ߨ9#�ϴ~�Q_�}T��s��σ>'e���+�}˅_V�|·ˆ���S�s��5�Ϸ[����g�#��
w$?�w'6��;=��`��wB��C��`���z*�U��,��cٯ�H⳴H}&l�u�`��=�� ��wB��C��`�����(���mߍ}yN�[߆;R���B*��
� �wB��C��`����zG��饷̙���5�
w$>zxӥ��X;� 8�/�	I>�ۃe�O�Y���ˆ���.!�+^\/����φ����b}�]Y
�p'$�8�o�
?��|o��+>�չ�m���e�Z)�)��:��2z����l��.
�u�9΍
+o#_Q%� X:�����=X6��@������a.Q��T������^;ni�� �	����S�Q�\�
iؑh����x[�|X��_��|·ˆ��H���u����~��n��c2�7mge<�
i�HH􌗷�h�I��������7�f]��p'$�8�o�
?���
�u�Z��=o��q��32?�t�7�ܷ<��v�᳚>�����ު����Cw��&$�8�o�
?��j�׏J[�G܇}u'����׍{B�� �	����C��ु)|���\�`�	��
��IB��C��`������RѺ���/��Q\������A$�#!�,o�v�+d"��?4�����aD�_��|·ˆ��H������3����Խ7J�8�7��s$$:���Z��:�oZ�Ϲ�A� ��;!��AX���~����Yy��/>�'��_����s4)�HHt�g-�~i�f�}$j��ء� �������=X6��@��J����o��LB��#����H9GB��H����ƨ��9$jE>$�C��A���;!��!|{�l��?�T1u���c�c2��9Gě��)�HH���[=��(�I}�׸7�M�_��|·ˆ��H�³���֨�q�c2u6<Ż�q$�#!�{�x��´���J��A,~�NH�q�,~� Uk�:���~F�#Tz1P��'��;Α�hώ���fb߮��zw�p'$�88!� �?�������2�
�A��.�H�q��d�@�9-�Fx��k�R�(�#2�G.A������=X6��@�f�_��_MO�T�nW7��SH8GB�1�{�퉉�}�8�ȏ\� �������=X6��@�v^�/��H��$�\s�S{րT�@�9h�&m�O�۟�ȴ��	�`
�wB��C��`�������];�"~Х���z�]�4��q�)��޷k]8"?r	��^��$�������R��6�Oh'WDK)�� ݰ��A�9�hٵ�/ӄd��(��J��*vw_Z�|·ˆ��H��iܥ-h�;�R[#Ho'�7H7GB��>Q/��|�x�8��� �w��;!��AX���~���������]wսN�K�	���ts$$�Q���1�2߮���z�����$�������Re�w��h����TL����#!Q��La���|���g��Q�_��|·ˆ��H��e܅/l��f���7�Z��#!Q��v�,|��Z�@�� xt��;!��!|{�l��?�Ti\_���.L܁���5�aa�]��;��0�.=m9��rw�p'$�8�B�A�~� U��lc�ʜR,�^;�3�r�]=a�ts$$j@=(S��y�v�iˁ��� �s��;!��!|{�l��?�T�s����[��V�#��l��D
��z��]X;�$����/�	I>B�MH3��O�
������"�k$�V����#��l��D-(�&��o\"
>�A-���pw�v$$�8�o�
?����zz/�����!Y�@"��l��D-h	V�����q/��ґ�pw_W�|·ˆ��HU��Ik��v���
@yĀ4G@�9� �NH��L|��
���� �s�,!��!|{�l��?�T5ėE�OAj���dI����HHԂro�/��`&�]�ƾҰ�C�^������kv�gN�+XB�����&����R�N��o�j�]����6��H6GB��9P���9�aF�<�mjB�A����y}6m��X�y�W��$aQJH3��O�
�*�8)C����F@�,��Hr$�#!QB�x�.F�ΰ�C��1��_�j�p'$�8�7!Ͷ<�O�V���@�*��:���/Ar# Y�^$9�͑���S÷���S;Ap�<��	��x�7!�&���i������|���?������K;�|	����te95�Z���]��R�FX�ؐ��Ԟ�o�/t:�wB���"|�:}����Ćd�~M����;��a&~��^�Z��@�2o��Q��2Hm��9��,GB�&P+y·�U1�s�O-��]�b��p'$�8�޷���w��6ɾ�j�>]�m>�:���1=�@�:�;wP�����lAW�#!Q��<��G���^��?ޖ���a-@���r��R�����P׷��9P
}c���Ӧ����:��x���
��RՑ7�wH��6BK7�te95�Z��2�p)ρDP�# �Z�������|�W��Y�K
+�����T�GJ�Mߏ�g�X�Xc������١(~Nz�.�߮�W�VoF����}V�^`s�Ru�e��$6ҝ-��r$$j��'|�;$[����/����x�^��A��I�3>���O;�������6|O�[�wz������oM䰿�����|��텵���|�}��%��zz��GX��H����"o�Se��&o���	��@��y�>�/�<��ס.�~Ns����{���
��P��u��6Ov�T�q8?Cs*/�����e=<����vxJ�Z�-���$$y�3>ѱT��v�ggƄЫe;��}�l�+W�G���H��f�A���v�mƳ)��r$$j����;�]��E������/&�s��{�%#��5�~ m��W��H�u+c��~�fD�l�Q3+V��y�#����
?~��n��.�9v�M���oM�қ���l���\��G����"?���D{x��?�T=г�fs@���,�|��ʑ����*K�Dy��c����K_�F|״m�g�����N�g�������D���j����kԲ+�!���O�
+~KHr]�����қ�լ�v"��|v����ٖ���րA���5>ch�G>�i���+GB��9���5���ϸb�fuc��PYK�׿t>lY!�]��z
+�G���E�Y��e����|;����T�{~7���G�pM
�_U}{f�������Vo����<�s�?���S
��X=z���U��@��#!QB�hy$
>呺Ѣ#OÞp�ݞ�w����~^;���^'�����f���]�h\�I����Z��mrD�_�Ө�
�]�����Uշ�����m�ѩ���kw�A��Ru�Z	�AO�����@��#!Q�rB���G�<��+~DL���rm7T^����.ޣ�nֺ+�Bty_u�"yg_=��<���F��4u�p�
>�J�v�r���0� ���βYx��~� U��LT`z�����,AW�#!Q�I���R��(����_K]k5`�v�}����	�ƹ������e{�%V�[��Oo�
������[�I��o7�@m�޳�g-9	5@��A�>��{NB��S�ߒ4�r$$jAK��A��oA-���Q����Qh{���s7�?�n4�������zXW���ϑ>���Wʨ��}`�nr��j��띑��[}�s	��a��6�ڼE�>ԃ2��U`�ĬC�#!Q�/h�(H��҈��,�J�G.���O�eif=��;}8�K;��Z����˚�<�s��t�Ἱ�,q!<��WU�~~��I��b�k�*�#�ƃ2��E�NԂ�t���d��-�]S��D
�_RWS������u@�]�i�]�3���}���
�u����z�(�|�A;��Z��E_�45]�����;]K��U���>����3�U�9�7�_�����{p
?��������\�/u���+ʑ��
n����AZ��(��]{��kZ���oUvH�4�_HX/��
~r�=k]�[2�o�ûK��K��;]
+TyR����v+��ȶ��{��(���]�?�����QD$��G�Ϥ6]P��D
��`;��A{$�"���˻ƾmW��������B��>�G�
${ßogwd��&v����;]��xL�q���v�����5'�f��;4|K�t?Ԫd	?���~���"�0s/������ɑ��
q��U�,|�V���i��R�7v���c:ȋ��v�M�怂v��To8�~�.�+����;������5h<-��
+r�o���&XC�N����6O~� U/b>3߶FZ���$��ɑ�(F�hJ�)-y$J"��Nu��n+��l@����9�e��i��}
e.#�v?�Lo����n�qɏ`���7�u�${"T�T�C{��Mf�����K�U�2�!B�^$g����]���D��%GB���=!aRv!Q-��H�H����=<�a��H��WXY�yM��gm��-?�[!.�7����_@��o�7w!�$�2�޺Z���\���H�G��	?���a^ jp����8wt%9����H��v1�ͫz�~�ٳ��m�g_ɸ/#��m��r.R���w›QT�i�cݼ�'G���u��w�IvF(�� �����o�Ot�l��tI��������Ru�:0���(��˹��t9�ȥI�8Vf�۵i�����Y�yמ�������a=��I�Cw$x�q�[�X�*�=c&�$��e��'V�0߮!%Pv#zV����@��HՍ�s���b7l�����	�B�e�@�� y����ҙ����
+�C-�-��0ڥq�1Q�ڻ�?����r���̶��^ǠL���t�C��ZX�qb�
+r�o��7�s������m������HՍx���IŽ����[wt	9E�!��ٔ��^5���Cu��{�6�0�����;�vW�,5������`Q�ye�6M��q�)V��̘y
�F�� ����'�E
��L��'�>��?�T݈� �O[��s���9H��J�G�ܷk��=ę�@q��{���D�kݝ`a>b2�'�2�oib[}{���',��#��?k8�m�vU���‹
+�^gh��,����Ru��B��Ծ��~X��	@�ϑ�(@|h������D	�����Q��K�aN�Kף�):̇�s+���㗥�^���t�4�.E��������]KU����4;F1${p
?���ԃ�hp˻���;�y��D����!i�oF�vT�Wc_Bm�GBݺb�^r��i:,lpj��!F��I��F��ն[��!�c�+�v��V�3����v�
+��E�6���1�lE�z���~��0Q�s$$Z���m��k�;5�>J��i�%��w�HP[�g,#�Ob�W#����/KI��%�{JR)B�P�nc&T���Xt��(���v3q͒^��	t�@�~�JH��v����ܼ;�q��DKxnޅ�D�j"Q+���Rj��G0z�g��{�e��I�+U�w�_�>�a��vu�:@��|���	��E��DH9~,�a��ҲX���R���(!��
#��9-������[HԈ��
+�d&p����3<��E�����OjZ��e�_�6��0x�I&���69��Za�BM��vs�bR
�A�㢥R�#n�puCl��|�;�i��D�q��*/`�з�_ƴo���a��n٤ѩ���,$�OG�@B]��_����a�>��z X|���&[i����GM9~,:b<L7�S�=���-吪af
p����<�;�e��DGq������#Q+�������čuPʼn_���w�B��4�
��柶,I@�>�{�G���3֦C(2� ǏEG�K��װ����p!U?+ԅ<;�{�0%��9c�["��`5���k�6��w
+����qlGP&����]@�[�J��:0uX?o�-KзO��ß������~*��u,��*�� ���ã�R���H�������.GB�yVί�>&3�o���U8�ԅ�x�!�MMH߱��>9gn�����-����幵2���^��	G�t�][�;P�V5�|����Y��i$��4
���C�N"�+:��λ���HH4˫gYH�/�7D�����4���(�<���c-.s��+�/Fgyd!aЭ���ʋ=��16�IST��գ�7m���vN�AM�َ�
K���`�vah^e�%�͌��T+�uU����I~V�*GB��⸝A'� �"��iڛ�,*1��s�j�6���[��&9��ӟ�0��I>x8��99����4E5��x�.����9S,o$���ߛt�û��r�:2�a�vz
i3#��C��:Ə���������G9��M��g���L
�����p_Ŷ7��س	��>��u�����?�
)�����E�F�.Q{+P^1:�̑F;�%w��T�D�3� Wm,v_��5>o��S�� ����=��R��X�i�>�N��N�����HH��W�?���M-#���~�>P#�:ub�I��҇V/~�+���v��R�����$��'Z~�N+K�Y��^���Fq�p>��n6J���'seL[z�I�7�*�E~��u����lۍJq�~�i3#��C��r���%���Ƒ�7�VY
PWr$$����W�0��uRjmH|���]��;�3�C/�- pW-�n/��
�Z?��9C�
����: 8��|���RVSBKST�<u#rؗ�c���[]%��Hc}�
�lH�c�K�U���#��	ew_�X�f��N���rH�b�NH�瞊�M�3�9x^�l|u傄�#������|�۱��E����g��lq;���ִo�,%��4^IY,�$�V��ۅ�?G��T�䛲�d��.t�zq2?�^�p~��$�$Mb�2I�`���h)�T+ L���t3h�����a�Q'r|�Gx;�8�YmW�����)p�]%�~J鼈v�A�w7�v�~�3>�[JX(�����@�)Z������h�W46�������k��	cz�2%�����{,6�
(O���iu�\r�^\ł_��C���@B�9���2�̠��W�.�݁mHE4����w�[q���1Whkiؾ�J'��>�N�{����
�� ���8E�F��5�ETI)�2|�����<b���!��T��e�@�h'��t}K�t��������rH���HH7���u�4Ru���p�M��:G۵���٨�@)祖�F{M�Z>����u;EX��7�b=��-W'�We|H�N�N[�y����p_1zd��2�./:���
+r������
+Á�ɖ���=�t��Tw�
-�j��5 ޳�s����y��	�5ݍ��fS+�)n;���v��/��OT��oL7L���U9�6܅H@�z6��Т:���N����p	#zM���?�<��4�&D0� �[Q�MJq�CRŷJL��CpB	�}�y�
+){��n��<�^�CGS S<M!�k�ݓ ]���
 ��		>����z��`w}�~$n���8EGK�ԇ��)�lb o������kx֛�f�T�"��@1�]�*8�+h��%G8�������rH���ݷK�\
ؠj*�ڝ	]F��/�7.mж�Xu�9��[g��|�c`)"��~�����u���8o�):�۵��r�33�f�����ŀ<
+;�<1�8���c,ۮ�(h*cl�^S��4�_����/�C˒��^~
�A$P���T�(��+���]��fv=�7�Gӛ[��Y�
��Ӆu�|���"kp
70���\���6"��9��-ܿ�_��|�bRf�ۍ/��"��@a8��{$�����Ֆ���rH��yt�>�0]�¹�6gA���!����V=J?[�v���1�J����%k-�jJ/w��Z,||���	�A	z6p��̈W���� K�ٲ�g��������HeJO�
+r�X�FU��+5��ћ���i�!�ԔC�5@}����Oϴ�iE}�Z���c�h
+x*=�B�;@�YD���\BZK��r���aNB��� �ޑ^���q���M�
��g��h��m����.M=}���h�����Ws����
,-�j
P��F^��m��q��9�Y���b��%��fo��BF�r�Qa���hk��Vv\����]��#�kpm���Hg�'[R
+�k����a��%q�d�e&������>*��Io�iA{�4���C�5@}����O�J�n�
5��H�j��p|V?J�N~��� y��m����(�!����<�����
+n��
��6�9E�]�G�������ʶ+�8P��Ue&�߿�"��:�o�LȜy�͌�R���!�ӷ?���4!q�jkz8�ࡣ) �n��~���9�50���x)�1�ܡ�iAa=��������ꬢ��WJ��#)��͐y�$x�e
;C)#�M�3�\��Q�����O��]�*���gJ���VxT�>�|X��C�5@}�#ͅޅ�ڈ��ePS��.'ژۏ&;
���3�%$�x�s�)�1�IPE���_���a��"]}�n?߲f���Pɬ�*��fr����	�֙6a�M|����O��M8�00gY*G98CK9�Z
a��Y)�j4��]���1����n
+�42�O�Cy�.!ώ�G���?�$�$
+pc�Ȓ�:��R�{ ��C�ڮ�(;z�)^ն�.�dd��[1��]�@�u�!��h�ۅ��Jcc��L3c� �[Ѓ��%�ܷ�o���k�7�⌀ڙ���<\c��+�pvv'$���-Y�����sc�T��r*ˍP'�|-%���5HO��8�–�bU�1��5+�N��[Hn���D'EH�T��Ƃ�7>�x�1W�t��M�|���@���@��OJ�nB��G�LL���O�:Ԋ/�r/@�
+�����dm1��K�ͪ�5EYu�
+1�t��Ƅ��dR���U�{<�t֐�Ad�����xl�PV6��
M��^� ���!��c��37D1�+Xgyh)�T+���^�ںe%T�FTيF�L˖(~�rҒ�:�5�b���zƷ��Y�0lX��	���oCI�ˮ"P�͆1vڦ&���%��2Ć�������(�)� 䤱�w�p��_�n�H28"�\��
+Sk !]3�J�n��,��I������̷�z�r{�C���a�{���{�A�Ũ�|“��-�P�͆�[b�i��)^=c���[�4���r~b��J9i,��yװ�g ��Nہ���"�ʡ.A���r=|�R+�\Z!f��+rGML���(x�q��n�ʇ��
�ܶ���}DsN���y*���iB�l6�tHk{~����[^���iȱ^� '����)�啔;x�}���`�$���٥���t)����Ҩ�)�6�t��jI�G*7�vZ�
��Un7'�4�����J����;��/=�\W�����l���WZ�U3-�a�StGH�T�S�bW�+�dgV�݀8�U�~b�݈�r��i�m !]��Oa��>n��yyUS�)-�;[5u�Gϑ[/�/"S��~aE�7t�J?�3*!A�XݠCه$
+�pq��.-�D'/`oU����#�
+r�X�����lY!�s�ܰ��'�c�Gv�V@��}�q_%����kܑ�t�1��Zm�o�ٯp%���dV-�'7x�������
�}_�X]�����}�fо�o��J}�"�4�DH�T�SƢ�WFY���R��w���jB��
%��I���@�M�7-JUq�$?�&V��&=�nܫ��q��n5П���}�"kXQ���8rC�]����S��Sʒ��"��AFH�T�S�B_�誰i�}p8��㻚�dp@I�.sR�c:y�*W]|��O��nD��&]�
�-�9H����_�w�9��3(2lX�FX���������D�2�����
+�TZ�(M�
+rBt���+;��rp)��9!����r�۟f���x����|��ˁR�zPٸ�ǻ����l �w��k��a�'P�����ܷ����EC�T��B��P��mO�%��J�GH�T��;���`A`���aq<&{(��cGOua$��y��=$�=	���UGX����X/�����\�V���O�2�YZX��Z��ݓ��Ҟ\w��n4���HE�p�>|{8�:�aL�7$��)�'����H��ˤ��q܌"�	��x�l���qg˲�m����F�߄�����c��a��	&ZWY+
]+x�~��I�τt
u�����HE��S=�1!\N*�	c�%�B糾])��n5Rn��?��]^�z�κ�t���S�ǤD���k.v�9�K�e�&��t�;�ʦ��u�'X����?+x��v������t�+�S������P۷s	s����oz��vPe�z�v%9���
+�Yw�I'R�NB=nnj}����+�-p�sm���\�8�Ol?_]v�Hװ�oH���a��iV�䋰#<��o�����=�iߒ���
+r�X��B�eA�0)�L��r��]�}�B-^?�g�5�և3�pg6��?s���>��Z��5"|HӍ����i�5yX{�Z	X�Y�|��R��K���H��p���iߒ���
+r�X��B�C��&���/���r���_��|�������O� �|{V?bn�a�3'����!��nuf���M�#��f/�>�ׯ��<~���i�ַ�
��J��@X�=��'gB�"�q*�	c�0�B�s�]�q��Rn�\�Lh��],���'�>�u�vd;�����n�'���`X��h�Cz۞�T��G�#3���~�.�z�җצ�s\2������vH�>��$K��9ނm��^� ��c�����b�ZA5����*�
����������VD��H��*»����aO�C+UDXKn4��d�M�#3�}�/���׾^i~~M���!�N8o]����>�$K��M3Bz��u:�kN�sW
+Rn�c�PFpL��_�V��r�d�����
�T�:�x��;�ż�AXKn�j�9������=��V^�>��!�Q.������է��n"�|sp�'DH�T���1*B�÷�B��;���	��$-�4ڌG�=���iH�bu�ʻ���k|�������}D`����]�	��5��'BX��pbݥ�AO'\�	��<=MH�>�0!�|sp�'DH�T��㙦B�s�	����>���*�	��9�m�:��q��A���}��:rL3w�����#��7�E˝n��Nz��ƍ�
z?aa5��mX�o��T)�[�
+�$K���1�!�RA�N����2z�
+`B�Vޚ�g��|�J2!H�)��(S���#���
���%s��V���g�#3�������5��;✐v��l`��&�2H���	�+���x2F�|�9e��yL!���
+`B��\���f��!�V|�;JT4߾Ki�>7/��{������E�5�$3W�v�Ƒ��=��T�{������7��Yn���m*+�,�7�xB�AN9>8��:�k�I�z
Rn�&�W����:�zWU�Y$Z��WzsT��h�k|Z���}�]�ƞd���͘?6�m�zߪl�`��jg/vR�&? i��H�za̐d	�98�"�W*������3�@�Or�[�`����*��t��mʺ4zWU�J�Y��f�߮��뎲��ӂu��3����iC����pl?�D�k�Uj~�t�t�79�=*)� m���H���	�+�������F����[�`����*��
5�lhź���*_C�Y�\zHK�!���zH=���6����u�
��u�>��.�I\�a.)��Rϑ�� �I����c<!Bz���S:�齢�}6)��UR�ܷ���[�#3�^,��2��렕ox��I�al�>rK�64�$�m@�3��%�ȵ��*$$
P�m��O$Y�o���
+r|p·.����*�q[����!5�b��2H2˜K��Z��Ju���I���>�KW�ؙ���;���%��%�Uj�ʂ/�
B?�d	��)�bEH�T��C���·o�7����*�
�������-��ט�׉$�̹�:h����V�}
ޠ� ғ��%-'*�w�ɕ����X�Z��
Lm=
��?�� ��i��O$Y�on��X�+���x�T�|-��)j!���W
������{C�<�E�Y�\z4�한{B��#U����F="��K�s_BXmk�o���sI��@�9��4@X��d	��)�bEH�T���IS��|���AU����*�
uMY@Z���_A�a�
)f�s�u���?=�W8���/RU�L�w��60���K^+d�8��@���瀗�aA�%���!�RA��Ǫ�����IG���)��U�����]������F�Y�\zt��O+���� ��Pw&����R�]˜�$tSo��
sI�&G�2�瀗�aA�%���!�RA���
���^*e�^URn��p�_K���}����2��eΥׁT��`�75�Aj�ؗ4�we]򱵾������T�%=�2��HH�
�$K���1�!�RA���
��~o)��U��YȻىp�w�w(H1˜K��d)�Xi���Pj�ؗћu�;��>޳��&t�}F��K�79��
�'Rm�PZ�d	�98�"�W*�������������r{_��lod͂�s�D�7 �,s.������	����%�%�e<������Š>6��3�
�K�79��
R�	�6@X��d	�98�"�r*����8`�����
!���
+��<l{f������~c	f�s�u �,1^�\����ꍚ��p��U˾��t5�̀sI�&G�2@j8!���$K���1�a�SA���
��~o)��U��ho��X��;=��`�9�^R�R��f�/֣חhӺ/��z���Ój�auV�j���x�#H 5��j�TD�%���O�0ʩ ��_��:_˷k�QP!���
+Q��,�x�����T�S�s�`�9�^Rɒ�ᴠ;�6�-ڴ�K1�/΃d����:ێ��M� e��pB�
RI����c<!�(������[�`����*B>&Wݙ�&	�_��̹�:�J��q�N�hӺ/�:�i�[���u.��%śA���T �"�,�7�xB�QN9>8��B��}!ۜ%o? ���d0n@�Y�\zH%��b��6���:��`^-;����p�%or)��Rm���H���	F9���L���I=�!���W
���qr���E	f�[Y�}���G��2zf�t�9I&R~;u�a��m�������* e��pB�
RI�����{B�QN9>8��B��}����5�!͝tQD�Y�V�Aw��9��N�hӺ/8���9({�au>���X�+#RH
'��!�d	�9<��C�T���=p!���W
��b�	�嚤��셢��Э,���s"j�?)#'VG,
]����Q����������	�U@���)���TD�%��,�{*�QN9>8K!t��o�"уB��}��Jݚ�!���:&Y�,?��K$�eΥׁ�`\���������>�����LaqZpX_��u%��?$Wq)��m�\!�d	��)�bE�T���B�k��9��c!���W
��;��75��uL2�z�B���r��t������'e�<�5�ݝ�����Y�4�l7�)���s�]
�k�臤�>�!��H 5l����$K��M+�(����:��ty�c�X)��U�2�m�
+�v��I��_��5H/˝N�	|���(�I-��b�[�7*w�_�ZnX��m����4�VbDG<��H?�=��!�"�,�77EP��
+r|p<�B�|���Or�yL!���
+PD>8��%�.�uMv��E�� �,w:M������#�I-���t-��*�~�j�a�R����}̲��DIL<��H?�ɵRI����"(V��J9>8���[�`����*@y��x�@�܄de��H���eΥׁfb�����;��y_�S��ջ��L��š�\fv�p߂��O e���,
B*"�|sSŊ�^� �g�]�H��	&AH�}�ᓷ��[���&$����^���̹�:�ķ뷤G�B��y_��k�?�143vRf�au���RYi+Q]�RF �,H�
"�|s�z�!�RA�Y�/:���i_
+�F������)��3NHVG�D���8�Ʒ�����ImZ�%�����	C2�,`�a�S���#Դ��.x)#�~$�!�d	�9o�l��^� �g������&��*@
�,���f������E$��nehI��|Sz��v��V]I�"�<�}!�
+��e�U~����+Q]�RFHC�D �I���s�ˆ�
+r|p<X�|���C�n5Rn����=�4�Ɲĥ���E$��nehI����yĚ��s��$t�?Zo��G����t�k-���⫨�V���	���
+����"B?�d	�9w�l��^� ��*�W���^�
+����Rn���f�|lDJ֖%H��#$��neh1�ù�>����%~���3;��Og<�d�E�U�ٽ�0m%��@�iAt�0��H�ߜ�^�CH�T��������et�)Rn��8>z`^c؅��H����@�Y�\zh1�C?v$��`/�qS���n<;�V�����O���.x)#�h9\���p#�|s�����J9>8��:��"����
B��}`ǣo�;{R�6���2AY�#H0˜K�-��`h�g�w��K�_�T4;2��)���usE=@ߑ"A�N�2���}�z7�,�77��AH�T��3�?��d����*�R�<b�Tr~�&��	f��Y�żB0�`G�]`�6|�Ԟ6GfrS����
k�
+��z��QHP��{��P��o��n$Y�on�?��^� �g�]���N0
B��}`�)b(9�g`���:��̹�:�]Ɓ
+���8�1߮�y��������\ w+Æu����8�����B�l��@��e:`~��I����P/�!r*�����?��g{/_�Rn�b�V�3f�i�IHVF���:}:��̹�:�]Ɓ����Y�/е	.�uݏ�g�-0��~SO��3
+	ҁ>��B���a�@�%��&��!�RA��|��9�TDH������0'BZy�}R�??H0˜K��e���^`M��	.��k�#3��B?0���
6�|s�=���>Q�25���=�z�,�7W�^�BH�T����B糽�'����a!xT����*@���9T��V���A-��wĐb�9�^R��-�ΰ�{�s
�[�������\���
+k��Ao�!AśA�i�"��7�,�7W�^6BH�T�ャL�_��g{���(GN��k��d0 ���W
rH)����v���#����H1˜K��	}�����ָ��5��0^?$�uAn?��5�����rV���H���/HB_�@��a��H��\�z�!�RA��|��=�Q�#��d0�v����.�x��7 ��^�$7R�BNҥ0�o�ϯܐPG�y��x����SU2�Vz�k�|;�
\@or)C�
8l�r_h����F�
+r|p<	#t>�{�>�rB��q��;�T9\��jd~�<���mC����)f�s�u��@�`�~��
+�'��Z�l.�Ą-����~���sЭ AśA��XB��a3q�
�\�z�!�RA���0���^�6�Il��9�HHc�7�l;��.���Z1C/xG�� �,s.����j��a�{�wZ.�=���Voia埅s��H�$�x�#H"5M.�۸�����9[��>�����bv�5�4
+R���GBH���\���N����=���7�k���ϻ�:��U�`�wjg�R�=����RY%��d�����t+�6
�,�����M� e�t���F���"�W*�����S����K{H��8��H����r{_��i���v����B�YJr�A�Y�\��L���!?Ô�lqRj)<�g�2#Ά5�Jt��6�M�5lT��+���1ҝ5���@7�SX�s=��7W�^6AH�T��3���U�*�)���W�m����YZ��ċ�U@�Y�9��Us�R0�-�k,�ٚ\����Z�b���;�S��.�R��w��",�? e��R����_�۩[�E��/4|sS�~	!�RA��,|�慲J#+-�)��\���%Է���o��¯wG�n$�eΥׁPM���!�K,E��%�'ҒXU+s�O��:����`~B!EśA��j������/�
+
�\�z�!�RA����� t~������4�o��5sBH�����RM�	>��;i'���
(}�if��I$-�Ղ!'���؉���Ti2:�
++�pGKr6(8,�79��1R��93����C�|�]���R�������:?����y�3笙B��}��~X�F�^�~����Gvo���"�w	hq���E����R�"P�{FfYa��xfQ��|�����H�j"��V��v�M	w�'V��j���
+r|p<uA��H��Ô�L���x)��U��}�@�G��pG1��v�+��UϹ�:��Z0�Ͷ?�Þ�j��bsa%�=#���ҙ��b�NI*��R6 d
+W����o���^� �g�]�8c�����4��ȹ*��b$�H�����rL&|���9P-�r�}���}�̱*ӆ���s��2{��(��R6�>S9���̍Y��\W���U��
�+����ķKK�}+B�H��<B��}���jZ��2{'�\=`OXr?�c2��Ϡ�́j�v�n���|��Cz��?)�SAsŴ/���=!�|`��x�#Hـ`���B
�Ѡ����j��
Bz��C�E��X便�~PFؚ�o�?6B��}���E�K��gw����<)#wc��� �,s.��es_3�s�+�dgv��%��˩,*�lg5�.,�HR�&G��
�X.�f�'��
zh}�᛫W/�#�W*�����
�󣽗�"����hn!���
+��RǵS;��g|K�Y��^h��T�̹�:�ڷ�OZ�I��*}O��
+$��_�D�����?��{��
!,�p
Q���l�ۀ��<)+�������i�
!�RA��\|����]#��s��
+!���
+�z�n�2h�d��Ǻ�T�������pR�r����^G�Cz:y
|5�-�̆�-ܤ�]���C����8�LcIa��T�',�p
a��R� ��
�p�s;.����z��>Bz�����vi)��z���窟/h������Rn�W�Wn*"g�t|�e]����nH6˜K���}��t��H�t#P���ױ$7 š`�=���k\a�s�a�7(����T���lAr3p>�nҍ��p���ߜ�J��+�����E��x便�f��~^�����N�+B���
+����+�9�-��T1�/���f�s�u���#�!,�P&��-
���u,�*��u
�ް�G��+�{�3�¬������h"z)�PnE�_�d'�>7��4��B�7W�^VGH�T���w
����eZ!�/�s�i����r{�����aUsx?�6�+�WG,lS���Eml�L��I;6z\�� ��Y��n�
+e�aց��U�qX��ߣ?��?��,�p١�)� �~�z����z�І�2{_h��*����
+r|pf�۵���^yhu��M�N�-B��
+�^����{Q��iv�풍y_eiQ��2cr �,s.�&���~�
��]8�OP_A^P��s�
+i��Y�F���r��\T��ߣ?��j>O�Yv��C�R6A��u+I���ݪ�Sf�
ߜ�^�,�߿g���ﳸ����+�������B�ML��*—�9̅�|'�!����u�]����
��s�¯�b;a5��c[�=��Z:Q��e�dA�Y�������u�v��ʦ�~���ek<�.��idm�oXo:L����Yv� Ufɾ)ې��ы	Kn�켠r+b�oΞI�	UϾ�
+r|p���C�|���-�a/B��UT�����"��pVь�	50�J[�N��	g���E�
�`0�x��;����"�w����
<�meDf�a�񣚤9Ҷۡ��'R���:`[����[ahoE��͙��9��kBH�T�ャ������|�O���]J0�r}�c�Q���1��y�V�v��o�]���
���\z��ߎT
�3~)��uA<�^"S`\�#���I�*���*�=��������/�R����{e�&3υ�ߊ��3g���]Bz����v����Y��\ݙ1����_������j�C��6��{��vx0���b.��B�)u��O���G����3��܄�������ot�+~���VZa�Wm���N�Hو4A-;���.�#mF�ߜ�^wf-��"�W*�����o��ف�(}����H�v�~Rnj\�a2b�S�5>]�P#� �,�һ,f��٣�c�b+�δ�BϦ�͚.[�l#��{1a�{�G)u��5�=�����@�F�þ����
+wF�ߜu�Z?�c��!�RA�Μ|����]�T�M�^�3B�M��{uA���~X� ^?�D���E9���Zz�|��떣��oE:�e�0������AX�X�4j��1��>�maT2��ɐ�(f��K��:�x������ ��gT���Y��6��nW�+���(����e[+���{�N�?+y���\h���Rnb�m���(��xE���{�o�;�:o���wa(n�v0��vKy9�[f�ۛ
���h�{Å�h���	�m%�v�������/HY��Hي���%�DK�m��\ʨ�ᛳ�P㉤���Jz���(��/�Z��5���E��b�BS�#w��rӒ�٨x�ߟ��/̮���A��A�Y��wahv�n0�Y��P����N�;���F�^���^��$V�l�h��h�"֛>'��:>�Ͱ�yG�w6��������d���Y�-�V5Bz���|�!t�&�g狚������R�#���r�R�q�&��~/b`��7���>��Գ�-���upG��Z��B0����܀�~9�k�ۋ���y��j���W�m��E�@؎V%�����w�����7g���GB(a8��J9>8��:l�qn�e2S���MH�M�=�k����Z�}qn]L�@�Y��wih+r�`�l��o	��\�)G3k�`h�R���8����>�����ǶC��,ٗa;�@i:j���_�֯���9c��U(��!�RA����#[+\���wj_��}
+�\h����F�I ���;{�b}x=��R�Z΅Y�v�NL�d)Y�8L�_�rBB��~4�v���6ǰf�Z�/����sl~kd[�%� L���B∶=����p�����3�K�
O�3�
+r|p<$t�Za�����R��<����a.4���}#��tT��rY��#�,�һ4����d����3�I���*�$ne�h��zJw���)�n2����-̒}	&7�G�R��#��ߜ�^��Mˎ�^� ��3B硭�݅o���!���\h���FH���z�KV�;�y�;�����Y�ve�v���Қ���P�H����4w~YJeAfI���u��j�?P|��.��d[��a�N��H�1����p�������K�
���9��J9>8�+:�ʙ|�Z�L@�M�~�)7��d`�bbؗ�nA-d���š�ǵ�Qﶱ�Q��l-���-���W.�4��U)���nZº�VG���"�Z��A��@�A63�cF����SA�ߜ�^��,٤��J9>8��:�m��jj-rC�\h���=#��D�7���p��Z@Md�^/�f�jC0�c�`�;���7ѽ��c�h�7��f3�=fM9�wX=Y����j
P��V�������{��.�5e�FA/�7g����u�
3+Bz���X�7�Z��V#�O�\h���=#��$���v��T����Ϙ�o�N��)���l6�)���Q�n�|���g���v���:�jX�l�/K���S݃�$�{{�Y�/
��b��zL���uP�Hׄ�����L��T=��GH�T�����p�9.U!�?�B�w��rSPúޢ���N�[�FS�]����Fx�Ԧ��g�׀=�-�ds�Y�
/��N㊿,%����&��^ӧ��^1���%� ̡w���UX�^Qh�T/M��5ֿK�qM9>8��:�ۓ��G��s�)�p�)7
�?���t�?5U�j$���.�y�vݨ޲+�k����gZ��������_��%�߳���]4���/$�ڍKk�Xw`��K�0���-�B�8��М�^Z�*�o�+�
+r|p<c!tη�	�
�w^�MY��EH���Ӧ2檕*�=|�������4C�|8i���ב4�M���+����/���_�i����K�2�_?����5&�3�:��n�W���K��i6r�
+r|p<c!t�
�|����[���M���'L�&��ţv�XJ���o������V�>�>��
�ç�ѿAGzNa-tS�}iH����`��K�0�ă<>��,wxE�9�,�l]4�nW�+���x�B���>Ot�:�)̅��{EH��~���t7�&���G
e�������p����ػ�ܜ��B�����x������7�ځ&�d_�i,ֲ�O����Bsh�,���6�.�+���x�B���Ns�:���\hѸW����Jdfmܫ����g�ķ�V-3Kp� �U@�q蜩��n(�u6��L̒}	��s�L��tJX�^Qh
���R[l�+�
+r|p<c!t�jk����8̅�1�;EH��X~��Ɍ�{��qQSY�w��ŷW��+�4�4)����Y�Dt�㌹����@Kw����3�d_�y,���OX�=k)ߜ�^Z2�|� �W*�����y����$�V�\hU�O���H����5�_�����b(�KIJ\�R?u��S��	�q�b�&�H'��&��
�T�d�
�ojZ��L-ٗa�)6!�R��������Ұ�>�D#�W*�����yT"��P�3��e�!�a�1��ԸW�i@�e1��%B���Q��{�X�,Rm��#S�dڔ�(N�����3��2�d_��{�#�qn�r�7��T���+���x�B�=�����N�BSA�R����^�����5���EB�
�Q����:�����9�D$߂[DX�l��r�
+t�Y�/)�J��2G�N�0S^Qh�K���6��Jz���X�'lm�d/�Y̅���"�\���e�-�q�*,�^\z	e0N4F�cŵ��H6�b��X��>^0}XKߒ���rZ
��,ٗ�u5�x
=�n�W����P����+���x�B�<Ǟƽ|����TT�?������n3f�C�Yj}���b\z	e0N4F�+�P��z�iwƴG�m}��i6����U~H=*��ۧx��VaH^Qh�K��l�]I�T��������	r���T��;��k�Ƒ�*���y�M�g
��,��.�`�h��&�\���,��u�E�]�%�������WԴJ�3K�%e]��_B�]Y�=�*��LCL��+���x�B�<�N%
�8s�	h�Bʵf
+�����]v�'�4��,��.�`�h�&	�ʔs��I�錻d�M_�h�5����\q<bO����e��Kʺ2��Yi2{�U�9X/
�И�4Bz���X�G��j*���`܅&$vg)ז/GF;yo�+e�ͷ/Q�Y`�]&����g_*��������?:[��'���V�δs~V`f�E��Һ����5+�mWԳ����z���o�1Bz���X��m�ks+�W�B�3��kȮ�ۨ�<O�V�Q�Y`�]&���ZO�
�x2���V��j�N��Kk�~{�,�h6QZ�ut�JK*
+K��+
+͡zi8$���
+r|p<c!t���ύk��i�MH��R��o��l�[���B���E-gA�w�hn�E0��d�PM�0	y��E��u8m	am�j��䒹�YR뜲���{�?Xl��p{�9T/qn�ݮ�W*�����y�ֶ|����
�B�3��k���Y�����[S6k����һP�!n�j�L���Piu(y��E������C����Щh1�,�ל�9e]�n}�1�A
+��+
+͡z��u�m�+�
+r|p<c!t^��k|�I�Xm�MH��R�
�O[�����f�ֵ�o?g>��pƓ��v���@�t��k	k�~��&�l\�%�����և��*,��(4*���v��Jz���X��l��͖��5�MH��R�6���i�c
+�i|���M�2��o��i0��ط�O�\���ɮ��6�����D����.�d_R����q�yX������@����v��^� ��3B�U[�"\���k�B�3����<����?�߹�dibU�gF������ɧ���%,/ ei�2���"���v�Q��/H#}<�,ٗe�T�%�o	��+
+́z	O�5�nW�+���x�B�nk_+W5�
>�B�3�����c����s���~����$�Y�X�陑ogJ��y��46��(}~	��f���aU;�79)��Q�H�F�xD�E�
+�PW�a<�~@X�	�t�����ћ:.��J9>8��:ﱵo�;w��Є��!��|o�k�iY���ٵ�j?�����U���vm\�X����O�Vv#�Us��ר��V�JW�T���u��d_R���V>l3��#�(4W����R۔���J9>8��:ﳵ���ڹMH�Ψ4$66�������<����:������i�m�m��/�6��Xb[O������o���y�a��j��o�pa�w'�%���lZ���~��O��͕�%�Og!Bz����	�w����|����h��\hBbw��r��i`�ԓy����:l��������ɷ�8�m�Bnm���
+�<����X�}�oX��!�	N�� 0K�%%�j4x�¾� ,ܞ%�o�\/�4iSm�+���x�B��֮�\[�$T-�B��wa^6��y�pwp��6+I���ot��7gl+ݕ6{E��khy����5B���np�\?�d_RR�Ǫ�(�?�-�I���+�K�c���M���L~�'x<�|�c��(M��Z�M�Y�fP�?�6g�4�M���b��X��Ż����v��)��9%՚��uƞ!�GB+'�抾m���$	�����wa�=��N_����3�ك�P�|�Q�^�x�����/��>��~�����t�)Z�����A|�.G�$?M��
������x��e��iˆ��[�:6V������m7�-�Q07V5?�u��O����Jo���<J,0���s�O�K4�2O����yO����#m�����7W���/������=}m�Ey�٤����AЌ�:��Ʋ�m7_���N�p�k�C�}�ʦ�w�ǶUúmֵ�m�����-ķ{o(��'(\�xV!���9(�&���7/�g4����!i_�9�k���Щ��A}V��������Ώ;u>k��t���'�v��a1����4�����g����7�� ��yV?p��wM_�%�4�����s��������m?.y��E �6����d�lщ�� � @�^?����5}y��:���>�KZ9�|�	��:}���m�k����5���f��~,5�ۃ �������v2�W�����v�^���5ϋ�����������������67/?�����^���x�#�ۃ ����[2�s��|�OmD^��\��/y��Rְn��"� X,�#E��A4����&����3��o$����#��#~,5�ۃ ���K|�����(���n� � �9P~y7�?� � ��=�K��ӧ � � �
�EߞПAAAЁ�/��v{AÁUɶ�v{AÂ⏥�v{AÂ⏥&��AAA���c��诃 � � �@��R?�_AAAЃ⏥�v{AÂҏ��v{AÂ⏥�v{AÂҏ��v{AÃҏ��v{AÂҏ��v{AÃҏ���AAAЅ�n��AAAЇ��v{AÏ��v{AĀ��v{AĀ�K��� � � �	�K��� � � �	�?����4� � �N��X��� � � �0�c�[��AAAt�mԷ�v{AA̅�K��� � � �
�?���AAA0�c�=�ۃ � �`6��Xjl�AA�|X�����??���CAA�Ԭ_п� � ��+�����7�o� � � ���'e��5�� X��͐
+endstream
+endobj
+28 0 obj
+<</Type /XObject
+/Subtype /Image
+/Name /im28
+/Filter /FlateDecode 
+/Width 283
+/Height 283
+/BitsPerComponent 8
+/ColorSpace [ /Indexed /DeviceRGB 255 30 0 R ]
+/SMask 29 0 R
+/Length 38812
+>>
+stream
+x�Ľ@g�7.^	���G�j�`��[��vu��v϶���������.g[O�m��AEԂ�UL���iH�!B�0d�%!�8 
�%\
`#u���+�������%s���>��y߱��܄�.�?q��}��+f׼0�;�s�	�tn�w9e9	�ss�>����[����\����{��r?:{6"�w6~��2�ut:`��qp�	v�&$LI�d��99�����sg���F���\���Ԕ5�D¹�ÝXq�ɳ���{IArA������'J�G�G��K��-��R�T24���ڐ�X�f����j�b��ҥCg?:2y����R��l�鴒8	#6������d����o���JNJ�
+{Ƨ,SS�SS���w��}}�Sl�ł�������{d��(;��ǧO���JJKq�,�ă����KD�
j5���t�p�� ='--���J��d�s��<�z�}�\k�
+�(V[/)1	%�f$�'�N^�����QQ.�a��J&�%D�
+_�n��-�x��t-a4���r
G��*S1�I�J�Z@nA������.����0�ƭ�,"���q1^���M
j6c�F�7Ӎb�)�{�y���D,6�LX�de�9�@���O��D"p$����k�^�G�&�H�+�R���Â�h(�> VX�_�n.\8�"O.WTTT(��<yzy:O��2�QQ��@I��0b
+Ayys��#z%�cHfCHp*��*ae�R�T(�V�G���0,���Z����k�V�����x�X�޽{�^-%��z������k�rou7�wL�����tS_�@�@aɊ����c����}6��2���@�r�\K��`�Nj��
+cAv����_�` 	��P8=/�\.��32��������zeA@�x�`��������8m;r��#������d��F�p�Ҫf�r\� �]>6�k��l�B�l�j����?��MMd�ED��u�Uul�R�%T
V�՛׮�v�������F�#tt�c*�Ř����cT�9���D�把t���PBEQ �YY���dp
�]�}ݷ�z�
+�%����21��K:�0�h��E�����Sbm�q�{f�w����gA&�;U*�SS9����XM�<8v���s���vh���T��Eo(���;���w����~�(J ����|j��g{
+�&=ܩTa���GlW
+r�W���M�V*u:]Uubbu"��2�T�����N��۱c�{���������%6F,�յ*��p��>�?������������bQ����M?z�~��o���?�63�r�۴z�zV6�Sۇ�2C!�C�JNP[0xw���wdž�	J�V.�2J \L�H��^�4++��a&̘r���=>$�q��'����_����8���iqg���u]�W�<�q��b��,���E�����l��
|�֞�e�]?��L����J�������	�Ù�BAR�C�]˯����~:��L/o,��x-Z���w��
Ƕ���g�����(+:�0���
1���g��Y|�n}/6S]�4:#��1��0vt�0fK�֙ŭ��L~����˭��-���������u�ZUY�p3���uꉹ�&ᬉ�13����˚U4O���B`�K�𢢙,�
+1S�M����|Lܙ|j���Ȉ�;9��*��W����I���'
j|{t���<B�,���������q#�}oͶѩv`�ՅbS�ʈ�+Z������+�:�c���ҍ��j�R�kmMΞHx��O�=��~α$�<
+����
b7��ɍ�u����mBT��W_���]��
+RR
+����}=��ɫ=}|��t�����Tf���HK�X�qQ��wm61
*G�������z*T�Y3s!v�����ό19	}���f���*�H�P��l
]���F���}��<�2Qjpy㖩�{/����79Z(ⰙLv}��J���bJ#"��e��mt�V�
+��ID�UUJD��YS�B�Օ�|>�bf"_y�B��Y)db�ʁ�j5��e�Y��#��`2��z_��B9\.��q���2�BD�,5{�.=X:�Z�b�!!\�eÌtM.[V
����~�������7ɕhg���s3=%ƀ5�V��<w�!���8�G!�������JeA\]��6�D�qX��#5��a��]�]��~>8;yy���|�Ł3��D!S���%�?���G��k������0����s/�I
+�s�f�Z�l��F�w��c�!dӃ����˖e�;l�c_
fHj��ͳr���cHzzySe�"�?�X�d�39sY$�x`rS
+�tZyy�>
f���/\�	��L��|^�Ƿ�+Z�)���,��`��:�y���l#hz���:Ǚ��U��\T3K�k;d҃�M-f�����ޞ3��U��Z��k�(h�*�Ij�������0����&]�\��98�ݠ����Y�k׬l�?���A���؂*%\�w�8�yy�/���&�ϻp�2����	���f�x7���Y,�<=#�
�ˬ�����Ǜ](
+��F�̊�B���,�mP��X��d��p�?����rpj
.
O:n�R���'M8�B|�LL�u+
����P����=�� 4,��P���C�Tڷ�9�GE���Ojh`����
�s5Tת9�I��\Y�PTV��H�r�+�JY�Bq� L��7�Tꔂ��
+�n���n��t
�+z;�8S9K����#� ���B+	�<D�uƾi
+�8b�����c�J�"�t��Tjט�i|7ާ'�?�ߤy��~
���[+`c!��~�U�����������%�&ssA#u�ʪ���M�	�LQR�=l)-�,*��vz�:5e+�+).��&X5����j4�@�2+���+z�B���m��k�ɰ�����L ���M~���kF������ľ+�������zZ,�O�W���ϼ�t�����{��B�=�5����B�[�i����ޝY�b��
w�Z������:%�3_��A���7Z��Vt���8��;�����P�~��~��
�RcS�jZ���8
F�n
+ ��jf�����T|Rh�W�5��ƶצ��#��~����	��Nj�y�i<�Z���S;�
��.����Nr�v����u�7F�����N��I���)�Mz�$1o����6��1�1"�X8�a2���0
_����ԅ�� �����W�u�����_l;{�xՖ��Ό�l�0s�i��^���`��������]�x�YYu���|�zݻV���BRkض��_I�A�S���_�DY�9�&����8&OT��,��4zi�er��Qu=��c_~��s�m���_�՝4C�:���i���X�c�?�I�����_��t��063-��v�F$b\�˸|c�L�w���|>�z�:��5���\k6с�'P#�I��v�{��\�X�0Q�Yآ�d��^,���0�_0�{����}}F�^�h�Zm�trI��AT
���Qщ:
+
�e!�K̃mF�01v��f!.��W{���֏��0q���P�&�k�]ol�����%-��n&E��T�5�87��ٴs��'/aa��5	���$�z���GOY*�!G�J�bdj��tz#F�1w<f����Lc���^e�̶������Ғ��zu'�Tl&"o���u���7�DZ1���?�a�&��[����Ţa���Q�$�N7�@3�H�D�t����'���=2dd�����ڎMK�]W�����<=X۬U�E�G[�?HMn"�EQ�������>�j�NY|��'�r�E^�ΎLH�IH:y��q{�U`n��)*0��mz�If0V��;<�c��C���8bɈ٨�
5o���Ӈ��8F�\���������l�F	�	�f}u��u����km�H�9Gbr2���,��\p`��2���lYٹ{YnnBN��s��� ."%I�P%sP���]]W�*�&�HΝ��7��{
+���ٷnՉ%"��^�t)����O��3bS���K$�ɗ���䁡ᒒ��ɠ�n��u�^��{_�5�6��l�յ�CC{��}��/�gp0���ijl�F��Y?"�O)�77�È���?�o1X\�����jjj�jjk�0S��%������1)�CuU{M���]_�|-��ZW�ծ���5�5l�:)���gIj%�z
+��e�����Z8�Z�'@���#(�(!���Lf��VT@X��յ�K�5Y׸b�e�2>6i��=��d{�1RSĢ9�9�8�4�"������چ9�;]
+yޒFК�=t���8�@
+�ܶl���)��l�ݞ�"�S�Lmss��O��W
+�
+ܞ@�>E���9G?Kb>Q�E����(w��x�7���r1�r{/��"Lv̀%��0b0�K������Ӂ_
3���a��<ɍ���!�RC���]'C*�΍N[��m̚��2�׀�֊�<'���xqP^����Uk����^+ףF��(#�=��P��� WɄ<��� �P�z�r�W�jY�T	��]�4V���_;z)A\�8#AR�,`��v�H� AɦG\��������StT��hh�z2��v���ihw}�����Fdž��^=4^�V��ը6t��}l�D�\ى��t���M�R���0TU���f݊�K�{�tL�ax8E�M@l��Md�*�. 9��\.O'��x<��1���2�`��@B!h*�C�Rio1�yyd��";v�Ɏ9�gg����8B6xR��b�6��ͭ۽��p`T*�t��b��Z�V��fT��~�5�h������m������D�R�1pbbSjoo��F�͞&O���F����m��������Z!�j
�����6iVj"�iF�Nf�PT ��3C
XCRC������tϱ��2n��D���Ͽ�d�T������q�˓�LRV�Y�		�!H�:���z�KJ���	�k[uCӿ~xx|BZVy�z���frI�^K�(��Pm���	
+|��q6�/x��'�Y~�ϻ�#s�б�j����x2�Bx�0]:]���h�V�hvvn\�
+��{��^��V������:a4��9u�hhFz:_x�T�)�b3���7��Z'�.*>?3�dbh�P(we^�v���O����M�aP�H�@�F�o�gDe^9y��
eq��`%`��rƥ2�4�n�#ok�::�JI���K<���ʾz-."�`@>
�8--z��7�
������a����~!*��dj1*<���~=70!"^�r^T�����٩]�l
�8;���ׯO%��������V�����4
+�����m}Ew&���w^}��;c%ic٣ccE�E�w��ڝ���LN|�gǫ{��vw�u�k?zm����;3��,���yK��gv���/�[�}���O��<6QjS̞k�؞��'��?�?z���zo:00�#�����W��!p/���Ks#h�v1W��P?��}/�ܵ嗿���|=;���q卍�]�u����5��#6�
�oӒ�������31����Me�l�(+u��
+U���������D�)v���g�u��8%O�����B|�ڭ!�����ɥZ�w�HD�,��TJ�F�'`���us/��Ld��X@��]��SXʊ*��ollY{���]��:5�P���K\���Y���3q�nv�h`����;o�7{�SbŻ~�ܬ��0HI��&�M]"�5l��Ju�
�-殺b�����6�n)�t)%�����x��klnֶ����ҐԴ��9~{h*(BL����R3O�m�����oڰ۶ �ܲr#��UjW�Ԗċ)���朽v��Ŭ[��4)���]��K�F4Y�~�-Z��i��
57X"�{����ῶ.��x|��Jz�O�RVnԺ��Ջũ�깸�Ҭ���f�󒪓b.���~65���ڊ*�o�����a����uf.��e冇%*�:X�	2�|����߽������^E3�੩G��aT�	�pu��zo�b3����7D
]��*���f�7���>�抲�V�l���k�{ݑ��k��&`��
+2��zӳ��~4��BM��C����
g����zf�NL*g�$��}��ҵ�+UMk^�MQj@�S��h�.����:�M�g2Uڍ�'��_W��K�h�f߹�|����Y�a�q�u?��N8p�T*c!㏞�� �+/���x�ҟ>��HDܥk�Bù�)1��l�j47�����kt�m^-�r9�r_SS���۩ѻh��~߾��k5�ӧch�����!~�sg57�H&ˆ$�S��=��R����������r�dJ��a��J�I���3�������w��6����|����wHU(����� ^^��P���v��ڥ���3~��%�H�rCi�dj��T��!3Q����9���_�w<�CT^Ndq�x#,*�!fċ�
b��e�r����aaX��ʛ����`�}(����C�a/�e��X��R�x��r���F���`�{AS�����*Gu������C�
�a_���e��@Lz�2)�)��F��^�BRsQ�j�Og�P�p�X�5�
5�>0Υf+�Z���&`�F*�&�|���w�X�x��?~�_�M����i���.s*//WT:���ڧ7>
go�5�`�mD�3�֭�<4"�kS��񱗾���|��	���n����öh`E��A�y����T��,^z���م��\�{�`����ڬ�x����^�n���?]��}����5����H������$�h?��xr�Lr�FG�����0�Q��ݺ|۸�L���(ݥ�?<�ժq�B�<���++x�޾EJ�͜�s�F��+`��5+�ʀ��u&�zϬ$���g{��9i'/fT>~���ʅ���H��s%Oa�M�o/����I���P���x�����
������.����9Q��h�y�������V�"��B��|5��0@M� ����푁2�e�,5b����wf�v{�PG�a�V���j��������䂻��/<��6��e/Ur��'�^���<>�+ŀ�G�DKk�bn���襝Z�M7�\6�P�J� o����h^3�~�UB������9��}2WBqY�|�x�&08Bu]�L����>1�*�f>Ys9�"�\c׵�姟~���f���_�Zk��Ub0��ܲ�Q_Sr�P,�{n��������Uk)36�����VkW�����*`u{"���+��I}�/�o���3����7>�j�y����q@W��q���>�~��r�X��݁�����>�7�ȅ�/-t$ɹ���a�����$��ͦ�aϷg;�������畎"�-|^�Z���M./����WC�"t��zj���"��-�wD=��7o݁�n�����F�a?���ur�TH�5�b4��a��\�}i��GA�.Î�ng.��5�nUz��|<1K���7Y�w�8��$�Hw�[^��󭙼FYjB!֖}k���󰢫��a��l~`�O'�����˱�A���Y��k��_B���b��O!�v2��m
+9�������L�8;�?L�U��ˬ��k��{�0�0ilnF�ޗo��Tjn�h���N��lڷo�Y�2dg1Y�����a��5&���ݞ�-�6)�QQ����/�0��45lv�¼L�f��ѕ����k�پ'�\ni\���x�U��s�}����q�o�	�1k�x���;���
>���׬x��Ps�u�&O�om�JX�����G"��0V�jrH�dW�B��8��:�����Yyy/�(��:���W�mo�M�b��=ɮ
�G맟��;/isP�[[�Ş���l��_���(%�r;5�o�k|�P�ˬ��ن��F�RA���Z��$�
MbX��Az����Q-w�����
+�tn�'qr
+�L%E��\���n���mI�׌��	��9]�d��}��X|����֫���a���kk��X��y�[j����-��F���/��|#Y�f��McK�4��8��;�����d�"{BdV�5!ז����#����Jϖ�����(+++--���e
2iiZX]Z"���{+���A�أW�����͍F �^._��]&
+k�PqH�jf���Tj](.��߿M@��4�׬Q0C3��.���}*C��urɳ�ԑ1o��>�7�C>����P��M�ǏG��)�
+�}"Y��?����6S�z���+�ݼW�Ť�����)�.
��2�׫W�%1O��z�ʧ�/_9�R_�TWW������&�JL�z��NJ̬�V�{����kOU0~�ݴ��-��E��E���ӵO�	�ܮ�&���~e�7��J�P(K��߿M������mP���(�ӶH
Q,���R�g�ѐ`c�l��cY���?�v��NM�����>S��4�d�޸�e�R�4��q�[
+JNd��6�9�YpHp��~x(��&��П�j�t*��)TթS����}!4�3*�j���������
�������<�Mo���:������g�]&��DQ��_� ���?���9���$���/ٕ���SG��%��^٩���O��H'KڕLWbtt�r����#->�
����v�`��Y6ü�iɪ�Kaэ3��xZW�
+E�F�FG8�in̯+�����E���9�e��3���H���΢�s�M�=�t:Ƃ�
A�Pr�2�b�)�c��J����h�����_���(
�y�ۻ�\1Y�`�r�L�03S	�cC��	��\��3Z�d�`Q���K�I�8�H��GCC�)��]^�����=�9ҪB��������HB�a{�]֫�ӿ���LM�[á����3�d������or��J߬�-�R(.[I�L�.d�30��� �9Y@��e�2��Ԉ�爘{��:E]�	P@Y�� B&'�K��dA�������}g��_��,I�L�0��	AരP�pB��#�Y��ta� �x���p���R��G�ɉ_o2|x����?U��	��
��Ž}�}Ҿr�eok�fN�o��c��6�[����L��-�E̪���˭�ƥu�
+���
+��{džE�}�f��)K��sN�{�[��v{�����"b���[$X�Bqg�c���q�d	B�j�	=��30�w�d>7'2;�$�	Y
��x.�; 3�#������>��oD�W3ay�C���W�>���섏���G%����_��N��Fo:�Z���wHQL�ü/�f� ���";��/gU��OF�	ܫY��ؗe͍7z��h�W����ѷ~�c�;v������o������߁osrse�
�}�2ѵja4v'2!���y�ʧW͞��u{������v������_�l犊bcb��y
+���8��T�{Ʀ���}��i�R !,��;�(d�R5D�<�{���M��hP�X������]\(Pb�~˪Ir���(��=�u.�I;���'�g����>!c�S�f�`�j�V��y���	$Xs&�}��o��x���
��d����霴3�"���h�`qIII��4�t�-����������^ï�O�c$��ۥK@ !��^�z5y�L���}����g-[).��B�����:��e�nt���,%�5h��i�ۅT���W'����F`A��Ywr�'[�>
+m�-w�{��"��jx�ԌhuT�'���XQf�m���dp�}�{���Y,{���
��Ƀ�g_X�I��m�����:+�ɹ�Em�j�{L��m���!kU���4�'j��a%�@��[dE@�B���.�2�ّ��Kf�p���N�X0��(a��6�'
+ae�B���䘑����s������X~�j�����҉�yM��c��z
+��f�B�Ԥ���{��(�ČkcwO�[���������W�z�0���
���f&.�_��.���Kf�j��V�Rx�(;i��9�U��O#��5�g�`q������W��5y��jTjQq��̛�{�zx�1.cb�m4��T:e��
f��Uou�vj��j'q�e�V��ws�ǁ���^���}W/����R��N���Oev؃�k�ʱ;5�(�}.�@ȧ����~Z�t0
,<���9[�S�/.J�-4
+�]]=�����>Ux�L�x�8J����	شfX�
7�`�%`�?��}�˛~~6�.r�8 ,��.51���o��˷f�R"5��,�e�}�SF>����ߋ��Λ�G����볌~$�yNY�I�4*
�+`T4�.GjT,��68����HƘ|�G,Ǧ�G_���6{��=�C.��@j���G��Z�Rcc�]�5���+X�I�Ѱ�1>�4>�)L�����DDټ��sq���N��EZ&�(!բ�M�:5�ᶙ����Gq�S_*�eRQʥS���w٧[����mÃ���@�!��j��1���U'�˗l^����N�V�0���`髩�^}w�T�����&OO�)-裏���_�l��dd���;�ew\��k-H���79y?x0�*]p�1������P��܏H��V���]95���;7,��	B�����=��{�C"��|�|����F7�ј�>�Ĉ�Jh/�3sh�M(+��Dݦ����аA��Q�R���o��Cp��փ�lmjr�:�!hkn./�-:��\HII�V	��ߤ$v<������\�6v����FuRppr|�7��y���?C�УL�,5+�od�+
��1���Һ����Έ����>/�-�R�����hl�Sۜ~�v��#ؾ
(���k�Jf��\;�p���&�Ic`*=p�0o�Q���C�[�nf�u/+��`.�<���kB�ݩ11"�Iٚ���]�������C�Q��=Ω�1ry�-��G1�y<��B�!��9#z�h��\������W�>#�`xqa�A��6x�ͨW��uPh*mz��x&l�scc�p�ز�L���u�d΂pTy'7���'�,� ��v�`P���'�-z
�
�$��/���Ң��[SR��/yd���PX2�V܀�ru��zW��i�h��Or ��ɍ����T��P[���Z-��M�G���qbL&�P��Ղ#���~T�i!S����ڴ�HaѰZ���,H_�)�|�T$��Ƿd��#���k�F��y&�L����
SS�V�NJ�V"����֮�)��u&�m�.�<�� �m@���q�.��� N���k�hu��c����0�?�q�JG	X�,�C��;^Z�P=�~� ��� )ii�����C���s�cnʓ�c�p�����rm

�܄s��n����&���xr��cuY�W�z*��\����D�K�7z��n\Ȱ�v�րr<���*������MG������@��׋8�ecC=��!����� U��*5
+*Z�{���7��$5��b2?��.�]R�,S�uf1T]�[t�A�������$V�[,
J^E�d�������x�^�GY�_�U[ �s�&k5
+��.��1(=C��6�L|��؆_���#�+�<�)�:��e)u�v!#C�4�^��π��'���g)��J?31Q��J"$px
+!�F���D���s$B"��$/�uҐ�Ը0j܍�����O�}o蘭e��������T*&�}>C��XV3�iz�F&��T*��N|j.F	xr
+A��h�@�瓓hʕ�X��F3�.�;�4�1\�|:9���r�lg����07m�L�C�;�N��g�4yJ��t�`n��O����=������GF��t𼙬���?��p!������R� l�1�� �ᤨ;�(+��Q�<��F��P8����f9���s*�/�k���gE
fxr

+a��r9��?� ��F�p�vߢ�}�~��=�nA��~���\�ԔX��ğJ�;ݖp?�0(($���R�9����w�>�����{}w�w�8�]_�U�B1\�Tˈ�Um:aĹf�D�n�P�S'���������<�����������0���u4��Q,Һ�۹j������Q��VT�6�U�xH�uj�0.}���#�J݌�\=)�|~����X����-+(�Ȥ
7���4>66<>5UVf���M���S��T��^^Q!�y7o��P8����ଣ��'/'%e�;9�8&�1:��[�w�zi!Y�)�f��n?L	�dvQAw'+���)N�RiLrlNPp�
+��"�ӎ�u��1�tb���
+��U��[��M{O���)������~uk�ց�v8-�]�s�zy!�lwjJL��F�yG�/�d�Z��ϲ��	Fu��RYIM�)$<k�
����fM�}™��9r�֯+Ѭtٰ����5M*.'z~j�Ww�3�j�a�<A'}ז
��r��TQ�P��
�ʱ֦ƕ��L3�b4�֖,�h5�f�J&������L�Qg��A�D��zs���������~�b��
g�S�<"��xi%A[Ƞ97�rQ݆B�L����C�Q411u���a���.@�4������˾��4�����M�˯�����+�aċi�?5�>F�0�ut�D�ie	������Z���<��o�;?봬4;.(�졳E�KbRE�X��?y���������G�6����ϴG֜YK��X�Y��U�ij�.Dj|]�$5��y���)�/L}Z�%�][�������T��B}c^R3=������"��]S�ᲄa�,��f~~EF����׿ں?�*q��̵Y��i��e�$�\i�a�k����kY����ܔ�+7�����"������FRo���W_툎�J�-sNuN�e&��=�s�?�{���`���'%dR��J=���KX���� <���ȧ�S`?��ӄa�pI$�TWW�s�7�&�+P�0g^�q%���@P����;Ѽa+�ƹ�{�����a���)W*���h�jPI�
+�����W�,βT���y�t��L(,,�X*C*aUWV���9.�I/H�w�O�,����ɣ��j�0+�(Dz��r=lG���bt�L&5.k6U,iv6��)�U���Z�z�\c�ֻ$5-k_,�A�>;I�M�	c��d�(�=���MM�p������?��K"�TL�|�z�Pr~  �?��aѨ�C�S�G�my�"::Pk;	m��1�?��G�r���?>�	Nh7��]�Ҭer>wun�H���«�2a�͋u�?�����׿�`=�Qt�E�>��RB$�9;h|\uY�������X\R"a���&�q���YX]-d�ĔX|\W����#2�Q[�
+x��(Yd�E�O'O��p���%��9x/��ݛ]#ol��?LY��AX*�W]+{���u�b,(
+�z�Gy`<@�_�A��=c�0�H�gsp��9հ�+��O�->�6�LVVf����M�5�Ņ"�hX,6��ٓV�׽u�"6QW���	y�0A��}������W�>K
*�NN���\V�������%Uܸ�&j�:V&
�hj�ۺ:9��`���F�Nj��P��o����w2Y���i?*5�H�t��="�t�R9F���%i%"l���Dܝ��u��R��ӧ�Ξ-�z�o�)ej:�N"͍�7��j�6������/٦�/j��''ǔ�`���Fo��ij�d����z��.b�����(.��A����8����p���$�?�����޾�,�mnnM���3)�T�􋉨�������{��f>��nr5��yT��|���8�-tH��ߘ[6�$�O��3\��rP���s�g�&�)�4;ߖڦ��.%�&$®�� ?���uB�O���ǎ9��31���t�9U|).�$�y��3�NDz��j^�����>%|�(�̉<��
��8���k.�����*��eԶ���%=c������y;^�"�,Ü�e��O�qQ��{~qY�
ذ�(��y�L]B\m��=����>^8J��8,�ks[��7��^���9�}_߅2��Σ=��Z�(Lxw͋���������F��`�Ѭ�<�����E��Q��iq���9<9��u�����n4DX9�����.H�5��)T
+^�ौ��5{/{[�YF �|���{�!����y��;�H{�b糅
++����R���J�Iۙ�c+�{��lr�*B�����~��6�n��P�D�0ڶ�M_����-��*�X����*9�l�wnⷅ
+p�b�d]���M�&K�q�t�����,��]'}�q�m��<̊?9YB�2�
�E�䌧2�����H!����1Kf�ݑؾ�Ӈ�F�v�'��_�Q���ê�� ��aݙ��?��P((�ۯ�Qu,���B!H�� %�?R*��?;Z�����y����̥$D^^��lk�H�
�w#ϕ��=�ow�*v-/o�{k^��a��,1�,������3[��"��ش��E�ęo������d��'0�+� :@1G�p�9'�弛ߐ�#ד/_���	V�/���+*x
+�� �&��
+�x �����6���8'��ݹ�a��j*�v.��ҍJf�j�<3t� Ҳ�8>DD�Y(B��2���'�� =�B�ܞL��
+A9W�=[Q�WA�B��.I*�|JTT�P���c�e�%	����ܟ�J�R��9�2'��PC��P�P�y�����ą��$f&�o�B�˗O=�u%Tȇ�3ޑ��4N:,��i2�x�
+
�"��‚�h2u�c�
{,e�,�G���q)�ּ��+�ʼuz
ݵ(j�޽���k�$U4<>�����|->�HLlHʵCq�>���;���g���C�7�Nv�\�T�\�DܹJ���� �����{��s��_��\��T,Y<5��:j4[�3/��	zzk���.d�9 ��Ӈ�/A����>c������r�sò��X*#��;���
+eA�C
+����ť}4�zy=�&w��R�d͢��HW*!L�.Fj�Z�Pw�_.�:�
�����p�l^VMV��
+�L�ltް���+�v>�U�-o�4q�
+�5��	���}}!�ų�������m^@y���9�re�]䲏�ך�V5?J�`7�a@���H3��������'x���b2�l|k�1�"a��Q`�*�Vهqz.u������륇�����!��_^����i�`����V�Ԋ$�U?�Gj�ƴCQ��7����·���ĘZ��s�j�`O���S�
���שqA�u����ta-.���ݯ�J҃��&��A٦G�I�
+睯?�(/�q�s��W�
����@d`�it^�����k��G��������,Mf�=w�xn���F�4����[�������/r�Zـ�kpsoa1����U=6P\��p#��!5	���P�f��4t���U����w������~����M���|u�5�좺���´�ȸ�񌔚�؄�C�����ʖf�����H���v��_��ҐR���I�����n�7
Lݰ�NM+���������oEFˆ��/6P��R�H"{�"�����.s:h�չ���U�QQ�>�ewf�ߣ��q���h��5��_s!D�����'��I��]KK['A�mm�?+����tWrJs��2xVUm4=9{wp��W����b�9
+�R�[�_c�rEo~�q��=s[�a%���3/+�&���R4��ZX��pq�����>�F�%�/p���/n''
B��-�c��g�u���W�S%��FҪ*Qχ4\�р�j!��-5��F=?��"���^r�ӣ8u���ܹ*�8ޒb߉���E�$&lBPX8�<�	-'yc��ѻ
��1�}|5
+�*��ٶ�4�k:��=��� L�iJ���۸{f���Y�cщ��=:ũT��b<ڂ��$�r��g_q&���N��k�i�0�L&�P��a�rY �BC��҅l�HN�S]�׮��Ҁ��
+D͔Þ��#,��t!��z�,äi5�h^5X�"-ޏ��둓}gw[8Te����#���5*,,�7jl��)��X,�c�۷�������سg���!�m�I�M
�'�Qb�Έ�En�_OZ����o��c�B¿̿�4�Oj��^�ښ�T:N���6y�)�M�'j���#�\�(������7�m��$�5jqx%�5j��
���7|�Mq���)W\��Vc4M���tb
+���	��|��ٳ �,���w7z��r�����H�4����,�4�-B/<9
���D�q11T���z��k!��1`�#6F����e���g��%g
}����/����7�7�/�x2O��(�����N,��ۼj���Ww��%�YF~���Rߝ;]0|��>j|����[�lnr�!�fjDz���/�x۲5J$Z����Y/Š�v�FH�[� �v.i�k�ʥ5v2:�o�(���~��Ç�PsM��b�)��0�����YȾ����k���}�sIE�\^��n�CW7Y7;�zng�	9e��wݟ�\�w��'wŽ�i�����_q}4(�"��T��¥����|17n�=��yH�u���/wn����@u�޻ŕ�ϡ�����>s4++��籱��|.&1V<666<Y&��������7>U6Y&���_ٸ�?�hjt��GXK�,��?���y%e�M�/�ρ�77w[� EV��}-�r���'o#0"��

;��?
+x73x|
�#��d�X,�{����Twv�v�Uՙ�}
+���С��!�5������2��,&��x��@	S��|���7n�3�|�3%�~����Y�v����	k"c4��09gZ�����)!H`�A��!B�@� �+Ytˏ"'z���|�a��l\����
;�WkP���=V����v�N���1.���#ɱ՚�F��AS�C\�k���D��cB}9)BUJ�\��BP�#{�Ȅ;9P�|�#9F�"5��h�=�
!���+5jV�;��,t�����O��^H&�����֭�srsWܝ���]~���_����4�
�����xxp�Ν�H@��{�iY��d$�nS���#����m�E�ʤ�O�Η=Ҙz�����r����z�^O�)P���t�����}�o�	��d$�0DQd�#АT�`Cgw�����ްj̮��.N�˯�E�;x?��
���'O�իi4��ؒ��B��\�l 0�o��8��i��x`�a��w���>�������&%U�P��P(2{����d��=$�Da`^K����Q��P�V��,�U�J����7���|��,��9,���L$Iz%bd�
]z�ԩ����>>�V&O3��{<�~��Sh	3��w ����g���[U��Fe��YL�B�7��nFuM�K%x$6����4��S�sP%B�(46�3��j[\f扺���5�a�7mX}��Uc�����5���� �DTj*��MM]�j8��ZL,�q������>s�_Z��B�u(_o�L*�Ca��2w��Cm��/㨰iރ�s�W�������
��|�&�^��IѪ�������b
+~-A�<M@U�r��+^cc:/*�d4�-y��'8��s}��΁�#q���{F��dId	�SLT�S�����[KdE_%_****(�JK�����Ɗ�'#'���N�����P�P�X���)T�B[���3�h��O�!5992����+9��6�	��`���43�M-	
+�v��Gfq�BO��!�3���G���dXXTz���؍Ƹ�ŵ(Ό3s���ۆ��(G,�`���[���w>'z\+�jLզ�a
+e������7|��ay��Ê<s��Im�����Ç�\b0j[�Q��Zyмz$w��}����ի(Z�]��"#�����P��x<
���������)*e�f0�l���~���[
�P��|�/9����^��v�R�B�DR�ʰ�k
NJ��j���0�<tMv��h:խ�"VA�i�9-��~�]j���['�=�����|��y���|}G�ƿ�I�E�DU*�
+��y�5��KH�TJ�&9�d�|�y���seP��hXUu��纬�N]��X�z����m���ߚA�ƛ-�=g`�髐��vO�U�a���{��`m�y��<��ӿ";���
��P겱�H�!��Y.ϼT�a����޽Q+yr9�G=����P,�<�,�Ai�s��n�ぁ��RT-��5%4Z�>�c�[�	
+�Ke�x�0-��"�M�ySI���G�{�]�4:MY�F=���Q��Y�eH�F�P���n��)p&���F����~`X*�>��An<��Y���ᅐ�@<���O��sRc�IdE��
+b��ꆒg�4�E.WX�����CE��.�
+��}V��
>˵0,��
��c$���^+).kW���Ϸ�׏�?ھ��3]�T!�
+V:B�D��m�Sێt��i��3g�ϞݱgN-G�U��"��a$�	QӐ�@��B`�Y���0 �p	�
��Y+A�k�����H�»��������2�q�%�p�����Ͽ���V�<��3c���Cg�"(;::��W
�
��vf͔��S��xу�?�D�
�,'�L�\^�9D�+)([�?�C$.��,��?������T�_y=�N�������gy-r�6�����C��
�T:S���Q�^M���A,�-8�;���?%�Hm�h�H�9��d���pϒ
�V3;�ZeR	R��u��C�s�b�P��WK��0�Jd��������=YY�A`�f!{��!�jK�R���G!f1="5���\Z''U�y��5K�P���[������11U�'d-
+��|n>"{���w�H����u���[�;��fd������s��A�z\D��?��[o��H�2YEn�HĮ��S�Y=�A5탃m�������É�t��^��o_�Ru3��Z�χ����I�:�{�c`� j�ի6a�ŋ
+FJK|s@>|�J�ʳ�.V�K�,N&5�R��l6�Ёa��$���B���'��,��49p���
+rp�}�ֵ}�ǭ��3s�����"�vk���܋�/�X�q|�� 7�hc�����!.,l?^�>#3O�eǜ�j������`'�<f,R��ӱBQZann������$>���l���08:lDa=G����:f��v�Qff&+3[����<��2�2�[e��ojis�m����Z6�p|��w�
������8�J���q�FO�Z��P\:8Ri�/)��Z'FGF�&+��#ccã�F��j4��ܕ�"�Tg�E/�5�u�V'���֩s68F>����F)�AM�%-.���$�heRTO&��L�Rb
+�S�T�N�����c�P���(��f�����'=�,-f�0�;h3��m.m�Vb�4W+Y��}=�ɹpv{���rUs3�HԀ`G���I"�ta�3��oo��<e�R�
+�L&c_)��HQDv-QY,��+�&�	�U
+P���5��M�5ԺEP��#�b�J0��iZ��J#P�RDB]���L��:�F�3�0π�W
�,NjD4�B�U_�16336�P���*�&Jln��Qs���@�6I�1'6�����؀��U�P�%&D[���A��&�LT��t��D"�_����)'��R�;t%�r�ZG
+
+�j5
+�B��Y�o��C���&9���QPF�K�df�Q�F
z���y�)��8f1m��}H�i;:<�i�-r�A�ϗ�6F҅
+��Nf�u�r���Q
#la����Ҷ��5�W�Jԉeq�"��@).��x��Z�@E��<��c����5)���A:H�
1W��鸑u�H�ՍP�MP�t$!&�
+آ���^T��,,AD��zgN�=ƣ���&T,6IK��l�J	B�S����|4�b�e�`�Pvc����,rكD"����:�0;%��ԪP�5 ��Ivg8tM`k�͹\n
��s��H3}���q�4��Y�=y�V���x�
+>�����	���j��i5Jucv��l0�&V�
S(
�"Tf&$sR+&E��3�z�"��3�T�,��枣�d֩��X�\�rښ�a��������+&'7�8�b��/�46y��L�b%�s�`�
+���(5߳_zF�@��Sx�>� &6��o�ݞK^��?�Q��#���7V]9x����D�����S�S��+EWNq�|�� 
���}x4攚�=�#���ٗ�kg�Ν9�Oco.`���e���(�5C�V=�qF��Yww���r��He�iVщ��9g���? �S�΄G��6%�������ث6����OF̿��şީL)�Z;XP1@l^�/�y�����/�f��;ko����
[�>x����;�.勧{^��c�{���*�p��l��&k	�����JX$�
+b�(
�n]��������xg�Wr�`�[���赫VK5�:o��I��81�y
+ZW��g�wӝCaO[s�n��X�4��M$0����^�tn}��[G$~�Rj��~X�\�R#`"�u�[�s҉���B0�|�4��}Aɕ-mk�5����|bv�Mei���$f�ʪZ�������4�+5
�D�88��_N��o�4���bM���^=���2_��7�C7oJ�{�r�m�^yB0���Oi�V<�S�v�VY�l[x��2x$"�3��fF9���!�x����^���N1:Xo�R��4��K|n֍��O���
+�	�ȥ�z�1c&S����?���&���=��+g��}}7�(���������b<PZP��Qi�Y�V�ͷoN�;��UE�(�n���<V��W�-<Iy����>u�O����&9nz��g����dX��1{r��)\�`{�4��~���OQ9�r��b�C��ق�`�(1I�W�O�H��/�s2����;���ٖ�\-�(�)�a�j���0�@J�J��@]}r\d*P۩��~��sH�c?ֽ�Us��9�>��Y�k
��A�����*�D�X���;�_�x<-m�yR����;�#���MMI+rss�#Eiq��+��;{�6��M��YU���-�;w�z�@����N��N&$$�������9~�[��>��ۅ]����s$�ݨ�� !�F�\�Æ�� �+"j��w��K���'H1���ki����TB��/H��{;`6齷��#=���"�#/���g�����pf��t��4Uݍ:���ϨW�N��Y��6m{d}$̒J3�+e���|���S���G�Èa�m���

���)�����e-..)��ѻw�eWa<��B[�T�L~5ƌ��a!�Y����.n>m���^έO�RS�^�5r�R��T���&#jW�9q@�f�c6�ܹ�)|�R�X�vT�zn//��%h�0�w�@ZPv@:-j@��{%eCM�?�~�]���A��ub	�3�D�!ARR�)���K�
Nu��O�{@�4�hn����?I���qXM�f5*�x.	�T�|�t!3c�H�[m7� f��V�]j���]�%�;�eO������.2BB!�� `���Щ�]�Ow�"�������LF��ָKW.E�����b����Ԭ&�L&u'$H}=��|�
��k�<�!\�B�ϫ
�H��1m_~l6{�b��νΓL)4̧�Rdbi*)��q��z5�@�z����uª9jڕ��=j���nji�Q��j�ӳ��od����%ZU9��I���Ň߹*�I��y�1��?��m��=;aDy#W.��Z������>�Ͻ����&�u�*=�-!��R�`�9�V�����k�7���s��}1�[|5z��q]@��u��`*�4==2���/�Cf�''��{p1-mz��C�We2�xɜ�@��ɉNi�|flrsi2.������l�Xg&��Q$$���<�y�d���!�ɞ���x���iC�5���f\ͦә��j��L�x��B�
���vچ@�¤j��l۪�{R���9�t�������B�=^
�+��(��m��6b��7.m��{��;Ĥ����AE��H�҅		IBA��n`
j&
+{�vX:��ٳgRr&�fG�HOX��1��L
&+�^�	�����mD����w��̖���c�=�e�D������V��EFV��5��ե��Ż����xz��hk1^�ZM���Ra��lwb�ְ��'��������
֏?p�/kRKL��6o�ꫯ����_��/��̿� �<M�fG�c,���Y�G��pN��#�b����o���t�nv�yFO#�ꮺn���V篩T=$��丰>ͷC�;|Xuk��tHh�MD)%F#i5��A�'x��
+OA��`O��O�MX��yjJY���\���ʊ�����CC��>`76eM*V�^���=Tdt]�b�WQU��+)��++��r�X�֍ō�9�g��zo�`�	w-��yD�K��o�-��R����ҏ|�-����������
��`j��h�~8>RVҐ
����<�cj�C����͖�q��܎Y�F�͉�}��a\����lXu����1/�驘�����X���{^5"�F�}��&��+�Bc}W��h��NO�|6�NO5
��4��c����BGU�%e�E��
�I߭fs�S&J7B��ͺ;W_�ۡ%
��uT���$�籙�/�GJ�:�׈g�!:��T�#�YD����y4~&T�{����h'!z
^���S�N(L�'FE�IԬ����8�Kx]"f��Mm��~���]����$S0jj5?�����`s0�;9�;����8H�̾y���Q�SN�y��ʼn/�	�IGXb���	JD��٢Ց���C>f5%�	{v���愇oO��X�-����%Y���;s���s��ݣ�PF�{��3�Ex89>��I�sv}[O��wԗ���r�S٤�����gΣ��Uu"���k.<#dqP6'�T5*�*5�yj�Mh0�@xH����4�O%%��9��)�����R����JŰ��{=��k��czrdp��������&��F4c��):P��|��dK��M�F먹��0c/��ee#���MH�Z�T�P��fu��	���na��α8t���n/|e���	���Q#�S��)���7ˇ���drِ�,aeyy�^
�
_o��SW��H��ea�|D���Wz�h��H�f
+��r��լ{�C9�
`�a�DEE�����t|�	ey���9��g.��R0��S�(��������n�{���55�as��X��$��Hd���I�JQ ���Q��U��17�~r7��=2-������Kxi��A�=ђ�)	�9�篎`��}�@�BW�gr��Q#{Õ��b/�┆JKK���3���`��_S
 ���D]NJr6[ּ����
+�P(hX5�K�lO����#*����}m�k7S�1��m��6��ڪ+����u�Ń�����5���'JK���x�4ޝ��M8���HE`�3�ZV�L�|���+���L� k�L�ژ�>�v�G����7���H�zc�r�\�T�AQ��	οm��d�fڷ�;���荦*�qqۏe�+�|� ��*�C�0f�]ѱ�$����sy\LO�(�#��=����Z1s�cI�)b+�'[��\�qX�L&��&p�z�%��c�`�<?�� Fi�8jn���=�H���0���-��L�!���ЩC����pj�	�'�C�`��/��|_�%S��,�9�0�V-��{�������O�4���#������d��$:vO����O����/�J���4�yU�q&��j��OO[-�����{I$"��gZ�b�11�@����[��Z��(��1z0�d�45���O:�O�
+f�V��)��+�0��n�����4�N��!5,���c���oY~.��A8B�L]��P�T�����d�?/N��qo*
+)4MK��ٵ��'6�
��g�p���5��:"��k�R�(�>�^o�2Mdy��A5ǰ��J����ѥ��x}.!k�cT��ۍc����:>܇ LA��v���d��8�J��J�[<ie|x-=5"�r�k5��瞼���<��w�ʑ�q��6�NM4�ey���k�;?^�n=ml���MS����
U�d�A��kF\��h�n�ܞP���zG��j}p���,���tۖ�-����fPk/�)�h�PR]����MJ����&q���{��9|�Џ?�#jW���*��P�Dߙ��L��Ҷ}m�jۦm���\���[�᨝���G�[np]��q�q!�P��
+�ׅF�e&����g�3��6�1jk3��
�ܮ�<y�4��EӪ��-�
+
al�0�С��{�&Cj4�M}���c���a�������v���������8��9A���Ap�\�T�0̀���.����}r�l�V��m�������Z�Qs𲦕H��LQ�k�Z�^Gl����z߀u>
�&��ئ���(U߉Dϝ�.D�~��ҙ�a;�6$���d��sEW�ҩ
+G
+a�2UWN������9v���f�/L��M�u����������:�Ǧ��|D$>	\���ߴmӓ𨹮.|׹����4�`��EPS��&��U?�$��_*R6I�Î���Z�^��g��g�>�l�Q����m]汎Jy�<����o4��������o����<W�Akk�O�k�q�^�$�����q�	���}LM*�LJ)��������űs�Y`ed.��8�Nз�k����L�\�R�b���o��O�D.��k�)�vq|^��0�!Q��bS�����-mw������٠$�U��,ӈ֫�䈔%6O���a���z?���a���xu��%z3��lG*���<��'?B^�b�Ϣ+�ä<�B��߆K�j��̮O�VP���J���Ɯ��;߶�P~���D��Uv�񺹴cx�����̀m떼�8Ӵb)����!��5ذ�frRÜ��ܫ����o��_
��2m���]T}MM:j�Ђh�[�1gU�eˊM�_�V5�ݥw' �ޑ#:�ى�����"E·�E�<�Pv��D�{�!5�j�Φ
�^봧=��0?|�"�[����}���k.��U�+W�����7�Å�Y���
+�c�3��IB!�����޿�ƨ)��0Ҩ��j*Ap�i�-.�r��Zڲ���u�����K�q;���|����B��3{Q�J��
[z�����\���l����զ*UIqF�=�B��2e]���I
+$�^kIQ��jg���N�����~=�}��f�^k��<V���2?����F�)��2�
���@�`�w�KM��*`1Pn�ʹ�����zϵ��W�&�h�HB
��p�s��,�x8-����
�q��������ɺ��$����<5C2�ۻ�mR��#��MbI��6y������P�p]W�QC���^kv���#Kޞ$�@@X�j��1�p�"�BFf����q�|t���xYI�Z��IE���YV9e�X�,�6��/��x�X����o���yK��_����u�*]&���$�����8�/���.�;0��ּʹ�R�>�z�!p����J�n]�ӈ ��L&�pLf���
ON�`������@������������
��0��7�U˅����s
+�r�
�W8�r.]=gF�ֹ��{#r��� ���[��r��z��Z��:�Ne��bN���$�W�B��j�ݩ�AZHG"j��X*��U H�<�>I�(�{�d�W����P)$Oϻ�zF��.%$�W<>�7��
�v{�^ċ�|��d|�&���
+'��VTT�A���K�)d~`���T��]WS��dQ�[[�yY�����;��X��ރ<t�Z}i����� PB�?b�bK$x�&��j���aa'�0�Ԩe�
+�j����N^`7�
��%oȝ;s�XV�#�(T�Qy�|��^Y������Q,nl()a�x:?��V�n�c2*g� W��!��̫U�l����B��TW��;�����Ůx}k��x�AM
��6�����$�2���|c�C?������\>�M�
�#M�`w�R��u�����t��}�'ʉ�HXɩl��h@�
M\��I?��˫���C0Sx�Qa1��=���TZE
D�Q�Ŗ-ޛ�e����9k����V�~�;���3�{YBn���-'ˌe&�B���1�<'_�|�Y��#x�8!���b\8�x')�߫¼�O�{�z���b�
+��M�jU�"�y0���O���'��n��7��ǯ��V�u#.�^��q�����X�l�q������y-G��#�%$&&>|X����䏂7o��4�iӦ��6l�������А��#�'+ݧ�'�{s�b=Q^�Ą�`��*A
z{���ؙ���?乾??��@|�X�-MH�N5OY�o�3OQ�&j�/������W
"(�STוLM��$�4��V��s��"|s��3�Z���sfl�
��6S䳘B�y����%$���0��N2�lӜ������P���ͳ�&���9t	�m�|�Թ��?$T���P���Ƹр�ƴ4y���l�RX�
n;�F}�F�ƶ��ѳ��4�8p�D���U9}ܘ���\��V:��FE�yl�&$��gb��x���*��z�fa6!,�:.z����rNL"��{�tjⷙB�@��SR("n7$�>o߁as����u�jCj4��v�+g,蓙��Fztl]u'R$�ݶ���K
%����~������yU87��j�q��!��L"����c��>]:#E H��t"�/�g�SRS�������j���	�1M>i6�o��Y,#�t�}P*ٗ١DvJ%��Z)�V9�Jdž����r��勧FTڃ��.��`:��/�er�Ia�eߙ�f��������F�㎿��E<2!b�P��B-l�l-�ɧ��/`u��ǀ�L�@�&��Za�3��ڝ�k�>~-|����E/(�Z)4�*��[�/T���5�w��a�}��ьX����+}]����$�����H��%I���,Y�����spMu>_H�����q֝�keIo�[t�w�m3U��E��b��f�E�⠔���ǖ�^��\��b"M��]�TJ���/d�n�XW{��HT}$.�ĩ���qVjF�@V���'��3C��ii��y-�?�ў�:!`�h�*��"O��ZE�K�Y��>�`����k~�n{�-�����x�YW}�<�����䬈��j���Bދ�&�l�����{[_g�Y������w���s(����Ttr^O �S��M�ť��%�)�B5����V�����p��wi�\Fb�'�a�p��+�9�y[C��ɥM�
ޛX�㬙�
+��۔����������z����mۦ����jyE���R���
+_�>3�t���O�O:��$�0�|�
+q<�'zm��|�=g�ŏ�Z�I!�sg����{**�K`����0�,z�~�W�uP]�����~������S&���rq��u��y�
+�Ȁ�)�Ϯ�GL�E���DA��m��w[��[��'�x��������/�/���R�'$�r�!����c)����׫�a��	`�o��D������z5�B���89p��&��̓=}�ʚ.�J��LLJ�bJ�xc4IP�����o�k���F���"����Z�TQ��������=m?����s��n/붵Z��h��L0C$�02L�j  B��q 1\"�K�Z��}�	�����y(Of2���������_8w
?G%.�e\��q/��8S�w�'%�$L����U���__���g�}�駸a	V>���R�\�@��P�V3k�+w1�3b|~�My�d��d7��sS�tr� y��O����.���]qh6��K�,�=���������YX�g�
Xw��i��x�T�?߻���UF(�P��F~z��O>�Y�C�P��B���D!"
���E��D
+쩎��lQ�L�$�¾F��Ĕ8�$Q���N-�dk�"��3�����DCs�����u�1�<4֮\�����E2%P�:��n�M"�9
+�W��q(���Xj������
�P��%��%�H�?�q=�l:-PI$��2*�,H�eTe9�Ӿ�,H�wP"�%h���M'�*:$��ͽ����m�YA��Cs�U+#��T�Ђ�'@��_ZBʩ��+�.���n�^LQH8��k3R7J'2�M
+��CyR����J*>M^H=�ml\����%J`����HD*�̦ʨP���դ::���0�@)����s��:P3�3A\�z�:s��BHŕ�D���{�#������`W)�������.f�j`�M�9YVҐ���<�[�_���{�_���S�W�cΦa�q�jǔe�N*8(�7y�t��=�Mם���d��t�u��Pܩe��c�ja�����c�q�e�\�_5���>B[��*����M��&!�hYɷ���t��g�������A�Fyƅ�����ۥee�3v���ώ-_�(%LOO�t��,�YJ�scbz6��~��f�鲯ƹ�h�s�E`-k���j�r܇��a�j���SG���Ũ]�R�a�v�#&4/?��g���k(L�NR3��z�[���E�$6\0M���A���r���3�
+KJG�'�1�E1��Ҋ�Fn�����=R6z��m㓷��5>��}}p�q%��)+V0�U���JJ�(Z�|�I/�ڰrPH9�
+�Lo��`�'ad���jEs��X��X�����"LOK��A;����Ȱ\f"��z��d���V=��U��5�P��db:S�x<>W��8MS&�drG�(�|ؑ��������s�߲n��;l����1l����|s`�b�n

h�n^?7k(;���LQ�B�߫�q^V���@�;]�u(+��۶>����{4�s��l������%�㇇-�=˰�T( 2$,�a`9/�8��5j�R�4Ch(GEQF ��|<�W�pz���6���y���f����7xy�[�Ϳ�y^�۵@�C���{�Mv^/y�P�u��{{<��ue�?�kh�����������ڍ��Ҳ�ɋS�3y��Ѓw�]wt׮�a8m�F�<z��?Q�7�d�
+�ɱ"a��&���r���0�p�—.��Z�FL�zL"%(�D�0�����eD�
+q���DQ|y�ϩ&���0J����^u)�cGƞ8W�3b�K�9~e1ͅ�[
4�Luǐ�s*�f'�JU+$'%�I������''����_�mP^�������ͮv#|�,XN�@�E��������}�hz��}��#cce��2�fG¼-)���5)U�:��M�
+�~Bbʬs�8@qZ4$m
�L\�t�	��u��g�&�cw�K�K�EEen�/8tq����F�`$*(���t
+�o�j؟�LJ�	%��ZuC��N�߽�2#/a�}c�����
#Da�>���\'��8x�Оς��u���|�z�\&֪��fv�X,sC�&��s`�ir�� �s
+�~}p�iy��������{q~�~
����q~n k7��x�ǜ���[��ޑ��t��˧땒hM�
�����j�ʕh�)+����z��2�8��a�%XzI�6
��7�/U!���c%�.9�`.lgs0���(� ��|���-[����3ɼ��m(�?��'�|(��!c�_��_&!խf?��(!A���켲u٥��L�BQP��g�b'��RA�7
+�����B�T*W�AC��~ڈa���g�B��m���t���_�1;Ԗ�κ5��J�]������+��?
+�,��_��J�R1<����Η��K�`݈�!�_������H��N����ߟ��G�T
+��i�`W]]ɬ��8E�����1	��̊ʲ�ҩ0If>�L�����E��$*��LS56A�@3�Yp�b���b���O���h�ͺew���l|��ל�U-ْ9S�T��)+�5��q�h�#w�X<
G�4ʊe���gΜ���`����R��g�0g�8Pd�q9@Z
�3�P*��ࠃ�9+
+v����ݩ�&���[m���Y�e����wh��4�;����h|�;:,�{}Y�M�^�mۈ�!�z�ԁ�U]׮][�q�FJrx��@�4_��R鲼�>_�P�s����일]���$�4��4���3�
��q8������	,@�w�RU�T�X,�V�o�
�h��Y�?�fU|u��[����ZL�NG�'4����{ͥ����.���LJa����ߑ���ԓ���!��F
I����]@r��b)ᴿ4�'%3��	���Rމ`ǭ��:�]]�T�Y٘X,4�YJ�މ�f97ʵ$�[��dqHm��3�W�5���r��^gX[�}�V��5�d�;;8����Y�TgK��p�ɛ�(����G���J��N�K�ΊBQ���f�\>
8
+�ﯫ�UI6�tBY��T���b;_K�-�ho6
��ɑ[}xkdj��S�W�eg��*�o�ɋ��kZ���9-�U�U�-1R"o�L*�sj;��L�뗣��o��P������x{b�b�ޞY}u�$[�iıZq���4���7
+�/+�����Ը�H&�I���\�;�Ư\m�����i�K�'���5�~��� _����֬�4I��d���7h�ND�A���T�5���IJq\#L��	�\듟?r�޽��ɱ��Z�Т��6�gb�Aڨ>]��&
[#2���6h6�][�e
+�g��c�DJ�$jɡ�,ݹ8.⡙@?v�o�l����!HDhM�\�������{�����]\S������6hF�s(�*)+6i�����P)��ؠ�vq��^LD��K
@�����Xm��T|�u:����&K��X�r^5oo�67�w��NN��j���l�,�^�?�D�	E;m�gE��0��bYv
�'q���|E3�]��a�X���j]"����y{d
KdN�%�XRJ�
+���.�5�1�!��ݲV� 7ITV��6�ڤ$N\��ߑ�$�i6�m�#_��l#���چ
4�A	2����z��/�Y��8���m?ޱ��`�T���U��h$ѨBэU��s��~
�ۢt>�hIZx��
+�"�
+�Ӳ�́?�����������ÿfۖo���w��s	��l ��3ֵ�'��+g��t�+�谌8�o��y��^���91՟~u2%6^FVת������G|��gq�a��B���j�ZE
Wk�rS�������'7[���ٕ����Bs$�T�s�Ғ{���!
+�rZ^`���8N�M��
�}J�e��PF3��dO�	����+Y�V���_sl��2�*i��W`��l�u�{���Y��b���r�v]"F!$��`@5 �@q�Ţ�i|)/L�Ah�"З��XG&37�:j�u44���M�X4�{)tw|d�lP�Q���J ���[W��9Cj�e���0��l�TJ4�f؇{)^v��f����j�w��9���, �oϞCBr��ه�h.	�M��N�qM���X�"�b�ĨL�"�*K"USC˗b���^��ϓJQh�
���D���IJ�M:s6-f�BFB����0u��晷���w�d���KΩ5Y,�No�[�6,�T���	�M6�겆Ǧ��N0�;v��
�Jl�e�W�OH0G����kN�l�^<D�7��y��Z�5�Ӂx��]�@�I�Ԇ����L4�P:�s)�W�@*��R������
�m$q>4��S�T��֟�Mi�X�M~�F=����~套�#.�x�5
]�;�_s{�͇%�
+ iI�^�O�wQb�HD4-c�X��Kff���м��%Գ?�
�4���7�0�>m��^���7�Z 4����lA�x�0�-��L��44�
��
������@,�0�p��C"�E��@���I)���d�?�|�H^޴GxI`����$)	��\n���~�?���7�VPս�ȴ��1�X�,�	���AA�tf��Pβkʭ�$Ib��ֻ�
G�Ɏ������x�8^c��ԻznM�r�C9\�_
q`e	�%�"0��l�Z,࿞�v#%B8
�(��74t�-��Ǧ� A�P'�VA�m`P/*� ������;5��v]�X�&X��N
��w�7������H8�pK�l�Ac�
+\Ѵ�*e�/�#>�Ke��D ��3��f�������z��l���.&��h6ض�;G�<Ger]':����_�%QVe�Eb��ͭǣ�V�}ӧ�@�"m[��3w����8ڊ�h�
+��!Q�3	����A33�V�Tj&�I�(C$8wĶ�{�1����T;Ϧ���/8k�����
+�W�e9���/�����I	P8:g9��kLZZK��{f��Zf[ybI�5�j�
+�E"N�����®���E2y��߯�󟎜�h��4�!���k��$W�b��ښl���>�$�V���ٕ�R
Б)c'�ݳgo�0]�We�����S�Z��j{�>l ���`������Yhvx-�*)-�#�g�h��9�d����q��5���5�"���
4c���q{�5���nf���D�������y��m�fQ��C)���7VRTX؛�T��;�;qBFam���t,rbl��O��}(��\K�Q�S�&[�T&z6���0ɪ�U��/�po|�K̄�j�d؝Q��+��{fq
+�#IΕ��d����|��P��Z�F��U��X��������8��G"쯇��%�G�fLD.�Lyy�<6=%(�JaȨ�-r�0%'Gc1ڌ���l��IEkg�c/WGKQ�=c�*pd�GD�_Z�L�[v��/22~~���w�D��`�;:�Tǚ*BʗJ��ΚTi��<��)=�𞏧���
4^����.z���q�'�����q��0kN���b�Y�&�ϓ��\��Vf�J$|)i��8:85�.�Þ7�	�f5���?���د�i�Fh��	�KO��2
�����ds4���G�?r�����N��O�"\�H����ۿY�P��bNh(�w��8K]�.����b99l`�]{,ï��u��W����z���2�0�l�e4N^�
�����F��x7��)��!<U�
��1�����
OB
�WԶA��K���wse�V�����(hI��}����?����w�T�c���{��@\ˉ��Sd*��tW*	U]�lxݪUl�^�nADb-��������1Ժ;I�C��k�`U�
+������~e⁠�F;;[��_���O��C�UM-�6v��7����q)Qݽ�:5X"&�Mo��
a�8n���^��E_Y�yI��㹉@F�����mU���#���Fו˻�*��dƞ�Ҍ���D�R�D"
�<�S
+�B�P՝�vm�����jR=������ �Z�
�lIh(��p^�[����%0������WnMW���:���NTUU�)pn�m,�0����։iYjZ0���>���V
+?*c:�Y��z]�;�m]��e�Q&�R��5Ƥ�i���&����|/m��
+O�0���t����	���ЫT�rkk��0�j���������H)���
+]˵ZG�F/I��h�aF��J �#��C���G�d���nV4��LJ���_y�R�rj/�
h�Z^�
��Piuk/8����R�H��kt��~�$���d)�0q\���sا�%͌>�U�dA�D�0��p��^�ļ�P(�ˍޡ�?D>���Ш�*��G��z�j����`�m�fm��D�"����N�XzB�}{�dqtDFA�~�rp��4I�=B8Q��EeI�����̯����F�k�)N狡�E
�
+��B�@Ye�tT�H��p�?�\=�:�<��o\U1�0?����m���M�{:�z�ÃNf���n�S�d�WZWwf�!���
,'�lg(�5���@��@vҩ�q�,''ШH�c��e4�336H�W�5
�􉗽YNo,q?>�I���|6&V[��1��6��R/��r��b2z{�=�*�Ez���b�0tDU7��t�1��B0^Q�D��HX�������ݕ�j���dv��,E'J^�?�o��Z�ޢ�lKcT�-5
�0�7V�`v.kdj����yV'�Z�@�m]*e��F��:�;޼�e���;���3�?�/�KK��QW[}��񼢻�z�i���m}:y\>{#2+�����,��v��C��6>���Ž�ʯ6��z��W�?���w:%	���0C^:���-�dk�!�qn�����F/�%1��)!#5&>Q��<yE�^���z�|��n,Y4qa��N%I�KPtσ�c~�%�PĶ���kr0���g;4T,���+E'��$�J���G��|R���~��;�]-���4q*M��'B3U���WLG����f(�Dwx����]�v����
�%c|\��@��i��Jl�B	�c��e)�IN�����Og�V�0��*��yG׿L�
+K��r��)����
���R6���%O�<���7P|�{a��߭q��X���4�#@�L,[�-L�<��w=��8c�5�$�"�\�U��뼟������'�u��4�;06Y1���>r:M�����9�G��|g!UȌ@0���%����۷����H���a\\�
�+0Z�U�S�@d�����˳8wR��4qA�?>�&�m��K������6��>X��|�o���s�#�֑��F�CϤ=���iw�������ͽ��x�A�a�hF��*Eh����(3s?��ۇ��&�:u���4���P�)�����A��|�%�>��>�ޮx!	��}�Vz���_���H˴f������2&�98a��=�1ȓ�U���'����iݒt���ĀϙP ��/S3�g{]A9\��K���;$�����.1M�On˽_��<nopع��(#��Yh�
�$8%ieLC}�!����!Vp�QM�$�D�
�N������.
+��2���}C%eG5�0�ѡTa�y=M^Zb"ЅT �}���3�hTf~���7��W�D��:��2G�Uz
zܞ�ʁ&��7�>`Ѩ$<�7'���U(DD\
>K�ˡo���Ґ0��~��7��I�)�8Y�PZx04���6I>+�:)))�.��7�P�?��7Y��ã�D����;���gY�3���U�J��\$[W��m"_A��T�4�ͳ��R�,a��>���m�zk
+
+
+`�U�
���	P�AJk�o����ӹ��M�T����Җ��i���$��
��}(X����'�<��'����{":
+54�,��8Eyz����Ł�S�����X*\&�܍$���l^n
i�`�(���h�Iu�Xfj����|}��²�2�P�7
�	�!
FW6lo���HSR)O"�LA_�N�N�w���K�ǡ��I4Q�fPaj,*9����Ԓ��\p��DL�����Н���;�n�7i�4�Ԥ
+��iCQ�nB��d��R�TQ��CY6ms�ݕ��F1}�c����
�\�K�
+43��#�z���d��.���4�d\�ln}\XU�k=f*-N�c�,�"��
+�Lf6B�.x۰��h�H(��4�Ҳ���~��s�����Xk�֏\H�0C#ꝟ_�b�vn\��Qz��V��#��5,��f�d+)��&�g�9��9��JK�д�m0i��$%
�DyX(�g��ݺ9lq7����/�֯��q�
�\� fO��&Q�FD��㭛��&�"I��̤0)�Yb;��n�]�(/-���+�Y�܇�8��GH��6��;�����n�Dzmmurl<R82�}��pC�slG�,�-��P�
�kv�]G?�"Q*5-:��)Pk%�0�h�UPnvu��F�������g����5�t)�Pi����]�8GMm���7�lLTv5���N��`�.�B#�A�' 3~��U6�n{��i����b�Ʃ��7��$�`n�[�#T����PR�MS�u`�܈�*.N,""�ބ�r�����Z�T"!{�s54MBX��;���D��d��6I��j�Ga6���*�;����+�'��bRG%R����ԗ,� z!��A&ֶ_����"��.tkhA��{�f�.S�	���v��D��FZ��5"��������qq",\�3+b޾\�Ӿa^�)i�hX,����
+'�$���T�����e}>n��$Cz���Z�#���)Ac����5�,�����h��$����)��Jf��R�׬ǻ Y^^V�&tζ;;�e�3KbCD)��ƞ��4�j�h�<����Ef�=��i�L��?�������a�����,}��A&��h<=�)Zsa
�[�
�&)�Ϳ��6bTT�J''�Pާ�[4i����u��v^�F{t���Pq`7��~��5
v�}�È81E�/�5�i�0U�؉@ʐ�$�g��%�w^�k�{��wX&��-�+�T��@��g߶�S9�oR��'�:���Y:�)�*Ȋ�O�ָ��9�Fq�����8$>^�����7�^ͺ?:+��8>*�=����
G�}ؐ�$���������8��w�J���g�@��S˰��AU�zZ�V�֖X@�6�6D0�b1?d4���l%F*���&W׵>����={�*L �������})4S��^t�.�f�*	�Y���<O��}_���=��Hc�?)Ҥ�Ö���,��.����"�5ڲ�K2�
~s��
�T}������oXm}�l}n�/�Q7.j�|:��Q=*ꔨ�#��]̛�ٽ����U���
�}/u#�(�����,���Ɛ<,�0���ݭݫ���49n��f���bN����ǖ���?����18��t,a�5/����DF$c%9r���ܔ�`nXrJ���;9��߄���0�jWBб�Yw�2��m����N̊�z $~�����&_���:#L	�� �P챼�����7����B�J"��p„B�f	L�a��tvr��2��h
+%�\/,+���H&�����k~���~����"��R��Fe�R�5��ڔյ@�(����z`(�Dž\��~H���gϞ������*�df��͐�lp*!�Z�
�6R�r�VK�/�KH8���Dya�C�����g�|�ް�cX^~:&]�qD%��D� �*JJ�l�~�"/��
+�P�F�2�q.�ae�?�����NW#S1.���*%��Ϟ�Нf0G#]�8�y���tJ�s��+t���U�AwE����
m�9�&�K���(,#8_ �R ������-��ܤƗ
^s� $���Yk���K�R�ʪ�RڠWdF�q8\�?�M��&��Vc��	����]-H)*.�)=�"���ee>+�,��x1И
�C1Z{{tj��Y(/����쬪�+�y�«
+���A�סa��ӿ
�24<����'I0��7Lp�2��kƨ��"�(���cI	�6GhX͓��0L).4z���AXx���՚�Lg�F
�&l#�\�H��jҊC��^&��Ճ�Ÿ�Ja}���"h?��8)�����,+���p�2{�
n����
��ٞ/R�TJ'���T��c�
+

�|��'���/O�J$�0�5Z�IT�_TuL �,�f�$���I��	B
+�0�0��,&���z�H&qhxÒa�eإ�2B�	Ђ�A�ͮ�
&Y�L�f���!a�\�rH(Phf��Fwf}�M�F#�a*H0�Hl1���%���E���~����Ѯȉ�U+]^�-Α**�@��I.����۷���������B��l6�9��y-F���nt�Nn�qs^i`�]�AC߼�?����͞�`�/�f.ju�
7����/��_q��[8��͢�u�~��W
]���o�9t��

�defffa&Q�xxzzxx��Zn��,��N�D2Y��ۣ����ı�g��=��;��DF�ʵk�F��}�k��yX��P���../nذ�\������ʫ�������۶������M����m�o{������n�]�s���}?�������������W_�_��3=}g:pz��7�n_�b��{���޹{g�����[
��{wޞ�O�b�eee�`[L�\�#p���;6z�Ν`��;9ʑ#?Y���g,��}�'��������;fv.��>|�ݻlE��������[p��>��g�������G`�u
+endstream
+endobj
+29 0 obj
+<</Type /XObject
+/Subtype /Image
+/Width 283
+/Height 283
+/ColorSpace /DeviceGray
+/BitsPerComponent 8
+/Filter /FlateDecode
+
+/Length 4564
+>>
+stream
+x�흍rc;n���/��%���#)�}+_%c�n�˳U[���@D��_C��PlЭŎQ
/u�anq�l�"�l�l���	,Y���-Y�7(/�������ɒ6xO��T#�r0���׵�
�E���ߞ�U����T�q�؆��PK�ӚD��p��@�D��}D�+��X}ꋣ���cţ�	旋k~�auN����!����
6`ʹ߿�"K�lӃ�E�	�F���>Kr�
_w�-���VA(�"�[�a0���!^袢��	�t�`e�i
+��sB��&&�`�
+ ;/�f�a�aZa�����d�HԲI4Lk��B�I�k��P�u���٧�*F�n��fD#�j	8L
�u�9�-ߘ��H\�2�����-Ȩ��g����U��E���ç��S#j�+�8��c'���#�O�����;*��n8�c~?-�"�����t���{?)p���v"I�c.��I
#z�6N쯇_�;�R�u
z)r`��S�؝�Atş�H~Y_���~����n�>�\�'8�4Ȫ�8x5��
�M�܃���n�[I�4��|f�*�]�_��A�9�܅g�;�Q�-�(��
+��6��Ty�x�"�Ý�,�Ӌa�C-�em��0+<��z�bi��8���E���+��܄>�QJeyfe������tV�$+Õ��bNsN66R}������e/l�騾��le�~����g�����{��Ծ:@UR�IJ���Y�=��̅[%@l��*�6x|�i�OD��M�m������Ӑ$8�uOm�
k��-X�A2�obGc�l��+L e�tƷ���6��/�<
�{�d���jT�g���o�&���/Ÿ!�4 g�/�
�k��kU
S�>�q�J�3���yNq�bU�ir�ا�?6ׁ�IV�2(-�Ò+O�~l�S�*��9��l~��0̓�ˆ:#�>5�2�k�&�|�b�0�C�����LL�V�{�b����W���L�Ӹk��|�Z�`�S��V^(!f6��t�&���e�n^��i�o�!��/��wb�t�
���L`���P����M	)�P�L�d-��ɬ#xTb��XVP��J�@��K��eO#@�7h��GP�B����4�m[D���Qx�*U��A
��=2��S�`�<%I�jJi{��!��+%!���s��4�
�����dѝ��<����|�iX����+5���1������4���Y��zV����Oc6���q�v>h�Y2-�n�zKO��j���L+�˺���~H2'l�,�������D[jV<M�5��@voKˊ���!�����x����y�~�l�z�xb�j�
k��)+��#s��MD��mY2���,Y���U�~<�-��dr���^gN,/��d��_���’�CgG�h.��d��n'v
+7�q�K&
���`�a���7�N��Q�c*����1�\��`)�T�J۩�~�R~�V(R��W)/S��RB�&ߦ�MM�JU�|��6%Q�������|��6%M"t(�#��)�"z��e�'u�A�/;����ea�otB]@���r ��.�����.B����a�2{d���y�L��iu9�+�����OX{����m��J3`�^c?a�C2��40���ɔ�2��z=��DY(�����o!5����X{���R��#&��]R�ZH��T~�����Ӑ�R2��Qb'`ɪ~(����/���$��	��!2
��y5v��/2��O�O80}�6�_n'aǻ�}Wy�LH؟��~]��O��	�M�����x]���$�o��Ք�[Mv:^9ę��vJ��w��I�l]���V1��p9��?�K�ivn�d'�-�J0:O�m�C2˰�r�>��4ϩl�"^h��W�������83�)v2�"�r�c��;��¸�����&v2w��F<��N0
X���2y�x~��|��T�
+��̀/����אMXfŽ���E��k�
���-�����z�|��5�2<�Tš i���[�hw�`��Ͱ��̉y����h{	g|�0�����T��Q��a>�d��G�$�8�Y8�*:9J=1�+f5�㑳�#��b��bxH*�u�quOgJ�����5��0��;��NN��Y��d	gD�������/��Sd��������#%)Hb��]��68r!RS����EI	�Qx���j@#;,��C�0�;x��VOx��E��-0�>�,�Hn���X�&�#�.��.����Hh@r���a���GB�+��Ѿ��Ԕ�ǞfLv�S?K����R�����v%��ޢ����:w��.�piQ6��[b̆�1Y��x�9qj�`jy�*����:!�Wn�l�	�&�2�7�P�j�>�W���9ߟ�����^.n����'��O󡛔��0��Y!�dBԒ�W�wJ����e�A3h31��I`�&%��=�gb�[��M��fr��Wo`i��tf���w�s���g�3��5`L�
+#%�J�H�?S*�^�~v許�6e�7�
+��;v^�;���i&�e�	g�;g�c�J��X�S��ש���ЕR�eY��P
�jj��˜���hH�l��x����lDOc�ǂ'ո��_N������4��̯`�X��@j�@K_a!
G���
N�d�&��-��/��@�2��HM��ܕ��~��[^BfL�z U���v̭n��B��.�!�J���b.5��$�A?&W����:~YWhҏ���E`c���u��(�]j�s`tu�y*���6�.5�a���Si�-�-,$���O��Ӽ���6w|�T_6P6	�n�0
���[v���0
���[f�D:�vb8�
r5{��xp�~>8�
r5[�D~�K6��j�L��k�DW�Ea���5��0MY2��x
K5����Ge
�d�%��P9
�n�'�h���q�r���|�Z�<N;*��.�{Ouh�����Z�z����X�GCٯGO�g=�y;H��!J���:|�i oY��ᵏ��}�L"��A؈��ε�5����B�ֳM�Xy�۟	]�,l=�8���T
��ĭ����FV�N�[,�����~��2.uB^2�'�}�i��F���A�|_{3�ax����۴��&������?����
+�z���=t�������dBD��@UoS�����0s14��j���d�14Զ�JW��d�tz�6bq4DkB��>��U5&����!n�P�XҪy��5l����;�����7�SOCF�|E��@���q�	,(��X���0~8>�4���xom7qW��������z2~�ӈ��3�~0n`&`�����z�ׯ����Ѐ��7ʐ�~:C�y
+�]��A����9
~����:�3���
���檅�����cf���Ǡ
r ���UJJI4�,�	O�@�@�󛫔�8;ދ�߯�羘bj@+?�4c��_��W{��bb��>�4�d�sL4�����N�-�bR�&Dz�П�crHi�w����_�M�W�����]�av��D�11P���T�`�?@(��c�z̍��
��ӑp�̭[?5��i��j¹Q��ՙS���Q���+}��d��1���.@�����a�ɿj�i�C�ǻ�yO#8���Z}�`'�3wԩ�7����A�
*�sKh��4�!�"�ȹ'��>ͻ�ܛ�MZysSh�>_��DW_{���d9��s��i����8�F��&�*��x�w��4dA'lT�N�@�Pq�<�Y��FJ`�w_��l��Y ��?4S�[n�s��亘�!	�S�@$N��7{}��bjB���u�☡�;�^M����m�F��a�l�@ê�뛩�	�H��G�����8Ȟ���4���ޭ�5���0;���O��m�Tɂ�^�����\������Gɢܬ����șI5��HYKJ5<���G�L2��DRz9��@�CuWU�#)�j��N(��R��3[Q��(�2�*o=FC�'��D�Tzl����,a����`W����ڶ���p#P��r�n�j6l<�p��6Zz��:s5����v��%����F
+�Ac������Bۻ��Au���z��ڤ� t8V�]��ldr[�1
@H^�53
+��,
�!*<̮�%����� �!K���B06�J��Y\B��pY'[�D����:*B�a����0�Gtn�2G@��*�\%#�~8^��
�������4$�������
+I��2�r�A�,�͐�D��<��7k�i���lR&�xrׂ�:�%BK�w+��O����t�P'���RW����HM�[G�6J�`�FNG[�5=E{tx�8��I+'��RQ����e�!n/
%J,�W�O�����I���	���GDBMX��׶�ɬ��?������4{J��� "���d���&�I�K��&}�|'�����߼󨉪+���u�Vf�i�LO��yo
+endstream
+endobj
+30 0 obj
+<</Length 768>>
+stream
+�GI�HI�EG�FI�gi駨�vy�T\�T^�[d�dl�dl�dl�lt�lt�t|�t|�|��t|�|�����.<�HW�IW�Zf�dn�S\�ku�ئ��1A�HW�Zl�dt�dt�Xf�l|�jv�z����섎Ⴭ�}���������������7M�<L�l|�t��t��|��r��|�茗�Ke�GZ�[u�hw�����Jd�d}�c}�l��t��Zt�l��t��{�ᗥ��\��c~����ف�訸�������i�踐�|���㷡�f駉՚�Z�X��f�ɵ�uK�������t�{�tL�����������uT�nS�}d�k�s��{�t���귪��gK�u[�~c�|d��k��t�|чv���������駙�fL�lT�lT�lT�u\�|d�s�vh�|�������������������dS�m\�td�td�|l��t�|l�t�|l�wi��|�t�|���閉ٟ��dT�XI�dT�dT�l\�WI�l\�l\�td�td�h[�|lፄ�������XJ�XJ�|t�|��|���쌄�������������������E:�\T�\T�d\�d\�d\�ld�d\�ld�ld�tl�ld�tl�|t�tl�|t�tl��|�|t�|����TT�TT�\\�\\�XX�dd�YX�dd�dd�ll�dd�ll�[Y�tt�ll�tt�ll�ih�||�tt�||�tt����||��||�xx���섄����ᄄ쌌���䌌������阗���ؐ������������������ṹ���
+endstream
+endobj
+31 0 obj
+<</Type /XObject
+/Subtype /Image
+/Name /im31
+/Filter /DCTDecode 
+/Width 236
+/Height 240
+/BitsPerComponent 8
+/ColorSpace /DeviceRGB
+/Length 7474
+>>
+stream
+����JFIF


``��ExifMM*��C
	
+
+

!(!0*21/*.-4;K@48G9-.BYBGNPTUT3?]c\RbKSTQ��C
''Q6.6QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ����
"

��







	
+���

}
!1AQa"q2���#B��R��$3br�	
+%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������










	
+���

w
!1AQaq"2�B����	#3R�br�
+$4�%�&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������
?��(��
+(��
+(��
+(��WW�����)
+v����(B�^�ZX@f����V���y���>�b�����J2�����pw�����.e����I�zP��4KBV�&�a�F���?�r��u���[گ���x�+���6�]��|�^�H�`�1T_W��9}F��ޙ���TP����������4h�������o�P���V#��;�?����֝��|Ih�f�4��lI��稠B��*j�[�g^�(��Euz_�_ߐ��%������2?<W�Q@K�4W�!�$Cё��-|�����(���Xy���^��|PS�
n�i���G����@�EU����m����9�n��#���5j�
+(��
+(��
+(��
+(��
+(��
+*9$H�i$`��,��:ה����^��~���*���w�{�>�
�x�Ƕ�B����qзT��������&�5�J�ony[���A�aU	�Z(��t}Q֮<�>٥#�60��=zV�����lڴ��N�RecS���
�Vw�yVv��I��Г�WW�|4�n��ϓf���6���R+�,�l`Z[�C���?J�@ye�O@
�q1�#P��ɭ������K�]%c�������ڎ4{o�I��7�|6��}
���
�\|<���œ�Ox�a���}���Fh�a*���z5
�z�ßX塊;��o��8?�k�����c���ȥO�k�j����P�W��\G��}Q�P��W�k���t�,�Su�%$��7Q���S�/���m}l�H:�B=�K��W���X��r7!'k�B;װxWƺ������0���=��k�i���V*��pE}5Ey��~ y̚n� �p�]��
�?��zH9���EQEQES�4gv
+�	$�y���>-�D�hz|��C����?�A���ې�x����O�r�z3�1�����E(��4���	|=�Q	{����<�#�$���ӭk���ݣյx����n�;?�`{��z���eck��%��	+�P`���j�(��(��(��(��(��(�:��e�Z5���M�r������Ex���w�,��D�����~!�;�q��\e}2�)V
��FA�y_�|m���0r�ۨɏԯ����<�b�'�60��}Z\�~X'c�=��������PӔW��8�oۣ]P�����1�X��O��Gҽ
+�
+(��
+(�.�a����w	J]���@���a�?g�|_]�GT^���=���d�I'$��jx�X�\�g�����?qGA�{�YTu�N�q��=sR�9��&������������ͅ���#u��.��`0�JZ(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+B
"���_��%��6,[1��(�3��=q��t���bX�h�9:8��y��3�oj�D	��-u����������;�d1�VS��^��E�.F�0���z�c�~]��k��F����ص��=xo����{��`�A�G9�P
^w�cZ�,a��|=��%��
�~$~��D�2Hs�|��P�"���cg+�����@b��k��l��t�8E�פ|&�D��3&D_��#���?���Mz�����0i�clk�7vcԟ��*(��(�������7�OK��~������vY�N�݁K��?Z��4�����Kv�jw��u�_�E��Dwک�
+3�@�#�k�GTQݎ�;�x{OțT��D�L׆^j7����i���9?��Z��G⭌`��a4�٥!�'��}�#k׷Фm�m"��ǒA#��p�cO����zy���})EP
EP
EP
EP
X�)�#��I��
.7B��\t?N����W����R�W1B�������xd�w�U)$lU��Q�U�	�����*�9�u�0�$+�	�NG<w�r�
�
u���um�l�Y�g�_�?��v��uc���v�7c�L��<ƽƀ0|m��/—ӡČ�Rcո�
'�
�T��}����N<�V�`~�ו��K0U�p�_B�oK]@���0\��y'�&�~���.Ṍ)x�:�##�k�x���a6�0S�c!��;�J��]�A�2@?�s��|9k��2\��1�?3�^&��9gb�z�9�i�
隇�w ����jw��?ƹ��x��!�v	��Z樠	g���C$�I+��v,O�QS�G��ƌ�{(�?�m�x;�:�:dȧ��X�q@4W�X�*�$�oo��wX�s�t�
4]��MxÓ����?�x��$��sZ�>�u].��.���{������M>�wX�>��@3KC3���U���Ժyƣj��1K��^I��B4��B����E}+E+:�[���Mޡo;4�?�ZѢ����z��ng�a�bmS��*��*�ɹll!�vi��P��K�F��]������f�2��>!�2&��E?����Ñ�F�#����$���|=fE<�nHP�?S�\���k�ȰӢ�viX���y�
��6��D���)�q��?�`�,�>�di�bI��2���0TR�z3�m�a�j0is�=A�~g��|+ԥ�^�An;����7h�Y��r�ur+��uM��N|蕏����X�2�m�7/qt��>�
���Y���i�1��F"�<�L�9=}�y'�{�7����@�����&�?��|i��s��?%��(���^	��vR����Q��E�'�ӯ�w���	�7/�;�8�x�QI3��6��eRO�[���C��,h�oݏןҽ�����Z��
+����U��;�M�2�����X���?�����߇l�2[It޳9?������g�XؠKK8`���U�(��(��(���_������dv�Eu8e ��GJ��j���y?�#U(V�Ě֣�u��:����C��$��}i*ŵ��ㅵ��v=�B��Pz+����/&�[���`��'�����9�j��f���(̩�E$ϲ(�F?ªI��{}���
�r�mr޳�o�`~��[YZZ [[h��F���
���-@��9�C�sa�?�����D탨jh��������W��@����ö`-�lu�������M��@��P@O.0?P*�QEQE
�>/�{��0�k�<l�<c������k�=��@DŽI�n?��ָ���L�������ڀ
+(��
+(�rj�tR4r��$�pU�PA��4
r�������B���/�������B���/���*�����A_����Hum0�F����@h��:W��?����!����T���ƀ<��:�u
R�Yм���|�	$\V�«����������U�FV��u�����ّ�]��h����i�1i�;�����"�8T$Q�(�
�U#�h���g����H5���l���_�
*+;�wG������_�mi<��ӟ�n��@���㮩g���h��щ j�y����4
�EP�X�'�b�P��F8UY��}��@Q@Q@Q@�&�.��"���P?�5�W�|_�٫�]��������5�
���ݥ��ܙ_�����?�<�~�В��u9�DׯP
EP
_=����W=~��~�����<e�#~��_
���(��(��(��(��(��(��(�
�q��+?��ξ���<!�#n��_)���:(��(��(����+�}��1�(%�fq�����W����ŊjzM݋��&L�8?����&��HdR�F�X������K�v����O�&���s���%{�5a�xb�bٖ5�e�ܣ�F�@Q@q��Ý'R�n/���O!��eېk���������T��T8dy@ ��h���W��������M�4O����������x�A'�Y����4���_������4
����qz�k���>�=�/O��_�&�S�]�b�������'�?�1e���h���[���{�����M/�*��{^�����k����@��ŗ��_��}��6���s����{�����v��=�����5��S���1�?��?Ɛ���㮳g�Es��n�zMz?����4����{������K<;�A�O��(���ÿ������0��W�d�'��~���A#�u����+����f���
+Q����Zg������ޟo1œ~�x������+t�����-9��������f���
+ʱ�y�X_�{o%В(i
#<t�����G�]�%���m,�*,��}�Z(��(�ח��0��wAq�F
+3�5@��@u�?��?ƀ6(���M��2A�j�;UY
$��k�
^)�7G:w��^�0c�a���k�gǺ�߇eH�76��r:��g��xMw����m��^`/��t���p�px�����u9ut4
���x7_Ohq��}�<G:��;�=?J�h����Z��v?�W�׀x��G-S���(
+�(��(��(��(��(��(��(�
��ۥ��:��|�����W�|�������f���In�v�!S�Nz~��@w�S[��i��b���C!���5�ԓJ�L��ŤrY��$�M0�2O���n�o�@o�\�d��z<�d�����h�C������{~𮆀
+(��<W�G��5�{n���%�:#�#��?J�k�sI�ִ��.� �XuV�W�j�mΑ�Mct�e��}v#؊����&�+��|$����Q�:�˽{ť�7��\��$�U�9���_���}�����n��=�����@�k��|
��W��܋�:f,�d����#�����J}q�9�u���²�������WiEq��9�ۯ���֤��e��K����֮Ҋ�G�O
�����f?�\��/
+�^��&��P��U����z�y��,d�������h�袊���sN��˨$�����y$�}+���k���q��s�f�;yq��תP�
+��_�����?�Z�k�x���]�
��µ������Ɠ��������5��@���t->��t�K�Pe��鑊ꨦ�R�@rI�q<V�I<�,qF�����k¼g�9<E�4�J�C����;���`V��k�t�=��co�A�-�z�;z������o�����?�.6�d0�F���:�U���]γ��ch��C��Qܟ`+ߴ]*�F�ᰵ�1�=X�'���Q@Q@r~9�x��Knu
���q�I�G���YE|�<2����G"1VV �������>Mv&��Q����Lc�}�}�rxe���6�T%YX`�:�(����H�4�FB�{#�L'����ׯC,sD��"�U���
|�]/��a�xvA>}�?4x�Oc��z+A�&�����@�B������h��(�:��?�W��l���E�:����,�W�f?���(��='���|������S�-�7�����6�R��(��++[���
+��}8BG�����(By����E�4���:�k��o�����c�v=N�7���u=�+7�^5��6� �
+�[б���\�-�]\GooI,�QFI'�[�5��Am$���2I=��e�?�c�!��d�d��{���{�Y�O����邽��\rvP}S�WSEQEQEQEW+��Zx�#<x��ae�;ǿQ�WUE|��w�E�Z_@b�}z0��F���4Kz��^Źz���?�5�~%�&����7�c�25��������s�Zγ[��J�*��}���@��yk�^�G��L	�t?�y�>��<Q�k*>�}���Nv��z��_2Ab+wM񆿦mX5)Z5�	N��8�(߫']������P��bb˱ʞFJ��/����t�'�9����K�Ocw��a��_��k��,'?����
+��_����i��/Är�@�����K���%��Bƀ6�
�g��f���X�g~��+�����&|�;�Ol�Q���kߊ�m�e��#�+�#��W��_�ZF���ױ���s��s^3�x���+6�$h��}8��5��]�1$��'��=����Ѡ�����}@�?�
uuqyp����J�,�ē��4
�*���^�7�kaK!�GE���xR�$K��kK��a������^���:5����b�u#��Ԟ��?��g��D����a�#��Q�{�?�uQ@Q@Q@Q@Q@Q@�����h��i|��ܞ|�>���y޳��\Ӊ{h���Q}�=���f�����he�CѼn:���5}!}�X�1콴�u���@H�{W1����Y0,֌����<Z������M���;	c#��*ʟᗈc?��,ޛe�0(�����{�t��o�fC�hO��'s�
+��*�@������R�Z�=Z\����>�
ޫ�(�̑@mRC��#�7��EE$��W�i�
4\��m�����.?�ue���,��� �=My���[�J��-�'��ˑ죟���4ml��nG���g�����OEQEQEQEQE��
+endstream
+endobj
+32 0 obj
+<</Type /Page
+/Parent 3 0 R
+/MediaBox [0 0 595 842]
+/Resources 33 0 R
+/Contents 34 0 R
+/Group << /S /Transparency /CS /DeviceRGB >>
+>>
+endobj
+33 0 obj
+<< /Font<</F3 8 0 R/F2 6 0 R/F4 10 0 R/F5 12 0 R/F6 14 0 R/F8 18 0 R>>
+/XObject<</im35 35 0 R /im31 31 0 R /im36 36 0 R /im38 38 0 R /im31 31 0 R /im36 36 0 R /im40 40 0 R >>
+/ProcSet[/PDF/Text/ImageC]
+>>
+endobj
+34 0 obj
+<<
+/Length 2911 /Filter/FlateDecode
+>>
+stream
+xڥZ�r�}6��]~�R`k�Eo��bYNd�Uv*�C� &���4��~"�s�g
�8�J$0hL�{�kϛۋo�m1��?��}f�.���f����7�����ۍ����>�K�/c�2)jɲ�nX��l#�&ݦѤe��6_ˊݽ�������_�>Dݷ����w�z��/Ǐe���_'+�^2Q�}U>��L���������Z�j�cB�Ҥ�d��X$�nu
U����o�P�n9V��Y���2�E���fb-�z�����E#�Td�b�5+ʆ��4{b��ŽL���Z�wL��л݀�ǥ`�:�/����GP�`�_�P�_�t�ˢa�^�EOQU)�j�fW����fp:o�"Iɰ5E������=��k88�!�56y�DV�l���ߜ�Bȉ��޲$���xҴ
N�f[V���Q�U��E�^`�%����V��qC�QhP�Y��'կj�ɵ	�_�� V��W����M�^���w%��[-�^k
�(��Egt:
��gN_O��1��v��a� �9��[z�-gY��bs�ٷ�Eҡ�â��6�#D����gVt:ّ#���\�x<�h���l��;y��}Y5��X�'��#���������I�w"�}6w��\�h���V��˩L�)����ϐ��ml�~���m�KU�p�1J��?|�y�O�p�	Z1��}��� $���Q߷G.����ػ��y�<i��{������ջ��+&�
��4�A����=s,��l�*!l��]A�M&T"�Wne&7e��E't�޴uZȺf�#$��J�-pC���(����XD�?R�<r2Y���p���|>�H�a�m�m�,ӻ��,�� �{�ѩ)-F�^Aȷb;���k�PdY��8�SÔJ�*x��T8�$���d�R�QeC�m%72}���)]���A �#�L��(k�����?�qw1�7�Ve>��*	=��KB|�45�ڨ�l�	e�E��CX"6��/��
+�XβB-��HAڎ�S�
�D֛*]k�~���%�{�f0�۲t�&9mP��Yp?�x�&�ߖ�>K6dW}}E��m���C\}68�:�����D�-hPE�]$����,�?ra8c��
*�J��A݉�r[��x�h��3~r7��k�@�1M�Ճbr�D�g�wl�p�QUYnd�R(�~ܥp�T	���k��o$�a��e|��m����Zւ��m.Y�R��'��Z*�$U@���q�;A̧�_�u�f�
+Ɉ��3i7����wA)��R��l3b���sPY$$�CZ��cVv�Vg�TXX&�C���L�'�SC���A��{��=)Y��c�>F�
ps�`W�S@��=�����w��r.�H����sS�*�
�8�1�oTv�B�DEۂ	]�	4�	�x��y�c��ͼ(�e,
ԈA���ΥRo9������u-�'E���݌ }O�6���9��m������ש��^˙�ƣ�!�.h�p/e)�
+�[����5�
~,�m�Du�4
�*�������@8����ݽx�ݒYP���j	�h����k�ݏi��m;�\���1�.��fr�r�m,�{�-�ő��=Rd}�
+Y���Og
+�%ٱŭ�l9*��Ω��{���m�
�vv��
+)�"�ʡe��q�H�)��}�Hp����7�L��Ē�|��3#�x�X���_�w���������0�{1{�%�4"��D�R!��k��)��q����OK,�ZC[z�?�P�ퟪ�~װ��#v:�@�ΘZC�2��	�_�J4.���+���9
�~Tcw�����(�C�˃a��!�j��q��m�݆����[nMP����M�#Nj����=�Opv����Z���7b�C/�������������n�A�"_)�h��b�[���"��B4⮏\C�	�.�՞u8*;�O�_פf��
�wHˇu�������E�p ����6��,o�6�Ĩ��w��U=��s�v�#��^�#�4E��@PĻ���X���TT�yI`W&g��c�uE�b�z1q�w`����L�ò,�y1-�c�γ�klʁC�T(��nV���hu�n��i�K�F��֟n�!��JAJg�)~ ?�%Jι2�M
�p��
+�W��D���ub��v���s��Wn{�b�|�w� "
��
+?u*Lm�U����~����]�����M��h1��07��ǁ��C��,�AO�P�x>��Q�����S��?�4�q�	|ȻhS�kgM��74H�/k��	5��1ѺΒ�;g
+��5�����oN2��\�^*��?=���Y�C��7�:3)7-	�
X���聊>����m�
+�i�f�t��=�X��k��\�y�Og3�S(�߹cu�'�Xdԗ(7��Ï��6%z?Z0o���q8uWaxR�IT�㍬X0㩡@~��ׅ�3v�݊��G�o�'�-���O`R
��,��)�*lx4�Wvғ�DQ��w�.�
�%���I��8��B4P�#7���I���M[��:?��Y�3�!
+�0^@��ܚ�o�;�:LД�M3�\��^rfLl������KQ%�۪A��D�3��Q��$��2aGCgz���u�[�h��X�]�
+��ZvS^��@M!�H.EV�<�(��-�l�❬������,/�/�&J�gr����x�pC
+W�4�'�9�F �Uȋ����}��h�'������]�����LJGW�O��ux�e��e����5=�М-u�w��o�s�|���Ef������K�@p��I%!����Թ��M�`�,��>�o�G��I�~j����G}.��wu��9sN�BŃ�͑`�Y�H��I�����Nj�>�����܇mm
+endstream
+endobj
+35 0 obj
+<</Type /XObject
+/Subtype /Image
+/Name /im35
+/Filter /DCTDecode 
+/Width 500
+/Height 500
+/BitsPerComponent 8
+/ColorSpace /DeviceRGB
+/Length 23235
+>>
+stream
+����JFIF


��Ducky
d��C
	
+
+

!(!0*21/*.-4;K@48G9-.BYBGNPTUT3?]c\RbKSTQ��C
''Q6.6QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ��
�
�
"

��







	
+���

}
!1AQa"q2���#B��R��$3br�	
+%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������










	
+���

w
!1AQaq"2�B����	#3R�br�
+$4�%�&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������
?��(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+)	N�k��=�U�Į?���}?ZM��p�:��W6h����r,��}f��?ư��O���5�Ƨ�b�1�sY��G�O+�?���9���4���?Z̸�>�o�����<���yL�I+�����c�M��g��� �97��3ѧ�֕Dq\�}�
���/���Zi>�.?LW
EK�#�9fn��:�����Wgn��?�T
�\�"�_�7�\�>�]�V��:F�ǃ�#��ү�����v���׮j�9�ܯ���Du�Yz�h�To�*�'��
��?�b?Ƹ�(���K����Gu����5��e��z�q"\E��?C^oER�#)e�w�����h�٨D����O�Ҋh�]�J�/�0"�N��D��vF���*Ϫ9��C�K�=���{_�V�	|���5�g����������s��EZ,⩕׏�fw�V���k�pm���o������I<n���)�5�i�pT�:n�VES3
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+*����iQ+��yf�+���m{u�;�,_������~u���]Z��i��u
R�M�}��E�)9c�k�ԼzyM6���o��k��G�F�Ggv9,�$�4��U�����t�����o�}CQbnw8Q�*�V-����Z*�(��I�+R�Ú��V���l�)��H�^N�U�Z�
+��n��z .�k�xL�y��d(�Z�JL�c��ڿ��TW���gE���>&#�ze��kBKX1��E?��*�E�g,�x/�-�_3�#����U����դ��w��~1��������'�'�/�u�8t�����-��=����z)����W�W��g�7�u��K��D���tۣ��d�*��){5���x��Wp����?��"��o�'����_m����t�3X����z+��|/�\gu�!������d]x
+��mo&��8?�C�$t�5�/����+���F�L+��F�ߑ������m�V���R3���qks��zU~	&W���v2o����a����U�4iIY�n���p�Х�we��?A]V��]+Rڱ\�?��_����+�(�cVH��e�jk������+�4��fԎ6�,�����~�i0ӯ��p~�9���?F�V�=|��V����9�-hy�EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
E�����GS��X�%?wݏjM��4�Nue�vk]]AgOs*��f5�k~7�]�ijbN�f1���sZ��y��y�r���A¯�U*�V�G�a��S����
��$�4��;��f9$�i�S�I�X⍤v�*���V'��C(�'��i>���&�'٣�����ֻ-7C�t�>�l���|��+Xғ��k�Tiiy�]O=Ӽ)��Ἇ���o����WOa�[pדIr��"�����Q[*QG�W2�Sge�U�Ӭ�W��C���zժ(�v8���
+(��Q@Q@Q@Q@Q@Q@5�$B���z��E`��/r�	���<˥r���u+]�j�w�+�G��+9S�;h�����y�',RA!�h�7^��~��K�6�Q�˼�IGbG#�z��o�itɼ��ɐ���8�eI��b�gJ���_�q�T��Z�a���z����=D���?��$��_2������w�/��5m���.O��s��{ו�	#�ZF��ʼn�ү�Ϲ��W�h^2���������ƻ�;�k�u��e�6����Զ>w���~�ӹ=QVr�Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@!!A$�$�d��m�<�h2���8�/�f�Y��KEf���}��'5ua���J�۫5<I�,o��_ٮ���?��q��Y�f'$����䔜���P�„y`����i�z�Ȃ�##w=�z�ڽA𥞖i���뽇ʇ����8A�����^����h���6�u�[s��>v÷����i�E���H�>g<�}M^����1ʸ���v
+(���
+(��
+(��
+(��
+����;J��
+�ȍyc��bx��?`-c`����D~���W�I#�#I#���c�Mc:���-uW=M�z��诮?�k[L����K{�%?��A��_¼��H ��+5Z]N��TZ�n���W	�o��X�rnC��;Wُ��wu�)+���a燗,Š(�9Š(��(��(��(��(�
+z��e���^@��ї�{W	�x6��t�%����Σ������訔�:��ʸw�;!Ҋ�{��z��Ž�_1G
�����^u��w�UϑwS�,9V��,��}O��}�uwK�o4��:�R����=�TT'c�QR\�WG��#��c�1�4,z��Q[U�Q��ȲF쎧*�pA�@�ϋR�e���.:$�Oc�k�o�>{�:~�-Wn�[EVǐQEQEQEQEQEQEQEQEQE
��V�qq �$,h������.$ă%�y�������ڡ�����*�sQGn	,L�%��^!�֧�3��?_s����+�����4�ƔT ���<=ờfA#f@~i彗֯�_���Y-z�}��?�zq�Q�q��(ª�+Zt��<�nb�������>�M�[{H�h:���'��TQ][=)9;�Š(�AEP
EP
EP
X>,�?�4����\���;���[sJ�����Q��
+�-kR�V��|�c�S�*:
+ʤ�Q���_oR��Y����NI=M[Ҵ�V�-m��nK�;�T���'�
'KS"��l<���_����f{��J�S���Ai���I�����
��x%�Jg,�&9��d�C]���ūX��c��\���G�A �^á�C�2�\���_�*���t���w,N��.��>��+iT*�P����Όv2�EEj-Q[XQEQEQEQEQEQEU{�+mB٭�YcnDZ���P4�]��>"�ƒZx7Og��|�����=^�@`A���o�Cf��*<�W����?*�+k���J^�m����QE����|XSe��&W��;���5�W�We��;4�FO�}ئc�}���o��N�Fxx����Iz��;�(��(��(��(��(��(��(��(��)��1<��H�f=��x���Gͬg�a�-A�{TNJ*�N
,D�V�J^'���חd���������x�*(�6�wg�ҧQP��v�ڂj�~�9�>����N��C�_me�/��O��a����?�z
+ڝ;��#0��ޕ'�V``p(���<��(��(��(��(��(�����}>;�\�; ���y�j����G]��6cV����8�y?�eWIsH��cEG�՛~ӿ�u�C�b����t�+�+��}e��s^2�Ӿ����|�U�WE(�'��V����
+(��<ࢊ(��(��(��(��(��(��(��(��(��(��W�V�=���nz�c�'���u�̬�U�������o�auk�%vYQ�5�Jw��0�*�N��)YJ�VpA�I\��׃|J_f�|�n��ǯ�'�~U�׈A��ץxC�?�v�d�q�ȇS�-���]4�_�g���}Mi��Ζ�(��(��(��(��(��(��(��5�^=M{��J�,H���Rn��BS��wf'����Bt�W��ް�=���}kϩ��%��4�^Gb�ǹ4�✹�ϯ��㇧ʷ���O��w�L����������v��ͫ�	k��{���+H,-#��M��0�>�t�ͫ93g��$>'��,h��`(S���ϙ
+(��
+(��
+(��
+(��
+(��
+����v�up�j�x��V�p�o��������_�Q7h�ua){ZяC��Hd�+S�6�m��DeC�o���+�+�[Rjr}Pҭ��mjq�~��\պ(����2��r}B�(�AEP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP!�
}�Q���!y�5����������|�mR�1� ����{�=Zi�]�ڍG��_�q�-��֗1�@�%��V�{�&��]еh��9.S �dO��V�y/�5�ѵ%������=~��b)X�X�28�:k������/��i��uQZ!EP
EP
EP
EP]���*��'��>%�X��PH��+
+�z�Mu><�>�l�d
�&�#�z~?�{ן�5i��}W�叶��`�F�,�jY��
Ԛmv��7�k��e`�o���Q�3��b+ƅ76t>�SFӄl
��
+_O���(�Ԭ����RU$�-�QE�
+(��
+(��
+(��
+(��
+(��
+�/�hk�W��O�G�g�J���~�u88}�S����y�+�랳��QK����V��.��V�5�����Z�Ӽi�o��a�v��:�~���vfU90�w��h���>X(��(��(��(��(��(��(��(��(��(��(��(��)��"2:�V*FA�(�<S�����6�������V{��C�i�ZN8a�un�W��Y�ay-��#lq\�!���~�����A]π���t�ۑ���N��:�Ky䶸�xX���e#��+�Չ���pg��T�}F=WL��<
���a�U��N���.-�(�HQEQET�QYY�u1�q)c�=quO�Z\M�$��(���L�ʮta���T?�~�y.�}5��/+d�z�qU袸O�IEY�&��Eh�
+~i
+����׮Cv�1(H�B���V�t���(M*�������񮆺�G�\�����r��QE��Q@Q@Q@Q@Q@Q@G�[�-t�>�8��f��<I{��z�`r��'�x���k.���&ϰ���Tcȍ$��2�@�׳�ۭ����bEA�W�xN��~#�R2�����G��zڊѳ���^Q�mB�(��(��(��(��(��(��(��(��(��(��(��(��(��(��+��Ƌ��/�3ۏ��O��_κ�B
�jeefmB���N=��|S�djΈ�����w��V5q5gf}�:��8�Χ�����#c+b�=�����F�Fdut%YNA�z
WH���m��:���]e��5���V]w4h����(��(��g���[�N#�K��㚅�������r����8��������쑰�
��t���ם�5i]��,��,W��
+�������)�so$�=��O�
aת�OK��ѣW\O7�$�������#���4��荪(���
+(��
+(��
+(��
+(��
+(��
+(��
+�����K��p�O���5�\W�K����)����A����Dݢ�ӄ��kF'EW�'i���3^^��TD��'�
+���V�f��Ff2�ǁ�
[��MZ(�uOi���}�EU�aEP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP/����M@���y�=��?�yU{}yg�����nM��g��{g����s֏�=ܧ��:�<
�y��7�p7'����W'R�O%��WIS�+�Ws��RU��>��QP���yg
�_rT?����i�fQE
+(�z���~�sw�c������7b�&���m��������p�)>���Š�I$䞤�\
���JpT࠺����cu�1~�O����
+�z�<
a�iR^���������WW]T�h�5�V���[-?�(����(��(��(��(��(��(����7�o�Ԁ����/�'�J֯�􋫼�C�����H�$��ɮz�d{�E-eQ�:(�i�$w`�{�mmxB��~#�eb&S�
���J�ǵV~�o�=F�������A�%Wy�M�VQE
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+�|o�}�Ci�f[S���~\��R:��#�U�=�)+�Ѩ�TS]���M�����9��?�*�p=������z���?K�ɏ�n�_�[��κ���^���0�8I������5�I�'��T��v��P��+S�
+�!^yZd��4�����~U�ך�������~[x��'����Y�v�ߗS��/-Nj�m4���U��ks���k��FV���ȕݏ��?g7��el�vPZ��b@���OE�|Sm����(QEQEQEQH̪���ROJʹ�.�lJɨDO�y�4�Kr�Ns�*���1Љ��a�bo�+=WO�8���V��o���II=�r�V
+�_"�QTbq��|�;k<��F����+�������7�'�_ï�Ů*��>�K�P����]�Û_�����%?���k��S�m��<9o���2��������s:��-�Cr�(���Š(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(����}o|��Wc}GO����ר����^����D�����חW%UiS��砓��h�IP�у�E{=���Y�r�vTW��x�zw�����М�џ�?CUE�c�7�zq�g��
Q]'�x�s��b��9+���z֣?�tۛ��ˉ�~�f�뽑�d���肻��6�-��Jħ�?Ҹz�[����34�������#�3�.��ߩ�EWY��EP
EP
E�ʊY�*��I����{���s5��7#�s�!�=ϰ�O������Rߣ�8/�=�F��W�Os�]s���̽��������w�8Q�*�����n.�ڞ�3���b��=yΖz#�� ���W��x_F�P�J��o��ϊ��ú5�}>��v�b��,�oJ��v8����^3][t��οC��J�&�-N�6�o*�FYO�]��9�p'���,�3Ii!±���<wS�m-�J�q�;��
S���%V��ֿ2&b�Y�I9$������G�O<p�/#Rq^�Kƒ�@1^a��O�x��#+e?�OԊ�:颴l��ޥ�v
+�y�����E�5fc�)��T�$��.�F�&�xR6+g�k�����ⴜ�QÄ��;-������,m�|���������Swր{��U�Ա[\L��A$��J� W3�&}ph-c������pv��D�?�5�iz柫/�,��Lm���+�i�H�ȲD쎧*�pA��[�V���{�3�h�Wž(��"���t����zꫦ2RWG�V�:3��EUKP�l4����F{.r���+�����i��i7�?ƦSQ�飅�[���oH�A�\�+�{U�'���?��j�B��u�2�.�����>��V^�_c�YD�n�뷷ֶ���HSՏ_��\���ؑ�XZ1�r����6���Q�3]J�J����n�~
+�/#ܺ�#t2���o��u%-"klD��}�k��Yf$z�����.���"wx�V����_x
+x�/gx�8q�n~�&��cxeh�B�!�����Ϊt�x���&{��ZjV�{I�D}�V��4�N�J�[�W��OG��WH��լ����z�w��Nc��`��-b^��+C�
+(��
++��<_��Ţ���q��?(>���j^(յC\#?���~}O�Yʬbw���V��^g���V6_��wGќ�u��񆆯��l�ఉ�?J��I$��z�Ed�>����^��=�c��'��á��t-v�G�]>�	.%��7�g<�7�x�Q�Y��0�zE�ǹ�Z:�#φ]R�IEi�sѮ��*ȑq}
+�꡷0�MQ_hE����&��.��u���(���&{-��e~��.���+r>���U�qK$��HѺ��S�+Ѽ�'�c{K�
�K�0�z��G��!W�Fpb��B<�wGEq
+�[�������ich�x�a�����m�&�M�ټIz�`3��!��J��3l�v���2k��sq�/mOp�Ã��qU��'đ&p%FO�?ұ��$z��s�伿#Ө���>D��|�O�o<�?���*�G��.�4�$�?	�
+�����r�ڃ}�W����G��)
+��5�����:���{P�T��8�����QEtQEQEW���Ć�FӬ��$p�O��k����ϋ���#��My�s՟�G���������(���/�6��� "�/�V����=��#N.r�~�н+�_'�2�����>�ν64H�X�P���S��QV>K��"|�۠QEg1���4K�r2�'�Ñ^E^ɪܭ��ur��q1���׍�5m��C�$�K�QX��|9��o/�"S�����z�����<9j�J����b�����Q��ڞҼ����x���h/6$�o(}:�ӏƼƻ?��uexTg�ԁ�+��z��=����>���җW���BD*�I1�h���+�`�+hV#X�Q��0y���=rH۬���PA�Y�F�h��s��g'[���>;ң�����w
�8��Z�;���%|d�� ��C^cX�V����]J
+��E#�*Kt!��PEz�SH���0�va�� �B�)]�<���?�"�����kMJ��Tͽc\����s&d#+����pگ��+��lE�G��.�_�������K�ܴ�6�MCJU[��
�R����ݝ˻c�$�J(��D)QGTE,�p$�Wo�M��p�� �o�?�Ǚ��^4)����"�#[��Y/Xdg�����'����QQVG�U�:�s��+�����jq.�.\w�?�?*�+'�P��7|�}����'?Ҧj�f�:��x����M[��Η�"���r@zٿ�MaQ\i��YV�j��[3���_CB��f̛v9�L�5�]��\����N/��eHbye`���1��6���uG{{fhl�`p�}»�r�K����&>�q�W�.����H��w���?>��W-��e��ԛW]�2�b��]>魧����v�3���z�=�ԕ�QEp94&�t�jڄbH����G�����WM�_
+%�%��i�)���/�N·�+�#��f�����g��x7W���+��$Bđ�3�W=^�^?����z`G�61ӭ*�Q��������
+�����%����}�Zȫ���������B�wG�Y'NI�g�ל�A�f��q$#?PH�X�F�#�<\XL�ԟȏ�]UW�|�[+b�s����k��~�A���Y�-��U�2g[?C\�F}=H�Aǹ�TQEw�q��ŭ�y����
�5��k�!��O^�\��?�\Uq����yr�??̽�'���)�n?�Яa�&���-�����׬ִvg����EyQ[�8QEU{���,f���"R���~=*�p�u3�26��l���G���g.Us�Aת����������s$����?
U袸O�IEY�.'HbB�H�UGrk�4=.=#L��0X|�0�&=Mr~�|ɤ�%_�<�Y������y]4ces�LO<��v[��Q[�8QE
���������@�dr\W�WS���֣�+o��f���k��:��>�.�����P�-�k���O�+�RqQ���m>��(X��
+e?��"�*��Uj�Μ���k)"(P=�>�+����>����Rջq���k���nZ����3�����\uW�Ϭ��͇��Է�^�����.t��;����{r$����dpH�
x�zG�5/���F̖��Oˑ�Uі�93j�UWC���K�9�d���C�����S���Z�&��؎�{W��=GJ���-�˷��GЎkZ��<�3�ͩ+�x�z�������U+$�ee=��~�T�~Ѭ�Y��E9R�[�8���t�]ٮ;DT �9��h�3��T��9"'�����*����7A���kn�K�X���ǜ���u��|D��/����o���֜Ҍ[�9խZ0��K_��袊�>���iϪ�١ 9˷�Tu5����1(X�B���W%��N���]~i��?쎿��U�W](�\��ο��ȶ��QEjy�T5���g��i�:j�dx�_'�W���� ZRٚ�W��'��+��S�>O�M��'>\������_\Ù1{{~�jߑ���}]������#ˉ���*��x�~�=��"B��=��qVk����l��NF�C��=����U9r����j���M,��$ұi$b�Ori�Q\'إ`����n���{�����X^��Y��6[��J����kՑ8�4P����(_Vy�/�{(n�EWI�v��
3F��l����$�ry5�|F�p,�
!������+;���et�(���V�� 3���@�����A?Ҳ+��&�%�>�r�ZE�
+��{�����SN7�Ӎ��Q�}tGc\��DΏm'�g����
+�k������q�N������>o툇���QEq^{dM�~>e�*-=�i֬:�������VmG�o�����G��]��o�����G��\U>&}f��?�Sk�˻�C8��תוx=�������Ԋ�Zޏ�y���Š(��$(��k��;�*��{
+��N�
J����������]�O\�8iq�z���+�j�T�(�hʣ�
+tQ�ҤQ���G�=)����]x�$a��S'��~�?�cwc֭S�Ss}D�,�NӠ���@$w=��sV����>.Rrm��EP �bK�9$��?��~���"�K�n?�O�I�+�N��S̵K�}����k!a���U�����X�E$���嗗aqzÙ�b���J�K0U�p�^ŤY
?J��c@����mE]���Z���_йEWQ�fW��N���B�.��'�y�z~5�����&ӿ�5��U�N|���?�r?
+����V��?S&�<9��'X�����Q�����e�X'gsڜ��-�����<�)k��F���[�ٚ��>��'�~��t]�ύ�Iқ��QE3 ��/>߭]܃�y_�G��7�W�`Ю�
�b�O�ב�=g�=ܢ��S���y�H���*�RzS+��5���噆R�|���A�?�awcحQR������%����ؐ.}}MX���>-�'vQE
+�� \yzp�̳
�`	�x�����%י��Z��Q�?V?��Y�v�;��s�#��QE�}a��:�����p�مzy�Ô'Q�~� ?3�֯@��_	�ٟ���y�5�=j���[l���5�+����.N$�yI�?�l�¼�����E%U�*+;� ,�p�i+�������%\�np����a��c�;�zʍ77���9����G
�o�V�c���Z�Q]�YY9��r��(��d:��m�B�F1MvH�8�b;��G�o|��6z�����נQQ*q��룍�F<�zޓ��:�E�rn�^F�����t�QT���5kN�書W9������tu�x��E����J4���:(��O�=�J��M��pO�QF�� �?���������O�g�q=�㪸�Џ�.�������L}�u���
+�+���Ϩ˝����f���g�,N@��9�W�W��yZ݋��~��{kGfy����_�QE��Q@g�i�kel�vr>�
������&�^�.�6?�\�q�w�>�/�.!]�ëm�Wwdr���?�7�\
z��a�|3k�/�����)�W��i>Z�����QEu�0QE�|D��5������<���t̨����2I�+ǵ��j�g8��Q裁�V5�h��2�<����)QE�}1����k��޷����z�r�Ӿˤ5ۮ$�l��tp?������Q�O��k{Z�-��EV�����K�^�/c�������u�먦�,��n����K�XօWF���x�{Z��L�g�?u�>�y�Q����q��T����n��~%f�w�oǧ�νJ�EX�S�A��4ۡ}��]�kc�q��릋�ǃ�Ҵ�QuеEV�qov�kb��&VÁ���\%l�����!�`r�)~���sX��Q�L��/eB1���^��+�h�r�r���#��:�ieH�e݂��M{=��ZY�l�v$?
��+[�Y�^Zj���QE�|�QEW�k��o�.�Aʴ�)�dp?A^��[����pؑ�ˏ������%�z�d{�E/���
+(���t��C�/���dA���Ұ<lm�7�34���
+۞d���yN#�K��5�h��1����5�ߡ��A�<�F+l����?�l~u�T��O{{5ԟ~W.}�ڠ�I>gs�0���(ð�y�H�R��@�OJ�
OM/K��0J/�G�1�:�|���Vk�\�l23��O�*�zތt������.��Q[�0QEQEQEW1�
����u�j������m��ޟ?���������QEq^{>��4�U�A�
+*XS˅��@����wm�����(�s����޽c�p}��w�J�����+�떲����ez-vc�s� �~���]NC������62�&��)�{��>�%�hQE�x
EP�x��x���1(�su���
+��'�B�~��W5\S���?�C�+��٠i�Ϻ�A� �^�������� ��?�iGvpf�Ï��EWI��EP9�}K�:)�]~���G�~5�u��S�SZ�ѷA������ұ�����}f������­i�O��0Y���`3�;��f��s��L�ͩȼ��E�O�?�~u0�3��*����ק���A
+C�H�*�@:S�+�z���[\f;"S��k���{j��?
�uJ�����51)��G��\��u��-��}�7����󮆭5%trU�*Sp��(��fg�O

����)�������{���B��&"����W��-ei\�l��=W�+��s�xxDO0J����ךWq��S���a���)Rv�y�9������U�.ņ�svq����=�犵\��+�+L��O�;�a��������N����{Z��sϙ�1f9$�J(�썯Z��Ė���d��##��z�y�ø�j�2c;`�~�?½��t���w�n�(����Š*��}��My'H� x��A�.MEn�'����E���H��x���u�ԗ�sq$��$b�}�G\2�3��Xz*�5�*Kh��+x�^F�RqQ�W�0��M"���a}�����Es;z��77����KkX���� E�
��|y�}�F[TlIr��#���]=yo����҅l�o���:��������}/m]7�S
+�*ޓfo�KkN�H};���5����r}J����4.$������1[T�v�ޕ����7Rno�QE�Š(��(��(����|�������޼�����"#��$���:��=�7�'��)SY���A3�E_��5��ȼ��'�6V���r-Y��%�.���(��ω#��n-���P��x���R�n0�J��+�k�<[i�OݨY�_�'��aYh��e-9C��=zO�n|��O0Jˏc��5���|<���+�Bx�=���b*ʓ��C1�χ~Z��EWa�EP�؋�;�8dh����k��T�~�o�	���S���f���*�H����=�^�๼�ڌ��Y��q�^[]���AG�4�l|���0�_����7:]��(���¹�j�M�Z� �㪯s�?ۻ����K��	c,My.��˫�R]��?*/�Tt�Y��_���9��Q\�Ԗ,,忾�����G���+�,�b������P��޹o
��E�j��$�m����?��]�uR��ϙ��>ҧ����8o���g��������<g}�����_�z�k�=���V���3{�S�>%��(do�	�`W�דxUKx�������ڏ�y9�J�~_�QEly#d*"r�p��x�z�������_8y�O�q��
+���H��
BR��Åv�
������U�W����hFv\5Ö����i+���棇k�����Ɨ�l��R"Q��&�.��,���?���F�W��]سRkJ�K~QJ�G�A�QEsBu��ƫu������kЫ�<)|� ��F��6>ǧ��z����sX8��(�O,+�|q����afs�џ������"M6ݬ�_7�?�=����y�Z�?��s,�;�i�O�
+(���x��	nn#�/$�Tw5�.���Eh�%F]��1�k��F�mb��bi��
+��S�����U(Y]�7�b����v_�C[�f�qw�H�Ov<ּ��f,NI9$�e�R<lm��$������k������e�}�w�� �������KtFV�>���5r������[�>i�8>Ï�T��k������C���+��@��(��(��(��(�*���n�<!?
�s^��K1�k���77������³�#��!y�}���C]�`�|I��Ln��������~��[ے:�~9'�
+ƚ����ɇ����;�(��O�
+�>"�qi~��'?��٫����h�6�e��O��#�?��ţ�	W�V��"��=���kk������?�5J��N���*I��=�@ �▰����A�3fX?t��C�b�k�;��V��7�(��faּ��:3i�l_�Y�h�a꿇��z�T���}R��nW(܂:��ED�̎�)��]��<n������;�����õ]ִ[���:�����}�6��i�WF�n�L�]+��*���aԅ,��G�V�a��d�i۲F�?���/���ұ�K*��}}
�x��[�+*�V sϩ=�cQEf�n��)Ӎ8��Yl�cD}gP
��eo_�G���-
+�Z����O�&#���^��i��e�Zڦ�^��S�ZS�ͫ�����F<�~���*"�Ut�E�|Ƀ�=<�h2\�
�T�u�	��˫��י���ϥܵղe!����'����z��H�2�J_��ȃ����եp�x.{�R�k���
 �pkn��z͚^j�U����ji�QVgF;<D���T�M,pD���j2��
+��֮Ɂ���9�u�������.�E!z(����4���$_�^���|E�<F�v�**kKY�nR��3$�pW3nN�N��E�M�VԢ�� 1˷�W��^�(��!�B��P;
Ҳ�9�Ţ�l�{�9�A��{
+׮�p�Z�5��}bv�ŽgǷ�f�ź�����G'�~u���x���:�S��@��#����f��;����^΂��(���b=O�SK&�W�2�/�9��Lb�쎊��B<�����<nm���R��0���Ǹ=~�����er����C����I��*�i�#i���?�6Ѷ�t�O.��o<�b� 1g�6\A���E[�&sC-�����$�,�$���r��$�mI���G��W[��ۦ�|��S��a����o�R�k��+%樅c���ރں�sV�D�~���9	c���8��N���r~†���#J�꺕��d�7�\���Wq�R@D0��ﴱ���\���ޡ7�w;����AڪU�C��UQ��]��۩oo%���IX��CE�}
+I+ �]����t(���#��S^E]~2�"�H�(/����+ZrQwg�����F1�s���Mi�������jq��{V���G�i��D�VAʞ�A���-��4��H�,�Ԛ��#'�a'�;���?�i
+�R<�f
+z
+K���E��Q@Q@Q@^'����%Sb�[��^K]��[ͶֶJyv27�p?�����J����]>Z��W�����I��F���?�y��;Q�c�s^�al,�-�H�T��S����mR����,QE�|�QE
�>,ӿ��ٕWM���0z��汫��o���G�Lk��r���_¼Ҹ�G�G��k�j)�֌�|�g�\�6�o�?��zux�J�_
+����J3�n"�%�=���5�}���p����f�Q]�QECuk�
�K,M�XW�x�4�\����)�F�λ�*e-Ί������5+6"��d���1�R�o��t<�N9ĭ�C�<v�I�oXk)���m��g�괏��]RQ����m��wUF�[�V�*�Z>��Go6��0F�ƣ
+�0IE��7}XQE)�F���Ȋ���2�Q@^��d��m.Qy�d<~�:�n�Z̑5���U�?1^�Ee*Q{�ε5ijx�++a���"�Lq2H�Rk���gO���O��
��o��k�d�.�7���]���Y��l�]�7ߕ�����:+H�Q81긍��
+��d���y4.�@3RW5����gS��m�����񪓲��B��R0]O:���������Nj*(����O4�c.�G�<W�XZ�����b@���z�X}�\��;e��<�
+���.|�mZ�T�C'^�-u�G����a%Q��>���T�����y�����7)�ƽn���R9p���u˺�x�*�3PI=�hk[gb�oܠ4��!��T�V~���y����
�o��mA��������Mw'��t�������-p���ڷh�#N181�j��/ ��:L����f������� {�AE[WVg%*��58��7��H���a�*Xlo.?�ZO.�o�^�QY�*		)Շ��=��;i��
�i��e�F�p>���Qˢ���r���^�E?b���ާ��	�;�u�\��K[�j[���P���){3O������4�	���
���>�7ˏíz]��v0�E�"P����b��Q���8ʘ�)h�QEgQEQEQEP�/ƛ���g���x�?ZM�R�9(���-�� �e9H�t�E��汨$�I9'�4Www>Ҝ8(.�ׄl���+`FR#�����Z���yV3ߺ�3lC�����*�+���O�̪�J�-��EV��QE!
��oiGH�����d��:W�V���},�k��r�{�������G��~'�U���yek�gW:F���>D�$����8<+�;;��*B5"�-�����2�Aw��G����m�'�B3?Ğ����W]]��2����ʍG	QTbQEQEQEQEQEQEQEQEQE�^7��f���v���uo׏½T�M;M��~�! z����x����;v%�������g)�y:���h���VM��v�i�޸�ù��\�Sߔ�S��z�����K3.$�>a�w����]64X�X�B����S��*���V���s}B�(�dQEQEQEQEQEQEQEQEQEQE��BԷ��q�$ǩ�?.]���V6s]LqJX��W�^�I{y5��/+>�ՍiYX����=��~d�!{��%�$�G�4����}�R{�1ی/����W<W3��ת��s}�O�K-#�b@��=��j�Wq�;���(QEQE
�~8���u��n����x�����)^�um嬖Ӡx�]�+���&mP{i2�y�����\�agt}&[����R�~(�is-��w06�cm�k��mN[N��.	�����W�Vdž��4m@9�[I�*{z�qJ��^���'����/�ǫ�L�X�&����r��E>�ϖzQ@Q@Q@Q@Q@Q@Q@Q@Sd�"�䑂��O`:��Q�j7-��1��G�?���j������7�=��*�qN\���a(�Jz��v�4�����Q��c���\\Q���Q�gr@�M{�b�n��c�k�V�O�WJ7w93J�������QEu4QEQEQEQEQEQEQEQEQEQEQTu�J-+M��L���c�Rnڕ����S���Y4�[�lz���&���K��'��I#c�MG\R�3��j
+�5:4i$X�K;�RMz���Ch1�����;�z?�.�S�w	�{����}��kz1���f��i*Q�o�QEnx�EP
EP
EP
Y����`�>U�)1�O�V�����NP��wG�^Z�eu%���3�
C^��&�m���F>F�t�J�	cxeh�B��k)�
q����&*8�_��7�<G��(���G?+�d½�A�Ex�u��A�+c~���I&?o��)Զ���0��Ik�w=�Eeu�H� �K]'υQ@Q@Q@Q@Q@Q@Q@r�<�>˦��m�۟���O�uH�D���Q
fc�
+�sRmWU����O��+*����e�kW��ϡB�)ȍ$�)gb�5�}9��L�V�ײ.b�/�������ѫ;A�I�a�.��ǯ�~�]��*��8��ޫ��dQEY�QEQEQEQEQEQEQEQEQEQE+�<_��j�T/�X8O��v���t^7׾�nt�g������S���ּ�������0�^�/�
+���M�_�i��z�Qܚ�^����2��S�.�9��S�֬�fw�1+O���ܰ����+H#�p=�O�V(��O�m�݅Q@��(��(��(��(����muHMժ�A�����5�QJIIY�ҫ*3S��:4n��U�� �k�<S�գ76�R�G�H=���#ͦ�H&xeFIᕆ5�88�갸�b#u�Toxo��[�n�̟��Q���W���[�[-Ŭ�,MЏ��k�����^i7u����Cʷ�UB�����e���I~g��Xz��p� �����η+�4�G�ԧ:R嚳
+(���QEQEQEQEQEP�uHt�:K�y#�N�݅&��Q���c�9��>LK��y�콇�������w2�]Is;n�F�ơ�)˙���-����~�]���c=��'_��q?���������h��:���X������{W��[�ko�8��Q�V��wvp�X�ge����QEu8QEQEQEQEQEQEQEQEQEQE��-j-��pӿG�}~���z���d�W-�^�uc�
+�[S�կ����xU��
+ʤ�U�磀����¿"��Iq;�3����c��tVdž�95��V�2����T�v>�s�(9KD�_hk�jWI���ڟ�a��?�z2���	�����yU���b%�����QEQ�QEQEQEQEQEQE���kQo�+�I@��}EmQI�ՙt�J�����Դ۽.��wF�{0��T�f����m���+$gר>���\�u݉i�w\���ο�¹�I�Q�x\�}ښ?��� ��Eu��.-v��n�����������Eg8�wV�N�yf�{=����{Y�X�u=>��X������ZN�?���Q޻M'�Q8X�8�����2��:��5���x���=i���;:*[�k�D����ꍚ��<��vaEP ��(����jvz]���`��W����7b�'h��{��m-���AH2�{W���[�Z��R�(���5'�|Cq�M���P�"��}O�Z�S�D}&�<�/�*Οcq��%��n���������Q�KkX��ߐ��W��{B�D�ڸ{�����{T�L���6Zˢ'�t�4{����#�oZТ��J�+9���[���)�QEQEQEQEQEQEQEQEQE��6�\�8H�$���뛈m-���AH2�{W�x�_�Z��%-#?�����Y�|����%���ݑ��[�Z��)qy�����ʢ��zmΫx����<�=z���L���Q���h�MƱ|��/W��z���մ�}6�;[eڈ:�cܟz�G�m��1on�=]�W>���]8r�汸Lj��𠢊+C�
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��1��
iڶ�?*���h�'�;���GS��<i��G��9�z�Y�P���8�����P�;���$�(�^�t=7Sɺ�Fs�-�o�Z�������vI�?Q���Il{sJ3�~�8�{��e���8�$b
t6>7�-�[�Ҏ�6��?³�<9�Y��c#(�(���V[)V*��:�P��u�1[H�+oi�`\[O	�g?��+B?hR����Ѱ���U��9%�P{]��*Дd��#�T�|q�D�'��ژ�+ͨ���(�4����<u}8+e
+[/������W/qq5��k�^Y�9ɢy�_d�+�u��+v�����X��3�S��?�*=�*8|*����z�tO
��쮪a��3��w��J�v�`VI���s�����k����<�Fj�+��:N�i�[y6��~���9�5~�+t����R�擻
+(��!EP
EP
EP
EP
EP
EP
EP
EP
EP
P^]���=�̢8���S��t�Sqw&��>�@+�u�v�Z��)������}�9�Q;��)bޑ��D�"����c�C������X�V����k7~M��G/!*�ڹu�>�*t)�h���]j����2�Y�E��KE���k1.y�B9s�{S��*�H��Ɏ���9�5z�i����|�7��:G�
+(��<ࢊ(��(��(��(��(��(��(��(��(��(��(��(�g������a�M7󩨠i��2&�Ɖ7�����Ȋ����/�S�k����=��&�v���}<��[y����pxsF���N�������բ�X��,Mio7���8�@�����F:�*��(��(��(��(��(��(��(��(��(��(��)��14���(�f8��}b��$�ѣ)�5�,@��oAX��Kn��x
���G�5Ż����Y���k	ն�=�&X����v,�Z�֩tn.�.Ǡ���R����w��\�������ћ��?_�`��=��ia�yh���v�Z�w1Z���#���?ʽ3O��ӭV��0���O��54QGKH��*���]P���X�d�/]`��+C�(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�][�f��2���g�S�W�x�Q��F��[s�,�<��u5��F'v
Z������Z�V����7#�Y�x���u�j����&ne�`�b^�SY�$Ms*�O,��Pd��G#���a�6�#��f�y���ZB\���~������f�_b�������붶�����%�5�0*�I��lNg
+~�-_����<+i�m�l\]��#�O�G��U�QEt���<
+�gV\�waES3
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+*�ޥcd	���#��
���
�4�2-�[��@ڿ����rKvmOV��΢�����3%���vW�_��U����v����ߙ��������.&�W��'���e���e5%�Go��
K�}�R�7��}���'�KS�.���$��?��/�~=��X���xwU�p`�e���I>U�z���������.g��*�����a�/,�����u���-��\4��8�U���Һ�K;k(��X�A��}j�E��z٭8iM]��x�\I�M�/����~����]���gn��պ�}OSW(����.���۠QEg(QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE�%�%�,���e�9�΋�z���*��`���=�`y��ه �u����<�I�e=�e9�t=8���4{�Y�����z@*�� ���ڕ��u�*�*UR�
+	>���ϱ�,�y3Ӧ�v�$��F�+:����������т�,��7���?݉�����c[�t�����^�ob�O�{��4�|u�ˑ0B;?��c�kڵ�D��z����V���uY0e���ğ�V��� 77�?����4rԑJ���o��I''�N�9%p��;�FMz���t[l���;�ſN��k�m�l��8��(�)�/�3���|o�<��º���0���;?N��t>
A���-��#��
+�h�(���g^{i�f�h:^��ogq�n77�z~�E�Ily��'p��)�QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE�!�_��#����E
{[Ke9[x��*UUQ�P�Q@�oqh��QEQEQEQEQEQEQEQEQEQEQEQEQEQEQE��
+endstream
+endobj
+36 0 obj
+<</Type /XObject
+/Subtype /Image
+/Name /im36
+/Filter /DCTDecode 
+/Width 172
+/Height 172
+/BitsPerComponent 8
+/ColorSpace /DeviceRGB
+/SMask 37 0 R
+/Length 2851
+>>
+stream
+����JFIF


``��C
	
+
+

!(!0*21/*.-4;K@48G9-.BYBGNPTUT3?]c\RbKSTQ��C
''Q6.6QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ����
"

��







	
+���

}
!1AQa"q2���#B��R��$3br�	
+%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������










	
+���

w
!1AQaq"2�B����	#3R�br�
+$4�%�&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������
?��_Ē\�]-�����>�Һ?�U���Z?��Ə�������j��E6y��*���-��?�G�*���-��?�^�E;
+��_�U���Z?��Ə�U���Z?��ƽ*�,g��®�����ߓ�4®�����ߓ�5�TQ`�<��t��������t�������J��������������������zUX.�5��]?����'�h��]?����'�kҨ��vy��*���-��?�G�*���-��?�^�E���WO�Ah����?�WO�Ah������(�]�k�
+��G�~O���
+��G�~O�ץQE���_�U���Z?��Ƹ;�si{=�m�=��pq���Z�����|���Li���_����܏��zUy��_����܏��zUOp��)�(��(��(��(��(��(��(��(��+�5��_��̟���ֿ�9�_2�F�)��_����܏��zUy��_����܏��zUOp��)��^ݧ��$K��EÀ�
�e�h_�����o��[������76K�wp@'��T�Y���a����U�S�B��.?�������q��k���g���Շ���"��Vz���X����(��h_�����o��B��.?���u�����������W7�h��ln�'�(l�I?P)
�����\���?�/������7��j묾k�6�q\��eP��
�F~^��5��}�?���Ə���������5��³�������?�G�+=o�~�?�������?�/������7����}�?���ƺ��Vz���X����(��g���Շ���"��;?���/�m�Wgb��1��ƺZ��q��0�\�o*3c$�$��V�2�(��Z�����|������
k�C����'��i2���%���O����W�W��%���O����W�P��
+(����(��(���_�����U�����m�����ƎN��ß�-i_����+�+��9�"֕�^���6h�E�
+(��
+(��
+(��
+�
k�C����'��k���5��_��̟���Gk��>u?�#�m^�^k��>u?�#�m^�B�(��b
+(��
+(��
+����6��\S�W�W��K���O��ʓ9:��ȵ�פ_���{����ZW�zE��
+٣ES$(��(��(��+�5��_��̟���ֿ�9�_2�F�)��_����܏��zUy��_����܏��zUOp��)�(��(��+��%���'�qO�^�^?�/�F�?�*Lh����9�"֕�^�����ß�-i_����(Cf�QL���(��(��(�ֿ�9�_2�F���Z�����|���L�v�	��S�r?���U�	��S�r?���T!=Š(� ��(��(����#l���?�{x�Ŀ�d��)��1���{����ZW�zE��
+�J��ȵ�פ_��
�4QE2B�(��(��(��Z�����|������
k�C����'��i2���%���O����W�W��%���O����W�P��
+(����(��(���_�����U�����m�����ƎN��ß�-i_����+�+��9�"֕�^���6h�E�
+(��
+(��
+(��
+�
k�C����'��k���5��_��̟���Gk��>u?�#�m^�^k��>u?�#�m^�B�(��b
+(��
+(��
+����6��\S�W�W��K���O��ʓ9:��ȵ�פ_���{����ZW�zE��
+٣ES$(��(��(��+�5��_��̟���ֿ�9�_2�F�)��_����܏��zUy��_����܏��zUOp��)�(��(��+��g�o��m�����
+*�}���+���<�����?֟���W��V�c������&+ЕP8����EP ��(��(��(�ֿ�9�_2�F���Z�����|���L�v�	��S�r?���U�\>���s�����(����c��+�:(�X�2��Ί.>���s�����(����c��+�:(�X�2��Ί.>���s�����+�5��_��̟��TP4���
+endstream
+endobj
+37 0 obj
+<</Type /XObject
+/Subtype /Image
+/Width 172
+/Height 172
+/ColorSpace /DeviceGray
+/BitsPerComponent 8
+/Filter /FlateDecode
+
+/Length 217
+>>
+stream
+x����	�E�ӂeX�-�e�4�$�%Q���y�;��"]�i8��:����������������������������ڴ�:�q�o�?m�>��m_e�kkkkӟZ77�	��;ceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee=�:>V����Xkkkkkkkkkk��*]�'6�m�
+endstream
+endobj
+38 0 obj
+<</Type /XObject
+/Subtype /Image
+/Name /im38
+/Filter /DCTDecode 
+/Width 1200
+/Height 287
+/BitsPerComponent 8
+/ColorSpace /DeviceRGB
+/SMask 39 0 R
+/Length 33265
+>>
+stream
+����JFIF


``��C
	
+
+

!(!0*21/*.-4;K@48G9-.BYBGNPTUT3?]c\RbKSTQ��C
''Q6.6QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ��
�
"

��







	
+���

}
!1AQa"q2���#B��R��$3br�	
+%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������










	
+���

w
!1AQaq"2�B����	#3R�br�
+$4�%�&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������
?���> y��Z�y�r���V��"�9��ܟ�%	��S�r?���T�l�_�E�s�A�?�6J?��������+Ҩ�+�k����7'��G�"�9��ܟ�%zU�5��_�?���d����nO�
��*����/��
����Q����7'��^�E
s���������(��_�?���d�J����������r�l��/��
����W�Q@\�_�E�s�A�?�6J?��������+Ҩ�.y��"�9��ܟ�%������r�l��TP<����nO�
���E�s�A�?�6J��(�k����7'��G�"�9��ܟ�%zU�5��_�?���d����nO�
��*����/��
����Q����7'��^�E
s���������(��_�?���d�J����������r�l��/��
����W�Q@\�_�E�s�A�?�6J?��������+Ҩ�.y��"�9��ܟ�%������r�l��TP<����nO�
���E�s�A�?�6J��(�k����7'��G�"�9��ܟ�%zU�5��_�?���d����nO�
��*����/��
����Q����7'��^�E
s���������(��_�?���d�J����������r�l��/��
����W�Q@\�_�E�s�A�?�6J?��������+Ҩ�.y��"�9��ܟ�%������r�l��TP<����nO�
���E�s�A�?�6J��(�k����7'��G�"�9��ܟ�%zU�5��_�?���d����nO�
��*����/��
����Q����7'��^�E
s���������(��_�?���d�J����������r�l��/��
����W�Q@\�_�E�s�A�?�6J?��������+Ҩ�.y��"�9��ܟ�%������r�l��TP<����nO�
���E�s�A�?�6J��(�k����7'��G�"�9��ܟ�%zU�5��_�?���d����nO�
��*����/��
����Q����7'��^�E
s���������(��_�?���d�J����������r�l��/��
����W�Q@\�_�E�s�A�?�6J?��������+Ҩ�.y��"�9��ܟ�%������r�l��TP<����nO�
���E�s�A�?�6J��(�k����7'��G�"�9��ܟ�%zU�5��_�?���d����nO�
��*����/��
����Q����7'��^�E
s���������(��_�?���d�J����������r�l��/��
����W�Q@\�_�E�s�A�?�6J?��������+Ҩ�.y��"�9��ܟ�%������r�l��TP<����nO�
���E�s�A�?�6J��(�k����7'��G�"�9��ܟ�%zU�5��_�?���d����nO�
��*����/��
����Q����7'��^�E
s���������(��_�?���d�J����������r�l��/��
����W�Q@\�_�E�s�A�?�6J?��������+Ҩ�.y��"�9��ܟ�%������r�l��TP<����nO�
���E�s�A�?�6J��(�k����7'��G�"�9��ܟ�%zU�5��_�?���d����nO�
��*����/��
����Q����7'��^�E
s���������(��_�?���d�J����������r�l��/��
����W�Q@\�_�E�s�A�?�6J?��������+Ҩ�.y��"�9��ܟ�%������r�l��TP<����nO�
���E�s�A�?�6J��(�k����7'��G�"�9��ܟ�%zU�5��_�?���d����nO�
��*����/��
����Q����7'��^�E
s���������(��_�?���d�J����������r�l��/��
����W�Q@\�_�E�s�A�?�6J?��������+Ҩ�.y��"�9��ܟ�%������r�l��TP<����nO�
���E�s�A�?�6J��(�k����7'��X������
+^�WD�	_.�C�OZ�J�_�_���'�ZCL>��Χ��ͫҫ�~��Χ��ͫҨB{�QLAEP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
^k�k�>t��$�k^�^k�k�>t��$�kC�>��Χ��ͫҫ�~��Χ��ͫҩ {�QLAEP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
^k�k�>t��$�k^�^k�k�>t��$�kC�>��Χ��ͫҫ�~��Χ��ͫҩ {�QLAEP
EP
EP
EP
EP
IA8�?�>=���m��w��A�!�?�P],��I+�"��c�+��>"hzqh�v��v������*��I��r�{t�<��"����u����+g�؅�ߙ���r�����6�rs�d*?J̎)&`�#;�2kr���"���K�T�� �Md��z�-y9>�7��~�w�?S��]t?<@�.��{4��!R�¬�������o�B=OP��;�?����֥���CdA�R���~q�֜��E�km7�K��b_�c\Ӂ7Zd���n��u�o�[�!u+��T�F�m�Z��`�X�?��o��^�^A��Aހ>�Ȣ�;þ:մfX���-G�������X�����[�������u���
�))h��(��(ϵ�kV>$���l���N�~POF���������q��,��U�f?���5�T�y��&�/���/�G�&�/���/�^�E0�������q��,��U�����q��,��UzU�5��������
e����������
e��Ҩ�.y��&�/���/�G�&�/���/�^�E
s��5�����Y��?�5�����Y����(�k�	��������Q�	��������W�Q@\�_�M|_�@8��_�*��M|_�@8��_�*�*����k���
������T�k���
������U�TP<��_��?������_��?�����J���������q��,��U[��5�K���U���&��F��,:���]�y��Y�����
 =*�(� ��(��(���Q�
Td��W ~$h9��g���Š�е�-z�K�"�c}�$ ��ZtQEQY:���|>��蔉��=1�=k�F��˿��?ƀ��Q\�,������O��p�2���-�3@�u4V}���j$-����8
�kB�Q@����O�n���+�λՑ
R>���|U�k���J�ƻ�ʡI����@�QEQM�D�'�F�3���Er�>��
nϸ�s��O������ț_��m��L���@(�?�F��˿��?ƺ�[���b����*�V��	h��(������0�֐��*�����@V��?^�{{�r����Q��P����Z��o<7�,LQ��8#�,u�UM/R�մ��m�R3��>�n�
+(��
+*��l�%��p�D�ٽ�r��D�%�"�+�w!UDC$���u�W/�x�I�o�����&�ᇖ?>����z��,��{�a�R;�ƀ4(��(��#�Q��0TPY��S@���A݀�g�D9�jΥ�}3K�ז��JQ_i�t#>���c����~�_��k�6�Yzz��JQEQ\��4g�/����w$`�c��u�W5}�m3O[v����\D%�1�T�5s@�6���l�@�`�ȡNq�l�EQEQ\���tK�$7<M��4r:��4�F-WO���H���0H�f�.QEc�&Ҵ �Ŧ#"��?�o�
�Ey��F� �r��6	���=���Wp��l�/���?�@�v;�*���X�֢���f���O�E\�AEP
Ec�&Ҵ �Ŧ#"��?�o����Do"
'+��`���@�z5�Y|O�w{���z)��
+���R�V�674}8*}�(��QET���0��#�1�R0�MC�>�l�-c���*�_���PeEy��R��ɤ(_�����V-~([�
w���h��?���4Vn��i��E�.U�FZ3ï�^��@��(��(��(��(������|��I�ֽ*�����|��I�ֆ5�|%���O����W�W��%���O����W�R@�
+(����(��(��(��(��$�4�0TQ��p�GXѝ�*��$�
^?��^VӴ�
+ء��q��~3��%ђ�E��G����z��ʼn$�OsI]��|
s����&��)?����sK�o�{������/�=�Ѵ/��Fmb���|��Q�n���]��h��6�k�z�r{�����v�����⌟��j�-��Q@	F
���@ڷ��]YOڬ"���A��1^��0��
>�?���'>���+�i(曛y�fh.!x�S�G\�S�.�,���g�T9WC�+�|G�;�6�.��0$����G�xLj�9���
�����Q��j��x�-_e��V+ވ�_�>��W̨�2��;W��>��q.��������U�B�t
�QIK@Q@k��c���^�^k��c���^�Hl(��b
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+�X?����D���X?����DCG�QE�QEQEs�<���+rU�%������x�E$�#�X��#�F@��"�������[i��-�y�������ׁ�>����E���2{���H��3�j?f�%�v�]G��ב�n�W�����t�V��A[����?�{�2���4m�92��EL}QLG��Z��m3��?����^x�y���h�3y�@�8��g�k�=�����KT���N�����WB��+=o�~�?����Z���aRR('��Q��b���,+�?_��d�/m&�cк���5��s�Z��"�z�ygЇ9t����^�sm�
�)4M�r
yO����~�`	�c�Brb'�ҁ���^�j6q��J%�A�aV+Ǽ��5e���Ю�+g�?f����^�LMX�񆂺���j�灿������x�s�j�]�
+���*Q^�^]�/��e�Ų~�s������֓zF�{���{nۢ�C/���*�y�=��m�ܾ"��~���c޽B�0��g�<�u�m����Ӑz/e�z�>��k��:6�=����ʽݏA^%w�"�B�̻��$�����&�>�{�SS�иL�Z� ���é�=k�*�����i�X��%�lrǹ>���`��_�?������1ivI��u#��?J��c�ඇp���'�e���w:֗��Oa? �[��c��٢��uv��ݬ�Gb�HkS�
++3ú�Z�
�x�l�?��Q�{Zt�!�����[��	J]���3[��<A��t�ť`�F9*�G��k����2E�-��B����_é�=*?����:��f8�[pGV�߇��R)hv^�SAђ����ûz}O�]r�/.h���ώ��-��?
�^�U�(u	�b�
+7���i���3�~Ǩ��;����xY=?��^�^
�Y��ڴ����I�/9?C^��}e5��@�&Q�.:�}H�EOXԡ�t�����K�3��a��)��(k�X�H��.0����Q�g�}�PmZt�6�lY�)=
��\�������wr����~�W�il:N���q����M"���;B��SY�?y|wN��<~>���>��u�m3����<+	����z���q�L��J2���ExO���4=j{$��ѱ�$=��
��Es��?��$2�n����}��5�S$+������N]*��C2`��~'��+˨l�庸}�D���
+�R��^��*�5Ę�1�EQ�RcF����WZs&ml�s����?���]�}�GH�Ё3sfuh��ï�[�����X,�@7J����?��+T�Ad��<G�����إv"�_��;m?��:��A��z^!��Z� �F�����Oo���W�|:���o�L���
y<�	�:~ք7��袛$�m$�f=M2N_�����h_WyE��W����}��<��s\�96���c؎����5_������7�������_ƽ[�z��4�E��߼������"�D^8І��7������8�U�G�yW�5y4Mj��E;dQ�Hz�����w������W�dȘ��!���40G��,w�4.92��A�}puߴY��;������~��WyL��k�CХ��w���9��z�W����޺�'ͭ�c���~'������u�n1�c�?�Pu?��E{�1G)H4P�����[��������W`9�UO�������bx�]]F{��\H|�T�oS�:׎ZZ��ڰ�-�s�Y��d�J�~'���)f�v�������m����båO�2�����>���s�
+�#��cd�����c�
+
�A��T����
�ͤ�<̣>L�na�Ì��TS�е���s��#�u���F�����8n��tS u>Ƽ��V��>"1.����8��ῡ�k��]��{'9kY>_enG���s��O뫠h�r�k��
+���}�Zۯ&������o���?�nO鶘��ZZ��ڰ�-�s�Y��d�J��6K�}��&9����'��1aҧԙ{p�Z�D_�9��wT�����V����n�fQ�&`70�a�
+�t-b�����øm;e��{�=��x�!���-����K�;��?�8o�
3�,���ݷE2S�jj�~j�C���Z�O��[����ڙ'��W�M=@$���Y�G�u�EY�l�=���=<W��ci-�w�@�q�Id�>��Z�Jù��|/�	��VVoU�
��f��
om�it륻�2be�߇$ҽJ�v�>Z]]�w�qn��-ס�#����������H��XpG��k��%�Gk��>�
+��z���]/‰�������>�F��7��QE�
+(��
+(��
+(��
+�_�_���'�Z���_�_���'�Z����>u?�#�m^�^k��>u?�#�m^�I�(��b
+(��
+(��
+(��
+JZ��>���Oz�1�%?�砠7⇊Ht;9v��e=e�{ז���yn�d����#f=ɭ��rOj�[X�i�v�S@�
�a֥��`��^�R?�{Q$1,Q DA�P0�����p@�Q���pK@Q@RP�E%-Q@Q@	U5M2�V�{;؄�?c�P{�Ex�<5s��D�!�-�Ɋ_�C�+	���&��H�r��
}�����-����*�ѻ^�i�N�5���&DZ��4
�	�"��H��p�������G_>�W[�A��RLD�����׿�4w$иx�P�ø4
%Q@k��c���^�^k��c���^�Hl(��b9��O�Y���.�&�e�c��a��џ��1����G���������H��B���?�c����(���?�c����+�h�vG��џ��1�����џ��1�����PG��џ��1�����џ��1�����PG��џ��1�����џ��1�����PG��џ��1�����џ��1�����PG��;�/�_�o�[���v�۽��k��9�G�1o�c��ףS%�Q@����,������*���,��������TQE1Q@#2�b��'���wǚ��w�nJ�$������㹠$�/_W��n�,����:(��+�4[��{K����ݻ��5�^ӿ�|Uls�������{U$S<S�Zw�o�n�W�|��7_�5����^ٳ%�O�r��𬯊�w��Z�H�4�����#��_�ڏٵ�l]��Q�����~��
���QE2O=����g��%�_	��'�\W��ߋ_����'�Z���Bw����.�t=>�(�HT7�����kp��J0�55
��g&���Y�~x$d'��{o���xr��t��>��)?��y��x>/�`1�"?��]��ٌ��2�\�ت��M"��eU�(5��Wt3)V��V(�I�z��u�kZH�e��I���½��z�k�,w$�p�$�;0��=�U����ښ_���7v�����?����4�5��\�96}�#{z0����+sw��?�uo�[�m-	^:;�?�A���O����a�:��b��v�G�����q�	���u��T�;|<dzz/����j��QE2B�?�~�M��m�2�6��'f�?�һ�GE�6GP���R2�������y�wD#����-��ڽ/���z�-�`�~HP������W�x�B}Zxm'���}GO�֪�����Wro��i��}�~T���h�u׈�շ�$�d�S�g,���5�Vv��ZEkn�!�B��
+�<���] O:b��|�E����+��M�QLG�;B�E�k&d�l��<����W7��\���Ŵϋ[�#d��'�~>�����A2�E*�zx"�+�zD��=�䢝�1�$=���H�����߉��گ�H��
��.?�OO�~��Vޝ�T{�5��m'�r>V�G'�k�4m:���V�����K!�՘���Go��B�����6c�ϧ�7��
zEko��V� H�P���-2XW�B�����f���G�C����aA��=A��f�t=v)dl[M���l��:��A��z^#�-�z�F�[K��O�'���]���]~�7������"�O������5��H�$���:���t/�^>�:~��{�s���W&�{�
p(����{���q���t�6q��Wn{�ܟry���(��'9��oB)7]��H}O��#���Ú����䢝���$=G���^�^;�B�����)�[��㢷����Re#��9�I�p�ȡ��BC\W��w�zr�P>&��V?���
��|OZ=͕��E�Q����p��pڕ�׈5�'(^{����T~�F�í�OX�t�k2��'��ï�=k�k3úDz&��`���0�'=O��i�
+��N���5��>xX�q����ֽ�
6��E�⺌��O�̧�����0^[��@��ּ��f��=EuX�I�����5gᧈ���n�hY����?��S��> ��:!���uw�\uT�#�?j�<�m�%L���I���'��x�W�^�f��d�p'��z��S^���hZp�����ɏ�G��8��
��ES$�\�jR���Q����
�[�KM@1�C��D����2��O�J��5��
+y~�S9�k��RE2�QL����m7O��C?�-d|*�)�][���w�?��G�I7xb#��t��a�k��l�|]��N?L�JEt=�����ڔ���!�}
��{�|�|�e�ğޕ��h`�k�l"��Zj
����%��mU
<�驜���g�*�2B��0�t���+'��3���}\o�$�ሎ~���u���h�>\׮����o��V�k�k�~>�B?���?ҽ��QE1#��3�U$�+�5�ڥ��մvv�E+F���BG<�=�x�Z��isyP���G���4�;
񖮚׈�����#ꣿ�I?�zo�t���9s.��c4�z�8����sX��5��G���C{ ;�XN�����wtaESQEQEQEW��Z���3��?�ץW��Z���3��?��Ʒ�������j���_�������j��H�ESQEQEQEW��R�M��4���6c�z�]+ֵ+��Ӯ/$#l1�9���ėws\�s$�]��'4
h�H��,�@w5���A�`�����oV=���
t�ԼS�.��>��^
+���s@EP��t�Mޡm;<�ʹ�G�V�hJ�f�a�<��4
�Q^M�|T�%$X�C������_����D��ȧ�b;�@�w�XY)k��a��s���_�eb����!C���RId��H��{�ɦ��_�V��i�j(�ӱ?���^���!�'��5?��?J��R�X��q����~w���{�ŝ�BI9$�k3ß�.i����V�QI@E2Ic�KI"����aj4���Jɨ�#��	�J߯>����=5�W2ۀ����'��j����i�L{4�~C5�����N	-�H�Y3�}�rF��N�o4y4�[2Z�z�'��
+����/�V����L7�_
�4P(�5��K1�}��A�J�5��K1�}��A�J�6QE1x�s��X���O���<c��EIEG�x?��ȣ�����RQ@������+��+�v�n�U���c�עW��Z��m3��?��4y�z��(��xՏ��3�kɫ�>�Ȭ�����i!���<��?��Q�x?��ȩ(�I����1��"����<c��EIE5#H�s��(��(����,������*���,��������TQE1Q@yw�MG��-��o��<�����~u�ʈ]�
+�$�¼Z�mSY��l��B˞��~X�ƏB�U�yZu֢���i������+����c��1Y�\F�D0��)�9��5c�������z��`5M��2�B���W��3N��M�-���J3������	��?��?���\���sq,�c|�]�02NOGаʓ�Ѷ��P�Gpy����?o�1�fKV0���B�]E2O=����g��%�_	��'�\W��ߋ_����'�Z���Bw����.�t=>�(�HQE
�_�7���n��d�Z���v7$~J��\7�/V��w�!�+�k�

�5�����6��r��O��{-QL�������s�\�5�{��ּy<��b��-�����|B�����wͥ���ߡ?�A��������Q�����L�cN��rp
H��[�v�RM��ZV2���c�T�#�J�
���е������L�/��0��k�|7�Ů��^��vT�����Є�Z(����+'���z�-�a�?$(��Oÿ�@O�-^�y�ҢUy >d�wRG
+?O�\%��kw
�*�D��q�H9�zV����x�^H�I;�&�󁜳�Ԋ��!xZk5>�n�ȿ�+B~���C���85�.�s�J�+�Op~��ג|;��f���p���`
=N����W��
+(��rt/�=���nl�n:��:�~���@#d��'��?
�/��(�S�..�+��oϯ�^Up��
���{��� �_���RE2�QL���(�����:ę��̐��U�G�x�H���_FW���B��SU(��:��e#��a�yV�N�<���^���?�^�Y>��[L��d�U�LL(����5�{2����?>��kQ@:ȒC#��Qԕe=AEw�4/:�Mft�"&8
����~>��x�B��Q
+���Ez_������i���Oc���)�QER�t�u}*{	�쫀��������{ɭgR�D�{�е���J@1!8��&R'�o�h��Q�3ofA\�i;~]*�����Ȭ�����k��&QE>w�����?ν�E����{G�����f3�}�/�ƽ��	|1����X��JH�i�E�8���+/�|��j�����-�ܓ�A5��V���ݮ����ƹ����Qa�,�ݏ���R�������>��|�:�"��c0�W��q"�Lh`�s��a�^���"��g�$�cKa�>���@���L��?�����_)���
+�>+H��c��@�J��@��|9�X[�'��k�+ȾF_�E����v?�ֽv�QE1�ǀ���g�9��������F���բf�oe�@8I��O�G�]��Z_j�դ���6Đ�*�Q�{�U�z����}ۻ�t�(è�=���Ś%݅�
"4n}v�����]��P�'�*���#����HoTzMQL���(��(��(�5���:g��5�J�5���:g��5��n	��S�r?���U�	��S�r?���T�=Š(� ��(��(��(���|m<'$*p�2,�r�x�z�9�]6�=w���0�
��o4Z{GLAi
+�v桾���@�w�\����/�8��tmOQ`,�g�=�?>���|4��@i��j���� 
q��rNh�W��Yǃ$ǺĻG�s]F��
M�Ӣ,?�O��Z��=+Q�`��7��#$~u�X|8���Gj��z�?��iH�5ڊ}�>�<�O�Sj�k�FIOu�6���kxz�=6)�y�k���9/����n��58E}�^!^��'�D�Ϫ�B�2�>���mm|1�=��0��Ndp�����|;d����7~�+ÞY$�wf���S(���+���i��<�A�5�_�@��B݋e=�\~�k�Tg`����d�֟�P��M�)�)���e�����v���:�^��|+Ԥ������yv����?ᦁj
�Y��u��G�(��Y�K@3Z��u}2��'M����[-L��K!�uA�ίP��|-�g�����z\�Ka��H�*�77/9`��]��QEy��Y�����
zUy��Y�����
zU!���)�(��(��+�~-Ƕ�����kЫ�~-Ƕ�����hc[�k^���Ef����K^G^���Ef����KI
��QL���(��(��(�5��K1�}��A�J�5��K1�}��A�4zUQLAEP;��G�;·%[\~�?�]��ט�7H�Z���{u
$�2�z�r�[�5;T�ӑ�[t��7O�
�֟­;˰�ԝ~i�D��'�'��V�����?�����T����y?����M�s�_��3�#���W)�º~������l�of�G�q��zuf��O��{e�-$gg�Õ�@�w<��v��mr[l%�(�my���z��M��N���;��>=pyҽ�Rxc�6��H�"�p���L�~O�K�?������:��k�=�����KY���u漻��Z%
+e� '=�@��Eg�A��b��S�j�Nj|=n	}Z���y���i�mV�<A��;���
+������
_�]�H��V�<��|�=����緷��ޣ�\<�72����(�R���i�k:�Q䴯�7�W�?�{��opD�c�B(�`W1�o�aY��҃8���k���?��uT l+��������۾/.�T�T^���Z�;۸l,滹}�ĥ���xn��]x�\�啚I�$Qp:*��րH���Ҭ�M�y��쿏��{X
T�c�WCME����<�;����l���^������3[J�G��"}+��7�?����>,�p��)�߇�&���]C+z^!��	�jH�I���w��:~^����FE��:������p���\)=^>��?*쩒!!T�@�Mx��<@u�a�&?c�)��o��b�?�>!���-�+�H?v?O��Y��[�������\&l�Hf�G~��O�^�K�������G�n�@3dr�����WO<1�A$ x�R����>�d��M]Y���ctN�C�>��G�� ����s�o-��������<�?��c,	��\�x�ú����.��.��C{J�TƇ���QH���Tv��um�):0�J��!EP��?��/���׿�����)��x��|����u��o��-�!I�4QE2B�(����2���/��k���<G�#.��_r��f�)��O�����O�ZՓ�O�����O�Z��
+(��
+(��<K�?�8�?���+Ҿȕ���O���9���Q�}�^����D�?���ƤS��袊d�Q@x�Ŀ�d��)���+��%���'�qO�I��������_�-v��/��Y������aLQE�?�O_|���}�O��o��b��6˜��7�r?B+➐�[[��.L?���'�?���k���"�o䵼m��$e�Fá>ݏ�H����SQ�H��eta��r����i�ٽ���J:��>�w>��8�7`ͧYʫ���?���MhL���,J}s������&��O|�T9�i��
�{׮x7H:7�-��]����G�߀��)�7k��whm<]|1���U��
?�k�+����4����K����I�O�r?�����]xF�s���&�G�Et���$Z-������䌿h�t'۱�+�Q�H��eta��r�uy�ś�fӬ��U�a������6�]��^L�D��<��s�^!�ZMsZ����s����8������kBe�/H8
bS뜓���^�X^
����{yl�~�Q�Ƿ�0?
+ݦ(�K�����P�δIp�
���ֺ�3]ҵT��)��8���h4QY:爴�{��2����.����h�|Y�S6�jܪ�0�8���<,ڝ����l�즹kU�ֵIo�8iGE^�W��E}@S:���>k��F>Q�:E=�QE�
+(��
+(��
+(��
+�_�_���'�Z���_�_���'�Z����>u?�#�m^�^k��>u?�#�m^�I�(��b
+(��
+(��
+(��<����X�ao�͏�W��ˁ�k�~0�Մ�����>C�S�@IiѬzm�(�X��U��Op�}��%?�X��*���i�<).�r�F��I��
~��G�<1����|��Q�	dž?�-����@���q����|��R�u��'����A�k�]�O,�S
+�$�õy�����W�o���❶�������������o������!A�~��(���Q�
����aO�ºK����kF�q�g'�T�Ǿ�_����@����(����€6�4��K( ��q��U��y�s�1T��o��Ǿ�_����@%-s_��\��Q����nX^��6Q�ZH%�Q�p�n�
f�(��(��(�5��K1�}��A�J�5��K1�}��A�J�6QE1Q@Q@y�ů���?ߓ�-zy�ů���?ߓ�-ks�k�>�Ȭ�����k���>�Ȭ�����i!����)�QEQEQE��f?���5�U��f?���4��J��)�(���mkH�����6�y��.b</a�b�c��pҴ+;,a��o�x�ߩ5�E�QE(�����SS��7��N�kg18�78�	#�B�I�_
[������ʼnWi*>��`��V���3M��m��ei-�Fr�5-��\�#:��.��ѯv������3��"�����|G9
t�W��U�f���,<�N�i�L�����N�3#A��s��[K�F�X��cyy���)�Š(�G��:�G�i�}Ԗ���D����}��Uo������=N��h~Xc�pwwl{�_j�j(Š(�AX>2І���H��P������oQ@+�i~%�58/�����6H��w�+��d���-gw���0�}�zպ(g�^�%յI.n4˯:�L�h�Q��@+ִ&H���.��c�֍aEP �)�/b֞�K��{{��X�>[wN���^�EL�~��g�^�as+��I�����~5�QE
+(��<2
k�q!M���>��
+ɧ�#���( �8=
��Q@��(��c^��>����t��u++,d��W��@ӱ��e���Ѵr���0A�CZTQ@��(��(�#񆃫����{}6�X��WH����"�{?	�[�B�̞f�q�2�GC[�P;�Q@��(�����.�}�g��O��#
脌�F��[��Շ��y ��f�"����h��Q@�Aͼ�N�H�R��Ѓ^Q�O
j|�6�]ٞB�2'����n����7ڞ�LP����FO�R��z��]_M��׾�h�����U
+�TaJù�x;��Z\G��
+�b�[�;ObǦ}��(��!Q�Aͼ�N�H�R��ЃRQ@I�O
j|�6�]ٞB�2'�����o�=4�����#�$�����)�8â�=FiXw<	WS�.��o����xKK��aW�C�+|�i�X�ϵw�T*��)h�\(��b<�ž���K�J��6�;A��+���5+"���wh��J��)Xw>z�j���:mT�:N������~���zƽ񡉛sD����,;�/�������N�yT>��?�ֻ�(�HQEQEQEQEW��Z���3��?�ץW��Z���3��?��Ʒ�������j���_�������j��H�ESQEQEQE
��I�N��FO��W�׸|K�7��u{vYG��ׇ��~���g9�)����>�����1���8�?�5�Pן|_�$�>���^�\ǎ|;s�M>���X�h��L��1�@Ew��o����ǿ—�V��?�����P
Ez�*�S�����/�*�O��6���y��?�5?���M�¨���#k�7�P�Q^��
+�S�������G�*�O��6��P�Q^�~j]�+c�
jK��j?�-@}^�����:o�����q?�5�1;o���<3�K�x~�N�E��^�,O��
Z(��
+(��
+(��<��,������*���,������*��QE�QEQE����L�~O��U����L�~O�1��5�\�_�"����%�#�\�_�"����%���Š(�HQEQEQEW���%����� ץW���%����� �=*�(� ��(��(��(��(��(��(��|e�"���\O��~���L����tǻQE(��(�O�������ۦn�
a��������y��u�4-f+�ɋ�L������{��e�����"�V<�O� ����F����vpe?$(��O�u�(^��=2��_֒���Y�nqݘ׹XX[Xi�XAF��s�\��mX�Ex�����Mj~�6^�������m�:M��{a���(�?�Ac���)�(����O�>ݨ
*��oj߼ ����}s@���W��2��]r�=R�ȷ��f�Iо���JŽ����d������X����~��&�;�s%�O�����G� ��(��|e�
B�h��w�h��9��ɼ9�K��pق����������c��1�������R���!�p�)��?
�P�3�~Ǩ��;����xY=?��H,z�QLAE��=^=E���]F�������
�
:+���K�wZ��X��̄��~Y��k��������ot����erS�|���R�F��{�������i��xF��[�O��}��i�V
+(��SU�!Ҵˋ���Wv3�ǰ���^+�k��b<˫�xԞ�!@ҹ��W	����K4�s��r�s <����+����
��w���������R�E"��RXdЊZb
+(��;ky'��E�f=�@Q^
��k��׌���$�U���{�:"�ZV��~�s����t�mtS&�8!y�p���f=Mx���cy�O$�4x8TS� �o��@%s�n�C��9I�KTq�|�H��!Ѯ�$����`��M𮹪D&��sr$r�H��F��]sK����q�]p>�'�!��:+��)��t��G�O'�rc��+�a�9�I�p�V=
15a�QQ�O����H�R�Ǡ�Veψ�KW)6�j�8*$���~)�}�;���bS��ս~��U4�	뺜"km=��!���)\v=��_��%��l�z/�
?��*�O��ޕ����!�D!�}pN?����y㶼�����r�{����E67IcY#`��2�9��LAQ�<6�'�"A�N�G�k����_�m���cy�*�W$;g��/�;��K=���q.��Hi�'�t�
�Z��́��Io�-�êڳ��
?�� ��^ �7&�8퀇�8��������>x�ur�Q��(��{� ���h����5-
+u�fi-��۹ʑ��}�{.��[j�l7֭��U=���Ջ�QE
+(��
+(��
+(��
+�_�_���'�Z���_�_���'�Z����>u?�#�m^�^k��>u?�#�m^�I�(��b
+(��
+(��
+(�� ��K�9�dIP��F+�=J�M?Q���a����
}'^G�cF�6��~��m���:~c�Pw�=Ti�(XdlEv�I��vr��~5��4N�Ȳ!*�C;^��q5����Fɗч���
�����/ڥ��q���rsZ��|]��z����4
h|L����?��/�,��~���W��@��3ÿ޸��T������?��x�
��<=�s�~��������<�߿��x�
���?�u�~�������������׌Q@��;���?����A�����?'������(�g�������������u5m6�m�L���0x8���}{����t��[�Cj�)��3�
Td��S�����e�f�����1�S����h
d����v]�
����5wC񦗮�"��'2m.K&� ��]�S�M*MRTėGjg��O���(�5��K1�}��A�J�5��K1�}��A�J�6QE1Q@Q@y�ů���?ߓ�-zy�ů���?ߓ�-ks�k�>�Ȭ�����k���>�Ȭ�����i!����)�QEQEQE��f?���5�U��f?���4��J��)�(��(��(��(��(��(������Z��q?�W��S�F�3��S�׮x��E-K����+��)�#N��_)��2�ǻQE�
+(��
+����W�M�b��\tF����ث;_�a��f��2�������|2���[D��0^ܞ�����z|���D����I"�?��q�5Hu�&�8��è�� h�H$�
+�_k�]�[�l���!�տ�v��A����f[�.n��#�G�����#�l��h�L�ڐϞ�ݗ����]�������\&/.�8#�N���J�袙&7��4״Y-��|�1�÷����W����Z&��`�Ŵ�278*Q^�^e�3��L�Z�O��B�
ٻ7�����ƏC�/����/��1L����>��V��>k�d�:E����I�=?��z��$1<�0D@Y��u4��>4�ƅ�����s�8G��߇��yW��Y�A�Gj�i?�������[��ܗ��_����ۏSֽG�~��*��O���z/���H{#zb��8!@�F�QG@AT��*-gH����_���á��B�d�?#]���a���e���=S�Wҭ���e\��v�q���(h[%�Z�>W�s�����U�g�}�Qm&w�7G1�����"���QEr�u���B����.*�����L���������ko���C�߉���������ɓW�9�UO�������޸�*���M�}�?�5�t�}����:��=���)��{{�qּP��ѵimd%'���^:r~�����v���D� O�@M���O�}�bGM�}e5��@�&Q�.:�}ׯ�{�ekb�gŭ��xW��?j�`¼��.����}�͵�+�������>����\�$�ع��p����~�ʼ��:<���
����|�胯�z}M&4w�/�ؾ�:bk��,�~������xc��H&@�ȥYOBZX�H�H�P��*���)��<�:L�&�=�䪝ѱ�$=��
z��5���	���|G7<�F�G�
Q����ih�o�3sfuh��~:�|��]�Y�~�a��~�Α[�ۨ�@ ��Vg��x�={��ucS�Nz���'�;]�E�h�?�;������?S�V~�Yi5�Ӂ����3Oθ�2��_��^k�I!�ُ�^�ek
��6��(P"�aH��15�6���5�5Ŭ����w_����k��c\Ф�5��?��܎���>��$e�6�~ߥ6w�Š�ryh�~]?*���4R]Y��0vؑ?���{���][Gq��E�;�I$��~���ǣ@���9��������R��M�罸lE
+>���O�w3�k��JT�sw.Gl��†�>h_��ԧL���=Nߗ_ʽf�hZ\Z6�oa>Z����=O�W�8���Z���6�������I��S�������(��u=��ۂ
+��mџ�F�o
+&=����
+����9,��������!�����)�x��
=YYm�%��.�:+�� �5��/��G�O���������A��;╰�ð�c�qϱ���2�0x�C�.!tǸ���SH�����|S�Z
:�L��n|������U�׎�H�7-�<�m�H����C$�w�ū��\� {k@a��z��?�z�rm�>���3��a����1C)V�0A�^3��
+=\�G]��+�F�����Q^�\?�[a&�iu��)���?��L7�=U�t���If�F�y�G�+��%�]ta�$��������?L׭S@�/xu|D�qI9�d.�G���֯iZ.����XZ�\|ό�}OSW�AH�J�H�����<{����G-�l��R�E`~`=��τ׎WP�c�eQ�NA�KU�,]�&�ah��7v�m�c�A�_	�c��`B1X������WC�(��d�Q@Q@Q@y�ů���?ܓ��zUy�ů���?ܓ��kp�K�:����6�J�5�K�:����6�J���QE1Q@Q@Q@f��I�[��,%���o�c�֕!�@6jsi��Y�.١b�+s�>$o����ZM�̣��q]����O�8ɹ�~�G� ��ʼ��h�%�xRX�<n7+/B+�>��Z%��˓~����3S.������Cϔ½v7Y:0ea�A����¦�����~����
+�o�'��?�^�Eyo�*i��,������4��d�"?�^�E|���jIfn��.:������'�*�����������ω�.bB��@�+�95�¦�������s����y+�������S?��������L��_���ׯP��<��4��_���׮�úY�t;m8�%07����kJ�������.%X�nfc�G����2�]H�X�J�?kr��̷�
�~X���:
+��Nj��
ߑnJXD~E�����W/RM*���UQԓ@��e׵�l��	�+�uZ���+[h��]�ơTz
\���4��G�
����z/�]5QEy��Y�����
zUy��Y�����
zU!���)�(��(��+�~-Ƕ�����kЫ�~-Ƕ�����hc[�k^���Ef����K^G^���Ef����KI
��QL���(��(��(�5��K1�}��A�J�5��K1�}��A�4zUQLAEP
EP
EP
EP
EP
EP/���RԿ��b��Ÿ�4���νs�_�)j_���1^G�O�t���O�I��=ڊ(�HQEQE
��|?�ºݲ|��ٿ����x��\�
�ce2�!FJ����zW��sB�J��u*��=Ex����VR�m�FX��\��i�,��}�]|���7RatQ�}�U�:����c;]��ǩ�=�^�+�n���yJ{)��{�C�^�B
+(���������kK���Q�������ˍY��B��m��8ܿ�������7}S��1�n�� ``v�u�+w❵�i6�R0K�}�`r�z��:���˗�쁞qH���᷇��|u{�ͽ�b Gޓ���x��T�VP趉�m<�c#�<������d���(_P��Q����wE2�a�k�5;�W��BR{i8q�NC�׿��;B�M�k'� &�ꝏ�C�I�3�������uFE"��s�w��?�k���cw�������_ƪ�j��v�PJV� ����k��q�h����m��#=N����P=����д8�u�_�L�=�
��[�QL��OwI�9�)�A��}
��"�$����%T�!����k��z4���|G7<�F�G�
R���i��m�3sfp9d�!�u��k���V�L[�i)Aq�������+sW����޺�'ͭ�c�����@+�>h_�: ��1uv����¿�������ָ�*f��K��迉�
�h��QE2@�Ad�׈��C:�$(�[K��Om�����n�w���ބ�$�վd�����?P(e/�Z�����)�76`/'�O�?�O�ֹ�������(6�d���?�O�ֹ�+T��/
͜�\�2}����sº3���V͓>d�裯�z~4�c��i�}�MmVt��C����<��ޑc�Q*(
�
+Zd�Q@E�B���~�
+b��㢿�ǯ��[�5�6	4Y��2A��{��y�O�u�#�#��Y�_
�n�����К�+[��VI���d�[�Pi�;O���<z,�ʼn'��ݗ��#ҟ�B�$�����;|��Oθ�[��b�R�y�yf?A�^�ci
��6��(T"�a@=	袊d��Y<�jLNq.��
�+�~&�X��c����yg���i������z����Nӿ�o��)�o�E�9ψ)����d�����_�^e�<�i�3.���k�|s�"v�����B��Ÿ�4���ΑKcݫ¼['��M��'e�������#���U����3C=s����;N\c(����[���������?���b
+��#&�ܶ3��o������ψ?�%j���F-�6��W���e�y�F��
���M�����*Hl(��b0��]��ג�]�ys�p��9��+V��cL�\\LG ڃ�Oӊ��o����.���E+�܃�@���~��^"ӱ8��۠`�cۯ�H�!�^����T{�ݶF̷R(�z��^�����V�
���%��'�>�יh��;RI��|�
+E���?�z��}m�YEyi �T�C�B,QE�QEQEQE����L�rO��U����L�rO�1���/�|��G�ڽ*���/�|��G�ڽ*��QE�QEQEQEQE#(e �A��%���Y5M*-֬wK��^�z*��B��P{�̽+��O��HE��-�Y�Iբ��qZ�4�|I�Q�#�̖�~���r#��J2�#�F�����.-&I�q��j�|�뺎�p&��d���o��^��|M���b�c6��.�2�(����^Z��&���x�F��ҧ�����J#��u�f�z�����z����X M���+�5��g��c�h?����5/���׫W3�?��bk�!��v�B��1]5�V�S��b2�����_��o�:<s���G�w�(�յ�
����,I�K@;׍x��^!�1FZ+9H����ֱ5=V�V�7�/4�����
ڡ�����K{h^i\�QI��K�U�8�������jq�71F��@����T��$:>��H,��U1���O�w�qKEQE
��f?���5�U��f?���5�T�Š(� ��(��(��Om��a�L<�ؤ��������>��|�?���z��H���,����ᔃ�k����
+(����(��(��(����,������*���,��������TQE1Q@Q@Q@Q@Q@Q@�2��KR��'���?
+�Ӧ��:��ȥ����y�?�i�?��?�&R��j(��!EP
EWS� ����[lQ.��{
�O
��E��n���l���\1����z~u�xO��x��Hs0���!(����T.�/|G�
+ﹺ�* �;
���A�a�4�la��2���=M"�<J���A�Vd;�Yd>���ۨ�s��5]6�f�r�q�����p?�
��ݲp�K�=����T~�������M��z$��>�\PS�袊d�6I(�Y" ,�N��W��L���-�������Lz��rO�o2n0)�����\z���j��/	]hzU���j�u��Ny�>��V��o�����	�{f�`����_�+�5+5=>{+��˴�z�4���=�e�.V�._�r^ܞ������K�
�,��=bKg%.-�ʺ�Ӑ��5����״h����L��\C�}hBf�QLAL�(���"�e==E>���U�K-^��2JA;Ĥ�!X����|m
��4�
+m�"7�7$אx��F]W������{/�?�V�?��?�$S5���d�Q@
��=A��E�:w�/�-�"I>Q��q^�^%��u���A���-���6�F��vw����G�u5�|>��+O����1���(��QEx��, ��Us�ڒ
.���'�v�-�M{�O�K9Voe�5��K���O��ʻ���+7�|��ZE=�Š(�HQEW�|O���^��!���� ��g��z�y�ŏ�	���t��c�5�,څ�L̛#V�$�!�W�מ�%��mO����W�SQE<7�1�~-ԗ�ſ>�z��_�4��@u��ڼ��E���Ӿ0'�$��榻O�7_yY��1��ZE=���(�I����x3P<d���ח�6?3źj�8�7����C��p"𷕞f�L���/ό���>2 ��?���‘Kc���<U��Qq�ܻ~g?ֽ޼c������P�/����^3��sq�ex�b?�n�+���M���D������S
+�~"��ݯ;F9�|�]5q��~����(ǰ�<P4p���񎜸���R�{uy�;s7�ĸ�]���������0��)�(���?�:,6���AC3�p[�@9�R|*��/n��c�Ȟrن
���m�Re_D��\�?;����L-�yrg������:(��!EP
EP
EP
^k�k�>t��$�k^�^k�k�>t��$�kC�>��Χ��ͫҫ�~��Χ��ͫҩ {�QLAEP
EP
EP
EP
EP������:�k����#�`+��?�u�PϺ߅��F�]����h�d?�oƱq_M:+�VP�F<�\���S-"ۛY���8�Ҁ<V����M��2�ޱ���|C��
+�Ip��т1�Zz���N-aw�vW�7�W;w�Z%��#���PQ�{���`s�EO�fO������W�Kcwb[Y�>��T>[����P�\|V�>F�n��ū���#�~� C�0�_׭`ç��@��y	��dֽ���ExG��ʀ��A��%���2'��s�NĚ�N�5�g«�`ڕ�Q�t�?��v�7�t=k�h$��Y�f�3��(ʼ?�}cZus	��<�fR2?��ּ;�;���-c
1y��?�j����Q@Q@Q@k��c���^�^]�Yx���W:���O!V�r�)�m?���۾?��d��
+i��+��|�@�?�������I����X��+��|�@�?�������I������TW��n������)��w�����
M
cҨ�5�����$��SG����'��ǥQ^k�����I��������2O�4�J����w�����
M۾?��d��
+h�Ey�����'��?�|�@�?��=*��_����2O�4n������)�,zU�۾?��d��
+h�����$��S@X���X?����D?�|�@�?��^�ק�徫���Ÿ��CU�eҐ�ESQEQEQEQEQEQE
��/��/����#���:g�|��\���Z��q?�W�[\Mis�RX�20�E&R>���K�O�RO���M<I�AI?��
+.+�Ex��&�$��������Mc��}o�riHؼ�~�\,{=yG���P]���տxGG�������o�
���B����E꾭�2+��/�ɯ�Q��"<�胯�z~41��g����TM�ܧ�ॸ=��oǧ�>��4�b�R�$h�UG@AO�I
ݴ7���� x�R���5�Z�>��Me)9��7�{�޽�/�Z�����7v���WN����֓e���]є�ٻ��L;�F��k��
+�&���v2a?$�?�_�u�+ܡ�9�I�p�H���B �
<A�á�_K��1}�A�{f�Z��k�c%�܄��<���V���C�����|�[�㣞���Z����y�nK��G)�_��c����4�:e�P���Or}��QE2N#�N���<j�雋Q��~��_�k��V�t-iZF?d�	0����Y�je�X�`��׉x�B:��"������u�:~T�K����PAA���7�۴�\�n-�1�����t�b�jd�Q@	�?�u_����C5���[L��d�U�^#���U����3^��O�����O�I�j(��!EP
^%��u���A���^9���Q�}�I�����D�?���Ʈ��χ��%i����F5tt�Š(��(����#l���?�v��Vo�����K���O��ʻ���+7�|��ZE=�Š(�HQEW�|X�����qo�^�^a�c�Bv�ſ�&4]�K�ڟ���&�B�=�K�ڟ���&�B�p��(������z�.|�a��W���Y5t��&Ӧ}�v
�������隍���=���e�ޣЏpy��tK��&�`3��^Ǩ>�ݩ��Ey6��U��b��+��
ؕs�#��Q��G�n�h�!��0�u%�}	�~T\V%����ީ�K@L�|���Mi�)�J[^jn���3�9o��q:�{�
DAn�W9�f� �'�۽{v�c���el�b�v���'ܞh�Y�:�����=Q �Ӻ��ߥz-T�t�5]6{���\:�؏py�$y���]-��4��h��œ���~#�W�W��:=���.���U�B���=;�F�k
+�wo
�э�c�#�Ґ�=^���f����v0�h��G��2?��U���^�������t%��=�*����y�
@C� �1 ���P	X�>�>�Ru���q����3�W{PX�Cae
�����T��fL�#�m���nf�'ڬ�'
+���ֵ��>&��/��тAƊ�m;I��X�W�u�%Dv��b"��Q���W�s���?������ϨV�5ej�6�5XZ�-�a�Ku۸{����p���_�S�"���<���xg=q������Mf����~DO%�8'�~u��{×��Ў�
+@�����PS�^ӥ���V�
���!�r{��h�B�QL���(��(��(�5���:g��5�J�5���:g��5��n	��S�r?���U�	��S�r?���T�=Š(� ��(��(��(��(��(��(��(��(�&�;F~��P
EP
�(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��"�������#E �#t"������m�#[TP/�"^��M��h��K���	���mQ@���x{��6���O
+�Ȯ�\
+�A���(?P���Nq5��s�hg����i�v���bAai����\t�uv�(��(���o	�}��ҭ�NO�
��?a���J�`�`��X��1����m�#[@t�(��(����c�F��Z�p�r��CV��?��7)sk��ɝ��g�Ԣ�(��ȟ���O6��#v �rMi����p@�8�P����IEQEQE�w�����nt�e��Y�r{V�

�����[ZıB�ڋ�d������(��(��;�4�F��^XE4�
��8f�O��m��(�ڽ3�Vh��(��(��j:6��H�}g�
+\t~���iVZȶ�ۉ,�:U�(��(��������ws��U�"���9+��Z�Z1so��K���E�í
 ���ˁ���]m�6���6����D\
+��(QE
항�����9�?���.~�9h��n��.G�<
u�P%k��@�p�-��;K/���Z���۬��1/DE�-QE��"u�0A�o����,�zD�$��8�+~��ᦆ͑=�A"�U�v^
���ky.H��HH��
���q���K$Q�¢(}��E
+(��
+(��
+(��
+(��
+�_�_���'�Z���_�_���'�Z����>u?�#�m^�^k��>u?�#�m^�I�(��b
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+�_�_���'�Z���_�_���'�Z����>u?�#�m^�^k��>u?�#�m^�I�(��b
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+�_�_���'�Z���_�_���'�Z����>u?�#�m^�^�x����3����b��>�ֶ��dk�ܴ��g�i
��(�#����r������F���O��Ƌ�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮQ^G�#^����?�G�,�{��������Ey�,�{��������5��Z߳�4\,z���5��Z߳�4��׿�i�~���p��W����׿�i�~����#^����?�E�ǮW��Z���3��?��o�,�{�������b��"����� a/��uǹ��i��
+endstream
+endobj
+39 0 obj
+<</Type /XObject
+/Subtype /Image
+/Width 1200
+/Height 287
+/ColorSpace /DeviceGray
+/BitsPerComponent 8
+/Filter /FlateDecode
+
+/Length 11942
+>>
+stream
+x���y�:F�}�x�m�i LZp�Hٱ��*�I*!%xB[)$Z��;�ټwcQ�d��$��	��������=��E+��cy��
�l�
+��+�V��[
�l�
+��+�V��[
�l�
+��+�V��[
�l�
+��+�V��[
�l�
+��+�V��[
�l�
+��+�V��[
�l�
+��+�V��[
�l�
+��+�V��[
�l�
+��+�V��[
�l�
+��+�V��[�N��:o���`�W���`�W���`�W���9o���O_E�`��W��‡�X#�U$���+�|	,��QyY?�1N���O_E�rT��Z[��e��"���l%N�
���V<��8
X�*X�[��V��>�7��Rs�����ԝ����W���ߊ�'�Kvo�!�����,��v��ÉZ��;�5	���V<pc���ħ����i��p8�N�o�IJ�!-���|��S�5-�V쟭sSS���%�"^j��Ǵ�{j��5��o,�r��h���vχo�藟O��|	,�=�g��8��$�?��W���'-|h/�>y�����݂6��WG�_Z�#54D[��
_�pz���e�:�ե���tR�ގv�wIVc�{���m�;n��8�y����.JCS7#
��q��շv�_�4��_���7KJ�zգ�[��
�Ak�T��Tlܒ��Vf:}����(��n�Yi2�Qkx�U$��o���q[����[[X��/C��aO�H��P�j��<^����#6��6���6���3d����zN3S������w�|	,��<�w�g9ԇ��W�>�������2���-:���Y��fi�d��ј�4�-��"m��D�MU�yG/N$
�>��\�D�[�ơ�hw8��EX�U$��o��rS��tP��|�;h�6�>�
+�Pٷ�_R/=��"��̮Z�:>���%�{n7$��nRCu$�%yN��<Ռ����Ww|	,��<����Z�M����j�tHK4G2u��y�,���n���+缄m����̕�J�|q W���p\���×��_��]���N�_���&�^�H`���?�8��AuBh����2.r����0.3��ry�U"���u�Y	�Z�*����h-���?(���J?!��ž�y*���v�W��k�U�N��J%_E��%��9���4��<e���6�[��OEX4�l��P���e月QTž����ݤ5�Kې���/mC���g����tO���ڥV�3o��\�
|	,�[<��g:���L%_���ص��U�<������#���Q��
���,��Y���#�Ҭ�	��q>ۇ�� sz�:u���>�+$����u�?E%��e��_]	,�[<��g��T�hO����N拕����yw6I"r��g%53U�aK��.���ƔT�2]�u���-}�H����G��7���x���
�Sn�3�㝆W{B���7��XaiI՜[��*t�6Z��b	{r�|�4���EZ��U�.Ln�����pƠ�?�e���"������L]qO��=!T}�k�bV(_˦$�G<5WKɗ��X�e���Q���NV�z��z�W2�~s���ِ�\�v�(�^��,��v��e�����
|	,�<���I��B";e��Ӯ(��3
:񊵝�-�ZbA�z��r^)a�N(BE��y��^�lWґ��t)��z{�)�\zY��WW��K�y:�d�Z|5�SZ�-r�$�7ge���ba������ك�Q4M��j�A��b��Y5��C�o���;e�iO������=��޼�W��������g�>�&�6_’�>9I�V��}#ߩ �T�k%l�r�>�9R��W�P�Łڭ�����
+/1���Ө���W��������g14N��*�%/Y/����jW���۩Y�rNck�_�+�d��Ņv�<#ab۾80��f��i�,��m��vC�.^�H`�w{��鎳��&�V_���Ң����ruVV@��{%5k�#M3��bK4f�MC�\�IXӐd�ّM��
�#�Po;���]��W�������g9���V�����QJ���;�9�>+��B�t��<i�U9��&
+2kNA[��\�F�i[uӎLs�l���~V�|	,�n�1�qN��E�1!4�*Պy�'��� �
+�$=5kT�ӎ��z�6*�!5����k\ AΎ+�rֆ7��Ne��L��~����8��"��4�B���5@yur�B��mr��,�xr�bⵦ�
H��r�F+V�?����r
��}]��Y� 5�m���񻁯"���끿�7�4d��5L���C��:�ź�����%5�օ���;�j�/Ym�S+}�T��Z�J�M�������m����{��"���{���4����Ic�z�aB���S�Zn��2�+½�Ԭ��z	{���V��BŐ�*���![Uz×��:�����P��6�H`����x3ͭ'�8E�t�2!4tm��L����J��x�&hioکu��&�"TD~*�0n�>��P��S9�:[�R����{�i�/�*�nǽ���,|��o������Z&�_�Sj'e��P/l����~�t�^�Yhy���Q������ʹA��Ł�@m}6"��{�)P�xz_],|��o������l:h�z|�/
V>gC���i�i�1V�	8B҇i*郎WK��!
�dC�&��A,-��N���t�����,|��o������|:h��|E�Z��&I�_ʛ(F��!{j&ԅ�Q����5�iV��җZ�� ���U��և#����Qծ��_E_���ƛin=��)1�&�._Q���2�ا�C��{����"=��>h�������ǀ�#rnH�0_�r� �aF2�>L�e
+S��k��>���U$��uhk����z��t�0!t����I��Wm��M����<�٬rn(BM�K#�R��,��fm�\�Z��f���e��H���tq�*8�#���)_���ƛin=��) M�	��W�_. (IzI��^����T�2u��(es��/K��/}Y�K_� {��ۮ�s���{dW�����yS��
m�7��zB�S@��3�������fH��8Ӕ#�O��D0}�O���G<��C�I,��1�����Ay��8ϧ�p.8���|	,|��o�����q:��%��gnJ�FԜ��|�gDMtF&u!�F�i��V��0-}
�?tANK_Z��t=N�u����^&���W����=���f�[O�qΑ���pq_��K�Q�q�`}��[��ԇ��@iH���:1d�v;��;�������C�T�|	,|��o�����y:�N}�j��1M�l�M�g�#��,W��E�H�������I+B1r�N�����W�3��X��u����{@[��4����Q��B��LݪL��q����]%��<�"T$��h�l[ͥ/���5�2�vҡ�N#
J�C_��vl:0u,?_�MX���Ǖ���[[�hn=��9�6�&�w�U�q���w�mm!]!}���h��{��B6�O�ů\��Q�=�z��gV��]����0u,?_�=X3����Ÿ:�v:�L�~��=!����$�z�U&�|���ґz�|L�����y��L{N����׾�=!Z�[�r�%��z	,��X����^��	�}}�ҍd_��f��!L���47�y�14iP�]}�?\�8M&��(��:����,|����Wi:(�fR����*���S��՜�D��z��Cbzy�r?����
G&Y����ۯ^���k�����c?�fL���yS��UV��tP��;�jrS�+I���}/�z;�P>��"ԅ�l�H$��V�ͤ����/od,�ԭ�:����,|����W��r��W�{1��_�f�,׉|��\��R�˙�!]j-
��I)��n�6V�H`�=Pg]�jM�S����竎�E]#��/��G�I��$�җo��>����V�])�BXάY����u���t�=!\�W���'I�]�R�����=
+}8������5��빚�T��N%������*X�n�Y������,��+}$�g���8��!���5�k���
Uν��*�ڂ�8��7�;Q�;{��З�t�_E����Us:؞�|���հ|ڦ$œ$�qF��q�ͻ/ik��BajrҞ�|�\}ZF𕷝�al���,�W����z���|E7u�dҹTHu|c��-]<�[>�g�|�x Ўo_
+z6���U*0�n�5_E��k���y����5�i�U�L^jC�&��S�x�-��"�})I�z˝}���ƽ��;���H`�;=�bM��?9Ug>5s�q�PM"��#S'��
^V>��(#�})q�Ypg_����mg�J>ͩ�W���wz�Ś|�� h0��Ƹ��Sv����
��0]�׾��My�_����Lo;]ez��p�Λ"��h�"_٧���3Ƶ�MP�*}�I���ۏ�g_&�My˝}e�K����rҾ �U$��}h�"_٧�„�3Ƶ_��{)�����%�#Tr7O=<�2!m�;Xz��W�+����mg �{����+h�u�����@���>fr�1��䏅j<�ܵ4K͊�����k_&�(���޾2쐸��v�;X�>4Y��<��y�c��	�Pe:��Y:LJ�D��7�l�z��c_��
y˽}�R���K\���
����m��+�f�+�>Ep��ϴyrG��ʏ)�j'I�y6i�Ď}���qo_������d�{��NJ_E��6��U��A����1N]J>%��+G�s�gy�l��H�}_i;��ro_�/����@j����H`�<�f5�R�LP}�%G�1Ne2�KU�[�a�FO��_%8Ct��0!�� c�]��FL���v:����q�*X�(��WID�	�6!4�qr�����gx�A۞{6���ƽ}E7�U/��o��%z۩��l~(�|	,|�V㫔�hW�+B��?�)��@i�\�z�D���d�H�aݗi+��rw_��a�d���x��N�j��C�_E��
����R-��L�c���ur����{%I��fe���&�}�S���}E�i��M_;<��T�h:��"������Z|e�V'��1�u%_��&M��.��H�
+�Y��@ڈw���W��z5/��Ӡvjws_E��
����:�MMc���^>!�Gr�]l��r�Eǹy}q���+�����ۮMNw�������+�y:X����x
�<�2������$����w���=�E&m�;X��+:tbh���>�����5(S6?r`����*+�y:X��c|w(�Y�-�S���f�}H��t�QrW��Fڄw���WT0�L;,�����p�i]��/��U�H`��=��_٧��	�2Ɵ?�7lU*���kg��N�Y�D:�u�<Q/����j���{㳮v��w� d]�n/�_E��
�u��1,���������0��ʋ}��ץI���LV?cS�]������ſ��O:0]��a���@�8�*�U$����Y�����
e�"�񗗷�q��]�S�L�vՖ��Pk{�/���ONw���iG��;������_E��
�u��3�KE��hQ��R5�5I���
�YYrW:�?�<>�#\\�o��iW�P����{+�I�u�U$����Y��h$��	҄��Z-��kmK�vʉ�ސ�=�hh.�o�*o�-r	�彸d[���]����9�L�{���*X�VX��RzbLХ	��W�*,�ƕ:sɽX���;�
+6'�[���T/C��)-��ry'�U$��0�
+_��z�ld�/�f��`��k��I�15+^l&�����C{�[����������o���5��9'�_J��ZxQrO:��fOE������%��P�v���;Ԯ"�U$�����_9���P��q~��$ex�;r�u�qY��^�%������U]$J��m�o�d��zf�������+�tP�6|5Z�	�%�$QUS��bC��=_==���I=K����f���f��c����V��iD���{jB���4�x8��X��1�Ж�<�.�-[§-�Ň���$.�Gڂ�����!��Kyi���4�����&��|z���*X�6�X�������:�p|�h�BO����S~��f�7_EA�W��_~��t���^zZ�_EA�W,|	,�=_
��U$���|�b�W���_���
_EA�W,|	,�=_
��U$���|�b�W���_���
_EA�W,|	,�=_
��U$���|�b�W���_���
_EA�W,|	,�=_��y���y{1�*L���=�{}q�@������v��y��"�����+�׼~柤:���H_ٽ�����a�}���Ǵ�����}�W���_����\��K#����ʉ�&���
?�^���������ggК\�o���cn�ށ��w�n8�hw(du��`Ȗ��do�����]����ݰ�.�H`�/�
�������4r�̀~)��s������d:C�b,�e��-~4~�߀h�1R���r^g����9�����V4�_P�����*X�z��bz��G�����l07|��{v�h��?]Z�
+-�vC�)�$i�����/���XoC�ɕo[N�������FhD�3z�W~�Ej����kYibg�$��z��I���K�iPC\wÂ�v~�m��YLʮT^u��2�ǔ):��"�����s�$��k��
+�Ԍ�V�)�P�饯i-����5���t7,h��=���r�Ww|	,�=_%(ei���o�P����g���4���T�A�%�&�T
IJ��ݐ�N�{�&���4+��m6����Wڗ�|	,�=_%r�Ҭ�Rwrv��ج�S}=o�Z9���Qm.�U��n�A)}�*��
$��U�{
+�߇��J��#/�����Q��K���Wߟ������ô�[.���"�����+�
+D�"�tvE��7:�NHͬ�s*B��i-��b46)�i�])0*u7���Ӌs����!���<���1���'���jw�:��W	�H`�/�
�*CǢ>Ǣ����h|4&v�K�	��r��/e+��͖�	mې����N�>��j�X;ҧ�l��kRb6~��<��"5�7�
�*X�z���$�:Ǫ��󰪞��ԌҎf5%�����5�!�G����y���v7��Drvp���C@V�*>��X+7���Z��*X�z�*�
YkS��Ġ�Z�>�q
6�,�s^��`)�K�$ӵE���J��d�*[���#I甛��yh���e�Q�
|	,�=_��@T@O�N�
Y�N55���- J��Y���*��K����7�fS!}!�I߈�=���Ƭ�.|,�;�H`�/�
��DI�h�JW�r�!��Z�R9��.��J-i��',�B�n�wA�2��
��k}k��R���U/�U$���|5�J�R�F��W@'m���H���� oW-�U��m�A�7�}�dfIK|~FiYE?����B_c&y�U$���|5!'I‰7u�Ze���0zh��:y%T!�����+�wv�E*+�g��;�
ɜ�qL��r
�f���x裸�}�|	,�=_M!7̛ѕ��ɜ����
"�ʹ\��|"ϲj���y�U�㳿!yGl�K�j-�J�!wުNy|uA�W���y��~.�Y��,�Ԭ]9O;"��x�n�#@�/����!�Ά�Y�P�[�P�J�
�������$�:+��dXw�R������=�uc�c	c'R�h�\��:�'U���;56m��>U<��V_݁��_�����iɝr��͒�����?��9]!�J8��0~$Υ�Փ$D�v5�O���'v�4��9��9���@`�/�
��Sy���
B~|��m�}�3�/�_���w�ꆤ=���5$��>!��$9ֿCD�k�Az��w ���|5C�Y�QL�Z� �Ȭ���f�\����+�GOC�w����ct��8�
+�>A�[�n���)A�Ws��u��'�
��KjV����VoT��!3d�J����ʔ�`C5=-�K��w�~]}|�7E`�/�
�j��$������i��CZjj����^T�-6��*�lU�t4��)��y�%yJ�UV�A��Z�~�n�Λ"���|%0����g��-
�vj&W��E�r
�]��07kd���<�
S�F�D�_��ѱl�]��2��|C�h_EA�W4"�r�gP�?F�����fb�|�ְ�XW��hl�{e���%O�
+�2���i<�+���.����$؈�qc�����R3�F��i�tmQ-B���pi����2��eh���L�0��]sH�=���)A�W"�*6��`��pZ߱�f�ʹ�B��6l�җI��R�đr0K�d�����A���v��|�7E`�/�
�Jd�$�5Y�I,�K	fdn
�p{`��)�j�̐��J���P�M�H�k�����N*z�4��u/A�W2���fP���XR3^9��.����]5T�/8��li��i�7���Е7+_�MX�z��@��Ŝ��eFC��y��ژ����jĬ�E�T�R�5\���/��t��>�{X�z����{N��W;��E���}�p��i
�V��0CZ�p���4�ƅ_5����_:�K�ہ�;��5߁5X�z��A�Qs�>@�DgdH
���n�i��X��0)}y���iO���j�;bX�?�wI���#���yS����j��;Vs<���Hi
G�~Z7e3��؊%�!<
��Oϙ�	|	,�=_U�����
��_���H��ًP�ް��"�����iW=
W�+��K
_EA�Wu�$Ig�{n��UP�+��/�3r�+�Z��Υ�!�Akr��p]����^ʂ�"�����:��j�����������������㈡潮�h�:_�k<�N�H`�/�
��AN���Uq}ѓ^��S*�v�b*BE>�S���{��������E`�/�
��A>8֤#S\^t�]f
�=r
��9�c�4���Ѿڽ\x=|����~l��W���_��Uz4��HWF���C
O�R�~�D8�;�7���Ѿ*ؽU��_EA�WU��pv��q�
���<[���|p����en�"_���5�ŧ��U$���|Ue:3�Uܧ�$WŽ����U&X�z[iH��6\���o֕�Z��"������H�,5s�P���R��q8PC���pm��G���|	,�=_U�=�I�R���e�w3��l�U4������c��0���b���O&_��9�m�7[��"�����
+��
+��+JM~�w]㢻ӛ~A”I��ح�R셜��[�⾃E�.��E��u������+�}�%O�g���H���r���F�� ��X��<��|�Z{�!l/
q����yS����d�q��<����R>pL��S�Nm���2c��S?��h|�7E`�/�
�Jd�R�۶$�H͊x�/�+�V_�~c=-Sd����}6�LF�$�;���)A�J�1�����$�^j�_��&-}�d�_�e!5�v�����j���G,u��D)5s|-�H`�?��m(ɰP/�$I�}����is�N�V_I.�HN����4�al��
�U$���
��6�Dh���������U�Tr��vSo�_��,;$�n�c3,�1?�U$���
���#K�ߡ,3��}��`�2�E�������q�<ɒ�Y�y����G`�?��q(	��Sq=�f&ڰ��fŨ�^_��|��`��dM�aX�|u?��p��8�Ci���~�!���)+/%�l�:�lۚ�Z_}�7�d���v�{������P8xh�ơ4G���:�PkvAH�ʧ	�%����ӯ�W)=m�a\dR!L���&�3H�K�i{�]n_E��p��8�CiR�r��Mj%IbjV�&���Ž�~�����3❸�i��벦[�$R��
+{��"���P8xh�ơġ6��ޒ$
�m�
\�YKZ���W�+}���������u�n���C=��qv��TטM]��+�E�Ҩ��#iio�ׇw��ceo��]���I�YW��&�.��
+|	,��z��C��)ԏ�nHպx-5{*J��G=�6��U��U'v�|�Τ=�>���齷�����C=��qZ��*�^Q��jjV��-ٳl�z}Ee��d��H���Yw����-^
���C=��qZ����=IItN���TU��*}hy���������A1��S�����D�-�C3wS�k���C=��q��R
u7qX�I�P�ء������L��*M�+��0~<�G��4gS��r�H�&��H�*X������iJz�҆��R��L��٤~VZ���W�+
+M,�ի��K��1?��=D�H�晽�W����<4N�P���a���<�j�fOE�]���%��~ž�C'=�D特>(����y��ֱqZ��’캀�"���P8xh������_�UO�h�U�S;�$-���k�U�g*�B�E���;�c�o#��s��;�ue~��
+|	,��z��C����)Tr磎~���Q�䮎}]2k�U�Mg�(�4;�/��2˺����l�]���|	,��z��C�;_�ə|��ŵB���=%w��ƴ��ӯ�W������r�#ֶ���kO�s^�ʗ��w�;����|	,��Q9��KW���_@}Vc�a���c��:M��Yљ���b�N�j_�
+
+1�
�gy%ŻgO���ޙ������������g�"�o-��_E?w�
 ����+N��wkv���~��Rex�ż�~ݾ���9bj{8���׼�y�|�m�z(_�"Tg��)�������H`��W��z�����$�R�2Uh��rZ�������x�{�qn!��������.>|e��g/\�_2���J�y�S��D�~�9-���+�UQ�h����5GԎ���������|����}���W��{#�Y�dM͞��{��k���v_5��ӜIׅ5��y�
F��׮"�U$h��|E��pɈV��إާPfƭmYFb��zz�"�v2oe���T;�o�ꡀr�{?�U$h��|5��o�}���x���-}�n�;=+,Y����$~��t/�XCK;��Ah��Iz3w��æ���?`΋v�E�k=��7�wi�K�ߥ��&|*�>42���V��SCmAN:V���h�{g�M��0ӝԍ>��k���f7p'_
����4�Q�s�|wH��p<]�5�>�L��m����:9�9w�|�
+�`+�W��_
�|�
+�`+�W��_
�|�
+�`+�W��_
�|�
+�`+�W��_
�|�
+�`+�W��_
�|�
+�`+�W��_
�|�
+�`+�W��_
�|�
+�`+�W��_
�|�
+�`+�W��_
�|�
+�`+�W��_
�|�
+�`+�W��_
�|�
+�`+�W��_
�|�
+�`+�W��_
�|�
+�`+�W��@�z
�U�~`���K��
+endstream
+endobj
+40 0 obj
+<</Type /XObject
+/Subtype /Image
+/Name /im40
+/Filter /DCTDecode 
+/Width 400
+/Height 353
+/BitsPerComponent 8
+/ColorSpace /DeviceRGB
+/SMask 41 0 R
+/Length 11431
+>>
+stream
+����JFIF


``��C
	
+
+

!(!0*21/*.-4;K@48G9-.BYBGNPTUT3?]c\RbKSTQ��C
''Q6.6QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ��
a
�
"

��







	
+���

}
!1AQa"q2���#B��R��$3br�	
+%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������










	
+���

w
!1AQaq"2�B����	#3R�br�
+$4�%�&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������
?��(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+���H��w��V;����nQO���>�>��|Nl��,�����O(�������$�z����f�������ā��Ia�_i�	�n�ps�،�Gƪ�@��?�){2Yk�7	r�#��o�O�z/Z���c�o��տ�䙚!�ݘ���~���Ҁ=�(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��kz�.�q�\��^�ݔ}M_����/�
Pi6ϛk3��ti{�]>��3P��Q�����M3�c���#I"ƊY؀�I'�6�������V�L�lq�O_�~�zW>&�p��ItWv;/
+�V�C��V�=� �%nJ��}����v�˼���|�/�C��E|,�5eSڹ{�Ϋ+X��R��M�'��bH\���?B9�Y]�a{
峔���+Ѿ&�^u�k6��ȀI���}�̫��X����u��sJ<��њ���[�`	�\��G�Z5�_<E���2��kx@\�I;ǧ�^�]d�Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@RI$9$���@��d�}�o������?��x3;bY��$�]�|B|A�I$lM��
؎�����P�>�}F�;u�,������N���Acn>H��ǹ?S�q�/&������ ��o���Z���s�_��죴?�E8�\(���
Mw�2�x�R������&�&��Md�1��&?ć����{�r�4/�m�™���Y�_�޽l��zܲ�e�#:��<| ���W�x�#�I+f���;�ٿ���k���~+�c�Yw8�d��:�u�g9�R++�e!��A���(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(���"����n���6)ϧ�]���S^\��aB�}�|��j���ơ?V�W?qGE�gV��4y5�f$�BwJ��Pu?��Eeװ|>���au:b��l�T��j��1_V��z/�ȸG��D�opB�#�B�����E|3w՝!ER��(�|u�b�l�-.s$X觺�Ȋ���U����Kk�'_�=�t�OƼ:Dx�h�J�����#�}�W���K⎏�g4�fz���higH�|�Y���E����"����D�'ѵk}B���J�a����t��5->�g��O����P��Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@V_�u��
�P��m���?�`h����-�&�l�*�K�;�����4�n�&����w/4�]��'�LDi$TE,�@�h��6�����L���Ē�z/�@k��š"�Z$V�=�y�ws��:~�_�b��Y����ΘG�Q^qaEP
EP
^[�/B�%���&!�;e�������Z�*��i�j�d�7�r�3�Ob>�������N���<�����
+<E��>�r����-�=��=~���
�YM�_�gp�e�����Z�	����x\���ta��5�i�+���f����48/�B6L��\u��k^�Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@x�įk�b�|�Y�����A���B���/�����c�T~�"�.�
+�>h_l�V�3
��Y�)=
��\}��څ�6v�Y�*����w�t�t�2q�D����r~���|_���㼿#Jq��r�*���[h�d��'*�*��Ǡ�0��%��t����f��]��Tr�}�6�>"j�r2iʶP�
��'��ƹ�cV��o���B���^�=��5��<���UsK�9�Q�����r��s!=wJ���!�o�9���3�Ĭ?���W���kX��W�x�[�u[���el{0���zG��I���֮Rdx_�_q�^SZ]�X�Gsk+E4g*�y���5��e��FmB�X~�^!�<��,,���{ܯ��NT��5f�Ӿ��7B��Y�O� p;�f���y�}<1�A$ x�R������&�&���d�(����}A���q|���m��Ƥm�����_غ趝�gxB>O�����j�������߈���!��@#�'�_�o�}ǽ{�GYEP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
M�D�'�F�3��W��U��,WD�|Mr7NA������p/ן�:�י"��
+{ �����a�Z��$�5�,�!	�+��A��O��i��[ Z���ʁ������@e�ߏO���L����P$Q�EQ�
���,V"X�����qVV
+������k�#~�����!��׬W�j�ֱ{p�&I���&�<���g7�W�gU�b�Q_Z`QEQEo�+V}'�vͻ��Gl��
{e|�	#�_@鳛�2����aG'�
���i%(U]t7��k����kh���ՠ.����C�����^
+ҡQT��ѫ�:Vυ5�<?��|�1}ɐ��q�*�t/�]m�ť�d��_���W5_}F�kSU#�9Z����2�qsB��C#�A�ם|(��-_C��Bۓ�;��y�j�Z�AEP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EPM[Q�I�./�[B�����8�έ�ϫjw�-�fr���{
�v�|E����-�0�Ӑ~����?S�^{@z����+Fs�.��s����?���\'��/��mL��KlI.z7��'����s:��,<}_�Sjq�QE|ɰW�7Q����Ge?����¼SټO�E��3�9ξ�!��8�/��2��ɢ�+��(��(���A�ŠiѷT��Oࢼ�i��~�Q�&���8��P�W�g��a_�ڗQ�QE|ɱ��u�[P��<,{8����^���Ѻ�u$2���_Dז|Kо�~���b��q�2z�#�־�%���Ж�oS*��r:m��f���m���������mN
cJ��-���\㺞����_7�}��_aԛG�|[ݜ�O�����>�WԘ�EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
EP
X�/ד��יv��
+{�����mׅ�@��������1Î����
@̲<Ҽ�1wrY��I=M"#Hꈥ��I��q��B�f�ڴ�-N#��I��Ԋ�^8zN��
+�ׄ�EдH��h�f�����E�5*J���:���EVc
+���G�e|cω$�6���5�-�u�]
���'�A��_&�.).���3���Ϩ���#�(��(����ڼS�Ō�=\�e���t�#�em�x���B�s��ٍz�|�y>j�=��IhQExf�T�m:[L���|��3��؏��QU8�(���P��N����v�a�~��B�Ѻ�1VS�A��+�v��ۦ�n�<XI��<~#Ҽξ��X�*�߯��%��{��5�������w:��;�_�UoW�x�'@ב�|Y�b9�a�߁�	�w9��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(��
+(���"����w	J]���@�įdh�b�|]��Q?��A����_�R���ơ.B���A����UX���P����wK3Q^�i��:\0�%��{��5��1м�_Z�O�L��^�����z|�q���=�v����+�Q^�QEW�B����S���'؂?�+��o[}�š�X�����Ճ���B^h�+�xmQ_~r�Q@Q@����7du)��I�b��o���g�R�<�'��e���1��1S~v��:��QEpQE2xc��H&@�ȥYOBW���G�C�g�|�tL�C�>�׻�)�B��э�)��@\c�'���{׭�b��nY|2��ԍ������E����g\>n�'����:~^�����bmZ��!�����C�~_�+��s�*;�o�ỷp�́чpjj(��(��(��(��(��(��(��(��(��(��+�>,x�di��?�ؒ�ê�����׵h4=�P������Ǡ�M|�}y=��ח/�i���s@V��t�5�f�V;�a�(:��܊̯_�{�e��k�1uv�T���U��b��E�n�_בP�3:�xc���P$Q�UQ���(��n���(��@QEɢY��WR��F)�SN�|�<M�B�4lT�A�G[^1��'�5��ҙ�n���_�R���g�&r=QE���*�k��^��L�~����J)���4_�h6���
��?�j�W�S����S�(���
+(��
+(��<c�:�.��$ť�d���\�{���E�tIm�z~�=�v���x{�F쎥YN=A����X�i|Q����l�L�O�._A�Y-�����^�_4Z]Mew
ջ���;_BxwX�]�m�p<��O�8�?�lW�A�EP
EP
EP
EP
EP
EP
EP
EP
EP
E�x��#���F�]Ϙ���߀�q@}�C�_�z��-�6�d�������pԤ�bI$�I4��#�"�f8u&�:�_�z����K|I/��_���״t�_	苡h�[>�����X��:V�|>e���f�´_��:aTQEyŅQ@Q@Q@Q�J���7q4?PH�X�.�?⽮�2��b��O�����]N|,<���i�H(���H
+��������FVyO����b��=�e�/���I�B�s��7�o�B��$zEQ_uQ@Q@Q@ygĭ�z���& �8��'��?Pk�Ɬ�C�i����U��{�<�n��u�&Q�V<�_�^"��ֿ����/=O�?�O�ҹ+�9����l��V��U�Wݦ���S��+���F�����ym���oF�G�
t��(��(��(��(��(��(��(��(��FeE,�*��I���� o��N�~����������A���/��,i6ϋ����uX��}>�������u�gL�jq�O���"�9��l��t�0U��F����c�"\��ܟ��7��^�;��4���(����(��(��(��(����wk���2с(���O��J���n�n-���F��핑�0�)����"�zs�g��ª��QE�{�[_��Q%#�W�����-x�{�i�
+�Ԍ�@��c��5�g�9h���kIj_��+��Š(��(��(��(�?���y�&�n�<xI�����J�J�"xc���	�<R)FSЃ��^"�$����%�!�������a-�ޟ�*F������z+�Oٟ�s��u�}GY#Y�#U��"�d�^�W�/��ͣ\�g����G��ЏJ�����(��(��(��(��(��(��(����i��ܾ�aB�~�֬W��W��:hV��E�.��¿�_�zP���Z�ơp~y�!{*�Q�B�����.��AcB��#�A����T�q�\�����1м�_Z�O�L��^�����z
GoV���
+�5
+�::T��8�D�5]G�#�*��EW0Š(��(��(��(��+�V�b�>�0<�p=|��5���-<��p�q$��	���9q=ѝU��QE��9{D��v�ek��fEo�y�+�k��Z}��q�FE�O'��U��y�Njчe���ZQ^�QEQEQEQEW'�B��э�	��@\c�'���{�YEmB��TU#�WV>t��>�>�����B۱���b8�h_غ����,t_U��Esu��jƴH��V��}'�_��i�_[6�f@����<U���>"�5��w/��%�$���G�z�j ��(��(��(��(��(��('��^��|��s�S�
|�q<�7\N�呋����k����/��p�[�l��D�G�o�>���P
^���B�����:b��9��#��^��x#B����\�[�I���'����|�u��Xx���~����(����`��(��(��(��(��(�ⵦ�.��b��~�3���yX9��_�o��j%�H'��v`*{<L%���L��<N�(��9OH�Oi�u�>�,J~����u��>��'��Ii�J��
]%|&aS�bg/;}�PV�
+(��J
+(��
+(��
+(��
+(��
+(��1|Y�.��Kl�B~�=�v�����:�e8 ����+���}�P]V�Gc�d���0k�r\_,�	l��2���A2M��6�:�9����4(oAa�L��\u���5��u�<E����S��+�G.O
+��߇O�5���EQEQEQEQEW'��_�zC���1ǃʯ�7��{��f�8!y�p�ƥ��@$���,�d��5�dB>HP�
+��S��jr+;�"�f8�i��|5оۨ��:fS��Ѥ��u��Xbk�IԗA�wc�𖈺��
����������[TQ_R����[��+hQEf0��(��(��(��(��(��a[�Ym��J�ЌT�SN���扠�H\a�b�=��"+;�(�1����mi�?_�W4�����L�}�ۼU��FTK�7�~o�_�*��{n���s�����e����_�k�*z(���mݝaER��(��(��(��(��(�z�����c8�%\g���CW(���Z�w@|�g6�}5���*«ץ�Nм�SZ�O�<$�w^��t��+�+�0x����-����\�Ƿ|8��Ά-g|�Y���������=믯�|/����r�Ɍ���4=G��W�V��so�):0�A��$��(��(��(����jph�Uơrq+���ܜ
+��+x������?�g
� ��쿉��y=Z����5)�[t�9f���*�X�����;u�,�G��^����\0�%�?�=��k��c�yq>�p�3�;p{�oǧ��^�_%����Oc����7�+�Q^�QEQEQEQEQEQEQE
����J��%��~�s��~�߅V^n�wzGD}X���κ��:Lگ�O٢ig�A"��Aw�“���6����D�\\Hddq�Q�?�5�[_ٜ��o��2��΢�(��5
+(��
+(��
+(��
+(��
+(��
+(��
+(��#��+�y ��"�e=��^�-"]X��L�S�6?�=�{�r�/�M�p&n�
a����?����l��+rK���Τn� �U�Q�/6Ю_�2[�������*�:}��u��϶h\:�q��_fs�JQT4=V
kH��-��*�un�~���
EP
EP
^C�S�_m�WF�|�js)OO�~��W���__h2�)i��p)���u�
wi$i�;Y��&�Z^�%���,c�V9�����r+6�{�������t���
�UO��_�Ҹ3W�h�-ވ�G��M�Z��o
+�5�;
Ҥ���f�:��(�
EP
EP
EP
EP
EP
EP
X����m��t�Ȃ/��.ߎ+3�>)�ö�l>�2�g�_�}}+��I�iev�G9fc�O�5���W����39��#����)r-4���!$��i�����i����ܩ�s\	kr~,˞G��~3�5�)#[�S`n>ǡ�u�WΠ��W�x��]�������%n����{׍��}�]Z:��4�K����(��(��(��(��(��(��(��(�E
��8п�5����/A꿁��r��ź"�$�������÷�ҼAՑ�J��z�_m����F�����3�q�;���"����p���?���e����⽆�cVd`�J�9k��������P��q���/�s��W�A��EPNO��&���+F�Ϸ|]ނ�uH���=??J�����^s���1��}[�?���J���Tf8u&�:h_�z�	S6���oC迉�
�i�X��B�"�`>�'�'?�߇O�]m��fX���m|+E�3��
+(���Š(��(��(��(��(��(���*�b$�ԵOX,�5�',-�#��EsI <?]�_V�n���9ٞ��G务E�,"��0��*�*H&��x��KF�������t���t�[��&�_��G�V���f�n�_������]~y^
+�YAtm~'Z�QX�(��(��(��(��(��(��+��%h?b�WU�1�Ę�?��~�תU=cM�W�籜|��
C]�S��S��ЙG�X�
+��
���~9$b-'�s��vo����K�9����l��V^��4���}8�2�R<�;��
��_�zI��7V`�����t����7wP�ZMup�!���W�~"�&�u��Bl�0���:��5�u����F��f���t�~''�+�h��ᶅ��Hꓦ`�?��F������,m&�����wK3Q�k��m6#K��������Mx��/���q���S��˴QE|q�QEQEQEQEQEQEQE�cYbx�e\#�Ө�Ϻ���~�qg(;ᐡ�|�Z�?�'���1��ƣ�Qч��_J�
+��*8�Jk~��,��Š(��B�T�PK�zJ�xbK��������s
+��X������|N"zn���ƕݏB�lN���Y��J����_���	��NOvu�QR
EP
EP
EP
EP
EP
EP
EP�|Nм�SZ�O�1���߇O�zW����Eso%��)�)�Z�����2d��ѱ�$=��
}^M�����m��¤l�7Aէ�5�}BZ&����z��+�[�/졼�}�́�����K���֋3�`���~d�׼dq>4�:��5�nU�Ɵ��?�åf,Ř�I�'�%z/��%�:���C�Ş�e���^�\�Éa����wY1��ďЊ�+�s�����Go�ꂴB�(���(��(��(��(��(��(��(��(��/xOդ{�G���Q�s�;q]m��(K���I�x����@�E7+��(���L��#��{X��$�@��I�c��O��M�e��#٣�оZZ:Ϫ�.�"%�}{��]��U
+�����k�j�%�Qܴ��(���QEQEQEQEQEQEQEQEW�/IK�j*���#��	���]�ex�H����:��x��Eu`�J�xJ=Ф��	��߶��:�6�*9�e�S�ǥ�8"���7<e�>��+�m����
�A�t�+
+���'�l|Ga�k�*��S/ތ��������L�k%�V�,�{��c@�>��h�&{	�e�e<�q] ����٬����Uq�H#RW5\%
+Ϛ�ScRkc������ϭ����.��Y�����߷��닢�����"<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����t�����������\]ga�<����,�o�}l?����u��x�T�YE���S��1�
��s���P2p95�<
+R�`�ؕ����[Z&�d�� ����jM��ηr���@yk���
힧�W��g�v>��=�/#�,�>i����6h���������'��>$�x�:(�袊(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��|?��x:���?F�tQ@�EP��
+endstream
+endobj
+41 0 obj
+<</Type /XObject
+/Subtype /Image
+/Width 400
+/Height 353
+/ColorSpace /DeviceGray
+/BitsPerComponent 8
+/Filter /FlateDecode
+
+/Length 2566
+>>
+stream
+x��ݱQM`��TE�YX���<W66�|  
" 2 B8	�"��z��g���}�t�����;�xw��ۼ��<��,���a���HW��͖�#��@-�˗�����Hg��x����P������%�wA��O��~s���w;��}W�������c�y<�^��p�c�y�^Ԝs7���*�d��݋7_��
ޭ^���E�V������w�Wx�j`��+�c�w�݄�~r�������W����k����j.c���U]q��=��P�����PNUt�]�]O�k��7��SPV��]{���eA悻�4��u�u'g�+�S��C�U�	w����^�a���K]fp��Ž:dZ�κ��e{?�Ȼ�^����7�+@�����KSVIK[s_�{�6խ����^1��쒖v�}X暻�ˠ��Q|֝ �RQ\���/���桺UP\%^c+�R7�W�����m!qIKCu[攻��p�-�v֝ �*QT�Ү��	�2~Up9�y�~q�V1��Zp�Bu+t�]YT�2
+%-
;
"��U��k�ʡ�ͧT��0ӛM9�J�̛�+wI� �ʤ\��ce�3���m��jg���2����[�{��5ϺT��U=�N���U�R�[(kN��2JZ�㖨\�0�@��b,^���v�}7 ���Cu�M��!�b����O8
'��v��g�	b�=�W)�y�L�ɡ��U���a<nN��*��8Z���[R�����8J����3/�xN1֮F%-m�}w�Q���Cu�MeN1V�Cp��x\�aIKC��YӒ���~}�%�Ja<�?�	89T�zW	��M�W)���#~N�6�Xo:��4�ǽR���Cu{`�;A�խ��a<�����g^#g���1���*5�x\�	8���ۮ%-m��8�Uj��pr�V��KZڰխ�s���z�<
'7h�e(�J�9W}Nn����܀1���*5^u���.m�U�fJZ�h�q���`�q�&��ƪnM������W��μU�ӥm��\IKf<����(�m�	8�Ab,��Ub���pr#T�.κ�
��e<�J�?�v���_ݚ-ii���W���q�&��B�X�KZZ��~u���\�v����c�/iik�˫�prQ�[wg�I��Up�
+�ܯ�prc,'%--�x���*o<���\���_p��6稤��:󚙀�c�*ii���M���n]�u'qb,��U*�x�Ò���밤��x���*b<���\���iIK0����q��ӥ�{�帤�9�3:
'绺5;
'�:�
+\�<�����s\݆:�~pc�	�R^��O��9�n��4��q������8�pr�� %-�_uk�9]�ܝy]L��y����4g�qN&��|U�n&��\�X1�������s����nÕ�47�qa����3��	89'�m����c<.tp��p�5��.mb��%-��x��	89�խ�	89�1V�����H_N'��lW��u'���5Hp�2<�xN�n������&�JY�s>
'g4�)�J�|��	89��m�	89�1� %-��x\�	89s���g݉�k��*e�_a&��LU�C��4K�q�W)C�q�&���T�Õ�43�qÕ�4+g�`pr6b�!KZ���ppr�ۀprb����T��aKZZ���U��s�\m�;vN�ku;tIK�9����q<g]B�k����k<.��\�3o�	8�>1J�Y]���O����nq�ݣC���j���qCL�ɵ�nQ�2��!�b�=�3
'״�Ep�jY݆|N��vgޡ&���X(ii57��\��v�	8�61��ŚT���ӥ�Eu��6C��8WY���
9
'W;�BI���x��Luϼ<�K[��U���qO��իn�����c���57��\��g]�:��Bp%Vc<p*T�(i��!�*�>�	�"�1J�Bk�
+��\!��p�4c,��
+��0
�@���YW�Z���J��s�0
�D��Ep�Dg<����8L�)R�nQ�**�CI���̋����%����8L��+:�bN]I��ં��8��ȫ[��U�����
+�x&�*�U�(i���!��Fr��s�*�X�*���\U��-&�*ˌ�P�V�7�	�겪[�u�ˉ�\5�1�	��W�(i�X:�ઑ��q��kdY�����E�-���̒3/&�Zc!�j���\S\u�	�Ƙ�Uc�ϼxNWs{�[�����Cp���x&ຘ�nQ�v17�ઓ�3/���	c���fM�L�uCU����h7�BI���x&�ڎ�p��l�_�:K��0
�]R�"����x�+��ǡ�5�#��gL��?=lx�m@�h���	rv#���G��V���ܔ��in�
+����osSn��h���
�K��	jS��]S����c�"C\bƮL�C�a�Oԃ����
`�%�sK�~��pf��>��_U3�}�a��t6�y�;�
1���/������y���L��fk���ގ^v��Wإ�恜�@����b���/4�x��{���z}q{��R�����z}����;��Q
+endstream
+endobj
+42 0 obj
+<</Type /Page
+/Parent 3 0 R
+/MediaBox [0 0 595 842]
+/Resources 43 0 R
+/Contents 44 0 R
+>>
+endobj
+43 0 obj
+<< /Font<</F2 6 0 R/F4 10 0 R/F5 12 0 R/F3 8 0 R/F6 14 0 R/F7 16 0 R/F8 18 0 R>>
+/XObject<</im35 35 0 R >>
+/ProcSet[/PDF/Text/ImageC]
+>>
+endobj
+44 0 obj
+<<
+/Length 2010 /Filter/FlateDecode
+>>
+stream
+xڵYێ7}���B��@���{�챽0�FG�>���բ$f�f�5��c���*�EҨ5l,�0��Z�:U��N1� �X����߂4b^q Xy	�U��_^ܽ]�}���b�B���� H`Y��}�ُ���en�>���pXn�~x���/_�KX�~w�����*�w�G�1�"�8�;�W&��I�"��t�[��*gϚ��	B$7L��i��þب��v'��U��Y��
+���jS�~]	�R�j�r�”�s�C��O�b��I�p�|��٩�Q�Te�[7�
4�^���@V�����M�;7陖����Ͼ�e^�
x5�l�J�a��`�������B^Hc:���{vӪf_d�4�(k!����\�Zf��`v�yӇ��u~
+uK���C���O���"O�P��&�O~��^�rݞ��C�[�w���j�'o���-�Xf�^�>��X�e�)Y�KPk�j�6*�.�3���L��L�9�}�]�MK'V.�PG��<4��5�� �/�}�w� �z�"�1gq�f��@�b:~�/I݄^��|�2�@|!lR��¤�o{Ք�"XecF��!u"6i�k��/�
+>cUou����lU?"9�
+Vr��=�8� ��Y�.������JA���rg��Z"E[�=������R�!�gYܶ���U#f}P�����a��ya^���3���*ͩ"��܁�Y6_tO�6���y�k��V�Ӿ[�K)qά0 ?��'�����R�cȃjwOZ0U�bt��7���΅q���ɼ��IUʴ�HG~��\���l6���@���r_��6�`1�;�R�l}S�躄l�Q����j�C�f��"�Q�
+1���X_�x�M�ʐ��>�o�ݤ&��%��
\�*��nH"�q��
+�3��lꢨ��O7��ȧk	�ϠN\MEDQn7R��N~�� E�¶��Fj3���0ȕ���5@��z�:I_�������$�!�0�8��=~_٩���";�
O%l����PCh3��w+�(3 ��Ny�0��k�g�����������DG�^c�O����T�Aq���@��p[l�nA�@x.�ʋ��r�l��dXvX�jl Č}C�ו�#.N�I
+��.w����y�~^M�|��>���$d��.�j�����z�����>*3��ڧn���uA\;x#D�.�q�9s�������~���4�}ߵP������̚�/)-i�ZC��85l����j�8vP�����n�E���с6�/g���*s�8�G�1*��A:A|�tˡǿ{�ۓN?�:�q	A[�3�#�d�hb��zK�PB��|/��5ܪ���Q�������5��N�`
�wM;������x���/"�9�oR2�0��LU7���s;�_����\N���'W�JE���٣~�I����n���U���g؟�.]z�[�x$����y~������@�H� B
�G
��O]�<tΞ![���D����6�M�J�î�W��r��Φt��	�ӉR��G����Z/��me�q�j��5�3j�Z	_�%�Y"��Ǝ��g��Se�=�T���9=e�s��(Q�PL옮�dj}#4���ЋC׀�T�S!�	���^�7E��k{�E��o�&f!�}�E�����,{�ۊğ����Ŕ�,����kK^�J�]�.�^��4�)�g�6��x�yq*@�L,�.8��^4��m�x�s�~��1�,v1�[-�d��V��B��Ů\�V��ڃ.ۋ���O��)8��驖�%�M�`�[N}�#�B�塘eL�X�8�~����q�q#�YgqN��ܽ-��P[��aG��D�U���.iߑ(�EY������_7f�����X:�̌���ԅ������I�=�ix��sРg��3������Yt�q���Y]'���t���H����y����5o!/�-��ޠ0����Ӽ'��N�:;6`���pb�G��g����X��
+endstream
+endobj
+45 0 obj
+<</Type /Page
+/Parent 3 0 R
+/MediaBox [0 0 595 842]
+/Resources 46 0 R
+/Contents 47 0 R
+>>
+endobj
+46 0 obj
+<< /Font<</F2 6 0 R/F4 10 0 R/F7 16 0 R/F5 12 0 R/F3 8 0 R/F8 18 0 R>>
+/XObject<</im35 35 0 R >>
+/ProcSet[/PDF/Text/ImageC]
+>>
+endobj
+47 0 obj
+<<
+/Length 1911 /Filter/FlateDecode
+>>
+stream
+xڵYɒ�6=[��<VG�0������&&b�v[>L�
"Y%���I�4������I�[QQm;���"�D�\^>�>�IC���+�$	F"H
+��\�����������BA$D*&L�b��"p��g�����<���d@a�z���?�w���j�����*��!B��=a��}aRL&�c�d�Nvk�K����O��
+�$
+Aѐ �����/P��(�ܠ�\I�����FԻ�_�G��R�II�?�Ҕϰɒ]i��wU���Te���>7n�����^��SU��@9���`�EV�����sT]�?���/�L�b�$_��bB#��)8�(b���3��K�+�>�j@��n��M�0��I��/e��u�'�����3ű2jL��=>|�����
��6!P=ae4�,���\t���뻇1'�b�F8�M�׭I��1*yLbF�������W?G%&WFL�:z��3��ƒ�2�m3� ��~h����6ϻ�,�
+.���9�5
6]��/YJ���vl("#�E�[����1d)�] |��f��)�'WE�V���6�I�A�V�%U��j�6-�ޭb-�5|��|��~�V���_���Ƹ�m� �yul�t��b>B�HE8��;�Wy(�YmwFfj�R��{{�����w&ٝ;�c�g�!i��/ׄ"!��E�X�[�[�_��W�W}�&7�6��\�Z
+���l�k�Ս���d�^����{��|�9n��=��[E���Jl��v��*��;J���cS^l�ם
#L	���2&cJb��6�6�]������
��V �	I	~6����d�-���C����V��v[��pB�ľ��bj�7�aD�:��|��鍨�ɂ�
�]�{+����h����X�r�6�}�+�T���:i��t�����6)\.3a
+�Z��'HM������١�t���\
� ȼ�D�0�$�V@�qm]�β|&����H�%1���8�z��/�c��d�3Pa���ֈNl|��=�v7M>�jح
Kj��v]�X�k�Qxh�K��m+�e-1��3rԢ
_0��3�ǧۢq�u��ұ8�)A*C�MY9}��F����f6c.��g�GT?��
+���u]�S���b���Nú��v8���[���>�>SK(AUKE��4���ë��2���8�
��Oq�mu�s,�
_����n��_�����b	IU�y`�6�i
9,5 ��l��P��(K�u��Tu�@0y�W��j���YYL%�i�ż�<[k'��B 9�W��h����k̰��5�#�L�'�6�MRg�8/�//�z�V���N���kGs�˷�	򜏽pFDĖF�c��^��2Ї�^��lee��8���"��?c�2�4po��s��O�L1���nU�P��A��lQ�η��t��b�1m/���X�x{{0y���̋f�<�o�b�x21e��s�x�1H�/Yݥ)���
+)���+2]6]�.�/,J�(:9��,)ev����kbv\:*$
+v�����'c��~
ONG�Hʼ���v�BJ��h'�8��0�
��N�oO��|�x�䥗�kw�|��{���0!%�!_R����n;.p�����������=��k]�'��By:��
+)��b��>S����k/�'�<+�_L}f���y!��P�t6k�-��W`
���YV�
���w&����r"h�$K��t
�PP^���Z*��
+(�39�>�k^̭��Egr��k��7�6=ܮ�s�n{��
+P�z��_%L{�)��v?��ۺ�Jl�L7)�p��py1���0�1�"�T��d_}�c��nH��`���zc?��\o&�w�Չ�\<4����[�^(dL�KGH���|�oh��MD�ճ7�]���6g����H�
+endstream
+endobj
+48 0 obj
+<<
+/Creator (��GrapeCity ActiveReports \(tm\) for .NET)
+/Producer (��ActiveReports for .NET 7.0J)
+/CreationDate (D:20220930145436+09'00')
+>>
+endobj
+49 0 obj
+<<
+/Type /Catalog
+/Pages 3 0 R
+/Outlines 1 0 R
+/PageMode /UseNone
+/ViewerPreferences <<
+/HideToolbar false
+/HideMenubar false
+/HideWindowUI false
+/FitWindow false
+/CenterWindow false
+/DisplayDocTitle false
+>>
+>>
+endobj
+xref
+0 50
+0000000000 65535 f
+0000000017 00000 n
+0000000069 00000 n
+0000000110 00000 n
+0000000197 00000 n
+0000001329 00000 n
+0000001510 00000 n
+0000002638 00000 n
+0000002819 00000 n
+0000003951 00000 n
+0000004140 00000 n
+0000005280 00000 n
+0000005465 00000 n
+0000006609 00000 n
+0000006799 00000 n
+0000007933 00000 n
+0000008123 00000 n
+0000009267 00000 n
+0000009457 00000 n
+0000010643 00000 n
+0000010870 00000 n
+0000031006 00000 n
+0000031163 00000 n
+0000031318 00000 n
+0000032532 00000 n
+0000043941 00000 n
+0000060102 00000 n
+0000109690 00000 n
+0000136853 00000 n
+0000175902 00000 n
+0000180651 00000 n
+0000181475 00000 n
+0000189144 00000 n
+0000189301 00000 n
+0000189528 00000 n
+0000192519 00000 n
+0000215950 00000 n
+0000219011 00000 n
+0000219412 00000 n
+0000252889 00000 n
+0000265018 00000 n
+0000276660 00000 n
+0000279411 00000 n
+0000279523 00000 n
+0000279682 00000 n
+0000281772 00000 n
+0000281884 00000 n
+0000282033 00000 n
+0000284024 00000 n
+0000284252 00000 n
+trailer
+<<
+/Size 50
+/Root 49 0 R
+/ID [<19fa33fe23b946a1ac35625ded69aeb8><6e30232f47dc49ae9f08de4cba3ed40e>]
+/Info 48 0 R
+>>
+startxref
+284496
+%%EOF
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_KC_Certificate.pdf b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_KC_Certificate.pdf
new file mode 100644
index 0000000..37edd83
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_KC_Certificate.pdf differ
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_NCC_Certificate.pdf b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_NCC_Certificate.pdf
new file mode 100644
index 0000000..41c3685
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_NCC_Certificate.pdf differ
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_PTCRB_Certificate.pdf b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_PTCRB_Certificate.pdf
new file mode 100644
index 0000000..1d84304
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_PTCRB_Certificate.pdf differ
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_RCM_SDoC.pdf b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_RCM_SDoC.pdf
new file mode 100644
index 0000000..7a62722
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_RCM_SDoC.pdf differ
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_T-Mobile_Certificate.pdf b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_T-Mobile_Certificate.pdf
new file mode 100644
index 0000000..0ca6e43
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_T-Mobile_Certificate.pdf differ
diff --git a/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_TELEC_Certificate.zip b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_TELEC_Certificate.zip
new file mode 100644
index 0000000..8968cbb
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/03 Certificate/Quectel_RM520N-GL_TELEC_Certificate.zip differ
diff --git a/RM520N-5G/RM520N系列资料/Quectel_RG520N&RG52xF&RG530F&RM520N&RM530N_Series_AT_Commands_Manual_V1.0.0_Preli.pdf b/RM520N-5G/RM520N系列资料/Quectel_RG520N&RG52xF&RG530F&RM520N&RM530N_Series_AT_Commands_Manual_V1.0.0_Preli.pdf
new file mode 100644
index 0000000..1824e67
Binary files /dev/null and b/RM520N-5G/RM520N系列资料/Quectel_RG520N&RG52xF&RG530F&RM520N&RM530N_Series_AT_Commands_Manual_V1.0.0_Preli.pdf differ
diff --git a/RM520N-5G/文件/binaries/quectel-CM b/RM520N-5G/文件/binaries/quectel-CM
new file mode 100644
index 0000000..3e3e344
Binary files /dev/null and b/RM520N-5G/文件/binaries/quectel-CM differ
diff --git a/RM520N-5G/文件/binaries/quectel-atc-proxy b/RM520N-5G/文件/binaries/quectel-atc-proxy
new file mode 100644
index 0000000..9333e63
Binary files /dev/null and b/RM520N-5G/文件/binaries/quectel-atc-proxy differ
diff --git a/RM520N-5G/文件/binaries/quectel-mbim-proxy b/RM520N-5G/文件/binaries/quectel-mbim-proxy
new file mode 100644
index 0000000..8d54ff7
Binary files /dev/null and b/RM520N-5G/文件/binaries/quectel-mbim-proxy differ
diff --git a/RM520N-5G/文件/binaries/quectel-qmi-proxy b/RM520N-5G/文件/binaries/quectel-qmi-proxy
new file mode 100644
index 0000000..b7b769b
Binary files /dev/null and b/RM520N-5G/文件/binaries/quectel-qmi-proxy differ
diff --git a/RM520N-5G/文件/configs/90-pcie_mhi.txt b/RM520N-5G/文件/configs/90-pcie_mhi.txt
new file mode 100644
index 0000000..dfc0992
--- /dev/null
+++ b/RM520N-5G/文件/configs/90-pcie_mhi.txt
@@ -0,0 +1 @@
+pcie_mhi mhi_mbim_enabled=1
diff --git a/RM520N-5G/文件/configs/init.d_modem5g b/RM520N-5G/文件/configs/init.d_modem5g
new file mode 100644
index 0000000..1a62b89
--- /dev/null
+++ b/RM520N-5G/文件/configs/init.d_modem5g
@@ -0,0 +1,29 @@
+#!/bin/sh /etc/rc.common
+# RM520N-GL PCIe MBIM 拨号自启 (2026-08-19)
+# 依赖: /etc/rc.local 的 mhi_q 绑定修复先跑, /dev/mhi_MBIM 出现后拨号
+START=95
+STOP=15
+
+start() {
+    echo "modem5g: 等待 /dev/mhi_MBIM ..."
+    local i=0
+    while [ $i -lt 30 ]; do
+        [ -c /dev/mhi_MBIM ] && break
+        sleep 2
+        i=$((i+1))
+    done
+    if [ ! -c /dev/mhi_MBIM ]; then
+        echo "modem5g: /dev/mhi_MBIM 未出现, 放弃拨号"
+        return 1
+    fi
+    echo "modem5g: 开始 MBIM 拨号 (wonet)"
+    start-stop-daemon -S -b -m -p /var/run/quectel_cm.pid \
+        -x /usr/bin/quectel-CM -- -s wonet -f /tmp/quectel_cm.log
+    echo "modem5g: 已启动 quectel-CM"
+}
+
+stop() {
+    echo "modem5g: 停止拨号"
+    start-stop-daemon -K -p /var/run/quectel_cm.pid 2>/dev/null
+    return 0
+}
diff --git a/RM520N-5G/文件/configs/modem_config.txt b/RM520N-5G/文件/configs/modem_config.txt
new file mode 100644
index 0000000..2c3c00d
--- /dev/null
+++ b/RM520N-5G/文件/configs/modem_config.txt
@@ -0,0 +1,25 @@
+
+config global 'global'
+	option enable_dial '1'
+	option modem_number '1'
+	option usb_scan '1'
+	option pci_scan '1'
+	option manual_configuration '1'
+	option network_interface_alias '1'
+
+config modem-device 'modem0'
+	option data_interface 'pci'
+	option path '/sys/devices/pci0000:00/0000:00:0a.0'
+	option driver 'driver'
+	option name 'qualcomm modem'
+	option manufacturer 'quectel'
+	option define_connect '1'
+	option platform 'quectel'
+	list modes 'qmi'
+	list modes 'gobinet'
+	list modes 'ecm'
+	list modes 'mbim'
+	list modes 'rndis'
+	list modes 'ncm'
+	option at_port '/dev/mhi_DUN'
+
diff --git a/RM520N-5G/文件/configs/rc.local b/RM520N-5G/文件/configs/rc.local
new file mode 100644
index 0000000..6327e23
--- /dev/null
+++ b/RM520N-5G/文件/configs/rc.local
@@ -0,0 +1,12 @@
+# Put your custom commands here that should be executed once
+# the system init finished. By default this file does nothing.
+
+# ===== RM520N-GL 说明 (2026-08-20 更新) =====
+# pcie_mhi 驱动由 /etc/modules.d/90-pcie_mhi 开机自动加载(mhi_mbim_enabled=1)。
+# 原生流程即可自启拨号(S95modem5g 等待 /dev/mhi_MBIM 后起 quectel-CM)。
+# 无需在此手动 bind mhi_q —— 手动强绑会抢设备导致 pcie_mhi 失联(SYS_ERR)。
+# 开机自启链路: 90-pcie_mhi(驱动) -> S95modem5g(拨号) -> S96wan5g-route(策略路由+NAT)
+# 诊断: dmesg | grep -iE "mhi|pcie_mhi"; ls /dev/mhi_*
+# 故障处理: 若模块失联且无 /dev/mhi_DUN, 先飞牛断电重启; 若无效再手动:
+#   echo 0000:00:0a.0 > /sys/bus/pci/drivers/mhi_q/bind  # 唤醒(临时)
+exit 0
diff --git a/RM520N-5G/文件/logs/quectel_cm_success_log.txt b/RM520N-5G/文件/logs/quectel_cm_success_log.txt
new file mode 100644
index 0000000..b3440cd
--- /dev/null
+++ b/RM520N-5G/文件/logs/quectel_cm_success_log.txt
@@ -0,0 +1,30 @@
+[08-19_13:00:23:606] HardwareInfo: RM520N-GL
+[08-19_13:00:23:607] mbim_device_services_query()
+[08-19_13:00:23:613] mbim_set_radio_state( 1 )
+[08-19_13:00:23:615] HwRadioState: 1, SwRadioState: 1
+[08-19_13:00:23:615] mbim_subscriber_status_query()
+[08-19_13:00:23:621] SubscriberId: 460092810130406
+[08-19_13:00:23:621] SimIccId:     89860125801671811893
+[08-19_13:00:23:621] SubscriberReadyState NotInitialized -> Initialized 
+[08-19_13:00:23:621] mbim_register_state_query()
+[08-19_13:00:23:628] RegisterState Unknown -> Home 
+[08-19_13:00:23:628] mbim_packet_service_query()
+[08-19_13:00:23:632] PacketServiceState Unknown -> Attached 
+[08-19_13:00:23:632] CurrentDataClass = Custom
+[08-19_13:00:23:632] mbim_query_connect(sessionID=0)
+[08-19_13:00:23:635] ActivationState Unknown -> Deactivated 
+[08-19_13:00:23:635] ip link set dev rmnet_mhi0 down
+[08-19_13:00:23:640] ip addr flush dev rmnet_mhi0.1
+[08-19_13:00:23:644] ip link set dev rmnet_mhi0.1 down
+[08-19_13:00:23:649] mbim_register_state_query()
+[08-19_13:00:23:652] mbim_packet_service_query()
+[08-19_13:00:23:657] CurrentDataClass = Custom
+[08-19_13:00:23:657] mbim_set_connect(onoff=1, sessionID=0)
+[08-19_13:00:23:916] ActivationState Deactivated -> Activated 
+[08-19_13:00:23:916] mbim_ip_config(sessionID=0)
+[08-19_13:00:23:921] < SessionId = 0
+[08-19_13:00:23:921] < IPv4ConfigurationAvailable = 0xf
+[08-19_13:00:23:921] < IPv6ConfigurationAvailable = 0x0
+[08-19_13:00:23:921] < IPv4AddressCount = 0x1
+[08-19_13:00:23:921] < IPv4AddressOffset = 0x3c
+[08-19_13:00:23:921] < IPv6AddressCount = 0x
\ No newline at end of file
diff --git a/RM520N-5G/文件/logs/官方参考_pcie_mhi_mbim.txt b/RM520N-5G/文件/logs/官方参考_pcie_mhi_mbim.txt
new file mode 100644
index 0000000..7a988a9
--- /dev/null
+++ b/RM520N-5G/文件/logs/官方参考_pcie_mhi_mbim.txt
@@ -0,0 +1,80 @@
+root@OpenWrt:/# lspci
+00:00.0 Class 0604: 17cb:1001
+01:00.0 Class ff00: 17cb:0306
+
+root@OpenWrt:/# insmod pcie_mhi.ko mhi_mbim_enabled=1
+[   63.094154] mhi_init Quectel_Linux_PCIE_MHI_Driver_V1.3.0.17
+[   63.094739] mhi_pci_probe pci_dev->name = 0000:01:00.0, domain=0, bus=1, slot=0, vendor=17CB, device=0306
+[   63.099373] mhi_q 0000:01:00.0: BAR 0: assigned [mem 0x48000000-0x48000fff 64bit]
+[   63.108476] mhi_q 0000:01:00.0: enabling device (0140 -> 0142)
+[   63.293451] [I][mhi_netdev_enable_iface] Prepare the channels for transfer
+[   63.324757] [I][mhi_netdev_enable_iface] Exited.
+[   63.326265] rmnet_vnd_register_device(rmnet_mhi0.1)=0
+
+root@OpenWrt:/# quectel-CM -s cment &
+[04-13_09:25:23:910] Quectel_QConnectManager_Linux_V1.6.0.25
+[04-13_09:25:23:912] network interface '' or qmidev '' is not exist
+[04-13_09:25:23:912] netcard driver = pcie_mhi, driver version = V1.3.0.17
+[04-13_09:25:23:913] mbim_qmap_mode = 1, vlan_id = 0x00, qmap_netcard = rmnet_mhi0.1
+[04-13_09:25:23:913] Modem works in MBIM mode
+[04-13_09:25:23:965] cdc_wdm_fd = 7
+[04-13_09:25:23:965] mbim_open_device()
+[04-13_09:25:24:549] mbim_device_caps_query()
+[04-13_09:25:24:575] DeviceId:     869710030002905
+[04-13_09:25:24:575] FirmwareInfo: RM500QGLABR10A03M4G_01.001.03
+[04-13_09:25:24:575] HardwareInfo: RM500QGL_VH
+[04-13_09:25:24:576] mbim_device_services_query()
+[04-13_09:25:24:585] mbim_set_radio_state( 1 )
+[04-13_09:25:24:588] HwRadioState: 1, SwRadioState: 1
+[04-13_09:25:24:588] mbim_subscriber_status_query()
+[04-13_09:25:24:612] SubscriberId: 460028563800461
+[04-13_09:25:24:612] SimIccId:     89860015120716380461
+[04-13_09:25:24:613] SubscriberReadyState NotInitialized -> Initialized 
+[04-13_09:25:24:613] mbim_register_state_query()
+[04-13_09:25:24:617] RegisterState Unknown -> Home 
+[04-13_09:25:24:617] mbim_packet_service_query()
+[04-13_09:25:24:619] PacketServiceState Unknown -> Attached 
+[04-13_09:25:24:619] CurrentDataClass = 5G_NSA
+[04-13_09:25:24:620] mbim_query_connect(sessionID=0)
+[04-13_09:25:24:631] ActivationState Unknown -> Deactivated 
+[04-13_09:25:24:631] ifconfig rmnet_mhi0 down
+[04-13_09:25:24:657] ifconfig rmnet_mhi0.1 0.0.0.0
+ifconfig: SIOCSIFFLAGS: Network is down
+[04-13_09:25:24:681] ifconfig rmnet_mhi0.1 down
+[04-13_09:25:24:705] mbim_register_state_query()
+[04-13_09:25:24:709] mbim_packet_service_query()
+[04-13_09:25:24:713] CurrentDataClass = 5G_NSA
+[04-13_09:25:24:713] mbim_set_connect(onoff=1, sessionID=0)
+[04-13_09:25:25:096] ActivationState Deactivated -> Activated 
+[04-13_09:25:25:097] mbim_ip_config(sessionID=0)
+[04-13_09:25:25:100] < SessionId = 0
+[04-13_09:25:25:100] < IPv4ConfigurationAvailable = 0xf
+[04-13_09:25:25:100] < IPv6ConfigurationAvailable = 0x0
+[04-13_09:25:25:101] < IPv4AddressCount = 0x1
+[04-13_09:25:25:101] < IPv4AddressOffset = 0x3c
+[04-13_09:25:25:101] < IPv6AddressCount = 0x0
+[04-13_09:25:25:102] < IPv6AddressOffset = 0x0
+[04-13_09:25:25:102] < IPv4 = 10.190.166.229/30
+[04-13_09:25:25:103] < gw = 10.190.166.230
+[04-13_09:25:25:103] < dns1 = 211.138.180.2
+[04-13_09:25:25:103] < dns2 = 211.138.180.3
+[04-13_09:25:25:104] < ipv4 mtu = 1500
+[04-13_09:25:25:112] ifconfig rmnet_mhi0 up
+[04-13_09:25:25:141] ifconfig rmnet_mhi0.1 up
+[04-13_09:25:25:170] ip -4 address flush dev rmnet_mhi0.1
+[04-13_09:25:25:190] ip -4 address add 10.190.166.229/30 dev rmnet_mhi0.1
+[04-13_09:25:25:213] ip -4 route add default via 10.190.166.230 dev rmnet_mhi0.1
+
+root@OpenWrt:/# ifconfig rmnet_mhi0.1
+rmnet_mhi0.1 Link encap:Ethernet  HWaddr 02:50:F4:00:00:00  
+          inet addr:10.190.166.229  Mask:255.255.255.252
+          inet6 addr: fe80::50:f4ff:fe00:0/64 Scope:Link
+          UP RUNNING NOARP  MTU:1500  Metric:1
+          RX packets:19 errors:0 dropped:0 overruns:0 frame:0
+          TX packets:29 errors:0 dropped:0 overruns:0 carrier:0
+          collisions:0 txqueuelen:1000 
+          RX bytes:2326 (2.2 KiB)  TX bytes:2991 (2.9 KiB)
+
+root@OpenWrt:/# ping 8.8.8.8
+PING 8.8.8.8 (8.8.8.8): 56 data bytes
+64 bytes from 8.8.8.8: seq=0 ttl=52 time=278.561 ms
diff --git a/RM520N-5G/文件/source/CMakeLists.txt b/RM520N-5G/文件/source/CMakeLists.txt
new file mode 100644
index 0000000..4df0bdb
--- /dev/null
+++ b/RM520N-5G/文件/source/CMakeLists.txt
@@ -0,0 +1,36 @@
+cmake_minimum_required(VERSION 2.4) 
+
+project(quectel-CM) 
+add_definitions(-Wall -Wextra -Werror -O1)
+option(USE_QRTR "Enable QRTR" OFF) 
+
+set( QL_CM_SRC
+     QmiWwanCM.c GobiNetCM.c main.c QCQMUX.c QMIThread.c util.c qmap_bridge_mode.c mbim-cm.c device.c
+     atc.c atchannel.c at_tok.c
+     udhcpc.c
+     )
+
+if(USE_QRTR) 
+add_definitions(-DCONFIG_QRTR)
+set( QRTR_SRC qrtr.c rmnetctl.c)
+endif() 
+
+add_executable(quectel-CM ${QL_CM_SRC} ${QRTR_SRC})
+target_link_libraries(quectel-CM PUBLIC pthread) 
+install (TARGETS quectel-CM DESTINATION bin)
+
+add_executable(quectel-qmi-proxy quectel-qmi-proxy.c)
+target_link_libraries(quectel-qmi-proxy PUBLIC pthread) 
+install (TARGETS quectel-qmi-proxy DESTINATION bin)
+
+add_executable(quectel-mbim-proxy quectel-mbim-proxy.c)
+target_link_libraries(quectel-mbim-proxy PUBLIC pthread) 
+install (TARGETS quectel-mbim-proxy DESTINATION bin)
+
+add_executable(quectel-atc-proxy quectel-atc-proxy.c atchannel.c at_tok.c util.c)
+target_link_libraries(quectel-atc-proxy PUBLIC pthread) 
+install (TARGETS quectel-atc-proxy DESTINATION bin)
+
+#add_executable(quectel-qrtr-proxy quectel-qrtr-proxy.c)
+#target_link_libraries(quectel-qrtr-proxy PUBLIC pthread) 
+#install (TARGETS quectel-qrtr-proxy DESTINATION bin)
diff --git a/RM520N-5G/文件/source/GobiNetCM.c b/RM520N-5G/文件/source/GobiNetCM.c
new file mode 100644
index 0000000..80add0e
--- /dev/null
+++ b/RM520N-5G/文件/source/GobiNetCM.c
@@ -0,0 +1,242 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <stdio.h>
+#include <string.h>
+#include <termios.h>
+#include <stdio.h>
+#include <ctype.h>
+#include "QMIThread.h"
+
+#ifdef CONFIG_GOBINET
+static int qmiclientId[QMUX_TYPE_ALL];
+
+// IOCTL to generate a client ID for this service type
+#define IOCTL_QMI_GET_SERVICE_FILE 0x8BE0 + 1
+
+// IOCTL to get the VIDPID of the device
+#define IOCTL_QMI_GET_DEVICE_VIDPID 0x8BE0 + 2
+
+// IOCTL to get the MEID of the device
+#define IOCTL_QMI_GET_DEVICE_MEID 0x8BE0 + 3
+
+static int GobiNetSendQMI(PQCQMIMSG pRequest) {
+    int ret, fd;
+
+    fd = qmiclientId[pRequest->QMIHdr.QMIType];
+    pRequest->QMIHdr.ClientId = (fd&0xFF) ? fd&0xFF : pRequest->QMIHdr.QMIType;
+
+    if (fd <= 0) {
+        dbg_time("%s QMIType: %d has no clientID", __func__, pRequest->QMIHdr.QMIType);
+        return -ENODEV;
+    }
+
+    // Always ready to write
+    if (1 == 1) {
+        ssize_t nwrites = le16_to_cpu(pRequest->QMIHdr.Length) + 1 - sizeof(QCQMI_HDR);
+        ret = write(fd, &pRequest->MUXMsg, nwrites);
+        if (ret == nwrites) {
+            ret = 0;
+        } else {
+            dbg_time("%s write=%d, errno: %d (%s)", __func__, ret, errno, strerror(errno));
+        }
+    } else {
+        dbg_time("%s poll=%d, errno: %d (%s)", __func__, ret, errno, strerror(errno));
+    }
+
+    return ret;
+}
+
+static int GobiNetGetClientID(const char *qcqmi, UCHAR QMIType) {
+    int ClientId;
+    ClientId = cm_open_dev(qcqmi);
+    if (ClientId == -1) {
+        dbg_time("failed to open %s, errno: %d (%s)", qcqmi, errno, strerror(errno));
+        return 0;
+    }
+
+    if (ioctl(ClientId, IOCTL_QMI_GET_SERVICE_FILE, QMIType) != 0) {
+        dbg_time("failed to get ClientID for 0x%02x errno: %d (%s)", QMIType, errno, strerror(errno));
+        close(ClientId);
+        ClientId = 0;
+    }
+
+    switch (QMIType) {
+        case QMUX_TYPE_WDS: dbg_time("Get clientWDS = %d", ClientId); break;
+        case QMUX_TYPE_DMS: dbg_time("Get clientDMS = %d", ClientId); break;
+        case QMUX_TYPE_NAS: dbg_time("Get clientNAS = %d", ClientId); break;
+        case QMUX_TYPE_QOS: dbg_time("Get clientQOS = %d", ClientId); break;
+        case QMUX_TYPE_WMS: dbg_time("Get clientWMS = %d", ClientId); break;
+        case QMUX_TYPE_PDS: dbg_time("Get clientPDS = %d", ClientId); break;
+        case QMUX_TYPE_UIM: dbg_time("Get clientUIM = %d", ClientId); break;
+        case QMUX_TYPE_COEX: dbg_time("Get clientCOEX = %d", ClientId); break;
+        case QMUX_TYPE_WDS_ADMIN: dbg_time("Get clientWDA = %d", ClientId);
+        break;
+        default: break;
+    }
+
+    return ClientId;
+}
+
+static int GobiNetDeInit(void) {
+    unsigned int i;
+    for (i = 0; i < sizeof(qmiclientId)/sizeof(qmiclientId[0]); i++)
+    {
+        if (qmiclientId[i] != 0)
+        {
+            close(qmiclientId[i]);
+            qmiclientId[i] = 0;
+        }
+    }
+
+    return 0;
+}
+
+static void * GobiNetThread(void *pData) {
+    PROFILE_T *profile = (PROFILE_T *)pData;
+    const char *qcqmi = (const char *)profile->qmichannel;
+    int wait_for_request_quit = 0;   
+    
+    qmiclientId[QMUX_TYPE_WDS] = GobiNetGetClientID(qcqmi, QMUX_TYPE_WDS);
+    if (profile->enable_ipv6)
+        qmiclientId[QMUX_TYPE_WDS_IPV6] = GobiNetGetClientID(qcqmi, QMUX_TYPE_WDS);
+    qmiclientId[QMUX_TYPE_DMS] = GobiNetGetClientID(qcqmi, QMUX_TYPE_DMS);
+    qmiclientId[QMUX_TYPE_NAS] = GobiNetGetClientID(qcqmi, QMUX_TYPE_NAS);
+    qmiclientId[QMUX_TYPE_UIM] = GobiNetGetClientID(qcqmi, QMUX_TYPE_UIM);
+#ifdef CONFIG_COEX_WWAN_STATE
+    qmiclientId[QMUX_TYPE_COEX] = GobiNetGetClientID(qcqmi, QMUX_TYPE_COEX);
+#endif
+    if (profile->qmap_mode == 0 || profile->loopback_state) {//when QMAP enabled, set data format in GobiNet Driver
+        qmiclientId[QMUX_TYPE_WDS_ADMIN] = GobiNetGetClientID(qcqmi, QMUX_TYPE_WDS_ADMIN);
+        profile->wda_client = qmiclientId[QMUX_TYPE_WDS_ADMIN];
+    }
+
+    //donot check clientWDA, there is only one client for WDA, if quectel-CM is killed by SIGKILL, i cannot get client ID for WDA again!
+    if (qmiclientId[QMUX_TYPE_WDS] == 0)  /*|| (clientWDA == -1)*/ {
+        GobiNetDeInit();
+        dbg_time("%s Failed to open %s, errno: %d (%s)", __func__, qcqmi, errno, strerror(errno));
+        qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_DISCONNECTED);
+        pthread_exit(NULL);
+        return NULL;
+    }
+
+    qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_CONNECTED);
+
+    while (1) {
+        struct pollfd pollfds[16] = {{qmidevice_control_fd[1], POLLIN, 0}};
+        int ne, ret, nevents = 1;
+        unsigned int i;
+
+        for (i = 0; i < sizeof(qmiclientId)/sizeof(qmiclientId[0]); i++)
+        {
+            if (qmiclientId[i] != 0)
+            {
+                pollfds[nevents].fd = qmiclientId[i];
+                pollfds[nevents].events = POLLIN;
+                pollfds[nevents].revents = 0;
+                nevents++;
+            }
+        }
+
+        do {
+            ret = poll(pollfds, nevents, wait_for_request_quit ? 1000: -1);
+         } while ((ret < 0) && (errno == EINTR));
+
+	if (ret == 0 && wait_for_request_quit) {
+    		QmiThreadRecvQMI(NULL); //main thread may pending on QmiThreadSendQMI()
+		continue;
+	}
+
+        if (ret <= 0) {
+            dbg_time("%s poll=%d, errno: %d (%s)", __func__, ret, errno, strerror(errno));
+            break;
+        }
+
+        for (ne = 0; ne < nevents; ne++) {
+            int fd = pollfds[ne].fd;
+            short revents = pollfds[ne].revents;
+
+            if (revents & (POLLERR | POLLHUP | POLLNVAL)) {
+                dbg_time("%s poll err/hup/inval", __func__);
+                dbg_time("epoll fd = %d, events = 0x%04x", fd, revents);
+                if (fd == qmidevice_control_fd[1]) {
+                } else {
+                }
+                if (revents & (POLLERR | POLLHUP | POLLNVAL))
+                    goto __GobiNetThread_quit;
+            }
+
+            if ((revents & POLLIN) == 0)
+                continue;
+
+            if (fd == qmidevice_control_fd[1]) {
+                int triger_event;
+                if (read(fd, &triger_event, sizeof(triger_event)) == sizeof(triger_event)) {
+                    //DBG("triger_event = 0x%x", triger_event);
+                    switch (triger_event) {
+                        case RIL_REQUEST_QUIT:
+                            goto __GobiNetThread_quit;
+                        break;
+                        case SIG_EVENT_STOP:
+                            wait_for_request_quit = 1;   
+                        break;
+                        default:
+                        break;
+                    }
+                }
+                continue;
+            }
+
+            {
+                ssize_t nreads;
+                PQCQMIMSG pResponse = (PQCQMIMSG)cm_recv_buf;
+
+                nreads = read(fd, &pResponse->MUXMsg, sizeof(cm_recv_buf) - sizeof(QCQMI_HDR));
+                if (nreads <= 0)
+                {
+                    dbg_time("%s read=%d errno: %d (%s)",  __func__, (int)nreads, errno, strerror(errno));
+                    break;
+                }
+
+                for (i = 0; i < sizeof(qmiclientId)/sizeof(qmiclientId[0]); i++)
+                {
+                    if (qmiclientId[i] == fd)
+                    {
+                        pResponse->QMIHdr.QMIType = i;
+                    }
+                }
+
+                pResponse->QMIHdr.IFType = USB_CTL_MSG_TYPE_QMI;
+                pResponse->QMIHdr.Length = cpu_to_le16(nreads + sizeof(QCQMI_HDR)  - 1);
+                pResponse->QMIHdr.CtlFlags = 0x00;
+                pResponse->QMIHdr.ClientId = (fd&0xFF) ? fd&0xFF : pResponse->QMIHdr.QMIType;;
+
+                QmiThreadRecvQMI(pResponse);
+            }
+        }
+    }
+
+__GobiNetThread_quit:
+    GobiNetDeInit();
+    qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_DISCONNECTED);
+    QmiThreadRecvQMI(NULL); //main thread may pending on QmiThreadSendQMI()
+    dbg_time("%s exit", __func__);
+    pthread_exit(NULL);
+    return NULL;
+}
+
+const struct qmi_device_ops gobi_qmidev_ops = {
+	.deinit = GobiNetDeInit,
+	.send = GobiNetSendQMI,
+	.read = GobiNetThread,
+};
+#endif
+
diff --git a/RM520N-5G/文件/source/NOTICE b/RM520N-5G/文件/source/NOTICE
new file mode 100644
index 0000000..898aac4
--- /dev/null
+++ b/RM520N-5G/文件/source/NOTICE
@@ -0,0 +1,7 @@
+This program is totally open souce code, and public domain software for customers of Quectel company.
+
+The APIs of QMI WWAMN interfaces are defined by Qualcomm. And this program complies with Qualcomm QMI WWAN interfaces specification.
+
+Customers are free to modify the source codes and redistribute them.
+
+For those who is not Quectel's customer, all rights are closed, and any copying and commercial development over this progrma is not allowed. 
diff --git a/RM520N-5G/文件/source/QCQCTL.h b/RM520N-5G/文件/source/QCQCTL.h
new file mode 100644
index 0000000..8a8eb80
--- /dev/null
+++ b/RM520N-5G/文件/source/QCQCTL.h
@@ -0,0 +1,389 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#ifndef QCQCTL_H
+#define QCQCTL_H
+
+#include "QCQMI.h"
+
+#pragma pack(push, 1)
+
+// ================= QMICTL ==================
+
+// QMICTL Control Flags
+#define QMICTL_CTL_FLAG_CMD     0x00
+#define QMICTL_CTL_FLAG_RSP     0x01
+#define QMICTL_CTL_FLAG_IND     0x02
+
+#if 0
+typedef struct _QMICTL_TRANSACTION_ITEM
+{
+   LIST_ENTRY  List;
+   UCHAR       TransactionId;  // QMICTL transaction id
+   PVOID       Context;        // Adapter or IocDev
+   PIRP        Irp;
+} QMICTL_TRANSACTION_ITEM, *PQMICTL_TRANSACTION_ITEM;
+#endif
+
+typedef struct _QCQMICTL_MSG_HDR
+{
+   UCHAR  CtlFlags;  // 00-cmd, 01-rsp, 10-ind
+   UCHAR  TransactionId;
+   USHORT QMICTLType;
+   USHORT Length;
+} __attribute__ ((packed)) QCQMICTL_MSG_HDR, *PQCQMICTL_MSG_HDR;
+
+#define QCQMICTL_MSG_HDR_SIZE sizeof(QCQMICTL_MSG_HDR)
+
+typedef struct _QCQMICTL_MSG_HDR_RESP
+{
+   UCHAR  CtlFlags;  // 00-cmd, 01-rsp, 10-ind
+   UCHAR  TransactionId;
+   USHORT QMICTLType;
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} __attribute__ ((packed)) QCQMICTL_MSG_HDR_RESP, *PQCQMICTL_MSG_HDR_RESP;
+
+typedef struct _QCQMICTL_MSG
+{
+   UCHAR  CtlFlags;  // 00-cmd, 01-rsp, 10-ind
+   UCHAR  TransactionId;
+   USHORT QMICTLType;
+   USHORT Length;
+   UCHAR  Payload;
+} __attribute__ ((packed)) QCQMICTL_MSG, *PQCQMICTL_MSG;
+
+// TLV Header
+typedef struct _QCQMICTL_TLV_HDR
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+} __attribute__ ((packed)) QCQMICTL_TLV_HDR, *PQCQMICTL_TLV_HDR;
+
+#define QCQMICTL_TLV_HDR_SIZE sizeof(QCQMICTL_TLV_HDR)
+
+// QMICTL Type
+#define QMICTL_SET_INSTANCE_ID_REQ    0x0020
+#define QMICTL_SET_INSTANCE_ID_RESP   0x0020
+#define QMICTL_GET_VERSION_REQ        0x0021
+#define QMICTL_GET_VERSION_RESP       0x0021
+#define QMICTL_GET_CLIENT_ID_REQ      0x0022
+#define QMICTL_GET_CLIENT_ID_RESP     0x0022
+#define QMICTL_RELEASE_CLIENT_ID_REQ  0x0023
+#define QMICTL_RELEASE_CLIENT_ID_RESP 0x0023
+#define QMICTL_REVOKE_CLIENT_ID_IND   0x0024
+#define QMICTL_INVALID_CLIENT_ID_IND  0x0025
+#define QMICTL_SET_DATA_FORMAT_REQ    0x0026
+#define QMICTL_SET_DATA_FORMAT_RESP   0x0026
+#define QMICTL_SYNC_REQ               0x0027
+#define QMICTL_SYNC_RESP              0x0027
+#define QMICTL_SYNC_IND               0x0027
+#define QMI_MESSAGE_CTL_INTERNAL_PROXY_OPEN 0xFF00
+
+#define QMICTL_FLAG_REQUEST    0x00
+#define QMICTL_FLAG_RESPONSE   0x01
+#define QMICTL_FLAG_INDICATION 0x02
+
+// QMICTL Message Definitions
+
+typedef struct _QMICTL_SET_INSTANCE_ID_REQ_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_REQUEST
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_SET_INSTANCE_ID_REQ
+   USHORT Length;          // 4
+   UCHAR  TLVType;         // QCTLV_TYPE_REQUIRED_PARAMETER
+   USHORT TLVLength;       // 1
+   UCHAR  Value;           // Host-unique QMI instance for this device driver
+} __attribute__ ((packed)) QMICTL_SET_INSTANCE_ID_REQ_MSG, *PQMICTL_SET_INSTANCE_ID_REQ_MSG;
+
+typedef struct _QMICTL_SET_INSTANCE_ID_RESP_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_RESPONSE
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_SET_INSTANCE_ID_RESP
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_RESULT_CODE
+   USHORT TLVLength;       // 0x0004
+   USHORT QMIResult;
+   USHORT QMIError;
+   UCHAR  TLV2Type;        // QCTLV_TYPE_REQUIRED_PARAMETER
+   USHORT TLV2Length;      // 0x0002
+   USHORT QMI_ID;          // Upper byte is assigned by MSM,
+                           // lower assigned by host
+} __attribute__ ((packed)) QMICTL_SET_INSTANCE_ID_RESP_MSG, *PQMICTL_SET_INSTANCE_ID_RESP_MSG;
+
+typedef struct _QMICTL_GET_VERSION_REQ_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_REQUEST
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_GET_VERSION_REQ
+   USHORT Length;          // 0
+   UCHAR  TLVType;         // QCTLV_TYPE_REQUIRED_PARAMETER
+   USHORT TLVLength;       // var
+   UCHAR  QMUXTypes;       // List of one byte QMUX_TYPE values
+                           // 0xFF returns a list of versions for all
+                           // QMUX_TYPEs implemented on the device
+} __attribute__ ((packed)) QMICTL_GET_VERSION_REQ_MSG, *PQMICTL_GET_VERSION_REQ_MSG;
+
+typedef struct _QMUX_TYPE_VERSION_STRUCT
+{
+   UCHAR  QMUXType;
+   USHORT MajorVersion;
+   USHORT MinorVersion;
+} __attribute__ ((packed)) QMUX_TYPE_VERSION_STRUCT, *PQMUX_TYPE_VERSION_STRUCT;
+
+typedef struct _ADDENDUM_VERSION_PREAMBLE
+{
+   UCHAR LabelLength;
+   UCHAR Label;
+} __attribute__ ((packed)) ADDENDUM_VERSION_PREAMBLE, *PADDENDUM_VERSION_PREAMBLE;
+
+#define QMICTL_GET_VERSION_RSP_TLV_TYPE_VERSION     0x01
+#define QMICTL_GET_VERSION_RSP_TLV_TYPE_ADD_VERSION 0x10
+
+typedef struct _QMICTL_GET_VERSION_RESP_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_RESPONSE
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_GET_VERSION_RESP
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_RESULT_CODE
+   USHORT TLVLength;       // 0x0004
+   USHORT QMIResult;
+   USHORT QMIError;
+   UCHAR  TLV2Type;        // QCTLV_TYPE_REQUIRED_PARAMETER
+   USHORT TLV2Length;      // var
+   UCHAR  NumElements;     // Num of QMUX_TYPE_VERSION_STRUCT
+   QMUX_TYPE_VERSION_STRUCT TypeVersion[0];
+} __attribute__ ((packed)) QMICTL_GET_VERSION_RESP_MSG, *PQMICTL_GET_VERSION_RESP_MSG;
+
+typedef struct _QMICTL_GET_CLIENT_ID_REQ_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_REQUEST
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_GET_CLIENT_ID_REQ
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_REQUIRED_PARAMETER
+   USHORT TLVLength;       // 1
+   UCHAR  QMIType;         // QMUX type
+} __attribute__ ((packed)) QMICTL_GET_CLIENT_ID_REQ_MSG, *PQMICTL_GET_CLIENT_ID_REQ_MSG;
+
+typedef struct _QMICTL_GET_CLIENT_ID_RESP_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_RESPONSE
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_GET_CLIENT_ID_RESP
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_RESULT_CODE
+   USHORT TLVLength;       // 0x0004
+   USHORT QMIResult;       // result code
+   USHORT QMIError;        // error code
+   UCHAR  TLV2Type;        // QCTLV_TYPE_REQUIRED_PARAMETER
+   USHORT TLV2Length;      // 2
+   UCHAR  QMIType;
+   UCHAR  ClientId;
+} __attribute__ ((packed)) QMICTL_GET_CLIENT_ID_RESP_MSG, *PQMICTL_GET_CLIENT_ID_RESP_MSG;
+
+typedef struct _QMICTL_RELEASE_CLIENT_ID_REQ_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_REQUEST
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_RELEASE_CLIENT_ID_REQ
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_REQUIRED_PARAMETER
+   USHORT TLVLength;       // 0x0002
+   UCHAR  QMIType;
+   UCHAR  ClientId;
+} __attribute__ ((packed)) QMICTL_RELEASE_CLIENT_ID_REQ_MSG, *PQMICTL_RELEASE_CLIENT_ID_REQ_MSG;
+
+typedef struct _QMICTL_RELEASE_CLIENT_ID_RESP_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_RESPONSE
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_RELEASE_CLIENT_ID_RESP
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_RESULT_CODE
+   USHORT TLVLength;       // 0x0004
+   USHORT QMIResult;       // result code
+   USHORT QMIError;        // error code
+   UCHAR  TLV2Type;        // QCTLV_TYPE_REQUIRED_PARAMETER
+   USHORT TLV2Length;      // 2
+   UCHAR  QMIType;
+   UCHAR  ClientId;
+} __attribute__ ((packed)) QMICTL_RELEASE_CLIENT_ID_RESP_MSG, *PQMICTL_RELEASE_CLIENT_ID_RESP_MSG;
+
+typedef struct _QMICTL_REVOKE_CLIENT_ID_IND_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_INDICATION
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_REVOKE_CLIENT_ID_IND
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_REQUIRED_PARAMETER
+   USHORT TLVLength;       // 0x0002
+   UCHAR  QMIType;
+   UCHAR  ClientId;
+} __attribute__ ((packed)) QMICTL_REVOKE_CLIENT_ID_IND_MSG, *PQMICTL_REVOKE_CLIENT_ID_IND_MSG;
+
+typedef struct _QMICTL_INVALID_CLIENT_ID_IND_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_INDICATION
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_REVOKE_CLIENT_ID_IND
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_REQUIRED_PARAMETER
+   USHORT TLVLength;       // 0x0002
+   UCHAR  QMIType;
+   UCHAR  ClientId;
+} __attribute__ ((packed)) QMICTL_INVALID_CLIENT_ID_IND_MSG, *PQMICTL_INVALID_CLIENT_ID_IND_MSG;
+
+typedef struct _QMICTL_SET_DATA_FORMAT_REQ_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_REQUEST
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_SET_DATA_FORMAT_REQ
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_REQUIRED_PARAMETER
+   USHORT TLVLength;       // 1
+   UCHAR  DataFormat;      // 0-default; 1-QoS hdr present
+} __attribute__ ((packed)) QMICTL_SET_DATA_FORMAT_REQ_MSG, *PQMICTL_SET_DATA_FORMAT_REQ_MSG;
+
+#ifdef QC_IP_MODE
+#define SET_DATA_FORMAT_TLV_TYPE_LINK_PROTO 0x10
+#define SET_DATA_FORMAT_LINK_PROTO_ETH      0x0001
+#define SET_DATA_FORMAT_LINK_PROTO_IP       0x0002
+typedef struct _QMICTL_SET_DATA_FORMAT_TLV_LINK_PROT
+{
+   UCHAR  TLVType;         // Link-Layer Protocol
+   USHORT TLVLength;       // 2
+   USHORT LinkProt;        // 0x1: ETH; 0x2: IP
+} QMICTL_SET_DATA_FORMAT_TLV_LINK_PROT, *PQMICTL_SET_DATA_FORMAT_TLV_LINK_PROT;
+
+#ifdef QCMP_UL_TLP
+#define SET_DATA_FORMAT_TLV_TYPE_UL_TLP 0x11
+typedef struct _QMICTL_SET_DATA_FORMAT_TLV_UL_TLP
+{
+   UCHAR  TLVType;         // 0x11, Uplink TLP Setting
+   USHORT TLVLength;       // 1
+   UCHAR  UlTlpSetting;    // 0x0: Disable; 0x01: Enable
+} QMICTL_SET_DATA_FORMAT_TLV_UL_TLP, *PQMICTL_SET_DATA_FORMAT_TLV_UL_TLP;
+#endif // QCMP_UL_TLP
+
+#ifdef QCMP_DL_TLP
+#define SET_DATA_FORMAT_TLV_TYPE_DL_TLP 0x13
+typedef struct _QMICTL_SET_DATA_FORMAT_TLV_DL_TLP
+{
+   UCHAR  TLVType;         // 0x11, Uplink TLP Setting
+   USHORT TLVLength;       // 1
+   UCHAR  DlTlpSetting;    // 0x0: Disable; 0x01: Enable
+} QMICTL_SET_DATA_FORMAT_TLV_DL_TLP, *PQMICTL_SET_DATA_FORMAT_TLV_DL_TLP;
+#endif // QCMP_DL_TLP
+
+#endif // QC_IP_MODE
+
+#ifdef MP_QCQOS_ENABLED
+#define SET_DATA_FORMAT_TLV_TYPE_QOS_SETTING 0x12
+typedef struct _QMICTL_SET_DATA_FORMAT_TLV_QOS_SETTING
+{
+   UCHAR  TLVType;       // 0x12, QoS setting
+   USHORT TLVLength;     // 1
+   UCHAR  QosSetting;    // 0x0: Disable; 0x01: Enable
+} QMICTL_SET_DATA_FORMAT_TLV_QOS_SETTING, *PQMICTL_SET_DATA_FORMAT_TLV_QOS_SETTING;
+#endif // MP_QCQOS_ENABLED
+
+typedef struct _QMICTL_SET_DATA_FORMAT_RESP_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_RESPONSE
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_SET_DATA_FORMAT_RESP
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_RESULT_CODE
+   USHORT TLVLength;       // 0x0004
+   USHORT QMIResult;       // result code
+   USHORT QMIError;        // error code
+} __attribute__ ((packed)) QMICTL_SET_DATA_FORMAT_RESP_MSG, *PQMICTL_SET_DATA_FORMAT_RESP_MSG;
+
+typedef struct _QMICTL_SYNC_REQ_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_REQUEST
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_CTL_SYNC_REQ
+   USHORT Length;          // 0
+} __attribute__ ((packed)) QMICTL_SYNC_REQ_MSG, *PQMICTL_SYNC_REQ_MSG;
+
+typedef struct _QMICTL_SYNC_RESP_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_RESPONSE
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_CTL_SYNC_RESP
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_RESULT_CODE
+   USHORT TLVLength;       // 0x0004
+   USHORT QMIResult;
+   USHORT QMIError;
+} __attribute__ ((packed)) QMICTL_SYNC_RESP_MSG, *PQMICTL_SYNC_RESP_MSG;
+
+typedef struct _QMICTL_SYNC_IND_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_INDICATION
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_REVOKE_CLIENT_ID_IND
+   USHORT Length;
+} __attribute__ ((packed)) QMICTL_SYNC_IND_MSG, *PQMICTL_SYNC_IND_MSG;
+
+typedef struct _QMICTL_LIBQMI_PROXY_OPEN_MSG
+{
+   UCHAR  CtlFlags;        // QMICTL_FLAG_RESPONSE
+   UCHAR  TransactionId;
+   USHORT QMICTLType;      // QMICTL_SET_DATA_FORMAT_RESP
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_RESULT_CODE
+   USHORT TLVLength;       // 0x0004
+   char device_path[0];       // result code
+} __attribute__ ((packed)) QMICTL_LIBQMI_PROXY_OPEN_MSG, *PQMICTL_LIBQMI_PROXY_OPEN_MSG;
+
+typedef struct _QMICTL_MSG
+{
+   union
+   {
+      // Message Header
+      QCQMICTL_MSG_HDR                             QMICTLMsgHdr;
+      QCQMICTL_MSG_HDR_RESP                             QMICTLMsgHdrRsp;
+
+      // QMICTL Message
+      QMICTL_SET_INSTANCE_ID_REQ_MSG               SetInstanceIdReq;
+      QMICTL_SET_INSTANCE_ID_RESP_MSG              SetInstanceIdRsp;
+      QMICTL_GET_VERSION_REQ_MSG                   GetVersionReq;
+      QMICTL_GET_VERSION_RESP_MSG                  GetVersionRsp;
+      QMICTL_GET_CLIENT_ID_REQ_MSG                 GetClientIdReq;
+      QMICTL_GET_CLIENT_ID_RESP_MSG                GetClientIdRsp;
+      QMICTL_RELEASE_CLIENT_ID_REQ_MSG             ReleaseClientIdReq;
+      QMICTL_RELEASE_CLIENT_ID_RESP_MSG            ReleaseClientIdRsp;
+      QMICTL_REVOKE_CLIENT_ID_IND_MSG              RevokeClientIdInd;
+      QMICTL_INVALID_CLIENT_ID_IND_MSG             InvalidClientIdInd;
+      QMICTL_SET_DATA_FORMAT_REQ_MSG               SetDataFormatReq;
+      QMICTL_SET_DATA_FORMAT_RESP_MSG              SetDataFormatRsp;
+      QMICTL_SYNC_REQ_MSG                          SyncReq;
+      QMICTL_SYNC_RESP_MSG                         SyncRsp;
+      QMICTL_SYNC_IND_MSG                          SyncInd;
+      QMICTL_LIBQMI_PROXY_OPEN_MSG          LibQmiProxyOpenReq;
+   };
+} __attribute__ ((packed)) QMICTL_MSG, *PQMICTL_MSG;
+#pragma pack(pop)
+
+#endif //QCQCTL_H
\ No newline at end of file
diff --git a/RM520N-5G/文件/source/QCQMI.h b/RM520N-5G/文件/source/QCQMI.h
new file mode 100644
index 0000000..ec01905
--- /dev/null
+++ b/RM520N-5G/文件/source/QCQMI.h
@@ -0,0 +1,316 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+
+#ifndef USBQMI_H
+#define USBQMI_H
+
+typedef uint8_t uint8;
+typedef int8_t int8;
+typedef uint16_t uint16;
+typedef int16_t int16;
+typedef uint32_t uint32;
+typedef uint64_t uint64;
+
+typedef signed char    CHAR;
+typedef unsigned char   UCHAR;
+typedef short   SHORT;
+typedef unsigned short   USHORT;
+typedef int   INT;
+typedef unsigned int   UINT;
+typedef long    LONG;
+typedef unsigned int   ULONG;
+typedef unsigned long long   ULONG64;
+typedef signed char   *PCHAR;
+typedef unsigned char   *PUCHAR;
+typedef int   *PINT;
+typedef int   BOOL;
+
+#define TRUE (1 == 1)
+#define FALSE (1 != 1)
+
+#define QMICTL_SUPPORTED_MAJOR_VERSION 1
+#define QMICTL_SUPPORTED_MINOR_VERSION 0
+
+#pragma pack(push, 1)
+
+// ========= USB Control Message ==========
+
+#define USB_CTL_MSG_TYPE_QMI 0x01
+
+// USB Control Message
+typedef struct _QCUSB_CTL_MSG_HDR
+{
+   UCHAR IFType;
+} __attribute__ ((packed)) QCUSB_CTL_MSG_HDR, *PQCUSB_CTL_MSG_HDR;
+
+#define QCUSB_CTL_MSG_HDR_SIZE sizeof(QCUSB_CTL_MSG_HDR)
+
+typedef struct _QCUSB_CTL_MSG
+{
+   UCHAR IFType;
+   UCHAR Message;
+} __attribute__ ((packed)) QCUSB_CTL_MSG, *PQCUSB_CTL_MSG;
+
+#define QCTLV_TYPE_REQUIRED_PARAMETER 0x01
+#define QCTLV_TYPE_RESULT_CODE        0x02
+
+// ================= QMI ==================
+
+// Define QMI Type
+typedef enum _QMI_SERVICE_TYPE
+{
+   QMUX_TYPE_CTL  = 0x00,
+   QMUX_TYPE_WDS  = 0x01,
+   QMUX_TYPE_DMS  = 0x02,
+   QMUX_TYPE_NAS  = 0x03,
+   QMUX_TYPE_QOS  = 0x04,
+   QMUX_TYPE_WMS  = 0x05,
+   QMUX_TYPE_PDS  = 0x06,
+   QMUX_TYPE_UIM  = 0x0B,
+   QMUX_TYPE_WDS_IPV6  = 0x11,
+   QMUX_TYPE_WDS_ADMIN  = 0x1A,
+   QMUX_TYPE_COEX  = 0x22,
+   QMUX_TYPE_MAX  = 0xFF,
+   QMUX_TYPE_ALL  = 0xFF
+} QMI_SERVICE_TYPE;
+
+typedef enum _QMI_RESULT_CODE_TYPE
+{
+   QMI_RESULT_SUCCESS = 0x0000,
+   QMI_RESULT_FAILURE = 0x0001
+} QMI_RESULT_CODE_TYPE;
+
+typedef enum _QMI_ERROR_CODE_TYPE
+{
+    QMI_ERR_NONE  = 0x0000
+    ,QMI_ERR_MALFORMED_MSG  = 0x0001
+    ,QMI_ERR_NO_MEMORY  = 0x0002
+    ,QMI_ERR_INTERNAL  = 0x0003
+    ,QMI_ERR_ABORTED  = 0x0004
+    ,QMI_ERR_CLIENT_IDS_EXHAUSTED  = 0x0005
+    ,QMI_ERR_UNABORTABLE_TRANSACTION  = 0x0006
+    ,QMI_ERR_INVALID_CLIENT_ID  = 0x0007
+    ,QMI_ERR_NO_THRESHOLDS  = 0x0008
+    ,QMI_ERR_INVALID_HANDLE  = 0x0009
+    ,QMI_ERR_INVALID_PROFILE  = 0x000A
+    ,QMI_ERR_INVALID_PINID  = 0x000B
+    ,QMI_ERR_INCORRECT_PIN  = 0x000C
+    ,QMI_ERR_NO_NETWORK_FOUND  = 0x000D
+    ,QMI_ERR_CALL_FAILED  = 0x000E
+    ,QMI_ERR_OUT_OF_CALL  = 0x000F
+    ,QMI_ERR_NOT_PROVISIONED  = 0x0010
+    ,QMI_ERR_MISSING_ARG  = 0x0011
+    ,QMI_ERR_ARG_TOO_LONG  = 0x0013
+    ,QMI_ERR_INVALID_TX_ID  = 0x0016
+    ,QMI_ERR_DEVICE_IN_USE  = 0x0017
+    ,QMI_ERR_OP_NETWORK_UNSUPPORTED  = 0x0018
+    ,QMI_ERR_OP_DEVICE_UNSUPPORTED  = 0x0019
+    ,QMI_ERR_NO_EFFECT  = 0x001A
+    ,QMI_ERR_NO_FREE_PROFILE  = 0x001B
+    ,QMI_ERR_INVALID_PDP_TYPE  = 0x001C
+    ,QMI_ERR_INVALID_TECH_PREF  = 0x001D
+    ,QMI_ERR_INVALID_PROFILE_TYPE  = 0x001E
+    ,QMI_ERR_INVALID_SERVICE_TYPE  = 0x001F
+    ,QMI_ERR_INVALID_REGISTER_ACTION  = 0x0020
+    ,QMI_ERR_INVALID_PS_ATTACH_ACTION  = 0x0021
+    ,QMI_ERR_AUTHENTICATION_FAILED  = 0x0022
+    ,QMI_ERR_PIN_BLOCKED  = 0x0023
+    ,QMI_ERR_PIN_PERM_BLOCKED  = 0x0024
+    ,QMI_ERR_SIM_NOT_INITIALIZED  = 0x0025
+    ,QMI_ERR_MAX_QOS_REQUESTS_IN_USE  = 0x0026
+    ,QMI_ERR_INCORRECT_FLOW_FILTER  = 0x0027
+    ,QMI_ERR_NETWORK_QOS_UNAWARE  = 0x0028
+    ,QMI_ERR_INVALID_QOS_ID  = 0x0029
+    ,QMI_ERR_INVALID_ID  = 0x0029
+    ,QMI_ERR_REQUESTED_NUM_UNSUPPORTED  = 0x002A
+    ,QMI_ERR_INTERFACE_NOT_FOUND  = 0x002B
+    ,QMI_ERR_FLOW_SUSPENDED  = 0x002C
+    ,QMI_ERR_INVALID_DATA_FORMAT  = 0x002D
+    ,QMI_ERR_GENERAL  = 0x002E
+    ,QMI_ERR_UNKNOWN  = 0x002F
+    ,QMI_ERR_INVALID_ARG  = 0x0030
+    ,QMI_ERR_INVALID_INDEX  = 0x0031
+    ,QMI_ERR_NO_ENTRY  = 0x0032
+    ,QMI_ERR_DEVICE_STORAGE_FULL  = 0x0033
+    ,QMI_ERR_DEVICE_NOT_READY  = 0x0034
+    ,QMI_ERR_NETWORK_NOT_READY  = 0x0035
+    ,QMI_ERR_CAUSE_CODE  = 0x0036
+    ,QMI_ERR_MESSAGE_NOT_SENT  = 0x0037
+    ,QMI_ERR_MESSAGE_DELIVERY_FAILURE  = 0x0038
+    ,QMI_ERR_INVALID_MESSAGE_ID  = 0x0039
+    ,QMI_ERR_ENCODING  = 0x003A
+    ,QMI_ERR_AUTHENTICATION_LOCK  = 0x003B
+    ,QMI_ERR_INVALID_TRANSITION  = 0x003C
+    ,QMI_ERR_NOT_A_MCAST_IFACE  = 0x003D
+    ,QMI_ERR_MAX_MCAST_REQUESTS_IN_USE  = 0x003E
+    ,QMI_ERR_INVALID_MCAST_HANDLE = 0x003F
+    ,QMI_ERR_INVALID_IP_FAMILY_PREF  = 0x0040
+    ,QMI_ERR_SESSION_INACTIVE  = 0x0041
+    ,QMI_ERR_SESSION_INVALID  = 0x0042
+    ,QMI_ERR_SESSION_OWNERSHIP  = 0x0043
+    ,QMI_ERR_INSUFFICIENT_RESOURCES  = 0x0044
+    ,QMI_ERR_DISABLED  = 0x0045
+    ,QMI_ERR_INVALID_OPERATION  = 0x0046
+    ,QMI_ERR_INVALID_QMI_CMD  = 0x0047
+    ,QMI_ERR_TPDU_TYPE  = 0x0048
+    ,QMI_ERR_SMSC_ADDR  = 0x0049
+    ,QMI_ERR_INFO_UNAVAILABLE  = 0x004A
+    ,QMI_ERR_SEGMENT_TOO_LONG  = 0x004B
+    ,QMI_ERR_SEGMENT_ORDER  = 0x004C
+    ,QMI_ERR_BUNDLING_NOT_SUPPORTED  = 0x004D
+    ,QMI_ERR_OP_PARTIAL_FAILURE  = 0x004E
+    ,QMI_ERR_POLICY_MISMATCH  = 0x004F
+    ,QMI_ERR_SIM_FILE_NOT_FOUND  = 0x0050
+    ,QMI_ERR_EXTENDED_INTERNAL  = 0x0051
+    ,QMI_ERR_ACCESS_DENIED  = 0x0052
+    ,QMI_ERR_HARDWARE_RESTRICTED  = 0x0053
+    ,QMI_ERR_ACK_NOT_SENT  = 0x0054
+    ,QMI_ERR_INJECT_TIMEOUT  = 0x0055
+    ,QMI_ERR_INCOMPATIBLE_STATE = 0x005A
+    ,QMI_ERR_FDN_RESTRICT  = 0x005B
+    ,QMI_ERR_SUPS_FAILURE_CAUSE  = 0x005C
+    ,QMI_ERR_NO_RADIO  = 0x005D
+    ,QMI_ERR_NOT_SUPPORTED  = 0x005E
+    ,QMI_ERR_NO_SUBSCRIPTION  = 0x005F
+    ,QMI_ERR_CARD_CALL_CONTROL_FAILED  = 0x0060
+    ,QMI_ERR_NETWORK_ABORTED  = 0x0061
+    ,QMI_ERR_MSG_BLOCKED  = 0x0062
+    ,QMI_ERR_INVALID_SESSION_TYPE  = 0x0064
+    ,QMI_ERR_INVALID_PB_TYPE  = 0x0065
+    ,QMI_ERR_NO_SIM  = 0x0066
+    ,QMI_ERR_PB_NOT_READY  = 0x0067
+    ,QMI_ERR_PIN_RESTRICTION  = 0x0068
+    ,QMI_ERR_PIN2_RESTRICTION  = 0x0069
+    ,QMI_ERR_PUK_RESTRICTION  = 0x006A
+    ,QMI_ERR_PUK2_RESTRICTION  = 0x006B
+    ,QMI_ERR_PB_ACCESS_RESTRICTED  = 0x006C
+    ,QMI_ERR_PB_DELETE_IN_PROG  = 0x006D
+    ,QMI_ERR_PB_TEXT_TOO_LONG  = 0x006E
+    ,QMI_ERR_PB_NUMBER_TOO_LONG  = 0x006F
+    ,QMI_ERR_PB_HIDDEN_KEY_RESTRICTION  = 0x0070
+} QMI_ERROR_CODE_TYPE;
+
+#define QCQMI_CTL_FLAG_SERVICE   0x80
+#define QCQMI_CTL_FLAG_CTL_POINT 0x00
+
+typedef struct _QCQMI_HDR
+{
+   UCHAR  IFType;
+   USHORT Length;
+   UCHAR  CtlFlags;  // reserved
+   UCHAR  QMIType;
+   UCHAR  ClientId;
+} __attribute__ ((packed)) QCQMI_HDR, *PQCQMI_HDR;
+
+#define QCQMI_HDR_SIZE (sizeof(QCQMI_HDR)-1)
+
+typedef struct _QCQMI
+{
+   UCHAR  IFType;
+   USHORT Length;
+   UCHAR  CtlFlags;  // reserved
+   UCHAR  QMIType;
+   UCHAR  ClientId;
+   UCHAR  SDU;
+} __attribute__ ((packed)) QCQMI, *PQCQMI;
+
+typedef struct _QMI_SERVICE_VERSION
+{
+   USHORT Major;
+   USHORT Minor;
+   USHORT AddendumMajor;
+   USHORT AddendumMinor;
+} __attribute__ ((packed)) QMI_SERVICE_VERSION, *PQMI_SERVICE_VERSION;
+
+// ================= QMUX ==================
+
+#define QMUX_MSG_OVERHEAD_BYTES 4  // Type(USHORT) Length(USHORT) -- header
+
+#define QMUX_BROADCAST_CID 0xFF
+
+typedef struct _QCQMUX_HDR
+{
+   UCHAR  CtlFlags;      // 0: single QMUX Msg; 1:
+   USHORT TransactionId;
+} __attribute__ ((packed)) QCQMUX_HDR, *PQCQMUX_HDR;
+
+typedef struct _QCQMUX
+{
+   UCHAR  CtlFlags;      // 0: single QMUX Msg; 1:
+   USHORT TransactionId;
+   UCHAR  Message;  // Type(2), Length(2), Value
+} __attribute__ ((packed)) QCQMUX, *PQCQMUX;
+
+#define QCQMUX_HDR_SIZE sizeof(QCQMUX_HDR)
+
+typedef struct _QCQMUX_MSG_HDR
+{
+   USHORT Type;
+   USHORT Length;
+} __attribute__ ((packed)) QCQMUX_MSG_HDR, *PQCQMUX_MSG_HDR;
+
+#define QCQMUX_MSG_HDR_SIZE sizeof(QCQMUX_MSG_HDR)
+
+typedef struct _QCQMUX_MSG_HDR_RESP
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} __attribute__ ((packed)) QCQMUX_MSG_HDR_RESP, *PQCQMUX_MSG_HDR_RESP;
+
+typedef struct _QCQMUX_TLV
+{
+   UCHAR Type;
+   USHORT Length;
+   UCHAR  Value;
+} __attribute__ ((packed)) QCQMUX_TLV, *PQCQMUX_TLV;
+
+typedef struct _QMI_TLV_HDR
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+} __attribute__ ((packed)) QMI_TLV_HDR, *PQMI_TLV_HDR;
+
+typedef struct _QMI_TLV
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   union {
+        int8_t s8;
+        uint8_t u8;
+        int16_t s16;
+        uint16_t u16;
+        int32_t s32;
+        uint32_t u32;
+        uint64_t u64;
+   };
+} __attribute__ ((packed)) QMI_TLV, *PQMI_TLV;
+
+// QMUX Message Definitions -- QMI SDU
+#define QMUX_CTL_FLAG_SINGLE_MSG    0x00
+#define QMUX_CTL_FLAG_COMPOUND_MSG  0x01
+#define QMUX_CTL_FLAG_TYPE_CMD      0x00
+#define QMUX_CTL_FLAG_TYPE_RSP      0x02
+#define QMUX_CTL_FLAG_TYPE_IND      0x04
+#define QMUX_CTL_FLAG_MASK_COMPOUND 0x01
+#define QMUX_CTL_FLAG_MASK_TYPE     0x06 // 00-cmd, 01-rsp, 10-ind
+
+#pragma pack(pop)
+
+#endif // USBQMI_H
diff --git a/RM520N-5G/文件/source/QCQMUX.c b/RM520N-5G/文件/source/QCQMUX.c
new file mode 100644
index 0000000..2cefc7f
--- /dev/null
+++ b/RM520N-5G/文件/source/QCQMUX.c
@@ -0,0 +1,472 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include "QMIThread.h"
+static char line[1024];
+static pthread_mutex_t dumpQMIMutex = PTHREAD_MUTEX_INITIALIZER;
+#undef dbg
+#define dbg( format, arg... ) do {if (strlen(line) < sizeof(line)) snprintf(&line[strlen(line)], sizeof(line) - strlen(line), format, ## arg);} while (0)
+
+PQMI_TLV_HDR GetTLV (PQCQMUX_MSG_HDR pQMUXMsgHdr, int TLVType);
+
+typedef struct {
+    UINT type;
+    const char *name;
+} QMI_NAME_T;
+
+#define qmi_name_item(type) {type, #type}
+
+#if 0
+static const QMI_NAME_T qmi_IFType[] = {
+{USB_CTL_MSG_TYPE_QMI, "USB_CTL_MSG_TYPE_QMI"},
+};
+
+static const QMI_NAME_T qmi_CtlFlags[] = {
+qmi_name_item(QMICTL_CTL_FLAG_CMD),
+qmi_name_item(QCQMI_CTL_FLAG_SERVICE),
+};
+
+static const QMI_NAME_T qmi_QMIType[] = {
+qmi_name_item(QMUX_TYPE_CTL),
+qmi_name_item(QMUX_TYPE_WDS),
+qmi_name_item(QMUX_TYPE_DMS),
+qmi_name_item(QMUX_TYPE_NAS),
+qmi_name_item(QMUX_TYPE_QOS),
+qmi_name_item(QMUX_TYPE_WMS),
+qmi_name_item(QMUX_TYPE_PDS),
+qmi_name_item(QMUX_TYPE_WDS_ADMIN),
+qmi_name_item(QMUX_TYPE_COEX),
+};
+
+static const QMI_NAME_T qmi_ctl_CtlFlags[] = {
+qmi_name_item(QMICTL_FLAG_REQUEST),
+qmi_name_item(QMICTL_FLAG_RESPONSE),
+qmi_name_item(QMICTL_FLAG_INDICATION),
+};
+#endif
+
+static const QMI_NAME_T qmux_ctl_QMICTLType[] = {
+// QMICTL Type
+qmi_name_item(QMICTL_SET_INSTANCE_ID_REQ), //    0x0020
+qmi_name_item(QMICTL_SET_INSTANCE_ID_RESP), //   0x0020
+qmi_name_item(QMICTL_GET_VERSION_REQ), //        0x0021
+qmi_name_item(QMICTL_GET_VERSION_RESP), //       0x0021
+qmi_name_item(QMICTL_GET_CLIENT_ID_REQ), //      0x0022
+qmi_name_item(QMICTL_GET_CLIENT_ID_RESP), //     0x0022
+qmi_name_item(QMICTL_RELEASE_CLIENT_ID_REQ), //  0x0023
+qmi_name_item(QMICTL_RELEASE_CLIENT_ID_RESP), // 0x0023
+qmi_name_item(QMICTL_REVOKE_CLIENT_ID_IND), //   0x0024
+qmi_name_item(QMICTL_INVALID_CLIENT_ID_IND), //  0x0025
+qmi_name_item(QMICTL_SET_DATA_FORMAT_REQ), //    0x0026
+qmi_name_item(QMICTL_SET_DATA_FORMAT_RESP), //   0x0026
+qmi_name_item(QMICTL_SYNC_REQ), //               0x0027
+qmi_name_item(QMICTL_SYNC_RESP), //              0x0027
+qmi_name_item(QMICTL_SYNC_IND), //               0x0027
+};
+
+static const QMI_NAME_T qmux_CtlFlags[] = {
+qmi_name_item(QMUX_CTL_FLAG_TYPE_CMD),
+qmi_name_item(QMUX_CTL_FLAG_TYPE_RSP),
+qmi_name_item(QMUX_CTL_FLAG_TYPE_IND),
+};
+
+
+static const QMI_NAME_T qmux_wds_Type[] = {
+qmi_name_item(QMIWDS_SET_EVENT_REPORT_REQ), //           0x0001
+qmi_name_item(QMIWDS_SET_EVENT_REPORT_RESP), //          0x0001
+qmi_name_item(QMIWDS_EVENT_REPORT_IND), //               0x0001
+qmi_name_item(QMIWDS_START_NETWORK_INTERFACE_REQ), //    0x0020
+qmi_name_item(QMIWDS_START_NETWORK_INTERFACE_RESP), //   0x0020
+qmi_name_item(QMIWDS_STOP_NETWORK_INTERFACE_REQ), //     0x0021
+qmi_name_item(QMIWDS_STOP_NETWORK_INTERFACE_RESP), //    0x0021
+qmi_name_item(QMIWDS_GET_PKT_SRVC_STATUS_REQ), //        0x0022
+qmi_name_item(QMIWDS_GET_PKT_SRVC_STATUS_RESP), //       0x0022
+qmi_name_item(QMIWDS_GET_PKT_SRVC_STATUS_IND), //        0x0022  
+qmi_name_item(QMIWDS_GET_CURRENT_CHANNEL_RATE_REQ), //   0x0023  
+qmi_name_item(QMIWDS_GET_CURRENT_CHANNEL_RATE_RESP), //  0x0023  
+qmi_name_item(QMIWDS_GET_PKT_STATISTICS_REQ), //         0x0024  
+qmi_name_item(QMIWDS_GET_PKT_STATISTICS_RESP), //        0x0024  
+qmi_name_item(QMIWDS_MODIFY_PROFILE_SETTINGS_REQ), //    0x0028
+qmi_name_item(QMIWDS_MODIFY_PROFILE_SETTINGS_RESP), //   0x0028
+qmi_name_item(QMIWDS_GET_PROFILE_SETTINGS_REQ), //    0x002B
+qmi_name_item(QMIWDS_GET_PROFILE_SETTINGS_RESP), //   0x002BD
+qmi_name_item(QMIWDS_GET_DEFAULT_SETTINGS_REQ), //       0x002C
+qmi_name_item(QMIWDS_GET_DEFAULT_SETTINGS_RESP), //      0x002C
+qmi_name_item(QMIWDS_GET_RUNTIME_SETTINGS_REQ), //       0x002D
+qmi_name_item(QMIWDS_GET_RUNTIME_SETTINGS_RESP), //      0x002D
+qmi_name_item(QMIWDS_GET_MIP_MODE_REQ), //               0x002F
+qmi_name_item(QMIWDS_GET_MIP_MODE_RESP), //              0x002F
+qmi_name_item(QMIWDS_GET_DATA_BEARER_REQ), //            0x0037
+qmi_name_item(QMIWDS_GET_DATA_BEARER_RESP), //           0x0037
+qmi_name_item(QMIWDS_DUN_CALL_INFO_REQ), //              0x0038
+qmi_name_item(QMIWDS_DUN_CALL_INFO_RESP), //             0x0038
+qmi_name_item(QMIWDS_DUN_CALL_INFO_IND), //              0x0038
+qmi_name_item(QMIWDS_SET_CLIENT_IP_FAMILY_PREF_REQ), //  0x004D  
+qmi_name_item(QMIWDS_SET_CLIENT_IP_FAMILY_PREF_RESP), // 0x004D  
+qmi_name_item(QMIWDS_SET_AUTO_CONNECT_REQ), //  0x0051  
+qmi_name_item(QMIWDS_SET_AUTO_CONNECT_RESP), // 0x0051
+qmi_name_item(QMIWDS_BIND_MUX_DATA_PORT_REQ), //         0x00A2  
+qmi_name_item(QMIWDS_BIND_MUX_DATA_PORT_RESP), //        0x00A2  
+};
+
+static const QMI_NAME_T qmux_dms_Type[] = {
+// ======================= DMS ==============================
+qmi_name_item(QMIDMS_SET_EVENT_REPORT_REQ), //           0x0001
+qmi_name_item(QMIDMS_SET_EVENT_REPORT_RESP), //          0x0001
+qmi_name_item(QMIDMS_EVENT_REPORT_IND), //               0x0001
+qmi_name_item(QMIDMS_GET_DEVICE_CAP_REQ), //             0x0020
+qmi_name_item(QMIDMS_GET_DEVICE_CAP_RESP), //            0x0020
+qmi_name_item(QMIDMS_GET_DEVICE_MFR_REQ), //             0x0021
+qmi_name_item(QMIDMS_GET_DEVICE_MFR_RESP), //            0x0021
+qmi_name_item(QMIDMS_GET_DEVICE_MODEL_ID_REQ), //        0x0022
+qmi_name_item(QMIDMS_GET_DEVICE_MODEL_ID_RESP), //       0x0022
+qmi_name_item(QMIDMS_GET_DEVICE_REV_ID_REQ), //          0x0023
+qmi_name_item(QMIDMS_GET_DEVICE_REV_ID_RESP), //         0x0023
+qmi_name_item(QMIDMS_GET_MSISDN_REQ), //                 0x0024
+qmi_name_item(QMIDMS_GET_MSISDN_RESP), //                0x0024
+qmi_name_item(QMIDMS_GET_DEVICE_SERIAL_NUMBERS_REQ), //  0x0025
+qmi_name_item(QMIDMS_GET_DEVICE_SERIAL_NUMBERS_RESP), // 0x0025
+qmi_name_item(QMIDMS_UIM_SET_PIN_PROTECTION_REQ), //     0x0027
+qmi_name_item(QMIDMS_UIM_SET_PIN_PROTECTION_RESP), //    0x0027
+qmi_name_item(QMIDMS_UIM_VERIFY_PIN_REQ), //             0x0028
+qmi_name_item(QMIDMS_UIM_VERIFY_PIN_RESP), //            0x0028
+qmi_name_item(QMIDMS_UIM_UNBLOCK_PIN_REQ), //            0x0029
+qmi_name_item(QMIDMS_UIM_UNBLOCK_PIN_RESP), //           0x0029
+qmi_name_item(QMIDMS_UIM_CHANGE_PIN_REQ), //             0x002A
+qmi_name_item(QMIDMS_UIM_CHANGE_PIN_RESP), //            0x002A
+qmi_name_item(QMIDMS_UIM_GET_PIN_STATUS_REQ), //         0x002B
+qmi_name_item(QMIDMS_UIM_GET_PIN_STATUS_RESP), //        0x002B
+qmi_name_item(QMIDMS_GET_DEVICE_HARDWARE_REV_REQ), //    0x002C
+qmi_name_item(QMIDMS_GET_DEVICE_HARDWARE_REV_RESP), //   0x002C
+qmi_name_item(QMIDMS_GET_OPERATING_MODE_REQ), //         0x002D 
+qmi_name_item(QMIDMS_GET_OPERATING_MODE_RESP), //        0x002D 
+qmi_name_item(QMIDMS_SET_OPERATING_MODE_REQ), //         0x002E 
+qmi_name_item(QMIDMS_SET_OPERATING_MODE_RESP), //        0x002E 
+qmi_name_item(QMIDMS_GET_ACTIVATED_STATUS_REQ), //       0x0031 
+qmi_name_item(QMIDMS_GET_ACTIVATED_STATUS_RESP), //      0x0031 
+qmi_name_item(QMIDMS_ACTIVATE_AUTOMATIC_REQ), //         0x0032
+qmi_name_item(QMIDMS_ACTIVATE_AUTOMATIC_RESP), //        0x0032
+qmi_name_item(QMIDMS_ACTIVATE_MANUAL_REQ), //            0x0033
+qmi_name_item(QMIDMS_ACTIVATE_MANUAL_RESP), //           0x0033
+qmi_name_item(QMIDMS_UIM_GET_ICCID_REQ), //              0x003C 
+qmi_name_item(QMIDMS_UIM_GET_ICCID_RESP), //             0x003C 
+qmi_name_item(QMIDMS_UIM_GET_CK_STATUS_REQ), //          0x0040
+qmi_name_item(QMIDMS_UIM_GET_CK_STATUS_RESP), //         0x0040
+qmi_name_item(QMIDMS_UIM_SET_CK_PROTECTION_REQ), //      0x0041
+qmi_name_item(QMIDMS_UIM_SET_CK_PROTECTION_RESP), //     0x0041
+qmi_name_item(QMIDMS_UIM_UNBLOCK_CK_REQ), //             0x0042
+qmi_name_item(QMIDMS_UIM_UNBLOCK_CK_RESP), //            0x0042
+qmi_name_item(QMIDMS_UIM_GET_IMSI_REQ), //               0x0043 
+qmi_name_item(QMIDMS_UIM_GET_IMSI_RESP), //              0x0043 
+qmi_name_item(QMIDMS_UIM_GET_STATE_REQ), //              0x0044 
+qmi_name_item(QMIDMS_UIM_GET_STATE_RESP), //             0x0044 
+qmi_name_item(QMIDMS_GET_BAND_CAP_REQ), //               0x0045 
+qmi_name_item(QMIDMS_GET_BAND_CAP_RESP), //              0x0045 
+};
+
+static const QMI_NAME_T qmux_qos_Type[] = {
+qmi_name_item( QMI_QOS_SET_EVENT_REPORT_REQ), //        0x0001
+qmi_name_item( QMI_QOS_SET_EVENT_REPORT_RESP), //       0x0001
+qmi_name_item( QMI_QOS_SET_EVENT_REPORT_IND), //        0x0001
+qmi_name_item( QMI_QOS_BIND_DATA_PORT_REQ), //          0x002B
+qmi_name_item( QMI_QOS_BIND_DATA_PORT_RESP), //         0x002B
+qmi_name_item( QMI_QOS_INDICATION_REGISTER_REQ), //     0x002F
+qmi_name_item( QMI_QOS_INDICATION_REGISTER_RESP), //    0x002F
+qmi_name_item( QMI_QOS_GLOBAL_QOS_FLOW_IND), //         0x0031
+qmi_name_item( QMI_QOS_GET_QOS_INFO_REQ), //            0x0033
+qmi_name_item( QMI_QOS_GET_QOS_INFO_RESP), //           0x0033
+};
+
+static const QMI_NAME_T qmux_nas_Type[] = {
+// ======================= NAS ==============================
+qmi_name_item(QMINAS_SET_EVENT_REPORT_REQ), //             0x0002
+qmi_name_item(QMINAS_SET_EVENT_REPORT_RESP), //            0x0002
+qmi_name_item(QMINAS_EVENT_REPORT_IND), //                 0x0002
+qmi_name_item(QMINAS_GET_SIGNAL_STRENGTH_REQ), //          0x0020
+qmi_name_item(QMINAS_GET_SIGNAL_STRENGTH_RESP), //         0x0020
+qmi_name_item(QMINAS_PERFORM_NETWORK_SCAN_REQ), //         0x0021
+qmi_name_item(QMINAS_PERFORM_NETWORK_SCAN_RESP), //        0x0021
+qmi_name_item(QMINAS_INITIATE_NW_REGISTER_REQ), //         0x0022
+qmi_name_item(QMINAS_INITIATE_NW_REGISTER_RESP), //        0x0022
+qmi_name_item(QMINAS_INITIATE_ATTACH_REQ), //              0x0023
+qmi_name_item(QMINAS_INITIATE_ATTACH_RESP), //             0x0023
+qmi_name_item(QMINAS_GET_SERVING_SYSTEM_REQ), //           0x0024
+qmi_name_item(QMINAS_GET_SERVING_SYSTEM_RESP), //          0x0024
+qmi_name_item(QMINAS_SERVING_SYSTEM_IND), //               0x0024
+qmi_name_item(QMINAS_GET_HOME_NETWORK_REQ), //             0x0025
+qmi_name_item(QMINAS_GET_HOME_NETWORK_RESP), //            0x0025
+qmi_name_item(QMINAS_GET_PREFERRED_NETWORK_REQ), //        0x0026
+qmi_name_item(QMINAS_GET_PREFERRED_NETWORK_RESP), //       0x0026
+qmi_name_item(QMINAS_SET_PREFERRED_NETWORK_REQ), //        0x0027
+qmi_name_item(QMINAS_SET_PREFERRED_NETWORK_RESP), //       0x0027
+qmi_name_item(QMINAS_GET_FORBIDDEN_NETWORK_REQ), //        0x0028
+qmi_name_item(QMINAS_GET_FORBIDDEN_NETWORK_RESP), //       0x0028
+qmi_name_item(QMINAS_SET_FORBIDDEN_NETWORK_REQ), //        0x0029
+qmi_name_item(QMINAS_SET_FORBIDDEN_NETWORK_RESP), //       0x0029
+qmi_name_item(QMINAS_SET_TECHNOLOGY_PREF_REQ), //          0x002A
+qmi_name_item(QMINAS_SET_TECHNOLOGY_PREF_RESP), //         0x002A
+qmi_name_item(QMINAS_GET_RF_BAND_INFO_REQ), //             0x0031
+qmi_name_item(QMINAS_GET_RF_BAND_INFO_RESP), //            0x0031
+qmi_name_item(QMINAS_GET_CELL_LOCATION_INFO_REQ),
+qmi_name_item(QMINAS_GET_CELL_LOCATION_INFO_RESP),
+qmi_name_item(QMINAS_GET_PLMN_NAME_REQ), //                0x0044
+qmi_name_item(QMINAS_GET_PLMN_NAME_RESP), //               0x0044
+qmi_name_item(QUECTEL_PACKET_TRANSFER_START_IND), //                0X100
+qmi_name_item(QUECTEL_PACKET_TRANSFER_END_IND), //               0X101
+qmi_name_item(QMINAS_GET_SYS_INFO_REQ), //                 0x004D
+qmi_name_item(QMINAS_GET_SYS_INFO_RESP), //                0x004D
+qmi_name_item(QMINAS_SYS_INFO_IND), //                     0x004D
+qmi_name_item(QMINAS_GET_SIG_INFO_REQ),
+qmi_name_item(QMINAS_GET_SIG_INFO_RESP),
+
+};
+
+static const QMI_NAME_T qmux_wms_Type[] = {
+// ======================= WMS ==============================
+qmi_name_item(QMIWMS_SET_EVENT_REPORT_REQ), //           0x0001
+qmi_name_item(QMIWMS_SET_EVENT_REPORT_RESP), //          0x0001
+qmi_name_item(QMIWMS_EVENT_REPORT_IND), //               0x0001
+qmi_name_item(QMIWMS_RAW_SEND_REQ), //                   0x0020
+qmi_name_item(QMIWMS_RAW_SEND_RESP), //                  0x0020
+qmi_name_item(QMIWMS_RAW_WRITE_REQ), //                  0x0021
+qmi_name_item(QMIWMS_RAW_WRITE_RESP), //                 0x0021
+qmi_name_item(QMIWMS_RAW_READ_REQ), //                   0x0022
+qmi_name_item(QMIWMS_RAW_READ_RESP), //                  0x0022
+qmi_name_item(QMIWMS_MODIFY_TAG_REQ), //                 0x0023
+qmi_name_item(QMIWMS_MODIFY_TAG_RESP), //                0x0023
+qmi_name_item(QMIWMS_DELETE_REQ), //                     0x0024
+qmi_name_item(QMIWMS_DELETE_RESP), //                    0x0024
+qmi_name_item(QMIWMS_GET_MESSAGE_PROTOCOL_REQ), //       0x0030
+qmi_name_item(QMIWMS_GET_MESSAGE_PROTOCOL_RESP), //      0x0030
+qmi_name_item(QMIWMS_LIST_MESSAGES_REQ), //              0x0031
+qmi_name_item(QMIWMS_LIST_MESSAGES_RESP), //             0x0031
+qmi_name_item(QMIWMS_GET_SMSC_ADDRESS_REQ), //           0x0034
+qmi_name_item(QMIWMS_GET_SMSC_ADDRESS_RESP), //          0x0034
+qmi_name_item(QMIWMS_SET_SMSC_ADDRESS_REQ), //           0x0035
+qmi_name_item(QMIWMS_SET_SMSC_ADDRESS_RESP), //          0x0035
+qmi_name_item(QMIWMS_GET_STORE_MAX_SIZE_REQ), //         0x0036
+qmi_name_item(QMIWMS_GET_STORE_MAX_SIZE_RESP), //        0x0036
+};
+
+static const QMI_NAME_T qmux_wds_admin_Type[] = {
+qmi_name_item(QMIWDS_ADMIN_SET_DATA_FORMAT_REQ), //      0x0020
+qmi_name_item(QMIWDS_ADMIN_SET_DATA_FORMAT_RESP), //     0x0020
+qmi_name_item(QMIWDS_ADMIN_GET_DATA_FORMAT_REQ), //      0x0021
+qmi_name_item(QMIWDS_ADMIN_GET_DATA_FORMAT_RESP), //     0x0021
+qmi_name_item(QMIWDS_ADMIN_SET_QMAP_SETTINGS_REQ), //    0x002B
+qmi_name_item(QMIWDS_ADMIN_SET_QMAP_SETTINGS_RESP), //   0x002B
+qmi_name_item(QMIWDS_ADMIN_GET_QMAP_SETTINGS_REQ), //    0x002C
+qmi_name_item(QMIWDS_ADMIN_GET_QMAP_SETTINGS_RESP), //   0x002C
+qmi_name_item(QMI_WDA_SET_LOOPBACK_CONFIG_REQ), //	 0x002F
+qmi_name_item(QMI_WDA_SET_LOOPBACK_CONFIG_RESP), //	 0x002F
+qmi_name_item(QMI_WDA_SET_LOOPBACK_CONFIG_IND), //	 0x002F
+};
+
+static const QMI_NAME_T qmux_uim_Type[] = {
+qmi_name_item( QMIUIM_READ_TRANSPARENT_REQ), //      0x0020
+qmi_name_item( QMIUIM_READ_TRANSPARENT_RESP), //     0x0020
+qmi_name_item( QMIUIM_READ_TRANSPARENT_IND), //      0x0020
+qmi_name_item( QMIUIM_READ_RECORD_REQ), //           0x0021
+qmi_name_item( QMIUIM_READ_RECORD_RESP), //          0x0021
+qmi_name_item( QMIUIM_READ_RECORD_IND), //           0x0021
+qmi_name_item( QMIUIM_WRITE_TRANSPARENT_REQ), //     0x0022
+qmi_name_item( QMIUIM_WRITE_TRANSPARENT_RESP), //    0x0022
+qmi_name_item( QMIUIM_WRITE_TRANSPARENT_IND), //     0x0022
+qmi_name_item( QMIUIM_WRITE_RECORD_REQ), //          0x0023
+qmi_name_item( QMIUIM_WRITE_RECORD_RESP), //         0x0023
+qmi_name_item( QMIUIM_WRITE_RECORD_IND), //          0x0023
+qmi_name_item( QMIUIM_SET_PIN_PROTECTION_REQ), //    0x0025
+qmi_name_item( QMIUIM_SET_PIN_PROTECTION_RESP), //   0x0025
+qmi_name_item( QMIUIM_SET_PIN_PROTECTION_IND), //    0x0025
+qmi_name_item( QMIUIM_VERIFY_PIN_REQ), //            0x0026
+qmi_name_item( QMIUIM_VERIFY_PIN_RESP), //           0x0026
+qmi_name_item( QMIUIM_VERIFY_PIN_IND), //            0x0026
+qmi_name_item( QMIUIM_UNBLOCK_PIN_REQ), //           0x0027
+qmi_name_item( QMIUIM_UNBLOCK_PIN_RESP), //          0x0027
+qmi_name_item( QMIUIM_UNBLOCK_PIN_IND), //           0x0027
+qmi_name_item( QMIUIM_CHANGE_PIN_REQ), //            0x0028
+qmi_name_item( QMIUIM_CHANGE_PIN_RESP), //           0x0028
+qmi_name_item( QMIUIM_CHANGE_PIN_IND), //            0x0028
+qmi_name_item( QMIUIM_DEPERSONALIZATION_REQ), //     0x0029
+qmi_name_item( QMIUIM_DEPERSONALIZATION_RESP), //    0x0029
+qmi_name_item( QMIUIM_EVENT_REG_REQ), //             0x002E
+qmi_name_item( QMIUIM_EVENT_REG_RESP), //            0x002E
+qmi_name_item( QMIUIM_GET_CARD_STATUS_REQ), //       0x002F
+qmi_name_item( QMIUIM_GET_CARD_STATUS_RESP), //      0x002F
+qmi_name_item( QMIUIM_STATUS_CHANGE_IND), //         0x0032
+};
+
+static const QMI_NAME_T qmux_coex_Type[] = {
+qmi_name_item(QMI_COEX_GET_WWAN_STATE_REQ), //    0x0022
+qmi_name_item(QMI_COEX_GET_WWAN_STATE_RESP), //    0x0022
+};
+
+static const char * qmi_name_get(const QMI_NAME_T *table, size_t size, int type, const char *tag) {
+    static char unknow[40];
+    size_t i;
+
+    if (qmux_CtlFlags == table) {
+        if (!strcmp(tag, "_REQ"))
+            tag = "_CMD";
+        else  if (!strcmp(tag, "_RESP"))
+            tag = "_RSP";
+    }
+    
+    for (i = 0; i < size; i++) {
+        if (table[i].type == (UINT)type) {
+            if (!tag || (strstr(table[i].name, tag)))
+                return table[i].name;
+        }
+    }
+    sprintf(unknow, "unknow_%x", type);
+    return unknow;
+}
+
+#define QMI_NAME(table, type) qmi_name_get(table, sizeof(table) / sizeof(table[0]), type, 0)
+#define QMUX_NAME(table, type, tag) qmi_name_get(table, sizeof(table) / sizeof(table[0]), type, tag)
+
+void dump_tlv(PQCQMUX_MSG_HDR pQMUXMsgHdr) {
+    int TLVFind = 0;
+    int i;
+    //dbg("QCQMUX_TLV-----------------------------------\n");
+    //dbg("{Type,\tLength,\tValue}\n");
+
+    while (1) {
+        PQMI_TLV_HDR TLVHdr = GetTLV(pQMUXMsgHdr, 0x1000 + (++TLVFind));
+        if (TLVHdr == NULL)
+            break;
+
+        //if ((TLVHdr->TLVType == 0x02) && ((USHORT *)(TLVHdr+1))[0])
+        {        
+            dbg("{%02x,\t%04x,\t", TLVHdr->TLVType, le16_to_cpu(TLVHdr->TLVLength));
+            for (i = 0; i < le16_to_cpu(TLVHdr->TLVLength); i++) {
+                dbg("%02x ", ((UCHAR *)(TLVHdr+1))[i]);
+            }
+            dbg("}\n");
+        }
+    }  // while
+}
+
+void dump_ctl(PQCQMICTL_MSG_HDR CTLHdr) {
+    const char *tag;
+    
+    //dbg("QCQMICTL_MSG--------------------------------------------\n");
+    //dbg("CtlFlags:           %02x\t\t%s\n", CTLHdr->CtlFlags, QMI_NAME(qmi_ctl_CtlFlags, CTLHdr->CtlFlags));
+   dbg("TransactionId:      %02x\n", CTLHdr->TransactionId);
+        switch (CTLHdr->CtlFlags) {
+            case QMICTL_FLAG_REQUEST: tag = "_REQ"; break;
+            case QMICTL_FLAG_RESPONSE: tag = "_RESP"; break;
+            case QMICTL_FLAG_INDICATION: tag = "_IND"; break;
+            default: tag = 0; break;
+       }
+        dbg("QMICTLType:         %04x\t%s\n", le16_to_cpu(CTLHdr->QMICTLType),
+        QMUX_NAME(qmux_ctl_QMICTLType, le16_to_cpu(CTLHdr->QMICTLType), tag));     
+        dbg("Length:             %04x\n", le16_to_cpu(CTLHdr->Length));
+
+     dump_tlv((PQCQMUX_MSG_HDR)(&CTLHdr->QMICTLType));
+}
+
+int dump_qmux(QMI_SERVICE_TYPE serviceType, PQCQMUX_HDR QMUXHdr) {
+    PQCQMUX_MSG_HDR QMUXMsgHdr = (PQCQMUX_MSG_HDR) (QMUXHdr + 1);
+    const char *tag;
+
+    //dbg("QCQMUX--------------------------------------------\n");
+    switch (QMUXHdr->CtlFlags&QMUX_CTL_FLAG_MASK_TYPE) {
+        case QMUX_CTL_FLAG_TYPE_CMD: tag = "_REQ"; break;
+        case QMUX_CTL_FLAG_TYPE_RSP: tag = "_RESP"; break;
+        case QMUX_CTL_FLAG_TYPE_IND: tag = "_IND"; break;
+        default: tag = 0; break;
+    }
+    //dbg("CtlFlags:           %02x\t\t%s\n", QMUXHdr->CtlFlags, QMUX_NAME(qmux_CtlFlags, QMUXHdr->CtlFlags, tag));
+    dbg("TransactionId:    %04x\n", le16_to_cpu(QMUXHdr->TransactionId));
+
+    //dbg("QCQMUX_MSG_HDR-----------------------------------\n");
+    switch (serviceType) {
+        case QMUX_TYPE_DMS:
+            dbg("Type:               %04x\t%s\n", le16_to_cpu(QMUXMsgHdr->Type),
+            QMUX_NAME(qmux_dms_Type, le16_to_cpu(QMUXMsgHdr->Type), tag));
+        break;
+        case QMUX_TYPE_NAS:
+            dbg("Type:               %04x\t%s\n", le16_to_cpu(QMUXMsgHdr->Type),
+            QMUX_NAME(qmux_nas_Type, le16_to_cpu(QMUXMsgHdr->Type), tag));
+        break;
+        case QMUX_TYPE_WDS:
+        case QMUX_TYPE_WDS_IPV6:
+            dbg("Type:               %04x\t%s\n", le16_to_cpu(QMUXMsgHdr->Type),
+            QMUX_NAME(qmux_wds_Type, le16_to_cpu(QMUXMsgHdr->Type), tag));
+        break;
+        case QMUX_TYPE_WMS:
+            dbg("Type:               %04x\t%s\n", le16_to_cpu(QMUXMsgHdr->Type),
+            QMUX_NAME(qmux_wms_Type, le16_to_cpu(QMUXMsgHdr->Type), tag));
+        break;
+        case QMUX_TYPE_WDS_ADMIN:
+            dbg("Type:               %04x\t%s\n", le16_to_cpu(QMUXMsgHdr->Type),
+            QMUX_NAME(qmux_wds_admin_Type, le16_to_cpu(QMUXMsgHdr->Type), tag));
+        break;
+        case QMUX_TYPE_UIM:
+            dbg("Type:               %04x\t%s\n", le16_to_cpu(QMUXMsgHdr->Type),
+            QMUX_NAME(qmux_uim_Type, le16_to_cpu(QMUXMsgHdr->Type), tag));
+        break;
+        case QMUX_TYPE_PDS:
+        case QMUX_TYPE_QOS:
+            dbg("Type:               %04x\t%s\n", le16_to_cpu(QMUXMsgHdr->Type),
+            QMUX_NAME(qmux_qos_Type, le16_to_cpu(QMUXMsgHdr->Type), tag));
+        break;
+        case QMUX_TYPE_COEX:
+            dbg("Type:               %04x\t%s\n", le16_to_cpu(QMUXMsgHdr->Type),
+            QMUX_NAME(qmux_coex_Type, le16_to_cpu(QMUXMsgHdr->Type), tag));
+        break;
+        case QMUX_TYPE_CTL:                
+        default:
+            dbg("Type:               %04x\t%s\n", le16_to_cpu(QMUXMsgHdr->Type), "PDS/QOS/CTL/unknown!");
+        break;    
+    }
+    dbg("Length:             %04x\n", le16_to_cpu(QMUXMsgHdr->Length));
+
+    dump_tlv(QMUXMsgHdr);
+    
+    return 0;
+}
+
+void dump_qmi(void *dataBuffer, int dataLen) 
+{
+    PQCQMI_HDR QMIHdr = (PQCQMI_HDR)dataBuffer;
+    PQCQMUX_HDR QMUXHdr = (PQCQMUX_HDR) (QMIHdr + 1);
+    PQCQMICTL_MSG_HDR CTLHdr =  (PQCQMICTL_MSG_HDR) (QMIHdr + 1);
+
+    int i;
+
+    if (!debug_qmi)
+        return;
+
+    pthread_mutex_lock(&dumpQMIMutex);
+    line[0] = 0;
+    for (i = 0; i < dataLen; i++) {
+        dbg("%02x ", ((unsigned char *)dataBuffer)[i]);
+    }
+    dbg_time("%s", line);
+    line[0] = 0;
+    
+    //dbg("QCQMI_HDR-----------------------------------------");
+    //dbg("IFType:             %02x\t\t%s", QMIHdr->IFType, QMI_NAME(qmi_IFType, QMIHdr->IFType));
+    //dbg("Length:             %04x", le16_to_cpu(QMIHdr->Length));
+    //dbg("CtlFlags:           %02x\t\t%s", QMIHdr->CtlFlags, QMI_NAME(qmi_CtlFlags, QMIHdr->CtlFlags));
+    //dbg("QMIType:            %02x\t\t%s", QMIHdr->QMIType, QMI_NAME(qmi_QMIType, QMIHdr->QMIType));
+    //dbg("ClientId:           %02x", QMIHdr->ClientId);
+
+    if (QMIHdr->QMIType == QMUX_TYPE_CTL) {
+        dump_ctl(CTLHdr);
+    } else {
+        dump_qmux(QMIHdr->QMIType, QMUXHdr);
+    }
+    dbg_time("%s", line);
+    pthread_mutex_unlock(&dumpQMIMutex);
+}
diff --git a/RM520N-5G/文件/source/QCQMUX.h b/RM520N-5G/文件/source/QCQMUX.h
new file mode 100644
index 0000000..6f5a77d
--- /dev/null
+++ b/RM520N-5G/文件/source/QCQMUX.h
@@ -0,0 +1,4332 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#ifndef QCQMUX_H
+#define QCQMUX_H
+
+#include "QCQMI.h"
+
+#pragma pack(push, 1)
+
+#define QMIWDS_SET_EVENT_REPORT_REQ           0x0001
+#define QMIWDS_SET_EVENT_REPORT_RESP          0x0001
+#define QMIWDS_EVENT_REPORT_IND               0x0001
+#define QMIWDS_START_NETWORK_INTERFACE_REQ    0x0020
+#define QMIWDS_START_NETWORK_INTERFACE_RESP   0x0020
+#define QMIWDS_STOP_NETWORK_INTERFACE_REQ     0x0021
+#define QMIWDS_STOP_NETWORK_INTERFACE_RESP    0x0021
+#define QMIWDS_GET_PKT_SRVC_STATUS_REQ        0x0022
+#define QMIWDS_GET_PKT_SRVC_STATUS_RESP       0x0022
+#define QMIWDS_GET_PKT_SRVC_STATUS_IND        0x0022
+#define QMIWDS_GET_CURRENT_CHANNEL_RATE_REQ   0x0023
+#define QMIWDS_GET_CURRENT_CHANNEL_RATE_RESP  0x0023
+#define QMIWDS_GET_PKT_STATISTICS_REQ         0x0024
+#define QMIWDS_GET_PKT_STATISTICS_RESP        0x0024
+#define QMIWDS_CREATE_PROFILE_REQ             0x0027
+#define QMIWDS_CREATE_PROFILE_RESP            0x0027
+#define QMIWDS_MODIFY_PROFILE_SETTINGS_REQ    0x0028
+#define QMIWDS_MODIFY_PROFILE_SETTINGS_RESP   0x0028
+#define QMIWDS_GET_PROFILE_LIST_REQ           0x002A
+#define QMIWDS_GET_PROFILE_LIST_RESP          0x002A
+#define QMIWDS_GET_PROFILE_SETTINGS_REQ       0x002B
+#define QMIWDS_GET_PROFILE_SETTINGS_RESP      0x002B
+#define QMIWDS_GET_DEFAULT_SETTINGS_REQ       0x002C
+#define QMIWDS_GET_DEFAULT_SETTINGS_RESP      0x002C
+#define QMIWDS_GET_RUNTIME_SETTINGS_REQ       0x002D
+#define QMIWDS_GET_RUNTIME_SETTINGS_RESP      0x002D
+#define QMIWDS_GET_MIP_MODE_REQ               0x002F
+#define QMIWDS_GET_MIP_MODE_RESP              0x002F
+#define QMIWDS_GET_DATA_BEARER_REQ            0x0037
+#define QMIWDS_GET_DATA_BEARER_RESP           0x0037
+#define QMIWDS_DUN_CALL_INFO_REQ              0x0038
+#define QMIWDS_DUN_CALL_INFO_RESP             0x0038
+#define QMIWDS_DUN_CALL_INFO_IND              0x0038
+#define QMIWDS_SET_CLIENT_IP_FAMILY_PREF_REQ  0x004D
+#define QMIWDS_SET_CLIENT_IP_FAMILY_PREF_RESP 0x004D
+#define QMIWDS_SET_AUTO_CONNECT_REQ     0x0051
+#define QMIWDS_SET_AUTO_CONNECT_RESP     0x0051
+#define QMIWDS_BIND_MUX_DATA_PORT_REQ         0x00A2
+#define QMIWDS_BIND_MUX_DATA_PORT_RESP        0x00A2
+
+
+// Stats masks
+#define QWDS_STAT_MASK_TX_PKT_OK 0x00000001
+#define QWDS_STAT_MASK_RX_PKT_OK 0x00000002
+#define QWDS_STAT_MASK_TX_PKT_ER 0x00000004
+#define QWDS_STAT_MASK_RX_PKT_ER 0x00000008
+#define QWDS_STAT_MASK_TX_PKT_OF 0x00000010
+#define QWDS_STAT_MASK_RX_PKT_OF 0x00000020
+
+// TLV Types for xfer statistics
+#define TLV_WDS_TX_GOOD_PKTS      0x10
+#define TLV_WDS_RX_GOOD_PKTS      0x11
+#define TLV_WDS_TX_ERROR          0x12
+#define TLV_WDS_RX_ERROR          0x13
+#define TLV_WDS_TX_OVERFLOW       0x14
+#define TLV_WDS_RX_OVERFLOW       0x15
+#define TLV_WDS_CHANNEL_RATE      0x16
+#define TLV_WDS_DATA_BEARER       0x17
+#define TLV_WDS_DORMANCY_STATUS   0x18
+
+#define QWDS_PKT_DATA_UNKNOW    0x00
+#define QWDS_PKT_DATA_DISCONNECTED    0x01
+#define QWDS_PKT_DATA_CONNECTED        0x02
+#define QWDS_PKT_DATA_SUSPENDED        0x03
+#define QWDS_PKT_DATA_AUTHENTICATING   0x04
+
+#define QMIWDS_ADMIN_SET_DATA_FORMAT_REQ      0x0020
+#define QMIWDS_ADMIN_SET_DATA_FORMAT_RESP     0x0020
+#define QMIWDS_ADMIN_GET_DATA_FORMAT_REQ      0x0021
+#define QMIWDS_ADMIN_GET_DATA_FORMAT_RESP     0x0021
+#define QMIWDS_ADMIN_SET_QMAP_SETTINGS_REQ    0x002B
+#define QMIWDS_ADMIN_SET_QMAP_SETTINGS_RESP   0x002B
+#define QMIWDS_ADMIN_GET_QMAP_SETTINGS_REQ    0x002C
+#define QMIWDS_ADMIN_GET_QMAP_SETTINGS_RESP   0x002C
+#define QMI_WDA_SET_LOOPBACK_CONFIG_REQ       0x002F
+#define QMI_WDA_SET_LOOPBACK_CONFIG_RESP      0x002F
+#define QMI_WDA_SET_LOOPBACK_CONFIG_IND       0x002F
+
+#define NETWORK_DESC_ENCODING_OCTET       0x00
+#define NETWORK_DESC_ENCODING_EXTPROTOCOL 0x01
+#define NETWORK_DESC_ENCODING_7BITASCII   0x02
+#define NETWORK_DESC_ENCODING_IA5         0x03
+#define NETWORK_DESC_ENCODING_UNICODE     0x04
+#define NETWORK_DESC_ENCODING_SHIFTJIS    0x05
+#define NETWORK_DESC_ENCODING_KOREAN      0x06
+#define NETWORK_DESC_ENCODING_LATINH      0x07
+#define NETWORK_DESC_ENCODING_LATIN       0x08
+#define NETWORK_DESC_ENCODING_GSM7BIT     0x09
+#define NETWORK_DESC_ENCODING_GSMDATA     0x0A
+#define NETWORK_DESC_ENCODING_UNKNOWN     0xFF
+
+typedef struct _QMIWDS_ADMIN_SET_DATA_FORMAT
+{
+   USHORT Type;             // QMUX type 0x0000
+   USHORT Length;
+} __attribute__ ((packed)) QMIWDS_ADMIN_SET_DATA_FORMAT, *PQMIWDS_ADMIN_SET_DATA_FORMAT;
+
+typedef struct _QMIWDS_ADMIN_SET_DATA_FORMAT_TLV_QOS
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  QOSSetting;
+} __attribute__ ((packed)) QMIWDS_ADMIN_SET_DATA_FORMAT_TLV_QOS, *PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV_QOS;
+
+typedef struct _QMIWDS_ADMIN_SET_DATA_FORMAT_TLV
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   ULONG  Value;
+} __attribute__ ((packed)) QMIWDS_ADMIN_SET_DATA_FORMAT_TLV, *PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV;
+
+typedef struct _QMIWDS_ENDPOINT_TLV
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   ULONG  ep_type;
+   ULONG  iface_id;
+} __attribute__ ((packed)) QMIWDS_ENDPOINT_TLV, *PQMIWDS_ENDPOINT_TLV;
+
+typedef struct _QMIWDS_ADMIN_SET_DATA_FORMAT_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+    QMIWDS_ADMIN_SET_DATA_FORMAT_TLV_QOS QosDataFormatTlv;
+    QMIWDS_ADMIN_SET_DATA_FORMAT_TLV UnderlyingLinkLayerProtocolTlv;
+    QMIWDS_ADMIN_SET_DATA_FORMAT_TLV UplinkDataAggregationProtocolTlv;
+    QMIWDS_ADMIN_SET_DATA_FORMAT_TLV DownlinkDataAggregationProtocolTlv;
+    QMIWDS_ADMIN_SET_DATA_FORMAT_TLV DownlinkDataAggregationMaxDatagramsTlv;
+    QMIWDS_ADMIN_SET_DATA_FORMAT_TLV DownlinkDataAggregationMaxSizeTlv;
+    QMIWDS_ENDPOINT_TLV epTlv;
+#ifdef QUECTEL_UL_DATA_AGG
+    QMIWDS_ADMIN_SET_DATA_FORMAT_TLV DlMinimumPassingTlv;
+    QMIWDS_ADMIN_SET_DATA_FORMAT_TLV UplinkDataAggregationMaxDatagramsTlv;
+    QMIWDS_ADMIN_SET_DATA_FORMAT_TLV UplinkDataAggregationMaxSizeTlv;
+#endif	
+} __attribute__ ((packed)) QMIWDS_ADMIN_SET_DATA_FORMAT_REQ_MSG, *PQMIWDS_ADMIN_SET_DATA_FORMAT_REQ_MSG;
+
+typedef struct _QMI_U8_TLV
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  TLVVaule;
+} __attribute__ ((packed)) QMI_U8_TLV, *PQMI_U8_TLV;
+
+typedef struct _QMI_U32_TLV
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   ULONG  TLVVaule;
+} __attribute__ ((packed)) QMI_U32_TLV, *PQMI_U32_TLV;
+
+typedef struct _QMI_WDA_SET_LOOPBACK_CONFIG_REQ_MSG {
+	USHORT Type;
+	USHORT Length;
+	QMI_U8_TLV loopback_state; //0x01
+	QMI_U32_TLV replication_factor; //0x10
+} __attribute__ ((packed)) QMI_WDA_SET_LOOPBACK_CONFIG_REQ_MSG, *PQMI_WDA_SET_LOOPBACK_CONFIG_REQ_MSG;
+
+typedef struct _QMI_WDA_SET_LOOPBACK_CONFIG_IND_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   QMI_U8_TLV loopback_state; //0x01
+   QMI_U32_TLV replication_factor; //0x10
+} __attribute__ ((packed)) QMI_WDA_SET_LOOPBACK_CONFIG_IND_MSG, *PQMI_WDA_SET_LOOPBACK_CONFIG_IND_MSG;
+
+#if 0
+typedef enum _QMI_RETURN_CODES {
+   QMI_SUCCESS = 0,
+   QMI_SUCCESS_NOT_COMPLETE,
+   QMI_FAILURE
+}QMI_RETURN_CODES;
+
+typedef struct _QMIWDS_GET_PKT_SRVC_STATUS_REQ_MSG
+{
+   USHORT Type;    // 0x0022
+   USHORT Length;  // 0x0000
+} QMIWDS_GET_PKT_SRVC_STATUS_REQ_MSG, *PQMIWDS_GET_PKT_SRVC_STATUS_REQ_MSG;
+
+typedef struct _QMIWDS_GET_PKT_SRVC_STATUS_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+   UCHAR  TLVType2;
+   USHORT TLVLength2;
+   UCHAR  ConnectionStatus; // 0x01: QWDS_PKT_DATAC_DISCONNECTED
+                            // 0x02: QWDS_PKT_DATA_CONNECTED
+                            // 0x03: QWDS_PKT_DATA_SUSPENDED
+                            // 0x04: QWDS_PKT_DATA_AUTHENTICATING
+} QMIWDS_GET_PKT_SRVC_STATUS_RESP_MSG, *PQMIWDS_GET_PKT_SRVC_STATUS_RESP_MSG;
+
+typedef struct _QMIWDS_GET_PKT_SRVC_STATUS_IND_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ConnectionStatus; // 0x01: QWDS_PKT_DATAC_DISCONNECTED
+                            // 0x02: QWDS_PKT_DATA_CONNECTED
+                            // 0x03: QWDS_PKT_DATA_SUSPENDED
+   UCHAR  ReconfigRequired; // 0x00: No need to reconfigure
+                            // 0x01: Reconfiguration required
+} QMIWDS_GET_PKT_SRVC_STATUS_IND_MSG, *PQMIWDS_GET_PKT_SRVC_STATUS_IND_MSG;
+
+typedef struct _WDS_PKT_SRVC_IP_FAMILY_TLV
+{
+   UCHAR  TLVType;     // 0x12
+   USHORT TLVLength;   // 1
+   UCHAR  IpFamily;    // IPV4-0x04, IPV6-0x06
+} WDS_PKT_SRVC_IP_FAMILY_TLV, *PWDS_PKT_SRVC_IP_FAMILY_TLV;
+
+typedef struct _QMIWDS_DUN_CALL_INFO_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   ULONG  Mask;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  ReportConnectionStatus;
+} QMIWDS_DUN_CALL_INFO_REQ_MSG, *PQMIWDS_DUN_CALL_INFO_REQ_MSG;
+
+typedef struct _QMIWDS_DUN_CALL_INFO_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} QMIWDS_DUN_CALL_INFO_RESP_MSG, *PQMIWDS_DUN_CALL_INFO_RESP_MSG;
+
+typedef struct _QMIWDS_DUN_CALL_INFO_IND_MSG
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ConnectionStatus;
+} QMIWDS_DUN_CALL_INFO_IND_MSG, *PQMIWDS_DUN_CALL_INFO_IND_MSG;
+
+typedef struct _QMIWDS_GET_CURRENT_CHANNEL_RATE_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0040
+   USHORT Length;
+} QMIWDS_GET_CURRENT_CHANNEL_RATE_REQ_MSG, *PQMIWDS_GET_CURRENT_CHANNEL_RATE_REQ_MSG;
+
+typedef struct _QMIWDS_GET_CURRENT_CHANNEL_RATE_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0040
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+
+   UCHAR  TLV2Type;         // 0x01
+   USHORT TLV2Length;       // 16
+   //ULONG  CallHandle;       // Context corresponding to reported channel
+   ULONG  CurrentTxRate;       // bps
+   ULONG  CurrentRxRate;       // bps
+   ULONG  ServingSystemTxRate; // bps
+   ULONG  ServingSystemRxRate; // bps
+
+} QMIWDS_GET_CURRENT_CHANNEL_RATE_RESP_MSG, *PQMIWDS_GET_CURRENT_CHANNEL_RATE_RESP;
+
+#define QWDS_EVENT_REPORT_MASK_RATES 0x01
+#define QWDS_EVENT_REPORT_MASK_STATS 0x02
+
+#ifdef QCUSB_MUX_PROTOCOL
+#error code not present
+#endif // QCUSB_MUX_PROTOCOL
+
+typedef struct _QMIWDS_SET_EVENT_REPORT_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0042
+   USHORT Length;
+
+   UCHAR  TLVType;          // 0x10 -- current channel rate indicator
+   USHORT TLVLength;        // 1
+   UCHAR  Mode;             // 0-do not report; 1-report when rate changes
+
+   UCHAR  TLV2Type;         // 0x11
+   USHORT TLV2Length;       // 5
+   UCHAR  StatsPeriod;      // seconds between reports; 0-do not report
+   ULONG  StatsMask;        //
+
+   UCHAR  TLV3Type;          // 0x12 -- current data bearer indicator
+   USHORT TLV3Length;        // 1
+   UCHAR  Mode3;             // 0-do not report; 1-report when changes
+
+   UCHAR  TLV4Type;          // 0x13 -- dormancy status indicator
+   USHORT TLV4Length;        // 1
+   UCHAR  DormancyStatus;    // 0-do not report; 1-report when changes
+} QMIWDS_SET_EVENT_REPORT_REQ_MSG, *PQMIWDS_SET_EVENT_REPORT_REQ_MSG;
+
+typedef struct _QMIWDS_SET_EVENT_REPORT_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0042
+   USHORT Length;
+
+   UCHAR  TLVType;          // 0x02 result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_NO_BATTERY
+                            // QMI_ERR_FAULT
+} QMIWDS_SET_EVENT_REPORT_RESP_MSG, *PQMIWDS_SET_EVENT_REPORT_RESP_MSG;
+
+typedef struct _QMIWDS_EVENT_REPORT_IND_MSG
+{
+   USHORT Type;             // QMUX type 0x0001
+   USHORT Length;
+} QMIWDS_EVENT_REPORT_IND_MSG, *PQMIWDS_EVENT_REPORT_IND_MSG;
+
+// PQCTLV_PKT_STATISTICS
+
+typedef struct _QMIWDS_EVENT_REPORT_IND_CHAN_RATE_TLV
+{
+   UCHAR  Type;
+   USHORT Length;  // 8
+   ULONG  TxRate;
+   ULONG  RxRate;
+} QMIWDS_EVENT_REPORT_IND_CHAN_RATE_TLV, *PQMIWDS_EVENT_REPORT_IND_CHAN_RATE_TLV;
+
+#ifdef QCUSB_MUX_PROTOCOL
+#error code not present
+#endif // QCUSB_MUX_PROTOCOL
+
+typedef struct _QMIWDS_GET_PKT_STATISTICS_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0041
+   USHORT Length;
+   UCHAR  TLVType;          // 0x01
+   USHORT TLVLength;        // 4
+   ULONG  StateMask;        // 0x00000001  tx success packets
+                            // 0x00000002  rx success packets
+                            // 0x00000004  rx packet errors (checksum)
+                            // 0x00000008  rx packets dropped (memory)
+
+} QMIWDS_GET_PKT_STATISTICS_REQ_MSG, *PQMIWDS_GET_PKT_STATISTICS_REQ_MSG;
+
+typedef struct _QMIWDS_GET_PKT_STATISTICS_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0041
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} QMIWDS_GET_PKT_STATISTICS_RESP_MSG, *PQMIWDS_GET_PKT_STATISTICS_RESP_MSG;
+
+// optional TLV for stats
+typedef struct _QCTLV_PKT_STATISTICS
+{
+   UCHAR  TLVType;          // see above definitions for TLV types
+   USHORT TLVLength;        // 4
+   ULONG  Count;
+} QCTLV_PKT_STATISTICS, *PQCTLV_PKT_STATISTICS;
+#endif
+
+//#ifdef QC_IP_MODE
+
+/*
+    \E2\80?Bit 0 \E2\80?Profile identifier
+    \E2\80?Bit 1 \E2\80?Profile name
+    \E2\80?Bit 2 \E2\80?PDP type
+    \E2\80?Bit 3 \E2\80?APN name
+    \E2\80?Bit 4 \E2\80?DNS address
+    \E2\80?Bit 5 \E2\80?UMTS/GPRS granted QoS
+    \E2\80?Bit 6 \E2\80?Username
+    \E2\80?Bit 7 \E2\80?Authentication Protocol
+    \E2\80?Bit 8 \E2\80?IP address
+    \E2\80?Bit 9 \E2\80?Gateway information (address and subnet mask)
+    \E2\80?Bit 10 \E2\80?PCSCF address using a PCO flag
+    \E2\80?Bit 11 \E2\80?PCSCF server address list
+    \E2\80?Bit 12 \E2\80?PCSCF domain name list
+    \E2\80?Bit 13 \E2\80?MTU
+    \E2\80?Bit 14 \E2\80?Domain name list
+    \E2\80?Bit 15 \E2\80?IP family
+    \E2\80?Bit 16 \E2\80?IM_CM flag
+    \E2\80?Bit 17 \E2\80?Technology name
+    \E2\80?Bit 18 \E2\80?Operator reserved PCO
+*/
+#define QMIWDS_GET_RUNTIME_SETTINGS_MASK_IPV4DNS_ADDR       (1 << 4)
+#define QMIWDS_GET_RUNTIME_SETTINGS_MASK_IPV4_ADDR          (1 << 8)
+#define QMIWDS_GET_RUNTIME_SETTINGS_MASK_IPV4GATEWAY_ADDR   (1 << 9)
+#define QMIWDS_GET_RUNTIME_SETTINGS_MASK_MTU                (1 << 13)
+#define QMIWDS_GET_RUNTIME_SETTINGS_MASK_PCSCF_SV_ADDR      (1 << 11)
+#define QMIWDS_GET_RUNTIME_SETTINGS_MASK_PCSCF_DOM_NAME     (1 << 14)
+
+typedef struct _QMIWDS_GET_RUNTIME_SETTINGS_REQ_MSG
+{
+   USHORT Type;            // QMIWDS_GET_RUNTIME_SETTINGS_REQ
+   USHORT Length;
+   UCHAR  TLVType;         // 0x10
+   USHORT TLVLength;       // 0x0004
+   ULONG  Mask;            // mask, bit 8: IP addr -- 0x0100
+} __attribute__ ((packed)) QMIWDS_GET_RUNTIME_SETTINGS_REQ_MSG, *PQMIWDS_GET_RUNTIME_SETTINGS_REQ_MSG;
+
+typedef struct _QMIWDS_BIND_MUX_DATA_PORT_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   ULONG  ep_type;
+   ULONG  iface_id;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  MuxId;
+   UCHAR  TLV3Type;
+   USHORT TLV3Length;
+   ULONG  client_type;
+} __attribute__ ((packed)) QMIWDS_BIND_MUX_DATA_PORT_REQ_MSG, *PQMIWDS_BIND_MUX_DATA_PORT_REQ_MSG;
+
+#define QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV4PRIMARYDNS 0x15
+#define QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV4SECONDARYDNS 0x16
+#define QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV4 0x1E
+#define QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV4GATEWAY 0x20
+#define QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV4SUBNET 0x21
+
+#define QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV6             0x25
+#define QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV6GATEWAY      0x26
+#define QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV6PRIMARYDNS   0x27
+#define QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV6SECONDARYDNS 0x28
+#define QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_MTU              0x29
+
+typedef struct _QMIWDS_GET_RUNTIME_SETTINGS_TLV_MTU
+{
+   UCHAR  TLVType;         // QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_MTU
+   USHORT TLVLength;       // 4
+   ULONG  Mtu;             // MTU
+} __attribute__ ((packed)) QMIWDS_GET_RUNTIME_SETTINGS_TLV_MTU, *PQMIWDS_GET_RUNTIME_SETTINGS_TLV_MTU;
+
+typedef struct _QMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV4_ADDR
+{
+   UCHAR  TLVType;         // QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV4
+   USHORT TLVLength;       // 4
+   ULONG  IPV4Address;     // address
+} __attribute__ ((packed)) QMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV4_ADDR, *PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV4_ADDR;
+
+typedef struct _QMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV6_ADDR
+{
+   UCHAR  TLVType;         // QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV6
+   USHORT TLVLength;       // 16
+   UCHAR  IPV6Address[16]; // address
+   UCHAR  PrefixLength;    // prefix length
+} __attribute__ ((packed)) QMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV6_ADDR, *PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV6_ADDR;
+
+typedef struct _QMIWDS_GET_RUNNING_SETTINGS_PCSCF_IPV6_ADDR
+{
+	UCHAR TLVType;
+	USHORT TLVLength;
+	UCHAR PCSCFNumber;
+} __attribute__ ((packed)) QMIWDS_GET_RUNNING_SETTINGS_PCSCF_IPV6_ADDR, *PQMIWDS_GET_RUNNING_SETTINGS_PCSCF_IPV6_ADDR;
+
+typedef struct _QMIWDS_GET_RUNNING_SETTINGS_PCSCF_IPV4_ADDR
+{
+	UCHAR TLVType;
+	USHORT TLVLength;
+	UCHAR PCSCFNumber;
+} __attribute__ ((packed)) QMIWDS_GET_RUNNING_SETTINGS_PCSCF_IPV4_ADDR, *PQMIWDS_GET_RUNNING_SETTINGS_PCSCF_IPV4_ADDR;
+
+typedef struct _QMIWDS_GET_RUNTIME_SETTINGS_RESP_MSG
+{
+   USHORT Type;            // QMIWDS_GET_RUNTIME_SETTINGS_RESP
+   USHORT Length;
+   UCHAR  TLVType;         // QCTLV_TYPE_RESULT_CODE
+   USHORT TLVLength;       // 0x0004
+   USHORT QMUXResult;      // result code
+   USHORT QMUXError;       // error code
+} __attribute__ ((packed)) QMIWDS_GET_RUNTIME_SETTINGS_RESP_MSG, *PQMIWDS_GET_RUNTIME_SETTINGS_RESP_MSG;
+
+//#endif // QC_IP_MODE
+
+typedef struct _QMIWDS_IP_FAMILY_TLV
+{
+   UCHAR  TLVType;          // 0x12
+   USHORT TLVLength;        // 1
+   UCHAR  IpFamily;         // IPV4-0x04, IPV6-0x06
+} __attribute__ ((packed)) QMIWDS_IP_FAMILY_TLV, *PQMIWDS_IP_FAMILY_TLV;
+
+typedef struct _QMIWDS_PKT_SRVC_TLV
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ConnectionStatus;
+   UCHAR  ReconfigReqd;
+} __attribute__ ((packed)) QMIWDS_PKT_SRVC_TLV, *PQMIWDS_PKT_SRVC_TLV;
+
+typedef struct _QMIWDS_CALL_END_REASON_TLV
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT CallEndReason;
+} __attribute__ ((packed)) QMIWDS_CALL_END_REASON_TLV, *PQMIWDS_CALL_END_REASON_TLV;
+
+typedef struct _QMIWDS_CALL_END_REASON_V_TLV
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT CallEndReasonType;
+   USHORT CallEndReason;
+} __attribute__ ((packed)) QMIWDS_CALL_END_REASON_V_TLV, *PQMIWDS_CALL_END_REASON_V_TLV;
+
+typedef struct _QMIWDS_SET_CLIENT_IP_FAMILY_PREF_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x004D
+   USHORT Length;
+   UCHAR  TLVType;          // 0x01
+   USHORT TLVLength;        // 1
+   UCHAR  IpPreference;     // IPV4-0x04, IPV6-0x06
+} __attribute__ ((packed)) QMIWDS_SET_CLIENT_IP_FAMILY_PREF_REQ_MSG, *PQMIWDS_SET_CLIENT_IP_FAMILY_PREF_REQ_MSG;
+
+typedef struct _QMIWDS_SET_CLIENT_IP_FAMILY_PREF_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0037
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS, QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INTERNAL, QMI_ERR_MALFORMED_MSG, QMI_ERR_INVALID_ARG
+} __attribute__ ((packed)) QMIWDS_SET_CLIENT_IP_FAMILY_PREF_RESP_MSG, *PQMIWDS_SET_CLIENT_IP_FAMILY_PREF_RESP_MSG;
+
+typedef struct _QMIWDS_SET_AUTO_CONNECT_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0051
+   USHORT Length;
+   UCHAR  TLVType;          // 0x01
+   USHORT TLVLength;        // 1
+   UCHAR  autoconnect_setting;     //  0x00 ?C Disabled, 0x01 ?C Enabled, 0x02 ?C Paused (resume on power cycle)
+} __attribute__ ((packed)) QMIWDS_SET_AUTO_CONNECT_REQ_MSG, *PQMIWDS_SET_AUTO_CONNECT_REQ_MSG;
+
+#if 0
+typedef struct _QMIWDS_GET_MIP_MODE_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0040
+   USHORT Length;
+} QMIWDS_GET_MIP_MODE_REQ_MSG, *PQMIWDS_GET_MIP_MODE_REQ_MSG;
+
+typedef struct _QMIWDS_GET_MIP_MODE_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0040
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+
+   UCHAR  TLV2Type;         // 0x01
+   USHORT TLV2Length;       // 20
+   UCHAR  MipMode;          //
+} QMIWDS_GET_MIP_MODE_RESP_MSG, *PQMIWDS_GET_MIP_MODE_RESP_MSG;
+#endif
+
+typedef struct _QMIWDS_TECHNOLOGY_PREFERECE
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  TechPreference;
+} __attribute__ ((packed)) QMIWDS_TECHNOLOGY_PREFERECE, *PQMIWDS_TECHNOLOGY_PREFERECE;
+
+typedef struct _QMIWDS_PROFILE_IDENTIFIER
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ProfileIndex;
+} __attribute__ ((packed)) QMIWDS_PROFILE_IDENTIFIER, *PQMIWDS_PROFILE_IDENTIFIER;
+
+typedef struct _QMIWDS_BRINGUP_APNTYPE
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   BOOL  bring_up_by_apn_type;
+} __attribute__ ((packed)) QMIWDS_BRINGUP_APNTYPE, *PQMIWDS_BRINGUP_APNTYPE;
+
+
+typedef struct _QMIWDS_BRINGUP_APNNAME
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   BOOL  bring_up_by_apn_name;
+} __attribute__ ((packed)) QMIWDS_BRINGUP_APNNAME, *PQMIWDS_BRINGUP_APNNAME;
+
+typedef struct _PQMIWDS_APN_TYPE
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   int    apn_type;
+} __attribute__ ((packed)) QMIWDS_APN_TYPE, *PQMIWDS_APN_TYPE;
+
+#if 0
+typedef struct _QMIWDS_IPADDRESS
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   ULONG  IPv4Address;
+}QMIWDS_IPADDRESS, *PQMIWDS_IPADDRESS;
+
+/*
+typedef struct _QMIWDS_UMTS_QOS
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  TrafficClass;
+   ULONG  MaxUplinkBitRate;
+   ULONG  MaxDownlinkBitRate;
+   ULONG  GuarUplinkBitRate;
+   ULONG  GuarDownlinkBitRate;
+   UCHAR  QOSDevOrder;
+   ULONG  MAXSDUSize;
+   UCHAR  SDUErrorRatio;
+   UCHAR  ResidualBerRatio;
+   UCHAR  DeliveryErrorSDUs;
+   ULONG  TransferDelay;
+   ULONG  TrafficHndPri;
+}QMIWDS_UMTS_QOS, *PQMIWDS_UMTS_QOS;
+
+typedef struct _QMIWDS_GPRS_QOS
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   ULONG  PrecedenceClass;
+   ULONG  DelayClass;
+   ULONG  ReliabilityClass;
+   ULONG  PeekThroClass;
+   ULONG  MeanThroClass;
+}QMIWDS_GPRS_QOS, *PQMIWDS_GPRS_QOS;
+*/
+#endif
+
+typedef struct _QMIWDS_PDPCONTEXT
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  pdp_context;
+} __attribute__ ((packed)) QMIWDS_PDPCONTEXT, *PQMIWDS_PDPCONTEXT;
+
+typedef struct _QMIWDS_PROFILELIST
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ProfileList[1024];
+} __attribute__ ((packed)) QMIWDS_PROFILELIST, *PQMIWDS_PROFILELIST;
+
+typedef struct _QMIWDS_PROFILENAME
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ProfileName;
+} __attribute__ ((packed)) QMIWDS_PROFILENAME, *PQMIWDS_PROFILENAME;
+
+typedef struct _QMIWDS_PDPTYPE
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+// 0 ?C PDP-IP (IPv4)
+// 1 ?C PDP-PPP
+// 2 ?C PDP-IPv6
+// 3 ?C PDP-IPv4v6
+    UCHAR  PdpType;
+} __attribute__ ((packed)) QMIWDS_PDPTYPE, *PQMIWDS_PDPTYPE;
+
+typedef struct _QMIWDS_USERNAME
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  UserName;
+} __attribute__ ((packed)) QMIWDS_USERNAME, *PQMIWDS_USERNAME;
+
+typedef struct _QMIWDS_PD
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  Pd;
+} __attribute__ ((packed)) QMIWDS_PD, *PQMIWDS_PD;
+
+typedef struct _QMIWDS_AUTH_PREFERENCE
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  AuthPreference;
+} __attribute__ ((packed)) QMIWDS_AUTH_PREFERENCE, *PQMIWDS_AUTH_PREFERENCE;
+
+typedef struct _QMIWDS_IPTYPE
+{
+    UCHAR TLVType;
+    USHORT TLVLength;
+    UCHAR IPType;
+} __attribute__ ((packed)) QMIWDS_IPTYPE, *PQMIWDS_IPTYPE;
+
+typedef struct _QMIWDS_APNNAME
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ApnName;
+} __attribute__ ((packed)) QMIWDS_APNNAME, *PQMIWDS_APNNAME;
+
+typedef struct _QMIWDS_AUTOCONNECT
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  AutoConnect;
+} __attribute__ ((packed)) QMIWDS_AUTOCONNECT, *PQMIWDS_AUTOCONNECT;
+
+typedef struct _QMIWDS_START_NETWORK_INTERFACE_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+} __attribute__ ((packed)) QMIWDS_START_NETWORK_INTERFACE_REQ_MSG, *PQMIWDS_START_NETWORK_INTERFACE_REQ_MSG;
+
+typedef struct _QMIWDS_CALLENDREASON
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT Reason;
+}__attribute__ ((packed)) QMIWDS_CALLENDREASON, *PQMIWDS_CALLENDREASON;
+
+typedef struct _QMIWDS_START_NETWORK_INTERFACE_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0040
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+
+   UCHAR  TLV2Type;         // 0x01
+   USHORT TLV2Length;       // 20
+   ULONG  Handle;          //
+} __attribute__ ((packed)) QMIWDS_START_NETWORK_INTERFACE_RESP_MSG, *PQMIWDS_START_NETWORK_INTERFACE_RESP_MSG;
+
+typedef struct _QMIWDS_STOP_NETWORK_INTERFACE_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   ULONG  Handle;
+} __attribute__ ((packed)) QMIWDS_STOP_NETWORK_INTERFACE_REQ_MSG, *PQMIWDS_STOP_NETWORK_INTERFACE_REQ_MSG;
+
+typedef struct _QMIWDS_STOP_NETWORK_INTERFACE_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0040
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+
+} __attribute__ ((packed)) QMIWDS_STOP_NETWORK_INTERFACE_RESP_MSG, *PQMIWDS_STOP_NETWORK_INTERFACE_RESP_MSG;
+
+typedef struct _QMIWDS_GET_DEFAULT_SETTINGS_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ProfileType;
+} __attribute__ ((packed)) QMIWDS_GET_DEFAULT_SETTINGS_REQ_MSG, *PQMIWDS_GET_DEFAULT_SETTINGS_REQ_MSG;
+
+typedef struct _QMIWDS_GET_DEFAULT_SETTINGS_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} __attribute__ ((packed)) QMIWDS_GET_DEFAULT_SETTINGS_RESP_MSG, *PQMIWDS_GET_DEFAULT_SETTINGS_RESP_MSG;
+
+typedef struct _QMIWDS_MODIFY_PROFILE_SETTINGS_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ProfileType;
+   UCHAR  ProfileIndex;
+} __attribute__ ((packed)) QMIWDS_MODIFY_PROFILE_SETTINGS_REQ_MSG, *PQMIWDS_MODIFY_PROFILE_SETTINGS_REQ_MSG;
+
+typedef struct _QMIWDS_MODIFY_PROFILE_SETTINGS_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} __attribute__ ((packed)) QMIWDS_MODIFY_PROFILE_SETTINGS_RESP_MSG, *PQMIWDS_MODIFY_PROFILE_SETTINGS_RESP_MSG;
+
+typedef struct _QMIWDS_GET_PROFILE_SETTINGS_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ProfileType;
+   UCHAR  ProfileIndex;
+} __attribute__ ((packed)) QMIWDS_GET_PROFILE_SETTINGS_REQ_MSG, *PQMIWDS_GET_PROFILE_SETTINGS_REQ_MSG;
+
+typedef struct _QMIWDS_CREATE_PROFILE_SETTINGS_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ProfileType;
+   UCHAR  TLV2Type; //0x25
+   USHORT TLV2Length;
+   UCHAR  pdp_context;
+} __attribute__ ((packed)) QMIWDS_CREATE_PROFILE_SETTINGS_REQ_MSG, *PQMIWDS_CREATE_PROFILE_SETTINGS_REQ_MSG;
+
+typedef struct _QMIWDS_GET_PROFILE_LIST_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+} __attribute__ ((packed)) QMIWDS_GET_PROFILE_LIST_REQ_MSG, *PQMIWDS_GET_PROFILE_LIST_REQ_MSG;
+
+typedef struct _QMIWDS_GET_PROFILE_LIST_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ProfileList[1024];
+} __attribute__ ((packed)) QMIWDS_GET_PROFILE_LIST_RESP_MSG, *PQMIWDS_GET_PROFILE_LIST_RESP_MSG;
+
+#if 0
+typedef struct _QMIWDS_EVENT_REPORT_IND_DATA_BEARER_TLV
+{
+   UCHAR  Type;
+   USHORT Length;
+   UCHAR  DataBearer;
+} QMIWDS_EVENT_REPORT_IND_DATA_BEARER_TLV, *PQMIWDS_EVENT_REPORT_IND_DATA_BEARER_TLV;
+
+typedef struct _QMIWDS_EVENT_REPORT_IND_DORMANCY_STATUS_TLV
+{
+   UCHAR  Type;
+   USHORT Length;
+   UCHAR  DormancyStatus;
+} QMIWDS_EVENT_REPORT_IND_DORMANCY_STATUS_TLV, *PQMIWDS_EVENT_REPORT_IND_DORMANCY_STATUS_TLV;
+
+
+typedef struct _QMIWDS_GET_DATA_BEARER_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0037
+   USHORT Length;
+} QMIWDS_GET_DATA_BEARER_REQ_MSG, *PQMIWDS_GET_DATA_BEARER_REQ_MSG;
+
+typedef struct _QMIWDS_GET_DATA_BEARER_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0037
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INTERNAL
+                            // QMI_ERR_MALFORMED_MSG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_OUT_OF_CALL
+                            // QMI_ERR_INFO_UNAVAILABLE
+   UCHAR  TLV2Type;         // 0x01
+   USHORT TLV2Length;       //
+   UCHAR  Technology;       //
+} QMIWDS_GET_DATA_BEARER_RESP_MSG, *PQMIWDS_GET_DATA_BEARER_RESP_MSG;
+#endif
+
+// ======================= DMS ==============================
+#define QMIDMS_SET_EVENT_REPORT_REQ           0x0001
+#define QMIDMS_SET_EVENT_REPORT_RESP          0x0001
+#define QMIDMS_EVENT_REPORT_IND               0x0001
+#define QMIDMS_GET_DEVICE_CAP_REQ             0x0020
+#define QMIDMS_GET_DEVICE_CAP_RESP            0x0020
+#define QMIDMS_GET_DEVICE_MFR_REQ             0x0021
+#define QMIDMS_GET_DEVICE_MFR_RESP            0x0021
+#define QMIDMS_GET_DEVICE_MODEL_ID_REQ        0x0022
+#define QMIDMS_GET_DEVICE_MODEL_ID_RESP       0x0022
+#define QMIDMS_GET_DEVICE_REV_ID_REQ          0x0023
+#define QMIDMS_GET_DEVICE_REV_ID_RESP         0x0023
+#define QMIDMS_GET_MSISDN_REQ                 0x0024
+#define QMIDMS_GET_MSISDN_RESP                0x0024
+#define QMIDMS_GET_DEVICE_SERIAL_NUMBERS_REQ  0x0025
+#define QMIDMS_GET_DEVICE_SERIAL_NUMBERS_RESP 0x0025
+#define QMIDMS_UIM_SET_PIN_PROTECTION_REQ     0x0027
+#define QMIDMS_UIM_SET_PIN_PROTECTION_RESP    0x0027
+#define QMIDMS_UIM_VERIFY_PIN_REQ             0x0028
+#define QMIDMS_UIM_VERIFY_PIN_RESP            0x0028
+#define QMIDMS_UIM_UNBLOCK_PIN_REQ            0x0029
+#define QMIDMS_UIM_UNBLOCK_PIN_RESP           0x0029
+#define QMIDMS_UIM_CHANGE_PIN_REQ             0x002A
+#define QMIDMS_UIM_CHANGE_PIN_RESP            0x002A
+#define QMIDMS_UIM_GET_PIN_STATUS_REQ         0x002B
+#define QMIDMS_UIM_GET_PIN_STATUS_RESP        0x002B
+#define QMIDMS_GET_DEVICE_HARDWARE_REV_REQ    0x002C
+#define QMIDMS_GET_DEVICE_HARDWARE_REV_RESP   0x002C
+#define QMIDMS_GET_OPERATING_MODE_REQ         0x002D
+#define QMIDMS_GET_OPERATING_MODE_RESP        0x002D
+#define QMIDMS_SET_OPERATING_MODE_REQ         0x002E
+#define QMIDMS_SET_OPERATING_MODE_RESP        0x002E
+#define QMIDMS_GET_ACTIVATED_STATUS_REQ       0x0031
+#define QMIDMS_GET_ACTIVATED_STATUS_RESP      0x0031
+#define QMIDMS_ACTIVATE_AUTOMATIC_REQ         0x0032
+#define QMIDMS_ACTIVATE_AUTOMATIC_RESP        0x0032
+#define QMIDMS_ACTIVATE_MANUAL_REQ            0x0033
+#define QMIDMS_ACTIVATE_MANUAL_RESP           0x0033
+#define QMIDMS_UIM_GET_ICCID_REQ              0x003C
+#define QMIDMS_UIM_GET_ICCID_RESP             0x003C
+#define QMIDMS_UIM_GET_CK_STATUS_REQ          0x0040
+#define QMIDMS_UIM_GET_CK_STATUS_RESP         0x0040
+#define QMIDMS_UIM_SET_CK_PROTECTION_REQ      0x0041
+#define QMIDMS_UIM_SET_CK_PROTECTION_RESP     0x0041
+#define QMIDMS_UIM_UNBLOCK_CK_REQ             0x0042
+#define QMIDMS_UIM_UNBLOCK_CK_RESP            0x0042
+#define QMIDMS_UIM_GET_IMSI_REQ               0x0043
+#define QMIDMS_UIM_GET_IMSI_RESP              0x0043
+#define QMIDMS_UIM_GET_STATE_REQ              0x0044
+#define QMIDMS_UIM_GET_STATE_RESP             0x0044
+#define QMIDMS_GET_BAND_CAP_REQ               0x0045
+#define QMIDMS_GET_BAND_CAP_RESP              0x0045
+
+#if 0
+typedef struct _QMIDMS_GET_DEVICE_MFR_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+} QMIDMS_GET_DEVICE_MFR_REQ_MSG, *PQMIDMS_GET_DEVICE_MFR_REQ_MSG;
+
+typedef struct _QMIDMS_GET_DEVICE_MFR_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+   UCHAR  TLV2Type;         // 0x01 - required parameter
+   USHORT TLV2Length;       // length of the mfr string
+   UCHAR  DeviceManufacturer; // first byte of string
+} QMIDMS_GET_DEVICE_MFR_RESP_MSG, *PQMIDMS_GET_DEVICE_MFR_RESP_MSG;
+
+typedef struct _QMIDMS_GET_DEVICE_MODEL_ID_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0004
+   USHORT Length;
+} QMIDMS_GET_DEVICE_MODEL_ID_REQ_MSG, *PQMIDMS_GET_DEVICE_MODEL_ID_REQ_MSG;
+
+typedef struct _QMIDMS_GET_DEVICE_MODEL_ID_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0004
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+   UCHAR  TLV2Type;         // 0x01 - required parameter
+   USHORT TLV2Length;       // length of the modem id string
+   UCHAR  DeviceModelID;    // device model id
+} QMIDMS_GET_DEVICE_MODEL_ID_RESP_MSG, *PQMIDMS_GET_DEVICE_MODEL_ID_RESP_MSG;
+#endif
+
+typedef struct _QMIDMS_GET_DEVICE_REV_ID_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0005
+   USHORT Length;
+} __attribute__ ((packed)) QMIDMS_GET_DEVICE_REV_ID_REQ_MSG, *PQMIDMS_GET_DEVICE_REV_ID_REQ_MSG;
+
+typedef struct _DEVICE_REV_ID
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  RevisionID;
+} __attribute__ ((packed)) DEVICE_REV_ID, *PDEVICE_REV_ID;
+
+#if 0
+typedef struct _QMIDMS_GET_DEVICE_REV_ID_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0023
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} QMIDMS_GET_DEVICE_REV_ID_RESP_MSG, *PQMIDMS_GET_DEVICE_REV_ID_RESP_MSG;
+
+typedef struct _QMIDMS_GET_MSISDN_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+} QMIDMS_GET_MSISDN_REQ_MSG, *PQMIDMS_GET_MSISDN_REQ_MSG;
+
+typedef struct _QCTLV_DEVICE_VOICE_NUMBERS
+{
+   UCHAR  TLVType;            // as defined above
+   USHORT TLVLength;          // 4/7/7
+   UCHAR  VoideNumberString; // ESN, IMEI, or MEID
+
+} QCTLV_DEVICE_VOICE_NUMBERS, *PQCTLV_DEVICE_VOICE_NUMBERS;
+
+
+typedef struct _QMIDMS_GET_MSISDN_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+} QMIDMS_GET_MSISDN_RESP_MSG, *PQMIDMS_GET_MSISDN_RESP_MSG;
+#endif
+
+typedef struct _QMIDMS_UIM_GET_IMSI_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+} __attribute__ ((packed)) QMIDMS_UIM_GET_IMSI_REQ_MSG, *PQMIDMS_UIM_GET_IMSI_REQ_MSG;
+
+typedef struct _QMIDMS_UIM_GET_IMSI_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR IMSI;
+} __attribute__ ((packed)) QMIDMS_UIM_GET_IMSI_RESP_MSG, *PQMIDMS_UIM_GET_IMSI_RESP_MSG;
+
+#if 0
+typedef struct _QMIDMS_GET_DEVICE_SERIAL_NUMBERS_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0007
+   USHORT Length;
+} QMIDMS_GET_DEVICE_SERIAL_NUMBERS_REQ_MSG, *PQMIDMS_GET_DEVICE_SERIAL_NUMBERS_REQ_MSG;
+
+#define QCTLV_TYPE_SER_NUM_ESN  0x10
+#define QCTLV_TYPE_SER_NUM_IMEI 0x11
+#define QCTLV_TYPE_SER_NUM_MEID 0x12
+
+typedef struct _QCTLV_DEVICE_SERIAL_NUMBER
+{
+   UCHAR  TLVType;            // as defined above
+   USHORT TLVLength;          // 4/7/7
+   UCHAR  SerialNumberString; // ESN, IMEI, or MEID
+
+} QCTLV_DEVICE_SERIAL_NUMBER, *PQCTLV_DEVICE_SERIAL_NUMBER;
+
+typedef struct _QMIDMS_GET_DEVICE_SERIAL_NUMBERS_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0007
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+  // followed by optional TLV
+} QMIDMS_GET_DEVICE_SERIAL_NUMBERS_RESP_MSG, *PQMIDMS_GET_DEVICE_SERIAL_NUMBERS_RESP;
+
+typedef struct _QMIDMS_GET_DMS_BAND_CAP
+{
+   USHORT  Type;
+   USHORT  Length;
+} QMIDMS_GET_BAND_CAP_REQ_MSG, *PQMIDMS_GET_BAND_CAP_REQ_MSG;
+
+typedef struct _QMIDMS_GET_BAND_CAP_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_NONE
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_MALFORMED_MSG
+                            // QMI_ERR_NO_MEMORY
+
+   UCHAR  TLV2Type;         // 0x01
+   USHORT TLV2Length;       // 2
+   ULONG64 BandCap;
+} QMIDMS_GET_BAND_CAP_RESP_MSG, *PQMIDMS_GET_BAND_CAP_RESP;
+
+typedef struct _QMIDMS_GET_DEVICE_CAP_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0002
+   USHORT Length;
+} QMIDMS_GET_DEVICE_CAP_REQ_MSG, *PQMIDMS_GET_DEVICE_CAP_REQ_MSG;
+
+typedef struct _QMIDMS_GET_DEVICE_CAP_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0002
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMUX_RESULT_SUCCESS
+                            // QMUX_RESULT_FAILURE
+   USHORT QMUXError;        // QMUX_ERR_INVALID_ARG
+                            // QMUX_ERR_NO_MEMORY
+                            // QMUX_ERR_INTERNAL
+                            // QMUX_ERR_FAULT
+   UCHAR  TLV2Type;         // 0x01
+   USHORT TLV2Length;       // 2
+
+   ULONG  MaxTxChannelRate;
+   ULONG  MaxRxChannelRate;
+   UCHAR  VoiceCap;
+   UCHAR  SimCap;
+
+   UCHAR  RadioIfListCnt;   // #elements in radio interface list
+   UCHAR  RadioIfList;      // N 1-byte elements
+} QMIDMS_GET_DEVICE_CAP_RESP_MSG, *PQMIDMS_GET_DEVICE_CAP_RESP_MSG;
+
+typedef struct _QMIDMS_GET_ACTIVATED_STATUS_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0002
+   USHORT Length;
+} QMIDMS_GET_ACTIVATED_STATUS_REQ_MSG, *PQMIDMS_GET_ACTIVATES_STATUD_REQ_MSG;
+
+typedef struct _QMIDMS_GET_ACTIVATED_STATUS_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0002
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMUX_RESULT_SUCCESS
+                            // QMUX_RESULT_FAILURE
+   USHORT QMUXError;        // QMUX_ERR_INVALID_ARG
+                            // QMUX_ERR_NO_MEMORY
+                            // QMUX_ERR_INTERNAL
+                            // QMUX_ERR_FAULT
+   UCHAR  TLV2Type;         // 0x01
+   USHORT TLV2Length;       // 2
+
+   USHORT ActivatedStatus;
+} QMIDMS_GET_ACTIVATED_STATUS_RESP_MSG, *PQMIDMS_GET_ACTIVATED_STATUS_RESP_MSG;
+
+typedef struct _QMIDMS_GET_OPERATING_MODE_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0002
+   USHORT Length;
+} QMIDMS_GET_OPERATING_MODE_REQ_MSG, *PQMIDMS_GET_OPERATING_MODE_REQ_MSG;
+
+typedef struct _OFFLINE_REASON
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT OfflineReason;
+} OFFLINE_REASON, *POFFLINE_REASON;
+
+typedef struct _HARDWARE_RESTRICTED_MODE
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  HardwareControlledMode;
+} HARDWARE_RESTRICTED_MODE, *PHARDWARE_RESTRICTED_MODE;
+
+typedef struct _QMIDMS_GET_OPERATING_MODE_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0002
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMUX_RESULT_SUCCESS
+                            // QMUX_RESULT_FAILURE
+   USHORT QMUXError;        // QMUX_ERR_INVALID_ARG
+                            // QMUX_ERR_NO_MEMORY
+                            // QMUX_ERR_INTERNAL
+                            // QMUX_ERR_FAULT
+   UCHAR  TLV2Type;         // 0x01
+   USHORT TLV2Length;       // 2
+
+   UCHAR  OperatingMode;
+} QMIDMS_GET_OPERATING_MODE_RESP_MSG, *PQMIDMS_GET_OPERATING_MODE_RESP_MSG;
+
+typedef struct _QMIDMS_UIM_GET_ICCID_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+} QMIDMS_UIM_GET_ICCID_REQ_MSG, *PQMIDMS_UIM_GET_ICCID_REQ_MSG;
+
+typedef struct _QMIDMS_UIM_GET_ICCID_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+   UCHAR  TLV2Type;         // 0x01 - required parameter
+   USHORT TLV2Length;       // var
+   UCHAR  ICCID;      // String of voice number
+} QMIDMS_UIM_GET_ICCID_RESP_MSG, *PQMIDMS_UIM_GET_ICCID_RESP_MSG;
+#endif
+
+typedef struct _QMIDMS_SET_OPERATING_MODE_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0002
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   UCHAR  OperatingMode;
+} __attribute__ ((packed)) QMIDMS_SET_OPERATING_MODE_REQ_MSG, *PQMIDMS_SET_OPERATING_MODE_REQ_MSG;
+
+typedef struct _QMIDMS_SET_OPERATING_MODE_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0002
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMUX_RESULT_SUCCESS
+                            // QMUX_RESULT_FAILURE
+   USHORT QMUXError;        // QMUX_ERR_INVALID_ARG
+                            // QMUX_ERR_NO_MEMORY
+                            // QMUX_ERR_INTERNAL
+                            // QMUX_ERR_FAULT
+} __attribute__ ((packed)) QMIDMS_SET_OPERATING_MODE_RESP_MSG, *PQMIDMS_SET_OPERATING_MODE_RESP_MSG;
+
+#if 0
+typedef struct _QMIDMS_ACTIVATE_AUTOMATIC_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        //
+   UCHAR  ActivateCodelen;
+   UCHAR  ActivateCode;
+} QMIDMS_ACTIVATE_AUTOMATIC_REQ_MSG, *PQMIDMS_ACTIVATE_AUTOMATIC_REQ_MSG;
+
+typedef struct _QMIDMS_ACTIVATE_AUTOMATIC_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} QMIDMS_ACTIVATE_AUTOMATIC_RESP_MSG, *PQMIDMS_ACTIVATE_AUTOMATIC_RESP_MSG;
+
+
+typedef struct _SPC_MSG
+{
+   UCHAR SPC[6];
+   USHORT SID;
+} SPC_MSG, *PSPC_MSG;
+
+typedef struct _MDN_MSG
+{
+   UCHAR MDNLEN;
+   UCHAR MDN;
+} MDN_MSG, *PMDN_MSG;
+
+typedef struct _MIN_MSG
+{
+   UCHAR MINLEN;
+   UCHAR MIN;
+} MIN_MSG, *PMIN_MSG;
+
+typedef struct _PRL_MSG
+{
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        //
+   USHORT PRLLEN;
+   UCHAR PRL;
+} PRL_MSG, *PPRL_MSG;
+
+typedef struct _MN_HA_KEY_MSG
+{
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        //
+   UCHAR MN_HA_KEY_LEN;
+   UCHAR MN_HA_KEY;
+} MN_HA_KEY_MSG, *PMN_HA_KEY_MSG;
+
+typedef struct _MN_AAA_KEY_MSG
+{
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        //
+   UCHAR MN_AAA_KEY_LEN;
+   UCHAR MN_AAA_KEY;
+} MN_AAA_KEY_MSG, *PMN_AAA_KEY_MSG;
+
+typedef struct _QMIDMS_ACTIVATE_MANUAL_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        //
+   UCHAR  Value;
+} QMIDMS_ACTIVATE_MANUAL_REQ_MSG, *PQMIDMS_ACTIVATE_MANUAL_REQ_MSG;
+
+typedef struct _QMIDMS_ACTIVATE_MANUAL_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} QMIDMS_ACTIVATE_MANUAL_RESP_MSG, *PQMIDMS_ACTIVATE_MANUAL_RESP_MSG;
+#endif
+
+typedef struct _QMIDMS_UIM_GET_STATE_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+} __attribute__ ((packed)) QMIDMS_UIM_GET_STATE_REQ_MSG, *PQMIDMS_UIM_GET_STATE_REQ_MSG;
+
+typedef struct _QMIDMS_UIM_GET_STATE_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  UIMState;
+} __attribute__ ((packed)) QMIDMS_UIM_GET_STATE_RESP_MSG, *PQMIDMS_UIM_GET_STATE_RESP_MSG;
+
+typedef struct _QMIDMS_UIM_GET_PIN_STATUS_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+} __attribute__ ((packed)) QMIDMS_UIM_GET_PIN_STATUS_REQ_MSG, *PQMIDMS_UIM_GET_PIN_STATUS_REQ_MSG;
+
+typedef struct _QMIDMS_UIM_PIN_STATUS
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  PINStatus;
+   UCHAR  PINVerifyRetriesLeft;
+   UCHAR  PINUnblockRetriesLeft;
+} __attribute__ ((packed)) QMIDMS_UIM_PIN_STATUS, *PQMIDMS_UIM_PIN_STATUS;
+
+#define QMI_PIN_STATUS_NOT_INIT      0
+#define QMI_PIN_STATUS_NOT_VERIF     1
+#define QMI_PIN_STATUS_VERIFIED      2
+#define QMI_PIN_STATUS_DISABLED      3
+#define QMI_PIN_STATUS_BLOCKED       4
+#define QMI_PIN_STATUS_PERM_BLOCKED  5
+#define QMI_PIN_STATUS_UNBLOCKED     6
+#define QMI_PIN_STATUS_CHANGED       7
+
+
+typedef struct _QMIDMS_UIM_GET_PIN_STATUS_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+   UCHAR PinStatus;
+} __attribute__ ((packed)) QMIDMS_UIM_GET_PIN_STATUS_RESP_MSG, *PQMIDMS_UIM_GET_PIN_STATUS_RESP_MSG;
+
+#if 0
+typedef struct _QMIDMS_UIM_GET_CK_STATUS_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  Facility;
+} QMIDMS_UIM_GET_CK_STATUS_REQ_MSG, *PQMIDMS_UIM_GET_CK_STATUS_REQ_MSG;
+
+
+typedef struct _QMIDMS_UIM_CK_STATUS
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  FacilityStatus;
+   UCHAR  FacilityVerifyRetriesLeft;
+   UCHAR  FacilityUnblockRetriesLeft;
+} QMIDMS_UIM_CK_STATUS, *PQMIDMS_UIM_CK_STATUS;
+
+typedef struct _QMIDMS_UIM_CK_OPERATION_STATUS
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  OperationBlocking;
+} QMIDMS_UIM_CK_OPERATION_STATUS, *PQMIDMS_UIM_CK_OPERATION_STATUS;
+
+typedef struct _QMIDMS_UIM_GET_CK_STATUS_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+   UCHAR  CkStatus;
+} QMIDMS_UIM_GET_CK_STATUS_RESP_MSG, *PQMIDMS_UIM_GET_CK_STATUS_RESP_MSG;
+#endif
+
+typedef struct _QMIDMS_UIM_VERIFY_PIN_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   UCHAR  PINID;
+   UCHAR  PINLen;
+   UCHAR  PINValue;
+} __attribute__ ((packed)) QMIDMS_UIM_VERIFY_PIN_REQ_MSG, *PQMIDMS_UIM_VERIFY_PIN_REQ_MSG;
+
+typedef struct _QMIDMS_UIM_VERIFY_PIN_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  PINVerifyRetriesLeft;
+   UCHAR  PINUnblockRetriesLeft;
+} __attribute__ ((packed)) QMIDMS_UIM_VERIFY_PIN_RESP_MSG, *PQMIDMS_UIM_VERIFY_PIN_RESP_MSG;
+
+#if 0
+typedef struct _QMIDMS_UIM_SET_PIN_PROTECTION_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   UCHAR  PINID;
+   UCHAR  ProtectionSetting;
+   UCHAR  PINLen;
+   UCHAR  PINValue;
+} QMIDMS_UIM_SET_PIN_PROTECTION_REQ_MSG, *PQMIDMS_UIM_SET_PIN_PROTECTION_REQ_MSG;
+
+typedef struct _QMIDMS_UIM_SET_PIN_PROTECTION_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  PINVerifyRetriesLeft;
+   UCHAR  PINUnblockRetriesLeft;
+} QMIDMS_UIM_SET_PIN_PROTECTION_RESP_MSG, *PQMIDMS_UIM_SET_PIN_PROTECTION_RESP_MSG;
+
+typedef struct _QMIDMS_UIM_SET_CK_PROTECTION_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  Facility;
+   UCHAR  FacilityState;
+   UCHAR  FacliltyLen;
+   UCHAR  FacliltyValue;
+} QMIDMS_UIM_SET_CK_PROTECTION_REQ_MSG, *PQMIDMS_UIM_SET_CK_PROTECTION_REQ_MSG;
+
+typedef struct _QMIDMS_UIM_SET_CK_PROTECTION_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  FacilityRetriesLeft;
+} QMIDMS_UIM_SET_CK_PROTECTION_RESP_MSG, *PQMIDMS_UIM_SET_CK_PROTECTION_RESP_MSG;
+
+
+typedef struct _UIM_PIN
+{
+   UCHAR  PinLength;
+   UCHAR  PinValue;
+} UIM_PIN, *PUIM_PIN;
+
+typedef struct _QMIDMS_UIM_CHANGE_PIN_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   UCHAR  PINID;
+   UCHAR  PinDetails;
+} QMIDMS_UIM_CHANGE_PIN_REQ_MSG, *PQMIDMS_UIM_CHANGE_PIN_REQ_MSG;
+
+typedef struct QMIDMS_UIM_CHANGE_PIN_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  PINVerifyRetriesLeft;
+   UCHAR  PINUnblockRetriesLeft;
+} QMIDMS_UIM_CHANGE_PIN_RESP_MSG, *PQMIDMS_UIM_CHANGE_PIN_RESP_MSG;
+
+typedef struct _UIM_PUK
+{
+   UCHAR  PukLength;
+   UCHAR  PukValue;
+} UIM_PUK, *PUIM_PUK;
+
+typedef struct _QMIDMS_UIM_UNBLOCK_PIN_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   UCHAR  PINID;
+   UCHAR  PinDetails;
+} QMIDMS_UIM_UNBLOCK_PIN_REQ_MSG, *PQMIDMS_UIM_BLOCK_PIN_REQ_MSG;
+
+typedef struct QMIDMS_UIM_UNBLOCK_PIN_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0024
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  PINVerifyRetriesLeft;
+   UCHAR  PINUnblockRetriesLeft;
+} QMIDMS_UIM_UNBLOCK_PIN_RESP_MSG, *PQMIDMS_UIM_UNBLOCK_PIN_RESP_MSG;
+
+typedef struct _QMIDMS_UIM_UNBLOCK_CK_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  Facility;
+   UCHAR  FacliltyUnblockLen;
+   UCHAR  FacliltyUnblockValue;
+} QMIDMS_UIM_UNBLOCK_CK_REQ_MSG, *PQMIDMS_UIM_BLOCK_CK_REQ_MSG;
+
+typedef struct QMIDMS_UIM_UNBLOCK_CK_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  FacilityUnblockRetriesLeft;
+} QMIDMS_UIM_UNBLOCK_CK_RESP_MSG, *PQMIDMS_UIM_UNBLOCK_CK_RESP_MSG;
+
+typedef struct _QMIDMS_SET_EVENT_REPORT_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+} QMIDMS_SET_EVENT_REPORT_REQ_MSG, *PQMIDMS_SET_EVENT_REPORT_REQ_MSG;
+
+typedef struct _QMIDMS_SET_EVENT_REPORT_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+} QMIDMS_SET_EVENT_REPORT_RESP_MSG, *PQMIDMS_SET_EVENT_REPORT_RESP_MSG;
+
+typedef struct _PIN_STATUS
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ReportPinState;
+} PIN_STATUS, *PPIN_STATUS;
+
+typedef struct _POWER_STATUS
+{
+   UCHAR TLVType;
+   USHORT TLVLength;
+   UCHAR PowerStatus;
+   UCHAR BatteryLvl;
+} POWER_STATUS, *PPOWER_STATUS;
+
+typedef struct _ACTIVATION_STATE
+{
+   UCHAR TLVType;
+   USHORT TLVLength;
+   USHORT ActivationState;
+} ACTIVATION_STATE, *PACTIVATION_STATE;
+
+typedef struct _ACTIVATION_STATE_REQ
+{
+   UCHAR TLVType;
+   USHORT TLVLength;
+   UCHAR ActivationState;
+} ACTIVATION_STATE_REQ, *PACTIVATION_STATE_REQ;
+
+typedef struct _OPERATING_MODE
+{
+   UCHAR TLVType;
+   USHORT TLVLength;
+   UCHAR OperatingMode;
+} OPERATING_MODE, *POPERATING_MODE;
+
+typedef struct _UIM_STATE
+{
+   UCHAR TLVType;
+   USHORT TLVLength;
+   UCHAR UIMState;
+} UIM_STATE, *PUIM_STATE;
+
+typedef struct _WIRELESS_DISABLE_STATE
+{
+   UCHAR TLVType;
+   USHORT TLVLength;
+   UCHAR WirelessDisableState;
+} WIRELESS_DISABLE_STATE, *PWIRELESS_DISABLE_STATE;
+
+typedef struct _QMIDMS_EVENT_REPORT_IND_MSG
+{
+   USHORT Type;
+   USHORT Length;
+} QMIDMS_EVENT_REPORT_IND_MSG, *PQMIDMS_EVENT_REPORT_IND_MSG;
+#endif
+
+// ============================ END OF DMS ===============================
+
+// ======================= QOS ==============================
+typedef struct _MPIOC_DEV_INFO MPIOC_DEV_INFO, *PMPIOC_DEV_INFO;
+
+#define QMI_QOS_SET_EVENT_REPORT_REQ        0x0001
+#define QMI_QOS_SET_EVENT_REPORT_RESP       0x0001
+#define QMI_QOS_SET_EVENT_REPORT_IND        0x0001
+#define QMI_QOS_BIND_DATA_PORT_REQ          0x002B
+#define QMI_QOS_BIND_DATA_PORT_RESP         0x002B
+#define QMI_QOS_INDICATION_REGISTER_REQ	    0x002F
+#define QMI_QOS_INDICATION_REGISTER_RESP    0x002F
+#define QMI_QOS_GLOBAL_QOS_FLOW_IND	        0x0031
+#define QMI_QOS_GET_QOS_INFO_REQ            0x0033
+#define QMI_QOS_GET_QOS_INFO_RESP           0x0033
+
+
+#if 1
+typedef struct _QMI_QOS_SET_EVENT_REPORT_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0001
+   USHORT Length;
+   // UCHAR  TLVType;          // 0x01 - physical link state
+   // USHORT TLVLength;        // 1
+   // UCHAR  PhyLinkStatusRpt; // 0-enable; 1-disable
+   UCHAR  TLVType2;         // 0x02 = global flow reporting
+   USHORT TLVLength2;       // 1
+   UCHAR  GlobalFlowRpt;    // 1-enable; 0-disable
+} QMI_QOS_SET_EVENT_REPORT_REQ_MSG, *PQMI_QOS_SET_EVENT_REPORT_REQ_MSG;
+
+typedef struct _QMI_QOS_SET_EVENT_REPORT_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0010
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMUX_RESULT_SUCCESS
+                            // QMUX_RESULT_FAILURE
+   USHORT QMUXError;        // QMUX_ERR_INVALID_ARG
+                            // QMUX_ERR_NO_MEMORY
+                            // QMUX_ERR_INTERNAL
+                            // QMUX_ERR_FAULT
+} QMI_QOS_SET_EVENT_REPORT_RESP_MSG, *PQMI_QOS_SET_EVENT_REPORT_RESP_MSG;
+
+typedef struct _QMI_QOS_SET_EVENT_REPORT_IND_MSG
+{
+   USHORT Type;             // QMUX type 0x0001
+   USHORT Length;
+   UCHAR  TLVs;
+} QMI_QOS_SET_EVENT_REPORT_IND_MSG, *PQMI_QOS_SET_EVENT_REPORT_IND_MSG;
+
+
+typedef struct _QMI_QOS_BIND_DATA_PORT_TLV_EP_ID
+{
+	UCHAR	TLVType;		//0x10
+	USHORT	TLVLength;
+	ULONG	ep_type;
+	ULONG	iface_id;
+} __attribute__ ((packed)) QMI_QOS_BIND_DATA_PORT_TLV_EP_ID, *PQMI_QOS_BIND_DATA_PORT_TLV_EP_ID;
+
+typedef struct _QMI_QOS_BIND_DATA_PORT_TLV_MUX_ID
+{
+	UCHAR	TLVType;		//0x11
+	USHORT	TLVLength;
+	UCHAR	mux_id;
+} __attribute__ ((packed)) QMI_QOS_BIND_DATA_PORT_TLV_MUX_ID, *PQMI_QOS_BIND_DATA_PORT_TLV_MUX_ID;
+
+typedef struct _QMI_QOS_BIND_DATA_PORT_TLV_DATA_PORT
+{
+	UCHAR	TLVType;		//0x12
+	USHORT	TLVLength;
+	USHORT	data_port;
+} __attribute__ ((packed)) QMI_QOS_BIND_DATA_PORT_TLV_DATA_PORT, *PQMI_QOS_BIND_DATA_PORT_TLV_DATA_PORT;
+
+typedef struct _QMI_QOS_BIND_DATA_PORT_REQ_MSG
+{
+	USHORT	Type;
+	USHORT	Length;
+	QMI_QOS_BIND_DATA_PORT_TLV_EP_ID		EpIdTlv;
+	QMI_QOS_BIND_DATA_PORT_TLV_MUX_ID		MuxIdTlv;
+	//QMI_QOS_BIND_DATA_PORT_TLV_DATA_PORT	DataPortTlv;
+} __attribute__ ((packed)) QMI_QOS_BIND_DATA_PORT_REQ_MSG, *PQMI_QOS_BIND_DATA_PORT_REQ_MSG;
+
+typedef struct _QMI_QOS_BIND_DATA_PORT_RESP_MSG
+{
+	USHORT	Type;
+	USHORT	Length;
+	UCHAR	TLVType;		//0x02
+	USHORT	TLVLength;
+	USHORT	QMUXResult;
+	USHORT	QMUXError;
+} __attribute__ ((packed)) QMI_QOS_BIND_DATA_PORT_RESP_MSG, *PQMI_QOS_BIND_DATA_PORT_RESP_MSG;
+
+typedef struct _QMI_QOS_INDICATION_REGISTER_TLV_REPORT_GLOBAL_QOS_FLOW
+{
+	UCHAR	TLVType;		//0x10
+	USHORT	TLVLength;
+	UCHAR	report_global_qos_flows;
+} __attribute__ ((packed)) QMI_QOS_INDICATION_REGISTER_TLV_REPORT_GLOBAL_QOS_FLOW, *PQMI_QOS_INDICATION_REGISTER_TLV_REPORT_GLOBAL_QOS_FLOW;
+
+typedef struct _QMI_QOS_INDICATION_REGISTER_TLV_SUPPRESS_REPORT_FLOW_CTL
+{
+	UCHAR	TLVType;		//0x11
+	USHORT	TLVLength;
+	UCHAR	suppress_report_flow_control;
+} __attribute__ ((packed)) QMI_QOS_INDICATION_REGISTER_TLV_SUPPRESS_REPORT_FLOW_CTL, *PQMI_QOS_INDICATION_REGISTER_TLV_SUPPRESS_REPORT_FLOW_CTL;
+
+typedef struct _QMI_QOS_INDICATION_REGISTER_TLV_SUPPRESS_NW_STATUS_IND
+{
+	UCHAR	TLVType;		//0x12
+	USHORT	TLVLength;
+	UCHAR	suppress_network_status_ind;
+} __attribute__ ((packed)) QMI_QOS_INDICATION_REGISTER_TLV_SUPPRESS_NW_STATUS_IND, *PQMI_QOS_INDICATION_REGISTER_TLV_SUPPRESS_NW_STATUS_IND;
+
+typedef struct _QMI_QOS_INDICATION_REGISTER_REQ_MSG
+{
+	USHORT	Type;
+	USHORT	Length;
+	QMI_QOS_INDICATION_REGISTER_TLV_REPORT_GLOBAL_QOS_FLOW		ReportGlobalQosFlowTlv;
+ 	//QMI_QOS_INDICATION_REGISTER_TLV_SUPPRESS_REPORT_FLOW_CTL	SuppressReportFlowCtlTlv;
+	//QMI_QOS_INDICATION_REGISTER_TLV_SUPPRESS_NW_STATUS_IND		SuppressNWStatusIndTlv;
+} __attribute__ ((packed)) QMI_QOS_INDICATION_REGISTER_REQ_MSG, *PQMI_QOS_INDICATION_REGISTER_REQ_MSG;
+
+typedef struct _QMI_QOS_INDICATION_REGISTER_RESP_MSG
+{
+	USHORT	Type;
+	USHORT	Length;
+	UCHAR	TLVType;		//0x02
+	USHORT	TLVLength;
+	USHORT	QMUXResult;
+	USHORT	QMUXError;
+} __attribute__ ((packed)) QMI_QOS_INDICATION_REGISTER_RESP_MSG, *PQMI_QOS_INDICATION_REGISTER_RESP_MSG;
+
+typedef struct _QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_STATE
+{
+	UCHAR	TLVType;		//0x01
+	USHORT	TLVLength;
+	ULONG	qos_id;
+	UCHAR	new_flow;
+	ULONG	state_change;
+} __attribute__ ((packed)) QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_STATE, *PQMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_STATE;
+
+typedef struct _QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_GRANTED
+{
+	UCHAR	TLVType;		//0x10 0x11
+	USHORT	TLVLength;
+	ULONG64	flow_valid_params;
+	ULONG	ip_flow_trf_cls;
+	ULONG64 data_rate_max;
+	ULONG64	guaranteed_rate;
+	ULONG	peak_rate;
+	ULONG	token_rate;
+	ULONG	bucket_size;
+	ULONG	ip_flow_latency;
+	ULONG	ip_flow_jitter;
+	USHORT	ip_flow_pkt_error_rate_multiplier;
+	USHORT	ip_flow_pkt_error_rate_exponent;
+	ULONG	ip_flow_min_policed_packet_size;
+	ULONG	ip_flow_max_allowed_packet_size;
+	ULONG	ip_flow_3gpp_residual_bit_error_rate;
+	ULONG	ip_flow_3gpp_traffic_handling_priority;
+	USHORT	ip_flow_3gpp2_profile_id;
+	UCHAR	ip_flow_3gpp2_flow_priority;
+	UCHAR	ip_flow_3gpp_im_cn_flag;
+	UCHAR	ip_flow_3gpp_sig_ind;
+	ULONG	ip_flow_lte_qci;
+} __attribute__ ((packed)) QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_GRANTED, *PQMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_GRANTED;
+
+typedef struct _QMI_QOS_GLOBAL_QOS_FLOW_TLV_FILTER
+{
+	UCHAR	TLVType;		//0x12 0x13
+	USHORT	TLVLength;
+	UCHAR	tx_rx_qos_filter_len;
+	UCHAR	ip_version;
+	ULONG64	valid_params0;
+	ULONG	ipv4_addr0;
+	ULONG	subnet_mask0;
+	ULONG	ipv4_addr1;
+	ULONG	subnet_mask1;
+	UCHAR	val4;
+	UCHAR	mask4;
+	ULONG64	valid_params01;
+	UCHAR	ipv6_address00;
+	UCHAR	ipv6_address01;
+	UCHAR	ipv6_address02;
+	UCHAR	ipv6_address03;
+	UCHAR	ipv6_address04;
+	UCHAR	ipv6_address05;
+	UCHAR	ipv6_address06;
+	UCHAR	ipv6_address07;
+	UCHAR	ipv6_address08;
+	UCHAR	ipv6_address09;
+	UCHAR	ipv6_address010;
+	UCHAR	ipv6_address011;
+	UCHAR	ipv6_address012;
+	UCHAR	ipv6_address013;
+	UCHAR	ipv6_address014;
+	ULONG	ipv6_address015;
+	UCHAR	prefix_len0;
+	UCHAR	ipv6_address10;
+	UCHAR	ipv6_address11;
+	UCHAR	ipv6_address12;
+	UCHAR	ipv6_address13;
+	UCHAR	ipv6_address14;
+	UCHAR	ipv6_address15;
+	UCHAR	ipv6_address16;
+	UCHAR	ipv6_address17;
+	UCHAR	ipv6_address18;
+	UCHAR	ipv6_address19;
+	UCHAR	ipv6_address110;
+	UCHAR	ipv6_address111;
+	UCHAR	ipv6_address112;
+	UCHAR	ipv6_address113;
+	UCHAR	ipv6_address114;
+	ULONG	ipv6_address115;
+	UCHAR	prefix_len1;
+	UCHAR	val6;
+	UCHAR	mask6;
+	ULONG	flow_label;
+	ULONG	xport_protocol;
+	ULONG64	valid_params2;
+	USHORT	port0;
+	USHORT	range0;
+	USHORT	port1;
+	USHORT	range1;
+	ULONG64	valid_params3;
+	USHORT	port2;
+	USHORT	range2;
+	USHORT	port3;
+	USHORT	range3;
+	ULONG64	valid_params4;
+	UCHAR	type;
+	UCHAR	code;
+	ULONG64	valid_params5;
+	ULONG	spi0;
+	ULONG64	valid_params6;
+	ULONG	spi1;
+	USHORT	filter_id;
+	USHORT	filter_precedence;
+} __attribute__ ((packed)) QMI_QOS_GLOBAL_QOS_FLOW_TLV_FILTER, *PQMI_QOS_GLOBAL_QOS_FLOW_TLV_FILTER;
+
+typedef struct _QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_TYPE
+{
+	UCHAR	TLVType;		//0x14
+	USHORT	TLVLength;
+	ULONG	flow_type;
+} __attribute__ ((packed)) QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_TYPE, *PQMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_TYPE;
+
+typedef struct _QMI_QOS_GLOBAL_QOS_FLOW_TLV_BEARER_ID
+{
+	UCHAR	TLVType;		//0x15
+	USHORT	TLVLength;
+	UCHAR	bearer_id;
+} __attribute__ ((packed)) QMI_QOS_GLOBAL_QOS_FLOW_TLV_BEARER_ID, *PQMI_QOS_GLOBAL_QOS_FLOW_TLV_BEARER_ID;
+
+typedef struct _QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_CTL_SEQ_NUM
+{
+	UCHAR	TLVType;		//0x16
+	USHORT	TLVLength;
+	USHORT	fc_seq_num;
+} __attribute__ ((packed)) QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_CTL_SEQ_NUM, *PQMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_CTL_SEQ_NUM;
+
+typedef struct _QMI_QOS_GLOBAL_QOS_FLOW_TLV_5G_QCI
+{
+	UCHAR	TLVType;		//0x17 0x18
+	USHORT	TLVLength;
+	ULONG	tx_rx_5g_qci;
+} __attribute__ ((packed)) QMI_QOS_GLOBAL_QOS_FLOW_TLV_5G_QCI, *PQMI_QOS_GLOBAL_QOS_FLOW_TLV_5G_QCI;
+
+typedef struct _QMI_QOS_GLOBAL_QOS_FLOW_TLV_AVG_WINDOW
+{
+	UCHAR	TLVType;		//0x19 0x1A
+	USHORT	TLVLength;
+	USHORT	tx_rx_avg_window;
+} __attribute__ ((packed)) QMI_QOS_GLOBAL_QOS_FLOW_TLV_AVG_WINDOW, *PQMI_QOS_GLOBAL_QOS_FLOW_TLV_AVG_WINDOW;
+
+typedef struct _QMI_QOS_GLOBAL_QOS_FLOW_TLV_TX_FILTER_MATCH_ALL
+{
+	UCHAR	TLVType;		//0x1B
+	USHORT	TLVLength;
+	UCHAR	tx_filter_match_all_len;
+	USHORT	filter_id;
+} __attribute__ ((packed)) QMI_QOS_GLOBAL_QOS_FLOW_TLV_TX_FILTER_MATCH_ALL, *PQMI_QOS_GLOBAL_QOS_FLOW_TLV_TX_FILTER_MATCH_ALL;
+
+typedef struct _QMI_QOS_GLOBAL_QOS_FLOW_IND_MSG
+{
+	USHORT	Type;
+	USHORT	Length;
+	QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_STATE			FlowStateTlv;
+	//QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_GRANTED		TxFlowGrantedTlv;
+	//QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_GRANTED		RxFlowGrantedTlv;
+	//QMI_QOS_GLOBAL_QOS_FLOW_TLV_FILTER				TxFilterTlv;
+	//QMI_QOS_GLOBAL_QOS_FLOW_TLV_FILTER				RxFilterTlv;
+	//QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_TYPE			FlowTypeTlv;
+	//QMI_QOS_GLOBAL_QOS_FLOW_TLV_BEARER_ID			BearerIdTlv;
+	//QMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_CTL_SEQ_NUM	FlowCtlSeqNumTlv;
+	//QMI_QOS_GLOBAL_QOS_FLOW_TLV_5G_QCI				Tx5GQciTlv;
+	//QMI_QOS_GLOBAL_QOS_FLOW_TLV_5G_QCI				Rx5GQciTlv;
+	//QMI_QOS_GLOBAL_QOS_FLOW_TLV_AVG_WINDOW			AvgWindowTlv;
+	//QMI_QOS_GLOBAL_QOS_FLOW_TLV_TX_FILTER_MATCH_ALL	TxFilterMatchAllTlv;
+} __attribute__ ((packed)) QMI_QOS_GLOBAL_QOS_FLOW_IND_MSG, *PQMI_QOS_GLOBAL_QOS_FLOW_IND_MSG;
+
+typedef struct _QMI_QOS_GET_QOS_INFO_TLV_QOS_ID
+{
+	UCHAR	TLVType;		//0x01
+	USHORT	TLVLength;
+	ULONG	qos_id;
+} __attribute__ ((packed)) QMI_QOS_GET_QOS_INFO_TLV_QOS_ID, *PQMI_QOS_GET_QOS_INFO_TLV_QOS_ID;
+
+typedef struct _QMI_QOS_GET_QOS_INFO_TLV_FLOW_STATUS
+{
+	UCHAR	TLVType;		//0x10
+	USHORT	TLVLength;
+	UCHAR	flow_status;
+} __attribute__ ((packed)) QMI_QOS_GET_QOS_INFO_TLV_FLOW_STATUS, *PQMI_QOS_GET_QOS_INFO_TLV_FLOW_STATUS;
+
+typedef struct _QMI_QOS_GET_QOS_INFO_TLV_GRANTED_FLOW
+{
+	UCHAR	TLVType;		//0x11 0x12
+	USHORT	TLVLength;
+	ULONG64	flow_valid_params;
+	ULONG	ip_flow_trf_cls;
+	ULONG64 data_rate_max;
+	ULONG64	guaranteed_rate;
+	ULONG	peak_rate;
+	ULONG	token_rate;
+	ULONG	bucket_size;
+	ULONG	ip_flow_latency;
+	ULONG	ip_flow_jitter;
+	USHORT	ip_flow_pkt_error_rate_multiplier;
+	USHORT	ip_flow_pkt_error_rate_exponent;
+	ULONG	ip_flow_min_policed_packet_size;
+	ULONG	ip_flow_max_allowed_packet_size;
+	ULONG	ip_flow_3gpp_residual_bit_error_rate;
+	ULONG	ip_flow_3gpp_traffic_handling_priority;
+	USHORT	ip_flow_3gpp2_profile_id;
+	UCHAR	ip_flow_3gpp2_flow_priority;
+	UCHAR	ip_flow_3gpp_im_cn_flag;
+	UCHAR	ip_flow_3gpp_sig_ind;
+	ULONG	ip_flow_lte_qci;
+} __attribute__ ((packed)) QMI_QOS_GET_QOS_INFO_TLV_GRANTED_FLOW, *PQMI_QOS_GET_QOS_INFO_TLV_GRANTED_FLOW;
+
+typedef struct _QMI_QOS_GET_QOS_INFO_TLV_FILTER_SPECS
+{
+	UCHAR	TLVType;		//0x13 0x14
+	USHORT	TLVLength;
+	UCHAR	tx_rx_qos_filter_len;
+	UCHAR	ip_version;
+	ULONG64	valid_params0;
+	ULONG	ipv4_addr0;
+	ULONG	subnet_mask0;
+	ULONG	ipv4_addr1;
+	ULONG	subnet_mask1;
+	UCHAR	val4;
+	UCHAR	mask4;
+	ULONG64	valid_params01;
+	UCHAR	ipv6_address00;
+	UCHAR	ipv6_address01;
+	UCHAR	ipv6_address02;
+	UCHAR	ipv6_address03;
+	UCHAR	ipv6_address04;
+	UCHAR	ipv6_address05;
+	UCHAR	ipv6_address06;
+	UCHAR	ipv6_address07;
+	UCHAR	ipv6_address08;
+	UCHAR	ipv6_address09;
+	UCHAR	ipv6_address010;
+	UCHAR	ipv6_address011;
+	UCHAR	ipv6_address012;
+	UCHAR	ipv6_address013;
+	UCHAR	ipv6_address014;
+	ULONG	ipv6_address015;
+	UCHAR	prefix_len0;
+	UCHAR	ipv6_address10;
+	UCHAR	ipv6_address11;
+	UCHAR	ipv6_address12;
+	UCHAR	ipv6_address13;
+	UCHAR	ipv6_address14;
+	UCHAR	ipv6_address15;
+	UCHAR	ipv6_address16;
+	UCHAR	ipv6_address17;
+	UCHAR	ipv6_address18;
+	UCHAR	ipv6_address19;
+	UCHAR	ipv6_address110;
+	UCHAR	ipv6_address111;
+	UCHAR	ipv6_address112;
+	UCHAR	ipv6_address113;
+	UCHAR	ipv6_address114;
+	ULONG	ipv6_address115;
+	UCHAR	prefix_len1;
+	UCHAR	val6;
+	UCHAR	mask6;
+	ULONG	flow_label;
+	ULONG	xport_protocol;
+	ULONG64	valid_params2;
+	USHORT	port0;
+	USHORT	range0;
+	USHORT	port1;
+	USHORT	range1;
+	ULONG64	valid_params3;
+	USHORT	port2;
+	USHORT	range2;
+	USHORT	port3;
+	USHORT	range3;
+	ULONG64	valid_params4;
+	UCHAR	type;
+	UCHAR	code;
+	ULONG64	valid_params5;
+	ULONG	spi0;
+	ULONG64	valid_params6;
+	ULONG	spi1;
+	USHORT	filter_id;
+	USHORT	filter_precedence;
+} __attribute__ ((packed)) QMI_QOS_GET_QOS_INFO_TLV_FILTER_SPECS, *PQMI_QOS_GET_QOS_INFO_TLV_FILTER_SPECS;
+
+typedef struct _QMI_QOS_GET_QOS_INFO_TLV_EXT_ERROR_INFO
+{
+	UCHAR	TLVType;		//0x15
+	USHORT	TLVLength;
+	USHORT	ext_error_info;
+} __attribute__ ((packed)) QMI_QOS_GET_QOS_INFO_TLV_EXT_ERROR_INFO, *PQMI_QOS_GET_QOS_INFO_TLV_EXT_ERROR_INFO;
+
+typedef struct _QMI_QOS_GET_QOS_INFO_TLV_5G_QCI
+{
+	UCHAR	TLVType;		//0x16 0x17
+	USHORT	TLVLength;
+	ULONG	tx_rx_5g_qci;
+} __attribute__ ((packed)) QMI_QOS_GET_QOS_INFO_TLV_5G_QCI, *PQMI_QOS_GET_QOS_INFO_TLV_5G_QCI;
+
+typedef struct _QMI_QOS_GET_QOS_INFO_TLV_AVG_WINDOW
+{
+	UCHAR	TLVType;		//0x18 0x19
+	USHORT	TLVLength;
+	USHORT	tx_rx_averaging_window;
+} __attribute__ ((packed)) QMI_QOS_GET_QOS_INFO_TLV_AVG_WINDOW, *PQMI_QOS_GET_QOS_INFO_TLV_AVG_WINDOW;
+
+typedef struct _QMI_QOS_GET_QOS_INFO_TLV_TX_FILTER_MATCH_ALL
+{
+	UCHAR	TLVType;		//0x1A
+	USHORT	TLVLength;
+	UCHAR	tx_filter_match_all_len;
+	USHORT	filter_id;
+} __attribute__ ((packed)) QMI_QOS_GET_QOS_INFO_TLV_TX_FILTER_MATCH_ALL, *PQMI_QOS_GET_QOS_INFO_TLV_TX_FILTER_MATCH_ALL;
+
+typedef struct _QMI_QOS_GET_QOS_INFO_REQ_MSG
+{
+	USHORT	Type;
+	USHORT	Length;
+	QMI_QOS_GET_QOS_INFO_TLV_QOS_ID		QosIdTlv;
+} __attribute__ ((packed)) QMI_QOS_GET_QOS_INFO_REQ_MSG, *PQMI_QOS_GET_QOS_INFO_REQ_MSG;
+
+typedef struct _QMI_QOS_GET_QOS_INFO_RESP_MSG
+{
+	USHORT	Type;
+	USHORT	Length;
+	UCHAR	TLVType;		//0x02
+	USHORT	TLVLength;
+	USHORT	QMUXResult;
+	USHORT	QMUXError;
+	//QMI_QOS_GET_QOS_INFO_TLV_FLOW_STATUS			FlowStatusTlv;
+	//QMI_QOS_GET_QOS_INFO_TLV_GRANTED_FLOW			TxGrantedFlowTlv;
+	//QMI_QOS_GET_QOS_INFO_TLV_GRANTED_FLOW			RxGrantedFlowTlv;
+	//QMI_QOS_GET_QOS_INFO_TLV_FILTER_SPECS			TxFilterSpecsTlv;
+	//QMI_QOS_GET_QOS_INFO_TLV_FILTER_SPECS			RxFilterSpecsTlv;
+	//QMI_QOS_GET_QOS_INFO_TLV_EXT_ERROR_INFO			ExtErrorInfoTlv;
+	//QMI_QOS_GET_QOS_INFO_TLV_5G_QCI					Tx5GQciTlv;
+	//QMI_QOS_GET_QOS_INFO_TLV_5G_QCI					Rx5GQciTlv;
+	//QMI_QOS_GET_QOS_INFO_TLV_AVG_WINDOW				TxAvgWindowTlv;
+	//QMI_QOS_GET_QOS_INFO_TLV_AVG_WINDOW				RxAvgWindowTlv;
+	//QMI_QOS_GET_QOS_INFO_TLV_TX_FILTER_MATCH_ALL	TxFilterMatchAllTlv;
+} __attribute__ ((packed)) QMI_QOS_GET_QOS_INFO_RESP_MSG, *PQMI_QOS_GET_QOS_INFO_RESP_MSG;
+
+#define QOS_IND_FLOW_STATE_ACTIVATED 0x00
+#define QOS_IND_FLOW_STATE_MODIFIED  0x01
+#define QOS_IND_FLOW_STATE_DELETED   0x02
+#define QOS_IND_FLOW_STATE_SUSPENDED 0x03
+#define QOS_IND_FLOW_STATE_ENABLED   0x04
+#define QOS_IND_FLOW_STATE_DISABLED  0x05
+#define QOS_IND_FLOW_STATE_INVALID	 0x06
+
+#define QOS_EVENT_RPT_IND_FLOW_ACTIVATED 0x01
+#define QOS_EVENT_RPT_IND_FLOW_MODIFIED  0x02
+#define QOS_EVENT_RPT_IND_FLOW_DELETED   0x03
+#define QOS_EVENT_RPT_IND_FLOW_SUSPENDED 0x04
+#define QOS_EVENT_RPT_IND_FLOW_ENABLED   0x05
+#define QOS_EVENT_RPT_IND_FLOW_DISABLED  0x06
+
+#define QOS_EVENT_RPT_IND_TLV_PHY_LINK_STATE_TYPE 0x01
+#define QOS_EVENT_RPT_IND_TLV_GLOBAL_FL_RPT_STATE 0x10
+#define QOS_EVENT_RPT_IND_TLV_GLOBAL_FL_RPT_TYPE  0x10
+#define QOS_EVENT_RPT_IND_TLV_TX_FLOW_TYPE        0x11
+#define QOS_EVENT_RPT_IND_TLV_RX_FLOW_TYPE        0x12
+#define QOS_EVENT_RPT_IND_TLV_TX_FILTER_TYPE      0x13
+#define QOS_EVENT_RPT_IND_TLV_RX_FILTER_TYPE      0x14
+#define QOS_EVENT_RPT_IND_TLV_FLOW_SPEC           0x10
+#define QOS_EVENT_RPT_IND_TLV_FILTER_SPEC         0x10
+
+typedef struct _QOS_EVENT_RPT_IND_TLV_PHY_LINK_STATE
+{
+   UCHAR  TLVType;       // 0x01
+   USHORT TLVLength;     // 1
+   UCHAR  PhyLinkState;  // 0-dormant, 1-active
+} QOS_EVENT_RPT_IND_TLV_PHY_LINK_STATE, *PQOS_EVENT_RPT_IND_TLV_PHY_LINK_STATE;
+
+typedef struct _QOS_EVENT_RPT_IND_TLV_GLOBAL_FL_RPT
+{
+   UCHAR  TLVType;       // 0x10
+   USHORT TLVLength;     // 6
+   ULONG  QosId;
+   UCHAR  NewFlow;       // 1: newly added flow; 0: existing flow
+   UCHAR  StateChange;   // 1: activated; 2: modified; 3: deleted;
+                         // 4: suspended(delete); 5: enabled; 6: disabled
+} QOS_EVENT_RPT_IND_TLV_GLOBAL_FL_RPT, *PQOS_EVENT_RPT_IND_TLV_GLOBAL_FL_RPT;
+
+// QOS Flow
+
+typedef struct _QOS_EVENT_RPT_IND_TLV_FLOW
+{
+   UCHAR  TLVType;       // 0x10-TX flow; 0x11-RX flow
+   USHORT TLVLength;     // var
+   // embedded TLV's
+} QOS_EVENT_RPT_IND_TLV_TX_FLOW, *PQOS_EVENT_RPT_IND_TLV_TX_FLOW;
+
+#define QOS_FLOW_TLV_IP_FLOW_IDX_TYPE                    0x10
+#define QOS_FLOW_TLV_IP_FLOW_TRAFFIC_CLASS_TYPE          0x11
+#define QOS_FLOW_TLV_IP_FLOW_DATA_RATE_MIN_MAX_TYPE      0x12
+#define QOS_FLOW_TLV_IP_FLOW_DATA_RATE_TOKEN_BUCKET_TYPE 0x13
+#define QOS_FLOW_TLV_IP_FLOW_LATENCY_TYPE                0x14
+#define QOS_FLOW_TLV_IP_FLOW_JITTER_TYPE                 0x15
+#define QOS_FLOW_TLV_IP_FLOW_PKT_ERR_RATE_TYPE           0x16
+#define QOS_FLOW_TLV_IP_FLOW_MIN_PKT_SIZE_TYPE           0x17
+#define QOS_FLOW_TLV_IP_FLOW_MAX_PKT_SIZE_TYPE           0x18
+#define QOS_FLOW_TLV_IP_FLOW_3GPP_BIT_ERR_RATE_TYPE      0x19
+#define QOS_FLOW_TLV_IP_FLOW_3GPP_TRAF_PRIORITY_TYPE     0x1A
+#define QOS_FLOW_TLV_IP_FLOW_3GPP2_PROFILE_ID_TYPE       0x1B
+
+typedef struct _QOS_FLOW_TLV_IP_FLOW_IDX
+{
+   UCHAR  TLVType;       // 0x10
+   USHORT TLVLength;     // 1
+   UCHAR  IpFlowIndex;
+}  QOS_FLOW_TLV_IP_FLOW_IDX, *PQOS_FLOW_TLV_IP_FLOW_IDX;
+
+typedef struct _QOS_FLOW_TLV_IP_FLOW_TRAFFIC_CLASS
+{
+   UCHAR  TLVType;       // 0x11
+   USHORT TLVLength;     // 1
+   UCHAR  TrafficClass;
+}  QOS_FLOW_TLV_IP_FLOW_TRAFFIC_CLASS, *PQOS_FLOW_TLV_IP_FLOW_TRAFFIC_CLASS;
+
+typedef struct _QOS_FLOW_TLV_IP_FLOW_DATA_RATE_MIN_MAX
+{
+   UCHAR  TLVType;       // 0x12
+   USHORT TLVLength;     // 8
+   ULONG  DataRateMax;
+   ULONG  GuaranteedRate;
+}  QOS_FLOW_TLV_IP_FLOW_DATA_RATE_MIN_MAX, *PQOS_FLOW_TLV_IP_FLOW_DATA_RATE_MIN_MAX;
+
+typedef struct _QOS_FLOW_TLV_IP_FLOW_DATA_RATE_TOKEN_BUCKET
+{
+   UCHAR  TLVType;       // 0x13
+   USHORT TLVLength;     // 12
+   ULONG  PeakRate;
+   ULONG  TokenRate;
+   ULONG  BucketSize;
+}  QOS_FLOW_TLV_IP_FLOW_DATA_RATE_TOKEN_BUCKET, *PQOS_FLOW_TLV_IP_FLOW_DATA_RATE_TOKEN_BUCKET;
+
+typedef struct _QOS_FLOW_TLV_IP_FLOW_LATENCY
+{
+   UCHAR  TLVType;       // 0x14
+   USHORT TLVLength;     // 4
+   ULONG  IpFlowLatency;
+}  QOS_FLOW_TLV_IP_FLOW_LATENCY, *PQOS_FLOW_TLV_IP_FLOW_LATENCY;
+
+typedef struct _QOS_FLOW_TLV_IP_FLOW_JITTER
+{
+   UCHAR  TLVType;       // 0x15
+   USHORT TLVLength;     // 4
+   ULONG  IpFlowJitter;
+}  QOS_FLOW_TLV_IP_FLOW_JITTER, *PQOS_FLOW_TLV_IP_FLOW_JITTER;
+
+typedef struct _QOS_FLOW_TLV_IP_FLOW_PKT_ERR_RATE
+{
+   UCHAR  TLVType;       // 0x16
+   USHORT TLVLength;     // 4
+   USHORT ErrRateMultiplier;
+   USHORT ErrRateExponent;
+}  QOS_FLOW_TLV_IP_FLOW_PKT_ERR_RATE, *PQOS_FLOW_TLV_IP_FLOW_PKT_ERR_RATE;
+
+typedef struct _QOS_FLOW_TLV_IP_FLOW_MIN_PKT_SIZE
+{
+   UCHAR  TLVType;       // 0x17
+   USHORT TLVLength;     // 4
+   ULONG  MinPolicedPktSize;
+}  QOS_FLOW_TLV_IP_FLOW_MIN_PKT_SIZE, *PQOS_FLOW_TLV_IP_FLOW_MIN_PKT_SIZE;
+
+typedef struct _QOS_FLOW_TLV_IP_FLOW_MAX_PKT_SIZE
+{
+   UCHAR  TLVType;       // 0x18
+   USHORT TLVLength;     // 4
+   ULONG  MaxAllowedPktSize;
+}  QOS_FLOW_TLV_IP_FLOW_MAX_PKT_SIZE, *PQOS_FLOW_TLV_IP_FLOW_MAX_PKT_SIZE;
+
+typedef struct _QOS_FLOW_TLV_IP_FLOW_3GPP_BIT_ERR_RATE
+{
+   UCHAR  TLVType;       // 0x19
+   USHORT TLVLength;     // 1
+   UCHAR  ResidualBitErrorRate;
+}  QOS_FLOW_TLV_IP_FLOW_3GPP_BIT_ERR_RATE, *PQOS_FLOW_TLV_IP_FLOW_3GPP_BIT_ERR_RATE;
+
+typedef struct _QOS_FLOW_TLV_IP_FLOW_3GPP_TRAF_PRIORITY
+{
+   UCHAR  TLVType;       // 0x1A
+   USHORT TLVLength;     // 1
+   UCHAR  TrafficHandlingPriority;
+}  QOS_FLOW_TLV_IP_FLOW_3GPP_TRAF_PRIORITY, *PQOS_FLOW_TLV_IP_FLOW_3GPP_TRAF_PRIORITY;
+
+typedef struct _QOS_FLOW_TLV_IP_FLOW_3GPP2_PROFILE_ID
+{
+   UCHAR  TLVType;       // 0x1B
+   USHORT TLVLength;     // 2
+   USHORT ProfileId;
+}  QOS_FLOW_TLV_IP_FLOW_3GPP2_PROFILE_ID, *PQOS_FLOW_TLV_IP_FLOW_3GPP2_PROFILE_ID;
+
+// QOS Filter
+
+#define QOS_FILTER_TLV_IP_FILTER_IDX_TYPE          0x10
+#define QOS_FILTER_TLV_IP_VERSION_TYPE             0x11
+#define QOS_FILTER_TLV_IPV4_SRC_ADDR_TYPE          0x12
+#define QOS_FILTER_TLV_IPV4_DEST_ADDR_TYPE         0x13
+#define QOS_FILTER_TLV_NEXT_HDR_PROTOCOL_TYPE      0x14
+#define QOS_FILTER_TLV_IPV4_TYPE_OF_SERVICE_TYPE   0x15
+#define QOS_FILTER_TLV_TCP_UDP_PORT_SRC_TCP_TYPE   0x1B
+#define QOS_FILTER_TLV_TCP_UDP_PORT_DEST_TCP_TYPE  0x1C
+#define QOS_FILTER_TLV_TCP_UDP_PORT_SRC_UDP_TYPE   0x1D
+#define QOS_FILTER_TLV_TCP_UDP_PORT_DEST_UDP_TYPE  0x1E
+#define QOS_FILTER_TLV_ICMP_FILTER_MSG_TYPE_TYPE   0x1F
+#define QOS_FILTER_TLV_ICMP_FILTER_MSG_CODE_TYPE   0x20
+#define QOS_FILTER_TLV_TCP_UDP_PORT_SRC_TYPE       0x24
+#define QOS_FILTER_TLV_TCP_UDP_PORT_DEST_TYPE      0x25
+
+typedef struct _QOS_EVENT_RPT_IND_TLV_FILTER
+{
+   UCHAR  TLVType;       // 0x12-TX filter; 0x13-RX filter
+   USHORT TLVLength;     // var
+   // embedded TLV's
+} QOS_EVENT_RPT_IND_TLV_RX_FILTER, *PQOS_EVENT_RPT_IND_TLV_RX_FILTER;
+
+typedef struct _QOS_FILTER_TLV_IP_FILTER_IDX
+{
+   UCHAR  TLVType;       // 0x10
+   USHORT TLVLength;     // 1
+   UCHAR  IpFilterIndex;
+}  QOS_FILTER_TLV_IP_FILTER_IDX, *PQOS_FILTER_TLV_IP_FILTER_IDX;
+
+typedef struct _QOS_FILTER_TLV_IP_VERSION
+{
+   UCHAR  TLVType;       // 0x11
+   USHORT TLVLength;     // 1
+   UCHAR  IpVersion;
+}  QOS_FILTER_TLV_IP_VERSION, *PQOS_FILTER_TLV_IP_VERSION;
+
+typedef struct _QOS_FILTER_TLV_IPV4_SRC_ADDR
+{
+   UCHAR  TLVType;       // 0x12
+   USHORT TLVLength;     // 8
+   ULONG  IpSrcAddr;
+   ULONG  IpSrcSubnetMask;
+}  QOS_FILTER_TLV_IPV4_SRC_ADDR, *PQOS_FILTER_TLV_IPV4_SRC_ADDR;
+
+typedef struct _QOS_FILTER_TLV_IPV4_DEST_ADDR
+{
+   UCHAR  TLVType;       // 0x13
+   USHORT TLVLength;     // 8
+   ULONG  IpDestAddr;
+   ULONG  IpDestSubnetMask;
+}  QOS_FILTER_TLV_IPV4_DEST_ADDR, *PQOS_FILTER_TLV_IPV4_DEST_ADDR;
+
+typedef struct _QOS_FILTER_TLV_NEXT_HDR_PROTOCOL
+{
+   UCHAR  TLVType;       // 0x14
+   USHORT TLVLength;     // 1
+   UCHAR  NextHdrProtocol;
+}  QOS_FILTER_TLV_NEXT_HDR_PROTOCOL, *PQOS_FILTER_TLV_NEXT_HDR_PROTOCOL;
+
+typedef struct _QOS_FILTER_TLV_IPV4_TYPE_OF_SERVICE
+{
+   UCHAR  TLVType;       // 0x15
+   USHORT TLVLength;     // 2
+   UCHAR  Ipv4TypeOfService;
+   UCHAR  Ipv4TypeOfServiceMask;
+}  QOS_FILTER_TLV_IPV4_TYPE_OF_SERVICE, *PQOS_FILTER_TLV_IPV4_TYPE_OF_SERVICE;
+
+typedef struct _QOS_FILTER_TLV_TCP_UDP_PORT
+{
+   UCHAR  TLVType;       // source port: 0x1B-TCP; 0x1D-UDP
+                         // dest port:   0x1C-TCP; 0x1E-UDP
+   USHORT TLVLength;     // 4
+   USHORT FilterPort;
+   USHORT FilterPortRange;
+}  QOS_FILTER_TLV_TCP_UDP_PORT, *PQOS_FILTER_TLV_TCP_UDP_PORT;
+
+typedef struct _QOS_FILTER_TLV_ICMP_FILTER_MSG_TYPE
+{
+   UCHAR  TLVType;       // 0x1F
+   USHORT TLVLength;     // 1
+   UCHAR  IcmpFilterMsgType;
+}  QOS_FILTER_TLV_ICMP_FILTER_MSG_TYPE, *PQOS_FILTER_TLV_ICMP_FILTER_MSG_TYPE;
+
+typedef struct _QOS_FILTER_TLV_ICMP_FILTER_MSG_CODE
+{
+   UCHAR  TLVType;       // 0x20
+   USHORT TLVLength;     // 1
+   UCHAR  IcmpFilterMsgCode;
+}  QOS_FILTER_TLV_ICMP_FILTER_MSG_CODE, *PQOS_FILTER_TLV_ICMP_FILTER_MSG_CODE;
+
+#define QOS_FILTER_PRECEDENCE_INVALID  256
+#define QOS_FILTER_TLV_PRECEDENCE_TYPE 0x22
+#define QOS_FILTER_TLV_ID_TYPE         0x23
+
+typedef struct _QOS_FILTER_TLV_PRECEDENCE
+{
+   UCHAR  TLVType;    // 0x22
+   USHORT TLVLength;  // 2
+   USHORT Precedence; // precedence of the filter
+}  QOS_FILTER_TLV_PRECEDENCE, *PQOS_FILTER_TLV_PRECEDENCE;
+
+typedef struct _QOS_FILTER_TLV_ID
+{
+   UCHAR  TLVType;    // 0x23
+   USHORT TLVLength;  // 2
+   USHORT FilterId;   // filter ID
+}  QOS_FILTER_TLV_ID, *PQOS_FILTER_TLV_ID;
+
+#ifdef QCQOS_IPV6
+
+#define QOS_FILTER_TLV_IPV6_SRC_ADDR_TYPE          0x16
+#define QOS_FILTER_TLV_IPV6_DEST_ADDR_TYPE         0x17
+#define QOS_FILTER_TLV_IPV6_NEXT_HDR_PROTOCOL_TYPE 0x14  // same as IPV4
+#define QOS_FILTER_TLV_IPV6_TRAFFIC_CLASS_TYPE     0x19
+#define QOS_FILTER_TLV_IPV6_FLOW_LABEL_TYPE        0x1A
+
+typedef struct _QOS_FILTER_TLV_IPV6_SRC_ADDR
+{
+   UCHAR  TLVType;       // 0x16
+   USHORT TLVLength;     // 17
+   UCHAR  IpSrcAddr[16];
+   UCHAR  IpSrcAddrPrefixLen;  // [0..128]
+}  QOS_FILTER_TLV_IPV6_SRC_ADDR, *PQOS_FILTER_TLV_IPV6_SRC_ADDR;
+
+typedef struct _QOS_FILTER_TLV_IPV6_DEST_ADDR
+{
+   UCHAR  TLVType;       // 0x17
+   USHORT TLVLength;     // 17
+   UCHAR  IpDestAddr[16];
+   UCHAR  IpDestAddrPrefixLen;  // [0..128]
+}  QOS_FILTER_TLV_IPV6_DEST_ADDR, *PQOS_FILTER_TLV_IPV6_DEST_ADDR;
+
+#define QOS_FILTER_IPV6_NEXT_HDR_PROTOCOL_TCP 0x06
+#define QOS_FILTER_IPV6_NEXT_HDR_PROTOCOL_UDP 0x11
+
+typedef struct _QOS_FILTER_TLV_IPV6_TRAFFIC_CLASS
+{
+   UCHAR  TLVType;       // 0x19
+   USHORT TLVLength;     // 2
+   UCHAR  TrafficClass;
+   UCHAR  TrafficClassMask; // compare the first 6 bits only
+}  QOS_FILTER_TLV_IPV6_TRAFFIC_CLASS, *PQOS_FILTER_TLV_IPV6_TRAFFIC_CLASS;
+
+typedef struct _QOS_FILTER_TLV_IPV6_FLOW_LABEL
+{
+   UCHAR  TLVType;       // 0x1A
+   USHORT TLVLength;     // 4
+   ULONG  FlowLabel;
+}  QOS_FILTER_TLV_IPV6_FLOW_LABEL, *PQOS_FILTER_TLV_IPV6_FLOW_LABEL;
+
+#endif // QCQOS_IPV6
+#endif
+
+// ======================= WMS ==============================
+#define QMIWMS_SET_EVENT_REPORT_REQ           0x0001
+#define QMIWMS_SET_EVENT_REPORT_RESP          0x0001
+#define QMIWMS_EVENT_REPORT_IND               0x0001
+#define QMIWMS_RAW_SEND_REQ                   0x0020
+#define QMIWMS_RAW_SEND_RESP                  0x0020
+#define QMIWMS_RAW_WRITE_REQ                  0x0021
+#define QMIWMS_RAW_WRITE_RESP                 0x0021
+#define QMIWMS_RAW_READ_REQ                   0x0022
+#define QMIWMS_RAW_READ_RESP                  0x0022
+#define QMIWMS_MODIFY_TAG_REQ                 0x0023
+#define QMIWMS_MODIFY_TAG_RESP                0x0023
+#define QMIWMS_DELETE_REQ                     0x0024
+#define QMIWMS_DELETE_RESP                    0x0024
+#define QMIWMS_GET_MESSAGE_PROTOCOL_REQ       0x0030
+#define QMIWMS_GET_MESSAGE_PROTOCOL_RESP      0x0030
+#define QMIWMS_LIST_MESSAGES_REQ              0x0031
+#define QMIWMS_LIST_MESSAGES_RESP             0x0031
+#define QMIWMS_GET_SMSC_ADDRESS_REQ           0x0034
+#define QMIWMS_GET_SMSC_ADDRESS_RESP          0x0034
+#define QMIWMS_SET_SMSC_ADDRESS_REQ           0x0035
+#define QMIWMS_SET_SMSC_ADDRESS_RESP          0x0035
+#define QMIWMS_GET_STORE_MAX_SIZE_REQ         0x0036
+#define QMIWMS_GET_STORE_MAX_SIZE_RESP        0x0036
+
+
+#define WMS_MESSAGE_PROTOCOL_CDMA             0x00
+#define WMS_MESSAGE_PROTOCOL_WCDMA            0x01
+
+#if 0
+typedef struct _QMIWMS_GET_MESSAGE_PROTOCOL_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+} QMIWMS_GET_MESSAGE_PROTOCOL_REQ_MSG, *PQMIWMS_GET_MESSAGE_PROTOCOL_REQ_MSG;
+
+typedef struct _QMIWMS_GET_MESSAGE_PROTOCOL_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  MessageProtocol;
+} QMIWMS_GET_MESSAGE_PROTOCOL_RESP_MSG, *PQMIWMS_GET_MESSAGE_PROTOCOL_RESP_MSG;
+
+typedef struct _QMIWMS_GET_STORE_MAX_SIZE_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  StorageType;
+} QMIWMS_GET_STORE_MAX_SIZE_REQ_MSG, *PQMIWMS_GET_STORE_MAX_SIZE_REQ_MSG;
+
+typedef struct _QMIWMS_GET_STORE_MAX_SIZE_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   ULONG  MemStoreMaxSize;
+} QMIWMS_GET_STORE_MAX_SIZE_RESP_MSG, *PQMIWMS_GET_STORE_MAX_SIZE_RESP_MSG;
+
+typedef struct _REQUEST_TAG
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  TagType;
+} REQUEST_TAG, *PREQUEST_TAG;
+
+typedef struct _QMIWMS_LIST_MESSAGES_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  StorageType;
+} QMIWMS_LIST_MESSAGES_REQ_MSG, *PQMIWMS_LIST_MESSAGES_REQ_MSG;
+
+typedef struct _QMIWMS_MESSAGE
+{
+   ULONG  MessageIndex;
+   UCHAR  TagType;
+} QMIWMS_MESSAGE, *PQMIWMS_MESSAGE;
+
+typedef struct _QMIWMS_LIST_MESSAGES_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   ULONG  NumMessages;
+} QMIWMS_LIST_MESSAGES_RESP_MSG, *PQMIWMS_LIST_MESSAGES_RESP_MSG;
+
+typedef struct _QMIWMS_RAW_READ_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  StorageType;
+   ULONG  MemoryIndex;
+} QMIWMS_RAW_READ_REQ_MSG, *PQMIWMS_RAW_READ_REQ_MSG;
+
+typedef struct _QMIWMS_RAW_READ_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  TagType;
+   UCHAR  Format;
+   USHORT MessageLength;
+   UCHAR  Message;
+} QMIWMS_RAW_READ_RESP_MSG, *PQMIWMS_RAW_READ_RESP_MSG;
+
+typedef struct _QMIWMS_MODIFY_TAG_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  StorageType;
+   ULONG  MemoryIndex;
+   UCHAR  TagType;
+} QMIWMS_MODIFY_TAG_REQ_MSG, *PQMIWMS_MODIFY_TAG_REQ_MSG;
+
+typedef struct _QMIWMS_MODIFY_TAG_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} QMIWMS_MODIFY_TAG_RESP_MSG, *PQMIWMS_MODIFY_TAG_RESP_MSG;
+
+typedef struct _QMIWMS_RAW_SEND_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  SmsFormat;
+   USHORT SmsLength;
+   UCHAR  SmsMessage;
+} QMIWMS_RAW_SEND_REQ_MSG, *PQMIWMS_RAW_SEND_REQ_MSG;
+
+typedef struct _RAW_SEND_CAUSE_CODE
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT CauseCode;
+} RAW_SEND_CAUSE_CODE, *PRAW_SEND_CAUSE_CODE;
+
+
+typedef struct _QMIWMS_RAW_SEND_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} QMIWMS_RAW_SEND_RESP_MSG, *PQMIWMS_RAW_SEND_RESP_MSG;
+
+
+typedef struct _WMS_DELETE_MESSAGE_INDEX
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   ULONG  MemoryIndex;
+} WMS_DELETE_MESSAGE_INDEX, *PWMS_DELETE_MESSAGE_INDEX;
+
+typedef struct _WMS_DELETE_MESSAGE_TAG
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  MessageTag;
+} WMS_DELETE_MESSAGE_TAG, *PWMS_DELETE_MESSAGE_TAG;
+
+typedef struct _QMIWMS_DELETE_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  StorageType;
+} QMIWMS_DELETE_REQ_MSG, *PQMIWMS_DELETE_REQ_MSG;
+
+typedef struct _QMIWMS_DELETE_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} QMIWMS_DELETE_RESP_MSG, *PQMIWMS_DELETE_RESP_MSG;
+
+
+typedef struct _QMIWMS_GET_SMSC_ADDRESS_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+} QMIWMS_GET_SMSC_ADDRESS_REQ_MSG, *PQMIWMS_GET_SMSC_ADDRESS_REQ_MSG;
+
+typedef struct _QMIWMS_SMSC_ADDRESS
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  SMSCAddressType[3];
+   UCHAR  SMSCAddressLength;
+   UCHAR  SMSCAddressDigits;
+} QMIWMS_SMSC_ADDRESS, *PQMIWMS_SMSC_ADDRESS;
+
+
+typedef struct _QMIWMS_GET_SMSC_ADDRESS_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+   UCHAR  SMSCAddress;
+} QMIWMS_GET_SMSC_ADDRESS_RESP_MSG, *PQMIWMS_GET_SMSC_ADDRESS_RESP_MSG;
+
+typedef struct _QMIWMS_SET_SMSC_ADDRESS_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  SMSCAddress;
+} QMIWMS_SET_SMSC_ADDRESS_REQ_MSG, *PQMIWMS_SET_SMSC_ADDRESS_REQ_MSG;
+
+typedef struct _QMIWMS_SET_SMSC_ADDRESS_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} QMIWMS_SET_SMSC_ADDRESS_RESP_MSG, *PQMIWMS_SET_SMSC_ADDRESS_RESP_MSG;
+
+typedef struct _QMIWMS_SET_EVENT_REPORT_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ReportNewMessage;
+} QMIWMS_SET_EVENT_REPORT_REQ_MSG, *PQMIWMS_SET_EVENT_REPORT_REQ_MSG;
+
+typedef struct _QMIWMS_SET_EVENT_REPORT_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} QMIWMS_SET_EVENT_REPORT_RESP_MSG, *PQMIWMS_SET_EVENT_REPORT_RESP_MSG;
+
+typedef struct _QMIWMS_EVENT_REPORT_IND_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  StorageType;
+   ULONG  StorageIndex;
+} QMIWMS_EVENT_REPORT_IND_MSG, *PQMIWMS_EVENT_REPORT_IND_MSG;
+#endif
+
+// ======================= End of WMS ==============================
+
+
+// ======================= NAS ==============================
+#define QMINAS_SET_EVENT_REPORT_REQ             0x0002
+#define QMINAS_SET_EVENT_REPORT_RESP            0x0002
+#define QMINAS_EVENT_REPORT_IND                 0x0002
+#define QMINAS_GET_SIGNAL_STRENGTH_REQ          0x0020
+#define QMINAS_GET_SIGNAL_STRENGTH_RESP         0x0020
+#define QMINAS_PERFORM_NETWORK_SCAN_REQ         0x0021
+#define QMINAS_PERFORM_NETWORK_SCAN_RESP        0x0021
+#define QMINAS_INITIATE_NW_REGISTER_REQ         0x0022
+#define QMINAS_INITIATE_NW_REGISTER_RESP        0x0022
+#define QMINAS_INITIATE_ATTACH_REQ              0x0023
+#define QMINAS_INITIATE_ATTACH_RESP             0x0023
+#define QMINAS_GET_SERVING_SYSTEM_REQ           0x0024
+#define QMINAS_GET_SERVING_SYSTEM_RESP          0x0024
+#define QMINAS_SERVING_SYSTEM_IND               0x0024
+#define QMINAS_GET_HOME_NETWORK_REQ             0x0025
+#define QMINAS_GET_HOME_NETWORK_RESP            0x0025
+#define QMINAS_GET_PREFERRED_NETWORK_REQ        0x0026
+#define QMINAS_GET_PREFERRED_NETWORK_RESP       0x0026
+#define QMINAS_SET_PREFERRED_NETWORK_REQ        0x0027
+#define QMINAS_SET_PREFERRED_NETWORK_RESP       0x0027
+#define QMINAS_GET_FORBIDDEN_NETWORK_REQ        0x0028
+#define QMINAS_GET_FORBIDDEN_NETWORK_RESP       0x0028
+#define QMINAS_SET_FORBIDDEN_NETWORK_REQ        0x0029
+#define QMINAS_SET_FORBIDDEN_NETWORK_RESP       0x0029
+#define QMINAS_SET_TECHNOLOGY_PREF_REQ          0x002A
+#define QMINAS_SET_TECHNOLOGY_PREF_RESP         0x002A
+#define QMINAS_GET_RF_BAND_INFO_REQ             0x0031
+#define QMINAS_GET_RF_BAND_INFO_RESP            0x0031
+#define QMINAS_GET_CELL_LOCATION_INFO_REQ  0x0043
+#define QMINAS_GET_CELL_LOCATION_INFO_RESP 0x0043
+#define QMINAS_GET_PLMN_NAME_REQ                0x0044
+#define QMINAS_GET_PLMN_NAME_RESP               0x0044
+#define QUECTEL_PACKET_TRANSFER_START_IND 0X100
+#define QUECTEL_PACKET_TRANSFER_END_IND 0X101
+#define QMINAS_GET_SYS_INFO_REQ                 0x004D
+#define QMINAS_GET_SYS_INFO_RESP                0x004D
+#define QMINAS_SYS_INFO_IND                     0x004E
+#define QMINAS_GET_SIG_INFO_REQ                 0x004F
+#define QMINAS_GET_SIG_INFO_RESP                0x004F
+
+typedef struct _QMINAS_GET_HOME_NETWORK_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+} __attribute__ ((packed)) QMINAS_GET_HOME_NETWORK_REQ_MSG, *PQMINAS_GET_HOME_NETWORK_REQ_MSG;
+
+typedef struct _HOME_NETWORK_SYSTEMID
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT SystemID;
+   USHORT NetworkID;
+} __attribute__ ((packed)) HOME_NETWORK_SYSTEMID, *PHOME_NETWORK_SYSTEMID;
+
+typedef struct _HOME_NETWORK
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT MobileCountryCode;
+   USHORT MobileNetworkCode;
+   UCHAR  NetworkDesclen;
+   UCHAR  NetworkDesc;
+} __attribute__ ((packed)) HOME_NETWORK, *PHOME_NETWORK;
+
+#if 0
+typedef struct _HOME_NETWORK_EXT
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT MobileCountryCode;
+   USHORT MobileNetworkCode;
+   UCHAR  NetworkDescDisp;
+   UCHAR  NetworkDescEncoding;
+   UCHAR  NetworkDesclen;
+   UCHAR  NetworkDesc;
+} HOME_NETWORK_EXT, *PHOME_NETWORK_EXT;
+
+typedef struct _QMINAS_GET_HOME_NETWORK_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} QMINAS_GET_HOME_NETWORK_RESP_MSG, *PQMINAS_GET_HOME_NETWORK_RESP_MSG;
+
+typedef struct _QMINAS_GET_PREFERRED_NETWORK_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+} QMINAS_GET_PREFERRED_NETWORK_REQ_MSG, *PQMINAS_GET_PREFERRED_NETWORK_REQ_MSG;
+
+
+typedef struct _PREFERRED_NETWORK
+{
+   USHORT MobileCountryCode;
+   USHORT MobileNetworkCode;
+   USHORT RadioAccess;
+} PREFERRED_NETWORK, *PPREFERRED_NETWORK;
+
+typedef struct _QMINAS_GET_PREFERRED_NETWORK_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+   UCHAR  TLV2Type;         // 0x01 - required parameter
+   USHORT TLV2Length;       // length of the mfr string
+   USHORT NumPreferredNetwork;
+} QMINAS_GET_PREFERRED_NETWORK_RESP_MSG, *PQMINAS_GET_PREFERRED_NETWORK_RESP_MSG;
+
+typedef struct _QMINAS_GET_FORBIDDEN_NETWORK_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+} QMINAS_GET_FORBIDDEN_NETWORK_REQ_MSG, *PQMINAS_GET_FORBIDDEN_NETWORK_REQ_MSG;
+
+typedef struct _FORBIDDEN_NETWORK
+{
+   USHORT MobileCountryCode;
+   USHORT MobileNetworkCode;
+} FORBIDDEN_NETWORK, *PFORBIDDEN_NETWORK;
+
+typedef struct _QMINAS_GET_FORBIDDEN_NETWORK_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+   UCHAR  TLV2Type;         // 0x01 - required parameter
+   USHORT TLV2Length;       // length of the mfr string
+   USHORT NumForbiddenNetwork;
+} QMINAS_GET_FORBIDDEN_NETWORK_RESP_MSG, *PQMINAS_GET_FORBIDDEN_NETWORK_RESP_MSG;
+
+typedef struct _QMINAS_GET_SERVING_SYSTEM_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+} QMINAS_GET_SERVING_SYSTEM_REQ_MSG, *PQMINAS_GET_SERVING_SYSTEM_REQ_MSG;
+
+typedef struct _QMINAS_ROAMING_INDICATOR_MSG
+{
+   UCHAR  TLVType;         // 0x01 - required parameter
+   USHORT TLVLength;       // length of the mfr string
+   UCHAR  RoamingIndicator;
+} QMINAS_ROAMING_INDICATOR_MSG, *PQMINAS_ROAMING_INDICATOR_MSG;
+#endif
+
+typedef struct _QMINAS_DATA_CAP
+{
+   UCHAR  TLVType;         // 0x01 - required parameter
+   USHORT TLVLength;       // length of the mfr string
+   UCHAR  DataCapListLen;
+   UCHAR  DataCap;
+} __attribute__ ((packed)) QMINAS_DATA_CAP, *PQMINAS_DATA_CAP;
+
+typedef struct _QMINAS_CURRENT_PLMN_MSG
+{
+   UCHAR  TLVType;         // 0x01 - required parameter
+   USHORT TLVLength;       // length of the mfr string
+   USHORT MobileCountryCode;
+   USHORT MobileNetworkCode;
+   UCHAR  NetworkDesclen;
+   UCHAR  NetworkDesc;
+} __attribute__ ((packed)) QMINAS_CURRENT_PLMN_MSG, *PQMINAS_CURRENT_PLMN_MSG;
+
+typedef struct _QMINAS_GET_SERVING_SYSTEM_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} __attribute__ ((packed)) QMINAS_GET_SERVING_SYSTEM_RESP_MSG, *PQMINAS_GET_SERVING_SYSTEM_RESP_MSG;
+
+typedef struct _SERVING_SYSTEM
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  RegistrationState;
+   UCHAR  CSAttachedState;
+   UCHAR  PSAttachedState;
+   UCHAR  RegistredNetwork;
+   UCHAR  InUseRadioIF;
+   UCHAR  RadioIF;
+} __attribute__ ((packed)) SERVING_SYSTEM, *PSERVING_SYSTEM;
+
+typedef struct _QMINAS_GET_SYS_INFO_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} __attribute__ ((packed)) QMINAS_GET_SYS_INFO_RESP_MSG, *PQMINAS_GET_SYS_INFO_RESP_MSG;
+
+typedef struct _QMINAS_SYS_INFO_IND_MSG
+{
+   USHORT Type;
+   USHORT Length;
+} __attribute__ ((packed)) QMINAS_SYS_INFO_IND_MSG, *PQMINAS_SYS_INFO_IND_MSG;
+
+typedef struct _SERVICE_STATUS_INFO
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  SrvStatus;
+   UCHAR  true_srv_status;
+   UCHAR  IsPrefDataPath;
+} __attribute__ ((packed)) SERVICE_STATUS_INFO, *PSERVICE_STATUS_INFO;
+
+typedef struct _CDMA_SYSTEM_INFO
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  SrvDomainValid;
+   UCHAR  SrvDomain;
+   UCHAR  SrvCapabilityValid;
+   UCHAR  SrvCapability;
+   UCHAR  RoamStatusValid;
+   UCHAR  RoamStatus;
+   UCHAR  IsSysForbiddenValid;
+   UCHAR  IsSysForbidden;
+   UCHAR  IsSysPrlMatchValid;
+   UCHAR  IsSysPrlMatch;
+   UCHAR  PRevInUseValid;
+   UCHAR  PRevInUse;
+   UCHAR  BSPRevValid;
+   UCHAR  BSPRev;
+   UCHAR  CCSSupportedValid;
+   UCHAR  CCSSupported;
+   UCHAR  CDMASysIdValid;
+   USHORT SID;
+   USHORT NID;
+   UCHAR  BSInfoValid;
+   USHORT BaseID;
+   ULONG  BaseLAT;
+   ULONG  BaseLONG;
+   UCHAR  PacketZoneValid;
+   USHORT PacketZone;
+   UCHAR  NetworkIdValid;
+   UCHAR  MCC[3];
+   UCHAR  MNC[3];
+} __attribute__ ((packed)) CDMA_SYSTEM_INFO, *PCDMA_SYSTEM_INFO;
+
+typedef struct _HDR_SYSTEM_INFO
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  SrvDomainValid;
+   UCHAR  SrvDomain;
+   UCHAR  SrvCapabilityValid;
+   UCHAR  SrvCapability;
+   UCHAR  RoamStatusValid;
+   UCHAR  RoamStatus;
+   UCHAR  IsSysForbiddenValid;
+   UCHAR  IsSysForbidden;
+   UCHAR  IsSysPrlMatchValid;
+   UCHAR  IsSysPrlMatch;
+   UCHAR  HdrPersonalityValid;
+   UCHAR  HdrPersonality;
+   UCHAR  HdrActiveProtValid;
+   UCHAR  HdrActiveProt;
+   UCHAR  is856SysIdValid;
+   UCHAR  is856SysId[16];
+} __attribute__ ((packed)) HDR_SYSTEM_INFO, *PHDR_SYSTEM_INFO;
+
+typedef struct _GSM_SYSTEM_INFO
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  SrvDomainValid;
+   UCHAR  SrvDomain;
+   UCHAR  SrvCapabilityValid;
+   UCHAR  SrvCapability;
+   UCHAR  RoamStatusValid;
+   UCHAR  RoamStatus;
+   UCHAR  IsSysForbiddenValid;
+   UCHAR  IsSysForbidden;
+   UCHAR  LacValid;
+   USHORT Lac;
+   UCHAR  CellIdValid;
+   ULONG  CellId;
+   UCHAR  RegRejectInfoValid;
+   UCHAR  RejectSrvDomain;
+   UCHAR  RejCause;
+   UCHAR  NetworkIdValid;
+   UCHAR  MCC[3];
+   UCHAR  MNC[3];
+   UCHAR  EgprsSuppValid;
+   UCHAR  EgprsSupp;
+   UCHAR  DtmSuppValid;
+   UCHAR  DtmSupp;
+} __attribute__ ((packed)) GSM_SYSTEM_INFO, *PGSM_SYSTEM_INFO;
+
+typedef struct _WCDMA_SYSTEM_INFO
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  SrvDomainValid;
+   UCHAR  SrvDomain;
+   UCHAR  SrvCapabilityValid;
+   UCHAR  SrvCapability;
+   UCHAR  RoamStatusValid;
+   UCHAR  RoamStatus;
+   UCHAR  IsSysForbiddenValid;
+   UCHAR  IsSysForbidden;
+   UCHAR  LacValid;
+   USHORT Lac;
+   UCHAR  CellIdValid;
+   ULONG  CellId;
+   UCHAR  RegRejectInfoValid;
+   UCHAR  RejectSrvDomain;
+   UCHAR  RejCause;
+   UCHAR  NetworkIdValid;
+   UCHAR  MCC[3];
+   UCHAR  MNC[3];
+   UCHAR  HsCallStatusValid;
+   UCHAR  HsCallStatus;
+   UCHAR  HsIndValid;
+   UCHAR  HsInd;
+   UCHAR  PscValid;
+   UCHAR  Psc;
+} __attribute__ ((packed)) WCDMA_SYSTEM_INFO, *PWCDMA_SYSTEM_INFO;
+
+typedef struct _LTE_SYSTEM_INFO
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  SrvDomainValid;
+   UCHAR  SrvDomain;
+   UCHAR  SrvCapabilityValid;
+   UCHAR  SrvCapability;
+   UCHAR  RoamStatusValid;
+   UCHAR  RoamStatus;
+   UCHAR  IsSysForbiddenValid;
+   UCHAR  IsSysForbidden;
+   UCHAR  LacValid;
+   USHORT Lac;
+   UCHAR  CellIdValid;
+   ULONG  CellId;
+   UCHAR  RegRejectInfoValid;
+   UCHAR  RejectSrvDomain;
+   UCHAR  RejCause;
+   UCHAR  NetworkIdValid;
+   UCHAR  MCC[3];
+   UCHAR  MNC[3];
+   UCHAR  TacValid;
+   USHORT Tac;
+} __attribute__ ((packed)) LTE_SYSTEM_INFO, *PLTE_SYSTEM_INFO;
+
+typedef struct _TDSCDMA_SYSTEM_INFO
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  SrvDomainValid;
+   UCHAR  SrvDomain;
+   UCHAR  SrvCapabilityValid;
+   UCHAR  SrvCapability;
+   UCHAR  RoamStatusValid;
+   UCHAR  RoamStatus;
+   UCHAR  IsSysForbiddenValid;
+   UCHAR  IsSysForbidden;
+   UCHAR  LacValid;
+   USHORT Lac;
+   UCHAR  CellIdValid;
+   ULONG  CellId;
+   UCHAR  RegRejectInfoValid;
+   UCHAR  RejectSrvDomain;
+   UCHAR  RejCause;
+   UCHAR  NetworkIdValid;
+   UCHAR  MCC[3];
+   UCHAR  MNC[3];
+   UCHAR  HsCallStatusValid;
+   UCHAR  HsCallStatus;
+   UCHAR  HsIndValid;
+   UCHAR  HsInd;
+   UCHAR  CellParameterIdValid;
+   USHORT CellParameterId;
+   UCHAR  CellBroadcastCapValid;
+   ULONG  CellBroadcastCap;
+   UCHAR  CsBarStatusValid;
+   ULONG  CsBarStatus;
+   UCHAR  PsBarStatusValid;
+   ULONG  PsBarStatus;
+   UCHAR  CipherDomainValid;
+   UCHAR  CipherDomain;
+} __attribute__ ((packed)) TDSCDMA_SYSTEM_INFO, *PTDSCDMA_SYSTEM_INFO;
+
+typedef enum {
+  NAS_SYS_SRV_STATUS_NO_SRV_V01 = 0, 
+  NAS_SYS_SRV_STATUS_LIMITED_V01 = 1, 
+  NAS_SYS_SRV_STATUS_SRV_V01 = 2, 
+  NAS_SYS_SRV_STATUS_LIMITED_REGIONAL_V01 = 3, 
+  NAS_SYS_SRV_STATUS_PWR_SAVE_V01 = 4, 
+}nas_service_status_enum_type_v01;
+
+typedef enum {
+  SYS_SRV_DOMAIN_NO_SRV_V01 = 0, 
+  SYS_SRV_DOMAIN_CS_ONLY_V01 = 1, 
+  SYS_SRV_DOMAIN_PS_ONLY_V01 = 2, 
+  SYS_SRV_DOMAIN_CS_PS_V01 = 3, 
+  SYS_SRV_DOMAIN_CAMPED_V01 = 4, 
+}nas_service_domain_enum_type_v01;
+
+typedef enum {
+    QMI_NAS_RADIO_INTERFACE_UNKNOWN     = -1,
+    QMI_NAS_RADIO_INTERFACE_NONE        = 0x00,
+    QMI_NAS_RADIO_INTERFACE_CDMA_1X     = 0x01,
+    QMI_NAS_RADIO_INTERFACE_CDMA_1XEVDO = 0x02,
+    QMI_NAS_RADIO_INTERFACE_AMPS        = 0x03,
+    QMI_NAS_RADIO_INTERFACE_GSM         = 0x04,
+    QMI_NAS_RADIO_INTERFACE_UMTS        = 0x05,
+    QMI_NAS_RADIO_INTERFACE_LTE         = 0x08,
+    QMI_NAS_RADIO_INTERFACE_TD_SCDMA    = 0x09,
+    QMI_NAS_RADIO_INTERFACE_5GNR        = 0x0C,
+} QMI_NAS_RADIO_INTERFACE_E;
+
+typedef enum {
+    QMI_NAS_ACTIVE_BAND_BC_0 = 0,
+    QMI_NAS_ACTIVE_BAND_BC_1 = 1,
+    QMI_NAS_ACTIVE_BAND_BC_2 = 2,
+    QMI_NAS_ACTIVE_BAND_BC_3 = 3,
+    QMI_NAS_ACTIVE_BAND_BC_4 = 4,
+    QMI_NAS_ACTIVE_BAND_BC_5 = 5,
+    QMI_NAS_ACTIVE_BAND_BC_6 = 6,
+    QMI_NAS_ACTIVE_BAND_BC_7 = 7,
+    QMI_NAS_ACTIVE_BAND_BC_8 = 8,
+    QMI_NAS_ACTIVE_BAND_BC_9 = 9,
+    QMI_NAS_ACTIVE_BAND_BC_10 = 10,
+    QMI_NAS_ACTIVE_BAND_BC_11 = 11,
+    QMI_NAS_ACTIVE_BAND_BC_12 = 12,
+    QMI_NAS_ACTIVE_BAND_BC_13 = 13,
+    QMI_NAS_ACTIVE_BAND_BC_14 = 14,
+    QMI_NAS_ACTIVE_BAND_BC_15 = 15,
+    QMI_NAS_ACTIVE_BAND_BC_16 = 16,
+    QMI_NAS_ACTIVE_BAND_BC_17 = 17,
+    QMI_NAS_ACTIVE_BAND_BC_18 = 18,
+    QMI_NAS_ACTIVE_BAND_BC_19 = 19,
+    QMI_NAS_ACTIVE_BAND_GSM_450 = 40,
+    QMI_NAS_ACTIVE_BAND_GSM_480 = 41,
+    QMI_NAS_ACTIVE_BAND_GSM_750 = 42,
+    QMI_NAS_ACTIVE_BAND_GSM_850 = 43,
+    QMI_NAS_ACTIVE_BAND_GSM_900_EXTENDED = 44,
+    QMI_NAS_ACTIVE_BAND_GSM_900_PRIMARY = 45,
+    QMI_NAS_ACTIVE_BAND_GSM_900_RAILWAYS = 46,
+    QMI_NAS_ACTIVE_BAND_GSM_DCS_1800 = 47,
+    QMI_NAS_ACTIVE_BAND_GSM_PCS_1900 = 48,
+    QMI_NAS_ACTIVE_BAND_WCDMA_2100 = 80,
+    QMI_NAS_ACTIVE_BAND_WCDMA_PCS_1900 = 81,
+    QMI_NAS_ACTIVE_BAND_WCDMA_DCS_1800 = 82,
+    QMI_NAS_ACTIVE_BAND_WCDMA_1700_US = 83,
+    QMI_NAS_ACTIVE_BAND_WCDMA_850 = 84,
+    QMI_NAS_ACTIVE_BAND_WCDMA_800 = 85,
+    QMI_NAS_ACTIVE_BAND_WCDMA_2600 = 86,
+    QMI_NAS_ACTIVE_BAND_WCDMA_900 = 87,
+    QMI_NAS_ACTIVE_BAND_WCDMA_1700_JAPAN = 88,
+    QMI_NAS_ACTIVE_BAND_WCDMA_1500_JAPAN = 90,
+    QMI_NAS_ACTIVE_BAND_WCDMA_850_JAPAN = 91,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_1 = 120,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_2 = 121,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_3 = 122,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_4 = 123,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_5 = 124,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_6 = 125,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_7 = 126,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_8 = 127,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_9 = 128,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_10 = 129,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_11 = 130,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_12 = 131,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_13 = 132,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_14 = 133,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_17 = 134,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_18 = 143,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_19 = 144,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_20 = 145,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_21 = 146,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_23 = 152,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_24 = 147,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_25 = 148,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_26 = 153,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_27 = 164,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_28 = 158,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_29 = 159,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_30 = 160,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_31 = 165,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_32 = 154,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_33 = 135,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_34 = 136,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_35 = 137,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_36 = 138,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_37 = 139,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_38 = 140,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_39 = 141,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_40 = 142,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_41 = 149,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_42 = 150,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_43 = 151,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_46 = 163,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_47 = 166,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_48 = 167,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_66 = 161,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_71 = 168,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_125 = 155,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_126 = 156,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_127 = 157,
+    QMI_NAS_ACTIVE_BAND_EUTRAN_250 = 162,
+    QMI_NAS_ACTIVE_BAND_TDSCDMA_A = 200,
+    QMI_NAS_ACTIVE_BAND_TDSCDMA_B = 201,
+    QMI_NAS_ACTIVE_BAND_TDSCDMA_C = 202,
+    QMI_NAS_ACTIVE_BAND_TDSCDMA_D = 203,
+    QMI_NAS_ACTIVE_BAND_TDSCDMA_E = 204,
+    QMI_NAS_ACTIVE_BAND_TDSCDMA_F = 205,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_1  = 250,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_2  = 251,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_3  = 252,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_5  = 253,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_7  = 254,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_8  = 255,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_20 = 256,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_28 = 257,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_38 = 258,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_41 = 259,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_50 = 260,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_51 = 261,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_66 = 262,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_70 = 263,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_71 = 264,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_74 = 265,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_75 = 266,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_76 = 267,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_77 = 268,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_78 = 269,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_79 = 270,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_80 = 271,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_81 = 272,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_82 = 273,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_83 = 274,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_84 = 275,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_85 = 276,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_257= 277,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_258= 278,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_259= 279,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_260= 280,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_261= 281,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_12 = 282,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_25 = 283,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_34 = 284,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_39 = 285,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_40 = 286,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_65 = 287,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_86 = 288,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_48 = 289,
+    QMI_NAS_ACTIVE_BAND_NR5G_BAND_14 = 290
+} QMI_NAS_ACTIVE_BAND_E;
+
+typedef struct {
+  UCHAR  TLVType;
+  USHORT TLVLength;
+
+  uint8_t srv_domain_valid;
+  uint8_t srv_domain;
+  uint8_t srv_capability_valid;
+  uint8_t srv_capability;
+  uint8_t roam_status_valid;
+  uint8_t roam_status;
+  uint8_t is_sys_forbidden_valid;
+  uint8_t is_sys_forbidden;
+
+  uint8_t lac_valid;
+  uint16_t lac;
+  uint8_t cell_id_valid;
+  uint32_t cell_id;
+  uint8_t reg_reject_info_valid;
+  uint8_t reject_srv_domain;
+  uint8_t rej_cause;
+  uint8_t network_id_valid;
+  UCHAR MCC[3];
+  UCHAR MNC[3];
+
+  uint8_t tac_valid;
+  uint16_t tac;
+} __attribute__ ((packed)) NR5G_SYSTEM_INFO, *PNR5G_SYSTEM_INFO;
+
+#if 0
+typedef struct _QMINAS_SERVING_SYSTEM_IND_MSG
+{
+   USHORT Type;
+   USHORT Length;
+} QMINAS_SERVING_SYSTEM_IND_MSG, *PQMINAS_SERVING_SYSTEM_IND_MSG;
+
+typedef struct _QMINAS_SET_PREFERRED_NETWORK_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT NumPreferredNetwork;
+   USHORT MobileCountryCode;
+   USHORT MobileNetworkCode;
+   USHORT RadioAccess;
+} QMINAS_SET_PREFERRED_NETWORK_REQ_MSG, *PQMINAS_SET_PREFERRED_NETWORK_REQ_MSG;
+
+typedef struct _QMINAS_SET_PREFERRED_NETWORK_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} QMINAS_SET_PREFERRED_NETWORK_RESP_MSG, *PQMINAS_SET_PREFERRED_NETWORK_RESP_MSG;
+
+typedef struct _QMINAS_SET_FORBIDDEN_NETWORK_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT NumForbiddenNetwork;
+   USHORT MobileCountryCode;
+   USHORT MobileNetworkCode;
+} QMINAS_SET_FORBIDDEN_NETWORK_REQ_MSG, *PQMINAS_SET_FORBIDDEN_NETWORK_REQ_MSG;
+
+typedef struct _QMINAS_SET_FORBIDDEN_NETWORK_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} QMINAS_SET_FORBIDDEN_NETWORK_RESP_MSG, *PQMINAS_SET_FORBIDDEN_NETWORK_RESP_MSG;
+
+typedef struct _QMINAS_PERFORM_NETWORK_SCAN_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+} QMINAS_PERFORM_NETWORK_SCAN_REQ_MSG, *PQMINAS_PERFORM_NETWORK_SCAN_REQ_MSG;
+
+typedef struct _VISIBLE_NETWORK
+{
+   USHORT MobileCountryCode;
+   USHORT MobileNetworkCode;
+   UCHAR  NetworkStatus;
+   UCHAR  NetworkDesclen;
+} VISIBLE_NETWORK, *PVISIBLE_NETWORK;
+
+typedef struct _QMINAS_PERFORM_NETWORK_SCAN_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} QMINAS_PERFORM_NETWORK_SCAN_RESP_MSG, *PQMINAS_PERFORM_NETWORK_SCAN_RESP_MSG;
+
+typedef struct _QMINAS_PERFORM_NETWORK_SCAN_NETWORK_INFO
+{
+   UCHAR  TLVType;         // 0x010 - required parameter
+   USHORT TLVLength;       // length
+   USHORT NumNetworkInstances;
+} QMINAS_PERFORM_NETWORK_SCAN_NETWORK_INFO, *PQMINAS_PERFORM_NETWORK_SCAN_NETWORK_INFO;
+
+typedef struct _QMINAS_PERFORM_NETWORK_SCAN_RAT_INFO
+{
+   UCHAR  TLVType;         // 0x011 - required parameter
+   USHORT TLVLength;       // length
+   USHORT NumInst;
+} QMINAS_PERFORM_NETWORK_SCAN_RAT_INFO, *PQMINAS_PERFORM_NETWORK_SCAN_RAT_INFO;
+
+typedef struct _QMINAS_PERFORM_NETWORK_SCAN_RAT
+{
+   USHORT MCC;
+   USHORT MNC;
+   UCHAR  RAT;
+} QMINAS_PERFORM_NETWORK_SCAN_RAT, *PQMINAS_PERFORM_NETWORK_SCAN_RAT;
+
+
+typedef struct _QMINAS_MANUAL_NW_REGISTER
+{
+   UCHAR  TLV2Type;          // 0x02 - result code
+   USHORT TLV2Length;        // 4
+   USHORT MobileCountryCode;
+   USHORT MobileNetworkCode;
+   UCHAR  RadioAccess;
+} QMINAS_MANUAL_NW_REGISTER, *PQMINAS_MANUAL_NW_REGISTER;
+
+typedef struct _QMINAS_INITIATE_NW_REGISTER_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   UCHAR  RegisterAction;
+} QMINAS_INITIATE_NW_REGISTER_REQ_MSG, *PQMINAS_INITIATE_NW_REGISTER_REQ_MSG;
+
+typedef struct _QMINAS_INITIATE_NW_REGISTER_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} QMINAS_INITIATE_NW_REGISTER_RESP_MSG, *PQMINAS_INITIATE_NW_REGISTER_RESP_MSG;
+
+typedef struct _QMINAS_SET_TECHNOLOGY_PREF_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT TechPref;
+   UCHAR  Duration;
+} QMINAS_SET_TECHNOLOGY_PREF_REQ_MSG, *PQMINAS_SET_TECHNOLOGY_PREF_REQ_MSG;
+
+typedef struct _QMINAS_SET_TECHNOLOGY_PREF_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} QMINAS_SET_TECHNOLOGY_PREF_RESP_MSG, *PQMINAS_SET_TECHNOLOGY_PREF_RESP_MSG;
+
+typedef struct _QMINAS_GET_SIGNAL_STRENGTH_REQ_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+} QMINAS_GET_SIGNAL_STRENGTH_REQ_MSG, *PQMINAS_GET_SIGNAL_STRENGTH_REQ_MSG;
+
+typedef struct _QMINAS_SIGNAL_STRENGTH
+{
+   CHAR   SigStrength;
+   UCHAR  RadioIf;
+} QMINAS_SIGNAL_STRENGTH, *PQMINAS_SIGNAL_STRENGTH;
+
+typedef struct _QMINAS_SIGNAL_STRENGTH_LIST
+{
+   UCHAR  TLV3Type;
+   USHORT TLV3Length;
+   USHORT NumInstance;
+} QMINAS_SIGNAL_STRENGTH_LIST, *PQMINAS_SIGNAL_STRENGTH_LIST;
+
+
+typedef struct _QMINAS_GET_SIGNAL_STRENGTH_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   CHAR   SignalStrength;
+   UCHAR  RadioIf;
+} QMINAS_GET_SIGNAL_STRENGTH_RESP_MSG, *PQMINAS_GET_SIGNAL_STRENGTH_RESP_MSG;
+
+
+typedef struct _QMINAS_SET_EVENT_REPORT_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ReportSigStrength;
+   UCHAR  NumTresholds;
+   CHAR   TresholdList[2];
+} QMINAS_SET_EVENT_REPORT_REQ_MSG, *PQMINAS_SET_EVENT_REPORT_REQ_MSG;
+
+typedef struct _QMINAS_SET_EVENT_REPORT_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} QMINAS_SET_EVENT_REPORT_RESP_MSG, *PQMINAS_SET_EVENT_REPORT_RESP_MSG;
+
+typedef struct _QMINAS_SIGNAL_STRENGTH_TLV
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   CHAR   SigStrength;
+   UCHAR  RadioIf;
+} QMINAS_SIGNAL_STRENGTH_TLV, *PQMINAS_SIGNAL_STRENGTH_TLV;
+
+typedef struct _QMINAS_REJECT_CAUSE_TLV
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  ServiceDomain;
+   USHORT RejectCause;
+} QMINAS_REJECT_CAUSE_TLV, *PQMINAS_REJECT_CAUSE_TLV;
+
+typedef struct _QMINAS_EVENT_REPORT_IND_MSG
+{
+   USHORT Type;
+   USHORT Length;
+} QMINAS_EVENT_REPORT_IND_MSG, *PQMINAS_EVENT_REPORT_IND_MSG;
+
+typedef struct _QMINAS_GET_RF_BAND_INFO_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+} QMINAS_GET_RF_BAND_INFO_REQ_MSG, *PQMINAS_GET_RF_BAND_INFO_REQ_MSG;
+
+typedef struct _QMINASRF_BAND_INFO
+{
+   UCHAR  RadioIf;
+   USHORT ActiveBand;
+   USHORT ActiveChannel;
+} QMINASRF_BAND_INFO, *PQMINASRF_BAND_INFO;
+
+typedef struct _QMINAS_GET_RF_BAND_INFO_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  NumInstances;
+} QMINAS_GET_RF_BAND_INFO_RESP_MSG, *PQMINAS_GET_RF_BAND_INFO_RESP_MSG;
+
+
+typedef struct _QMINAS_GET_PLMN_NAME_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT MCC;
+   USHORT MNC;
+} QMINAS_GET_PLMN_NAME_REQ_MSG, *PQMINAS_GET_PLMN_NAME_REQ_MSG;
+
+typedef struct _QMINAS_GET_PLMN_NAME_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;       // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;        // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} QMINAS_GET_PLMN_NAME_RESP_MSG, *PQMINAS_GET_PLMN_NAME_RESP_MSG;
+
+typedef struct _QMINAS_GET_PLMN_NAME_SPN
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  SPN_Enc;
+   UCHAR  SPN_Len;
+} QMINAS_GET_PLMN_NAME_SPN, *PQMINAS_GET_PLMN_NAME_SPN;
+
+typedef struct _QMINAS_GET_PLMN_NAME_PLMN
+{
+   UCHAR  PLMN_Enc;
+   UCHAR  PLMN_Ci;
+   UCHAR  PLMN_SpareBits;
+   UCHAR  PLMN_Len;
+} QMINAS_GET_PLMN_NAME_PLMN, *PQMINAS_GET_PLMN_NAME_PLMN;
+
+typedef struct _QMINAS_INITIATE_ATTACH_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  PsAttachAction;
+} QMINAS_INITIATE_ATTACH_REQ_MSG, *PQMINAS_INITIATE_ATTACH_REQ_MSG;
+
+typedef struct _QMINAS_INITIATE_ATTACH_RESP_MSG
+{
+   USHORT Type;             // QMUX type 0x0003
+   USHORT Length;
+   UCHAR  TLVType;          // 0x02 - result code
+   USHORT TLVLength;        // 4
+   USHORT QMUXResult;      // QMI_RESULT_SUCCESS
+                            // QMI_RESULT_FAILURE
+   USHORT QMUXError;       // QMI_ERR_INVALID_ARG
+                            // QMI_ERR_NO_MEMORY
+                            // QMI_ERR_INTERNAL
+                            // QMI_ERR_FAULT
+} QMINAS_INITIATE_ATTACH_RESP_MSG, *PQMINAS_INITIATE_ATTACH_RESP_MSG;
+#endif
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+    CHAR rssi;
+    SHORT ecio;
+} __attribute__ ((packed)) QMINAS_SIG_INFO_CDMA_TLV_MSG, *PQMINAS_SIG_INFO_CDMA_TLV_MSG;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+    CHAR rssi;
+    SHORT ecio;
+    CHAR sinr;
+    INT io;
+} __attribute__ ((packed)) QMINAS_SIG_INFO_HDR_TLV_MSG, *PQMINAS_SIG_INFO_HDR_TLV_MSG;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+    CHAR rssi;
+} __attribute__ ((packed)) QMINAS_SIG_INFO_GSM_TLV_MSG, *PQMINAS_SIG_INFO_GSM_TLV_MSG;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+    CHAR rssi;
+    SHORT ecio;
+} __attribute__ ((packed)) QMINAS_SIG_INFO_WCDMA_TLV_MSG, *PQMINAS_SIG_INFO_WCDMA_TLV_MSG;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+    CHAR rssi;
+    CHAR rsrq;
+    SHORT rsrp;
+    SHORT snr;
+} __attribute__ ((packed)) QMINAS_SIG_INFO_LTE_TLV_MSG, *PQMINAS_SIG_INFO_LTE_TLV_MSG;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+    CHAR rscp;
+} __attribute__ ((packed)) QMINAS_SIG_INFO_TDSCDMA_TLV_MSG, *PQMINAS_SIG_INFO_TDSCDMA_TLV_MSG;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+    SHORT rsrp;
+    SHORT snr;
+} __attribute__ ((packed)) QMINAS_SIG_INFO_5G_NSA_TLV_MSG, *PQMINAS_SIG_INFO_5G_NSA_TLV_MSG;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+    SHORT nr5g_rsrq;
+} __attribute__ ((packed)) QMINAS_SIG_INFO_5G_SA_TLV_MSG, *PQMINAS_SIG_INFO_5G_SA_TLV_MSG;
+
+typedef struct {
+    uint8 radio_if;
+    uint16 active_band;
+    uint16 active_channel;
+} __attribute__ ((packed)) NasGetRfBandInfo;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+
+    uint8 num_instances;
+    NasGetRfBandInfo bands_array[0];
+} __attribute__ ((packed)) NasGetRfBandInfoList;
+
+typedef struct {
+    uint8 radio_if;
+    uint16 dedicated_band;
+} __attribute__ ((packed)) NasGetRfBandInfoDedicated;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+
+    uint8 num_instances;
+    NasGetRfBandInfoDedicated bands_array[0];
+} __attribute__ ((packed)) NasGetRfBandInfoDedicatedList;
+
+typedef struct {
+    uint8 radio_if;
+    uint16 active_band;
+    uint32 active_channel;
+} __attribute__ ((packed)) NasGetRfBandInfoExtended;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+
+    uint8 num_instances;
+    NasGetRfBandInfoExtended bands_array[0];
+} __attribute__ ((packed)) NasGetRfBandInfoExtendedList;
+
+typedef struct {
+    uint8 radio_if;
+    uint32 bandwidth;
+} __attribute__ ((packed)) NasGetRfBandInfoBandWidth;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+
+    uint8 num_instances;
+    NasGetRfBandInfoBandWidth bands_array[0];
+} __attribute__ ((packed)) NasGetRfBandInfoBandWidthList;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+
+    uint8 plmn[3];
+    uint8 tac[3];
+    uint64 global_cell_id;
+    uint16 physical_cell_id;
+    int16 rsrq;
+    int16 rsrp;
+    int16 snr;
+} __attribute__ ((packed)) NasGetCellLocationNr5gServingCell;
+
+typedef struct {
+    uint16 physical_cell_id;
+    int16 rsrq;
+    int16 rsrp;
+    int16 rssi;
+    int16 cell_selection_rx_level;
+} __attribute__ ((packed)) NasGetCellLocationLteInfoCell;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+
+    uint8 ue_in_idle;
+    uint8 plmn[3];
+    uint16 tracking_area_code;
+    uint32 global_cell_id;
+    uint16 absolute_rf_channel_number;
+    uint16 serving_cell_id;
+    uint8 cell_reselection_priority;
+    uint8 s_non_intra_search_threshold;
+    uint8 serving_cell_low_threshold;
+    uint8 s_intra_search_threshold;
+    uint8 cells_len;
+    NasGetCellLocationLteInfoCell cells_array[0];
+} __attribute__ ((packed)) NasGetCellLocationLteInfoIntrafrequency;
+
+typedef struct _QmiMessageNasGetCellLocationInfoOutputInterfrequencyLteInfoFrequencyElement {
+    uint16 eutra_absolute_rf_channel_number;
+    uint8 cell_selection_rx_level_low_threshold;
+    uint8 cell_selection_rx_level_high_threshold;
+    uint8 cell_reselection_priority;
+    uint8 cells_len;
+    NasGetCellLocationLteInfoCell cells_array[0];
+} __attribute__ ((packed)) NasGetCellLocationLteInfoInterfrequencyFrequencyElement;
+
+typedef struct {
+    UCHAR  TLVType;
+    USHORT TLVLength;
+
+    uint8 ue_in_idle;
+    uint8 freqs_len;
+    NasGetCellLocationLteInfoInterfrequencyFrequencyElement freqs[0];
+} __attribute__ ((packed)) NasGetCellLocationLteInfoInterfrequency;
+
+// ======================= End of NAS ==============================
+
+// ======================= UIM ==============================
+#define QMIUIM_READ_TRANSPARENT_REQ      0x0020
+#define QMIUIM_READ_TRANSPARENT_RESP     0x0020
+#define QMIUIM_READ_TRANSPARENT_IND      0x0020
+#define QMIUIM_READ_RECORD_REQ           0x0021
+#define QMIUIM_READ_RECORD_RESP          0x0021
+#define QMIUIM_READ_RECORD_IND           0x0021
+#define QMIUIM_WRITE_TRANSPARENT_REQ     0x0022
+#define QMIUIM_WRITE_TRANSPARENT_RESP    0x0022
+#define QMIUIM_WRITE_TRANSPARENT_IND     0x0022
+#define QMIUIM_WRITE_RECORD_REQ          0x0023
+#define QMIUIM_WRITE_RECORD_RESP         0x0023
+#define QMIUIM_WRITE_RECORD_IND          0x0023
+#define QMIUIM_SET_PIN_PROTECTION_REQ    0x0025
+#define QMIUIM_SET_PIN_PROTECTION_RESP   0x0025
+#define QMIUIM_SET_PIN_PROTECTION_IND    0x0025
+#define QMIUIM_VERIFY_PIN_REQ            0x0026
+#define QMIUIM_VERIFY_PIN_RESP           0x0026
+#define QMIUIM_VERIFY_PIN_IND            0x0026
+#define QMIUIM_UNBLOCK_PIN_REQ           0x0027
+#define QMIUIM_UNBLOCK_PIN_RESP          0x0027
+#define QMIUIM_UNBLOCK_PIN_IND           0x0027
+#define QMIUIM_CHANGE_PIN_REQ            0x0028
+#define QMIUIM_CHANGE_PIN_RESP           0x0028
+#define QMIUIM_CHANGE_PIN_IND            0x0028
+#define QMIUIM_DEPERSONALIZATION_REQ     0x0029
+#define QMIUIM_DEPERSONALIZATION_RESP    0x0029
+#define QMIUIM_EVENT_REG_REQ             0x002E
+#define QMIUIM_EVENT_REG_RESP            0x002E
+#define QMIUIM_GET_CARD_STATUS_REQ       0x002F
+#define QMIUIM_GET_CARD_STATUS_RESP      0x002F
+#define QMIUIM_STATUS_CHANGE_IND         0x0032
+#define QMIUIM_POWER_DOWN                0x0030
+#define QMIUIM_POWER_UP                  0x0031
+
+
+typedef struct _QMIUIM_GET_CARD_STATUS_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} __attribute__ ((packed)) QMIUIM_GET_CARD_STATUS_RESP_MSG, *PQMIUIM_GET_CARD_STATUS_RESP_MSG;
+
+#define UIM_CARD_STATE_ABSENT     0x00
+#define UIM_CARD_STATE_PRESENT    0x01
+#define UIM_CARD_STATE_ERROR      0x02
+
+typedef struct _QMIUIM_APP_INFO
+{
+   UCHAR  AppType;
+   UCHAR  AppState;
+   UCHAR  PersoState;
+   UCHAR  PersoFeature;
+   UCHAR  PersoRetries;
+   UCHAR  PersoUnblockRetries;
+   UCHAR  AIDLength;
+} __attribute__ ((packed)) QMIUI_APP_INFO;
+
+typedef struct _QMIUIM_CARD_STATUS
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT IndexGWPri;
+   USHORT Index1XPri;
+   USHORT IndexGWSec;
+   USHORT Index1XSec;
+   UCHAR  NumSlot;
+   UCHAR  CardState;
+   UCHAR  UPINState;
+   UCHAR  UPINRetries;
+   UCHAR  UPUKRetries;
+   UCHAR  ErrorCode;
+   UCHAR  NumApp;
+   QMIUI_APP_INFO APP_INFO;
+} __attribute__ ((packed)) QMIUIM_CARD_STATUS, *PQMIUIM_CARD_STATUS;
+
+typedef struct _QMIUIM_PIN_STATE
+{
+   UCHAR  UnivPIN;
+   UCHAR  PIN1State;
+   UCHAR  PIN1Retries;
+   UCHAR  PUK1Retries;
+   UCHAR  PIN2State;
+   UCHAR  PIN2Retries;
+   UCHAR  PUK2Retries;
+} __attribute__ ((packed)) QMIUIM_PIN_STATE, *PQMIUIM_PIN_STATE;
+
+typedef struct _QMIUIM_VERIFY_PIN_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  Session_Type;
+   UCHAR  Aid_Len;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  PINID;
+   UCHAR  PINLen;
+   UCHAR  PINValue;
+} __attribute__ ((packed)) QMIUIM_VERIFY_PIN_REQ_MSG, *PQMIUIM_VERIFY_PIN_REQ_MSG;
+
+typedef struct _QMIUIM_VERIFY_PIN_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   UCHAR  PINVerifyRetriesLeft;
+   UCHAR  PINUnblockRetriesLeft;
+} __attribute__ ((packed)) QMIUIM_VERIFY_PIN_RESP_MSG, *PQMIUIM_VERIFY_PIN_RESP_MSG;
+
+typedef struct _QMIUIM_READ_TRANSPARENT_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR  Session_Type;
+   UCHAR  Aid_Len;
+   UCHAR  TLV2Type;
+   USHORT TLV2Length;
+   USHORT file_id;
+   UCHAR  path_len;
+   UCHAR  path[];
+} __attribute__ ((packed)) QMIUIM_READ_TRANSPARENT_REQ_MSG, *PQMIUIM_READ_TRANSPARENT_REQ_MSG;
+
+typedef struct _READ_TRANSPARENT_TLV
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT Offset;
+   USHORT Length;
+} __attribute__ ((packed)) READ_TRANSPARENT_TLV, *PREAD_TRANSPARENT_TLV;
+
+typedef struct _QMIUIM_CONTENT
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT content_len;
+   UCHAR  content[];
+} __attribute__ ((packed)) QMIUIM_CONTENT, *PQMIUIM_CONTENT;
+
+typedef struct _QMIUIM_READ_TRANSPARENT_RESP_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   USHORT QMUXResult;
+   USHORT QMUXError;
+} __attribute__ ((packed)) QMIUIM_READ_TRANSPARENT_RESP_MSG, *PQMIUIM_READ_TRANSPARENT_RESP_MSG;
+
+typedef struct _QMIUIM_SET_CARD_SLOT_REQ_MSG
+{
+   USHORT Type;
+   USHORT Length;
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   UCHAR slot;
+} __attribute__ ((packed)) QMIUIM_SET_CARD_SLOT_REQ_MSG, *PQMIUIM_SET_CARD_SLOT_REQ_MSG;
+
+// ======================= COEX ==============================
+#define QMI_COEX_GET_WWAN_STATE_REQ 0x22
+#define QMI_COEX_GET_WWAN_STATE_RESP 0x22
+
+typedef struct {
+
+  uint32_t freq;
+  /**<   Band center frequency in MHz. */
+
+  uint32_t bandwidth;
+  /**<   Bandwidth in MHz. */
+}coex_band_type_v01;  /* Type */
+
+typedef struct _QMI_COEX_GET_WWAN_STATE_RESP_MSG_LTE_BAND
+{
+   UCHAR  TLVType;
+   USHORT TLVLength;
+   coex_band_type_v01 ul_band;
+   coex_band_type_v01  dl_band;
+} __attribute__ ((packed)) QMI_COEX_GET_WWAN_STATE_RESP_MSG_LTE_BAND, *PQMI_COEX_GET_WWAN_STATE_RESP_MSG_LTE_BAND;
+
+
+typedef struct _QMUX_MSG
+{
+   QCQMUX_HDR QMUXHdr;
+   union
+   {
+      // Message Header
+      QCQMUX_MSG_HDR                           QMUXMsgHdr;
+      QCQMUX_MSG_HDR_RESP                      QMUXMsgHdrResp;
+
+      // QMIWDS Message
+#if 0
+      QMIWDS_GET_PKT_SRVC_STATUS_REQ_MSG        PacketServiceStatusReq;
+      QMIWDS_GET_PKT_SRVC_STATUS_RESP_MSG       PacketServiceStatusRsp;
+      QMIWDS_GET_PKT_SRVC_STATUS_IND_MSG        PacketServiceStatusInd;
+      QMIWDS_EVENT_REPORT_IND_MSG               EventReportInd;
+      QMIWDS_GET_CURRENT_CHANNEL_RATE_REQ_MSG   GetCurrChannelRateReq;
+      QMIWDS_GET_CURRENT_CHANNEL_RATE_RESP_MSG  GetCurrChannelRateRsp;
+      QMIWDS_GET_PKT_STATISTICS_REQ_MSG         GetPktStatsReq;
+      QMIWDS_GET_PKT_STATISTICS_RESP_MSG        GetPktStatsRsp;
+      QMIWDS_SET_EVENT_REPORT_REQ_MSG           EventReportReq;
+      QMIWDS_SET_EVENT_REPORT_RESP_MSG          EventReportRsp;
+#endif
+      //#ifdef QC_IP_MODE
+      QMIWDS_GET_RUNTIME_SETTINGS_REQ_MSG       GetRuntimeSettingsReq;
+      QMIWDS_GET_RUNTIME_SETTINGS_RESP_MSG      GetRuntimeSettingsRsp;
+      //#endif // QC_IP_MODE
+      QMIWDS_SET_CLIENT_IP_FAMILY_PREF_REQ_MSG  SetClientIpFamilyPrefReq;
+      QMIWDS_SET_CLIENT_IP_FAMILY_PREF_RESP_MSG SetClientIpFamilyPrefResp;
+      QMIWDS_SET_AUTO_CONNECT_REQ_MSG SetAutoConnectReq;
+#if 0
+      QMIWDS_GET_MIP_MODE_REQ_MSG               GetMipModeReq;
+      QMIWDS_GET_MIP_MODE_RESP_MSG              GetMipModeResp;
+#endif
+      QMIWDS_START_NETWORK_INTERFACE_REQ_MSG    StartNwInterfaceReq;
+      QMIWDS_START_NETWORK_INTERFACE_RESP_MSG   StartNwInterfaceResp;
+      QMIWDS_STOP_NETWORK_INTERFACE_REQ_MSG     StopNwInterfaceReq;
+      QMIWDS_STOP_NETWORK_INTERFACE_RESP_MSG    StopNwInterfaceResp;
+      QMIWDS_GET_DEFAULT_SETTINGS_REQ_MSG       GetDefaultSettingsReq;
+      QMIWDS_GET_DEFAULT_SETTINGS_RESP_MSG      GetDefaultSettingsResp;
+      QMIWDS_MODIFY_PROFILE_SETTINGS_REQ_MSG    ModifyProfileSettingsReq;
+      QMIWDS_MODIFY_PROFILE_SETTINGS_RESP_MSG   ModifyProfileSettingsResp;
+      QMIWDS_GET_PROFILE_SETTINGS_REQ_MSG       GetProfileSettingsReq;
+      QMIWDS_CREATE_PROFILE_SETTINGS_REQ_MSG    CreatetProfileSettingsReq;
+      QMIWDS_GET_PROFILE_LIST_REQ_MSG           GetProfileListReq;
+      QMIWDS_GET_PROFILE_LIST_RESP_MSG          GetProfileListResp;
+#if 0
+      QMIWDS_GET_DATA_BEARER_REQ_MSG            GetDataBearerReq;
+      QMIWDS_GET_DATA_BEARER_RESP_MSG           GetDataBearerResp;
+      QMIWDS_DUN_CALL_INFO_REQ_MSG              DunCallInfoReq;
+      QMIWDS_DUN_CALL_INFO_RESP_MSG             DunCallInfoResp;
+#endif
+      QMIWDS_BIND_MUX_DATA_PORT_REQ_MSG         BindMuxDataPortReq;
+
+      // QMIDMS Messages
+#if 0
+      QMIDMS_GET_DEVICE_MFR_REQ_MSG             GetDeviceMfrReq;
+      QMIDMS_GET_DEVICE_MFR_RESP_MSG            GetDeviceMfrRsp;
+      QMIDMS_GET_DEVICE_MODEL_ID_REQ_MSG        GetDeviceModeIdReq;
+      QMIDMS_GET_DEVICE_MODEL_ID_RESP_MSG       GetDeviceModeIdRsp;
+      QMIDMS_GET_DEVICE_REV_ID_REQ_MSG          GetDeviceRevIdReq;
+      QMIDMS_GET_DEVICE_REV_ID_RESP_MSG         GetDeviceRevIdRsp;
+      QMIDMS_GET_MSISDN_REQ_MSG                 GetMsisdnReq;
+      QMIDMS_GET_MSISDN_RESP_MSG                GetMsisdnRsp;
+      QMIDMS_GET_DEVICE_SERIAL_NUMBERS_REQ_MSG  GetDeviceSerialNumReq;
+      QMIDMS_GET_DEVICE_SERIAL_NUMBERS_RESP_MSG GetDeviceSerialNumRsp;
+      QMIDMS_GET_DEVICE_CAP_REQ_MSG             GetDeviceCapReq;
+      QMIDMS_GET_DEVICE_CAP_RESP_MSG            GetDeviceCapResp;
+      QMIDMS_GET_BAND_CAP_REQ_MSG               GetBandCapReq;
+      QMIDMS_GET_BAND_CAP_RESP_MSG              GetBandCapRsp;
+      QMIDMS_GET_ACTIVATED_STATUS_REQ_MSG       GetActivatedStatusReq;
+      QMIDMS_GET_ACTIVATED_STATUS_RESP_MSG      GetActivatedStatusResp;
+      QMIDMS_GET_OPERATING_MODE_REQ_MSG         GetOperatingModeReq;
+      QMIDMS_GET_OPERATING_MODE_RESP_MSG        GetOperatingModeResp;
+#endif
+      QMIDMS_SET_OPERATING_MODE_REQ_MSG         SetOperatingModeReq;
+      QMIDMS_SET_OPERATING_MODE_RESP_MSG        SetOperatingModeResp;
+#if 0
+      QMIDMS_UIM_GET_ICCID_REQ_MSG              GetICCIDReq;
+      QMIDMS_UIM_GET_ICCID_RESP_MSG             GetICCIDResp;
+      QMIDMS_ACTIVATE_AUTOMATIC_REQ_MSG         ActivateAutomaticReq;
+      QMIDMS_ACTIVATE_AUTOMATIC_RESP_MSG        ActivateAutomaticResp;
+      QMIDMS_ACTIVATE_MANUAL_REQ_MSG            ActivateManualReq;
+      QMIDMS_ACTIVATE_MANUAL_RESP_MSG           ActivateManualResp;
+#endif
+      QMIDMS_UIM_GET_PIN_STATUS_REQ_MSG         UIMGetPinStatusReq;
+      QMIDMS_UIM_GET_PIN_STATUS_RESP_MSG        UIMGetPinStatusResp;
+      QMIDMS_UIM_VERIFY_PIN_REQ_MSG             UIMVerifyPinReq;
+      QMIDMS_UIM_VERIFY_PIN_RESP_MSG            UIMVerifyPinResp;
+#if 0
+      QMIDMS_UIM_SET_PIN_PROTECTION_REQ_MSG     UIMSetPinProtectionReq;
+      QMIDMS_UIM_SET_PIN_PROTECTION_RESP_MSG    UIMSetPinProtectionResp;
+      QMIDMS_UIM_CHANGE_PIN_REQ_MSG             UIMChangePinReq;
+      QMIDMS_UIM_CHANGE_PIN_RESP_MSG            UIMChangePinResp;
+      QMIDMS_UIM_UNBLOCK_PIN_REQ_MSG            UIMUnblockPinReq;
+      QMIDMS_UIM_UNBLOCK_PIN_RESP_MSG           UIMUnblockPinResp;
+      QMIDMS_SET_EVENT_REPORT_REQ_MSG           DmsSetEventReportReq;
+      QMIDMS_SET_EVENT_REPORT_RESP_MSG          DmsSetEventReportResp;
+      QMIDMS_EVENT_REPORT_IND_MSG               DmsEventReportInd;
+#endif
+      QMIDMS_UIM_GET_STATE_REQ_MSG              UIMGetStateReq;
+      QMIDMS_UIM_GET_STATE_RESP_MSG             UIMGetStateResp;
+      QMIDMS_UIM_GET_IMSI_REQ_MSG               UIMGetIMSIReq;
+      QMIDMS_UIM_GET_IMSI_RESP_MSG              UIMGetIMSIResp;
+#if 0
+      QMIDMS_UIM_GET_CK_STATUS_REQ_MSG          UIMGetCkStatusReq;
+      QMIDMS_UIM_GET_CK_STATUS_RESP_MSG         UIMGetCkStatusResp;
+      QMIDMS_UIM_SET_CK_PROTECTION_REQ_MSG      UIMSetCkProtectionReq;
+      QMIDMS_UIM_SET_CK_PROTECTION_RESP_MSG     UIMSetCkProtectionResp;
+      QMIDMS_UIM_UNBLOCK_CK_REQ_MSG             UIMUnblockCkReq;
+      QMIDMS_UIM_UNBLOCK_CK_RESP_MSG            UIMUnblockCkResp;
+#endif
+
+      // QMIQOS Messages
+#if 1
+      QMI_QOS_SET_EVENT_REPORT_REQ_MSG          QosSetEventReportReq;
+      QMI_QOS_SET_EVENT_REPORT_RESP_MSG         QosSetEventReportRsp;
+      QMI_QOS_SET_EVENT_REPORT_IND_MSG          QosSetEventReportInd;
+	  QMI_QOS_BIND_DATA_PORT_REQ_MSG			QosBindDataPortReq;
+	  QMI_QOS_BIND_DATA_PORT_RESP_MSG			QosBindDataPortRsp;
+	  QMI_QOS_INDICATION_REGISTER_REQ_MSG		QosIndRegReq;
+	  QMI_QOS_INDICATION_REGISTER_RESP_MSG		QosIndRegRsp;
+	  QMI_QOS_GLOBAL_QOS_FLOW_IND_MSG			QosGlobalQosFlowInd;
+	  QMI_QOS_GET_QOS_INFO_REQ_MSG				QosGetQosInfoReq;
+	  QMI_QOS_GET_QOS_INFO_RESP_MSG				QosGetQosInfoRsp;
+#endif
+
+      // QMIWMS Messages
+#if 0
+      QMIWMS_GET_MESSAGE_PROTOCOL_REQ_MSG       GetMessageProtocolReq;
+      QMIWMS_GET_MESSAGE_PROTOCOL_RESP_MSG      GetMessageProtocolResp;
+      QMIWMS_GET_SMSC_ADDRESS_REQ_MSG           GetSMSCAddressReq;
+      QMIWMS_GET_SMSC_ADDRESS_RESP_MSG          GetSMSCAddressResp;
+      QMIWMS_SET_SMSC_ADDRESS_REQ_MSG           SetSMSCAddressReq;
+      QMIWMS_SET_SMSC_ADDRESS_RESP_MSG          SetSMSCAddressResp;
+      QMIWMS_GET_STORE_MAX_SIZE_REQ_MSG         GetStoreMaxSizeReq;
+      QMIWMS_GET_STORE_MAX_SIZE_RESP_MSG        GetStoreMaxSizeResp;
+      QMIWMS_LIST_MESSAGES_REQ_MSG              ListMessagesReq;
+      QMIWMS_LIST_MESSAGES_RESP_MSG             ListMessagesResp;
+      QMIWMS_RAW_READ_REQ_MSG                   RawReadMessagesReq;
+      QMIWMS_RAW_READ_RESP_MSG                  RawReadMessagesResp;
+      QMIWMS_SET_EVENT_REPORT_REQ_MSG           WmsSetEventReportReq;
+      QMIWMS_SET_EVENT_REPORT_RESP_MSG          WmsSetEventReportResp;
+      QMIWMS_EVENT_REPORT_IND_MSG               WmsEventReportInd;
+      QMIWMS_DELETE_REQ_MSG                     WmsDeleteReq;
+      QMIWMS_DELETE_RESP_MSG                    WmsDeleteResp;
+      QMIWMS_RAW_SEND_REQ_MSG                   RawSendMessagesReq;
+      QMIWMS_RAW_SEND_RESP_MSG                  RawSendMessagesResp;
+      QMIWMS_MODIFY_TAG_REQ_MSG                 WmsModifyTagReq;
+      QMIWMS_MODIFY_TAG_RESP_MSG                WmsModifyTagResp;
+#endif
+
+      // QMINAS Messages
+#if 0
+      QMINAS_GET_HOME_NETWORK_REQ_MSG           GetHomeNetworkReq;
+      QMINAS_GET_HOME_NETWORK_RESP_MSG          GetHomeNetworkResp;
+      QMINAS_GET_PREFERRED_NETWORK_REQ_MSG      GetPreferredNetworkReq;
+      QMINAS_GET_PREFERRED_NETWORK_RESP_MSG     GetPreferredNetworkResp;
+      QMINAS_GET_FORBIDDEN_NETWORK_REQ_MSG      GetForbiddenNetworkReq;
+      QMINAS_GET_FORBIDDEN_NETWORK_RESP_MSG     GetForbiddenNetworkResp;
+      QMINAS_GET_SERVING_SYSTEM_REQ_MSG         GetServingSystemReq;
+#endif
+      QMINAS_GET_SERVING_SYSTEM_RESP_MSG        GetServingSystemResp;
+      QMINAS_GET_SYS_INFO_RESP_MSG              GetSysInfoResp;
+      QMINAS_SYS_INFO_IND_MSG                   NasSysInfoInd;
+#if 0
+      QMINAS_SERVING_SYSTEM_IND_MSG             NasServingSystemInd;
+      QMINAS_SET_PREFERRED_NETWORK_REQ_MSG      SetPreferredNetworkReq;
+      QMINAS_SET_PREFERRED_NETWORK_RESP_MSG     SetPreferredNetworkResp;
+      QMINAS_SET_FORBIDDEN_NETWORK_REQ_MSG      SetForbiddenNetworkReq;
+      QMINAS_SET_FORBIDDEN_NETWORK_RESP_MSG     SetForbiddenNetworkResp;
+      QMINAS_PERFORM_NETWORK_SCAN_REQ_MSG       PerformNetworkScanReq;
+      QMINAS_PERFORM_NETWORK_SCAN_RESP_MSG      PerformNetworkScanResp;
+      QMINAS_INITIATE_NW_REGISTER_REQ_MSG       InitiateNwRegisterReq;
+      QMINAS_INITIATE_NW_REGISTER_RESP_MSG      InitiateNwRegisterResp;
+      QMINAS_SET_TECHNOLOGY_PREF_REQ_MSG        SetTechnologyPrefReq;
+      QMINAS_SET_TECHNOLOGY_PREF_RESP_MSG       SetTechnologyPrefResp;
+      QMINAS_GET_SIGNAL_STRENGTH_REQ_MSG        GetSignalStrengthReq;
+      QMINAS_GET_SIGNAL_STRENGTH_RESP_MSG       GetSignalStrengthResp;
+      QMINAS_SET_EVENT_REPORT_REQ_MSG           SetEventReportReq;
+      QMINAS_SET_EVENT_REPORT_RESP_MSG          SetEventReportResp;
+      QMINAS_EVENT_REPORT_IND_MSG               NasEventReportInd;
+      QMINAS_GET_RF_BAND_INFO_REQ_MSG           GetRFBandInfoReq;
+      QMINAS_GET_RF_BAND_INFO_RESP_MSG          GetRFBandInfoResp;
+      QMINAS_INITIATE_ATTACH_REQ_MSG            InitiateAttachReq;
+      QMINAS_INITIATE_ATTACH_RESP_MSG           InitiateAttachResp;
+      QMINAS_GET_PLMN_NAME_REQ_MSG              GetPLMNNameReq;
+      QMINAS_GET_PLMN_NAME_RESP_MSG             GetPLMNNameResp;
+#endif
+
+      // QMIUIM Messages
+      QMIUIM_GET_CARD_STATUS_RESP_MSG           UIMGetCardStatus;
+      QMIUIM_VERIFY_PIN_REQ_MSG                 UIMUIMVerifyPinReq;
+      QMIUIM_VERIFY_PIN_RESP_MSG                UIMUIMVerifyPinResp;
+#if 0
+      QMIUIM_SET_PIN_PROTECTION_REQ_MSG         UIMUIMSetPinProtectionReq;
+      QMIUIM_SET_PIN_PROTECTION_RESP_MSG        UIMUIMSetPinProtectionResp;
+      QMIUIM_CHANGE_PIN_REQ_MSG                 UIMUIMChangePinReq;
+      QMIUIM_CHANGE_PIN_RESP_MSG                UIMUIMChangePinResp;
+      QMIUIM_UNBLOCK_PIN_REQ_MSG                UIMUIMUnblockPinReq;
+      QMIUIM_UNBLOCK_PIN_RESP_MSG               UIMUIMUnblockPinResp;
+#endif
+      QMIUIM_READ_TRANSPARENT_REQ_MSG           UIMUIMReadTransparentReq;
+      QMIUIM_READ_TRANSPARENT_RESP_MSG          UIMUIMReadTransparentResp;
+      QMIUIM_SET_CARD_SLOT_REQ_MSG                 UIMSetCardSlotReq;
+
+      QMIWDS_ADMIN_SET_DATA_FORMAT_REQ_MSG      SetDataFormatReq;
+      QMI_WDA_SET_LOOPBACK_CONFIG_REQ_MSG       SetLoopBackReq;
+      QMI_WDA_SET_LOOPBACK_CONFIG_IND_MSG       SetLoopBackInd;	  
+   };
+} __attribute__ ((packed)) QMUX_MSG, *PQMUX_MSG;
+
+typedef struct _QCQMIMSG {
+    QCQMI_HDR QMIHdr;
+    union {
+        QMICTL_MSG CTLMsg;
+        QMUX_MSG MUXMsg;
+    };
+} __attribute__ ((packed)) QCQMIMSG, *PQCQMIMSG;
+
+#pragma pack(pop)
+
+#endif // QCQMUX_H
+
diff --git a/RM520N-5G/文件/source/QMIThread.c b/RM520N-5G/文件/source/QMIThread.c
new file mode 100644
index 0000000..d4ad232
--- /dev/null
+++ b/RM520N-5G/文件/source/QMIThread.c
@@ -0,0 +1,3099 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include "QMIThread.h"
+#include <inttypes.h>
+
+#ifndef MIN
+#define MIN(a, b)	((a) < (b)? (a): (b))
+#endif
+
+#define qmi_rsp_check_and_return() do { \
+        if (err < 0 || pResponse == NULL) { \
+            dbg_time("%s err = %d", __func__, err); \
+            return err; \
+        } \
+        pMUXMsg = &pResponse->MUXMsg; \
+        if (le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXResult) || le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXError)) { \
+            USHORT QMUXError = le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXError); \
+            dbg_time("%s QMUXResult = 0x%x, QMUXError = 0x%x", __func__, \
+                le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXResult), QMUXError); \
+            free(pResponse); \
+            return QMUXError; \
+        } \
+} while(0)
+
+#define qmi_rsp_check() do { \
+        if (err < 0 || pResponse == NULL) { \
+            dbg_time("%s err = %d", __func__, err); \
+            return err; \
+        } \
+        pMUXMsg = &pResponse->MUXMsg; \
+        if (le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXResult) || le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXError)) { \
+            USHORT QMUXError = le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXError); \
+            dbg_time("%s QMUXResult = 0x%x, QMUXError = 0x%x", __func__, \
+                le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXResult), QMUXError); \
+        } \
+} while(0)
+
+#define UIM_APP_TYPE_CSIM   0x04
+#define UIM_APP_TYPE_USIM   0x02
+
+static uint32_t WdsConnectionIPv4Handle = 0;
+static uint32_t WdsConnectionIPv6Handle = 0;
+static int s_is_cdma = 0;
+static int s_5g_type = WWAN_DATA_CLASS_NONE;
+static int s_hdr_personality = 0; // 0x01-HRPD, 0x02-eHRPD
+static char *qstrcpy(char *to, const char *from) { //no __strcpy_chk
+	char *save = to;
+	for (; (*to = *from) != '\0'; ++from, ++to);
+	return(save);
+}
+
+static void uchar2char(char *dst_ptr, size_t dst_len, const UCHAR *src_ptr, size_t src_len) { 
+    size_t copy = MIN(dst_len-1, src_len);
+
+    if (copy)
+        memcpy(dst_ptr, src_ptr, copy);
+    dst_ptr[copy] = 0;
+}
+
+static int s_9x07 = 1;
+
+typedef USHORT (*CUSTOMQMUX)(PQMUX_MSG pMUXMsg, void *arg);
+
+// To retrieve the ith (Index) TLV
+PQMI_TLV_HDR GetTLV (PQCQMUX_MSG_HDR pQMUXMsgHdr, int TLVType) {
+    int TLVFind = 0;
+    USHORT Length = le16_to_cpu(pQMUXMsgHdr->Length);
+    PQMI_TLV_HDR pTLVHdr = (PQMI_TLV_HDR)(pQMUXMsgHdr + 1);
+
+    while (Length >= sizeof(QMI_TLV_HDR)) {
+        TLVFind++;
+        if (TLVType > 0x1000) {
+            if ((TLVFind + 0x1000) == TLVType)
+                return pTLVHdr;
+        } else  if (pTLVHdr->TLVType == TLVType) {
+            return pTLVHdr;
+        }
+        Length -= (le16_to_cpu((pTLVHdr->TLVLength)) + sizeof(QMI_TLV_HDR));
+        pTLVHdr = (PQMI_TLV_HDR)(((UCHAR *)pTLVHdr) + le16_to_cpu(pTLVHdr->TLVLength) + sizeof(QMI_TLV_HDR));
+    }
+
+   return NULL;
+}
+
+static USHORT GetQMUXTransactionId(void) {
+    static int TransactionId = 0;
+    if (++TransactionId > 0xFFFF)
+        TransactionId = 1;
+    return TransactionId;
+}
+
+static PQCQMIMSG ComposeQMUXMsg(UCHAR QMIType, USHORT Type, CUSTOMQMUX customQmuxMsgFunction, void *arg) {
+    UCHAR QMIBuf[WDM_DEFAULT_BUFSIZE];
+    PQCQMIMSG pRequest = (PQCQMIMSG)QMIBuf;
+    int Length;
+
+    memset(QMIBuf, 0x00, sizeof(QMIBuf));
+    pRequest->QMIHdr.IFType = USB_CTL_MSG_TYPE_QMI;
+    pRequest->QMIHdr.CtlFlags = 0x00;
+    pRequest->QMIHdr.QMIType = QMIType;
+
+    pRequest->MUXMsg.QMUXHdr.CtlFlags = QMUX_CTL_FLAG_SINGLE_MSG | QMUX_CTL_FLAG_TYPE_CMD;
+    pRequest->MUXMsg.QMUXHdr.TransactionId = cpu_to_le16(GetQMUXTransactionId());
+    pRequest->MUXMsg.QMUXMsgHdr.Type = cpu_to_le16(Type);
+    if (customQmuxMsgFunction)
+        pRequest->MUXMsg.QMUXMsgHdr.Length = cpu_to_le16(customQmuxMsgFunction(&pRequest->MUXMsg, arg) - sizeof(QCQMUX_MSG_HDR));
+    else
+        pRequest->MUXMsg.QMUXMsgHdr.Length = cpu_to_le16(0x0000);
+
+    pRequest->QMIHdr.Length = cpu_to_le16(le16_to_cpu(pRequest->MUXMsg.QMUXMsgHdr.Length) + sizeof(QCQMUX_MSG_HDR) + sizeof(QCQMUX_HDR)
+        + sizeof(QCQMI_HDR) - 1);
+    Length = le16_to_cpu(pRequest->QMIHdr.Length) + 1;
+
+    pRequest = (PQCQMIMSG)malloc(Length);
+    if (pRequest == NULL) {
+        dbg_time("%s fail to malloc", __func__);
+    } else {
+        memcpy(pRequest, QMIBuf, Length);
+    }
+
+    return pRequest;
+}
+
+#if 0
+static USHORT NasSetEventReportReq(PQMUX_MSG pMUXMsg, void *arg) {
+    pMUXMsg->SetEventReportReq.TLVType = 0x10;
+    pMUXMsg->SetEventReportReq.TLVLength = 0x04;
+    pMUXMsg->SetEventReportReq.ReportSigStrength = 0x00;
+    pMUXMsg->SetEventReportReq.NumTresholds = 2;
+    pMUXMsg->SetEventReportReq.TresholdList[0] = -113;
+    pMUXMsg->SetEventReportReq.TresholdList[1] = -50;
+    return sizeof(QMINAS_SET_EVENT_REPORT_REQ_MSG);
+}
+
+static USHORT WdsSetEventReportReq(PQMUX_MSG pMUXMsg, void *arg) {
+    pMUXMsg->EventReportReq.TLVType = 0x10;          // 0x10 -- current channel rate indicator
+    pMUXMsg->EventReportReq.TLVLength = 0x0001;        // 1
+    pMUXMsg->EventReportReq.Mode = 0x00;             // 0-do not report; 1-report when rate changes
+
+    pMUXMsg->EventReportReq.TLV2Type = 0x11;         // 0x11
+    pMUXMsg->EventReportReq.TLV2Length = 0x0005;       // 5
+    pMUXMsg->EventReportReq.StatsPeriod = 0x00;      // seconds between reports; 0-do not report
+    pMUXMsg->EventReportReq.StatsMask = 0x000000ff;        //
+
+    pMUXMsg->EventReportReq.TLV3Type = 0x12;          // 0x12 -- current data bearer indicator
+    pMUXMsg->EventReportReq.TLV3Length = 0x0001;        // 1
+    pMUXMsg->EventReportReq.Mode3 = 0x01;             // 0-do not report; 1-report when changes
+
+    pMUXMsg->EventReportReq.TLV4Type = 0x13;          // 0x13 -- dormancy status indicator
+    pMUXMsg->EventReportReq.TLV4Length = 0x0001;        // 1
+    pMUXMsg->EventReportReq.DormancyStatus = 0x00;    // 0-do not report; 1-report when changes
+    return sizeof(QMIWDS_SET_EVENT_REPORT_REQ_MSG);
+}
+
+static USHORT DmsSetEventReportReq(PQMUX_MSG pMUXMsg) {
+    PPIN_STATUS pPinState = (PPIN_STATUS)(&pMUXMsg->DmsSetEventReportReq + 1);
+    PUIM_STATE pUimState = (PUIM_STATE)(pPinState + 1);
+    // Pin State
+    pPinState->TLVType = 0x12;
+    pPinState->TLVLength = 0x01;
+    pPinState->ReportPinState = 0x01;
+    // UIM State
+    pUimState->TLVType = 0x15;
+    pUimState->TLVLength = 0x01;
+    pUimState->UIMState = 0x01;
+    return sizeof(QMIDMS_SET_EVENT_REPORT_REQ_MSG) + sizeof(PIN_STATUS) + sizeof(UIM_STATE);
+}
+#endif
+
+static USHORT WdsStartNwInterfaceReq(PQMUX_MSG pMUXMsg, void *arg) {
+    PQMIWDS_TECHNOLOGY_PREFERECE pTechPref;
+    PQMIWDS_AUTH_PREFERENCE pAuthPref;
+    PQMIWDS_USERNAME pUserName;
+    PQMIWDS_PD pPd;
+    PQMIWDS_APNNAME pApnName;
+    PQMIWDS_IP_FAMILY_TLV pIpFamily;
+    USHORT TLVLength = 0;
+    UCHAR *pTLV;
+    PROFILE_T *profile = (PROFILE_T *)arg;
+    const char *profile_user = profile->user;
+    const char *profile_pd = profile->pd;
+    int profile_auth = profile->auth;
+
+    if (s_is_cdma && (profile_user == NULL || profile_user[0] == '\0') && (profile_pd == NULL || profile_pd[0] == '\0')) {
+        profile_user = "ctnet@mycdma.cn";
+        profile_pd = "vnet.mobi";
+        profile_auth = 2; //chap
+    }
+
+    pTLV = (UCHAR *)(&pMUXMsg->StartNwInterfaceReq + 1);
+    pMUXMsg->StartNwInterfaceReq.Length = 0;
+
+    // Set technology Preferece
+    pTechPref = (PQMIWDS_TECHNOLOGY_PREFERECE)(pTLV + TLVLength);
+    pTechPref->TLVType = 0x30;
+    pTechPref->TLVLength = cpu_to_le16(0x01);
+    if (s_is_cdma == 0)
+        pTechPref->TechPreference = 0x01;
+    else
+        pTechPref->TechPreference = 0x02;
+    TLVLength +=(le16_to_cpu(pTechPref->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+
+    // Set APN Name
+    if (profile->apn && !s_is_cdma) { //cdma no apn
+        pApnName = (PQMIWDS_APNNAME)(pTLV + TLVLength);
+        pApnName->TLVType = 0x14;
+        pApnName->TLVLength = cpu_to_le16(strlen(profile->apn));
+        qstrcpy((char *)&pApnName->ApnName, profile->apn);
+        TLVLength +=(le16_to_cpu(pApnName->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+    }
+
+    // Set User Name
+    if (profile_user) {
+        pUserName = (PQMIWDS_USERNAME)(pTLV + TLVLength);
+        pUserName->TLVType = 0x17;
+        pUserName->TLVLength = cpu_to_le16(strlen(profile_user));
+        qstrcpy((char *)&pUserName->UserName, profile_user);
+        TLVLength += (le16_to_cpu(pUserName->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+    }
+
+    // Set Password
+    if (profile_pd) {
+        pPd = (PQMIWDS_PD)(pTLV + TLVLength);
+        pPd->TLVType = 0x18;
+        pPd->TLVLength = cpu_to_le16(strlen(profile_pd));
+        qstrcpy((char *)&pPd->Pd, profile_pd);
+	TLVLength += (le16_to_cpu(pPd->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+    }
+
+    // Set Auth Protocol
+    if (profile_user && profile_pd) {
+        pAuthPref = (PQMIWDS_AUTH_PREFERENCE)(pTLV + TLVLength);
+        pAuthPref->TLVType = 0x16;
+        pAuthPref->TLVLength = cpu_to_le16(0x01);
+        pAuthPref->AuthPreference = profile_auth; // 0 ~ None, 1 ~ Pap, 2 ~ Chap, 3 ~ MsChapV2
+        TLVLength += (le16_to_cpu(pAuthPref->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+    }
+
+    // Add IP Family Preference
+    pIpFamily = (PQMIWDS_IP_FAMILY_TLV)(pTLV + TLVLength);
+    pIpFamily->TLVType = 0x19;
+    pIpFamily->TLVLength = cpu_to_le16(0x01);
+    pIpFamily->IpFamily = profile->curIpFamily;
+    TLVLength += (le16_to_cpu(pIpFamily->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+
+    if(profile->usb_dev.idProduct != 0x0316){
+    
+      //Set Profile Index
+      if (profile->profile_index && !s_is_cdma) { //cdma only support one pdp, so no need to set profile index
+          PQMIWDS_PROFILE_IDENTIFIER pProfileIndex = (PQMIWDS_PROFILE_IDENTIFIER)(pTLV + TLVLength);
+          pProfileIndex->TLVLength = cpu_to_le16(0x01);
+          pProfileIndex->TLVType = 0x31;
+          pProfileIndex->ProfileIndex = profile->profile_index;
+          if (s_is_cdma && s_hdr_personality == 0x02) {
+              pProfileIndex->TLVType = 0x32; //profile_index_3gpp2
+              pProfileIndex->ProfileIndex = 101;
+          }
+          TLVLength += (le16_to_cpu(pProfileIndex->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+      }
+    }
+    else if(profile->usb_dev.idProduct == 0x0316){
+   
+      if(profile->bring_up_by_apn_name)
+      {
+          PQMIWDS_BRINGUP_APNNAME pBring_up_by_apn_name = (PQMIWDS_BRINGUP_APNNAME)(pTLV + TLVLength);        
+          pBring_up_by_apn_name->TLVLength = cpu_to_le16(0x01);  
+          pBring_up_by_apn_name->TLVType = 0x3C;
+          pBring_up_by_apn_name->bring_up_by_apn_name  =   profile->bring_up_by_apn_name;
+          TLVLength += (le16_to_cpu(pBring_up_by_apn_name->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+      }
+
+      if(profile->bring_up_by_apn_type)
+      {
+          PQMIWDS_BRINGUP_APNTYPE pBring_up_by_apn_type = (PQMIWDS_BRINGUP_APNTYPE)(pTLV + TLVLength); 
+          pBring_up_by_apn_type->TLVLength = cpu_to_le16(0x01);  
+          pBring_up_by_apn_type->TLVType = 0x3D;
+          pBring_up_by_apn_type->bring_up_by_apn_type  =   profile->bring_up_by_apn_type;
+          TLVLength += (le16_to_cpu(pBring_up_by_apn_type->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+      }
+    
+      if(profile->apn_type)
+      {
+          PQMIWDS_APN_TYPE pApn_type = (PQMIWDS_APN_TYPE)(pTLV + TLVLength); 
+          pApn_type->TLVLength = cpu_to_le32(0x04);  
+          pApn_type->TLVType = 0x38;
+          pApn_type->apn_type = cpu_to_le32(profile->apn_type);
+          TLVLength += (le16_to_cpu(pApn_type->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+      }  
+   }
+      return sizeof(QMIWDS_START_NETWORK_INTERFACE_REQ_MSG) + TLVLength;
+}
+
+static USHORT WdsStopNwInterfaceReq(PQMUX_MSG pMUXMsg, void *arg) {
+    pMUXMsg->StopNwInterfaceReq.TLVType = 0x01;
+    pMUXMsg->StopNwInterfaceReq.TLVLength = cpu_to_le16(0x04);
+    if (*((int *)arg) == IpFamilyV4)
+        pMUXMsg->StopNwInterfaceReq.Handle =  cpu_to_le32(WdsConnectionIPv4Handle);
+    else
+        pMUXMsg->StopNwInterfaceReq.Handle =  cpu_to_le32(WdsConnectionIPv6Handle);
+    return sizeof(QMIWDS_STOP_NETWORK_INTERFACE_REQ_MSG);
+}
+
+static USHORT WdsSetClientIPFamilyPref(PQMUX_MSG pMUXMsg, void *arg) {
+    pMUXMsg->SetClientIpFamilyPrefReq.TLVType = 0x01;
+    pMUXMsg->SetClientIpFamilyPrefReq.TLVLength = cpu_to_le16(0x01);
+    pMUXMsg->SetClientIpFamilyPrefReq.IpPreference = *((UCHAR *)arg);
+    return sizeof(QMIWDS_SET_CLIENT_IP_FAMILY_PREF_REQ_MSG);
+}
+
+static USHORT WdsSetAutoConnect(PQMUX_MSG pMUXMsg, void *arg) {
+    pMUXMsg->SetAutoConnectReq.TLVType = 0x01;
+    pMUXMsg->SetAutoConnectReq.TLVLength = cpu_to_le16(0x01);
+    pMUXMsg->SetAutoConnectReq.autoconnect_setting = *((UCHAR *)arg);
+    return sizeof(QMIWDS_SET_AUTO_CONNECT_REQ_MSG);
+}
+
+enum peripheral_ep_type {
+	DATA_EP_TYPE_RESERVED	= 0x0,
+	DATA_EP_TYPE_HSIC	= 0x1,
+	DATA_EP_TYPE_HSUSB	= 0x2,
+	DATA_EP_TYPE_PCIE	= 0x3,
+	DATA_EP_TYPE_EMBEDDED	= 0x4,
+	DATA_EP_TYPE_BAM_DMUX	= 0x5,
+};
+        
+static USHORT WdsSetQMUXBindMuxDataPort(PQMUX_MSG pMUXMsg, void *arg) {
+    QMAP_SETTING *qmap_settings = (QMAP_SETTING *)arg;
+
+    pMUXMsg->BindMuxDataPortReq.TLVType = 0x10;
+    pMUXMsg->BindMuxDataPortReq.TLVLength = cpu_to_le16(0x08);
+    pMUXMsg->BindMuxDataPortReq.ep_type = cpu_to_le32(qmap_settings->ep_type);
+    pMUXMsg->BindMuxDataPortReq.iface_id = cpu_to_le32(qmap_settings->iface_id);
+    pMUXMsg->BindMuxDataPortReq.TLV2Type = 0x11;
+    pMUXMsg->BindMuxDataPortReq.TLV2Length = cpu_to_le16(0x01);
+    pMUXMsg->BindMuxDataPortReq.MuxId = qmap_settings->MuxId;
+    pMUXMsg->BindMuxDataPortReq.TLV3Type = 0x13;
+    pMUXMsg->BindMuxDataPortReq.TLV3Length = cpu_to_le16(0x04);
+    pMUXMsg->BindMuxDataPortReq.client_type = cpu_to_le32(1); //WDS_CLIENT_TYPE_TETHERED
+    
+    return sizeof(QMIWDS_BIND_MUX_DATA_PORT_REQ_MSG);
+}
+
+static int qmap_version = 0x05;
+static USHORT WdaSetDataFormat(PQMUX_MSG pMUXMsg, void *arg) {
+    QMAP_SETTING *qmap_settings = (QMAP_SETTING *)arg;
+
+    if (qmap_settings->rx_urb_size == 0) {
+        PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV_QOS pWdsAdminQosTlv;
+        PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV linkProto;
+        PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV dlTlp;
+
+        pWdsAdminQosTlv = (PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV_QOS)(&pMUXMsg->QMUXMsgHdr + 1);
+        pWdsAdminQosTlv->TLVType = 0x10;
+        pWdsAdminQosTlv->TLVLength = cpu_to_le16(0x0001);
+        pWdsAdminQosTlv->QOSSetting = 0; /* no-QOS header */
+
+        linkProto = (PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV)(pWdsAdminQosTlv + 1);
+        linkProto->TLVType = 0x11;
+        linkProto->TLVLength = cpu_to_le16(4);
+        linkProto->Value = cpu_to_le32(0x01);     /* Set Ethernet  mode */
+
+        dlTlp = (PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV)(linkProto + 1);;
+        dlTlp->TLVType = 0x13;
+        dlTlp->TLVLength = cpu_to_le16(4);
+        dlTlp->Value = cpu_to_le32(0x00);
+
+        if (sizeof(*linkProto) != 7 )
+            dbg_time("%s sizeof(*linkProto) = %zu, is not 7!", __func__, sizeof(*linkProto) );
+
+        return sizeof(QCQMUX_MSG_HDR) + sizeof(*pWdsAdminQosTlv) + sizeof(*linkProto) + sizeof(*dlTlp);
+    } 
+    else {
+    //Indicates whether the Quality of Service(QOS) data format is used by the client.
+        pMUXMsg->SetDataFormatReq.QosDataFormatTlv.TLVType = 0x10;
+        pMUXMsg->SetDataFormatReq.QosDataFormatTlv.TLVLength = cpu_to_le16(0x0001);
+        pMUXMsg->SetDataFormatReq.QosDataFormatTlv.QOSSetting = 0; /* no-QOS header */
+		
+    //Underlying Link Layer Protocol
+        pMUXMsg->SetDataFormatReq.UnderlyingLinkLayerProtocolTlv.TLVType = 0x11; 
+        pMUXMsg->SetDataFormatReq.UnderlyingLinkLayerProtocolTlv.TLVLength = cpu_to_le16(4);
+        pMUXMsg->SetDataFormatReq.UnderlyingLinkLayerProtocolTlv.Value = cpu_to_le32(0x02);     /* Set IP  mode */
+
+    //Uplink (UL) data aggregation protocol to be used for uplink data transfer.
+        pMUXMsg->SetDataFormatReq.UplinkDataAggregationProtocolTlv.TLVType = 0x12; 
+        pMUXMsg->SetDataFormatReq.UplinkDataAggregationProtocolTlv.TLVLength = cpu_to_le16(4);
+        pMUXMsg->SetDataFormatReq.UplinkDataAggregationProtocolTlv.Value = cpu_to_le32(qmap_version); //UL QMAP is enabled
+        
+    //Downlink (DL) data aggregation protocol to be used for downlink data transfer
+        pMUXMsg->SetDataFormatReq.DownlinkDataAggregationProtocolTlv.TLVType = 0x13; 
+        pMUXMsg->SetDataFormatReq.DownlinkDataAggregationProtocolTlv.TLVLength = cpu_to_le16(4);
+        pMUXMsg->SetDataFormatReq.DownlinkDataAggregationProtocolTlv.Value = cpu_to_le32(qmap_version); //DL QMAP is enabled
+        
+    //Maximum number of datagrams in a single aggregated packet on downlink
+        pMUXMsg->SetDataFormatReq.DownlinkDataAggregationMaxDatagramsTlv.TLVType = 0x15; 
+        pMUXMsg->SetDataFormatReq.DownlinkDataAggregationMaxDatagramsTlv.TLVLength = cpu_to_le16(4);
+        pMUXMsg->SetDataFormatReq.DownlinkDataAggregationMaxDatagramsTlv.Value = cpu_to_le32(qmap_settings->rx_urb_size/512);
+		
+    //Maximum size in bytes of a single aggregated packet allowed on downlink
+        pMUXMsg->SetDataFormatReq.DownlinkDataAggregationMaxSizeTlv.TLVType = 0x16; 
+        pMUXMsg->SetDataFormatReq.DownlinkDataAggregationMaxSizeTlv.TLVLength = cpu_to_le16(4);
+        pMUXMsg->SetDataFormatReq.DownlinkDataAggregationMaxSizeTlv.Value = cpu_to_le32(qmap_settings->rx_urb_size);
+
+    //Peripheral End Point ID
+        pMUXMsg->SetDataFormatReq.epTlv.TLVType = 0x17; 
+        pMUXMsg->SetDataFormatReq.epTlv.TLVLength = cpu_to_le16(8);
+        pMUXMsg->SetDataFormatReq.epTlv.ep_type = cpu_to_le32(qmap_settings->ep_type);
+        pMUXMsg->SetDataFormatReq.epTlv.iface_id = cpu_to_le32(qmap_settings->iface_id); 
+
+#ifdef QUECTEL_UL_DATA_AGG
+        if (!qmap_settings->ul_data_aggregation_max_datagrams) {
+            return ((size_t)&((QMIWDS_ADMIN_SET_DATA_FORMAT_REQ_MSG *)0)->DlMinimumPassingTlv);
+        }
+        
+     //Maximum number of datagrams in a single aggregated packet on uplink
+        pMUXMsg->SetDataFormatReq.DlMinimumPassingTlv.TLVType = 0x19; 
+        pMUXMsg->SetDataFormatReq.DlMinimumPassingTlv.TLVLength = cpu_to_le16(4);
+        pMUXMsg->SetDataFormatReq.DlMinimumPassingTlv.Value = cpu_to_le32(qmap_settings->dl_minimum_padding);
+		
+     //Maximum number of datagrams in a single aggregated packet on uplink
+        pMUXMsg->SetDataFormatReq.UplinkDataAggregationMaxDatagramsTlv.TLVType = 0x1B; 
+        pMUXMsg->SetDataFormatReq.UplinkDataAggregationMaxDatagramsTlv.TLVLength = cpu_to_le16(4);
+        pMUXMsg->SetDataFormatReq.UplinkDataAggregationMaxDatagramsTlv.Value = cpu_to_le32(qmap_settings->ul_data_aggregation_max_datagrams);
+		
+    //Maximum size in bytes of a single aggregated packet allowed on downlink
+        pMUXMsg->SetDataFormatReq.UplinkDataAggregationMaxSizeTlv.TLVType = 0x1C; 
+        pMUXMsg->SetDataFormatReq.UplinkDataAggregationMaxSizeTlv.TLVLength = cpu_to_le16(4);
+        pMUXMsg->SetDataFormatReq.UplinkDataAggregationMaxSizeTlv.Value = cpu_to_le32(qmap_settings->ul_data_aggregation_max_size);
+#endif
+
+        return sizeof(QMIWDS_ADMIN_SET_DATA_FORMAT_REQ_MSG);
+    }
+}
+
+#ifdef CONFIG_SIM
+static USHORT DmsUIMVerifyPinReqSend(PQMUX_MSG pMUXMsg, void *arg) {
+    pMUXMsg->UIMVerifyPinReq.TLVType = 0x01;
+    pMUXMsg->UIMVerifyPinReq.PINID = 0x01; //Pin1, not Puk
+    pMUXMsg->UIMVerifyPinReq.PINLen = strlen((const char *)arg);
+    qstrcpy((char *)&pMUXMsg->UIMVerifyPinReq.PINValue, ((const char *)arg));
+    pMUXMsg->UIMVerifyPinReq.TLVLength = cpu_to_le16(2 + strlen((const char *)arg));
+    return sizeof(QMIDMS_UIM_VERIFY_PIN_REQ_MSG) + (strlen((const char *)arg) - 1);
+}
+
+static USHORT UimVerifyPinReqSend(PQMUX_MSG pMUXMsg, void *arg)
+{
+    pMUXMsg->UIMUIMVerifyPinReq.TLVType = 0x01;
+    pMUXMsg->UIMUIMVerifyPinReq.TLVLength = cpu_to_le16(0x02);
+    pMUXMsg->UIMUIMVerifyPinReq.Session_Type = 0x00;
+    pMUXMsg->UIMUIMVerifyPinReq.Aid_Len = 0x00;
+    pMUXMsg->UIMUIMVerifyPinReq.TLV2Type = 0x02;
+    pMUXMsg->UIMUIMVerifyPinReq.TLV2Length = cpu_to_le16(2 + strlen((const char *)arg));
+    pMUXMsg->UIMUIMVerifyPinReq.PINID = 0x01;  //Pin1, not Puk
+    pMUXMsg->UIMUIMVerifyPinReq.PINLen= strlen((const char *)arg);
+    qstrcpy((char *)&pMUXMsg->UIMUIMVerifyPinReq.PINValue, ((const char *)arg));
+    return sizeof(QMIUIM_VERIFY_PIN_REQ_MSG) + (strlen((const char *)arg) - 1);
+}
+
+#ifdef CONFIG_IMSI_ICCID
+static USHORT UimReadTransparentIMSIReqSend(PQMUX_MSG pMUXMsg, void *arg) {
+    PREAD_TRANSPARENT_TLV pReadTransparent;
+
+    pMUXMsg->UIMUIMReadTransparentReq.TLVType =  0x01;
+    pMUXMsg->UIMUIMReadTransparentReq.TLVLength = cpu_to_le16(0x02);
+    if (!strcmp((char *)arg, "EF_ICCID")) {
+        pMUXMsg->UIMUIMReadTransparentReq.Session_Type = 0x06;
+        pMUXMsg->UIMUIMReadTransparentReq.Aid_Len = 0x00;
+
+        pMUXMsg->UIMUIMReadTransparentReq.TLV2Type = 0x02;
+        pMUXMsg->UIMUIMReadTransparentReq.file_id = cpu_to_le16(0x2FE2);
+        pMUXMsg->UIMUIMReadTransparentReq.path_len = 0x02;
+        pMUXMsg->UIMUIMReadTransparentReq.path[0] = 0x00;
+        pMUXMsg->UIMUIMReadTransparentReq.path[1] = 0x3F;
+    }
+    else if(!strcmp((char *)arg, "EF_IMSI")) {
+        pMUXMsg->UIMUIMReadTransparentReq.Session_Type = 0x00;
+        pMUXMsg->UIMUIMReadTransparentReq.Aid_Len = 0x00;
+
+        pMUXMsg->UIMUIMReadTransparentReq.TLV2Type = 0x02;
+        pMUXMsg->UIMUIMReadTransparentReq.file_id = cpu_to_le16(0x6F07);
+        pMUXMsg->UIMUIMReadTransparentReq.path_len = 0x04;
+        pMUXMsg->UIMUIMReadTransparentReq.path[0] = 0x00;
+        pMUXMsg->UIMUIMReadTransparentReq.path[1] = 0x3F;
+        pMUXMsg->UIMUIMReadTransparentReq.path[2] = 0xFF;
+        pMUXMsg->UIMUIMReadTransparentReq.path[3] = 0x7F;
+    }
+
+    pMUXMsg->UIMUIMReadTransparentReq.TLV2Length = cpu_to_le16(3 +  pMUXMsg->UIMUIMReadTransparentReq.path_len);
+
+    pReadTransparent = (PREAD_TRANSPARENT_TLV)(&pMUXMsg->UIMUIMReadTransparentReq.path[pMUXMsg->UIMUIMReadTransparentReq.path_len]);
+    pReadTransparent->TLVType = 0x03;
+    pReadTransparent->TLVLength = cpu_to_le16(0x04);
+    pReadTransparent->Offset = cpu_to_le16(0x00);
+    pReadTransparent->Length = cpu_to_le16(0x00);
+
+    return (sizeof(QMIUIM_READ_TRANSPARENT_REQ_MSG) + pMUXMsg->UIMUIMReadTransparentReq.path_len + sizeof(READ_TRANSPARENT_TLV));
+}
+#endif
+#endif
+
+#ifdef CONFIG_APN
+
+static USHORT WdsGetProfileListReqSend(PQMUX_MSG pMUXMsg, void *arg) {
+    (void)(arg);
+    pMUXMsg->GetProfileListReq.Length = cpu_to_le16(sizeof(QMIWDS_GET_PROFILE_LIST_REQ_MSG) - 4);
+    return sizeof(QMIWDS_GET_PROFILE_LIST_REQ_MSG);
+}
+
+static USHORT WdsCreateProfileSettingsReqSend(PQMUX_MSG pMUXMsg, void *arg) {
+    PROFILE_T *profile = (PROFILE_T *)arg;
+    pMUXMsg->CreatetProfileSettingsReq.Length = cpu_to_le16(sizeof(QMIWDS_CREATE_PROFILE_SETTINGS_REQ_MSG) - 4);
+    pMUXMsg->CreatetProfileSettingsReq.TLVType = 0x01;
+    pMUXMsg->CreatetProfileSettingsReq.TLVLength = cpu_to_le16(0x01);
+    pMUXMsg->CreatetProfileSettingsReq.ProfileType = 0x00; // 0 ~ 3GPP, 1 ~ 3GPP2
+    pMUXMsg->CreatetProfileSettingsReq.TLV2Type = 0x25;
+    pMUXMsg->CreatetProfileSettingsReq.TLV2Length = cpu_to_le16(0x01);
+    pMUXMsg->CreatetProfileSettingsReq.pdp_context = profile->pdp; // 0 ~ 3GPP, 1 ~ 3GPP2
+    return sizeof(QMIWDS_CREATE_PROFILE_SETTINGS_REQ_MSG);
+}
+
+static USHORT WdsGetProfileSettingsReqSend(PQMUX_MSG pMUXMsg, void *arg) {
+    PROFILE_T *profile = (PROFILE_T *)arg;
+    pMUXMsg->GetProfileSettingsReq.Length = cpu_to_le16(sizeof(QMIWDS_GET_PROFILE_SETTINGS_REQ_MSG) - 4);
+    pMUXMsg->GetProfileSettingsReq.TLVType = 0x01;
+    pMUXMsg->GetProfileSettingsReq.TLVLength = cpu_to_le16(0x02);
+    pMUXMsg->GetProfileSettingsReq.ProfileType = 0x00; // 0 ~ 3GPP, 1 ~ 3GPP2
+    pMUXMsg->GetProfileSettingsReq.ProfileIndex = profile->profile_index;
+    return sizeof(QMIWDS_GET_PROFILE_SETTINGS_REQ_MSG);
+}
+
+static USHORT WdsModifyProfileSettingsReq(PQMUX_MSG pMUXMsg, void *arg) {
+    USHORT TLVLength = 0;
+    UCHAR *pTLV;
+    PROFILE_T *profile = (PROFILE_T *)arg;
+    PQMIWDS_PDPTYPE pPdpType;
+
+    pMUXMsg->ModifyProfileSettingsReq.Length = cpu_to_le16(sizeof(QMIWDS_MODIFY_PROFILE_SETTINGS_REQ_MSG) - 4);
+    pMUXMsg->ModifyProfileSettingsReq.TLVType = 0x01;
+    pMUXMsg->ModifyProfileSettingsReq.TLVLength = cpu_to_le16(0x02);
+    pMUXMsg->ModifyProfileSettingsReq.ProfileType = 0x00; // 0 ~ 3GPP, 1 ~ 3GPP2
+    pMUXMsg->ModifyProfileSettingsReq.ProfileIndex = profile->profile_index;
+
+    pTLV = (UCHAR *)(&pMUXMsg->ModifyProfileSettingsReq + 1);
+
+    pPdpType = (PQMIWDS_PDPTYPE)(pTLV + TLVLength);
+    pPdpType->TLVType = 0x11;
+    pPdpType->TLVLength = cpu_to_le16(0x01);
+    pPdpType->PdpType = profile->iptype;
+    TLVLength +=(le16_to_cpu(pPdpType->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+
+    // Set APN Name
+    if (profile->apn) {
+        PQMIWDS_APNNAME pApnName = (PQMIWDS_APNNAME)(pTLV + TLVLength);
+        pApnName->TLVType = 0x14;
+        pApnName->TLVLength = cpu_to_le16(strlen(profile->apn));
+        qstrcpy((char *)&pApnName->ApnName, profile->apn);
+        TLVLength +=(le16_to_cpu(pApnName->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+    }
+
+    // Set User Name
+    if (profile->user) {
+        PQMIWDS_USERNAME pUserName = (PQMIWDS_USERNAME)(pTLV + TLVLength);
+        pUserName->TLVType = 0x1B;
+        pUserName->TLVLength = cpu_to_le16(strlen(profile->user));
+        qstrcpy((char *)&pUserName->UserName, profile->user);
+        TLVLength += (le16_to_cpu(pUserName->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+    }
+
+    // Set Password
+    if (profile->pd) {
+        PQMIWDS_PD pPd = (PQMIWDS_PD)(pTLV + TLVLength);
+        pPd->TLVType = 0x1C;
+        pPd->TLVLength = cpu_to_le16(strlen(profile->pd));
+        qstrcpy((char *)&pPd->Pd, profile->pd);
+        TLVLength +=(le16_to_cpu(pPd->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+    }
+
+    // Set Auth Protocol
+    if (profile->user && profile->pd) {
+        PQMIWDS_AUTH_PREFERENCE pAuthPref = (PQMIWDS_AUTH_PREFERENCE)(pTLV + TLVLength);
+        pAuthPref->TLVType = 0x1D;
+        pAuthPref->TLVLength = cpu_to_le16(0x01);
+        pAuthPref->AuthPreference = profile->auth; // 0 ~ None, 1 ~ Pap, 2 ~ Chap, 3 ~ MsChapV2
+        TLVLength += (le16_to_cpu(pAuthPref->TLVLength) + sizeof(QCQMICTL_TLV_HDR));
+    }
+
+    return sizeof(QMIWDS_MODIFY_PROFILE_SETTINGS_REQ_MSG) + TLVLength;
+}
+#endif
+
+static USHORT WdsGetRuntimeSettingReq(PQMUX_MSG pMUXMsg, void *arg)
+{
+    (void)arg;
+    pMUXMsg->GetRuntimeSettingsReq.TLVType = 0x10;
+    pMUXMsg->GetRuntimeSettingsReq.TLVLength = cpu_to_le16(0x04);
+    // the following mask also applies to IPV6
+    pMUXMsg->GetRuntimeSettingsReq.Mask = cpu_to_le32(QMIWDS_GET_RUNTIME_SETTINGS_MASK_IPV4DNS_ADDR |
+                                                      QMIWDS_GET_RUNTIME_SETTINGS_MASK_IPV4_ADDR |
+                                                      QMIWDS_GET_RUNTIME_SETTINGS_MASK_MTU |
+                                                      QMIWDS_GET_RUNTIME_SETTINGS_MASK_IPV4GATEWAY_ADDR) |
+                                          QMIWDS_GET_RUNTIME_SETTINGS_MASK_PCSCF_SV_ADDR |
+                                          QMIWDS_GET_RUNTIME_SETTINGS_MASK_PCSCF_DOM_NAME;
+
+    return sizeof(QMIWDS_GET_RUNTIME_SETTINGS_REQ_MSG);
+}
+
+static PQCQMIMSG s_pRequest;
+static PQCQMIMSG s_pResponse;
+
+static int is_response(const PQCQMIMSG pRequest, const PQCQMIMSG pResponse) {
+    if ((pRequest->QMIHdr.QMIType == pResponse->QMIHdr.QMIType)
+        && (pRequest->QMIHdr.ClientId == pResponse->QMIHdr.ClientId)) {
+            USHORT requestTID, responseTID;
+        if (pRequest->QMIHdr.QMIType == QMUX_TYPE_CTL) {
+            requestTID = pRequest->CTLMsg.QMICTLMsgHdr.TransactionId;
+            responseTID = pResponse->CTLMsg.QMICTLMsgHdr.TransactionId;
+        } else {
+            requestTID = le16_to_cpu(pRequest->MUXMsg.QMUXHdr.TransactionId);
+            responseTID = le16_to_cpu(pResponse->MUXMsg.QMUXHdr.TransactionId);
+        }
+        return (requestTID == responseTID);
+    }
+    return 0;
+}
+
+int (*qmidev_send)(PQCQMIMSG pRequest);
+
+int QmiThreadSendQMITimeout(PQCQMIMSG pRequest, PQCQMIMSG *ppResponse, unsigned msecs, const char *funcname) {
+    int ret;
+    
+    if (!pRequest)
+        return -EINVAL;
+
+    pthread_mutex_lock(&cm_command_mutex);
+
+    if (ppResponse)
+        *ppResponse = NULL;
+
+    dump_qmi(pRequest, le16_to_cpu(pRequest->QMIHdr.Length) + 1);
+
+    s_pRequest = pRequest;
+    s_pResponse = NULL;
+
+    ret = qmidev_send(pRequest);
+    if (ret == 0) {
+        ret = pthread_cond_timeout_np(&cm_command_cond, &cm_command_mutex, msecs);
+        if (!ret) {
+            if (s_pResponse && ppResponse) {
+                *ppResponse = s_pResponse;
+            }
+            else if (s_pResponse) {
+                free(s_pResponse);
+                s_pResponse = NULL;
+            }
+            else {
+                dbg_time("%s message null", funcname);
+                ret = -EINVAL;
+            }
+        } else {
+            dbg_time("%s message timeout", funcname);
+        }
+    }
+
+    pthread_mutex_unlock(&cm_command_mutex);
+
+    return ret;
+}
+
+void QmiThreadRecvQMI(PQCQMIMSG pResponse) {
+    pthread_mutex_lock(&cm_command_mutex);
+    if (pResponse == NULL) {
+        if (s_pRequest) {
+            free(s_pRequest);
+            s_pRequest = NULL;
+            s_pResponse = NULL;
+            pthread_cond_signal(&cm_command_cond);
+        }
+        pthread_mutex_unlock(&cm_command_mutex);
+        return;
+    }
+    dump_qmi(pResponse, le16_to_cpu(pResponse->QMIHdr.Length) + 1);
+    if (s_pRequest && is_response(s_pRequest, pResponse)) {
+        free(s_pRequest);
+        s_pRequest = NULL;
+        s_pResponse = malloc(le16_to_cpu(pResponse->QMIHdr.Length) + 1);
+        if (s_pResponse != NULL) {
+            memcpy(s_pResponse, pResponse, le16_to_cpu(pResponse->QMIHdr.Length) + 1);
+        }
+        pthread_cond_signal(&cm_command_cond);
+    } else if ((pResponse->QMIHdr.QMIType == QMUX_TYPE_CTL)
+                    && (le16_to_cpu(pResponse->CTLMsg.QMICTLMsgHdrRsp.QMICTLType == QMICTL_REVOKE_CLIENT_ID_IND))) {
+        qmidevice_send_event_to_main(MODEM_REPORT_RESET_EVENT);
+    } else if ((pResponse->QMIHdr.QMIType == QMUX_TYPE_NAS)
+                    && (le16_to_cpu(pResponse->MUXMsg.QMUXMsgHdrResp.Type) == QMINAS_SERVING_SYSTEM_IND)) {
+        qmidevice_send_event_to_main(RIL_UNSOL_RESPONSE_VOICE_NETWORK_STATE_CHANGED);
+    } else if ((pResponse->QMIHdr.QMIType == QMUX_TYPE_WDS)
+                    && (le16_to_cpu(pResponse->MUXMsg.QMUXMsgHdrResp.Type) == QMIWDS_GET_PKT_SRVC_STATUS_IND)) {
+        qmidevice_send_event_to_main(RIL_UNSOL_DATA_CALL_LIST_CHANGED);
+    } else if ((pResponse->QMIHdr.QMIType == QMUX_TYPE_NAS)
+                    && (le16_to_cpu(pResponse->MUXMsg.QMUXMsgHdrResp.Type) == QMINAS_SYS_INFO_IND)) {
+        qmidevice_send_event_to_main(RIL_UNSOL_RESPONSE_VOICE_NETWORK_STATE_CHANGED);
+    } else if ((pResponse->QMIHdr.QMIType == QMUX_TYPE_WDS_ADMIN)
+                    && (le16_to_cpu(pResponse->MUXMsg.QMUXMsgHdrResp.Type) == QMI_WDA_SET_LOOPBACK_CONFIG_IND)) {
+    	qmidevice_send_event_to_main_ext(RIL_UNSOL_LOOPBACK_CONFIG_IND,
+            &pResponse->MUXMsg.SetLoopBackInd, sizeof(pResponse->MUXMsg.SetLoopBackInd));
+    }
+#ifdef CONFIG_REG_QOS_IND
+    else if ((pResponse->QMIHdr.QMIType == QMUX_TYPE_QOS)
+          && (le16_to_cpu(pResponse->MUXMsg.QMUXMsgHdrResp.Type) == QMI_QOS_GLOBAL_QOS_FLOW_IND)) {
+        UINT qos_id = 0;
+        UCHAR new_flow = ql_get_global_qos_flow_ind_qos_id(pResponse, &qos_id);
+        if (qos_id != 0 && new_flow == 1)
+            qmidevice_send_event_to_main_ext(RIL_UNSOL_GLOBAL_QOS_FLOW_IND_QOS_ID, &qos_id, sizeof(qos_id));
+#ifdef CONFIG_GET_QOS_DATA_RATE
+        if (new_flow) {
+            ULONG64 max_data_rate[2] = {0};
+            if (ql_get_global_qos_flow_ind_data_rate(pResponse, (void *)max_data_rate) == 0){}
+        }
+#endif
+    }
+#endif
+    else {
+        if (debug_qmi)
+            dbg_time("nobody care this qmi msg!!");
+    }
+    pthread_mutex_unlock(&cm_command_mutex);
+}
+
+#ifdef CONFIG_COEX_WWAN_STATE
+static int requestGetCoexWWANState(void) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    PQMI_COEX_GET_WWAN_STATE_RESP_MSG_LTE_BAND pLteBand;
+    static QMI_COEX_GET_WWAN_STATE_RESP_MSG_LTE_BAND oldLteBand = {-1, -1};
+    int err;
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_COEX, QMI_COEX_GET_WWAN_STATE_REQ, NULL, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+
+    if (err < 0 || pResponse == NULL) {
+        dbg_time("%s err = %d", __func__, err);
+        return err;
+    }
+
+    pMUXMsg = &pResponse->MUXMsg;
+    if (le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXResult) || le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXError)) {
+        dbg_time("%s QMUXResult = 0x%x, QMUXError = 0x%x", __func__, le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXResult), le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXError));
+        err = le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXError);
+        free(pResponse);
+        return err;
+    } 
+    pLteBand = (PQMI_COEX_GET_WWAN_STATE_RESP_MSG_LTE_BAND)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x10);
+
+    if (pLteBand && memcmp(pLteBand, &oldLteBand, sizeof(oldLteBand))) {
+        oldLteBand = *pLteBand;
+        dbg_time("%s ul_freq %d ul_bandwidth %d", __func__, le32_to_cpu(pLteBand->ul_band.freq), le32_to_cpu(pLteBand->ul_band.bandwidth));
+        dbg_time("%s dl_freq %d dl_bandwidth %d", __func__, le32_to_cpu(pLteBand->dl_band.freq), le32_to_cpu(pLteBand->dl_band.bandwidth));
+    }
+    free(pResponse);
+    return 0;
+}
+#endif
+
+static int requestSetEthMode(PROFILE_T *profile) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse = NULL;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV linkProto;
+    UCHAR IpPreference;
+    UCHAR autoconnect_setting = 0;
+    QMAP_SETTING qmap_settings = {0};
+
+    qmap_settings.size = sizeof(qmap_settings);
+    
+    if (profile->qmap_mode) {
+        profile->rawIP = 1;
+        s_9x07 = profile->rawIP;
+        
+        qmap_settings.MuxId = profile->muxid;
+
+        if (profile->hardware_interface == HARDWARE_PCIE) { //SDX20_PCIE
+            qmap_settings.rx_urb_size = profile->qmap_size; //SDX24&SDX55 support 32KB 
+            qmap_settings.ep_type = DATA_EP_TYPE_PCIE;
+            qmap_settings.iface_id = 0x04;
+        }
+        else if (profile->hardware_interface == HARDWARE_IPA) { // for inside sdx
+            qmap_settings.rx_urb_size = profile->qmap_size; //SDX24&SDX55 support 32KB
+            qmap_settings.ep_type = DATA_EP_TYPE_EMBEDDED;
+            qmap_settings.iface_id = 1; //DSI_DEFAULT_EPID_IPA;
+            //skip for netmgrd send QMI_WDA_SET_DATA_FORMAT_REQ_V01 & QMI_DPM_OPEN_PORT_REQ_V01
+            goto skip_WdaSetDataFormat;
+        }
+        else { // for MDM9x07&MDM9x40&SDX20 USB
+            qmap_settings.rx_urb_size = profile->qmap_size; //SDX24&SDX55 support 32KB
+            qmap_settings.ep_type = DATA_EP_TYPE_HSUSB;
+            qmap_settings.iface_id = 0x04;
+            if(profile->usb_dev.idProduct == 0x0316) //X35 Rmnet interface is 3
+                qmap_settings.iface_id = 0x03;
+        }
+
+        qmap_settings.ul_data_aggregation_max_datagrams = 11; //by test result, 11 can get best TPUT
+        qmap_settings.ul_data_aggregation_max_size = 8*1024;
+        qmap_settings.dl_minimum_padding = 0; //no effect when register to real netowrk
+        if(profile->qmap_version != 0x09)
+            profile->qmap_version = 0x05;
+
+        qmap_version = profile->qmap_version;
+        if (profile->rmnet_info.size) {
+            qmap_settings.rx_urb_size = profile->rmnet_info.rx_urb_size;
+            qmap_settings.ep_type = profile->rmnet_info.ep_type;
+            qmap_settings.iface_id = profile->rmnet_info.iface_id;
+            qmap_settings.dl_minimum_padding = profile->rmnet_info.dl_minimum_padding;
+            qmap_version = profile->rmnet_info.qmap_version;
+        }
+
+        if (!profile->wda_client) {
+            if (qmidev_is_gobinet(profile->qmichannel)) {
+                //when QMAP enabled, set data format in GobiNet driver
+            }
+            else if (profile->proxy[0]) {
+                /* the first running 'quectel-cm' had alloc wda client and set data format,
+                   so we can ingore to set data format here. */
+            }
+            goto skip_WdaSetDataFormat;
+        }
+    }
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_WDS_ADMIN, QMIWDS_ADMIN_SET_DATA_FORMAT_REQ, WdaSetDataFormat, (void *)&qmap_settings);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    linkProto = (PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x11);
+    if (linkProto != NULL) {
+        profile->rawIP = (le32_to_cpu(linkProto->Value) == 2);
+        s_9x07 = profile->rawIP; //MDM90x7 only support RAW IP, do not support Eth
+    }
+
+    linkProto = (PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x16);
+    if (linkProto != NULL && profile->qmap_mode) {
+        qmap_settings.rx_urb_size = le32_to_cpu(linkProto->Value);
+        dbg_time("qmap_settings.rx_urb_size = %u", qmap_settings.rx_urb_size); //must same as rx_urb_size defined in GobiNet&qmi_wwan driver
+    }
+
+#ifdef QUECTEL_UL_DATA_AGG
+    if (qmap_settings.ul_data_aggregation_max_datagrams)
+    {
+        linkProto = (PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x17);
+        if (linkProto != NULL) {
+            qmap_settings.ul_data_aggregation_max_datagrams = MIN(qmap_settings.ul_data_aggregation_max_datagrams, le32_to_cpu(linkProto->Value));
+            dbg_time("qmap_settings.ul_data_aggregation_max_datagrams  = %u", qmap_settings.ul_data_aggregation_max_datagrams);
+        }
+
+        linkProto = (PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x18);
+        if (linkProto != NULL) {
+            qmap_settings.ul_data_aggregation_max_size = MIN(qmap_settings.ul_data_aggregation_max_size, le32_to_cpu(linkProto->Value));
+            dbg_time("qmap_settings.ul_data_aggregation_max_size       = %u", qmap_settings.ul_data_aggregation_max_size);
+        }
+
+        linkProto = (PQMIWDS_ADMIN_SET_DATA_FORMAT_TLV)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x1A);
+        if (linkProto != NULL) {
+            qmap_settings.dl_minimum_padding = le32_to_cpu(linkProto->Value);
+            dbg_time("qmap_settings.dl_minimum_padding                 = %u", qmap_settings.dl_minimum_padding);
+        }
+
+	if (qmap_settings.ul_data_aggregation_max_datagrams > 1) {
+		ql_set_driver_qmap_setting(profile, &qmap_settings);
+	}
+    }
+#endif
+
+    free(pResponse);
+
+skip_WdaSetDataFormat:
+    if (profile->enable_ipv4) {
+    	if (profile->qmapnet_adapter[0]) {
+            // bind wds mux data port
+        	pRequest = ComposeQMUXMsg(QMUX_TYPE_WDS, QMIWDS_BIND_MUX_DATA_PORT_REQ , WdsSetQMUXBindMuxDataPort, (void *)&qmap_settings);
+        	err = QmiThreadSendQMI(pRequest, &pResponse);
+        	qmi_rsp_check_and_return();
+        	if (pResponse) free(pResponse);
+        }
+
+        // set ipv4
+    	IpPreference = IpFamilyV4;
+    	pRequest = ComposeQMUXMsg(QMUX_TYPE_WDS, QMIWDS_SET_CLIENT_IP_FAMILY_PREF_REQ, WdsSetClientIPFamilyPref, (void *)&IpPreference);
+    	err = QmiThreadSendQMI(pRequest, &pResponse);
+    	if (pResponse) free(pResponse);
+    }
+
+    if (profile->enable_ipv6) {
+        if (profile->qmapnet_adapter[0]) {
+            // bind wds ipv6 mux data port
+            pRequest = ComposeQMUXMsg(QMUX_TYPE_WDS_IPV6, QMIWDS_BIND_MUX_DATA_PORT_REQ , WdsSetQMUXBindMuxDataPort, (void *)&qmap_settings);
+            err = QmiThreadSendQMI(pRequest, &pResponse);
+            qmi_rsp_check_and_return();
+            if (pResponse) free(pResponse);
+        }
+
+        // set ipv6
+        IpPreference = IpFamilyV6;
+        pRequest = ComposeQMUXMsg(QMUX_TYPE_WDS_IPV6, QMIWDS_SET_CLIENT_IP_FAMILY_PREF_REQ, WdsSetClientIPFamilyPref, (void *)&IpPreference);
+        err = QmiThreadSendQMI(pRequest, &pResponse);
+        qmi_rsp_check_and_return();
+        if (pResponse) free(pResponse);
+    }
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_WDS, QMIWDS_SET_AUTO_CONNECT_REQ , WdsSetAutoConnect, (void *)&autoconnect_setting);
+    QmiThreadSendQMI(pRequest, &pResponse);
+    if (pResponse) free(pResponse);
+
+    return 0;
+}
+
+#ifdef CONFIG_SIM
+static int requestGetPINStatus(SIM_Status *pSIMStatus) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    PQMIDMS_UIM_PIN_STATUS pPin1Status = NULL;
+    //PQMIDMS_UIM_PIN_STATUS pPin2Status = NULL;
+
+    if (s_9x07)
+        pRequest = ComposeQMUXMsg(QMUX_TYPE_UIM, QMIUIM_GET_CARD_STATUS_REQ, NULL, NULL);
+    else
+        pRequest = ComposeQMUXMsg(QMUX_TYPE_DMS, QMIDMS_UIM_GET_PIN_STATUS_REQ, NULL, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    pPin1Status = (PQMIDMS_UIM_PIN_STATUS)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x11);
+    //pPin2Status = (PQMIDMS_UIM_PIN_STATUS)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x12);
+
+    if (pPin1Status != NULL) {
+        if (pPin1Status->PINStatus == QMI_PIN_STATUS_NOT_VERIF) {
+            *pSIMStatus = SIM_PIN;
+        } else if (pPin1Status->PINStatus == QMI_PIN_STATUS_BLOCKED) {
+            *pSIMStatus = SIM_PUK;
+        } else if (pPin1Status->PINStatus == QMI_PIN_STATUS_PERM_BLOCKED) {
+            *pSIMStatus = SIM_BAD;
+        }
+    }
+
+    free(pResponse);
+    return 0;
+}
+
+static int requestGetSIMStatus(SIM_Status *pSIMStatus) { //RIL_REQUEST_GET_SIM_STATUS
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    const char * SIM_Status_String[] = {
+        "SIM_ABSENT",
+        "SIM_NOT_READY",
+        "SIM_READY", /* SIM_READY means the radio state is RADIO_STATE_SIM_READY */
+        "SIM_PIN",
+        "SIM_PUK",
+        "SIM_NETWORK_PERSONALIZATION"
+    };
+
+    if (s_9x07)
+        pRequest = ComposeQMUXMsg(QMUX_TYPE_UIM, QMIUIM_GET_CARD_STATUS_REQ, NULL, NULL);
+    else
+        pRequest = ComposeQMUXMsg(QMUX_TYPE_DMS, QMIDMS_UIM_GET_STATE_REQ, NULL, NULL);
+
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+    *pSIMStatus = SIM_ABSENT;
+    if (s_9x07)
+    {
+        PQMIUIM_CARD_STATUS pCardStatus = NULL;
+        PQMIUIM_PIN_STATE pPINState = NULL;
+        QMIUI_APP_INFO *appinfo = NULL;
+        UCHAR CardState = 0x01;
+        UCHAR PIN1State = QMI_PIN_STATUS_NOT_VERIF;
+        //UCHAR PIN1Retries;
+        //UCHAR PUK1Retries;
+        //UCHAR PIN2State;
+        //UCHAR PIN2Retries;
+        //UCHAR PUK2Retries;
+
+        pCardStatus = (PQMIUIM_CARD_STATUS)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x10);
+
+        if (pCardStatus != NULL)
+        {
+            pPINState = (PQMIUIM_PIN_STATE)((PUCHAR)pCardStatus + sizeof(QMIUIM_CARD_STATUS) + pCardStatus->APP_INFO.AIDLength);
+            for(int app_index = 0; app_index < pCardStatus->NumApp - 1; app_index++)
+            {
+                if (pCardStatus->APP_INFO.AppType != UIM_APP_TYPE_USIM)
+                {
+                    appinfo = (QMIUI_APP_INFO *)((PUCHAR)pPINState + sizeof(QMIUIM_PIN_STATE));
+                    pPINState = (PQMIUIM_PIN_STATE)((PUCHAR)appinfo + sizeof(QMIUI_APP_INFO) + appinfo->AIDLength);
+                }
+            }
+
+            CardState  = pCardStatus->CardState;
+            if (CardState == UIM_CARD_STATE_PRESENT) {
+                if (pPINState->UnivPIN == 1)
+                {
+                   PIN1State = pCardStatus->UPINState;
+                   //PIN1Retries = pCardStatus->UPINRetries;
+                   //PUK1Retries = pCardStatus->UPUKRetries;
+                }
+                else
+                {
+                   PIN1State = pPINState->PIN1State;
+                   //PIN1Retries = pPINState->PIN1Retries;
+                   //PUK1Retries = pPINState->PUK1Retries;
+                }
+                //PIN2State = pPINState->PIN2State;
+                //PIN2Retries = pPINState->PIN2Retries;
+                //PUK2Retries = pPINState->PUK2Retries;
+            }
+        }
+
+        *pSIMStatus = SIM_ABSENT;
+        if ((CardState == 0x01) &&  ((PIN1State == QMI_PIN_STATUS_VERIFIED)|| (PIN1State == QMI_PIN_STATUS_DISABLED)))
+        {
+            *pSIMStatus = SIM_READY;
+        }
+        else if (CardState == 0x01)
+        {
+            if (PIN1State == QMI_PIN_STATUS_NOT_VERIF)
+            {
+                *pSIMStatus = SIM_PIN;
+            }
+            if ( PIN1State == QMI_PIN_STATUS_BLOCKED)
+            {
+                *pSIMStatus = SIM_PUK;
+            }
+            else if (PIN1State == QMI_PIN_STATUS_PERM_BLOCKED)
+            {
+                *pSIMStatus = SIM_BAD;
+            }
+            else if (PIN1State == QMI_PIN_STATUS_NOT_INIT || PIN1State == QMI_PIN_STATUS_VERIFIED || PIN1State == QMI_PIN_STATUS_DISABLED)
+            {
+                *pSIMStatus = SIM_READY;
+            }
+        }
+        else if (CardState == 0x00 || CardState == 0x02)
+        {
+        }
+        else
+        {
+        }
+    }
+    else
+    {
+    //UIM state. Values:
+    // 0x00  UIM initialization completed
+    // 0x01  UIM is locked or the UIM failed
+    // 0x02  UIM is not present
+    // 0x03  Reserved
+    // 0xFF  UIM state is currently
+    //unavailable
+        if (pResponse->MUXMsg.UIMGetStateResp.UIMState == 0x00) {
+            *pSIMStatus = SIM_READY;
+        } else if (pResponse->MUXMsg.UIMGetStateResp.UIMState == 0x01) {
+            *pSIMStatus = SIM_ABSENT;
+            err = requestGetPINStatus(pSIMStatus);
+        } else if ((pResponse->MUXMsg.UIMGetStateResp.UIMState == 0x02) || (pResponse->MUXMsg.UIMGetStateResp.UIMState == 0xFF)) {
+            *pSIMStatus = SIM_ABSENT;
+        } else {
+            *pSIMStatus = SIM_ABSENT;
+        }
+    }
+    dbg_time("%s SIMStatus: %s", __func__, SIM_Status_String[*pSIMStatus]);
+
+    free(pResponse);
+
+    return 0;
+}
+
+static int requestEnterSimPin(const char *pPinCode) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+
+    if (s_9x07)
+        pRequest = ComposeQMUXMsg(QMUX_TYPE_UIM, QMIUIM_VERIFY_PIN_REQ, UimVerifyPinReqSend, (void *)pPinCode);
+    else
+        pRequest = ComposeQMUXMsg(QMUX_TYPE_DMS, QMIDMS_UIM_VERIFY_PIN_REQ, DmsUIMVerifyPinReqSend, (void *)pPinCode);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    free(pResponse);
+    return 0;
+}
+#endif
+
+#ifdef CONFIG_IMSI_ICCID
+static int requestGetICCID(void) { //RIL_REQUEST_GET_IMSI
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    PQMIUIM_CONTENT pUimContent;
+    int err;
+
+    //dbg_time("enter requestGetICCID_2");
+
+    if (s_9x07) {
+        pRequest = ComposeQMUXMsg(QMUX_TYPE_UIM, QMIUIM_READ_TRANSPARENT_REQ, UimReadTransparentIMSIReqSend, (void *)"EF_ICCID");
+        err = QmiThreadSendQMI(pRequest, &pResponse);
+    } else {
+        return 0;
+    }
+    qmi_rsp_check_and_return();
+
+    pUimContent = (PQMIUIM_CONTENT)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x11);
+    if (pUimContent != NULL) {
+        static char DeviceICCID[32] = {'\0'};
+        int i = 0, j = 0;
+
+        for (i = 0, j = 0; i < le16_to_cpu(pUimContent->content_len); ++i) {
+            char charmaps[] = "0123456789ABCDEF";
+
+            DeviceICCID[j++] = charmaps[(pUimContent->content[i] & 0x0F)];
+            DeviceICCID[j++] = charmaps[((pUimContent->content[i] & 0xF0) >> 0x04)];
+        }
+        DeviceICCID[j] = '\0';
+
+        dbg_time("%s DeviceICCID: %s", __func__, DeviceICCID);
+    }
+
+    free(pResponse);
+    return 0;
+}
+
+static int requestGetIMSI(void) { //RIL_REQUEST_GET_IMSI
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    PQMIUIM_CONTENT pUimContent;
+    int err;
+
+    if (s_9x07) {
+        pRequest = ComposeQMUXMsg(QMUX_TYPE_UIM, QMIUIM_READ_TRANSPARENT_REQ, UimReadTransparentIMSIReqSend, (void *)"EF_IMSI");
+        err = QmiThreadSendQMI(pRequest, &pResponse);
+    } else {
+        return 0;
+    }
+    qmi_rsp_check_and_return();
+
+    pUimContent = (PQMIUIM_CONTENT)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x11);
+    if (pUimContent != NULL) {
+        static char DeviceIMSI[32] = {'\0'};
+        int i = 0, j = 0;
+
+        for (i = 0, j = 0; i < le16_to_cpu(pUimContent->content[0]); ++i) {
+            if (i != 0)
+                DeviceIMSI[j++] = (pUimContent->content[i+1] & 0x0F) + '0';
+            DeviceIMSI[j++] = ((pUimContent->content[i+1] & 0xF0) >> 0x04) + '0';
+        }
+        DeviceIMSI[j] = '\0';
+
+        dbg_time("%s DeviceIMSI: %s", __func__, DeviceIMSI);
+    }
+
+    free(pResponse);
+    return 0;
+}
+#endif
+
+#if 1
+static void quectel_convert_cdma_mcc_2_ascii_mcc( USHORT *p_mcc, USHORT mcc )
+{
+  unsigned int d1, d2, d3, buf = mcc + 111;
+
+  if ( mcc == 0x3FF ) // wildcard
+  {
+    *p_mcc = 3;
+  }
+  else
+  {
+    d3 = buf % 10;
+    buf = ( d3 == 0 ) ? (buf-10)/10 : buf/10;
+
+    d2 = buf % 10;
+    buf = ( d2 == 0 ) ? (buf-10)/10 : buf/10;
+
+    d1 = ( buf == 10 ) ? 0 : buf;
+
+//dbg_time("d1:%d, d2:%d,d3:%d",d1,d2,d3);
+    if ( d1<10 && d2<10 && d3<10 )
+    {
+    *p_mcc = d1*100+d2*10+d3;
+#if 0
+      *(p_mcc+0) = '0' + d1;
+      *(p_mcc+1) = '0' + d2;
+      *(p_mcc+2) = '0' + d3;
+#endif
+    }
+    else
+    {
+      //dbg_time( "invalid digits %d %d %d", d1, d2, d3 );
+      *p_mcc = 0;
+    }
+  }
+}
+
+static void quectel_convert_cdma_mnc_2_ascii_mnc( USHORT *p_mnc, USHORT imsi_11_12)
+{
+  unsigned int d1, d2, buf = imsi_11_12 + 11;
+
+  if ( imsi_11_12 == 0x7F ) // wildcard
+  {
+    *p_mnc = 7;
+  }
+  else
+  {
+    d2 = buf % 10;
+    buf = ( d2 == 0 ) ? (buf-10)/10 : buf/10;
+
+    d1 = ( buf == 10 ) ? 0 : buf;
+
+    if ( d1<10 && d2<10 )
+    {
+     *p_mnc = d1*10 + d2;
+    }
+    else
+    {
+      //dbg_time( "invalid digits %d %d", d1, d2, 0 );
+      *p_mnc = 0;
+    }
+  }
+}
+
+static int requestGetHomeNetwork(USHORT *p_mcc, USHORT *p_mnc, USHORT *p_sid, USHORT *p_nid) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    PHOME_NETWORK pHomeNetwork;
+    PHOME_NETWORK_SYSTEMID pHomeNetworkSystemID;
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_NAS, QMINAS_GET_HOME_NETWORK_REQ, NULL, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    pHomeNetwork = (PHOME_NETWORK)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x01);
+    if (pHomeNetwork && p_mcc && p_mnc ) {
+        *p_mcc = le16_to_cpu(pHomeNetwork->MobileCountryCode);
+        *p_mnc = le16_to_cpu(pHomeNetwork->MobileNetworkCode);
+        //dbg_time("%s MobileCountryCode: %d, MobileNetworkCode: %d", __func__, *pMobileCountryCode, *pMobileNetworkCode);
+    }
+
+    pHomeNetworkSystemID = (PHOME_NETWORK_SYSTEMID)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x10);
+    if (pHomeNetworkSystemID && p_sid && p_nid) {
+        *p_sid = le16_to_cpu(pHomeNetworkSystemID->SystemID); //china-hefei: sid 14451
+        *p_nid = le16_to_cpu(pHomeNetworkSystemID->NetworkID);
+        //dbg_time("%s SystemID: %d, NetworkID: %d", __func__, *pSystemID, *pNetworkID);
+    }
+
+    free(pResponse);
+
+    return 0;
+}
+#endif
+
+#if 0
+// Lookup table for carriers known to produce SIMs which incorrectly indicate MNC length.
+static const char * MCCMNC_CODES_HAVING_3DIGITS_MNC[] = {
+    "302370", "302720", "310260",
+    "405025", "405026", "405027", "405028", "405029", "405030", "405031", "405032",
+    "405033", "405034", "405035", "405036", "405037", "405038", "405039", "405040",
+    "405041", "405042", "405043", "405044", "405045", "405046", "405047", "405750",
+    "405751", "405752", "405753", "405754", "405755", "405756", "405799", "405800",
+    "405801", "405802", "405803", "405804", "405805", "405806", "405807", "405808",
+    "405809", "405810", "405811", "405812", "405813", "405814", "405815", "405816",
+    "405817", "405818", "405819", "405820", "405821", "405822", "405823", "405824",
+    "405825", "405826", "405827", "405828", "405829", "405830", "405831", "405832",
+    "405833", "405834", "405835", "405836", "405837", "405838", "405839", "405840",
+    "405841", "405842", "405843", "405844", "405845", "405846", "405847", "405848",
+    "405849", "405850", "405851", "405852", "405853", "405875", "405876", "405877",
+    "405878", "405879", "405880", "405881", "405882", "405883", "405884", "405885",
+    "405886", "405908", "405909", "405910", "405911", "405912", "405913", "405914",
+    "405915", "405916", "405917", "405918", "405919", "405920", "405921", "405922",
+    "405923", "405924", "405925", "405926", "405927", "405928", "405929", "405930",
+    "405931", "405932", "502142", "502143", "502145", "502146", "502147", "502148"
+};
+
+static const char * MCC_CODES_HAVING_3DIGITS_MNC[] = {
+    "302",    //Canada
+    "310",    //United States of America
+    "311",    //United States of America
+    "312",    //United States of America
+    "313",    //United States of America
+    "314",    //United States of America
+    "315",    //United States of America
+    "316",    //United States of America
+    "334",    //Mexico
+    "338",    //Jamaica
+    "342", //Barbados
+    "344",    //Antigua and Barbuda
+    "346",    //Cayman Islands
+    "348",    //British Virgin Islands
+    "365",    //Anguilla
+    "708",    //Honduras (Republic of)
+    "722",    //Argentine Republic
+    "732"    //Colombia (Republic of)
+};
+
+int requestGetIMSI(const char **pp_imsi, USHORT *pMobileCountryCode, USHORT *pMobileNetworkCode) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+
+    if (pp_imsi) *pp_imsi = NULL;
+    if (pMobileCountryCode) *pMobileCountryCode = 0;
+    if (pMobileNetworkCode) *pMobileNetworkCode = 0;
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_DMS, QMIDMS_UIM_GET_IMSI_REQ, NULL, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    if (pMUXMsg->UIMGetIMSIResp.TLV2Type == 0x01 &&  le16_to_cpu(pMUXMsg->UIMGetIMSIResp.TLV2Length) >= 5) {
+        int mnc_len = 2;
+        unsigned i;
+        char tmp[4];
+
+        if (pp_imsi) *pp_imsi = strndup((const char *)(&pMUXMsg->UIMGetIMSIResp.IMSI), le16_to_cpu(pMUXMsg->UIMGetIMSIResp.TLV2Length));
+
+        for (i = 0; i < sizeof(MCCMNC_CODES_HAVING_3DIGITS_MNC)/sizeof(MCCMNC_CODES_HAVING_3DIGITS_MNC[0]); i++) {
+            if (!strncmp((const char *)(&pMUXMsg->UIMGetIMSIResp.IMSI), MCCMNC_CODES_HAVING_3DIGITS_MNC[i], 6)) {
+                mnc_len = 3;
+                break;
+            }
+        }
+        if (mnc_len == 2) {
+            for (i = 0; i < sizeof(MCC_CODES_HAVING_3DIGITS_MNC)/sizeof(MCC_CODES_HAVING_3DIGITS_MNC[0]); i++) {
+                if (!strncmp((const char *)(&pMUXMsg->UIMGetIMSIResp.IMSI), MCC_CODES_HAVING_3DIGITS_MNC[i], 3)) {
+                    mnc_len = 3;
+                    break;
+                }
+            }
+        }
+
+        tmp[0] = (&pMUXMsg->UIMGetIMSIResp.IMSI)[0];
+        tmp[1] = (&pMUXMsg->UIMGetIMSIResp.IMSI)[1];
+        tmp[2] = (&pMUXMsg->UIMGetIMSIResp.IMSI)[2];
+        tmp[3] = 0;
+        if (pMobileCountryCode) *pMobileCountryCode = atoi(tmp);
+        tmp[0] = (&pMUXMsg->UIMGetIMSIResp.IMSI)[3];
+        tmp[1] = (&pMUXMsg->UIMGetIMSIResp.IMSI)[4];
+        tmp[2] = 0;
+        if (mnc_len == 3) {
+            tmp[2] = (&pMUXMsg->UIMGetIMSIResp.IMSI)[6];
+        }
+        if (pMobileNetworkCode) *pMobileNetworkCode = atoi(tmp);
+    }
+
+    free(pResponse);
+
+    return 0;
+}
+#endif
+
+static struct wwan_data_class_str class2str[] = {
+    {WWAN_DATA_CLASS_NONE, "UNKNOWN"},
+    {WWAN_DATA_CLASS_GPRS, "GPRS"},
+    {WWAN_DATA_CLASS_EDGE, "EDGE"},
+    {WWAN_DATA_CLASS_UMTS, "UMTS"},
+    {WWAN_DATA_CLASS_HSDPA, "HSDPA"},
+    {WWAN_DATA_CLASS_HSUPA, "HSUPA"},
+    {WWAN_DATA_CLASS_LTE, "LTE"},
+    {WWAN_DATA_CLASS_5G_NSA, "5G_NSA"},
+    {WWAN_DATA_CLASS_5G_SA, "5G_SA"},
+    {WWAN_DATA_CLASS_1XRTT, "1XRTT"},
+    {WWAN_DATA_CLASS_1XEVDO, "1XEVDO"},
+    {WWAN_DATA_CLASS_1XEVDO_REVA, "1XEVDO_REVA"},
+    {WWAN_DATA_CLASS_1XEVDV, "1XEVDV"},
+    {WWAN_DATA_CLASS_3XRTT, "3XRTT"},
+    {WWAN_DATA_CLASS_1XEVDO_REVB, "1XEVDO_REVB"},
+    {WWAN_DATA_CLASS_UMB, "UMB"},
+    {WWAN_DATA_CLASS_CUSTOM, "CUSTOM"},
+};
+
+static const char *wwan_data_class2str(ULONG class)
+{
+    unsigned int i = 0;
+    for (i = 0; i < sizeof(class2str)/sizeof(class2str[0]); i++) {
+        if (class2str[i].class == class) {
+            return class2str[i].str;
+        }
+    }
+    return "UNKNOWN";
+}
+
+static USHORT char2ushort(UCHAR str[3]) {
+    int i;
+    char temp[4];
+    USHORT ret= 0;
+
+    memcpy(temp, str, 3);
+    temp[3] = '\0';
+
+    for (i = 0; i < 4; i++) {
+        if ((UCHAR)temp[i] == 0xFF) {
+            temp[i] = '\0';
+        }
+    }
+    ret = (USHORT)atoi(temp);
+
+    return ret;
+}
+
+static int requestRegistrationState2(UCHAR *pPSAttachedState) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    USHORT MobileCountryCode = 0;
+    USHORT MobileNetworkCode = 0;
+    const char *pDataCapStr = "UNKNOW";
+    LONG remainingLen;
+    PSERVICE_STATUS_INFO pServiceStatusInfo;
+    int is_lte = 0;
+    PCDMA_SYSTEM_INFO pCdmaSystemInfo;
+    PHDR_SYSTEM_INFO pHdrSystemInfo;
+    PGSM_SYSTEM_INFO pGsmSystemInfo;
+    PWCDMA_SYSTEM_INFO pWcdmaSystemInfo;
+    PLTE_SYSTEM_INFO pLteSystemInfo;
+    PTDSCDMA_SYSTEM_INFO pTdscdmaSystemInfo;
+    PNR5G_SYSTEM_INFO pNr5gSystemInfo;
+    UCHAR DeviceClass = 0;
+    ULONG DataCapList = 0;
+    
+    /*  Additional LTE System Info - Availability of Dual connectivity of E-UTRA with NR5G */
+    uint8_t endc_available_valid = 0;  /**< Must be set to true if endc_available is being passed */
+    uint8_t endc_available = 0x00;
+    /**<  
+       Upper layer indication in LTE SIB2. Values: \n
+       - 0x00 -- 5G Not available \n
+       - 0x01 -- 5G Available
+       
+    */
+    /*  Additional LTE System Info - DCNR restriction Info */
+    uint8_t restrict_dcnr_valid = 0;  /**< Must be set to true if restrict_dcnr is being passed */
+    uint8_t restrict_dcnr = 0x01;
+    /**<  
+       DCNR restriction in NAS attach/TAU accept. Values: \n
+       - 0x00 -- Not restricted \n
+       - 0x01 -- Restricted
+    */
+
+    *pPSAttachedState = 0;
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_NAS, QMINAS_GET_SYS_INFO_REQ, NULL, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    pServiceStatusInfo = (PSERVICE_STATUS_INFO)(((PCHAR)&pMUXMsg->GetSysInfoResp) + QCQMUX_MSG_HDR_SIZE);
+    remainingLen = le16_to_cpu(pMUXMsg->GetSysInfoResp.Length);
+
+    s_is_cdma = 0;
+    s_5g_type = WWAN_DATA_CLASS_NONE;
+    s_hdr_personality = 0;
+    //dbg_time("pServiceStatusInfo->TLVType:%d\n", pServiceStatusInfo->TLVType);
+    //dbg_time("remainingLen:%ld\n", remainingLen);
+    while (remainingLen > 0) {
+        switch (pServiceStatusInfo->TLVType) {
+        case 0x10: // CDMA
+            if (pServiceStatusInfo->SrvStatus == 0x02) {
+                DataCapList = WWAN_DATA_CLASS_1XRTT|
+                              WWAN_DATA_CLASS_1XEVDO|
+                              WWAN_DATA_CLASS_1XEVDO_REVA|
+                              WWAN_DATA_CLASS_1XEVDV|
+                              WWAN_DATA_CLASS_1XEVDO_REVB;
+                DeviceClass = DEVICE_CLASS_CDMA;
+                s_is_cdma = (0 == is_lte);
+            }
+            break;
+        case 0x11: // HDR
+            if (pServiceStatusInfo->SrvStatus == 0x02) {
+                DataCapList = WWAN_DATA_CLASS_3XRTT|
+                              WWAN_DATA_CLASS_UMB;
+                DeviceClass = DEVICE_CLASS_CDMA;
+                s_is_cdma = (0 == is_lte);
+            }
+            break;
+        case 0x12: // GSM
+            if (pServiceStatusInfo->SrvStatus == 0x02) {
+                DataCapList = WWAN_DATA_CLASS_GPRS|
+                              WWAN_DATA_CLASS_EDGE;
+                DeviceClass = DEVICE_CLASS_GSM;
+            }
+            break;
+        case 0x13: // WCDMA
+            if (pServiceStatusInfo->SrvStatus == 0x02) {
+                DataCapList = WWAN_DATA_CLASS_UMTS;
+                DeviceClass = DEVICE_CLASS_GSM;
+            }
+            break;
+        case 0x14: // LTE
+            if (pServiceStatusInfo->SrvStatus == 0x02) {
+                DataCapList = WWAN_DATA_CLASS_LTE;
+                DeviceClass = DEVICE_CLASS_GSM;
+                is_lte = 1;
+                s_is_cdma = 0;
+            }
+            break;
+        case 0x4A: // NR5G Service Status Info
+            if (pServiceStatusInfo->SrvStatus == NAS_SYS_SRV_STATUS_SRV_V01) {
+                DataCapList |= WWAN_DATA_CLASS_5G_SA;
+                DeviceClass = DEVICE_CLASS_GSM;
+                is_lte = 1;
+                s_is_cdma = 0;
+            }
+            break;
+        case 0x4B: // NR5G System Info
+            pNr5gSystemInfo = (PNR5G_SYSTEM_INFO)pServiceStatusInfo;
+            if (pNr5gSystemInfo->srv_domain_valid == 0x01) {
+                if (pNr5gSystemInfo->srv_domain & SYS_SRV_DOMAIN_PS_ONLY_V01) {
+                    *pPSAttachedState = 1;
+                }
+            }
+
+            if (pNr5gSystemInfo->network_id_valid == 0x01) {
+                MobileCountryCode = (USHORT)char2ushort(pNr5gSystemInfo->MCC);
+                MobileNetworkCode = (USHORT)char2ushort(pNr5gSystemInfo->MNC);
+                //dbg_time("%d", __LINE__);
+            }
+            break;
+        case 0x4E: //Additional LTE System Info - Availability of Dual Connectivity of E-UTRA with NR5G
+            endc_available_valid = 1;
+            endc_available = pServiceStatusInfo->SrvStatus;
+            break;
+            
+        case 0x4F: //Additional LTE System Info - DCNR restriction Info
+            restrict_dcnr_valid = 1;
+            restrict_dcnr = pServiceStatusInfo->SrvStatus;
+            break;
+
+        case 0x24: // TDSCDMA
+            if (pServiceStatusInfo->SrvStatus == 0x02) {
+                pDataCapStr = "TD-SCDMA";
+            }
+            break;
+        case 0x15: // CDMA
+            // CDMA_SYSTEM_INFO
+            pCdmaSystemInfo = (PCDMA_SYSTEM_INFO)pServiceStatusInfo;
+            if (pCdmaSystemInfo->SrvDomainValid == 0x01) {
+                if (pCdmaSystemInfo->SrvDomain & 0x02) {
+                    *pPSAttachedState = 1;
+                    s_is_cdma = (0 == is_lte);
+                }
+            }
+#if 0
+            if (pCdmaSystemInfo->SrvCapabilityValid == 0x01) {
+                *pPSAttachedState = 0;
+                if (pCdmaSystemInfo->SrvCapability & 0x02) {
+                    *pPSAttachedState = 1;
+                    s_is_cdma = (0 == is_lte);
+                }
+            }
+#endif
+            if (pCdmaSystemInfo->NetworkIdValid == 0x01) {
+                MobileCountryCode = (USHORT)char2ushort(pCdmaSystemInfo->MCC);
+                MobileNetworkCode = (USHORT)char2ushort(pCdmaSystemInfo->MNC);
+                //dbg_time("%d", __LINE__);
+            }
+            break;
+        case 0x16: // HDR
+            // HDR_SYSTEM_INFO
+            pHdrSystemInfo = (PHDR_SYSTEM_INFO)pServiceStatusInfo;
+            if (pHdrSystemInfo->SrvDomainValid == 0x01) {
+                if (pHdrSystemInfo->SrvDomain & 0x02) {
+                    *pPSAttachedState = 1;
+                    s_is_cdma = (0 == is_lte);
+                }
+            }
+#if 0
+            if (pHdrSystemInfo->SrvCapabilityValid == 0x01) {
+                *pPSAttachedState = 0;
+                if (pHdrSystemInfo->SrvCapability & 0x02) {
+                    *pPSAttachedState = 1;
+                    s_is_cdma = (0 == is_lte);
+                }
+            }
+#endif
+            if (*pPSAttachedState && pHdrSystemInfo->HdrPersonalityValid == 0x01) {
+                if (pHdrSystemInfo->HdrPersonality == 0x03)
+                    s_hdr_personality = 0x02;
+                //else if (pHdrSystemInfo->HdrPersonality == 0x02)
+                //    s_hdr_personality = 0x01;
+            }
+            USHORT cmda_mcc = 0, cdma_mnc = 0;
+            if(!requestGetHomeNetwork(&cmda_mcc, &cdma_mnc,NULL, NULL) && cmda_mcc) {
+                quectel_convert_cdma_mcc_2_ascii_mcc(&MobileCountryCode, cmda_mcc);
+                quectel_convert_cdma_mnc_2_ascii_mnc(&MobileNetworkCode, cdma_mnc);
+                //dbg_time("%d", __LINE__);
+            }
+            break;
+        case 0x17: // GSM
+            // GSM_SYSTEM_INFO
+            pGsmSystemInfo = (PGSM_SYSTEM_INFO)pServiceStatusInfo;
+            if (pGsmSystemInfo->SrvDomainValid == 0x01) {
+                if (pGsmSystemInfo->SrvDomain & 0x02) {
+                    *pPSAttachedState = 1;
+                }
+            }
+#if 0
+            if (pGsmSystemInfo->SrvCapabilityValid == 0x01) {
+                *pPSAttachedState = 0;
+                if (pGsmSystemInfo->SrvCapability & 0x02) {
+                    *pPSAttachedState = 1;
+                }
+            }
+#endif
+            if (pGsmSystemInfo->NetworkIdValid == 0x01) {
+                MobileCountryCode = (USHORT)char2ushort(pGsmSystemInfo->MCC);
+                MobileNetworkCode = (USHORT)char2ushort(pGsmSystemInfo->MNC);
+                //dbg_time("%d", __LINE__);
+            }
+            break;
+        case 0x18: // WCDMA
+            // WCDMA_SYSTEM_INFO
+            pWcdmaSystemInfo = (PWCDMA_SYSTEM_INFO)pServiceStatusInfo;
+            if (pWcdmaSystemInfo->SrvDomainValid == 0x01) {
+                if (pWcdmaSystemInfo->SrvDomain & 0x02) {
+                    *pPSAttachedState = 1;
+                }
+            }
+#if 0
+            if (pWcdmaSystemInfo->SrvCapabilityValid == 0x01) {
+                *pPSAttachedState = 0;
+                if (pWcdmaSystemInfo->SrvCapability & 0x02) {
+                    *pPSAttachedState = 1;
+                }
+            }
+#endif
+            if (pWcdmaSystemInfo->NetworkIdValid == 0x01) {
+                MobileCountryCode = (USHORT)char2ushort(pWcdmaSystemInfo->MCC);
+                MobileNetworkCode = (USHORT)char2ushort(pWcdmaSystemInfo->MNC);
+                //dbg_time("%d", __LINE__);
+            }
+            break;
+        case 0x19: // LTE_SYSTEM_INFO
+            // LTE_SYSTEM_INFO
+            pLteSystemInfo = (PLTE_SYSTEM_INFO)pServiceStatusInfo;
+            if (pLteSystemInfo->SrvDomainValid == 0x01) {
+                if (pLteSystemInfo->SrvDomain & 0x02) {
+                    *pPSAttachedState = 1;
+                    is_lte = 1;
+                    s_is_cdma = 0;
+                }
+            }
+#if 0
+            if (pLteSystemInfo->SrvCapabilityValid == 0x01) {
+                *pPSAttachedState = 0;
+                if (pLteSystemInfo->SrvCapability & 0x02) {
+                    *pPSAttachedState = 1;
+                    is_lte = 1;
+                    s_is_cdma = 0;
+                }
+            }
+#endif
+            if (pLteSystemInfo->NetworkIdValid == 0x01) {
+                MobileCountryCode = (USHORT)char2ushort(pLteSystemInfo->MCC);
+                MobileNetworkCode = (USHORT)char2ushort(pLteSystemInfo->MNC);
+                //dbg_time("%d", __LINE__);
+            }
+            break;
+        case 0x25: // TDSCDMA
+            // TDSCDMA_SYSTEM_INFO
+            pTdscdmaSystemInfo = (PTDSCDMA_SYSTEM_INFO)pServiceStatusInfo;
+            if (pTdscdmaSystemInfo->SrvDomainValid == 0x01) {
+                if (pTdscdmaSystemInfo->SrvDomain & 0x02) {
+                    *pPSAttachedState = 1;
+                }
+            }
+#if 0
+            if (pTdscdmaSystemInfo->SrvCapabilityValid == 0x01) {
+                *pPSAttachedState = 0;
+                if (pTdscdmaSystemInfo->SrvCapability & 0x02) {
+                    *pPSAttachedState = 1;
+                }
+            }
+#endif
+            if (pTdscdmaSystemInfo->NetworkIdValid == 0x01) {
+                MobileCountryCode = (USHORT)char2ushort(pTdscdmaSystemInfo->MCC);
+                MobileNetworkCode = (USHORT)char2ushort(pTdscdmaSystemInfo->MNC);
+                //dbg_time("%d", __LINE__);
+            }
+            break;
+        default:
+            break;
+        } /* switch (pServiceStatusInfo->TLYType) */
+
+        remainingLen -= (le16_to_cpu(pServiceStatusInfo->TLVLength) + 3);
+        pServiceStatusInfo = (PSERVICE_STATUS_INFO)((PCHAR)&pServiceStatusInfo->TLVLength + le16_to_cpu(pServiceStatusInfo->TLVLength) + sizeof(USHORT));
+    } /* while (remainingLen > 0) */
+
+    if (DataCapList & WWAN_DATA_CLASS_LTE) {
+        if (endc_available_valid && restrict_dcnr_valid) {
+            if (endc_available && !restrict_dcnr) {
+                DataCapList |= WWAN_DATA_CLASS_5G_NSA;
+            }
+        }
+    }
+
+    if (DeviceClass == DEVICE_CLASS_CDMA) {
+        if (s_hdr_personality == 2) {
+            pDataCapStr = s_hdr_personality == 2 ? "eHRPD" : "HRPD";
+        } else if (DataCapList & WWAN_DATA_CLASS_1XEVDO_REVB) {
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_1XEVDO_REVB);
+        } else if (DataCapList & WWAN_DATA_CLASS_1XEVDO_REVA) {
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_1XEVDO_REVA);
+        } else if (DataCapList & WWAN_DATA_CLASS_1XEVDO) {
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_1XEVDO);
+        } else if (DataCapList & WWAN_DATA_CLASS_1XRTT) {
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_1XRTT);
+        } else if (DataCapList & WWAN_DATA_CLASS_3XRTT) {
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_3XRTT);
+        } else if (DataCapList & WWAN_DATA_CLASS_UMB) {
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_UMB);
+        }
+    } else {
+        if (DataCapList & WWAN_DATA_CLASS_5G_SA) {
+            s_5g_type = WWAN_DATA_CLASS_5G_SA;
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_5G_SA);
+        } else if (DataCapList & WWAN_DATA_CLASS_5G_NSA) {
+            s_5g_type = WWAN_DATA_CLASS_5G_NSA;
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_5G_NSA);
+        } else if (DataCapList & WWAN_DATA_CLASS_LTE) {
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_LTE);
+        } else if ((DataCapList & WWAN_DATA_CLASS_HSDPA) && (DataCapList & WWAN_DATA_CLASS_HSUPA)) {
+            pDataCapStr = "HSDPA_HSUPA";
+        } else if (DataCapList & WWAN_DATA_CLASS_HSDPA) {
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_HSDPA);
+        } else if (DataCapList & WWAN_DATA_CLASS_HSUPA) {
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_HSUPA);
+        } else if (DataCapList & WWAN_DATA_CLASS_UMTS) {
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_UMTS);
+        } else if (DataCapList & WWAN_DATA_CLASS_EDGE) {
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_EDGE);
+        } else if (DataCapList & WWAN_DATA_CLASS_GPRS) {
+            pDataCapStr = wwan_data_class2str(WWAN_DATA_CLASS_GPRS);
+        }
+    }
+
+    dbg_time("%s MCC: %d, MNC: %d, PS: %s, DataCap: %s", __func__,
+        MobileCountryCode, MobileNetworkCode, (*pPSAttachedState == 1) ? "Attached" : "Detached" , pDataCapStr);
+
+    free(pResponse);
+
+    return 0;
+}
+
+static int requestRegistrationState(UCHAR *pPSAttachedState) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    PQMINAS_CURRENT_PLMN_MSG pCurrentPlmn;
+    PSERVING_SYSTEM pServingSystem;
+    PQMINAS_DATA_CAP pDataCap;
+    USHORT MobileCountryCode = 0;
+    USHORT MobileNetworkCode = 0;
+    const char *pDataCapStr = "UNKNOW";
+
+    if (s_9x07) {
+        return requestRegistrationState2(pPSAttachedState);
+    }
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_NAS, QMINAS_GET_SERVING_SYSTEM_REQ, NULL, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    pCurrentPlmn = (PQMINAS_CURRENT_PLMN_MSG)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x12);
+    if (pCurrentPlmn) {
+        MobileCountryCode = le16_to_cpu(pCurrentPlmn->MobileCountryCode);
+        MobileNetworkCode = le16_to_cpu(pCurrentPlmn->MobileNetworkCode);
+    }
+
+    *pPSAttachedState = 0;
+    pServingSystem = (PSERVING_SYSTEM)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x01);
+    if (pServingSystem) {
+    //Packet-switched domain attach state of the mobile.
+    //0x00    PS_UNKNOWN ?Unknown or not applicable
+    //0x01    PS_ATTACHED ?Attached
+    //0x02    PS_DETACHED ?Detached
+        *pPSAttachedState = pServingSystem->RegistrationState;
+        if (pServingSystem->RegistrationState == 0x01) //0x01 ?C REGISTERED ?C Registered with a network
+            *pPSAttachedState  = pServingSystem->PSAttachedState;
+        else {
+            //MobileCountryCode = MobileNetworkCode = 0;
+            *pPSAttachedState  = 0x02;
+        }
+    }
+
+    pDataCap = (PQMINAS_DATA_CAP)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x11);
+    if (pDataCap && pDataCap->DataCapListLen) {
+        UCHAR *DataCap = &pDataCap->DataCap;
+        if (pDataCap->DataCapListLen == 2) {
+            if ((DataCap[0] == 0x06) && ((DataCap[1] == 0x08) || (DataCap[1] == 0x0A)))
+                DataCap[0] = DataCap[1];
+        }
+        switch (DataCap[0]) {
+             case 0x01: pDataCapStr = "GPRS"; break;
+             case 0x02: pDataCapStr = "EDGE"; break;
+             case 0x03: pDataCapStr = "HSDPA"; break;
+             case 0x04: pDataCapStr = "HSUPA"; break;
+             case 0x05: pDataCapStr = "UMTS"; break;
+             case 0x06: pDataCapStr = "1XRTT"; break;
+             case 0x07: pDataCapStr = "1XEVDO"; break;
+             case 0x08: pDataCapStr = "1XEVDO_REVA"; break;
+             case 0x09: pDataCapStr = "GPRS"; break;
+             case 0x0A: pDataCapStr = "1XEVDO_REVB"; break;
+             case 0x0B: pDataCapStr = "LTE"; break;
+             case 0x0C: pDataCapStr = "HSDPA"; break;
+             case 0x0D: pDataCapStr = "HSDPA"; break;
+             default: pDataCapStr = "UNKNOW"; break;
+        }
+    }
+
+    if (pServingSystem && pServingSystem->RegistrationState == 0x01 && pServingSystem->InUseRadioIF && pServingSystem->RadioIF == 0x09) {
+        pDataCapStr = "TD-SCDMA";
+    }
+
+    s_is_cdma = 0;
+    if (pServingSystem && pServingSystem->RegistrationState == 0x01 && pServingSystem->InUseRadioIF && (pServingSystem->RadioIF == 0x01 || pServingSystem->RadioIF == 0x02)) {
+        USHORT cmda_mcc = 0, cdma_mnc = 0;
+        s_is_cdma = 1;
+        if(!requestGetHomeNetwork(&cmda_mcc, &cdma_mnc,NULL, NULL) && cmda_mcc) {
+            quectel_convert_cdma_mcc_2_ascii_mcc(&MobileCountryCode, cmda_mcc);
+            quectel_convert_cdma_mnc_2_ascii_mnc(&MobileNetworkCode, cdma_mnc);
+        }
+        if (1) {
+            PQCQMUX_TLV pTLV = (PQCQMUX_TLV)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x23);
+            if (pTLV)
+                s_hdr_personality = pTLV->Value;
+            else
+                s_hdr_personality = 0;
+            if (s_hdr_personality == 2)
+                pDataCapStr = "eHRPD";
+        }
+    }
+
+    dbg_time("%s MCC: %d, MNC: %d, PS: %s, DataCap: %s", __func__,
+        MobileCountryCode, MobileNetworkCode, (*pPSAttachedState == 1) ? "Attached" : "Detached" , pDataCapStr);
+
+    free(pResponse);
+
+    return 0;
+}
+
+static int requestQueryDataCall(UCHAR  *pConnectionStatus, int curIpFamily) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    PQMIWDS_PKT_SRVC_TLV pPktSrvc;
+    UCHAR oldConnectionStatus = *pConnectionStatus;
+    UCHAR QMIType = (curIpFamily == IpFamilyV4) ? QMUX_TYPE_WDS : QMUX_TYPE_WDS_IPV6;
+
+    pRequest = ComposeQMUXMsg(QMIType, QMIWDS_GET_PKT_SRVC_STATUS_REQ, NULL, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    *pConnectionStatus = QWDS_PKT_DATA_DISCONNECTED;
+    pPktSrvc = (PQMIWDS_PKT_SRVC_TLV)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x01);
+    if (pPktSrvc) {
+        *pConnectionStatus = pPktSrvc->ConnectionStatus;
+        if ((le16_to_cpu(pPktSrvc->TLVLength) == 2) && (pPktSrvc->ReconfigReqd == 0x01))
+            *pConnectionStatus = QWDS_PKT_DATA_DISCONNECTED;
+    }
+
+    if (*pConnectionStatus == QWDS_PKT_DATA_DISCONNECTED) {
+        if (curIpFamily == IpFamilyV4)
+            WdsConnectionIPv4Handle = 0;
+        else
+            WdsConnectionIPv6Handle = 0;
+    }
+
+    if (oldConnectionStatus != *pConnectionStatus || debug_qmi) {
+        dbg_time("%s %sConnectionStatus: %s", __func__, (curIpFamily == IpFamilyV4) ? "IPv4" : "IPv6",
+            (*pConnectionStatus == QWDS_PKT_DATA_CONNECTED) ? "CONNECTED" : "DISCONNECTED");
+    }
+
+    free(pResponse);
+    return 0;
+}
+
+static int requestSetupDataCall(PROFILE_T *profile, int curIpFamily) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err = 0;
+    UCHAR QMIType = (curIpFamily == IpFamilyV4) ? QMUX_TYPE_WDS : QMUX_TYPE_WDS_IPV6;
+
+//DualIPSupported means can get ipv4 & ipv6 address at the same time, one wds for ipv4, the other wds for ipv6
+    profile->curIpFamily = curIpFamily;
+    pRequest = ComposeQMUXMsg(QMIType, QMIWDS_START_NETWORK_INTERFACE_REQ, WdsStartNwInterfaceReq, profile);
+    err = QmiThreadSendQMITimeout(pRequest, &pResponse, 120 * 1000, __func__);
+    qmi_rsp_check();
+
+    if (le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXResult) || le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXError)) {
+        PQMI_TLV_HDR pTLVHdr;
+
+        pTLVHdr = GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x10);
+        if (pTLVHdr) {
+            uint16_t *data16 = (uint16_t *)(pTLVHdr+1);
+            uint16_t call_end_reason = le16_to_cpu(data16[0]);
+            dbg_time("call_end_reason is %d", call_end_reason);
+        }
+
+        pTLVHdr = GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x11);
+        if (pTLVHdr) {
+            uint16_t *data16 = (uint16_t *)(pTLVHdr+1);
+            uint16_t call_end_reason_type = le16_to_cpu(data16[0]);
+            uint16_t verbose_call_end_reason  = le16_to_cpu(data16[1]);
+
+            dbg_time("call_end_reason_type is %d", call_end_reason_type);
+            dbg_time("call_end_reason_verbose is %d", verbose_call_end_reason);
+        }
+
+        err = le16_to_cpu(pMUXMsg->QMUXMsgHdrResp.QMUXError);
+        free(pResponse);
+        return err;
+    }
+
+    if (curIpFamily == IpFamilyV4) {
+        WdsConnectionIPv4Handle = le32_to_cpu(pResponse->MUXMsg.StartNwInterfaceResp.Handle);
+        dbg_time("%s WdsConnectionIPv4Handle: 0x%08x", __func__, WdsConnectionIPv4Handle);
+    } else {
+        WdsConnectionIPv6Handle = le32_to_cpu(pResponse->MUXMsg.StartNwInterfaceResp.Handle);
+        dbg_time("%s WdsConnectionIPv6Handle: 0x%08x", __func__, WdsConnectionIPv6Handle);
+    }
+
+    free(pResponse);
+
+    return 0;
+}
+
+static int requestDeactivateDefaultPDP(PROFILE_T *profile, int curIpFamily) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    UCHAR QMIType = (curIpFamily == 0x04) ? QMUX_TYPE_WDS : QMUX_TYPE_WDS_IPV6;
+
+    (void)profile;
+    if (curIpFamily == IpFamilyV4 && WdsConnectionIPv4Handle == 0)
+        return 0;
+    if (curIpFamily == IpFamilyV6 && WdsConnectionIPv6Handle == 0)
+        return 0;
+
+    dbg_time("%s WdsConnectionIPv%dHandle", __func__, curIpFamily == IpFamilyV4 ? 4 : 6);
+
+    pRequest = ComposeQMUXMsg(QMIType, QMIWDS_STOP_NETWORK_INTERFACE_REQ , WdsStopNwInterfaceReq, &curIpFamily);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    if (curIpFamily == IpFamilyV4)
+        WdsConnectionIPv4Handle = 0;
+    else
+         WdsConnectionIPv6Handle = 0;
+    free(pResponse);
+    return 0;
+}
+
+static int requestGetIPAddress(PROFILE_T *profile, int curIpFamily) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV4_ADDR pIpv4Addr;
+    PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV6_ADDR pIpv6Addr = NULL;
+    PQMIWDS_GET_RUNTIME_SETTINGS_TLV_MTU pMtu;
+    IPV4_T *pIpv4 = &profile->ipv4;
+    IPV6_T *pIpv6 = &profile->ipv6;
+    UCHAR QMIType = (curIpFamily == 0x04) ? QMUX_TYPE_WDS : QMUX_TYPE_WDS_IPV6;
+    PQMIWDS_GET_RUNNING_SETTINGS_PCSCF_IPV6_ADDR pPCSCFIpv6Addr;
+	PQMIWDS_GET_RUNNING_SETTINGS_PCSCF_IPV4_ADDR pPCSCFIpv4Addr;
+
+    if (curIpFamily == IpFamilyV4) {
+        memset(pIpv4, 0x00, sizeof(IPV4_T));
+        if (WdsConnectionIPv4Handle == 0)
+            return 0;
+    } else if (curIpFamily == IpFamilyV6) {
+        memset(pIpv6, 0x00, sizeof(IPV6_T));
+        if (WdsConnectionIPv6Handle == 0)
+            return 0;
+    }
+
+    pRequest = ComposeQMUXMsg(QMIType, QMIWDS_GET_RUNTIME_SETTINGS_REQ, WdsGetRuntimeSettingReq, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+	pPCSCFIpv6Addr = (PQMIWDS_GET_RUNNING_SETTINGS_PCSCF_IPV6_ADDR)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x2e);    // 0x2e - pcscf ipv6 address 
+	if (pPCSCFIpv6Addr) {
+    	if (pPCSCFIpv6Addr->PCSCFNumber == 1) {
+        	UCHAR *PCSCFIpv6Addr1 = (UCHAR *)(pPCSCFIpv6Addr + 1);
+        	memcpy(profile->PCSCFIpv6Addr1, PCSCFIpv6Addr1, 16);
+        }else if (pPCSCFIpv6Addr->PCSCFNumber == 2) {
+        	UCHAR *PCSCFIpv6Addr1 = (UCHAR *)(pPCSCFIpv6Addr + 1);
+        	UCHAR *PCSCFIpv6Addr2 = PCSCFIpv6Addr1 + 16;
+        	memcpy(profile->PCSCFIpv6Addr1, PCSCFIpv6Addr1, 16);
+        	memcpy(profile->PCSCFIpv6Addr2, PCSCFIpv6Addr2, 16);
+        }
+    }
+    
+	pPCSCFIpv4Addr = (PQMIWDS_GET_RUNNING_SETTINGS_PCSCF_IPV4_ADDR)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x23);    // 0x23 - pcscf ipv4 address 
+	if (pPCSCFIpv4Addr) {
+    	if (pPCSCFIpv4Addr->PCSCFNumber == 1) {
+        	UCHAR *PCSCFIpv4Addr1 = (UCHAR *)(pPCSCFIpv4Addr + 1);
+        	memcpy(&profile->PCSCFIpv4Addr1, PCSCFIpv4Addr1, 4);
+        }else if (pPCSCFIpv4Addr->PCSCFNumber == 2) {
+        	UCHAR *PCSCFIpv4Addr1 = (UCHAR *)(pPCSCFIpv4Addr + 1);
+        	UCHAR *PCSCFIpv4Addr2 = PCSCFIpv4Addr1 + 4;
+        	memcpy(&profile->PCSCFIpv4Addr1, PCSCFIpv4Addr1, 4);
+        	memcpy(&profile->PCSCFIpv4Addr2, PCSCFIpv4Addr2, 4);
+        }
+    }
+
+    pIpv4Addr = (PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV4_ADDR)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV4PRIMARYDNS);
+    if (pIpv4Addr) {
+        pIpv4->DnsPrimary = pIpv4Addr->IPV4Address;
+    }
+
+    pIpv4Addr = (PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV4_ADDR)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV4SECONDARYDNS);
+    if (pIpv4Addr) {
+        pIpv4->DnsSecondary = pIpv4Addr->IPV4Address;
+    }
+
+    pIpv4Addr = (PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV4_ADDR)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV4GATEWAY);
+    if (pIpv4Addr) {
+        pIpv4->Gateway = pIpv4Addr->IPV4Address;
+    }
+
+    pIpv4Addr = (PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV4_ADDR)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV4SUBNET);
+    if (pIpv4Addr) {
+        pIpv4->SubnetMask = pIpv4Addr->IPV4Address;
+    }
+
+    pIpv4Addr = (PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV4_ADDR)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV4);
+    if (pIpv4Addr) {
+        pIpv4->Address = pIpv4Addr->IPV4Address;
+    }
+
+    pIpv6Addr = (PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV6_ADDR)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV6PRIMARYDNS);
+    if (pIpv6Addr) {
+        memcpy(pIpv6->DnsPrimary, pIpv6Addr->IPV6Address, 16);
+    }
+
+    pIpv6Addr = (PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV6_ADDR)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV6SECONDARYDNS);
+    if (pIpv6Addr) {
+        memcpy(pIpv6->DnsSecondary, pIpv6Addr->IPV6Address, 16);
+    }
+
+    pIpv6Addr = (PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV6_ADDR)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV6GATEWAY);
+    if (pIpv6Addr) {
+        memcpy(pIpv6->Gateway, pIpv6Addr->IPV6Address, 16);
+        pIpv6->PrefixLengthGateway = pIpv6Addr->PrefixLength;
+    }
+
+    pIpv6Addr = (PQMIWDS_GET_RUNTIME_SETTINGS_TLV_IPV6_ADDR)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_IPV6);
+    if (pIpv6Addr) {
+        memcpy(pIpv6->Address, pIpv6Addr->IPV6Address, 16);
+        pIpv6->PrefixLengthIPAddr = pIpv6Addr->PrefixLength;
+    }
+
+    pMtu = (PQMIWDS_GET_RUNTIME_SETTINGS_TLV_MTU)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, QMIWDS_GET_RUNTIME_SETTINGS_TLV_TYPE_MTU);
+    if (pMtu) {
+        if (curIpFamily == IpFamilyV4)
+            pIpv4->Mtu =  le32_to_cpu(pMtu->Mtu);
+        else
+            pIpv6->Mtu =  le32_to_cpu(pMtu->Mtu);
+    }
+
+    free(pResponse);
+    return 0;
+}
+
+#ifdef CONFIG_APN
+static int requestSetProfile(PROFILE_T *profile) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    const char *new_apn = profile->apn ? profile->apn : "";
+    const char *new_user = profile->user ? profile->user : "";
+    const char *new_pd = profile->pd ? profile->pd : "";
+    const char *ipStr[] = {"IPV4", "NULL", "IPV6", "IPV4V6"};
+
+    dbg_time("%s[pdp:%d index:%d] %s/%s/%s/%d/%s", __func__, profile->pdp, profile->profile_index, profile->apn, profile->user, profile->pd, profile->auth,ipStr[profile->iptype]);
+    if (!profile->profile_index)
+        return -1;
+
+    if ( !strcmp(profile->old_apn, new_apn) && !strcmp(profile->old_user, new_user)
+        && !strcmp(profile->old_pd, new_pd)
+        && profile->old_iptype == profile->iptype
+        && profile->old_auth == profile->auth)
+    {
+        dbg_time("no need to set skip the rest");
+        return 0;
+    }
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_WDS, QMIWDS_MODIFY_PROFILE_SETTINGS_REQ, WdsModifyProfileSettingsReq, profile);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    free(pResponse);
+    return 1;
+}
+
+static int requestGetProfile(PROFILE_T *profile) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    PQMIWDS_APNNAME pApnName;
+    PQMIWDS_USERNAME pUserName;
+    PQMIWDS_PD pPd;
+    PQMIWDS_AUTH_PREFERENCE pAuthPref;
+    PQMIWDS_IPTYPE pIpType;
+    PQMIWDS_PDPCONTEXT pPdpContext;
+    PQMIWDS_PROFILELIST pProfileList;
+    
+    const char *ipStr[] = {"IPV4", "NULL", "IPV6", "IPV4V6"};
+
+    profile->old_apn[0] = profile->old_user[0] = profile->old_pd[0] = '\0';
+    profile->old_auth = 0;
+    profile->old_iptype = 0;
+    if (profile->enable_ipv4 && profile->enable_ipv6)
+        profile->iptype = 3;
+    else if (profile->enable_ipv6)
+        profile->iptype = 2;
+    else
+        profile->iptype = 0;
+
+    if (!profile->pdp)
+        return 0;
+
+_re_check:
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_WDS, QMIWDS_GET_PROFILE_LIST_REQ, WdsGetProfileListReqSend, profile);
+    err = QmiThreadSendQMI(pRequest, &pResponse);s_pResponse = malloc(le16_to_cpu(pResponse->QMIHdr.Length) + 1);
+    qmi_rsp_check_and_return();
+    
+    pProfileList = (PQMIWDS_PROFILELIST)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x01);
+    uint8 profile_indexs[42] = {0};
+    uint8 profile_num = pProfileList->ProfileList[0];
+    uint8 i;
+    if(profile_num >= 1)
+    {
+        uint8 j = 0;
+        uint8 k = 2;
+        for(i=0; i<profile_num; i++)
+        {
+            profile_indexs[j++] = pProfileList->ProfileList[k];
+            if(pProfileList->ProfileList[++k] == 0)
+                k+=2;
+            else
+                k+=2+pProfileList->ProfileList[k];
+        }
+    }
+    free(pResponse);
+    
+    for(i=0; i<profile_num; i++)
+    {
+        profile->profile_index = profile_indexs[i];
+        
+        pRequest = ComposeQMUXMsg(QMUX_TYPE_WDS, QMIWDS_GET_PROFILE_SETTINGS_REQ, WdsGetProfileSettingsReqSend, profile);
+        err = QmiThreadSendQMI(pRequest, &pResponse);
+        qmi_rsp_check_and_return();
+        
+        pPdpContext = (PQMIWDS_PDPCONTEXT)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x25);
+        if(pPdpContext->pdp_context == profile->pdp)
+            break;
+        else
+            free(pResponse);
+
+        if(i == profile_num-1)
+        {
+            pRequest = ComposeQMUXMsg(QMUX_TYPE_WDS, QMIWDS_CREATE_PROFILE_REQ, WdsCreateProfileSettingsReqSend, profile);
+            err = QmiThreadSendQMI(pRequest, &pResponse);
+            qmi_rsp_check_and_return();
+            free(pResponse);
+            goto _re_check;
+        }
+    }
+    
+
+    pApnName = (PQMIWDS_APNNAME)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x14);
+    pUserName = (PQMIWDS_USERNAME)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x1B);
+    pPd = (PQMIWDS_PD)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x1C);
+    pAuthPref = (PQMIWDS_AUTH_PREFERENCE)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x1D);
+    pIpType = (PQMIWDS_IPTYPE)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x11);
+
+    if (pApnName/* && le16_to_cpu(pApnName->TLVLength)*/)
+        uchar2char(profile->old_apn, sizeof(profile->old_apn), &pApnName->ApnName, le16_to_cpu(pApnName->TLVLength));
+    if (pUserName/*  && pUserName->UserName*/)
+        uchar2char(profile->old_user, sizeof(profile->old_user), &pUserName->UserName, le16_to_cpu(pUserName->TLVLength));
+    if (pPd/*  && le16_to_cpu(pPd->TLVLength)*/)
+        uchar2char(profile->old_pd, sizeof(profile->old_pd), &pPd->Pd, le16_to_cpu(pPd->TLVLength));
+    if (pAuthPref/*  && le16_to_cpu(pAuthPref->TLVLength)*/) {
+        profile->old_auth = pAuthPref->AuthPreference;
+    }
+    if (pIpType) {
+        profile->old_iptype = pIpType->IPType;
+    }
+
+    dbg_time("%s[pdp:%d index:%d] %s/%s/%s/%d/%s", __func__, profile->pdp, profile->profile_index, profile->old_apn, profile->old_user, profile->old_pd, profile->old_auth, ipStr[profile->old_iptype]);
+
+    free(pResponse);
+    return 0;
+}
+#endif
+
+#ifdef CONFIG_SIGNALINFO
+static int requestGetSignalInfo(void)
+{
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_NAS, QMINAS_GET_SIG_INFO_REQ, NULL, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    
+    // CDMA
+    {
+        PQMINAS_SIG_INFO_CDMA_TLV_MSG ptlv = (PQMINAS_SIG_INFO_CDMA_TLV_MSG)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x10);
+        if (ptlv && ptlv->TLVLength)
+        {
+            dbg_time("%s CDMA: RSSI %d dBm, ECIO %.1lf dBm", __func__,
+                ptlv->rssi, (-0.5) * (double)ptlv->ecio);
+        }
+    }
+
+    // HDR
+    {
+        PQMINAS_SIG_INFO_HDR_TLV_MSG ptlv = (PQMINAS_SIG_INFO_HDR_TLV_MSG)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x11);
+        if (ptlv && ptlv->TLVLength)
+        {
+            dbg_time("%s HDR: RSSI %d dBm, ECIO %.1lf dBm, IO %d dBm", __func__,
+                ptlv->rssi, (-0.5) * (double)ptlv->ecio, ptlv->io);
+        }
+    }
+
+    // GSM
+    {
+        PQMINAS_SIG_INFO_GSM_TLV_MSG ptlv = (PQMINAS_SIG_INFO_GSM_TLV_MSG)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x12);
+        if (ptlv && ptlv->TLVLength)
+        {
+            dbg_time("%s GSM: RSSI %d dBm", __func__, ptlv->rssi);
+        }
+    }
+
+    // WCDMA
+    {
+        PQMINAS_SIG_INFO_WCDMA_TLV_MSG ptlv = (PQMINAS_SIG_INFO_WCDMA_TLV_MSG)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x13);
+        if (ptlv && ptlv->TLVLength)
+        {
+            dbg_time("%s WCDMA: RSSI %d dBm, ECIO %.1lf dBm", __func__,
+                ptlv->rssi, (-0.5) * (double)ptlv->ecio);
+        }
+    }
+
+    // LTE
+    {
+        PQMINAS_SIG_INFO_LTE_TLV_MSG ptlv = (PQMINAS_SIG_INFO_LTE_TLV_MSG)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x14);
+        if (ptlv && ptlv->TLVLength)
+        {
+            dbg_time("%s LTE: RSSI %d dBm, RSRQ %d dB, RSRP %d dBm, SNR %.1lf dB", __func__,
+                ptlv->rssi, ptlv->rsrq, ptlv->rsrp, (0.1) * (double)ptlv->snr);
+        }
+    }
+
+    // TDSCDMA
+    {
+        PQMINAS_SIG_INFO_TDSCDMA_TLV_MSG ptlv = (PQMINAS_SIG_INFO_TDSCDMA_TLV_MSG)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x15);
+        if (ptlv && ptlv->TLVLength)
+        {
+            dbg_time("%s LTE: RSCP %d dBm", __func__, ptlv->rscp);
+        }
+    }
+
+    // 5G_NSA
+    if (s_5g_type == WWAN_DATA_CLASS_5G_NSA)
+    {
+        PQMINAS_SIG_INFO_5G_NSA_TLV_MSG ptlv = (PQMINAS_SIG_INFO_5G_NSA_TLV_MSG)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x17);
+        if (ptlv && ptlv->TLVLength)
+        {
+            dbg_time("%s 5G_NSA: RSRP %d dBm, SNR %.1lf dB", __func__, ptlv->rsrp, (0.1) * (double)ptlv->snr);
+        }
+    }
+
+    // 5G_SA
+    if (s_5g_type == WWAN_DATA_CLASS_5G_SA)
+    {
+        PQMINAS_SIG_INFO_5G_SA_TLV_MSG ptlv = (PQMINAS_SIG_INFO_5G_SA_TLV_MSG)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x18);
+        if (ptlv && ptlv->TLVLength)
+        {
+            dbg_time("%s 5G_SA: NR5G_RSRQ %d dB", __func__, ptlv->nr5g_rsrq);
+        }
+    }
+
+    free(pResponse);
+    return 0;
+}
+#endif
+
+#ifdef CONFIG_VERSION
+static int requestBaseBandVersion(PROFILE_T *profile) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    PDEVICE_REV_ID revId;
+    int err;
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_DMS, QMIDMS_GET_DEVICE_REV_ID_REQ, NULL, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    revId = (PDEVICE_REV_ID)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x01);
+
+    if (revId && le16_to_cpu(revId->TLVLength))
+    {
+        uchar2char(profile->BaseBandVersion, sizeof(profile->BaseBandVersion), &revId->RevisionID, le16_to_cpu(revId->TLVLength));
+        dbg_time("%s %s", __func__, profile->BaseBandVersion);
+    }
+
+    free(pResponse);
+    return 0;
+}
+#endif
+
+static USHORT DmsSetOperatingModeReq(PQMUX_MSG pMUXMsg, void *arg) {
+    pMUXMsg->SetOperatingModeReq.TLVType = 0x01;
+    pMUXMsg->SetOperatingModeReq.TLVLength = cpu_to_le16(1);
+    pMUXMsg->SetOperatingModeReq.OperatingMode = *((UCHAR *)arg);
+
+    return sizeof(QMIDMS_SET_OPERATING_MODE_REQ_MSG);
+}
+
+static USHORT UimSetCardSlotReq(PQMUX_MSG pMUXMsg, void *arg) {
+    pMUXMsg->UIMSetCardSlotReq.TLVType = 0x01;
+    pMUXMsg->UIMSetCardSlotReq.TLVLength = cpu_to_le16(1);
+    pMUXMsg->UIMSetCardSlotReq.slot = *((UCHAR *)arg);
+
+    return sizeof(QMIUIM_SET_CARD_SLOT_REQ_MSG);
+}
+
+static int requestRadioPower(int state) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    UCHAR OperatingMode = (!!state) ? DMS_OP_MODE_ONLINE : DMS_OP_MODE_LOW_POWER;
+    USHORT SimOp = (!!state) ? QMIUIM_POWER_UP : QMIUIM_POWER_DOWN;
+    UCHAR cardSlot = 0x01;
+
+    dbg_time("%s(%d)", __func__, state);
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_DMS, QMIDMS_SET_OPERATING_MODE_REQ, DmsSetOperatingModeReq, &OperatingMode);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+    free(pResponse);
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_UIM, SimOp, UimSetCardSlotReq, &cardSlot);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+    free(pResponse);
+
+    return 0;
+}
+
+static USHORT WdaSetLoopBackReq(PQMUX_MSG pMUXMsg, void *arg) {
+    (void)arg;
+	pMUXMsg->SetLoopBackReq.loopback_state.TLVType  = 0x01;
+	pMUXMsg->SetLoopBackReq.loopback_state.TLVLength = cpu_to_le16(1);
+
+	pMUXMsg->SetLoopBackReq.replication_factor.TLVType	= 0x10;
+	pMUXMsg->SetLoopBackReq.replication_factor.TLVLength = cpu_to_le16(4);
+
+	return sizeof(QMI_WDA_SET_LOOPBACK_CONFIG_REQ_MSG);
+}
+
+static int requestSetLoopBackState(UCHAR loopback_state, ULONG replication_factor) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+
+    dbg_time("%s(loopback_state=%d, replication_factor=%u)", __func__, loopback_state, replication_factor);
+    
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_WDS_ADMIN, QMI_WDA_SET_LOOPBACK_CONFIG_REQ, WdaSetLoopBackReq, NULL);
+    pRequest->MUXMsg.SetLoopBackReq.loopback_state.TLVVaule = loopback_state;
+    pRequest->MUXMsg.SetLoopBackReq.replication_factor.TLVVaule = cpu_to_le16(replication_factor);
+
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    free(pResponse);
+    return 0;
+}
+
+#ifdef CONFIG_ENABLE_QOS
+static USHORT QosSetBindMuxDataPort(PQMUX_MSG pMUXMsg, void *arg) {
+    PROFILE_T *profile = (PROFILE_T *)arg;
+    pMUXMsg->QosBindDataPortReq.EpIdTlv.TLVType = 0x10;
+    pMUXMsg->QosBindDataPortReq.EpIdTlv.TLVLength = cpu_to_le16(8);
+    pMUXMsg->QosBindDataPortReq.EpIdTlv.ep_type = cpu_to_le32(profile->rmnet_info.ep_type);
+    pMUXMsg->QosBindDataPortReq.EpIdTlv.iface_id = cpu_to_le32(profile->rmnet_info.iface_id);
+    pMUXMsg->QosBindDataPortReq.MuxIdTlv.TLVType = 0x11;
+    pMUXMsg->QosBindDataPortReq.MuxIdTlv.TLVLength = cpu_to_le16(1);
+    pMUXMsg->QosBindDataPortReq.MuxIdTlv.mux_id = profile->muxid;
+    return sizeof(QMI_QOS_BIND_DATA_PORT_REQ_MSG);
+}
+
+#ifdef CONFIG_REG_QOS_IND
+static USHORT QosIndRegReq(PQMUX_MSG pMUXMsg, void *arg) {
+    pMUXMsg->QosIndRegReq.ReportGlobalQosFlowTlv.TLVType = 0x10;
+    pMUXMsg->QosIndRegReq.ReportGlobalQosFlowTlv.TLVLength = cpu_to_le16(1);
+    pMUXMsg->QosIndRegReq.ReportGlobalQosFlowTlv.report_global_qos_flows = 1;
+    return sizeof(QMI_QOS_INDICATION_REGISTER_REQ_MSG);
+}
+#endif
+
+static int requestRegisterQos(PROFILE_T *profile) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse = NULL;
+    PQMUX_MSG pMUXMsg;
+    int err;
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_QOS, QMI_QOS_BIND_DATA_PORT_REQ , QosSetBindMuxDataPort, (void *)profile);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    dbg_time("%s QosSetBindMuxDataPort", __func__);
+    qmi_rsp_check_and_return();
+    if (pResponse) free(pResponse);
+	
+#ifdef CONFIG_REG_QOS_IND
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_QOS, QMI_QOS_INDICATION_REGISTER_REQ , QosIndRegReq, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    dbg_time("%s QosIndRegReq", __func__);
+    qmi_rsp_check_and_return();
+    if (pResponse) free(pResponse);
+#endif
+    return 0;
+}
+
+#ifdef CONFIG_GET_QOS_INFO
+UCHAR ql_get_qos_info_data_rate(PQCQMIMSG pResponse, void *max_data_rate)
+{
+    PQMI_QOS_GET_QOS_INFO_TLV_GRANTED_FLOW qos_tx_granted_flow = NULL;
+    PQMI_QOS_GET_QOS_INFO_TLV_GRANTED_FLOW qos_rx_granted_flow = NULL;
+    qos_tx_granted_flow = (PQMI_QOS_GET_QOS_INFO_TLV_GRANTED_FLOW)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x11);
+    if(qos_tx_granted_flow != NULL)
+    {
+        *(ULONG64 *)(max_data_rate) = le64_to_cpu(qos_tx_granted_flow->data_rate_max);
+        dbg_time("GET_QOS_INFO: tx_data_rate_max=%llu", *(ULONG64 *)(max_data_rate+0));
+    }
+    else
+        dbg_time("GET_QOS_INFO: No qos_tx_granted_flow");
+    qos_rx_granted_flow = (PQMI_QOS_GET_QOS_INFO_TLV_GRANTED_FLOW)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x12);
+    if(qos_rx_granted_flow != NULL)
+    {
+        *(ULONG64 *)(max_data_rate+sizeof(ULONG64)) = le64_to_cpu(qos_rx_granted_flow->data_rate_max);
+        dbg_time("GET_QOS_INFO: rx_data_rate_max=%llu", *(ULONG64 *)(max_data_rate+sizeof(ULONG64)));
+    }
+    else
+        dbg_time("GET_QOS_INFO: No qos_rx_granted_flow");
+    if(qos_tx_granted_flow != NULL || qos_rx_granted_flow != NULL)
+        return 0;
+    else
+        return 1;
+}
+
+static USHORT QosGetQosInfoReq(PQMUX_MSG pMUXMsg, void *arg) {
+    PROFILE_T *profile = (PROFILE_T *)arg;
+    pMUXMsg->QosGetQosInfoReq.QosIdTlv.TLVType = 0x01;
+    pMUXMsg->QosGetQosInfoReq.QosIdTlv.TLVLength = cpu_to_le16(4);
+    pMUXMsg->QosGetQosInfoReq.QosIdTlv.qos_id = cpu_to_le32(profile->qos_id);
+    return sizeof(QMI_QOS_GET_QOS_INFO_REQ_MSG);
+}
+
+static int requestGetQosInfo(PROFILE_T *profile) {
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse = NULL;
+    PQMUX_MSG pMUXMsg;
+    int err;
+
+    if(profile->qos_id == 0)
+    {
+        dbg_time("%s request not send: invalid qos_id", __func__);
+        return 0;
+    }
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_QOS, QMI_QOS_GET_QOS_INFO_REQ , QosGetQosInfoReq, (void *)profile);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+    if (pResponse)
+    {
+#ifdef CONFIG_GET_QOS_DATA_RATE
+        ULONG64 max_data_rate[2] = {0};
+        if(ql_get_qos_info_data_rate(pResponse, (void *)max_data_rate) == 0){}
+#endif
+        free(pResponse);
+    }
+    return 0;
+}
+#endif //#ifdef CONFIG_GET_QOS_INFO
+
+#ifdef CONFIG_REG_QOS_IND
+UCHAR ql_get_global_qos_flow_ind_qos_id(PQCQMIMSG pResponse, UINT *qos_id)
+{
+    PQMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_STATE qos_flow_state = NULL;
+    qos_flow_state = (PQMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_STATE)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x01);
+    if(qos_flow_state != NULL)
+    {
+        if(le32_to_cpu(qos_flow_state->state_change) == QOS_IND_FLOW_STATE_ACTIVATED && qos_flow_state->new_flow == 1)
+        {
+            *qos_id = le32_to_cpu(qos_flow_state->qos_id);
+            dbg_time("QMI_QOS_GLOBAL_QOS_FLOW_IND: qos_id=%u state=QOS_IND_FLOW_STATE_ACTIVATED", *qos_id);
+        }
+        return (qos_flow_state->new_flow);
+    }
+    return (0);
+}
+
+#ifdef CONFIG_GET_QOS_DATA_RATE
+UCHAR ql_get_global_qos_flow_ind_data_rate(PQCQMIMSG pResponse, void *max_data_rate)
+{
+    PQMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_GRANTED qos_tx_flow_granted = NULL;
+    PQMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_GRANTED qos_rx_flow_granted = NULL;
+    qos_tx_flow_granted = (PQMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_GRANTED)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x10);
+    if(qos_tx_flow_granted != NULL)
+    {
+        *(ULONG64 *)(max_data_rate) = le64_to_cpu(qos_tx_flow_granted->data_rate_max);
+        dbg_time("QMI_QOS_GLOBAL_QOS_FLOW_IND: tx_data_rate_max=%llu", *(ULONG64 *)(max_data_rate+0));
+    }
+    else
+    dbg_time("QMI_QOS_GLOBAL_QOS_FLOW_IND: No qos_tx_flow_granted");
+    qos_rx_flow_granted = (PQMI_QOS_GLOBAL_QOS_FLOW_TLV_FLOW_GRANTED)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x11);
+    if(qos_rx_flow_granted != NULL)
+    {
+        *(ULONG64 *)(max_data_rate+sizeof(ULONG64)) = le64_to_cpu(qos_rx_flow_granted->data_rate_max);
+        dbg_time("QMI_QOS_GLOBAL_QOS_FLOW_IND: rx_data_rate_max=%llu", *(ULONG64 *)(max_data_rate+sizeof(ULONG64)));
+    }
+    else
+        dbg_time("QMI_QOS_GLOBAL_QOS_FLOW_IND: No qos_rx_flow_granted");
+    if(qos_tx_flow_granted != NULL || qos_rx_flow_granted != NULL)
+        return 0;
+    else
+        return 1;
+}
+#endif
+#endif //#ifdef CONFIG_REG_QOS_IND
+#endif //#ifdef CONFIG_ENABLE_QOS
+
+#ifdef CONFIG_CELLINFO
+/*
+    at+qeng="servingcell" and at+qeng="neighbourcell"
+    https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/blob/master/src/qmicli/qmicli-nas.c
+*/
+static int nas_get_cell_location_info(void);
+static int nas_get_rf_band_information(void);
+
+static int requestGetCellInfoList(void) {
+    dbg_time("%s", __func__);
+    nas_get_cell_location_info();
+    nas_get_rf_band_information();
+    return 0;
+}
+#endif
+
+const struct request_ops qmi_request_ops = {
+#ifdef CONFIG_VERSION
+    .requestBaseBandVersion = requestBaseBandVersion,
+#endif
+    .requestSetEthMode = requestSetEthMode,
+#ifdef CONFIG_SIM
+    .requestGetSIMStatus = requestGetSIMStatus,
+    .requestEnterSimPin = requestEnterSimPin,
+#endif
+#ifdef CONFIG_IMSI_ICCID
+    .requestGetICCID = requestGetICCID,
+    .requestGetIMSI = requestGetIMSI,
+#endif
+#ifdef CONFIG_APN
+    .requestSetProfile = requestSetProfile,
+    .requestGetProfile = requestGetProfile,
+#endif
+    .requestRegistrationState = requestRegistrationState,
+    .requestSetupDataCall = requestSetupDataCall,
+    .requestQueryDataCall = requestQueryDataCall,
+    .requestDeactivateDefaultPDP = requestDeactivateDefaultPDP,
+    .requestGetIPAddress = requestGetIPAddress,
+#ifdef CONFIG_SIGNALINFO
+    .requestGetSignalInfo = requestGetSignalInfo,
+#endif
+#ifdef CONFIG_CELLINFO
+    .requestGetCellInfoList = requestGetCellInfoList,
+#endif
+    .requestSetLoopBackState = requestSetLoopBackState,
+    .requestRadioPower = requestRadioPower,
+#ifdef CONFIG_ENABLE_QOS
+    .requestRegisterQos = requestRegisterQos,
+#endif
+#ifdef CONFIG_GET_QOS_INFO
+    .requestGetQosInfo = requestGetQosInfo,
+#endif
+#ifdef CONFIG_COEX_WWAN_STATE
+    .requestGetCoexWWANState = requestGetCoexWWANState,
+#endif
+};
+
+#ifdef CONFIG_CELLINFO
+static char *str_from_bcd_plmn (uint8 plmn[3])
+{
+    const char bcd_chars[] = "0123456789*#abc\0\0";
+    static char str[12];
+    int i;
+    int j = 0;
+
+    for (i = 0; i < 3; i++) {
+        str[j] = bcd_chars[plmn[i]&0xF];
+        if (str[j]) j++;
+        str[j] = bcd_chars[plmn[i]>>4];
+        if (str[j]) j++;
+    }
+
+    str[j++] = 0;
+
+    return str;
+}
+
+typedef struct {
+    UINT type;
+    const char *name;
+} ENUM_NAME_T;
+
+#define enum_name(type) {type, #type}
+#define N_ELEMENTS(arr)		(sizeof (arr) / sizeof ((arr)[0]))
+
+static const ENUM_NAME_T QMI_NAS_ACTIVE_BAND_NAME[] = {
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_0),                  
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_1),                  
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_2),                  
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_3),                  
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_4),                  
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_5),                  
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_6),                  
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_7),                  
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_8),                  
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_9),                  
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_10),                 
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_11),                 
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_12),                 
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_13),                 
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_14),                 
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_15),                 
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_16),                 
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_17),                 
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_18),                 
+    enum_name(QMI_NAS_ACTIVE_BAND_BC_19),                 
+    enum_name(QMI_NAS_ACTIVE_BAND_GSM_450),               
+    enum_name(QMI_NAS_ACTIVE_BAND_GSM_480),               
+    enum_name(QMI_NAS_ACTIVE_BAND_GSM_750),               
+    enum_name(QMI_NAS_ACTIVE_BAND_GSM_850),               
+    enum_name(QMI_NAS_ACTIVE_BAND_GSM_900_EXTENDED),      
+    enum_name(QMI_NAS_ACTIVE_BAND_GSM_900_PRIMARY),       
+    enum_name(QMI_NAS_ACTIVE_BAND_GSM_900_RAILWAYS),      
+    enum_name(QMI_NAS_ACTIVE_BAND_GSM_DCS_1800),          
+    enum_name(QMI_NAS_ACTIVE_BAND_GSM_PCS_1900),          
+    enum_name(QMI_NAS_ACTIVE_BAND_WCDMA_2100),            
+    enum_name(QMI_NAS_ACTIVE_BAND_WCDMA_PCS_1900),        
+    enum_name(QMI_NAS_ACTIVE_BAND_WCDMA_DCS_1800),        
+    enum_name(QMI_NAS_ACTIVE_BAND_WCDMA_1700_US),         
+    enum_name(QMI_NAS_ACTIVE_BAND_WCDMA_850),             
+    enum_name(QMI_NAS_ACTIVE_BAND_WCDMA_800),             
+    enum_name(QMI_NAS_ACTIVE_BAND_WCDMA_2600),            
+    enum_name(QMI_NAS_ACTIVE_BAND_WCDMA_900),             
+    enum_name(QMI_NAS_ACTIVE_BAND_WCDMA_1700_JAPAN),      
+    enum_name(QMI_NAS_ACTIVE_BAND_WCDMA_1500_JAPAN),      
+    enum_name(QMI_NAS_ACTIVE_BAND_WCDMA_850_JAPAN),       
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_1),              
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_2),              
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_3),              
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_4),              
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_5),              
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_6),              
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_7),              
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_8),              
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_9),              
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_10),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_11),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_12),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_13),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_14),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_17),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_18),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_19),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_20),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_21),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_23),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_24),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_25),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_26),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_27),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_28),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_29),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_30),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_31),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_32),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_33),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_34),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_35),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_36),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_37),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_38),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_39),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_40),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_41),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_42),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_43),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_46),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_47),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_48),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_66),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_71),             
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_125),            
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_126),            
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_127),            
+    enum_name(QMI_NAS_ACTIVE_BAND_EUTRAN_250),            
+    enum_name(QMI_NAS_ACTIVE_BAND_TDSCDMA_A),             
+    enum_name(QMI_NAS_ACTIVE_BAND_TDSCDMA_B),             
+    enum_name(QMI_NAS_ACTIVE_BAND_TDSCDMA_C),             
+    enum_name(QMI_NAS_ACTIVE_BAND_TDSCDMA_D),             
+    enum_name(QMI_NAS_ACTIVE_BAND_TDSCDMA_E),             
+    enum_name(QMI_NAS_ACTIVE_BAND_TDSCDMA_F),             
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_1 ),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_2 ),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_3 ),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_5 ),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_7 ),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_8 ),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_20),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_28),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_38),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_41),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_50),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_51),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_66),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_70),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_71),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_74),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_75),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_76),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_77),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_78),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_79),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_80),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_81),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_82),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_83),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_84),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_85),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_257),         
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_258),         
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_259),         
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_260),         
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_261),         
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_12),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_25),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_34),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_39),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_40),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_65),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_86),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_48),          
+    enum_name(QMI_NAS_ACTIVE_BAND_NR5G_BAND_14),          
+};
+
+static const char *qmi_nas_radio_interface_get_string(uint8 radio_if)
+{
+    const char *str = NULL;
+
+    switch (radio_if) {
+        case QMI_NAS_RADIO_INTERFACE_CDMA_1X: str = "cdma-1x"; break;
+        case QMI_NAS_RADIO_INTERFACE_CDMA_1XEVDO: str = "cdma-1xevdo"; break;
+        case QMI_NAS_RADIO_INTERFACE_AMPS: str = "amps"; break;
+        case QMI_NAS_RADIO_INTERFACE_GSM: str = "gsm"; break;
+        case QMI_NAS_RADIO_INTERFACE_UMTS: str = "umts"; break;
+        case QMI_NAS_RADIO_INTERFACE_LTE: str = "lte"; break;
+        case QMI_NAS_RADIO_INTERFACE_TD_SCDMA: str = "td-scdma"; break;
+        case QMI_NAS_RADIO_INTERFACE_5GNR: str = "5gnr"; break;
+        default: str = NULL; break;
+    }
+
+    return str ?  str : "unknown";
+}
+
+static const char *qmi_nas_active_band_get_string(uint32 active_band)
+{
+    size_t i;
+
+    for (i = 0; i < N_ELEMENTS(QMI_NAS_ACTIVE_BAND_NAME); i++) {
+        if (active_band == QMI_NAS_ACTIVE_BAND_NAME[i].type)
+            return QMI_NAS_ACTIVE_BAND_NAME[i].name + strlen("QMI_NAS_ACTIVE_BAND_");
+    }
+
+    return "unknown";
+}
+
+typedef struct {
+    uint16      min;
+    uint16      max;
+    const char *name;
+} EarfcnRange;
+
+/* http://niviuk.free.fr/lte_band.php */
+static const EarfcnRange earfcn_ranges[] = {
+    {     0,   599, "E-UTRA band 1: 2100"           },
+    {   600,  1199, "E-UTRA band 2: 1900 PCS"       },
+    {  1200,  1949, "E-UTRA band 3: 1800+"          },
+    {  1950,  2399, "E-UTRA band 4: AWS-1"          },
+    {  2400,  2649, "E-UTRA band 5: 850"            },
+    {  2650,  2749, "E-UTRA band 6: UMTS only"      },
+    {  2750,  3449, "E-UTRA band 7: 2600"           },
+    {  3450,  3799, "E-UTRA band 8: 900"            },
+    {  3800,  4149, "E-UTRA band 9: 1800"           },
+    {  4150,  4749, "E-UTRA band 10: AWS-1+"        },
+    {  4750,  4999, "E-UTRA band 11: 1500 Lower"    },
+    {  5000,  5179, "E-UTRA band 12: 700 a"         },
+    {  5180,  5279, "E-UTRA band 13: 700 c"         },
+    {  5280,  5379, "E-UTRA band 14: 700 PS"        },
+    {  5730,  5849, "E-UTRA band 17: 700 b"         },
+    {  5850,  5999, "E-UTRA band 18: 800 Lower"     },
+    {  6000,  6149, "E-UTRA band 19: 800 Upper"     },
+    {  6150,  6449, "E-UTRA band 20: 800 DD"        },
+    {  6450,  6599, "E-UTRA band 21: 1500 Upper"    },
+    {  6600,  7399, "E-UTRA band 22: 3500"          },
+    {  7500,  7699, "E-UTRA band 23: 2000 S-band"   },
+    {  7700,  8039, "E-UTRA band 24: 1600 L-band"   },
+    {  8040,  8689, "E-UTRA band 25: 1900+"         },
+    {  8690,  9039, "E-UTRA band 26: 850+"          },
+    {  9040,  9209, "E-UTRA band 27: 800 SMR"       },
+    {  9210,  9659, "E-UTRA band 28: 700 APT"       },
+    {  9660,  9769, "E-UTRA band 29: 700 d"         },
+    {  9770,  9869, "E-UTRA band 30: 2300 WCS"      },
+    {  9870,  9919, "E-UTRA band 31: 450"           },
+    {  9920, 10359, "E-UTRA band 32: 1500 L-band"   },
+    { 36000, 36199, "E-UTRA band 33: TD 1900"       },
+    { 36200, 36349, "E-UTRA band 34: TD 2000"       },
+    { 36350, 36949, "E-UTRA band 35: TD PCS Lower"  },
+    { 36950, 37549, "E-UTRA band 36: TD PCS Upper"  },
+    { 37550, 37749, "E-UTRA band 37: TD PCS Center" },
+    { 37750, 38249, "E-UTRA band 38: TD 2600"       },
+    { 38250, 38649, "E-UTRA band 39: TD 1900+"      },
+    { 38650, 39649, "E-UTRA band 40: TD 2300"       },
+    { 39650, 41589, "E-UTRA band 41: TD 2500"       },
+    { 41590, 43589, "E-UTRA band 42: TD 3500"       },
+    { 43590, 45589, "E-UTRA band 43: TD 3700"       },
+    { 45590, 46589, "E-UTRA band 44: TD 700"        },
+};
+
+static const char * earfcn_to_eutra_band_string (uint16 earfcn)
+{
+    size_t i;
+
+    for (i = 0; i < N_ELEMENTS (earfcn_ranges); i++) {
+        if (earfcn <= earfcn_ranges[i].max && earfcn >= earfcn_ranges[i].min)
+            return earfcn_ranges[i].name;
+    }
+    
+    return "unknown";
+}
+
+static int nas_get_cell_location_info(void)
+{
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    PQMI_TLV pV;
+    int err;
+    int i, j;
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_NAS, QMINAS_GET_CELL_LOCATION_INFO_REQ, NULL, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    pV = (PQMI_TLV)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x2E);
+    if (pV && pV->TLVLength) {
+        printf ("5GNR ARFCN: '%u'\n", pV->u32);
+    }
+
+    {
+        NasGetCellLocationNr5gServingCell *ptlv = (NasGetCellLocationNr5gServingCell *)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x2F);
+        if (ptlv && ptlv->TLVLength)
+        {
+            printf ("5GNR cell information:\n"
+                     "\tPLMN: '%s'\n"
+                     "\tTracking Area Code: '%u'\n"
+                     "\tGlobal Cell ID: '%" PRIu64 "'\n"
+                     "\tPhysical Cell ID: '%u'\n"
+                     "\tRSRQ: '%.1lf dB'\n"
+                     "\tRSRP: '%.1lf dBm'\n"
+                     "\tSNR: '%.1lf dB'\n",
+                     str_from_bcd_plmn(ptlv->plmn),
+                     ptlv->tac[0]<<16 | ptlv->tac[1]<<8 | ptlv->tac[2] ,
+                     ptlv->global_cell_id,
+                     ptlv->physical_cell_id,
+                     (0.1) * ((double)ptlv->rsrq),
+                     (0.1) * ((double)ptlv->rsrp),
+                     (0.1) * ((double)ptlv->snr));
+        }
+    }
+
+    {
+        NasGetCellLocationLteInfoIntrafrequency *ptlv = (NasGetCellLocationLteInfoIntrafrequency *)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x13);
+        if (ptlv && ptlv->TLVLength)
+        {
+            printf ("Intrafrequency LTE Info:\n"
+                    "\tUE In Idle: '%s'\n"
+                    "\tPLMN: '%s'\n"
+                    "\tTracking Area Code: '%u'\n"
+                    "\tGlobal Cell ID: '%u'\n"
+                    "\tEUTRA Absolute RF Channel Number: '%u' (%s)\n"
+                    "\tServing Cell ID: '%u'\n",
+                    ptlv->ue_in_idle ? "yes" : "no",
+                    str_from_bcd_plmn(ptlv->plmn),
+                    ptlv->tracking_area_code,
+                    ptlv->global_cell_id,
+                    ptlv->absolute_rf_channel_number, earfcn_to_eutra_band_string(ptlv->absolute_rf_channel_number),
+                    ptlv->serving_cell_id);
+
+                if (ptlv->ue_in_idle)
+                    printf ("\tCell Reselection Priority: '%u'\n"
+                             "\tS Non Intra Search Threshold: '%u'\n"
+                             "\tServing Cell Low Threshold: '%u'\n"
+                             "\tS Intra Search Threshold: '%u'\n",
+                             ptlv->cell_reselection_priority,
+                             ptlv->s_non_intra_search_threshold,
+                             ptlv->serving_cell_low_threshold,
+                             ptlv->s_intra_search_threshold);
+
+
+                for (i = 0; i < ptlv->cells_len; i++) {
+                    NasGetCellLocationLteInfoCell *cell = &ptlv->cells_array[i];
+
+                    printf ("\tCell [%u]:\n"
+                             "\t\tPhysical Cell ID: '%u'\n"
+                             "\t\tRSRQ: '%.1lf' dB\n"
+                             "\t\tRSRP: '%.1lf' dBm\n"
+                             "\t\tRSSI: '%.1lf' dBm\n",
+                             i,
+                             cell->physical_cell_id,
+                             (double) cell->rsrq * 0.1,
+                             (double) cell->rsrp * 0.1,
+                             (double) cell->rssi * 0.1);
+
+                    if (ptlv->ue_in_idle)
+                        printf ("\t\tCell Selection RX Level: '%d'\n",
+                                 cell->cell_selection_rx_level);
+                }
+        }
+    }
+
+    {
+        NasGetCellLocationLteInfoInterfrequency *ptlv = (NasGetCellLocationLteInfoInterfrequency *)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x14);
+        if (ptlv && ptlv->TLVLength)
+        {
+            int off = offsetof(NasGetCellLocationLteInfoInterfrequency, freqs[0]);
+            printf ("Interfrequency LTE Info:\n"
+                     "\tUE In Idle: '%s'\n", ptlv->ue_in_idle ? "yes" : "no");
+
+                for (i = 0; i < ptlv->freqs_len; i++) {
+                    NasGetCellLocationLteInfoInterfrequencyFrequencyElement *freq = (((void *)ptlv) + off);
+
+                    off += sizeof(*freq);
+                    printf ("\tFrequency [%u]:\n"
+                             "\t\tEUTRA Absolute RF Channel Number: '%u' (%s)\n"
+                             "\t\tSelection RX Level Low Threshold: '%u'\n"
+                             "\t\tCell Selection RX Level High Threshold: '%u'\n",
+                             i,
+                             freq->eutra_absolute_rf_channel_number, earfcn_to_eutra_band_string(freq->eutra_absolute_rf_channel_number),
+                             freq->cell_selection_rx_level_low_threshold,
+                             freq->cell_selection_rx_level_high_threshold);
+                    if (ptlv->ue_in_idle)
+                        printf ("\t\tCell Reselection Priority: '%u'\n",
+                                 freq->cell_reselection_priority);
+
+
+                    for (j = 0; j < freq->cells_len; j++) {
+                        NasGetCellLocationLteInfoCell *cell = &freq->cells_array[j];
+
+                        off += sizeof(*cell);
+                        printf ("\t\tCell [%u]:\n"
+                                 "\t\t\tPhysical Cell ID: '%u'\n"
+                                 "\t\t\tRSRQ: '%.1lf' dB\n"
+                                 "\t\t\tRSRP: '%.1lf' dBm\n"
+                                 "\t\t\tRSSI: '%.1lf' dBm\n"
+                                 "\t\t\tCell Selection RX Level: '%u'\n",
+                                 j,
+                                 cell->physical_cell_id,
+                                 (double) cell->rsrq * 0.1,
+                                 (double) cell->rsrp * 0.1,
+                                 (double) cell->rssi * 0.1,
+                                 cell->cell_selection_rx_level);
+                    }
+                }
+        }
+    }
+
+    pV = (PQMI_TLV)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x1E);
+    if (pV && pV->TLVLength) {
+        if (pV->u32 == 0xFFFFFFFF)
+            printf ("LTE Timing Advance: 'unavailable'\n");
+        else
+            printf ("LTE Timing Advance: '%u'\n", pV->u32);
+    }
+    
+    free(pResponse);
+    return 0;
+}
+
+static int nas_get_rf_band_information(void)
+{
+    PQCQMIMSG pRequest;
+    PQCQMIMSG pResponse;
+    PQMUX_MSG pMUXMsg;
+    int err;
+    int i;
+
+    pRequest = ComposeQMUXMsg(QMUX_TYPE_NAS, QMINAS_GET_RF_BAND_INFO_REQ, NULL, NULL);
+    err = QmiThreadSendQMI(pRequest, &pResponse);
+    qmi_rsp_check_and_return();
+
+    {
+        NasGetRfBandInfoList *ptlv = (NasGetRfBandInfoList *)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x01);
+        if (ptlv && ptlv->TLVLength)
+        {
+            printf ("Band Information:\n");
+            for (i = 0; i < ptlv->num_instances; i++) {
+                NasGetRfBandInfo *band = &ptlv->bands_array[i];
+
+                printf ("\tRadio Interface:   '%s'\n"
+                         "\tActive Band Class: '%s'\n"
+                         "\tActive Channel:    '%u'\n",
+                         qmi_nas_radio_interface_get_string (band->radio_if),
+                         qmi_nas_active_band_get_string (band->active_band),
+                         band->active_channel);
+            }
+        }
+    }
+
+    {
+        NasGetRfBandInfoExtendedList *ptlv = (NasGetRfBandInfoExtendedList *)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x11);
+        if (ptlv && ptlv->TLVLength)
+        {
+            printf ("Band Information (Extended):\n");
+            for (i = 0; i < ptlv->num_instances; i++) {
+                NasGetRfBandInfoExtended *band = &ptlv->bands_array[i];
+
+                printf ("\tRadio Interface:   '%s'\n"
+                         "\tActive Band Class: '%s'\n"
+                         "\tActive Channel:    '%u'\n",
+                         qmi_nas_radio_interface_get_string (band->radio_if),
+                         qmi_nas_active_band_get_string (band->active_band),
+                         band->active_channel);
+            }
+        }
+    }
+
+    {
+        NasGetRfBandInfoBandWidthList *ptlv = (NasGetRfBandInfoBandWidthList *)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x12);
+        if (ptlv && ptlv->TLVLength)
+        {
+            printf ("Bandwidth:\n");
+            for (i = 0; i < ptlv->num_instances; i++) {
+                NasGetRfBandInfoBandWidth *band = &ptlv->bands_array[i];
+
+                printf ("\tRadio Interface:   '%s'\n"
+                         "\tBandwidth:         '%u'\n",
+                     qmi_nas_radio_interface_get_string (band->radio_if),
+                     (band->bandwidth));
+            }
+        }
+    }
+
+    free(pResponse);
+    return 0;
+}
+#endif
diff --git a/RM520N-5G/文件/source/QMIThread.h b/RM520N-5G/文件/source/QMIThread.h
new file mode 100644
index 0000000..249336f
--- /dev/null
+++ b/RM520N-5G/文件/source/QMIThread.h
@@ -0,0 +1,467 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#ifndef __QMI_THREAD_H__
+#define __QMI_THREAD_H__
+
+#define CONFIG_GOBINET
+#define CONFIG_QMIWWAN
+#define CONFIG_SIM
+#define CONFIG_APN
+#define CONFIG_VERSION
+//#define CONFIG_SIGNALINFO
+//#define CONFIG_CELLINFO
+//#define CONFIG_COEX_WWAN_STATE
+#define CONFIG_DEFAULT_PDP 1
+//#define CONFIG_IMSI_ICCID
+#define QUECTEL_UL_DATA_AGG
+//#define QUECTEL_QMI_MERGE
+//#define REBOOT_SIM_CARD_WHEN_APN_CHANGE
+//#define REBOOT_SIM_CARD_WHEN_LONG_TIME_NO_PS 60 //unit is seconds
+//#define CONFIG_QRTR
+//#define CONFIG_ENABLE_QOS
+//#define CONFIG_REG_QOS_IND
+//#define CONFIG_GET_QOS_INFO
+//#define CONFIG_GET_QOS_DATA_RATE
+
+#if (defined(CONFIG_REG_QOS_IND) || defined(CONFIG_GET_QOS_INFO) || defined(CONFIG_GET_QOS_DATA_RATE))
+#ifndef CONFIG_REG_QOS_IND
+#define CONFIG_REG_QOS_IND
+#endif
+#ifndef CONFIG_ENABLE_QOS
+#define CONFIG_ENABLE_QOS
+#endif
+#endif
+
+#include <stdio.h>
+#include <string.h>
+#include <termios.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <time.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <pthread.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/epoll.h>
+#include <poll.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <stddef.h>
+
+#include "qendian.h"
+#include "QCQMI.h"
+#include "QCQCTL.h"
+#include "QCQMUX.h"
+#include "util.h"
+
+#define DEVICE_CLASS_UNKNOWN           0
+#define DEVICE_CLASS_CDMA              1
+#define DEVICE_CLASS_GSM               2
+
+#define WWAN_DATA_CLASS_NONE            0x00000000
+#define WWAN_DATA_CLASS_GPRS            0x00000001
+#define WWAN_DATA_CLASS_EDGE            0x00000002 /* EGPRS */
+#define WWAN_DATA_CLASS_UMTS            0x00000004
+#define WWAN_DATA_CLASS_HSDPA           0x00000008
+#define WWAN_DATA_CLASS_HSUPA           0x00000010
+#define WWAN_DATA_CLASS_LTE             0x00000020
+#define WWAN_DATA_CLASS_5G_NSA        0x00000040
+#define WWAN_DATA_CLASS_5G_SA        0x00000080
+#define WWAN_DATA_CLASS_1XRTT           0x00010000
+#define WWAN_DATA_CLASS_1XEVDO          0x00020000
+#define WWAN_DATA_CLASS_1XEVDO_REVA     0x00040000
+#define WWAN_DATA_CLASS_1XEVDV          0x00080000
+#define WWAN_DATA_CLASS_3XRTT           0x00100000
+#define WWAN_DATA_CLASS_1XEVDO_REVB     0x00200000 /* for future use */
+#define WWAN_DATA_CLASS_UMB             0x00400000
+#define WWAN_DATA_CLASS_CUSTOM          0x80000000
+
+struct wwan_data_class_str {
+    ULONG class;
+    const char *str;
+};
+
+#pragma pack(push, 1)
+typedef struct __IPV4 {
+    uint32_t Address;
+    uint32_t Gateway;
+    uint32_t SubnetMask;
+    uint32_t DnsPrimary;
+    uint32_t DnsSecondary;
+    uint32_t Mtu;
+} IPV4_T;
+
+typedef struct __IPV6 {
+    UCHAR Address[16];
+    UCHAR Gateway[16];
+    UCHAR SubnetMask[16];
+    UCHAR DnsPrimary[16];
+    UCHAR DnsSecondary[16];
+    UCHAR PrefixLengthIPAddr;
+    UCHAR PrefixLengthGateway;
+    ULONG Mtu;
+} IPV6_T;
+
+typedef struct {
+    UINT size;
+    UINT rx_urb_size;
+    UINT ep_type;
+    UINT iface_id;
+    UINT MuxId;
+    UINT ul_data_aggregation_max_datagrams; //0x17
+    UINT ul_data_aggregation_max_size ;//0x18
+    UINT dl_minimum_padding; //0x1A
+} QMAP_SETTING;
+
+//Configured downlink data aggregationprotocol
+#define WDA_DL_DATA_AGG_DISABLED (0x00) //DL data aggregation is disabled (default)
+#define WDA_DL_DATA_AGG_TLP_ENABLED (0x01) // DL TLP is enabled
+#define WDA_DL_DATA_AGG_QC_NCM_ENABLED (0x02) // DL QC_NCM isenabled
+#define WDA_DL_DATA_AGG_MBIM_ENABLED (0x03) // DL MBIM isenabled
+#define WDA_DL_DATA_AGG_RNDIS_ENABLED (0x04) // DL RNDIS is enabled
+#define WDA_DL_DATA_AGG_QMAP_ENABLED (0x05) // DL QMAP isenabled
+#define WDA_DL_DATA_AGG_QMAP_V2_ENABLED (0x06) // DL QMAP V2 is enabled
+#define WDA_DL_DATA_AGG_QMAP_V3_ENABLED (0x07) // DL QMAP V3 is enabled
+#define WDA_DL_DATA_AGG_QMAP_V4_ENABLED (0x08) // DL QMAP V4 is enabled
+#define WDA_DL_DATA_AGG_QMAP_V5_ENABLED (0x09) // DL QMAP V5 is enabled
+
+typedef struct {
+    unsigned int size;
+    unsigned int rx_urb_size;
+    unsigned int ep_type;
+    unsigned int iface_id;
+    unsigned int qmap_mode;
+    unsigned int qmap_version;
+    unsigned int dl_minimum_padding;
+    char ifname[8][16];
+    unsigned char mux_id[8];
+} RMNET_INFO;
+
+#define IpFamilyV4 (0x04)
+#define IpFamilyV6 (0x06)
+
+struct __PROFILE;
+struct qmi_device_ops {
+	int (*init)(struct __PROFILE *profile);
+	int (*deinit)(void);
+	int (*send)(PQCQMIMSG pRequest);
+	void* (*read)(void *pData);
+};
+#ifdef CONFIG_QRTR
+extern const struct qmi_device_ops qrtr_qmidev_ops;
+#endif
+extern const struct qmi_device_ops gobi_qmidev_ops;
+extern const struct qmi_device_ops qmiwwan_qmidev_ops;
+extern const struct qmi_device_ops mbim_dev_ops;
+extern const struct qmi_device_ops atc_dev_ops;
+extern int (*qmidev_send)(PQCQMIMSG pRequest);
+
+struct usb_device_info {
+    int idVendor;
+    int idProduct;
+    int  busnum;
+    int devnum;
+    int bNumInterfaces;
+};
+
+struct usb_interface_info {
+    int bNumEndpoints;
+    int bInterfaceClass;
+    int bInterfaceSubClass;
+    int bInterfaceProtocol;
+    char driver[32];
+};
+
+#define LIBQMI_PROXY "qmi-proxy" //src/libqmi-glib/qmi-proxy.h
+#define LIBMBIM_PROXY "mbim-proxy"
+#define QUECTEL_QMI_PROXY "quectel-qmi-proxy"
+#define QUECTEL_MBIM_PROXY "quectel-mbim-proxy"
+#define QUECTEL_ATC_PROXY "quectel-atc-proxy"
+#define QUECTEL_QRTR_PROXY "quectel-qrtr-proxy"
+
+#ifndef bool
+#define bool uint8_t
+#endif
+struct request_ops;
+typedef struct __PROFILE {
+    //user input start
+    const char *apn;
+    const char *user;
+    const char *pd;
+    int auth;
+    int iptype;
+    const char *pincode;
+    char proxy[32];
+    int pdp;//pdp_context
+    int profile_index;//profile_index
+    int enable_bridge;
+    bool enable_ipv4;
+    bool enable_ipv6;
+    bool no_dhcp;
+    const char *logfile;
+    const char *usblogfile;
+    char expect_adapter[32];
+    int kill_pdp;
+    int replication_factor;
+    //user input end
+
+    char qmichannel[32];
+    char usbnet_adapter[32];
+    char qmapnet_adapter[32];
+    char driver_name[32];
+    int qmap_mode;
+    int qmap_size;
+    int qmap_version;
+    int curIpFamily;
+    int rawIP;
+    int muxid;
+#ifdef CONFIG_ENABLE_QOS
+    UINT qos_id;
+#endif
+    int wda_client;
+    uint32_t udhcpc_ip;
+    IPV4_T ipv4;
+    IPV6_T ipv6;
+    UINT PCSCFIpv4Addr1;
+    UINT PCSCFIpv4Addr2;
+    UCHAR PCSCFIpv6Addr1[16];
+    UCHAR PCSCFIpv6Addr2[16];
+    bool reattach_flag;
+    int hardware_interface;
+    int software_interface;
+
+    struct usb_device_info usb_dev;
+    struct usb_interface_info usb_intf;
+
+    int usbmon_fd;
+    FILE  *usbmon_logfile_fp;
+    bool loopback_state;
+
+    char BaseBandVersion[64];
+    char old_apn[64];
+    char old_user[64];
+    char old_pd[64];
+    int old_auth;
+    int old_iptype;
+
+    const struct qmi_device_ops *qmi_ops;
+    const struct request_ops *request_ops;
+    RMNET_INFO rmnet_info;
+    BOOL bring_up_by_apn_name;
+    BOOL bring_up_by_apn_type; 
+    int apn_type;
+} PROFILE_T;
+
+#ifdef QUECTEL_QMI_MERGE
+#define MERGE_PACKET_IDENTITY 0x2c7c
+#define MERGE_PACKET_VERSION 0x0001
+#define MERGE_PACKET_MAX_PAYLOAD_SIZE 56
+typedef struct __QMI_MSG_HEADER {
+    uint16_t idenity;
+    uint16_t version;
+    uint16_t cur_len;
+    uint16_t total_len;
+} QMI_MSG_HEADER;
+
+typedef struct __QMI_MSG_PACKET {
+    QMI_MSG_HEADER header;
+    uint16_t len;
+    char buf[4096];
+} QMI_MSG_PACKET;
+#endif
+
+typedef enum {
+    SIM_ABSENT = 0,
+    SIM_NOT_READY = 1,
+    SIM_READY = 2, /* SIM_READY means the radio state is RADIO_STATE_SIM_READY */
+    SIM_PIN = 3,
+    SIM_PUK = 4,
+    SIM_NETWORK_PERSONALIZATION = 5,
+    SIM_BAD = 6,
+} SIM_Status;
+
+#pragma pack(pop)
+
+#define WDM_DEFAULT_BUFSIZE	256
+#define RIL_REQUEST_QUIT    0x1000
+#define RIL_INDICATE_DEVICE_CONNECTED    0x1002
+#define RIL_INDICATE_DEVICE_DISCONNECTED    0x1003
+#define RIL_UNSOL_RESPONSE_VOICE_NETWORK_STATE_CHANGED    0x1004
+#define RIL_UNSOL_DATA_CALL_LIST_CHANGED    0x1005
+#define MODEM_REPORT_RESET_EVENT 0x1006
+#define RIL_UNSOL_LOOPBACK_CONFIG_IND 0x1007
+#ifdef CONFIG_REG_QOS_IND
+#define RIL_UNSOL_GLOBAL_QOS_FLOW_IND_QOS_ID 0x1008
+#endif
+
+extern pthread_mutex_t cm_command_mutex;
+extern pthread_cond_t cm_command_cond;
+extern unsigned int cm_recv_buf[1024];
+extern int cm_open_dev(const char *dev);
+extern int cm_open_proxy(const char *name);
+extern int pthread_cond_timeout_np(pthread_cond_t *cond, pthread_mutex_t * mutex, unsigned msecs);
+extern int QmiThreadSendQMITimeout(PQCQMIMSG pRequest, PQCQMIMSG *ppResponse, unsigned msecs, const char *funcname);
+#define QmiThreadSendQMI(pRequest, ppResponse) QmiThreadSendQMITimeout(pRequest, ppResponse, 30 * 1000, __func__)
+extern void QmiThreadRecvQMI(PQCQMIMSG pResponse);
+extern void udhcpc_start(PROFILE_T *profile);
+extern void udhcpc_stop(PROFILE_T *profile);
+extern void ql_set_driver_link_state(PROFILE_T *profile, int link_state);
+extern void ql_set_driver_qmap_setting(PROFILE_T *profile, QMAP_SETTING *qmap_settings);
+extern void ql_get_driver_rmnet_info(PROFILE_T *profile, RMNET_INFO *rmnet_info);
+extern void dump_qmi(void *dataBuffer, int dataLen);
+extern void qmidevice_send_event_to_main(int triger_event);
+extern void qmidevice_send_event_to_main_ext(int triger_event, void *data, unsigned len);
+extern uint8_t qmi_over_mbim_get_client_id(uint8_t QMIType);
+extern uint8_t qmi_over_mbim_release_client_id(uint8_t QMIType, uint8_t ClientId);
+#ifdef CONFIG_REG_QOS_IND
+extern UCHAR ql_get_global_qos_flow_ind_qos_id(PQCQMIMSG pResponse, UINT *qos_id);
+#endif
+#ifdef CONFIG_GET_QOS_DATA_RATE
+extern UCHAR ql_get_global_qos_flow_ind_data_rate(PQCQMIMSG pResponse, void *max_data_rate);
+#endif
+
+struct request_ops {
+    int (*requestBaseBandVersion)(PROFILE_T *profile);
+    int (*requestSetEthMode)(PROFILE_T *profile);
+    int (*requestSetLoopBackState)(UCHAR loopback_state, ULONG replication_factor);
+    int (*requestGetSIMStatus)(SIM_Status *pSIMStatus);
+    int (*requestEnterSimPin)(const char *pPinCode);
+    int (*requestSetProfile)(PROFILE_T *profile); // 1 ~ success and apn change, 0 ~ success and no apn change, -1 ~ fail
+    int (*requestGetProfile)(PROFILE_T *profile);
+    int (*requestRegistrationState)(UCHAR *pPSAttachedState);
+    int (*requestSetupDataCall)(PROFILE_T *profile, int curIpFamily);
+    int (*requestQueryDataCall)(UCHAR  *pConnectionStatus, int curIpFamily);
+    int (*requestDeactivateDefaultPDP)(PROFILE_T *profile, int curIpFamily);
+    int (*requestGetIPAddress)(PROFILE_T *profile, int curIpFamily);
+    int (*requestGetSignalInfo)(void);
+    int (*requestGetCellInfoList)(void);
+    int (*requestGetICCID)(void);
+    int (*requestGetIMSI)(void);
+    int (*requestRadioPower)(int state);
+    int (*requestRegisterQos)(PROFILE_T *profile);
+    int (*requestGetQosInfo)(PROFILE_T *profile);
+    int (*requestGetCoexWWANState)(void);
+};
+extern const struct request_ops qmi_request_ops;
+extern const struct request_ops mbim_request_ops;
+extern const struct request_ops atc_request_ops;
+
+extern int get_driver_type(PROFILE_T *profile);
+extern BOOL qmidevice_detect(char *qmichannel, char *usbnet_adapter, unsigned bufsize, PROFILE_T *profile);
+int mhidevice_detect(char *qmichannel, char *usbnet_adapter, PROFILE_T *profile);
+int atdevice_detect(char *atchannel, char *usbnet_adapter, PROFILE_T *profile);
+extern int ql_bridge_mode_detect(PROFILE_T *profile);
+extern int ql_enable_qmi_wwan_rawip_mode(PROFILE_T *profile);
+extern int ql_qmap_mode_detect(PROFILE_T *profile);
+#ifdef CONFIG_QRTR
+extern int rtrmnet_ctl_new_vnd(char *devname, char *vndname, uint8_t muxid,
+		       uint32_t qmap_version, uint32_t ul_agg_cnt, uint32_t ul_agg_size);
+extern int rtrmnet_ctl_get_vnd(char *vndname, int *muxid,
+		       int *qmap_version);
+#endif
+
+#define qmidev_is_gobinet(_qmichannel) (strncmp(_qmichannel, "/dev/qcqmi", strlen("/dev/qcqmi")) == 0)
+#define qmidev_is_qmiwwan(_qmichannel) (strncmp(_qmichannel, "/dev/cdc-wdm", strlen("/dev/cdc-wdm")) == 0)
+#define qmidev_is_pciemhi(_qmichannel) (strncmp(_qmichannel, "/dev/mhi_", strlen("/dev/mhi_")) == 0)
+
+#define driver_is_qmi(_drv_name) (strncasecmp(_drv_name, "qmi_wwan", strlen("qmi_wwan")) == 0)
+#define driver_is_mbim(_drv_name) (strncasecmp(_drv_name, "cdc_mbim", strlen("cdc_mbim")) == 0)
+
+extern FILE *logfilefp;
+extern int debug_qmi;
+extern int qmidevice_control_fd[2];
+extern int g_donot_exit_when_modem_hangup;
+extern void update_resolv_conf(int iptype, const char *ifname, const char *dns1, const char *dns2);
+void update_ipv4_address(const char *ifname, const char *ip, const char *gw, unsigned prefix);
+void update_ipv6_address(const char *ifname, const char *ip, const char *gw, unsigned prefix);
+int reattach_driver(PROFILE_T *profile);
+extern void no_trunc_strncpy(char *dest, const char *src, size_t dest_size);
+
+enum
+{
+	DRV_INVALID,
+	SOFTWARE_QMI,
+	SOFTWARE_MBIM,
+	SOFTWARE_ECM_RNDIS_NCM,
+	SOFTWARE_QRTR,
+	HARDWARE_PCIE,
+	HARDWARE_USB,
+	HARDWARE_IPA,
+};
+
+#ifdef USE_IPC_MSG_STATUS_IND
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#define MSG_FILE "/etc/passwd"
+#define MSG_TYPE_IPC 1
+#define MSGBUFFSZ 16
+struct message
+{
+    long mtype;
+    char mtext[MSGBUFFSZ];
+};
+
+enum
+{
+    QCM_PARA_CONFIG_QUERY = 1,
+    QCM_NETWORK_IPV4_CONNECTED,
+    QCM_NETWORK_IPV6_CONNECTED,
+    QCM_NETWORK_IPV4_DISCONNECTED,
+    QCM_NETWORK_IPV6_DISCONNECTED,
+    QCM_PREPARE_START_DAIL,
+    QCM_PREPARE_DAIL_FIAL,
+    QCM_PREPARE_DAIL_SUCC,
+    QCM_PREPARE_RESTART_DAIL,
+    QCM_PROCESS_EXIT,
+};
+#endif
+
+enum
+{
+    SIG_EVENT_START,
+    SIG_EVENT_CHECK,
+    SIG_EVENT_STOP,
+};
+
+typedef enum
+{
+    DMS_OP_MODE_ONLINE,
+    DMS_OP_MODE_LOW_POWER,
+    DMS_OP_MODE_FACTORY_TEST_MODE,
+    DMS_OP_MODE_OFFLINE,
+    DMS_OP_MODE_RESETTING,
+    DMS_OP_MODE_SHUTTING_DOWN,
+    DMS_OP_MODE_PERSISTENT_LOW_POWER,
+    DMS_OP_MODE_MODE_ONLY_LOW_POWER,
+    DMS_OP_MODE_NET_TEST_GW,
+}Device_operating_mode;
+
+#ifdef CM_DEBUG
+#define dbg_time(fmt, args...) do { \
+    fprintf(stdout, "[%15s-%04d: %s] " fmt "\n", __FILE__, __LINE__, get_time(), ##args); \
+    fflush(stdout);\
+    if (logfilefp) fprintf(logfilefp, "[%s-%04d: %s] " fmt "\n", __FILE__, __LINE__, get_time(), ##args); \
+} while(0)
+#else
+#define dbg_time(fmt, args...) do { \
+    fprintf(stdout, "[%s] " fmt "\n", get_time(), ##args); \
+    fflush(stdout);\
+    if (logfilefp) fprintf(logfilefp, "[%s] " fmt "\n", get_time(), ##args); \
+} while(0)
+#endif
+#endif
diff --git a/RM520N-5G/文件/source/QmiWwanCM.c b/RM520N-5G/文件/source/QmiWwanCM.c
new file mode 100644
index 0000000..2959c58
--- /dev/null
+++ b/RM520N-5G/文件/source/QmiWwanCM.c
@@ -0,0 +1,454 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <stdio.h>
+#include <string.h>
+#include <termios.h>
+#include <stdio.h>
+#include <ctype.h>
+#include "QMIThread.h"
+
+#ifdef CONFIG_QMIWWAN
+static int cdc_wdm_fd = -1;
+static UCHAR qmiclientId[QMUX_TYPE_ALL];
+
+static UCHAR GetQCTLTransactionId(void) {
+    static int TransactionId = 0;
+    if (++TransactionId > 0xFF)
+        TransactionId = 1;
+    return TransactionId;
+}
+
+typedef USHORT (*CUSTOMQCTL)(PQMICTL_MSG pCTLMsg, void *arg);
+
+static PQCQMIMSG ComposeQCTLMsg(USHORT QMICTLType, CUSTOMQCTL customQctlMsgFunction, void *arg) {
+    UCHAR QMIBuf[WDM_DEFAULT_BUFSIZE];
+    PQCQMIMSG pRequest = (PQCQMIMSG)QMIBuf;
+    int Length;
+
+    pRequest->QMIHdr.IFType   = USB_CTL_MSG_TYPE_QMI;
+    pRequest->QMIHdr.CtlFlags = 0x00;
+    pRequest->QMIHdr.QMIType  = QMUX_TYPE_CTL;
+    pRequest->QMIHdr.ClientId= 0x00;
+
+    pRequest->CTLMsg.QMICTLMsgHdr.CtlFlags = QMICTL_FLAG_REQUEST;
+    pRequest->CTLMsg.QMICTLMsgHdr.TransactionId = GetQCTLTransactionId();
+    pRequest->CTLMsg.QMICTLMsgHdr.QMICTLType = cpu_to_le16(QMICTLType);
+    if (customQctlMsgFunction)
+        pRequest->CTLMsg.QMICTLMsgHdr.Length = cpu_to_le16(customQctlMsgFunction(&pRequest->CTLMsg, arg) - sizeof(QCQMICTL_MSG_HDR));
+    else
+        pRequest->CTLMsg.QMICTLMsgHdr.Length = cpu_to_le16(0x0000);
+
+    pRequest->QMIHdr.Length = cpu_to_le16(le16_to_cpu(pRequest->CTLMsg.QMICTLMsgHdr.Length) + sizeof(QCQMICTL_MSG_HDR) + sizeof(QCQMI_HDR) - 1);
+    Length = le16_to_cpu(pRequest->QMIHdr.Length) + 1;
+
+    pRequest = (PQCQMIMSG)malloc(Length);
+    if (pRequest == NULL) {
+        dbg_time("%s fail to malloc", __func__);
+    } else {
+        memcpy(pRequest, QMIBuf, Length);
+    }
+
+    return pRequest;
+}
+
+static USHORT CtlGetVersionReq(PQMICTL_MSG QCTLMsg, void *arg)
+{
+    (void)arg;
+    QCTLMsg->GetVersionReq.TLVType = QCTLV_TYPE_REQUIRED_PARAMETER;
+    QCTLMsg->GetVersionReq.TLVLength = cpu_to_le16(0x0001);
+    QCTLMsg->GetVersionReq.QMUXTypes = QMUX_TYPE_ALL;
+    return sizeof(QMICTL_GET_VERSION_REQ_MSG);
+}
+
+static USHORT CtlGetClientIdReq(PQMICTL_MSG QCTLMsg, void *arg) {
+   QCTLMsg->GetClientIdReq.TLVType       = QCTLV_TYPE_REQUIRED_PARAMETER;
+   QCTLMsg->GetClientIdReq.TLVLength     = cpu_to_le16(0x0001);
+   QCTLMsg->GetClientIdReq.QMIType     = ((UCHAR *)arg)[0];
+   return sizeof(QMICTL_GET_CLIENT_ID_REQ_MSG);
+}
+
+static USHORT CtlReleaseClientIdReq(PQMICTL_MSG QCTLMsg, void *arg) {
+   QCTLMsg->ReleaseClientIdReq.TLVType       = QCTLV_TYPE_REQUIRED_PARAMETER;
+   QCTLMsg->ReleaseClientIdReq.TLVLength     = cpu_to_le16(0x0002);
+   QCTLMsg->ReleaseClientIdReq.QMIType     = ((UCHAR *)arg)[0];
+   QCTLMsg->ReleaseClientIdReq.ClientId = ((UCHAR *)arg)[1] ;
+   return sizeof(QMICTL_RELEASE_CLIENT_ID_REQ_MSG);
+}
+
+static USHORT CtlLibQmiProxyOpenReq(PQMICTL_MSG QCTLMsg, void *arg)
+{
+    (void)arg;
+    const char *device_path = (const char *)(arg);
+    QCTLMsg->LibQmiProxyOpenReq.TLVType = 0x01;
+    QCTLMsg->LibQmiProxyOpenReq.TLVLength = cpu_to_le16(strlen(device_path));
+    //strcpy(QCTLMsg->LibQmiProxyOpenReq.device_path, device_path);
+    //__builtin___strcpy_chk
+    memcpy(QCTLMsg->LibQmiProxyOpenReq.device_path, device_path, strlen(device_path));
+    return sizeof(QMICTL_LIBQMI_PROXY_OPEN_MSG) + (strlen(device_path));
+}
+
+static int libqmi_proxy_open(const char *cdc_wdm) {
+    int ret;
+    PQCQMIMSG pResponse;
+
+    ret = QmiThreadSendQMI(ComposeQCTLMsg(QMI_MESSAGE_CTL_INTERNAL_PROXY_OPEN,
+        CtlLibQmiProxyOpenReq, (void *)cdc_wdm), &pResponse);
+    if (!ret && pResponse
+        && pResponse->CTLMsg.QMICTLMsgHdrRsp.QMUXResult == 0
+        && pResponse->CTLMsg.QMICTLMsgHdrRsp.QMUXError == 0) {
+        ret = 0;
+    }
+    else {
+        return -1;
+    }
+
+    if (pResponse)
+            free(pResponse);
+
+    return ret;
+}
+
+static int QmiWwanSendQMI(PQCQMIMSG pRequest) {
+    struct pollfd pollfds[]= {{cdc_wdm_fd, POLLOUT, 0}};
+    int ret;
+
+    if (cdc_wdm_fd == -1) {
+        dbg_time("%s cdc_wdm_fd = -1", __func__);
+        return -ENODEV;
+    }
+
+    if (pRequest->QMIHdr.QMIType != QMUX_TYPE_CTL) {
+        pRequest->QMIHdr.ClientId = qmiclientId[pRequest->QMIHdr.QMIType];
+        if (pRequest->QMIHdr.ClientId == 0) {
+            dbg_time("QMIType %d has no clientID", pRequest->QMIHdr.QMIType);
+            return -ENODEV;
+        }
+
+        if (pRequest->QMIHdr.QMIType == QMUX_TYPE_WDS_IPV6)
+            pRequest->QMIHdr.QMIType = QMUX_TYPE_WDS;
+    }
+
+    do {
+        ret = poll(pollfds, sizeof(pollfds)/sizeof(pollfds[0]), 5000);
+    } while ((ret < 0) && (errno == EINTR));
+
+    if (pollfds[0].revents & POLLOUT) {
+        ssize_t nwrites = le16_to_cpu(pRequest->QMIHdr.Length) + 1;
+        ret = write(cdc_wdm_fd, pRequest, nwrites);
+        if (ret == nwrites) {
+            ret = 0;
+        } else {
+            dbg_time("%s write=%d, errno: %d (%s)", __func__, ret, errno, strerror(errno));
+        }
+    } else {
+        dbg_time("%s poll=%d, revents = 0x%x, errno: %d (%s)", __func__, ret, pollfds[0].revents, errno, strerror(errno));
+    }
+
+    return ret;
+}
+
+static UCHAR QmiWwanGetClientID(UCHAR QMIType) {
+    PQCQMIMSG pResponse;
+
+    QmiThreadSendQMI(ComposeQCTLMsg(QMICTL_GET_CLIENT_ID_REQ, CtlGetClientIdReq, &QMIType), &pResponse);
+
+    if (pResponse) {
+        USHORT QMUXResult = cpu_to_le16(pResponse->CTLMsg.QMICTLMsgHdrRsp.QMUXResult);       // QMI_RESULT_SUCCESS
+        USHORT QMUXError = cpu_to_le16(pResponse->CTLMsg.QMICTLMsgHdrRsp.QMUXError);        // QMI_ERR_INVALID_ARG
+        //UCHAR QMIType = pResponse->CTLMsg.GetClientIdRsp.QMIType;
+        UCHAR ClientId = pResponse->CTLMsg.GetClientIdRsp.ClientId;
+
+        if (!QMUXResult && !QMUXError && (QMIType == pResponse->CTLMsg.GetClientIdRsp.QMIType)) {
+            switch (QMIType) {
+                case QMUX_TYPE_WDS: dbg_time("Get clientWDS = %d", ClientId); break;
+                case QMUX_TYPE_DMS: dbg_time("Get clientDMS = %d", ClientId); break;
+                case QMUX_TYPE_NAS: dbg_time("Get clientNAS = %d", ClientId); break;
+                case QMUX_TYPE_QOS: dbg_time("Get clientQOS = %d", ClientId); break;
+                case QMUX_TYPE_WMS: dbg_time("Get clientWMS = %d", ClientId); break;
+                case QMUX_TYPE_PDS: dbg_time("Get clientPDS = %d", ClientId); break;
+                case QMUX_TYPE_UIM: dbg_time("Get clientUIM = %d", ClientId); break;
+                case QMUX_TYPE_COEX: dbg_time("Get clientCOEX = %d", ClientId); break;
+                case QMUX_TYPE_WDS_ADMIN: dbg_time("Get clientWDA = %d", ClientId);
+                break;
+                default: break;
+            }
+            return ClientId;
+        }
+    }
+    return 0;
+}
+
+static int QmiWwanReleaseClientID(QMI_SERVICE_TYPE QMIType, UCHAR ClientId) {
+    UCHAR argv[] = {QMIType, ClientId};
+    QmiThreadSendQMI(ComposeQCTLMsg(QMICTL_RELEASE_CLIENT_ID_REQ, CtlReleaseClientIdReq, argv), NULL);
+    return 0;
+}
+
+static int QmiWwanInit(PROFILE_T *profile) {
+    unsigned i;
+    int ret;
+    PQCQMIMSG pResponse;
+
+    if (profile->proxy[0] && !strcmp(profile->proxy, LIBQMI_PROXY)) {
+        ret = libqmi_proxy_open(profile->qmichannel);
+        if (ret)
+            return ret;
+    }
+
+    if (!profile->proxy[0]) {
+        for (i = 0; i < 10; i++) {
+            ret = QmiThreadSendQMITimeout(ComposeQCTLMsg(QMICTL_SYNC_REQ, NULL, NULL), NULL, 1 * 1000, __func__);
+            if (ret != ETIMEDOUT)
+                break;
+            sleep(1);
+        }
+        if (ret)
+            return ret;
+    }
+
+    QmiThreadSendQMI(ComposeQCTLMsg(QMICTL_GET_VERSION_REQ, CtlGetVersionReq, NULL), &pResponse);
+    if (profile->qmap_mode) {
+        if (pResponse) {
+            if (pResponse->CTLMsg.QMICTLMsgHdrRsp.QMUXResult == 0 && pResponse->CTLMsg.QMICTLMsgHdrRsp.QMUXError == 0) {
+                uint8_t  NumElements = 0;
+
+                for (NumElements = 0; NumElements < pResponse->CTLMsg.GetVersionRsp.NumElements; NumElements++) {
+#if 0
+                    dbg_time("QMUXType = %02x Version = %d.%d",
+                        pResponse->CTLMsg.GetVersionRsp.TypeVersion[NumElements].QMUXType,
+                        pResponse->CTLMsg.GetVersionRsp.TypeVersion[NumElements].MajorVersion,
+                        pResponse->CTLMsg.GetVersionRsp.TypeVersion[NumElements].MinorVersion);
+#endif
+                    if (pResponse->CTLMsg.GetVersionRsp.TypeVersion[NumElements].QMUXType == QMUX_TYPE_WDS_ADMIN)
+                        profile->qmap_version = (pResponse->CTLMsg.GetVersionRsp.TypeVersion[NumElements].MinorVersion > 16);
+                }
+            }
+        }
+    }
+    if (pResponse) free(pResponse);
+    qmiclientId[QMUX_TYPE_WDS] = QmiWwanGetClientID(QMUX_TYPE_WDS);
+    if (profile->enable_ipv6)
+        qmiclientId[QMUX_TYPE_WDS_IPV6] = QmiWwanGetClientID(QMUX_TYPE_WDS);
+    qmiclientId[QMUX_TYPE_DMS] = QmiWwanGetClientID(QMUX_TYPE_DMS);
+    qmiclientId[QMUX_TYPE_NAS] = QmiWwanGetClientID(QMUX_TYPE_NAS);
+    qmiclientId[QMUX_TYPE_UIM] = QmiWwanGetClientID(QMUX_TYPE_UIM);
+    qmiclientId[QMUX_TYPE_WDS_ADMIN] = QmiWwanGetClientID(QMUX_TYPE_WDS_ADMIN);
+#ifdef CONFIG_COEX_WWAN_STATE
+    qmiclientId[QMUX_TYPE_COEX] = QmiWwanGetClientID(QMUX_TYPE_COEX);
+#endif
+#ifdef CONFIG_ENABLE_QOS
+    qmiclientId[QMUX_TYPE_QOS] = QmiWwanGetClientID(QMUX_TYPE_QOS);
+#endif
+    profile->wda_client = qmiclientId[QMUX_TYPE_WDS_ADMIN];
+
+    return 0;
+}
+
+static int QmiWwanDeInit(void) {
+    unsigned int i;
+    for (i = 0; i < sizeof(qmiclientId)/sizeof(qmiclientId[0]); i++)
+    {
+        if (qmiclientId[i] != 0)
+        {
+            QmiWwanReleaseClientID((QMUX_TYPE_WDS_IPV6 == i ? QMUX_TYPE_WDS : i), qmiclientId[i]);
+            qmiclientId[i] = 0;
+        }
+    }
+
+    return 0;
+}
+
+static ssize_t qmi_proxy_read (int fd, void *buf, size_t size) {
+    ssize_t nreads;
+    PQCQMI_HDR pHdr = (PQCQMI_HDR)buf;
+
+    nreads = read(fd, pHdr, sizeof(QCQMI_HDR));
+    if (nreads == sizeof(QCQMI_HDR) && le16_to_cpu(pHdr->Length) < size) {
+        nreads += read(fd, pHdr+1, le16_to_cpu(pHdr->Length) + 1 - sizeof(QCQMI_HDR));
+    }
+
+    return nreads;
+}
+
+#ifdef QUECTEL_QMI_MERGE
+static int QmiWwanMergeQmiRsp(void *buf, ssize_t *src_size) {
+    static QMI_MSG_PACKET s_QMIPacket;
+    QMI_MSG_HEADER *header = NULL;
+    ssize_t size = *src_size;
+
+    if((uint16_t)size < sizeof(QMI_MSG_HEADER))
+        return -1;
+
+    header = (QMI_MSG_HEADER *)buf;
+    if(le16_to_cpu(header->idenity) != MERGE_PACKET_IDENTITY || le16_to_cpu(header->version) != MERGE_PACKET_VERSION || le16_to_cpu(header->cur_len) > le16_to_cpu(header->total_len)) 
+        return -1;
+
+    if(le16_to_cpu(header->cur_len) == le16_to_cpu(header->total_len)) {
+        *src_size = le16_to_cpu(header->total_len);
+        memcpy(buf, buf + sizeof(QMI_MSG_HEADER), *src_size);
+        s_QMIPacket.len = 0;  
+        return 0;
+    } 
+
+    memcpy(s_QMIPacket.buf + s_QMIPacket.len, buf + sizeof(QMI_MSG_HEADER), le16_to_cpu(header->cur_len));
+    s_QMIPacket.len += le16_to_cpu(header->cur_len);
+
+    if (le16_to_cpu(header->cur_len) < MERGE_PACKET_MAX_PAYLOAD_SIZE || s_QMIPacket.len >= le16_to_cpu(header->total_len)) { 
+       memcpy(buf, s_QMIPacket.buf, s_QMIPacket.len);      
+       *src_size = s_QMIPacket.len;
+       s_QMIPacket.len = 0;
+       return 0;           
+    }
+
+    return -1;
+}
+#endif
+
+static void * QmiWwanThread(void *pData) {
+    PROFILE_T *profile = (PROFILE_T *)pData;
+    const char *cdc_wdm = (const char *)profile->qmichannel;
+    int wait_for_request_quit = 0;
+    char num = cdc_wdm[strlen(cdc_wdm)-1];
+	
+    if (profile->proxy[0]) {
+         if (!strncmp(profile->proxy, QUECTEL_QMI_PROXY, strlen(QUECTEL_QMI_PROXY))) {
+            snprintf(profile->proxy, sizeof(profile->proxy), "%s%c", QUECTEL_QMI_PROXY, num);
+         }
+    }
+    else if (!strncmp(cdc_wdm, "/dev/mhi_IPCR", strlen("/dev/mhi_IPCR"))) {
+        snprintf(profile->proxy, sizeof(profile->proxy), "%s%c", QUECTEL_QRTR_PROXY, num);
+    }
+    else if (profile->qmap_mode > 1) {
+        snprintf(profile->proxy, sizeof(profile->proxy), "%s%c", QUECTEL_QMI_PROXY, num);
+    }
+    
+    if (profile->proxy[0])
+        cdc_wdm_fd = cm_open_proxy(profile->proxy);
+    else
+        cdc_wdm_fd = cm_open_dev(cdc_wdm);
+
+    if (cdc_wdm_fd == -1) {
+        dbg_time("%s Failed to open %s, errno: %d (%s)", __func__, cdc_wdm, errno, strerror(errno));
+        qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_DISCONNECTED);
+        pthread_exit(NULL);
+        return NULL;
+    }
+
+    dbg_time("cdc_wdm_fd = %d", cdc_wdm_fd);
+
+    qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_CONNECTED);
+    while (1) {
+        struct pollfd pollfds[] = {{qmidevice_control_fd[1], POLLIN, 0}, {cdc_wdm_fd, POLLIN, 0}};
+        int ne, ret, nevents = sizeof(pollfds)/sizeof(pollfds[0]);
+
+        do {
+            ret = poll(pollfds, nevents, wait_for_request_quit ? 1000 : -1);
+         } while ((ret < 0) && (errno == EINTR));
+
+	if (ret == 0 && wait_for_request_quit) {
+            QmiThreadRecvQMI(NULL);
+            continue;
+	}
+
+        if (ret <= 0) {
+            dbg_time("%s poll=%d, errno: %d (%s)", __func__, ret, errno, strerror(errno));
+            break;
+        }
+
+        for (ne = 0; ne < nevents; ne++) {
+            int fd = pollfds[ne].fd;
+            short revents = pollfds[ne].revents;
+
+            //dbg_time("{%d, %x, %x}", pollfds[ne].fd, pollfds[ne].events, pollfds[ne].revents);
+
+            if (revents & (POLLERR | POLLHUP | POLLNVAL)) {
+                dbg_time("%s poll err/hup/inval", __func__);
+                dbg_time("poll fd = %d, events = 0x%04x", fd, revents);
+                if (fd == cdc_wdm_fd) {
+                } else {
+                }
+                if (revents & (POLLHUP | POLLNVAL)) //EC20 bug, Can get POLLERR
+                    goto __QmiWwanThread_quit;
+            }
+
+            if ((revents & POLLIN) == 0)
+                continue;
+
+            if (fd == qmidevice_control_fd[1]) {
+                int triger_event;
+                if (read(fd, &triger_event, sizeof(triger_event)) == sizeof(triger_event)) {
+                    //DBG("triger_event = 0x%x", triger_event);
+                    switch (triger_event) {
+                        case RIL_REQUEST_QUIT:
+                            goto __QmiWwanThread_quit;
+                        break;
+                        case SIG_EVENT_STOP:
+                            wait_for_request_quit = 1;
+                        break;
+                        default:
+                        break;
+                    }
+                }
+            }
+
+            if (fd == cdc_wdm_fd) {
+                ssize_t nreads;
+                PQCQMIMSG pResponse = (PQCQMIMSG)cm_recv_buf;
+                
+                if (!profile->proxy[0])
+                    nreads = read(fd, cm_recv_buf, sizeof(cm_recv_buf));
+                else
+                    nreads = qmi_proxy_read(fd, cm_recv_buf, sizeof(cm_recv_buf));
+                //dbg_time("%s read=%d errno: %d (%s)",  __func__, (int)nreads, errno, strerror(errno));
+                if (nreads <= 0) {
+                    dbg_time("%s read=%d errno: %d (%s)",  __func__, (int)nreads, errno, strerror(errno));
+                    break;
+                }
+#ifdef QUECTEL_QMI_MERGE
+                if((profile->qmap_mode == 0 || profile->qmap_mode == 1) && QmiWwanMergeQmiRsp(cm_recv_buf, &nreads))
+                    continue;             
+#endif
+                if (nreads != (le16_to_cpu(pResponse->QMIHdr.Length) + 1)) {
+                    dbg_time("%s nreads=%d,  pQCQMI->QMIHdr.Length = %d",  __func__, (int)nreads, le16_to_cpu(pResponse->QMIHdr.Length));
+                    continue;
+                }
+
+                QmiThreadRecvQMI(pResponse);
+            }
+        }
+    }
+
+__QmiWwanThread_quit:
+    if (cdc_wdm_fd != -1) { close(cdc_wdm_fd); cdc_wdm_fd = -1; }
+    qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_DISCONNECTED);
+    QmiThreadRecvQMI(NULL); //main thread may pending on QmiThreadSendQMI()
+    dbg_time("%s exit", __func__);
+    pthread_exit(NULL);
+    return NULL;
+}
+
+const struct qmi_device_ops qmiwwan_qmidev_ops = {
+    .init = QmiWwanInit,
+    .deinit = QmiWwanDeInit,
+    .send = QmiWwanSendQMI,
+    .read = QmiWwanThread,
+};
+
+uint8_t qmi_over_mbim_get_client_id(uint8_t QMIType) {
+    return QmiWwanGetClientID(QMIType);
+}
+
+uint8_t qmi_over_mbim_release_client_id(uint8_t QMIType, uint8_t ClientId) {
+    return QmiWwanReleaseClientID(QMIType, ClientId);
+}
+#endif
+
diff --git a/RM520N-5G/文件/source/Quectel_QConnectManager_Linux_User_Guide_V1.0.pdf b/RM520N-5G/文件/source/Quectel_QConnectManager_Linux_User_Guide_V1.0.pdf
new file mode 100644
index 0000000..a6ee18c
Binary files /dev/null and b/RM520N-5G/文件/source/Quectel_QConnectManager_Linux_User_Guide_V1.0.pdf differ
diff --git a/RM520N-5G/文件/source/ReleaseNote.txt b/RM520N-5G/文件/source/ReleaseNote.txt
new file mode 100644
index 0000000..76a63be
--- /dev/null
+++ b/RM520N-5G/文件/source/ReleaseNote.txt
@@ -0,0 +1,344 @@
+Release Notes
+
+[V1.6.8]
+Date:   3/4/2025
+enhancement:
+  1. add QMI dialing status report
+fix:
+  1. fix some bugs
+
+[V1.6.7]
+Date:   5/17/2024
+enhancement:
+  1. optimize -a parameter
+fix:
+  1. fix the multiple dialing issue on the SDX35 platform
+
+[V1.6.6]
+Date:   1/12/2024
+enhancement:
+  1. support SDX35 platform
+  
+[V1.6.4]
+Date:   9/7/2022
+enhancement:
+  1. set cflags as -Wall -Wextra -Werror -O1, and fix compile errors
+  2. some code refactoring
+  3. add quectel-qrtr-proxy
+fix:
+  1. netmask error when use ifconfig on little endian cpu
+
+[V1.6.2]
+Date:   11/18/2021
+enhancement:
+	1. support 'LTE && WiFi Coexistence Solution via QMI'.
+	   If customer want use this feature, need enable CONFIG_COEX_WWAN_STATE in QMIThread.h 
+
+[V1.6.1]
+Date:   7/20/2021
+enhancement:
+	1. add requestGetCellInfoList requestRadioPower
+	2. add QMI OVER MBIM 
+	3. support qrtr and rmnet
+	4. support RG500U PCIE 
+	5. add qos service && get qos flow data_rate_max func
+fix:
+  1. mbim: increase mbim open timeout to 3 seconds. some modem take long time for open cmd.
+  2. support MsChapV2
+  3. mbim: invalid memory access when only get one DNS
+  4. some bug fix for use AT Command to setup data call
+
+[V1.6.0.26]
+Date:   4/22/2021
+enhancement:
+	1. add lots of log file to show how to use this tool
+	2. support pcie mhi multiple call
+	3. at command: support EC200U/EC200T/EC200S/RG801H/RG500U/
+fix:
+  1. mbim-proxy: fix errors on big endian cpu, ignore mbim open/close cmd from quectel-cm 
+
+[V1.6.0.25]
+Date:   4/8/2021
+enhancement:
+fix:
+  1. fix compile error when use gcc 9.3.0
+  2. fix yocto 'QA Issue: No GNU_HASH in the ELF binary'
+
+[V1.6.0.24]
+Date:   3/9/2021
+enhancement:
+  1. '-p [quectel-][qmi|mbim]-proxy', can connect to quectel/libqmi/libmbim's proxy, even only one data
+  2. set variable s_9x07 as 1 (from 0), most of modems are base on MDM90x7 and later QCOM chip.
+fix:
+  1. define CHAR as signed char
+  2. mofidy Makefile to generate more compile warnnings and fix them
+
+[V1.6.0.23]
+Date:   2/26/2021
+enhancement:
+  1. support 'AT+QNETDEVCTL' (not release)
+fix:
+   1. modify help/usage
+   2. fix some memroy access error in mbim-cm.c
+
+[V1.6.0.22]
+Date:   2/4/2021
+enhancement:
+  1. support connect to libqmi's qmi-proxy
+  2. only allow ' 0/1/2/none/pap/chap' for auth of '-s'
+  3. '-m iface-idx' bind QMAP data call to wwan0_<iface_idx>
+fix:
+
+[V1.6.0.21]
+Date:   1/28/2021
+enhancement:
+  1. print 5G signal
+fix:
+  1. fix compile errors: -Werror=format-truncation=
+  
+[V1.6.0.20]
+Date:   12/29/2020
+enhancement:
+  1. Code refactoring
+  2. support 'AT+QNETDEVCTL' (not release)
+fix:
+
+[V1.6.0.19]
+Date:   12/4/2020
+enhancement:
+  1. if 'udhcpc's default.script' missed, directy set ip/dns/route by 'ip' co,mand
+fix:
+
+[V1.6.0.18]
+Date:   12/4/2020
+enhancement:
+  1. Code refactoring
+fix:
+
+[V1.6.0.17]
+Date:   8/25/2020
+enhancement:
+  1. support MBIM multi-call
+  2. support unisoc RG500U mbim
+  3. QUECTEL_QMI_MERGE: some SOC can not read more then 64 bytes (QMI)data via USB Endpoint 0
+fix:
+
+[V1.6.0.15]
+Date:   7/24/2020
+enhancement:
+fix:
+  1. QMAP multi-call, AT+CFUN=4 then AT+CFUN=1, only one call can obtain IP by DHCP
+ 	  
+[V1.6.0.14]
+Date:   6/10/2020 
+enhancement:
+  1. support X55's GobiNet LOOPBACK
+fix:
+  1. very old uclib do not support htole32 and pthread_condattr_setclock
+  2. pthread_cond_wait tv_nsec >= 1000000000U is wrong
+  3. do not close socket in udhcpc.c ifc_get_addr()
+ 	                                  
+[V1.6.0.13]
+Date:   6/9/2020 
+enhancement:
+  1. add some example for openwrt, marco 'QL_OPENWER_NETWORK_SETUP'
+fix:
+
+[V1.6.0.12]
+Date:   5/29/2020 
+enhancement:
+fix:
+	1. some EM12's usb-net-qmi/mbim interface is at 8 (not 4)
+
+[V1.6.0.11]
+Date:   5/28/2020 
+enhancement:
+fix:
+	1. fix mbim debug on Big Endian CPU
+
+[V1.6.0.10]
+Date:   5/25/2020 
+enhancement:
+fix:
+	1. set QMAP .ul_data_aggregation_max_datagrams to 11 (from 16)
+
+[V1.6.0.9]
+Date:   5/22/2020 
+enhancement:
+fix:
+	1. dial fail when register to 5G-SA
+
+[V1.6.0.8]
+Date:   4/30/2020
+enhancement:
+  1. support '-b' to seletc brige mode
+fix:
+
+[V1.6.0.7]
+Date:   4/29/2020
+enhancement:
+  1. support QMAP multi-call for qmi_wwan_q and pcie_mhi 's rmnet driver
+fix:
+
+[V1.6.0.6]
+Date:   4/20/2020
+enhancement:
+  1. support '-k pdn_idx' to hangup call '-n pdn_idx'
+fix:
+  1. fix set dl_minimum_padding as 0, modems do not support this featrue
+
+[V1.6.0.5]
+Date:   4/10/2020
+enhancement:
+  1. support X55's QMAPV5 for PCIE
+fix:
+
+[V1.6.0.3]
+Date:   4/8/2020
+enhancement:
+  1. support multi-modems all use multi-data-calls
+fix:
+
+[V1.6.0.2]
+Date:   4/7/2020
+enhancement:
+  1. support X55's QMAPV5 for USB
+fix:
+
+[V1.6.0.1]
+Date:   4/1/2020
+enhancement:
+  1. support QMAP UL AGG (multi data call)
+fix:
+  1. some EM12's usb-net-qmi/mbim interface is at 8 (not 4)
+
+[V1.5.9]
+Date:   3/4/2020
+enhancement:
+  1. support pcie mhi multi-APN data call
+  3. support QMAP UL AGG (single data call)
+fix:
+  1. set 4 bytes aligned for mbim parameters, or cause dial mbim call fail
+
+[V1.5.8]
+Date:   2/18/2020
+enhancement:
+  1. support '-l 14' X55's loopback function
+fix:
+
+[V1.5.7]
+Date:   2/6/2020
+enhancement:
+  1. support '-u usbmon_log_file' to catch usbmon log
+fix:
+
+[V1.5.6]
+Date:   1/20/202
+enhancement:
+  1. show driver name and version
+  2. support PCSCF
+  3. support bridge in mbim
+fix:
+
+[V1.5.5]
+Date:   12/31/2019
+enhancement:
+fix:
+  1. fix some memory access bug in mbim-cm.c
+
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.5.4]
+Date:   12/17/2019
+enhancement:
+  1. Add copyright
+  2. auto detect pcie mhi /dev/mhi*
+fix:
+
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.5.3]
+Date:   2019/12/11
+enhancement:
+1. support show SignalInfo, controlled by macro CONFIG_SIGNALINFO
+2. support show 5G_NSA/5G_NA
+3. support Microsoft Extend MBIM message
+fix:
+1. quectel-qmi-proxy bugs on Big-Endian CPU
+
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.5.2]
+Date:   12/2/2019
+enhancement:
+  1. support requestGetSignalInfo()
+fix:
+
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.4.1]
+Date:   10/23/2019 
+enhancement:
+  1. support QMI_CTL_REVOKE_CLIENT_ID_IND (Quectel define QMI)
+  2. add copyright
+fix:
+  1. remove SIGUSR
+
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.3.10]
+Date:   10/14/2019
+enhancement:
+  1. increase retry interval
+fix:
+
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.2.1]
+Date:   2019/02/26
+enhancement:
+1. Implement help message.
+
+root@ubuntu:# ./quectel-CM -h
+[02-26_10:39:21:353] Usage: ./quectel-CM [options]
+[02-26_10:39:21:353] -s [apn [user password auth]]          Set apn/user/password/auth get from your network provider
+[02-26_10:39:21:353] -p pincode                             Verify sim card pin if sim card is locked
+[02-26_10:39:21:353] -f logfilename                         Save log message of this program to file
+[02-26_10:39:21:353] -i interface                           Specify network interface(default auto-detect)
+[02-26_10:39:21:353] -4                                     IPv4 protocol
+[02-26_10:39:21:353] -6                                     IPv6 protocol
+[02-26_10:39:21:353] -m muxID                               Specify muxid when set multi-pdn data connection.
+[02-26_10:39:21:353] -n channelID                           Specify channelID when set multi-pdn data connection(default 1).
+[02-26_10:39:21:353] [Examples]
+[02-26_10:39:21:353] Example 1: ./quectel-CM
+[02-26_10:39:21:353] Example 2: ./quectel-CM -s 3gnet
+[02-26_10:39:21:353] Example 3: ./quectel-CM -s 3gnet carl 1234 0 -p 1234 -f gobinet_log.txt
+root@ubuntu:#
+2. Support bridge mode when set multi-pdn data connections.
+3. Host device can access network in bridge mode.
+
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.1.46]
+Date:   2019/02/18
+enhancement:
+1. support only IPV6 data call. quectel-CM now support three dialing methods: IPV4 only, IPV6 only, IPV4V6.
+	./quectel-CM  -4(or no argument)  only IPV4
+				  -6	        only IPV6
+				  -4 -6               IPV4 && IPV6
+
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.1.45]
+Date:   2018/09/13
+enhancement:
+1. support EG12 PCIE interface
+
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.1.44]
+Date:   2018/09/10
+enhancement:
+1. support setup IPV4&IPV6 data call.
+
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.1.43]
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.1.42]
+Date:   2018/08/29
+enhancement:
+1. support QMI_WWAN's QMAP fucntion and bridge mode, please contact Quectel FAE to get qmi_wwan.c patch.
+   when enable QMI_WWAN's QMAP IP Mux function, must run 'quectel-qmi-proxy -d /dev/cdc-wdmX' before quectel-CM
+
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.1.41]
+Date:   2018/05/24
+enhancement:
+1. fix a cdma data call error
+
+[WCDMA&LTE_QConnectManager_Linux&Android_V1.1.40]
+Date:   2018/05/12
+enhancement:
+1. support GobiNet's QMAP fucntion and bridge mode.
+	 'Quectel_WCDMA&LTE_Linux&Android_GobiNet_Driver_V1.3.5' and later version is required to use QMAP and bridge mode.
+	 for detail, please refer to GobiNet Driver
+	 
diff --git a/RM520N-5G/文件/source/at_tok.c b/RM520N-5G/文件/source/at_tok.c
new file mode 100644
index 0000000..6736cc8
--- /dev/null
+++ b/RM520N-5G/文件/source/at_tok.c
@@ -0,0 +1,283 @@
+/* //device/system/reference-ril/at_tok.c
+**
+** Copyright 2006, The Android Open Source Project
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+#include "at_tok.h"
+#include <string.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <stdarg.h>
+
+/**
+ * Starts tokenizing an AT response string
+ * returns -1 if this is not a valid response string, 0 on success.
+ * updates *p_cur with current position
+ */
+int at_tok_start(char **p_cur)
+{
+    if (*p_cur == NULL) {
+        return -1;
+    }
+
+    // skip prefix
+    // consume "^[^:]:"
+
+    *p_cur = strchr(*p_cur, ':');
+
+    if (*p_cur == NULL) {
+        return -1;
+    }
+
+    (*p_cur)++;
+
+    return 0;
+}
+
+static void skipWhiteSpace(char **p_cur)
+{
+    if (*p_cur == NULL) return;
+
+    while (**p_cur != '\0' && isspace(**p_cur)) {
+        (*p_cur)++;
+    }
+}
+
+static void skipNextComma(char **p_cur)
+{
+    if (*p_cur == NULL) return;
+
+    while (**p_cur != '\0' && **p_cur != ',') {
+        (*p_cur)++;
+    }
+
+    if (**p_cur == ',') {
+        (*p_cur)++;
+    }
+}
+
+static char * nextTok(char **p_cur)
+{
+    char *ret = NULL;
+
+    skipWhiteSpace(p_cur);
+
+    if (*p_cur == NULL) {
+        ret = NULL;
+    } else if (**p_cur == '"') {
+        (*p_cur)++;
+        ret = strsep(p_cur, "\"");
+        skipNextComma(p_cur);
+    } else {
+        ret = strsep(p_cur, ",");
+    }
+
+    return ret;
+}
+
+
+/**
+ * Parses the next integer in the AT response line and places it in *p_out
+ * returns 0 on success and -1 on fail
+ * updates *p_cur
+ * "base" is the same as the base param in strtol
+ */
+
+static int at_tok_nextint_base(char **p_cur, int *p_out, int base, int  uns)
+{
+    char *ret;
+
+    if (*p_cur == NULL) {
+        return -1;
+    }
+
+    ret = nextTok(p_cur);
+
+    if (ret == NULL) {
+        return -1;
+    } else {
+        long l;
+        char *end;
+
+        if (uns)
+            l = strtoul(ret, &end, base);
+        else
+            l = strtol(ret, &end, base);
+
+        *p_out = (int)l;
+
+        if (end == ret) {
+            return -1;
+        }
+    }
+
+    return 0;
+}
+
+/**
+ * Parses the next base 10 integer in the AT response line
+ * and places it in *p_out
+ * returns 0 on success and -1 on fail
+ * updates *p_cur
+ */
+int at_tok_nextint(char **p_cur, int *p_out)
+{
+    return at_tok_nextint_base(p_cur, p_out, 10, 0);
+}
+
+/**
+ * Parses the next base 16 integer in the AT response line
+ * and places it in *p_out
+ * returns 0 on success and -1 on fail
+ * updates *p_cur
+ */
+int at_tok_nexthexint(char **p_cur, int *p_out)
+{
+    return at_tok_nextint_base(p_cur, p_out, 16, 1);
+}
+
+int at_tok_nextbool(char **p_cur, char *p_out)
+{
+    int ret;
+    int result;
+
+    ret = at_tok_nextint(p_cur, &result);
+
+    if (ret < 0) {
+        return -1;
+    }
+
+    // booleans should be 0 or 1
+    if (!(result == 0 || result == 1)) {
+        return -1;
+    }
+
+    if (p_out != NULL) {
+        *p_out = (char)result;
+    }
+
+    return ret;
+}
+
+int at_tok_nextstr(char **p_cur, char **p_out)
+{
+    if (*p_cur == NULL) {
+        return -1;
+    }
+
+    *p_out = nextTok(p_cur);
+
+    return 0;
+}
+
+/** returns 1 on "has more tokens" and 0 if no */
+int at_tok_hasmore(char **p_cur)
+{
+    return ! (*p_cur == NULL || **p_cur == '\0');
+}
+
+int at_tok_count(const char *in_line)
+{
+    int commas = 0;
+    const char *p;
+
+    if (!in_line)
+        return 0;
+
+    for (p = in_line; *p != '\0' ; p++) {
+        if (*p == ',') commas++;
+    }
+
+    return commas;
+}
+
+//fmt: d ~ int, x ~ hexint, b ~ bool, s ~ str
+int at_tok_scanf(const char *in_line, const char *fmt, ...)
+{
+    int n = 0;
+    int err;
+    va_list ap;
+    const char *p = fmt;
+    void *d;
+    void *dump;
+    static char s_line[1024];
+    char *line = s_line;
+
+    if (!in_line)
+        return 0;
+
+    strncpy(s_line, in_line, sizeof(s_line) - 1);
+
+    va_start(ap, fmt);
+
+    err = at_tok_start(&line);
+    if (err < 0) goto error;
+
+    for (; *p; p++) {
+        if (*p == ',' || *p == ' ')
+            continue;
+
+        if (*p != '%') {
+            goto error;
+        }
+        p++;
+
+        d = va_arg(ap, void *);
+        if (!d)
+            d = &dump;
+
+        if (!at_tok_hasmore(&line))
+            break;
+        
+        if (*line == '-' && *(line + 1) == ',') {
+            line += 2;
+            n++;
+            if (*p == 'd')
+                *(int *)d = -1;
+            continue;
+         }
+
+        switch(*p) {
+            case 'd':
+                err = at_tok_nextint(&line, (int *)d);
+                if (err < 0) goto error;
+           break;
+            case 'x':
+                err = at_tok_nexthexint(&line, (int *)d);
+                if (err < 0) goto error;
+            break;
+            case 'b':
+                err = at_tok_nextbool(&line, (char *)d);
+                if (err < 0) goto error;
+            break;
+            case 's':
+                err = at_tok_nextstr(&line, (char **)d); //if strdup(line), here return free memory to caller
+                if (err < 0) goto error;
+            break;
+            default:
+                goto error;
+            break;
+        }
+
+        n++;
+    }
+
+    va_end(ap);
+
+error:
+    //free(line);
+    return n;
+}
diff --git a/RM520N-5G/文件/source/at_tok.h b/RM520N-5G/文件/source/at_tok.h
new file mode 100644
index 0000000..2fcb683
--- /dev/null
+++ b/RM520N-5G/文件/source/at_tok.h
@@ -0,0 +1,33 @@
+/* //device/system/reference-ril/at_tok.h
+**
+** Copyright 2006, The Android Open Source Project
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+#ifndef AT_TOK_H
+#define AT_TOK_H 1
+
+int at_tok_start(char **p_cur);
+int at_tok_nextint(char **p_cur, int *p_out);
+int at_tok_nexthexint(char **p_cur, int *p_out);
+
+int at_tok_nextbool(char **p_cur, char *p_out);
+int at_tok_nextstr(char **p_cur, char **out);
+
+int at_tok_hasmore(char **p_cur);
+int at_tok_count(const char *in_line);
+int at_tok_scanf(const char *line, const char *fmt, ...);
+
+#endif /*AT_TOK_H */
+
diff --git a/RM520N-5G/文件/source/atc.c b/RM520N-5G/文件/source/atc.c
new file mode 100644
index 0000000..d6b9777
--- /dev/null
+++ b/RM520N-5G/文件/source/atc.c
@@ -0,0 +1,1056 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <fcntl.h>
+#include <stddef.h>
+#include <pthread.h>
+#include <errno.h>
+#include <time.h>
+#include <signal.h>
+#include <getopt.h>
+#include <poll.h>
+#include <sys/time.h>
+#include <endian.h>
+#include <time.h>
+#include <sys/types.h>
+#include <limits.h>
+#include <inttypes.h>
+
+extern int asprintf(char **s, const char *fmt, ...);
+
+#include "QMIThread.h"
+
+#include "atchannel.h"
+#include "at_tok.h"
+
+static int asr_style_atc = 0;
+static int s_pdp;
+#define safe_free(__x) do { if (__x) { free((void *)__x); __x = NULL;}} while(0)
+#define safe_at_response_free(__x) { if (__x) { at_response_free(__x); __x = NULL;}}
+
+#define at_response_error(err, p_response) \
+    (err \
+    || p_response == NULL \
+    || p_response->finalResponse == NULL \
+    || p_response->success == 0)
+
+static int atc_init(PROFILE_T *profile) {
+    int err;
+    char *cmd;
+    ATResponse *p_response = NULL;
+
+    if (profile->proxy[0])  {
+        s_pdp = profile->pdp;
+        err = at_send_command_singleline("AT+QNETDEVSTATUS=?", "+QNETDEVSTATUS:", &p_response);
+        if (at_response_error(err, p_response))
+            asr_style_atc = 1; //EC200T/EC100Y do not support this AT, but RG801/RG500U support
+        safe_at_response_free(p_response);
+		
+        return err;
+    }
+
+    err = at_handshake();
+    if (err) {
+        dbg_time("handshake fail, TODO ... ");
+        goto exit;
+    }
+	
+    s_pdp = profile->pdp;
+    at_send_command_singleline("AT+QCFG=\"usbnet\"", "+QCFG:", NULL);
+    at_send_command_multiline("AT+QNETDEVCTL=?", "+QNETDEVCTL:", NULL);
+    at_send_command("AT+CGREG=2", NULL); //GPRS Network Registration Status
+    at_send_command("AT+CEREG=2", NULL); //EPS Network Registration Status
+    at_send_command("AT+C5GREG=2", NULL); //5GS Network Registration Status
+
+    err = at_send_command_singleline("AT+QNETDEVSTATUS=?", "+QNETDEVSTATUS:", &p_response);
+    if (at_response_error(err, p_response))
+        asr_style_atc = 1; //EC200T/EC100Y do not support this AT, but RG801/RG500U support 
+    safe_at_response_free(p_response);
+
+    if(profile->usb_dev.idProduct == 0x6007)
+        asr_style_atc = 1;
+
+    err = at_send_command_singleline("AT+QCFG=\"NAT\"", "+QCFG:", &p_response);
+    if (!at_response_error(err, p_response)) {
+        int old_nat, new_nat = asr_style_atc ? 1 : 0;
+
+        err = at_tok_scanf(p_response->p_intermediates->line, "%s%d", NULL, &old_nat);
+        if (err == 2 && old_nat != new_nat) {
+            safe_at_response_free(p_response);
+            asprintf(&cmd, "AT+QCFG=\"NAT\",%d", new_nat);
+            err = at_send_command(cmd, &p_response);
+            safe_free(cmd);
+            if (!at_response_error(err, p_response)) {
+                err = at_send_command("at+cfun=1,1",NULL);
+                if (!err)
+                    g_donot_exit_when_modem_hangup = 1;
+                //reboot to take effect
+            }
+            safe_at_response_free(p_response);
+        }
+        err = 0;
+    }
+    safe_at_response_free(p_response);
+
+exit:
+    return err;
+}
+
+static int atc_deinit(void) {
+    return 0;
+}
+
+/**
+ * Called by atchannel when an unsolicited line appears
+ * This is called on atchannel's reader thread. AT commands may
+ * not be issued here
+ */
+static void onUnsolicited (const char *s, const char *sms_pdu)
+{
+    (void)sms_pdu;
+
+    if (strStartsWith(s, "+QNETDEVSTATUS:")) {
+        qmidevice_send_event_to_main(RIL_UNSOL_DATA_CALL_LIST_CHANGED);
+    }
+    else if (strStartsWith(s, "+CGREG:")
+        || strStartsWith(s, "+CEREG:")
+        || strStartsWith(s, "+C5GREG:")) {
+        qmidevice_send_event_to_main(RIL_UNSOL_RESPONSE_VOICE_NETWORK_STATE_CHANGED);
+    }
+}
+
+static void onTimeout(void) {
+    dbg_time("%s", __func__);
+    //TODO
+}
+
+static void onClose(void) {
+    dbg_time("%s", __func__);
+}
+
+static void * atc_read_thread(void *param) {
+    PROFILE_T *profile = (PROFILE_T *)param;
+    const char *cdc_wdm = (const char *)profile->qmichannel;
+    int wait_for_request_quit = 0;
+    int atc_fd;
+
+    atc_fd = cm_open_dev(cdc_wdm);
+    if (atc_fd <= 0) {
+        dbg_time("fail to open (%s), errno: %d (%s)", cdc_wdm, errno, strerror(errno));
+        goto __quit;
+    }
+
+    dbg_time("atc_fd = %d", atc_fd);
+
+    if (at_open(atc_fd, onUnsolicited, 0))
+        goto __quit;
+
+    at_set_on_timeout(onTimeout);
+    at_set_on_reader_closed(onClose);
+    qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_CONNECTED);
+
+    while (atc_fd > 0) {
+        struct pollfd pollfds[] = {{atc_fd, POLLIN, 0}, {qmidevice_control_fd[1], POLLIN, 0}};
+        int ne, ret, nevents = 2;
+
+        ret = poll(pollfds, nevents, wait_for_request_quit ? 1000 : -1);
+
+        if (ret == 0 && wait_for_request_quit) {
+            break;
+        }
+
+        if (ret < 0) {
+            dbg_time("%s poll=%d, errno: %d (%s)", __func__, ret, errno, strerror(errno));
+            break;
+        }
+
+        for (ne = 0; ne < nevents; ne++) {
+            int fd = pollfds[ne].fd;
+            short revents = pollfds[ne].revents;
+
+            if (revents & (POLLERR | POLLHUP | POLLNVAL)) {
+                dbg_time("%s poll err/hup/inval", __func__);
+                dbg_time("epoll fd = %d, events = 0x%04x", fd, revents);
+                if (revents & (POLLERR | POLLHUP | POLLNVAL))
+                goto __quit;
+            }
+
+            if ((revents & POLLIN) == 0)
+                continue;
+
+            if (atc_fd == fd) {
+                usleep(10*1000); //let atchannel.c read at response.
+            }
+            else if (fd == qmidevice_control_fd[1]) {
+                int triger_event;
+                if (read(fd, &triger_event, sizeof(triger_event)) == sizeof(triger_event)) {
+                    //dbg_time("triger_event = 0x%x", triger_event);
+                    switch (triger_event) {
+                        case RIL_REQUEST_QUIT:
+                            goto __quit;
+                        break;
+                        case SIG_EVENT_STOP:
+                            wait_for_request_quit = 1;
+                        break;
+                        default:
+                        break;
+                    }
+                }
+            }
+        }
+    }
+
+__quit:
+    at_close();
+    qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_DISCONNECTED);
+    dbg_time("%s exit", __func__);
+
+    return NULL;
+}
+
+const struct qmi_device_ops atc_dev_ops = {
+    .init = atc_init,
+    .deinit = atc_deinit,
+    .read = atc_read_thread,
+};
+
+static int requestBaseBandVersion(PROFILE_T *profile) {
+    int retVal = -1;
+    int err;
+    ATResponse *p_response = NULL;
+
+    (void)profile;
+
+    err = at_send_command_multiline("AT+CGMR", "\0", &p_response);
+    if (at_response_error(err, p_response))
+        goto exit;
+
+    if (p_response->p_intermediates && p_response->p_intermediates->line) {
+        strncpy(profile->BaseBandVersion, p_response->p_intermediates->line, sizeof(profile->BaseBandVersion) - 1);
+        retVal = 0;
+    }
+
+exit:
+    safe_at_response_free(p_response);
+    return retVal;
+}
+
+static int requestGetSIMStatus(SIM_Status *pSIMStatus)
+{
+    int err;
+    ATResponse *p_response = NULL;
+    char *cpinLine;
+    char *cpinResult;
+    int ret = SIM_NOT_READY;
+
+    err = at_send_command_singleline("AT+CPIN?", "+CPIN:", &p_response);
+    if (at_response_error(err, p_response))
+        goto done;
+
+    switch (at_get_cme_error(p_response))
+    {
+    case CME_SUCCESS:
+        break;
+
+    case CME_SIM_NOT_INSERTED:
+    case CME_OPERATION_NOT_ALLOWED:
+    case CME_FAILURE:
+        ret = SIM_ABSENT;
+        goto done;
+
+    default:
+        ret = SIM_NOT_READY;
+        goto done;
+    }
+
+    cpinLine = p_response->p_intermediates->line;
+    err = at_tok_start (&cpinLine);
+
+    if (err < 0)
+    {
+        ret = SIM_NOT_READY;
+        goto done;
+    }
+
+    err = at_tok_nextstr(&cpinLine, &cpinResult);
+
+    if (err < 0)
+    {
+        ret = SIM_NOT_READY;
+        goto done;
+    }
+
+    if (0 == strcmp (cpinResult, "SIM PIN"))
+    {
+        ret = SIM_PIN;
+        goto done;
+    }
+    else if (0 == strcmp (cpinResult, "SIM PUK"))
+    {
+        ret = SIM_PUK;
+        goto done;
+    }
+    else if (0 == strcmp (cpinResult, "PH-NET PIN"))
+    {
+        return SIM_NETWORK_PERSONALIZATION;
+    }
+    else if (0 != strcmp (cpinResult, "READY"))
+    {
+        /* we're treating unsupported lock types as "sim absent" */
+        ret = SIM_ABSENT;
+        goto done;
+    }
+
+    ret = SIM_READY;
+
+done:
+    safe_at_response_free(p_response);
+    *pSIMStatus = ret;
+    return err;
+}
+
+static int requestEnterSimPin(const char *pPinCode) {
+    int retVal = -1;
+    int err;
+    ATResponse *p_response = NULL;
+    char *cmd = NULL;
+
+    asprintf(&cmd, "AT+CPIN=%s", pPinCode);
+    err = at_send_command(cmd, NULL);
+    safe_free(cmd);
+
+    if (!at_response_error(err, p_response)) {
+        retVal = 0;
+    }
+
+    safe_at_response_free(p_response);
+    return retVal;
+}
+
+static int requestSetProfile(PROFILE_T *profile) {
+    int err;
+    ATResponse *p_response = NULL;
+    char *cmd = NULL;
+    const char *new_apn = profile->apn ? profile->apn : "";
+    const char *new_user = profile->user ? profile->user : "";
+    const char *new_pd = profile->pd ? profile->pd : "";
+    const char *ipStr[] = {"NULL", "IPV4", "IPV6", "IPV4V6"};
+
+    dbg_time("%s[%d] %s/%s/%s/%d/%s", __func__,
+        profile->pdp, profile->apn, profile->user, profile->pd,
+        profile->auth,ipStr[profile->iptype]);
+
+    if ( !strcmp(profile->old_apn, new_apn) && !strcmp(profile->old_user, new_user)
+        && !strcmp(profile->old_pd, new_pd)
+        && profile->old_iptype == profile->iptype
+        && profile->old_auth == profile->auth)
+    {
+        dbg_time("no need to set skip the rest");
+        return 0;
+    }
+
+    asprintf(&cmd, "AT+QICSGP=%d,%d,\"%s\",\"%s\",\"%s\",%d",
+        profile->pdp, profile->iptype, new_apn, new_user, new_pd, profile->auth);
+    err = at_send_command(cmd, &p_response);
+    safe_free(cmd);
+    if (at_response_error(err, p_response)) {
+        safe_at_response_free(p_response);
+        asprintf(&cmd, "AT+CGDCONT=%d,\"%s\",\"%s\"", profile->pdp, ipStr[profile->iptype], new_apn);
+        err = at_send_command(cmd, &p_response);
+        safe_free(cmd);
+    }
+
+    safe_at_response_free(p_response);
+    return 1;
+}
+
+static int requestGetProfile(PROFILE_T *profile) {
+    int retVal = -1;
+    int err;
+    ATResponse *p_response = NULL;
+    char *cmd = NULL;
+    int pdp;
+    int old_iptype = 1; // 1 ~ IPV4, 2 ~ IPV6, 3 ~ IPV4V6
+    char *old_apn = "", *old_user = "", *old_pd = "";
+    int old_auth = 0;
+    const char *ipStr[] = {"NULL", "IPV4", "IPV6", "IPV4V6"};
+
+    if (profile->enable_ipv4 && profile->enable_ipv6)
+        profile->iptype = 3;
+    else if (profile->enable_ipv6)
+        profile->iptype = 2;
+    else
+        profile->iptype = 1;
+
+_re_check:
+    asprintf(&cmd, "AT+QICSGP=%d", profile->pdp);
+    err = at_send_command_singleline(cmd, "+QICSGP:", &p_response);
+    safe_free(cmd);
+    if (err == AT_ERROR_INVALID_RESPONSE && p_response == NULL) {
+        //bug of RG801H
+        safe_at_response_free(p_response);
+        asprintf(&cmd, "AT+QICSGP=%d,%d,\"\",\"\",\"\",0", profile->pdp, profile->iptype);
+        err = at_send_command(cmd, &p_response);
+        safe_free(cmd);
+        if (!at_response_error(err, p_response)) {
+            safe_at_response_free(p_response);
+            goto _re_check;
+        }
+    }
+
+    if (!at_response_error(err, p_response)) {
+        err = at_tok_scanf(p_response->p_intermediates->line,
+            "%d%s%s%s%d", &old_iptype, &old_apn,  &old_user, &old_pd, &old_auth);
+
+        if (err != 4 || pdp != profile->pdp)
+            goto _error;
+    }
+    else {
+        ATLine *atLine = NULL;
+        char *cgdcont_iptype = NULL;
+
+        safe_at_response_free(p_response);
+        err = at_send_command_multiline("AT+CGDCONT?", "+CGDCONT:", &p_response);
+        if (at_response_error(err, p_response))
+            goto _error;
+
+        atLine = p_response->p_intermediates;
+        while (atLine) {
+            err = at_tok_scanf(atLine->line, "%d%s%s", &pdp, &cgdcont_iptype, &old_apn);
+            if (err == 3 && pdp == profile->pdp) {
+                if (!strcasecmp(cgdcont_iptype, ipStr[3]))
+                    old_iptype = 3;
+                else if (!strcasecmp(cgdcont_iptype, ipStr[2]))
+                     old_iptype = 2;
+                else
+                    old_iptype = 1;
+               break;
+            }
+            old_apn = NULL;
+            atLine = atLine->p_next;
+        }
+    }
+
+    retVal = 0;
+
+_error:
+    if (!old_apn) old_apn = "";
+    if (!old_user) old_user = "";
+    if (!old_pd) old_pd = "";
+
+    strncpy(profile->old_apn, old_apn, sizeof(profile->old_apn));
+    strncpy(profile->old_user, old_user, sizeof(profile->old_user));
+    strncpy(profile->old_pd, old_pd, sizeof(profile->old_pd));
+    profile->old_auth = old_auth;
+    profile->old_iptype = old_iptype; 
+
+    dbg_time("%s[%d] %s/%s/%s/%d/%s", __func__,
+        profile->pdp, profile->old_apn, profile->old_user, profile->old_pd,
+        profile->old_auth, ipStr[profile->old_iptype]);
+
+    safe_at_response_free(p_response);
+
+    return retVal;
+}
+
+static int requestRegistrationState(UCHAR *pPSAttachedState) {
+    int retVal = -1;
+    int err;
+    ATResponse *p_response = NULL;
+    ATLine *p_cur;
+    int i;
+    int cops_act = -1;
+    int state = 0, lac = 0, cid = 0, act = 0;
+    int commas;
+    char *line;
+
+    *pPSAttachedState = 0;
+
+    err = at_send_command_multiline(
+              "AT+COPS=3,0;+COPS?;+COPS=3,1;+COPS?;+COPS=3,2;+COPS?",
+              "+COPS:", &p_response);
+    if (at_response_error(err, p_response))
+        goto error;
+
+/*
+AT< +COPS: 0,0,"CHINA MOBILE",13
+AT< +COPS: 0,1,"CMCC",13
+AT< +COPS: 0,2,"46000",13
+AT< OK
+*/
+    retVal = 0;
+    for (i = 0, p_cur = p_response->p_intermediates; p_cur != NULL; p_cur = p_cur->p_next, i++) {
+        err = at_tok_scanf(p_cur->line, "%d%d%s%d", NULL, NULL, NULL, &cops_act);
+        if (err != 4) goto error;
+
+        break;
+    }
+
+    safe_at_response_free(p_response);
+    switch (cops_act) {
+        case 2: //UTRAN
+        case 3: //GSM W/EGPRS
+        case 4: //UTRAN W/HSDPA
+        case 5: //UTRAN W/HSUPA
+        case 6: //UTRAN W/HSDPA and HSUPA
+            //AT+CGREG  GPRS Network Registration Status
+            err = at_send_command_singleline("AT+CGREG?", "+CGREG:", &p_response);
+        break;
+
+        case 7: //E-UTRAN
+        case 13: //E-UTRAN-NR dual connectivity
+            //AT+CEREG  EPS Network Registration Status
+            err = at_send_command_singleline("AT+CEREG?", "+CEREG:", &p_response);
+        break;
+
+        case 10: //E-UTRAN connected to a 5GCN
+        case 11: //NR connected to a 5GCN
+        case 12: //NG-RAN
+            //AT+C5GREG  5GS Network Registration Status
+            err = at_send_command_singleline("AT+C5GREG?", "+C5GREG:", &p_response);
+        break;
+
+        default:
+            goto error;
+        break;
+    }
+
+    if (at_response_error(err, p_response))
+        goto error;
+    if (!p_response->p_intermediates || !p_response->p_intermediates->line) goto error;
+
+    line = p_response->p_intermediates->line;
+    commas = at_tok_count(line);
+     switch (commas) {
+        case 0: /* +CREG: <stat> */
+            err = at_tok_nextint(&line, &state);
+            if (err < 0) goto error;
+            break;
+
+        case 1: /* +CREG: <n>, <stat> */
+            err = at_tok_scanf(line, "%d%d", NULL, &state);
+            if (err != 2) goto error;
+            break;
+
+        case 2: /* +CREG: <stat>, <lac>, <cid> */
+            err = at_tok_scanf(line, "%d%x%x", NULL, &state, &lac, &cid);
+            if (err != 3) goto error;
+            break;
+
+        case 3: /* +CREG: <n>, <stat>, <lac>, <cid> */
+            err = at_tok_scanf(line, "%d%d%x%x", NULL, &state, &lac, &cid);
+            if (err != 4) goto error;
+            break;
+
+        case 4: //<n>, <stat>, <lac>, <cid>, <networkType> */
+        case 5:
+        case 6: 
+        case 7:
+            err = at_tok_scanf(line, "%d%d%x%x%d", NULL, &state, &lac, &cid, &act);
+            if (err != 5) goto error;
+        break;
+
+        default:
+            goto error;
+    }
+
+    //dbg_time("state=%d", state);
+
+    if (state == 1 || state == 5) { //Registered, home network  / roaming
+        *pPSAttachedState = 1;
+    }
+
+error:
+    safe_at_response_free(p_response);
+    return retVal;
+}
+
+static int requestSetupDataCall(PROFILE_T *profile, int curIpFamily) {
+    int err;
+    ATResponse *p_response = NULL;
+    char *cmd = NULL;
+    ATLine *p_cur = NULL;
+    int pdp = profile->pdp;
+    int state = 0;
+
+    (void)curIpFamily;
+
+    if (strStartsWith(profile->BaseBandVersion, "RG801H") || strStartsWith(profile->BaseBandVersion, "EC200H")) {
+        //RG801H will miss USB_CDC_NOTIFY_NETWORK_CONNECTION
+        asprintf(&cmd, "ifconfig %s up", profile->usbnet_adapter);
+        if (system(cmd)) {};
+        safe_free(cmd);
+    }
+
+    if (asr_style_atc) {
+        err = at_send_command_multiline("AT+CGACT?", "+CGACT:", &p_response);
+        if (at_response_error(err, p_response))
+            goto _error;
+
+        for (p_cur = p_response->p_intermediates; p_cur != NULL; p_cur = p_cur->p_next) {
+            int cid = 0;
+			state = 0;
+			
+            err = at_tok_scanf(p_cur->line, "%d%d", &cid, &state);
+            if (cid == pdp)
+                break;
+			else if(state)
+				state = 0;
+        }
+        safe_at_response_free(p_response);
+
+        if (state == 0) {
+            asprintf(&cmd, "AT+CGACT=1,%d", pdp);
+            err = at_send_command(cmd, &p_response);
+            safe_free(cmd);
+            if (at_response_error(err, p_response))
+                goto _error;
+        }
+    }
+
+    if(asr_style_atc)
+        asprintf(&cmd, "AT+QNETDEVCTL=1,%d,%d", pdp, 1);
+    else
+        asprintf(&cmd, "AT+QNETDEVCTL=%d,1,%d", pdp, 1);
+    err = at_send_command(cmd, &p_response);
+    safe_free(cmd);
+
+    if (at_response_error(err, p_response))
+        goto _error;
+
+    if (!asr_style_atc) { //TODO some modems do not sync return setup call resule
+        int t = 0;
+
+        while (t++ < 15) {
+            asprintf(&cmd, "AT+QNETDEVSTATUS=%d", pdp);
+            err = at_send_command_singleline(cmd, "+QNETDEVSTATUS", &p_response);
+            safe_free(cmd);
+            if (err) goto _error;
+
+            if (!at_response_error(err, p_response)) {
+                break;
+            }
+            safe_at_response_free(p_response);
+            sleep(1);
+        }
+    }
+
+    //some modem do not report URC
+    qmidevice_send_event_to_main(RIL_UNSOL_DATA_CALL_LIST_CHANGED);
+
+_error:
+    safe_at_response_free(p_response);
+    //dbg_time("%s err=%d", __func__, err);
+    return err;
+}
+
+static int at_netdevstatus(int pdp, unsigned int *pV4Addr) {
+    int err;
+    ATResponse *p_response = NULL;
+    char *cmd = NULL;
+    char *ipv4_address = NULL;
+    char *ipv4_gate = NULL;
+    char *ipv4_DHCP = NULL;
+    char *ipv4_pDNS = NULL;
+    char *ipv4_sDNS = NULL;
+    char *ipv6_address = NULL;
+    char *ipv6_gate = NULL;
+    char *ipv6_DHCP = NULL;
+    char *ipv6_pDNS = NULL;
+    char *ipv6_sDNS = NULL;
+
+    *pV4Addr = 0;
+
+    asprintf(&cmd, "AT+QNETDEVSTATUS=%d", pdp);
+    err = at_send_command_singleline(cmd, "+QNETDEVSTATUS", &p_response);
+    safe_free(cmd);
+    if (at_response_error(err, p_response)) goto _error;
+    if (!p_response->p_intermediates || !p_response->p_intermediates->line) goto _error;
+
+    err = at_tok_scanf(p_response->p_intermediates->line, "%s%s%s%s%s%s%s%s%s%s",
+        &ipv4_address, &ipv4_gate, &ipv4_DHCP, &ipv4_pDNS, &ipv4_sDNS,
+        &ipv6_address, &ipv6_gate, &ipv6_DHCP, &ipv6_pDNS, &ipv6_sDNS);
+    if (err > 0) {
+#if 0
+        dbg_time("%s,%s,%s,%s,%s,%s,%s,%s,%s,%s",
+            ipv4_address, ipv4_gate, ipv4_DHCP, ipv4_pDNS, ipv4_sDNS,
+            ipv6_address, ipv6_gate, ipv6_DHCP, ipv6_pDNS, ipv6_sDNS);
+#endif
+
+        if (ipv4_address && ipv4_address[0]) {
+            int addr[4] = {0, 0, 0, 0};
+
+            if (strstr(ipv4_address, ".")) {
+                sscanf(ipv4_address, "%d.%d.%d.%d", &addr[0], &addr[1], &addr[2], &addr[3]);
+            }
+            else {
+                sscanf(ipv4_address, "%02X%02X%02X%02X", &addr[3], &addr[2], &addr[1], &addr[0]);
+            }
+            *pV4Addr = (addr[0]) | (addr[1]<<8) | (addr[2]<<16) | (addr[3]<<24);
+       }
+    }
+
+_error:
+    safe_at_response_free(p_response);
+    return 0;
+}
+
+static int requestQueryDataCall(UCHAR  *pConnectionStatus, int curIpFamily) {
+    int err;
+    ATResponse *p_response = NULL;
+    ATLine *p_cur = NULL;
+    int state = 0;
+    int bind = 0;
+    int cid;
+    int pdp = s_pdp;
+    unsigned int v4Addr = 0;
+
+    (void)curIpFamily;
+
+    *pConnectionStatus = QWDS_PKT_DATA_DISCONNECTED;
+
+    if (!asr_style_atc) {
+        err = at_netdevstatus(pdp, &v4Addr);
+        if (!err && v4Addr) {
+            *pConnectionStatus = QWDS_PKT_DATA_CONNECTED;
+            //if (profile->ipv4.Address == v4Addr) {} //TODO
+        }
+        return err;
+    }
+
+    err = at_send_command_multiline("AT+QNETDEVCTL?", "+QNETDEVCTL:", &p_response);
+    if (at_response_error(err, p_response))
+        goto _error;
+
+    for (p_cur = p_response->p_intermediates; p_cur != NULL; p_cur = p_cur->p_next)
+    {
+        //+QNETDECTL:<op>,<cid>,<urc_en>,<state>
+        err = at_tok_scanf(p_cur->line, "%d%d%d%d", &bind, &cid, NULL, &state);
+        if (err != 4 || cid != pdp)
+            continue;
+        if (bind != 1)
+            bind = 0;
+    }
+    safe_at_response_free(p_response);
+
+    if (bind == 0 || state == 0)
+        goto _error;
+
+    err = at_send_command_multiline("AT+CGACT?", "+CGACT:", &p_response);
+    if (at_response_error(err, p_response))
+        goto _error;
+
+    for (p_cur = p_response->p_intermediates; p_cur != NULL; p_cur = p_cur->p_next)
+    {
+		state = 0;
+        err = at_tok_scanf(p_cur->line, "%d%d", &cid, &state);
+        if (cid == pdp)
+            break;
+		else if(state)
+			state = 0;
+    }
+    safe_at_response_free(p_response);
+
+    if (bind && state)
+        *pConnectionStatus = QWDS_PKT_DATA_CONNECTED;
+
+_error:
+    safe_at_response_free(p_response);
+    //dbg_time("%s err=%d, call_state=%d", __func__, err, *pConnectionStatus);
+    return 0;
+}
+
+static int requestDeactivateDefaultPDP(PROFILE_T *profile, int curIpFamily) {
+    char *cmd = NULL;
+    int pdp = profile->pdp;
+
+    (void)curIpFamily;
+
+    if (asr_style_atc)
+        asprintf(&cmd, "AT+QNETDEVCTL=0,%d,%d", pdp, 0);
+    else
+        asprintf(&cmd, "AT+QNETDEVCTL=%d,0,%d", pdp, 0);
+    at_send_command(cmd, NULL);
+    safe_free(cmd);
+
+    //dbg_time("%s err=%d", __func__, err);
+    return 0;
+}
+
+static int requestGetIPAddress(PROFILE_T *profile, int curIpFamily) {
+    int err;
+    ATResponse *p_response = NULL;
+    char *cmd = NULL;
+    ATLine *p_cur = NULL;
+    int pdp = profile->pdp;
+    unsigned int v4Addr = 0;
+    unsigned char *v4 = (unsigned char *)&v4Addr;
+
+    (void)curIpFamily;
+
+    if (!asr_style_atc) {
+        err = at_netdevstatus(pdp, &v4Addr);
+        goto _error;
+    }
+
+    asprintf(&cmd, "AT+CGPADDR=%d", profile->pdp);
+    err = at_send_command_singleline(cmd, "+CGPADDR:", &p_response);
+    safe_free(cmd);
+    if (at_response_error(err, p_response))
+        goto _error;
+
+    //+CGPADDR: 1,"10.201.80.91","2409:8930:4B3:41C7:F9B8:3D9B:A2F7:CA96"
+    for (p_cur = p_response->p_intermediates; p_cur != NULL; p_cur = p_cur->p_next)
+    {
+        char *ipv4 = NULL;
+        char *ipv6 = NULL;
+
+        err = at_tok_scanf(p_cur->line, "%d%s%s", &pdp, &ipv4, &ipv6);
+        if (err < 2 || pdp != profile->pdp)
+            continue;
+
+        if (ipv4) {
+            int addr[4] = {0, 0, 0, 0};
+
+            sscanf(ipv4, "%d.%d.%d.%d", &addr[0], &addr[1], &addr[2], &addr[3]);
+            v4[0] = addr[0];
+            v4[1] = addr[1];
+            v4[2] = addr[2];
+            v4[3] = addr[3];
+            break;
+        }
+    }
+
+_error:
+    if (v4Addr && profile->ipv4.Address != v4Addr) {
+        profile->ipv4.Address = v4Addr;
+        dbg_time("%s %d.%d.%d.%d", __func__, v4[0], v4[1], v4[2], v4[3]);    
+    }
+        
+    //dbg_time("%s err=%d", __func__, err);
+    return v4Addr ? 0 : -1;
+}
+
+static int requestGetSignalInfo(void) {
+    int retVal = -1;
+    int err;
+    ATResponse *p_response = NULL;
+    int i;
+    ATLine *p_cur = NULL;
+    char *rat = NULL;
+    int cops_act = 0;
+    int is_nr5g_nsa = 0, nr5g_sa = 0;
+    int verbose = 0;
+
+    err = at_send_command_singleline("at+cops?", "+COPS:", &p_response);
+    if (at_response_error(err, p_response)) goto _error;
+    if (!p_response->p_intermediates || !p_response->p_intermediates->line) goto _error;
+
+    retVal = 0;
+    err = at_tok_scanf(p_response->p_intermediates->line, "%d%d%s%d", NULL, NULL, NULL, &cops_act);
+    if (err != 4) goto _error;
+
+    nr5g_sa = (cops_act == 11);
+
+    safe_at_response_free(p_response);
+    err = at_send_command_multiline("at+qeng=\"servingcell\"", "+QENG:", &p_response);
+    if (at_response_error(err, p_response))
+        goto _error;
+
+    for (i = 0, p_cur = p_response->p_intermediates; p_cur != NULL; p_cur = p_cur->p_next, i++) {
+        char *type, *state;
+
+        err = at_tok_scanf(p_cur->line, "%s%s", &type, &state);
+        if (err != 2 || strcmp(type, "servingcell"))
+            continue;
+
+        if (!strcmp(state, "SEARCH") || !strcmp(state, "LIMSRV"))
+            continue;
+
+        if (!strcmp(state, "NOCONN") || !strcmp(state, "CONNECT")) {
+            err = at_tok_scanf(p_cur->line, "%s%s%s", &type, &state, &rat);
+            if (err != 3)
+                continue;        
+        }
+        else {
+            rat = state;
+        }
+       
+        if (!strcmp(rat, "NR5G-SA"))
+        {
+            //+QENG: "servingcell",<state>,"NR5G-SA",<duplex_mode>,<MCC>,<MNC>,<cellID>,<PCID>,<TAC>,<ARFCN>,<band>,<NR_DL_bandwidth>,<RSRP>,<RSRQ>,<SINR>,<tx_power>,<srxlev> 
+            //+QENG: "servingcell","NOCONN","NR5G-SA","TDD", 454,12,0,21,4ED,636576,78,3,-85,-11,32,0,5184
+            struct qeng_servingcell_nr5g_sa {
+                char *cell_type, *state, *rat, *is_tdd;
+                int MCC, MNC, cellID/*hex*/;
+                int PCID, TAC/*hex*/, ARFCN;
+                int band, NR_DL_bandwidth;
+                int RSRP, RSRQ, RSSI, SINR;
+            };
+            struct qeng_servingcell_nr5g_sa nr5g_sa;
+
+            memset(&nr5g_sa, 0, sizeof(nr5g_sa));
+            err = at_tok_scanf(p_cur->line, "%s,%s,%s,%s,%d,%d,%x,%d,%x,%d,%d,%d,%d,%d,%d,%d",
+                &nr5g_sa.cell_type, &nr5g_sa.state, &nr5g_sa.rat, &nr5g_sa.is_tdd,
+                &nr5g_sa.MCC, &nr5g_sa.MNC, &nr5g_sa.cellID, &nr5g_sa.PCID, &nr5g_sa.TAC,
+                &nr5g_sa.ARFCN, &nr5g_sa.band, &nr5g_sa.NR_DL_bandwidth,
+                &nr5g_sa.RSRP, &nr5g_sa.RSRQ, &nr5g_sa.RSSI, &nr5g_sa.SINR);
+
+            if (err >= 13 && verbose) {
+                dbg_time("%s,%s,%s,%s,%d,%d,%x,%d,%x,%d,%d,%d,%d,%d,%d,%d",
+                    nr5g_sa.cell_type, nr5g_sa.state, nr5g_sa.rat, nr5g_sa.is_tdd,
+                    nr5g_sa.MCC, nr5g_sa.MNC, nr5g_sa.cellID, nr5g_sa.PCID, nr5g_sa.TAC,
+                    nr5g_sa.ARFCN, nr5g_sa.band, nr5g_sa.NR_DL_bandwidth,
+                    nr5g_sa.RSRP, nr5g_sa.RSRQ, nr5g_sa.RSSI, nr5g_sa.SINR);
+            }
+        }
+        else if (!strcmp(rat, "NR5G-NSA"))
+        {
+            //+QENG: "NR5G-NSA",<MCC>,<MNC>,<PCID>,<RSRP>,< SINR>,<RSRQ>,<ARFCN>,<band>
+            struct qeng_servingcell_nr5g_nsa {
+                char *mcc, *mnc;
+                int pcid, rsrp, sinr, rsrq;
+            };
+            struct qeng_servingcell_nr5g_nsa nr5g_nsa;
+           
+            memset(&nr5g_nsa, 0, sizeof(nr5g_nsa));
+            err = at_tok_scanf(p_cur->line, "%s%s%s%s%d%d%d%dd",
+                NULL, NULL, &nr5g_nsa.mcc, &nr5g_nsa.mnc, &nr5g_nsa.pcid, &nr5g_nsa.rsrp, &nr5g_nsa.sinr, &nr5g_nsa.rsrq);
+            if (err == 8 && verbose)
+            {
+                dbg_time("mcc=%s, mnc=%s, pcid=%d, rsrp=%d, sinr=%d, rsrq=%d",
+                    nr5g_nsa.mcc, nr5g_nsa.mnc, nr5g_nsa.pcid, nr5g_nsa.rsrp, nr5g_nsa.sinr, nr5g_nsa.rsrq);
+            }
+
+            is_nr5g_nsa = 1;
+        }
+        else if (!strcmp(rat, "LTE"))
+        {
+            //+QENG: "LTE",<is_tdd>,<MCC>,<MNC>,<cellID>,<PCID>,<earfcn>,<freq_band_ind>,<UL_bandwidth>,<DL_bandwidth>,<TAC>,<RSRP>,<RSRQ>,<RSSI>,<SINR>,<CQI>,<tx_power>,<srxlev>
+            struct qeng_servingcell_lte {
+                char *is_tdd, *mcc, *mnc;
+                int cellID/*hex*/, pcid, earfcn, freq_band_ind, ul_bandwidth, dl_bandwidth;
+                int tac/*hex*/, rsrp, rsrq, rssi, sinr, cqi,tx_power,srxlev;
+            };
+            struct qeng_servingcell_lte lte;
+
+            memset(&lte, 0, sizeof(lte));
+            if (!strcmp(rat, state))
+                err = at_tok_scanf(p_cur->line, "%s%s%s%s%s%x%d%d%d%d%d%x%d%d%d%d%d%d%d",
+                    NULL, NULL, &lte.is_tdd, &lte.mcc, &lte.mnc,
+                    &lte.cellID, &lte.pcid, &lte.earfcn, &lte.freq_band_ind, &lte.ul_bandwidth, &lte.dl_bandwidth,
+                    &lte.tac, &lte.rsrp, &lte.rsrq, &lte.rssi, &lte.sinr, &lte.cqi, &lte.tx_power, &lte.srxlev);
+            else
+                 err = at_tok_scanf(p_cur->line, "%s%s%s%s%s%s%x%d%d%d%d%d%x%d%d%d%d%d%d%d",
+                    NULL, NULL, NULL, &lte.is_tdd, &lte.mcc, &lte.mnc,
+                    &lte.cellID, &lte.pcid, &lte.earfcn, &lte.freq_band_ind, &lte.ul_bandwidth, &lte.dl_bandwidth,
+                    &lte.tac, &lte.rsrp, &lte.rsrq, &lte.rssi, &lte.sinr, &lte.cqi, &lte.tx_power, &lte.srxlev);
+            
+                if (err >= 18 && verbose)
+                {
+                    dbg_time("is_tdd=%s, mcc=%s, mnc=%s", lte.is_tdd, lte.mcc, lte.mnc);
+                    dbg_time("cellID=%x, pcid=%d, earfcn=%d", lte.cellID, lte.pcid, lte.earfcn);
+                    dbg_time("freq_band_ind=%d, ul_bandwidth=%d, dl_bandwidth=%d", lte.freq_band_ind, lte.ul_bandwidth, lte.dl_bandwidth);
+                    dbg_time("tac=%x, rsrp=%d, rsrq=%d, rssi=%d, sinr=%d", lte.tac, lte.rsrp, lte.rsrq, lte.rssi, lte.sinr);
+                    dbg_time("cqi=%d, tx_power=%d, earfcn=%d", lte.cqi, lte.tx_power, lte.srxlev);
+                }
+        }
+    }
+
+    if (is_nr5g_nsa) {
+        int endc_avl, plmn_info_list_r15_avl, endc_rstr, nr5g_basic;
+
+        is_nr5g_nsa = 0;
+        safe_at_response_free(p_response);
+        err = at_send_command_multiline("at+qendc", "+QENDC:", &p_response);
+        if (at_response_error(err, p_response)) goto _error;
+        if (!p_response->p_intermediates || !p_response->p_intermediates->line) goto _error;
+
+        err = at_tok_scanf(p_response->p_intermediates->line, "%d%d%d%d",
+            &endc_avl, &plmn_info_list_r15_avl, &endc_rstr, &nr5g_basic);
+        if (err == 4 && nr5g_basic) {
+            is_nr5g_nsa = 1;
+        }
+    }
+
+    if (verbose)
+        dbg_time("cops_act=%d, nr5g_nsa=%d, nr5g_sa=%d", cops_act, is_nr5g_nsa, nr5g_sa);
+
+_error:
+    safe_at_response_free(p_response);
+    return retVal;
+}
+
+static int requestGetICCID(void) {
+    int retVal = -1;
+    int err;
+    ATResponse *p_response = NULL;
+    char *iccid;
+
+    err = at_send_command_singleline("AT+QCCID", "+QCCID:", &p_response);
+    if (at_response_error(err, p_response)) goto _error;
+    if (!p_response->p_intermediates || !p_response->p_intermediates->line) goto _error;
+
+    err = at_tok_scanf(p_response->p_intermediates->line, "%s", &iccid);
+    if (err != 1) goto _error;
+
+    if (iccid && iccid[0]) {
+        dbg_time("%s %s", __func__, iccid);
+        retVal = 0;
+    }
+
+_error:
+    safe_at_response_free(p_response);
+    return retVal;
+}
+
+static int requestGetIMSI(void) {
+    int retVal = -1;
+    int err;
+    ATResponse *p_response = NULL;
+    char *imsi;
+
+    err = at_send_command_numeric("AT+CIMI", &p_response);
+    if (at_response_error(err, p_response)) goto _error;
+    if (!p_response->p_intermediates || !p_response->p_intermediates->line) goto _error;
+
+    imsi = p_response->p_intermediates->line;
+    if (imsi) {
+        dbg_time("%s %s", __func__, imsi);
+        retVal = 0;
+    }
+
+_error:
+    safe_at_response_free(p_response);
+    return retVal;
+}
+
+const struct request_ops atc_request_ops = {
+    .requestBaseBandVersion = requestBaseBandVersion,
+    .requestGetSIMStatus = requestGetSIMStatus,
+    .requestEnterSimPin = requestEnterSimPin,
+    .requestSetProfile = requestSetProfile,
+    .requestGetProfile = requestGetProfile,
+    .requestRegistrationState = requestRegistrationState,
+    .requestSetupDataCall = requestSetupDataCall,
+    .requestQueryDataCall = requestQueryDataCall,
+    .requestDeactivateDefaultPDP = requestDeactivateDefaultPDP,
+    .requestGetIPAddress = requestGetIPAddress,
+    .requestGetSignalInfo = requestGetSignalInfo,
+    .requestGetICCID = requestGetICCID,
+    .requestGetIMSI = requestGetIMSI,
+};
+
diff --git a/RM520N-5G/文件/source/atchannel.c b/RM520N-5G/文件/source/atchannel.c
new file mode 100644
index 0000000..90aa1c4
--- /dev/null
+++ b/RM520N-5G/文件/source/atchannel.c
@@ -0,0 +1,1037 @@
+/* //device/system/reference-ril/atchannel.c
+**
+** Copyright 2006, The Android Open Source Project
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+#include "atchannel.h"
+#include "at_tok.h"
+
+#include <stdio.h>
+#include <string.h>
+#include <pthread.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/time.h>
+#include <time.h>
+#include <unistd.h>
+#include <sys/timeb.h>
+#include <stdarg.h>
+
+#include "QMIThread.h"
+#define LOGE dbg_time
+#define LOGD dbg_time
+
+#define NUM_ELEMS(x) (sizeof(x)/sizeof(x[0]))
+
+#define MAX_AT_RESPONSE sizeof(cm_recv_buf)
+#define HANDSHAKE_RETRY_COUNT 8
+#define HANDSHAKE_TIMEOUT_MSEC 1000
+
+static pthread_t s_tid_reader;
+static int s_fd = -1;    /* fd of the AT channel */
+static ATUnsolHandler s_unsolHandler;
+static int s_atc_proxy = 0;    /* fd of the AT channel */
+
+/* for input buffering */
+
+static char *s_ATBuffer = (char *)cm_recv_buf;
+static char *s_ATBufferCur = (char *)cm_recv_buf;
+
+static int s_readCount = 0;
+
+#if AT_DEBUG
+void  AT_DUMP(const char*  prefix, const char*  buff, int  len)
+{
+    if (len < 0)
+        len = strlen(buff);
+    LOGD("%.*s", len, buff);
+}
+#endif
+
+/*
+ * for current pending command
+ * these are protected by s_commandmutex
+ */
+static ATCommandType s_type;
+static const char *s_responsePrefix = NULL;
+static const char *s_smsPDU = NULL;
+static const char *s_raw_data = NULL;
+static size_t s_raw_len;
+static ATResponse *sp_response = NULL;
+
+static void (*s_onTimeout)(void) = NULL;
+static void (*s_onReaderClosed)(void) = NULL;
+static int s_readerClosed;
+
+static void onReaderClosed();
+static int writeCtrlZ (const char *s);
+static int writeline (const char *s);
+static int writeraw (const char *s, size_t len);
+
+static void sleepMsec(long long msec)
+{
+    struct timespec ts;
+    int err;
+
+    ts.tv_sec = (msec / 1000);
+    ts.tv_nsec = (msec % 1000) * 1000 * 1000;
+
+    do {
+        err = nanosleep (&ts, &ts);
+    } while (err < 0 && errno == EINTR);
+}
+
+/** returns 1 if line starts with prefix, 0 if it does not */
+int strStartsWith(const char *line, const char *prefix)
+{
+    for ( ; *line != '\0' && *prefix != '\0' ; line++, prefix++) {
+        if (*line != *prefix) {
+            return 0;
+        }
+    }
+
+    return *prefix == '\0';
+}
+
+/** add an intermediate response to sp_response*/
+static void addIntermediate(const char *line)
+{
+    ATLine *p_new;
+
+    p_new = (ATLine  *) malloc(sizeof(ATLine));
+
+    p_new->line = strdup(line);
+
+    /* note: this adds to the head of the list, so the list
+       will be in reverse order of lines received. the order is flipped
+       again before passing on to the command issuer */
+    p_new->p_next = sp_response->p_intermediates;
+    sp_response->p_intermediates = p_new;
+}
+
+
+/**
+ * returns 1 if line is a final response indicating error
+ * See 27.007 annex B
+ * WARNING: NO CARRIER and others are sometimes unsolicited
+ */
+static const char * s_finalResponsesError[] = {
+    "ERROR",
+    "+CMS ERROR:",
+    "+CME ERROR:",
+    "NO CARRIER", /* sometimes! */
+    "NO ANSWER",
+    "NO DIALTONE",
+    "COMMAND NOT SUPPORT",
+};
+static int isFinalResponseError(const char *line)
+{
+    size_t i;
+
+    for (i = 0 ; i < NUM_ELEMS(s_finalResponsesError) ; i++) {
+        if (strStartsWith(line, s_finalResponsesError[i])) {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+/**
+ * returns 1 if line is a final response indicating success
+ * See 27.007 annex B
+ * WARNING: NO CARRIER and others are sometimes unsolicited
+ */
+static const char * s_finalResponsesSuccess[] = {
+    "OK",
+    "+QIND: \"FOTA\",\"END\",0",
+    "CONNECT"       /* some stacks start up data on another channel */
+};
+
+static int isFinalResponseSuccess(const char *line)
+{
+    size_t i;
+
+    for (i = 0 ; i < NUM_ELEMS(s_finalResponsesSuccess) ; i++) {
+        if (strStartsWith(line, s_finalResponsesSuccess[i])) {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+#if 0
+/**
+ * returns 1 if line is a final response, either  error or success
+ * See 27.007 annex B
+ * WARNING: NO CARRIER and others are sometimes unsolicited
+ */
+static int isFinalResponse(const char *line)
+{
+    return isFinalResponseSuccess(line) || isFinalResponseError(line);
+}
+#endif
+
+/**
+ * returns 1 if line is the first line in (what will be) a two-line
+ * SMS unsolicited response
+ */
+static const char * s_smsUnsoliciteds[] = {
+   "+CMT:",
+    "+CDS:",
+    "+CBM:",
+    "+CMTI:"
+};
+static int isSMSUnsolicited(const char *line)
+{
+    size_t i;
+
+    for (i = 0 ; i < NUM_ELEMS(s_smsUnsoliciteds) ; i++) {
+        if (strStartsWith(line, s_smsUnsoliciteds[i])) {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+
+/** assumes s_commandmutex is held */
+static void handleFinalResponse(const char *line)
+{
+    sp_response->finalResponse = strdup(line);
+
+    pthread_cond_signal(&cm_command_cond);
+}
+
+static void handleUnsolicited(const char *line)
+{
+    if (s_unsolHandler != NULL) {
+        s_unsolHandler(line, NULL);
+    }
+}
+
+static void processLine(const char *line)
+{
+    pthread_mutex_lock(&cm_command_mutex);
+
+    if (sp_response == NULL) {
+        /* no command pending */
+        handleUnsolicited(line);
+    } else if (s_raw_data != NULL && 0 == strcmp(line, "CONNECT")) {
+        usleep(500*1000); //for EC20
+        writeraw(s_raw_data, s_raw_len);
+        s_raw_data = NULL;
+    } else if (isFinalResponseSuccess(line)) {
+        if(s_atc_proxy)
+            handleUnsolicited(line);
+        sp_response->success = 1;
+        handleFinalResponse(line);
+    } else if (isFinalResponseError(line)) {
+        if(s_atc_proxy) 
+            handleUnsolicited(line);
+        sp_response->success = 0;
+        handleFinalResponse(line);
+    } else if (s_smsPDU != NULL && 0 == strcmp(line, "> ")) {
+        // See eg. TS 27.005 4.3
+        // Commands like AT+CMGS have a "> " prompt
+        writeCtrlZ(s_smsPDU);
+        s_smsPDU = NULL;
+    } else switch (s_type) {
+        case NO_RESULT:
+            handleUnsolicited(line);
+            break;
+        case NUMERIC:
+            if (sp_response->p_intermediates == NULL
+                && isdigit(line[0])
+            ) {
+                addIntermediate(line);
+            } else {
+                /* either we already have an intermediate response or
+                   the line doesn't begin with a digit */
+                handleUnsolicited(line);
+            }
+            break;
+        case SINGLELINE:
+            if (sp_response->p_intermediates == NULL
+                && strStartsWith (line, s_responsePrefix)
+            ) {
+                addIntermediate(line);
+            } else {
+                /* we already have an intermediate response */
+                handleUnsolicited(line);
+            }
+            break;
+        case MULTILINE:
+            if (strStartsWith (line, s_responsePrefix)) {
+                addIntermediate(line);
+            } else {
+                handleUnsolicited(line);
+            }
+        break;
+
+        default: /* this should never be reached */
+            LOGE("Unsupported AT command type %d\n", s_type);
+            handleUnsolicited(line);
+        break;
+    }
+
+    pthread_mutex_unlock(&cm_command_mutex);
+}
+
+
+/**
+ * Returns a pointer to the end of the next line
+ * special-cases the "> " SMS prompt
+ *
+ * returns NULL if there is no complete line
+ */
+static char * findNextEOL(char *cur)
+{
+    if (cur[0] == '>' && cur[1] == ' ' && cur[2] == '\0') {
+        /* SMS prompt character...not \r terminated */
+        return cur+2;
+    }
+
+    // Find next newline
+    while (*cur != '\0' && *cur != '\r' && *cur != '\n') cur++;
+
+    return *cur == '\0' ? NULL : cur;
+}
+
+
+/**
+ * Reads a line from the AT channel, returns NULL on timeout.
+ * Assumes it has exclusive read access to the FD
+ *
+ * This line is valid only until the next call to readline
+ *
+ * This function exists because as of writing, android libc does not
+ * have buffered stdio.
+ */
+
+static const char *readline()
+{
+    ssize_t count;
+
+    char *p_read = NULL;
+    char *p_eol = NULL;
+    char *ret;
+
+    /* this is a little odd. I use *s_ATBufferCur == 0 to
+     * mean "buffer consumed completely". If it points to a character, than
+     * the buffer continues until a \0
+     */
+    if (*s_ATBufferCur == '\0') {
+        /* empty buffer */
+        s_ATBufferCur = s_ATBuffer;
+        *s_ATBufferCur = '\0';
+        p_read = s_ATBuffer;
+    } else {   /* *s_ATBufferCur != '\0' */
+        /* there's data in the buffer from the last read */
+
+        // skip over leading newlines
+        while (*s_ATBufferCur == '\r' || *s_ATBufferCur == '\n')
+            s_ATBufferCur++;
+
+        p_eol = findNextEOL(s_ATBufferCur);
+
+        if (p_eol == NULL) {
+            /* a partial line. move it up and prepare to read more */
+            size_t len;
+
+            len = strlen(s_ATBufferCur);
+
+            memmove(s_ATBuffer, s_ATBufferCur, len + 1);
+            p_read = s_ATBuffer + len;
+            s_ATBufferCur = s_ATBuffer;
+        }
+        /* Otherwise, (p_eol !- NULL) there is a complete line  */
+        /* that will be returned the while () loop below        */
+    }
+
+    while (p_eol == NULL) {
+        if (0 == MAX_AT_RESPONSE - (p_read - s_ATBuffer)) {
+            LOGE("ERROR: Input line exceeded buffer\n");
+            /* ditch buffer and start over again */
+            s_ATBufferCur = s_ATBuffer;
+            *s_ATBufferCur = '\0';
+            p_read = s_ATBuffer;
+        }
+
+        do {
+            while (s_fd > 0) {
+                struct pollfd pollfds[1] = {{s_fd, POLLIN, 0}};
+                int ret;
+            
+                do {
+                    ret = poll(pollfds, 1, -1);
+                } while ((ret < 0) && (errno == EINTR));
+
+                if (pollfds[0].revents & (POLLERR | POLLHUP | POLLNVAL)) {
+                    break;
+                } else if   (pollfds[0].revents & (POLLIN))  {
+                    break;
+                }
+            };
+
+            count = (s_fd == -1) ? 0 : read(s_fd, p_read,
+                            MAX_AT_RESPONSE - (p_read - s_ATBuffer));
+        } while (count < 0 && errno == EINTR);
+
+        if (count > 0) {
+            AT_DUMP( "<< ", p_read, count );
+            s_readCount += count;
+
+            p_read[count] = '\0';
+
+            // skip over leading newlines
+            while (*s_ATBufferCur == '\r' || *s_ATBufferCur == '\n')
+                s_ATBufferCur++;
+
+            p_eol = findNextEOL(s_ATBufferCur);
+            p_read += count;
+        } else if (count <= 0) {
+            /* read error encountered or EOF reached */
+            if(count == 0) {
+                LOGD("atchannel: EOF reached");
+            } else {
+                LOGD("atchannel: read error %s", strerror(errno));
+            }
+            return NULL;
+        }
+    }
+
+    /* a full line in the buffer. Place a \0 over the \r and return */
+
+    ret = s_ATBufferCur;
+    *p_eol = '\0';
+    s_ATBufferCur = p_eol + 1; /* this will always be <= p_read,    */
+                              /* and there will be a \0 at *p_read */
+
+    LOGD("AT< %s", ret);
+    return ret;
+}
+
+
+static void onReaderClosed()
+{
+    LOGE("%s", __func__);
+    if (s_onReaderClosed != NULL && s_readerClosed == 0) {
+
+        pthread_mutex_lock(&cm_command_mutex);
+
+        s_readerClosed = 1;
+
+        pthread_cond_signal(&cm_command_cond);
+
+        pthread_mutex_unlock(&cm_command_mutex);
+
+        s_onReaderClosed();
+    }
+}
+
+
+static void *readerLoop(void *arg)
+{
+    (void)arg;
+
+    for (;;) {
+        const char * line;
+
+        line = readline();
+
+        if (line == NULL) {
+            break;
+        }
+
+        if(isSMSUnsolicited(line)) {
+            char *line1;
+            const char *line2;
+
+            // The scope of string returned by 'readline()' is valid only
+            // till next call to 'readline()' hence making a copy of line
+            // before calling readline again.
+            line1 = strdup(line);
+            line2 = readline();
+
+            if (line2 == NULL) {
+                break;
+            }
+
+            if (s_unsolHandler != NULL) {
+                s_unsolHandler (line1, line2);
+            }
+            free(line1);
+        } else {
+            processLine(line);
+        }
+    }
+
+    onReaderClosed();
+
+    return NULL;
+}
+
+/**
+ * Sends string s to the radio with a \r appended.
+ * Returns AT_ERROR_* on error, 0 on success
+ *
+ * This function exists because as of writing, android libc does not
+ * have buffered stdio.
+ */
+static int writeline (const char *s)
+{
+    size_t cur = 0;
+    size_t len = strlen(s);
+    ssize_t written;
+    static char at_command[64];
+
+    if (s_fd < 0 || s_readerClosed > 0) {
+        return AT_ERROR_CHANNEL_CLOSED;
+    }
+
+    LOGD("AT> %s", s);
+
+    AT_DUMP( ">> ", s, strlen(s) );
+
+#if 1 //send '\r' maybe fail via USB controller: Intel Corporation 7 Series/C210 Series Chipset Family USB xHCI Host Controller (rev 04)
+    if (len < (sizeof(at_command) - 1)) {
+        strcpy(at_command, s);
+        at_command[len++] = '\r';
+        s = (const char *)at_command;
+    }
+#endif
+
+    /* the main string */
+    while (cur < len) {
+        do {
+            written = write (s_fd, s + cur, len - cur);
+        } while (written < 0 && errno == EINTR);
+
+        if (written < 0) {
+            return AT_ERROR_GENERIC;
+        }
+
+        cur += written;
+    }
+
+#if 1 //Quectel send '\r' maybe fail via USB controller: Intel Corporation 7 Series/C210 Series Chipset Family USB xHCI Host Controller (rev 04)
+    if (s == (const char *)at_command) {
+        return 0;
+    }
+#endif
+
+    /* the \r  */
+
+    do {
+        written = write (s_fd, "\r" , 1);
+    } while ((written < 0 && errno == EINTR) || (written == 0));
+    
+    if (written < 0) {
+        return AT_ERROR_GENERIC;
+    }
+
+    return 0;
+}
+static int writeCtrlZ (const char *s)
+{
+    size_t cur = 0;
+    size_t len = strlen(s);
+    ssize_t written;
+
+    if (s_fd < 0 || s_readerClosed > 0) {
+        return AT_ERROR_CHANNEL_CLOSED;
+    }
+
+    LOGD("AT> %s^Z", s);
+
+    AT_DUMP( ">* ", s, strlen(s) );
+
+    /* the main string */
+    while (cur < len) {
+        do {
+            written = write (s_fd, s + cur, len - cur);
+        } while (written < 0 && errno == EINTR);
+
+        if (written < 0) {
+            return AT_ERROR_GENERIC;
+        }
+
+        cur += written;
+    }
+
+    /* the ^Z  */
+
+    do {
+        written = write (s_fd, "\032" , 1);
+    } while ((written < 0 && errno == EINTR) || (written == 0));
+
+    if (written < 0) {
+        return AT_ERROR_GENERIC;
+    }
+
+    return 0;
+}
+
+static int writeraw (const char *s, size_t len) {
+    size_t cur = 0;
+    ssize_t written;
+
+    if (s_fd < 0 || s_readerClosed > 0) {
+        return AT_ERROR_CHANNEL_CLOSED;
+    }
+
+    /* the main string */
+    while (cur < len) {
+        struct pollfd pollfds[1] = {{s_fd, POLLOUT, 0}};
+        int ret;
+
+        ret = poll(pollfds, 1, -1);
+        if (ret <= 0)
+            break;
+            
+        do {
+            written = write (s_fd, s + cur, len - cur);
+        } while (written < 0 && errno == EINTR);
+
+        if (written < 0) {
+            return AT_ERROR_GENERIC;
+        }
+
+        cur += written;
+    }
+
+    if (written < 0) {
+        return AT_ERROR_GENERIC;
+    }
+
+    return cur;
+}
+
+static void clearPendingCommand()
+{
+    if (sp_response != NULL) {
+        at_response_free(sp_response);
+    }
+
+    sp_response = NULL;
+    s_responsePrefix = NULL;
+    s_smsPDU = NULL;
+}
+
+
+/**
+ * Starts AT handler on stream "fd'
+ * returns 0 on success, -1 on error
+ */
+int at_open(int fd, ATUnsolHandler h, int proxy)
+{
+    int ret;
+    pthread_attr_t attr;
+
+    s_fd = fd;
+    s_unsolHandler = h;
+    s_readerClosed = 0;
+	s_atc_proxy = proxy;
+
+    s_responsePrefix = NULL;
+    s_smsPDU = NULL;
+    sp_response = NULL;
+    
+    pthread_attr_init (&attr);
+    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+
+    ret = pthread_create(&s_tid_reader, &attr, readerLoop, NULL);
+
+    if (ret < 0) {
+        LOGE("readerLoop create fail!");
+        perror ("pthread_create\n");
+        return -1;
+    }
+
+    return 0;
+}
+
+/* FIXME is it ok to call this from the reader and the command thread? */
+void at_close()
+{
+    dbg_time("at_close");
+    if (s_fd >= 0) {
+        close(s_fd);
+    }
+    s_fd = -1;
+
+    pthread_mutex_lock(&cm_command_mutex);
+
+    s_readerClosed = 1;
+
+    pthread_cond_signal(&cm_command_cond);
+
+    pthread_mutex_unlock(&cm_command_mutex);
+
+    /* the reader thread should eventually die */
+}
+
+static ATResponse * at_response_new()
+{
+    return (ATResponse *) calloc(1, sizeof(ATResponse));
+}
+
+void at_response_free(ATResponse *p_response)
+{
+    ATLine *p_line;
+
+    if (p_response == NULL) return;
+
+    p_line = p_response->p_intermediates;
+
+    while (p_line != NULL) {
+        ATLine *p_toFree;
+
+        p_toFree = p_line;
+        p_line = p_line->p_next;
+
+        free(p_toFree->line);
+        free(p_toFree);
+    }
+
+    free (p_response->finalResponse);
+    free (p_response);
+}
+
+/**
+ * The line reader places the intermediate responses in reverse order
+ * here we flip them back
+ */
+static void reverseIntermediates(ATResponse *p_response)
+{
+    ATLine *pcur,*pnext;
+
+    pcur = p_response->p_intermediates;
+    p_response->p_intermediates = NULL;
+
+    while (pcur != NULL) {
+        pnext = pcur->p_next;
+        pcur->p_next = p_response->p_intermediates;
+        p_response->p_intermediates = pcur;
+        pcur = pnext;
+    }
+}
+
+/**
+ * Internal send_command implementation
+ * Doesn't lock or call the timeout callback
+ *
+ * timeoutMsec == 0 means infinite timeout
+ */
+static int at_send_command_full_nolock (const char *command, ATCommandType type,
+                    const char *responsePrefix, const char *smspdu,
+                    long long timeoutMsec, ATResponse **pp_outResponse)
+{
+    int err = 0;
+
+    if (!timeoutMsec)
+        timeoutMsec = 15000;
+
+    if(sp_response != NULL) {
+        err = AT_ERROR_COMMAND_PENDING;
+        goto error;
+    }
+
+    if (command != NULL)
+        err = writeline (command);
+
+    if (err < 0) {
+        printf("%s errno: %d (%s)\n", __func__, errno, strerror(errno));
+        goto error;
+    }
+
+    s_type = type;
+    s_responsePrefix = responsePrefix;
+    s_smsPDU = smspdu;
+    sp_response = at_response_new();
+
+    while (sp_response->finalResponse == NULL && s_readerClosed == 0) {
+        err = pthread_cond_timeout_np(&cm_command_cond, &cm_command_mutex, timeoutMsec);
+
+        if (err == ETIMEDOUT) {
+            err = AT_ERROR_TIMEOUT;
+            goto error;
+        }
+    }
+
+    if (pp_outResponse == NULL) {
+        at_response_free(sp_response);
+    } else {
+        /* line reader stores intermediate responses in reverse order */
+        reverseIntermediates(sp_response);
+        *pp_outResponse = sp_response;
+    }
+
+    sp_response = NULL;
+
+    if(s_readerClosed > 0) {
+        err = AT_ERROR_CHANNEL_CLOSED;
+        goto error;
+    }
+
+    err = 0;
+error:
+    clearPendingCommand();
+
+    return err;
+}
+
+/**
+ * Internal send_command implementation
+ *
+ * timeoutMsec == 0 means infinite timeout
+ */
+static int at_send_command_full (const char *command, ATCommandType type,
+                    const char *responsePrefix, const char *smspdu,
+                    long long timeoutMsec, ATResponse **pp_outResponse)
+{
+    int err;
+
+    if (0 != pthread_equal(s_tid_reader, pthread_self())) {
+        /* cannot be called from reader thread */
+        return AT_ERROR_INVALID_THREAD;
+    }
+
+    pthread_mutex_lock(&cm_command_mutex);
+
+    err = at_send_command_full_nolock(command, type,
+                    responsePrefix, smspdu,
+                    timeoutMsec, pp_outResponse);
+
+    pthread_mutex_unlock(&cm_command_mutex);
+
+    if (err == AT_ERROR_TIMEOUT && s_onTimeout != NULL) {
+        s_onTimeout();
+    }
+
+    return err;
+}
+
+
+/**
+ * Issue a single normal AT command with no intermediate response expected
+ *
+ * "command" should not include \r
+ * pp_outResponse can be NULL
+ *
+ * if non-NULL, the resulting ATResponse * must be eventually freed with
+ * at_response_free
+ */
+int at_send_command (const char *command, ATResponse **pp_outResponse)
+{
+    int err;
+
+    err = at_send_command_full (command, NO_RESULT, NULL,
+                                    NULL, 0, pp_outResponse);
+
+    return err;
+}
+
+
+int at_send_command_singleline (const char *command,
+                                const char *responsePrefix,
+                                 ATResponse **pp_outResponse)
+{
+    int err;
+
+    err = at_send_command_full (command, SINGLELINE, responsePrefix,
+                                    NULL, 0, pp_outResponse);
+
+    if (err == 0 && pp_outResponse != NULL
+        && (*pp_outResponse)->success > 0
+        && (*pp_outResponse)->p_intermediates == NULL
+    ) {
+        /* successful command must have an intermediate response */
+        at_response_free(*pp_outResponse);
+        *pp_outResponse = NULL;
+        return AT_ERROR_INVALID_RESPONSE;
+    }
+
+    return err;
+}
+
+
+int at_send_command_numeric (const char *command,
+                                 ATResponse **pp_outResponse)
+{
+    int err;
+
+    err = at_send_command_full (command, NUMERIC, NULL,
+                                    NULL, 0, pp_outResponse);
+
+    if (err == 0 && pp_outResponse != NULL
+        && (*pp_outResponse)->success > 0
+        && (*pp_outResponse)->p_intermediates == NULL
+    ) {
+        /* successful command must have an intermediate response */
+        at_response_free(*pp_outResponse);
+        *pp_outResponse = NULL;
+        return AT_ERROR_INVALID_RESPONSE;
+    }
+
+    return err;
+}
+
+
+int at_send_command_sms (const char *command,
+                                const char *pdu,
+                                const char *responsePrefix,
+                                 ATResponse **pp_outResponse)
+{
+    int err;
+
+    err = at_send_command_full (command, SINGLELINE, responsePrefix,
+                                    pdu, 0, pp_outResponse);
+
+    if (err == 0 && pp_outResponse != NULL
+        && (*pp_outResponse)->success > 0
+        && (*pp_outResponse)->p_intermediates == NULL
+    ) {
+        /* successful command must have an intermediate response */
+        at_response_free(*pp_outResponse);
+        *pp_outResponse = NULL;
+        return AT_ERROR_INVALID_RESPONSE;
+    }
+
+    return err;
+}
+
+int at_send_command_multiline (const char *command,
+                                const char *responsePrefix,
+                                 ATResponse **pp_outResponse)
+{
+    int err;
+
+    err = at_send_command_full (command, MULTILINE, responsePrefix,
+                                    NULL, 0, pp_outResponse);
+
+    return err;
+}
+
+int at_send_command_raw (const char *command,
+                                const char *raw_data, unsigned int raw_len,
+                                const char *responsePrefix,
+                                 ATResponse **pp_outResponse)
+{
+    int err;
+
+    s_raw_data = raw_data;
+    s_raw_len = raw_len;
+    err = at_send_command_full (command, SINGLELINE, responsePrefix,
+                                    NULL, 0, pp_outResponse);
+
+    return err;
+}
+
+/**
+ * Periodically issue an AT command and wait for a response.
+ * Used to ensure channel has start up and is active
+ */
+
+int at_handshake()
+{
+    int i;
+    int err = 0;
+
+    if (0 != pthread_equal(s_tid_reader, pthread_self())) {
+        /* cannot be called from reader thread */
+        return AT_ERROR_INVALID_THREAD;
+    }
+
+    pthread_mutex_lock(&cm_command_mutex);
+
+    for (i = 0 ; i < HANDSHAKE_RETRY_COUNT ; i++) {
+        /* some stacks start with verbose off */
+        err = at_send_command_full_nolock ("ATE0Q0V1", NO_RESULT,
+                    NULL, NULL, HANDSHAKE_TIMEOUT_MSEC, NULL);
+
+        if (err == 0) {
+            break;
+        }
+    }
+
+    pthread_mutex_unlock(&cm_command_mutex);
+
+    if (err == 0) {
+        /* pause for a bit to let the input buffer drain any unmatched OK's
+           (they will appear as extraneous unsolicited responses) */
+
+        sleepMsec(HANDSHAKE_TIMEOUT_MSEC);
+    }
+
+    return err;
+}
+
+AT_CME_Error at_get_cme_error(const ATResponse *p_response)
+{
+    int ret;
+    int err;
+    char *p_cur;
+
+    if (p_response == NULL)
+        return CME_ERROR_NON_CME;
+
+    if (p_response->success > 0) {
+        return CME_SUCCESS;
+    }
+
+    if (p_response->finalResponse == NULL
+        || !strStartsWith(p_response->finalResponse, "+CME ERROR:")
+    ) {
+        return CME_ERROR_NON_CME;
+    }
+
+    p_cur = p_response->finalResponse;
+    err = at_tok_start(&p_cur);
+
+    if (err < 0) {
+        return CME_ERROR_NON_CME;
+    }
+
+    err = at_tok_nextint(&p_cur, &ret);
+
+    if (err < 0) {
+        return CME_ERROR_NON_CME;
+    }
+
+    return (AT_CME_Error) ret;
+}
+
+/** This callback is invoked on the command thread */
+void at_set_on_timeout(void (*onTimeout)(void))
+{
+    s_onTimeout = onTimeout;
+}
+
+/**
+ *  This callback is invoked on the reader thread (like ATUnsolHandler)
+ *  when the input stream closes before you call at_close
+ *  (not when you call at_close())
+ *  You should still call at_close()
+ */
+void at_set_on_reader_closed(void (*onClose)(void))
+{
+    s_onReaderClosed = onClose;
+}
diff --git a/RM520N-5G/文件/source/atchannel.h b/RM520N-5G/文件/source/atchannel.h
new file mode 100644
index 0000000..cce28b1
--- /dev/null
+++ b/RM520N-5G/文件/source/atchannel.h
@@ -0,0 +1,152 @@
+/* //device/system/reference-ril/atchannel.h
+**
+** Copyright 2006, The Android Open Source Project
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+#ifndef ATCHANNEL_H
+#define ATCHANNEL_H 1
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* define AT_DEBUG to send AT traffic to /tmp/radio-at.log" */
+#define AT_DEBUG  0
+
+#if AT_DEBUG
+extern void  AT_DUMP(const char* prefix, const char*  buff, int  len);
+#else
+#define  AT_DUMP(prefix,buff,len)  do{}while(0)
+#endif
+
+#define AT_ERROR_GENERIC -1
+#define AT_ERROR_COMMAND_PENDING -2
+#define AT_ERROR_CHANNEL_CLOSED -3
+#define AT_ERROR_TIMEOUT -4
+#define AT_ERROR_INVALID_THREAD -5 /* AT commands may not be issued from
+                                       reader thread (or unsolicited response
+                                       callback */
+#define AT_ERROR_INVALID_RESPONSE -6 /* eg an at_send_command_singleline that
+                                        did not get back an intermediate
+                                        response */
+
+
+typedef enum {
+    NO_RESULT,   /* no intermediate response expected */
+    NUMERIC,     /* a single intermediate response starting with a 0-9 */
+    SINGLELINE,  /* a single intermediate response starting with a prefix */
+    MULTILINE    /* multiple line intermediate response
+                    starting with a prefix */
+} ATCommandType;
+
+/** a singly-lined list of intermediate responses */
+typedef struct ATLine  {
+    struct ATLine *p_next;
+    char *line;
+} ATLine;
+
+/** Free this with at_response_free() */
+typedef struct {
+    int success;              /* true if final response indicates
+                                    success (eg "OK") */
+    char *finalResponse;      /* eg OK, ERROR */
+    ATLine  *p_intermediates; /* any intermediate responses */
+} ATResponse;
+
+/**
+ * a user-provided unsolicited response handler function
+ * this will be called from the reader thread, so do not block
+ * "s" is the line, and "sms_pdu" is either NULL or the PDU response
+ * for multi-line TS 27.005 SMS PDU responses (eg +CMT:)
+ */
+typedef void (*ATUnsolHandler)(const char *s, const char *sms_pdu);
+
+int at_open(int fd, ATUnsolHandler h, int proxy);
+void at_close();
+
+/* This callback is invoked on the command thread.
+   You should reset or handshake here to avoid getting out of sync */
+void at_set_on_timeout(void (*onTimeout)(void));
+/* This callback is invoked on the reader thread (like ATUnsolHandler)
+   when the input stream closes before you call at_close
+   (not when you call at_close())
+   You should still call at_close()
+   It may also be invoked immediately from the current thread if the read
+   channel is already closed */
+void at_set_on_reader_closed(void (*onClose)(void));
+
+int at_send_command_singleline (const char *command,
+                                const char *responsePrefix,
+                                 ATResponse **pp_outResponse);
+
+int at_send_command_numeric (const char *command,
+                                 ATResponse **pp_outResponse);
+
+int at_send_command_multiline (const char *command,
+                                const char *responsePrefix,
+                                 ATResponse **pp_outResponse);
+
+int at_send_command_raw (const char *command,
+                                const char *raw_data, unsigned int raw_len,
+                                const char *responsePrefix,
+                                 ATResponse **pp_outResponse);
+
+int at_handshake();
+
+int at_send_command (const char *command, ATResponse **pp_outResponse);
+
+int at_send_command_sms (const char *command, const char *pdu,
+                            const char *responsePrefix,
+                            ATResponse **pp_outResponse);
+
+void at_response_free(ATResponse *p_response);
+
+int strStartsWith(const char *line, const char *prefix);
+
+typedef enum {
+    CME_ERROR_NON_CME = -1,
+    CME_SUCCESS = 0,
+
+    CME_OPERATION_NOT_ALLOWED = 3,
+    CME_OPERATION_NOT_SUPPORTED = 4,
+    CME_PH_SIM_PIN= 5,
+    CME_PH_FSIM_PIN = 6,
+    CME_PH_FSIM_PUK = 7,
+    CME_SIM_NOT_INSERTED =10,
+    CME_SIM_PIN_REQUIRED = 11,
+    CME_SIM_PUK_REQUIRED = 12,
+    CME_FAILURE = 13,
+    CME_SIM_BUSY = 14,
+    CME_SIM_WRONG = 15,
+    CME_INCORRECT_PASSWORD = 16,
+    CME_SIM_PIN2_REQUIRED = 17,
+    CME_SIM_PUK2_REQUIRED = 18,
+    CME_MEMORY_FULL = 20,
+    CME_INVALID_INDEX = 21,
+    CME_NOT_FOUND = 22,
+    CME_MEMORY_FAILURE = 23,
+    CME_STRING_TO_LONG = 24,
+    CME_INVALID_CHAR = 25,
+    CME_DIALSTR_TO_LONG = 26,
+    CME_INVALID_DIALCHAR = 27,
+} AT_CME_Error;
+
+AT_CME_Error at_get_cme_error(const ATResponse *p_response);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /*ATCHANNEL_H*/
diff --git a/RM520N-5G/文件/source/device.c b/RM520N-5G/文件/source/device.c
new file mode 100644
index 0000000..eada281
--- /dev/null
+++ b/RM520N-5G/文件/source/device.c
@@ -0,0 +1,756 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <unistd.h>
+#include <sys/types.h>
+#include <fcntl.h>
+#include <dirent.h>
+#include <errno.h>
+#include <strings.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <linux/usbdevice_fs.h>
+#include <linux/types.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <time.h>
+#include <pthread.h>
+
+#include "QMIThread.h"
+#include "ethtool-copy.h"
+
+#define USB_CLASS_VENDOR_SPEC		0xff
+#define USB_CLASS_COMM			2
+#define USB_CDC_SUBCLASS_ACM			0x02
+#define USB_CDC_SUBCLASS_ETHERNET       0x06
+#define USB_CDC_SUBCLASS_NCM			0x0d
+#define USB_CDC_SUBCLASS_MBIM			0x0e
+#define USB_CLASS_WIRELESS_CONTROLLER	0xe0
+
+#define CM_MAX_PATHLEN 256
+
+#define CM_INVALID_VAL (~((int)0))
+
+static int RDNIS_MODEL = 0;
+
+/* get first line from file 'fname'
+ * And convert the content into a hex number, then return this number */
+static int file_get_value(const char *fname, int base)
+{
+    FILE *fp = NULL;
+    long num;
+    char buff[32 + 1] = {'\0'};
+    char *endptr = NULL;
+
+    fp = fopen(fname, "r");
+    if (!fp) goto error;
+    if (fgets(buff, sizeof(buff), fp) == NULL)
+        goto error;
+    fclose(fp);
+
+    num = (int)strtol(buff, &endptr, base);
+    if (errno == ERANGE && (num == LONG_MAX || num == LONG_MIN))
+        goto error;
+    /* if there is no digit in buff */
+    if (endptr == buff)
+        goto error;
+
+    if (debug_qmi)
+        dbg_time("(%s) = %lx", fname, num);
+    return (int)num;
+
+error:
+    if (fp) fclose(fp);
+    return CM_INVALID_VAL;
+}
+
+/*
+ * This function will search the directory 'dirname' and return the first child.
+ * '.' and '..' is ignored by default
+ */
+static int dir_get_child(const char *dirname, char *buff, unsigned bufsize, const char *prefix)
+{
+    struct dirent *entptr = NULL;
+    DIR *dirptr;
+
+    buff[0] = 0;
+
+    dirptr = opendir(dirname);
+    if (!dirptr)
+        return -1;
+
+    while ((entptr = readdir(dirptr))) {
+        if (entptr->d_name[0] == '.')
+            continue;
+        if (prefix && strlen(prefix) && strncmp(entptr->d_name, prefix, strlen(prefix)))
+            continue;
+        snprintf(buff, bufsize, "%.31s", entptr->d_name);
+        break;
+    }
+    closedir(dirptr);
+
+    return 0;
+}
+
+static int conf_get_val(const char *fname, const char *key)
+{
+    char buff[128] = {'\0'};
+    FILE *fp = fopen(fname, "r");
+    if (!fp)
+        return CM_INVALID_VAL;
+
+    while (fgets(buff, sizeof(buff)-1, fp)) {
+        char prefix[128] = {'\0'};
+        char tail[128] = {'\0'};
+        /* To eliminate cppcheck warnning: Assume string length is no more than 15 */
+        sscanf(buff, "%15[^=]=%15s", prefix, tail);
+        if (!strncasecmp(prefix, key, strlen(key))) {
+            fclose(fp);
+            return atoi(tail);
+        }
+    }
+
+    fclose(fp);
+    return CM_INVALID_VAL;
+}
+
+static void query_usb_device_info(char *path, struct usb_device_info *p) {
+    size_t offset = strlen(path);
+
+    memset(p, 0, sizeof(*p));
+
+    path[offset] = '\0';
+    strcat(path, "/idVendor");
+    p->idVendor = file_get_value(path, 16);
+
+    if (p->idVendor == CM_INVALID_VAL)
+        return;
+
+    path[offset] = '\0';
+    strcat(path, "/idProduct");
+    p->idProduct = file_get_value(path, 16);
+
+    path[offset] = '\0';
+    strcat(path, "/busnum");
+    p->busnum = file_get_value(path, 10);
+
+    path[offset] = '\0';
+    strcat(path, "/devnum");
+    p->devnum = file_get_value(path, 10);
+
+    path[offset] = '\0';
+    strcat(path, "/bNumInterfaces");
+    p->bNumInterfaces = file_get_value(path, 10);
+
+    path[offset] = '\0';
+}
+
+static void query_usb_interface_info(char *path, struct usb_interface_info *p) {
+    char driver[128];
+    size_t offset = strlen(path);
+    int n;
+
+    memset(p, 0, sizeof(*p));
+
+    path[offset] = '\0';
+    strcat(path, "/bNumEndpoints");
+    p->bInterfaceClass = file_get_value(path, 16);
+
+    path[offset] = '\0';
+    strcat(path, "/bInterfaceClass");
+    p->bInterfaceClass = file_get_value(path, 16);
+
+    path[offset] = '\0';
+    strcat(path, "/bInterfaceSubClass");
+    p->bInterfaceSubClass = file_get_value(path, 16);
+
+    path[offset] = '\0';
+    strcat(path, "/bInterfaceProtocol");
+    p->bInterfaceProtocol = file_get_value(path, 16);
+
+    path[offset] = '\0';
+    strcat(path, "/driver");
+    n = readlink(path, driver, sizeof(driver));
+    if (n > 0) {
+        driver[n] = 0;
+        if (debug_qmi) dbg_time("driver -> %s", driver);
+        n = strlen(driver);
+        while (n > 0) {
+            if (driver[n] == '/')
+                break;
+            n--;
+        }
+        strncpy(p->driver, &driver[n+1], sizeof(p->driver) - 1);
+    }
+
+    path[offset] = '\0';
+}
+
+static int detect_path_cdc_wdm_or_qcqmi(char *path, char *devname, size_t bufsize)
+{
+    size_t offset = strlen(path);
+    char tmp[32];
+    
+    devname[0] = 0;
+
+    if (access(path, R_OK))
+        return -1;
+
+    path[offset] = '\0';
+    strcat(path, "/GobiQMI");
+    if (!access(path, R_OK))
+        goto step_1;
+
+    path[offset] = '\0';
+    strcat(path, "/usbmisc");
+    if (!access(path, R_OK))
+        goto step_1;
+
+    path[offset] = '\0';
+    strcat(path, "/usb");
+    if (!access(path, R_OK))
+        goto step_1;
+
+    return -1;
+
+step_1: 
+    /* get device(qcqmiX|cdc-wdmX) */
+    if (debug_qmi) dbg_time("%s", path);
+    dir_get_child(path, tmp, sizeof(tmp), NULL);
+    if (tmp[0] == '\0')
+        return -1;
+
+    /* There is a chance that, no device(qcqmiX|cdc-wdmX) is generated. We should warn user about that! */
+    snprintf(devname, bufsize, "/dev/%s", tmp);
+    if (access(devname, R_OK | F_OK) && errno == ENOENT)
+    {
+        int major, minor;
+
+        dbg_time("access %s  failed, errno: %d (%s)", devname, errno, strerror(errno));
+        strcat(path, "/");
+        strcat(path, tmp);
+        strcat(path, "/uevent");
+        major = conf_get_val(path, "MAJOR");
+        minor = conf_get_val(path, "MINOR");
+
+        if(major == CM_INVALID_VAL || minor == CM_INVALID_VAL)
+            dbg_time("get major and minor failed");
+         else if (mknod(devname, S_IFCHR|0666, (((major & 0xfff) << 8) | (minor & 0xff) | ((minor & 0xfff00) << 12))))
+            dbg_time("please mknod %s c %d %d", devname, major, minor);
+    }
+
+    return 0;
+}
+
+/* To detect the device info of the modem.
+ * return:
+ *  FALSE -> fail
+ *  TRUE -> ok
+ */
+BOOL qmidevice_detect(char *qmichannel, char *usbnet_adapter, unsigned bufsize, PROFILE_T *profile) {
+    struct dirent* ent = NULL;
+    DIR *pDir;
+    const char *rootdir = "/sys/bus/usb/devices";
+    struct {
+        char path[255*2];
+    } *pl;
+    pl = (typeof(pl)) malloc(sizeof(*pl));
+    memset(pl, 0x00, sizeof(*pl));
+
+    pDir = opendir(rootdir);
+    if (!pDir) {
+        dbg_time("opendir %s failed: %s", rootdir, strerror(errno));
+        goto error;
+    }
+
+    while ((ent = readdir(pDir)) != NULL)  {
+        char netcard[32+1] = {'\0'};
+        char devname[32+5] = {'\0'}; //+strlen("/dev/")
+        int netIntf;
+        int driver_type;
+
+        if (ent->d_name[0] == 'u')
+            continue;
+
+        snprintf(pl->path, sizeof(pl->path), "%s/%s", rootdir, ent->d_name);
+        query_usb_device_info(pl->path, &profile->usb_dev);
+        if (profile->usb_dev.idVendor == CM_INVALID_VAL)
+            continue;
+
+        if (profile->usb_dev.idVendor == 0x2c7c || profile->usb_dev.idVendor == 0x05c6) {
+            dbg_time("Find %s/%s idVendor=0x%x idProduct=0x%x, bus=0x%03x, dev=0x%03x",
+                rootdir, ent->d_name, profile->usb_dev.idVendor, profile->usb_dev.idProduct,
+                profile->usb_dev.busnum, profile->usb_dev.devnum);
+        }
+
+        /* get network interface */
+        /* NOTICE: there is a case that, bNumberInterface=6, but the net interface is 8 */
+        /* toolchain-mips_24kc_gcc-5.4.0_musl donot support GLOB_BRACE */
+        /* RG500U's MBIM is at inteface 0 */
+        for (netIntf = 0;  netIntf < (profile->usb_dev.bNumInterfaces + 8); netIntf++) {
+            snprintf(pl->path, sizeof(pl->path), "%s/%s:1.%d/net", rootdir, ent->d_name, netIntf);
+            dir_get_child(pl->path, netcard, sizeof(netcard), NULL);
+            if (netcard[0])
+                break;
+        }
+
+        if (netcard[0] == '\0') { //for centos 2.6.x
+            const char *n= "usb0";
+            const char *c = "qcqmi0";
+
+            snprintf(pl->path, sizeof(pl->path), "%s/%s:1.4/net:%s", rootdir, ent->d_name, n);
+            if (!access(pl->path, F_OK)) {
+                snprintf(pl->path, sizeof(pl->path), "%s/%s:1.4/GobiQMI:%s", rootdir, ent->d_name, c);
+                if (!access(pl->path, F_OK)) {
+                    snprintf(qmichannel, bufsize, "/dev/%s", c);
+                    snprintf(usbnet_adapter, bufsize, "%s", n);
+                    snprintf(pl->path, sizeof(pl->path), "%s/%s:1.4", rootdir, ent->d_name);
+                    query_usb_interface_info(pl->path, &profile->usb_intf);
+                    break;
+                }
+            }
+        }
+
+        if (netcard[0] == '\0')
+            continue;
+
+        /* not '-i iface' */
+        if (usbnet_adapter[0] && strcmp(usbnet_adapter, netcard))
+            continue;
+
+        snprintf(pl->path, sizeof(pl->path), "%s/%s:1.%d", rootdir, ent->d_name, netIntf);
+        query_usb_interface_info(pl->path, &profile->usb_intf);
+        driver_type = get_driver_type(profile);
+
+        if (driver_type == SOFTWARE_QMI || driver_type == SOFTWARE_MBIM) {
+            detect_path_cdc_wdm_or_qcqmi(pl->path, devname, sizeof(devname));
+        }
+        else if (driver_type == SOFTWARE_ECM_RNDIS_NCM)
+        {
+            int atIntf = -1;
+
+            if (profile->usb_dev.idVendor == 0x2c7c) { //Quectel
+                switch (profile->usb_dev.idProduct) { //EC200U
+                case 0x0901: //EC200U
+                case 0x0902: //EC200D
+                case 0x8101: //RG801H
+                    atIntf = 2;
+                break;
+                case 0x0900: //RG500U
+                    atIntf = 4;
+                break;
+                case 0x6026: //EC200T
+                case 0x6005: //EC200A
+                case 0x6002: //EC200S
+                case 0x6001: //EC100Y
+                    atIntf = 3;
+                break;
+
+                case 0x6007: //EG915Q\EG800Q
+                    if(RDNIS_MODEL == 1)
+                        atIntf = 5;
+                    else
+                        atIntf = 3;
+                break;
+
+                default:
+                   dbg_time("unknow at interface for USB idProduct:%04x\n", profile->usb_dev.idProduct);
+                break;
+                }
+            }
+
+            if (atIntf != -1) {
+                snprintf(pl->path, sizeof(pl->path), "%s/%s:1.%d", rootdir, ent->d_name, atIntf);
+                dir_get_child(pl->path, devname, sizeof(devname), "tty");
+                if (devname[0] && !strcmp(devname, "tty")) {
+                    snprintf(pl->path, sizeof(pl->path), "%s/%s:1.%d/tty", rootdir, ent->d_name, atIntf);
+                    dir_get_child(pl->path, devname, sizeof(devname), "tty");
+                }
+            }
+        }
+        
+        if (netcard[0] && devname[0]) {
+            if (devname[0] == '/')
+                snprintf(qmichannel, bufsize, "%s", devname);
+            else
+                snprintf(qmichannel, bufsize, "/dev/%s", devname);
+            snprintf(usbnet_adapter, bufsize, "%s", netcard);
+            dbg_time("Auto find qmichannel = %s", qmichannel);
+            dbg_time("Auto find usbnet_adapter = %s", usbnet_adapter);
+            break;
+        }
+    }
+    closedir(pDir);
+
+    if (qmichannel[0] == '\0' || usbnet_adapter[0] == '\0') {
+        dbg_time("network interface '%s' or qmidev '%s' is not exist", usbnet_adapter, qmichannel);
+        goto error;
+    }
+    free(pl);
+    return TRUE;
+error:
+    free(pl);
+    return FALSE;
+}
+
+int mhidevice_detect(char *qmichannel, char *usbnet_adapter, PROFILE_T *profile) {
+    struct dirent* ent = NULL;
+    DIR *pDir;
+    const char *rootdir_mhi[] = {"/sys/bus/mhi_q/devices", "/sys/bus/mhi/devices", NULL};
+    int i = 0;
+    char path[256];
+    int find = 0;
+
+    while (rootdir_mhi[i]) {
+        const char *rootdir = rootdir_mhi[i++];
+
+        pDir = opendir(rootdir);
+        if (!pDir) {
+            if (errno != ENOENT)
+                    dbg_time("opendir %s failed: %s", rootdir, strerror(errno));
+            continue;
+        }
+
+        while ((ent = readdir(pDir)) != NULL)  {
+            char netcard[32] = {'\0'};
+            char devname[32] = {'\0'};
+            int software_interface = SOFTWARE_QMI;
+            char *pNode = NULL;
+
+            pNode = strstr(ent->d_name, "_IP_HW0"); //0306_00.01.00_IP_HW0
+            if (!pNode)
+                continue;
+
+            snprintf(path, sizeof(path), "%s/%.32s/net", rootdir, ent->d_name);
+            dir_get_child(path, netcard, sizeof(netcard), NULL);
+            if (!netcard[0])
+                continue;
+
+            if (usbnet_adapter[0] && strcmp(netcard, usbnet_adapter)) //not '-i x'
+                continue;
+
+            if (!strcmp(rootdir, "/sys/bus/mhi/devices")) {
+                snprintf(path, sizeof(path), "%s/%.13s_IPCR", rootdir, ent->d_name); // 13 is sizeof(0306_00.01.00)
+                if (!access(path, F_OK)) {
+                    /* we also need 'cat /dev/mhi_0306_00.01.00_pipe_14' to enable rmnet as like USB's DTR 
+                         or will get error 'requestSetEthMode QMUXResult = 0x1, QMUXError = 0x46' */
+                    sprintf(usbnet_adapter, "%s", netcard);
+                    sprintf(qmichannel, "qrtr-%d", 3); // 3 is sdx modem's node id
+                    profile->software_interface = SOFTWARE_QRTR;
+                    find = 1;
+                    break;
+                }
+                continue;
+            }
+
+            snprintf(path, sizeof(path), "%s/%.13s_IPCR", rootdir, ent->d_name);
+            if (access(path, F_OK)) {
+                snprintf(path, sizeof(path), "%s/%.13s_QMI0", rootdir, ent->d_name);
+                if (access(path, F_OK)) {
+                    snprintf(path, sizeof(path), "%s/%.13s_MBIM", rootdir, ent->d_name);
+                    if (!access(path, F_OK))
+                        software_interface = SOFTWARE_MBIM;
+                }
+            }
+            if (access(path, F_OK))
+                continue;
+
+            strncat(path, "/mhi_uci_q", sizeof(path)-1);
+            dir_get_child(path, devname, sizeof(devname), NULL);
+            if (!devname[0])
+                continue;      
+
+            sprintf(usbnet_adapter, "%s", netcard);
+            sprintf(qmichannel, "/dev/%s", devname);
+            profile->software_interface = software_interface;
+            find = 1;
+            break;
+        }
+
+        closedir(pDir);
+    }
+
+    return find;
+}
+
+int atdevice_detect(char *atchannel, char *usbnet_adapter, PROFILE_T *profile) {
+    if (!access("/sys/class/net/sipa_dummy0", F_OK)) {
+		strcpy(usbnet_adapter, "sipa_dummy0");
+		snprintf(profile->qmapnet_adapter, sizeof(profile->qmapnet_adapter), "%s%d", "pcie", profile->pdp - 1);
+    }
+	else {
+        dbg_time("atdevice_detect failed");
+        goto error;
+    }
+
+    if (!access("/dev/stty_nr31", F_OK)) {
+        strcpy(atchannel, "/dev/stty_nr31");
+        profile->software_interface = SOFTWARE_ECM_RNDIS_NCM;
+    }
+    else {
+        goto error;
+    }
+
+    return 1;
+error:
+    return 0;
+}
+
+
+int get_driver_type(PROFILE_T *profile)
+{
+    /* QMI_WWAN */
+    if (profile->usb_intf.bInterfaceClass == USB_CLASS_VENDOR_SPEC) {
+        return SOFTWARE_QMI;
+    }
+    else if (profile->usb_intf.bInterfaceClass == USB_CLASS_COMM) {
+        switch (profile->usb_intf.bInterfaceSubClass) {
+            case USB_CDC_SUBCLASS_MBIM:
+                return SOFTWARE_MBIM;
+            break;
+            case USB_CDC_SUBCLASS_ETHERNET:
+            case USB_CDC_SUBCLASS_NCM:
+                return SOFTWARE_ECM_RNDIS_NCM;
+            break;
+            default:
+            break;
+        }
+    }
+    else if (profile->usb_intf.bInterfaceClass == USB_CLASS_WIRELESS_CONTROLLER) {
+        if (profile->usb_intf.bInterfaceSubClass == 1 && profile->usb_intf.bInterfaceProtocol == 3) {
+            RDNIS_MODEL = 1;//Some modules in RNDIS mode the usb port definition is different, adding a marker bit to distinguish.
+            return SOFTWARE_ECM_RNDIS_NCM;
+        }
+    }
+
+    dbg_time("%s unknow bInterfaceClass=%d, bInterfaceSubClass=%d", __func__,
+        profile->usb_intf.bInterfaceClass, profile->usb_intf.bInterfaceSubClass);
+    return DRV_INVALID;
+}
+
+struct usbfs_getdriver
+{
+    unsigned int interface;
+    char driver[255 + 1];
+};
+
+struct usbfs_ioctl
+{
+    int ifno;       /* interface 0..N ; negative numbers reserved */
+    int ioctl_code; /* MUST encode size + direction of data so the
+			 * macros in <asm/ioctl.h> give correct values */
+    void *data;     /* param buffer (in, or out) */
+};
+
+#define IOCTL_USBFS_DISCONNECT	_IO('U', 22)
+#define IOCTL_USBFS_CONNECT	_IO('U', 23)
+
+int usbfs_is_kernel_driver_alive(int fd, int ifnum)
+{
+    struct usbfs_getdriver getdrv;
+    getdrv.interface = ifnum;
+    if (ioctl(fd, USBDEVFS_GETDRIVER, &getdrv) < 0) {
+        dbg_time("%s ioctl USBDEVFS_GETDRIVER failed, kernel driver may be inactive", __func__);
+        return 0;
+    }
+    dbg_time("%s find interface %d has match the driver %s", __func__, ifnum, getdrv.driver);
+    return 1;
+}
+
+void usbfs_detach_kernel_driver(int fd, int ifnum)
+{
+    struct usbfs_ioctl operate;
+    operate.data = NULL;
+    operate.ifno = ifnum;
+    operate.ioctl_code = IOCTL_USBFS_DISCONNECT;
+    if (ioctl(fd, USBDEVFS_IOCTL, &operate) < 0) {
+        dbg_time("%s detach kernel driver failed", __func__);
+    } else {
+        dbg_time("%s detach kernel driver success", __func__);
+    }
+}
+
+void usbfs_attach_kernel_driver(int fd, int ifnum)
+{
+    struct usbfs_ioctl operate;
+    operate.data = NULL;
+    operate.ifno = ifnum;
+    operate.ioctl_code = IOCTL_USBFS_CONNECT;
+    if (ioctl(fd, USBDEVFS_IOCTL, &operate) < 0) {
+        dbg_time("%s detach kernel driver failed", __func__);
+    } else {
+        dbg_time("%s detach kernel driver success", __func__);
+    }
+}
+
+int reattach_driver(PROFILE_T *profile)
+{
+    int ifnum = 4;
+    int fd;
+    char devpath[128] = {'\0'};
+    snprintf(devpath, sizeof(devpath), "/dev/bus/usb/%03d/%03d", profile->usb_dev.busnum, profile->usb_dev.devnum);
+    fd = open(devpath, O_RDWR | O_NOCTTY);
+    if (fd < 0)
+    {
+        dbg_time("%s fail to open %s", __func__, devpath);
+        return -1;
+    }
+    usbfs_detach_kernel_driver(fd, ifnum);
+    usbfs_attach_kernel_driver(fd, ifnum);
+    close(fd);
+    return 0;
+}
+
+#define SIOCETHTOOL     0x8946
+int ql_get_netcard_driver_info(const char *devname)
+{
+    int fd = -1;
+    struct ethtool_drvinfo drvinfo;
+    struct ifreq ifr;	/* ifreq suitable for ethtool ioctl */
+
+    memset(&ifr, 0, sizeof(ifr));
+    strcpy(ifr.ifr_name, devname);
+
+    fd = socket(AF_INET, SOCK_DGRAM, 0);
+    if (fd < 0) {
+        dbg_time("Cannot get control socket: errno(%d)(%s)", errno, strerror(errno));
+        return -1;
+    }
+
+    drvinfo.cmd = ETHTOOL_GDRVINFO;
+    ifr.ifr_data = (void *)&drvinfo;
+
+    if (ioctl(fd, SIOCETHTOOL, &ifr) < 0) {
+        dbg_time("ioctl() error: errno(%d)(%s)", errno, strerror(errno));
+        close(fd);
+        return -1;
+    }
+
+    dbg_time("netcard driver = %s, driver version = %s", drvinfo.driver, drvinfo.version);
+
+    close(fd);
+
+    return 0;
+}
+
+int ql_get_netcard_carrier_state(const char *devname)
+{
+    int fd = -1;
+    struct ethtool_value edata;
+    struct ifreq ifr;	/* ifreq suitable for ethtool ioctl */
+
+    memset(&ifr, 0, sizeof(ifr));
+    strcpy(ifr.ifr_name, devname);
+
+    fd = socket(AF_INET, SOCK_DGRAM, 0);
+    if (fd < 0) {
+        dbg_time("Cannot get control socket: errno(%d)(%s)", errno, strerror(errno));
+        return -1;
+    }
+
+    edata.cmd = ETHTOOL_GLINK;
+    edata.data = 0;
+    ifr.ifr_data = (void *)&edata;
+
+    if (ioctl(fd, SIOCETHTOOL, &ifr) < 0) {
+        dbg_time("ioctl('%s') error: errno(%d)(%s)", devname, errno, strerror(errno));
+        return -1;
+    }
+
+    if (!edata.data)
+        dbg_time("netcard carrier = %d", edata.data);
+
+    close(fd);
+
+    return edata.data;
+}
+
+static void *catch_log(void *arg)
+{
+    PROFILE_T *profile = (PROFILE_T *)arg;
+    int nreads = 0;
+    char tbuff[256+32];
+    char filter[32];
+    size_t tsize = strlen(get_time()) + 1;
+
+    snprintf(filter, sizeof(filter), ":%d:%03d:", profile->usb_dev.busnum, profile->usb_dev.devnum);
+
+    while(1) {
+        nreads = read(profile->usbmon_fd, tbuff + tsize, sizeof(tbuff) - tsize - 1);
+        if (nreads <= 0) {
+            if (nreads == -1 && errno == EINTR)
+                continue;
+            break;
+        }
+
+        tbuff[tsize+nreads] = '\0';   // printf("%s", buff);
+
+        if (!strstr(tbuff+tsize, filter))
+            continue;
+
+        snprintf(tbuff, sizeof(tbuff), "%s", get_time());
+        tbuff[tsize-1] = ' ';
+
+        fwrite(tbuff, strlen(tbuff), 1, profile->usbmon_logfile_fp);
+    }
+
+    return NULL;
+}
+
+int ql_capture_usbmon_log(PROFILE_T *profile, const char *log_path)
+{
+    char usbmon_path[256];
+    pthread_t pt;
+    pthread_attr_t attr;
+
+    if (access("/sys/module/usbmon", F_OK)) {
+        dbg_time("usbmon is not load, please execute \"modprobe usbmon\" or \"insmod usbmon.ko\"");
+        return -1;
+    }
+
+    if (access("/sys/kernel/debug/usb", F_OK)) {
+        dbg_time("debugfs is not mount, please execute \"mount -t debugfs none_debugs /sys/kernel/debug\"");
+        return -1;
+    }
+
+    snprintf(usbmon_path, sizeof(usbmon_path), "/sys/kernel/debug/usb/usbmon/%du", profile->usb_dev.busnum);
+    profile->usbmon_fd = open(usbmon_path, O_RDONLY);
+    if (profile->usbmon_fd < 0) {
+        dbg_time("open %s error(%d) (%s)", usbmon_path, errno, strerror(errno));
+        return -1;
+    }
+
+    snprintf(usbmon_path, sizeof(usbmon_path), "cat /sys/kernel/debug/usb/devices >> %s", log_path);
+    if (system(usbmon_path) == -1) {};
+
+    profile->usbmon_logfile_fp = fopen(log_path, "wb");
+    if (!profile->usbmon_logfile_fp) {
+      dbg_time("open %s error(%d) (%s)", log_path, errno, strerror(errno));
+      close(profile->usbmon_fd);
+      profile->usbmon_fd = -1;
+      return -1;
+    }
+
+    pthread_attr_init(&attr);
+    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+
+    pthread_create(&pt, &attr, catch_log, (void *)profile);
+
+    return 0;
+}
+
+void ql_stop_usbmon_log(PROFILE_T *profile) {
+    if (profile->usbmon_fd > 0)
+        close(profile->usbmon_fd);
+    if (profile->usbmon_logfile_fp)
+        fclose(profile->usbmon_logfile_fp);
+}
diff --git a/RM520N-5G/文件/source/ethtool-copy.h b/RM520N-5G/文件/source/ethtool-copy.h
new file mode 100644
index 0000000..a61b454
--- /dev/null
+++ b/RM520N-5G/文件/source/ethtool-copy.h
@@ -0,0 +1,1110 @@
+/*
+ * ethtool.h: Defines for Linux ethtool.
+ *
+ * Copyright (C) 1998 David S. Miller (davem@redhat.com)
+ * Copyright 2001 Jeff Garzik <jgarzik@pobox.com>
+ * Portions Copyright 2001 Sun Microsystems (thockin@sun.com)
+ * Portions Copyright 2002 Intel (eli.kupermann@intel.com,
+ *                                christopher.leech@intel.com,
+ *                                scott.feldman@intel.com)
+ * Portions Copyright (C) Sun Microsystems 2008
+
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+
+#ifndef _LINUX_ETHTOOL_H
+#define _LINUX_ETHTOOL_H
+
+#include <linux/types.h>
+#include <linux/if_ether.h>
+
+/* This should work for both 32 and 64 bit userland. */
+struct ethtool_cmd {
+	__u32	cmd;
+	__u32	supported;	/* Features this interface supports */
+	__u32	advertising;	/* Features this interface advertises */
+	__u16	speed;	        /* The forced speed (lower bits) in
+				 * Mbps. Please use
+				 * ethtool_cmd_speed()/_set() to
+				 * access it */
+	__u8	duplex;		/* Duplex, half or full */
+	__u8	port;		/* Which connector port */
+	__u8	phy_address;	/* MDIO PHY address (PRTAD for clause 45).
+				 * May be read-only or read-write
+				 * depending on the driver.
+				 */
+	__u8	transceiver;	/* Which transceiver to use */
+	__u8	autoneg;	/* Enable or disable autonegotiation */
+	__u8	mdio_support;	/* MDIO protocols supported.  Read-only.
+				 * Not set by all drivers.
+				 */
+	__u32	maxtxpkt;	/* Tx pkts before generating tx int */
+	__u32	maxrxpkt;	/* Rx pkts before generating rx int */
+	__u16	speed_hi;       /* The forced speed (upper
+				 * bits) in Mbps. Please use
+				 * ethtool_cmd_speed()/_set() to
+				 * access it */
+	__u8	eth_tp_mdix;	/* twisted pair MDI-X status */
+	__u8    eth_tp_mdix_ctrl; /* twisted pair MDI-X control, when set,
+				   * link should be renegotiated if necessary
+				   */
+	__u32	lp_advertising;	/* Features the link partner advertises */
+	__u32	reserved[2];
+};
+
+static __inline__ void ethtool_cmd_speed_set(struct ethtool_cmd *ep,
+					 __u32 speed)
+{
+
+	ep->speed = (__u16)speed;
+	ep->speed_hi = (__u16)(speed >> 16);
+}
+
+static __inline__ __u32 ethtool_cmd_speed(const struct ethtool_cmd *ep)
+{
+	return (ep->speed_hi << 16) | ep->speed;
+}
+
+/* Device supports clause 22 register access to PHY or peripherals
+ * using the interface defined in <linux/mii.h>.  This should not be
+ * set if there are known to be no such peripherals present or if
+ * the driver only emulates clause 22 registers for compatibility.
+ */
+#define ETH_MDIO_SUPPORTS_C22	1
+
+/* Device supports clause 45 register access to PHY or peripherals
+ * using the interface defined in <linux/mii.h> and <linux/mdio.h>.
+ * This should not be set if there are known to be no such peripherals
+ * present.
+ */
+#define ETH_MDIO_SUPPORTS_C45	2
+
+#define ETHTOOL_FWVERS_LEN	32
+#define ETHTOOL_BUSINFO_LEN	32
+/* these strings are set to whatever the driver author decides... */
+struct ethtool_drvinfo {
+	__u32	cmd;
+	char	driver[32];	/* driver short name, "tulip", "eepro100" */
+	char	version[32];	/* driver version string */
+	char	fw_version[ETHTOOL_FWVERS_LEN];	/* firmware version string */
+	char	bus_info[ETHTOOL_BUSINFO_LEN];	/* Bus info for this IF. */
+				/* For PCI devices, use pci_name(pci_dev). */
+	char	reserved1[32];
+	char	reserved2[12];
+				/*
+				 * Some struct members below are filled in
+				 * using ops->get_sset_count().  Obtaining
+				 * this info from ethtool_drvinfo is now
+				 * deprecated; Use ETHTOOL_GSSET_INFO
+				 * instead.
+				 */
+	__u32	n_priv_flags;	/* number of flags valid in ETHTOOL_GPFLAGS */
+	__u32	n_stats;	/* number of u64's from ETHTOOL_GSTATS */
+	__u32	testinfo_len;
+	__u32	eedump_len;	/* Size of data from ETHTOOL_GEEPROM (bytes) */
+	__u32	regdump_len;	/* Size of data from ETHTOOL_GREGS (bytes) */
+};
+
+#define SOPASS_MAX	6
+/* wake-on-lan settings */
+struct ethtool_wolinfo {
+	__u32	cmd;
+	__u32	supported;
+	__u32	wolopts;
+	__u8	sopass[SOPASS_MAX]; /* SecureOn(tm) password */
+};
+
+/* for passing single values */
+struct ethtool_value {
+	__u32	cmd;
+	__u32	data;
+};
+
+/* for passing big chunks of data */
+struct ethtool_regs {
+	__u32	cmd;
+	__u32	version; /* driver-specific, indicates different chips/revs */
+	__u32	len; /* bytes */
+	__u8	data[0];
+};
+
+/* for passing EEPROM chunks */
+struct ethtool_eeprom {
+	__u32	cmd;
+	__u32	magic;
+	__u32	offset; /* in bytes */
+	__u32	len; /* in bytes */
+	__u8	data[0];
+};
+
+/**
+ * struct ethtool_eee - Energy Efficient Ethernet information
+ * @cmd: ETHTOOL_{G,S}EEE
+ * @supported: Mask of %SUPPORTED_* flags for the speed/duplex combinations
+ *	for which there is EEE support.
+ * @advertised: Mask of %ADVERTISED_* flags for the speed/duplex combinations
+ *	advertised as eee capable.
+ * @lp_advertised: Mask of %ADVERTISED_* flags for the speed/duplex
+ *	combinations advertised by the link partner as eee capable.
+ * @eee_active: Result of the eee auto negotiation.
+ * @eee_enabled: EEE configured mode (enabled/disabled).
+ * @tx_lpi_enabled: Whether the interface should assert its tx lpi, given
+ *	that eee was negotiated.
+ * @tx_lpi_timer: Time in microseconds the interface delays prior to asserting
+ *	its tx lpi (after reaching 'idle' state). Effective only when eee
+ *	was negotiated and tx_lpi_enabled was set.
+ */
+struct ethtool_eee {
+	__u32	cmd;
+	__u32	supported;
+	__u32	advertised;
+	__u32	lp_advertised;
+	__u32	eee_active;
+	__u32	eee_enabled;
+	__u32	tx_lpi_enabled;
+	__u32	tx_lpi_timer;
+	__u32	reserved[2];
+};
+
+/**
+ * struct ethtool_modinfo - plugin module eeprom information
+ * @cmd: %ETHTOOL_GMODULEINFO
+ * @type: Standard the module information conforms to %ETH_MODULE_SFF_xxxx
+ * @eeprom_len: Length of the eeprom
+ *
+ * This structure is used to return the information to
+ * properly size memory for a subsequent call to %ETHTOOL_GMODULEEEPROM.
+ * The type code indicates the eeprom data format
+ */
+struct ethtool_modinfo {
+	__u32   cmd;
+	__u32   type;
+	__u32   eeprom_len;
+	__u32   reserved[8];
+};
+
+/**
+ * struct ethtool_coalesce - coalescing parameters for IRQs and stats updates
+ * @cmd: ETHTOOL_{G,S}COALESCE
+ * @rx_coalesce_usecs: How many usecs to delay an RX interrupt after
+ *	a packet arrives.
+ * @rx_max_coalesced_frames: Maximum number of packets to receive
+ *	before an RX interrupt.
+ * @rx_coalesce_usecs_irq: Same as @rx_coalesce_usecs, except that
+ *	this value applies while an IRQ is being serviced by the host.
+ * @rx_max_coalesced_frames_irq: Same as @rx_max_coalesced_frames,
+ *	except that this value applies while an IRQ is being serviced
+ *	by the host.
+ * @tx_coalesce_usecs: How many usecs to delay a TX interrupt after
+ *	a packet is sent.
+ * @tx_max_coalesced_frames: Maximum number of packets to be sent
+ *	before a TX interrupt.
+ * @tx_coalesce_usecs_irq: Same as @tx_coalesce_usecs, except that
+ *	this value applies while an IRQ is being serviced by the host.
+ * @tx_max_coalesced_frames_irq: Same as @tx_max_coalesced_frames,
+ *	except that this value applies while an IRQ is being serviced
+ *	by the host.
+ * @stats_block_coalesce_usecs: How many usecs to delay in-memory
+ *	statistics block updates.  Some drivers do not have an
+ *	in-memory statistic block, and in such cases this value is
+ *	ignored.  This value must not be zero.
+ * @use_adaptive_rx_coalesce: Enable adaptive RX coalescing.
+ * @use_adaptive_tx_coalesce: Enable adaptive TX coalescing.
+ * @pkt_rate_low: Threshold for low packet rate (packets per second).
+ * @rx_coalesce_usecs_low: How many usecs to delay an RX interrupt after
+ *	a packet arrives, when the packet rate is below @pkt_rate_low.
+ * @rx_max_coalesced_frames_low: Maximum number of packets to be received
+ *	before an RX interrupt, when the packet rate is below @pkt_rate_low.
+ * @tx_coalesce_usecs_low: How many usecs to delay a TX interrupt after
+ *	a packet is sent, when the packet rate is below @pkt_rate_low.
+ * @tx_max_coalesced_frames_low: Maximum nuumber of packets to be sent before
+ *	a TX interrupt, when the packet rate is below @pkt_rate_low.
+ * @pkt_rate_high: Threshold for high packet rate (packets per second).
+ * @rx_coalesce_usecs_high: How many usecs to delay an RX interrupt after
+ *	a packet arrives, when the packet rate is above @pkt_rate_high.
+ * @rx_max_coalesced_frames_high: Maximum number of packets to be received
+ *	before an RX interrupt, when the packet rate is above @pkt_rate_high.
+ * @tx_coalesce_usecs_high: How many usecs to delay a TX interrupt after
+ *	a packet is sent, when the packet rate is above @pkt_rate_high.
+ * @tx_max_coalesced_frames_high: Maximum number of packets to be sent before
+ *	a TX interrupt, when the packet rate is above @pkt_rate_high.
+ * @rate_sample_interval: How often to do adaptive coalescing packet rate
+ *	sampling, measured in seconds.  Must not be zero.
+ *
+ * Each pair of (usecs, max_frames) fields specifies this exit
+ * condition for interrupt coalescing:
+ *	(usecs > 0 && time_since_first_completion >= usecs) ||
+ *	(max_frames > 0 && completed_frames >= max_frames)
+ * It is illegal to set both usecs and max_frames to zero as this
+ * would cause interrupts to never be generated.  To disable
+ * coalescing, set usecs = 0 and max_frames = 1.
+ *
+ * Some implementations ignore the value of max_frames and use the
+ * condition:
+ *	time_since_first_completion >= usecs
+ * This is deprecated.  Drivers for hardware that does not support
+ * counting completions should validate that max_frames == !rx_usecs.
+ *
+ * Adaptive RX/TX coalescing is an algorithm implemented by some
+ * drivers to improve latency under low packet rates and improve
+ * throughput under high packet rates.  Some drivers only implement
+ * one of RX or TX adaptive coalescing.  Anything not implemented by
+ * the driver causes these values to be silently ignored.
+ *
+ * When the packet rate is below @pkt_rate_high but above
+ * @pkt_rate_low (both measured in packets per second) the
+ * normal {rx,tx}_* coalescing parameters are used.
+ */
+struct ethtool_coalesce {
+	__u32	cmd;
+	__u32	rx_coalesce_usecs;
+	__u32	rx_max_coalesced_frames;
+	__u32	rx_coalesce_usecs_irq;
+	__u32	rx_max_coalesced_frames_irq;
+	__u32	tx_coalesce_usecs;
+	__u32	tx_max_coalesced_frames;
+	__u32	tx_coalesce_usecs_irq;
+	__u32	tx_max_coalesced_frames_irq;
+	__u32	stats_block_coalesce_usecs;
+	__u32	use_adaptive_rx_coalesce;
+	__u32	use_adaptive_tx_coalesce;
+	__u32	pkt_rate_low;
+	__u32	rx_coalesce_usecs_low;
+	__u32	rx_max_coalesced_frames_low;
+	__u32	tx_coalesce_usecs_low;
+	__u32	tx_max_coalesced_frames_low;
+	__u32	pkt_rate_high;
+	__u32	rx_coalesce_usecs_high;
+	__u32	rx_max_coalesced_frames_high;
+	__u32	tx_coalesce_usecs_high;
+	__u32	tx_max_coalesced_frames_high;
+	__u32	rate_sample_interval;
+};
+
+/* for configuring RX/TX ring parameters */
+struct ethtool_ringparam {
+	__u32	cmd;	/* ETHTOOL_{G,S}RINGPARAM */
+
+	/* Read only attributes.  These indicate the maximum number
+	 * of pending RX/TX ring entries the driver will allow the
+	 * user to set.
+	 */
+	__u32	rx_max_pending;
+	__u32	rx_mini_max_pending;
+	__u32	rx_jumbo_max_pending;
+	__u32	tx_max_pending;
+
+	/* Values changeable by the user.  The valid values are
+	 * in the range 1 to the "*_max_pending" counterpart above.
+	 */
+	__u32	rx_pending;
+	__u32	rx_mini_pending;
+	__u32	rx_jumbo_pending;
+	__u32	tx_pending;
+};
+
+/**
+ * struct ethtool_channels - configuring number of network channel
+ * @cmd: ETHTOOL_{G,S}CHANNELS
+ * @max_rx: Read only. Maximum number of receive channel the driver support.
+ * @max_tx: Read only. Maximum number of transmit channel the driver support.
+ * @max_other: Read only. Maximum number of other channel the driver support.
+ * @max_combined: Read only. Maximum number of combined channel the driver
+ *	support. Set of queues RX, TX or other.
+ * @rx_count: Valid values are in the range 1 to the max_rx.
+ * @tx_count: Valid values are in the range 1 to the max_tx.
+ * @other_count: Valid values are in the range 1 to the max_other.
+ * @combined_count: Valid values are in the range 1 to the max_combined.
+ *
+ * This can be used to configure RX, TX and other channels.
+ */
+
+struct ethtool_channels {
+	__u32	cmd;
+	__u32	max_rx;
+	__u32	max_tx;
+	__u32	max_other;
+	__u32	max_combined;
+	__u32	rx_count;
+	__u32	tx_count;
+	__u32	other_count;
+	__u32	combined_count;
+};
+
+/* for configuring link flow control parameters */
+struct ethtool_pauseparam {
+	__u32	cmd;	/* ETHTOOL_{G,S}PAUSEPARAM */
+
+	/* If the link is being auto-negotiated (via ethtool_cmd.autoneg
+	 * being true) the user may set 'autoneg' here non-zero to have the
+	 * pause parameters be auto-negotiated too.  In such a case, the
+	 * {rx,tx}_pause values below determine what capabilities are
+	 * advertised.
+	 *
+	 * If 'autoneg' is zero or the link is not being auto-negotiated,
+	 * then {rx,tx}_pause force the driver to use/not-use pause
+	 * flow control.
+	 */
+	__u32	autoneg;
+	__u32	rx_pause;
+	__u32	tx_pause;
+};
+
+#define ETH_GSTRING_LEN		32
+enum ethtool_stringset {
+	ETH_SS_TEST		= 0,
+	ETH_SS_STATS,
+	ETH_SS_PRIV_FLAGS,
+	ETH_SS_NTUPLE_FILTERS,	/* Do not use, GRXNTUPLE is now deprecated */
+	ETH_SS_FEATURES,
+};
+
+/* for passing string sets for data tagging */
+struct ethtool_gstrings {
+	__u32	cmd;		/* ETHTOOL_GSTRINGS */
+	__u32	string_set;	/* string set id e.c. ETH_SS_TEST, etc*/
+	__u32	len;		/* number of strings in the string set */
+	__u8	data[0];
+};
+
+struct ethtool_sset_info {
+	__u32	cmd;		/* ETHTOOL_GSSET_INFO */
+	__u32	reserved;
+	__u64	sset_mask;	/* input: each bit selects an sset to query */
+				/* output: each bit a returned sset */
+	__u32	data[0];	/* ETH_SS_xxx count, in order, based on bits
+				   in sset_mask.  One bit implies one
+				   __u32, two bits implies two
+				   __u32's, etc. */
+};
+
+/**
+ * enum ethtool_test_flags - flags definition of ethtool_test
+ * @ETH_TEST_FL_OFFLINE: if set perform online and offline tests, otherwise
+ *	only online tests.
+ * @ETH_TEST_FL_FAILED: Driver set this flag if test fails.
+ * @ETH_TEST_FL_EXTERNAL_LB: Application request to perform external loopback
+ *	test.
+ * @ETH_TEST_FL_EXTERNAL_LB_DONE: Driver performed the external loopback test
+ */
+
+enum ethtool_test_flags {
+	ETH_TEST_FL_OFFLINE	= (1 << 0),
+	ETH_TEST_FL_FAILED	= (1 << 1),
+	ETH_TEST_FL_EXTERNAL_LB	= (1 << 2),
+	ETH_TEST_FL_EXTERNAL_LB_DONE	= (1 << 3),
+};
+
+/* for requesting NIC test and getting results*/
+struct ethtool_test {
+	__u32	cmd;		/* ETHTOOL_TEST */
+	__u32	flags;		/* ETH_TEST_FL_xxx */
+	__u32	reserved;
+	__u32	len;		/* result length, in number of u64 elements */
+	__u64	data[0];
+};
+
+/* for dumping NIC-specific statistics */
+struct ethtool_stats {
+	__u32	cmd;		/* ETHTOOL_GSTATS */
+	__u32	n_stats;	/* number of u64's being returned */
+	__u64	data[0];
+};
+
+struct ethtool_perm_addr {
+	__u32	cmd;		/* ETHTOOL_GPERMADDR */
+	__u32	size;
+	__u8	data[0];
+};
+
+/* boolean flags controlling per-interface behavior characteristics.
+ * When reading, the flag indicates whether or not a certain behavior
+ * is enabled/present.  When writing, the flag indicates whether
+ * or not the driver should turn on (set) or off (clear) a behavior.
+ *
+ * Some behaviors may read-only (unconditionally absent or present).
+ * If such is the case, return EINVAL in the set-flags operation if the
+ * flag differs from the read-only value.
+ */
+enum ethtool_flags {
+	ETH_FLAG_TXVLAN		= (1 << 7),	/* TX VLAN offload enabled */
+	ETH_FLAG_RXVLAN		= (1 << 8),	/* RX VLAN offload enabled */
+	ETH_FLAG_LRO		= (1 << 15),	/* LRO is enabled */
+	ETH_FLAG_NTUPLE		= (1 << 27),	/* N-tuple filters enabled */
+	ETH_FLAG_RXHASH		= (1 << 28),
+};
+
+/* The following structures are for supporting RX network flow
+ * classification and RX n-tuple configuration. Note, all multibyte
+ * fields, e.g., ip4src, ip4dst, psrc, pdst, spi, etc. are expected to
+ * be in network byte order.
+ */
+
+/**
+ * struct ethtool_tcpip4_spec - flow specification for TCP/IPv4 etc.
+ * @ip4src: Source host
+ * @ip4dst: Destination host
+ * @psrc: Source port
+ * @pdst: Destination port
+ * @tos: Type-of-service
+ *
+ * This can be used to specify a TCP/IPv4, UDP/IPv4 or SCTP/IPv4 flow.
+ */
+struct ethtool_tcpip4_spec {
+	__be32	ip4src;
+	__be32	ip4dst;
+	__be16	psrc;
+	__be16	pdst;
+	__u8    tos;
+};
+
+/**
+ * struct ethtool_ah_espip4_spec - flow specification for IPsec/IPv4
+ * @ip4src: Source host
+ * @ip4dst: Destination host
+ * @spi: Security parameters index
+ * @tos: Type-of-service
+ *
+ * This can be used to specify an IPsec transport or tunnel over IPv4.
+ */
+struct ethtool_ah_espip4_spec {
+	__be32	ip4src;
+	__be32	ip4dst;
+	__be32	spi;
+	__u8    tos;
+};
+
+#define	ETH_RX_NFC_IP4	1
+
+/**
+ * struct ethtool_usrip4_spec - general flow specification for IPv4
+ * @ip4src: Source host
+ * @ip4dst: Destination host
+ * @l4_4_bytes: First 4 bytes of transport (layer 4) header
+ * @tos: Type-of-service
+ * @ip_ver: Value must be %ETH_RX_NFC_IP4; mask must be 0
+ * @proto: Transport protocol number; mask must be 0
+ */
+struct ethtool_usrip4_spec {
+	__be32	ip4src;
+	__be32	ip4dst;
+	__be32	l4_4_bytes;
+	__u8    tos;
+	__u8    ip_ver;
+	__u8    proto;
+};
+
+union ethtool_flow_union {
+	struct ethtool_tcpip4_spec		tcp_ip4_spec;
+	struct ethtool_tcpip4_spec		udp_ip4_spec;
+	struct ethtool_tcpip4_spec		sctp_ip4_spec;
+	struct ethtool_ah_espip4_spec		ah_ip4_spec;
+	struct ethtool_ah_espip4_spec		esp_ip4_spec;
+	struct ethtool_usrip4_spec		usr_ip4_spec;
+	struct ethhdr				ether_spec;
+	__u8					hdata[52];
+};
+
+/**
+ * struct ethtool_flow_ext - additional RX flow fields
+ * @h_dest: destination MAC address
+ * @vlan_etype: VLAN EtherType
+ * @vlan_tci: VLAN tag control information
+ * @data: user defined data
+ *
+ * Note, @vlan_etype, @vlan_tci, and @data are only valid if %FLOW_EXT
+ * is set in &struct ethtool_rx_flow_spec @flow_type.
+ * @h_dest is valid if %FLOW_MAC_EXT is set.
+ */
+struct ethtool_flow_ext {
+	__u8		padding[2];
+	unsigned char	h_dest[ETH_ALEN];
+	__be16		vlan_etype;
+	__be16		vlan_tci;
+	__be32		data[2];
+};
+
+/**
+ * struct ethtool_rx_flow_spec - classification rule for RX flows
+ * @flow_type: Type of match to perform, e.g. %TCP_V4_FLOW
+ * @h_u: Flow fields to match (dependent on @flow_type)
+ * @h_ext: Additional fields to match
+ * @m_u: Masks for flow field bits to be matched
+ * @m_ext: Masks for additional field bits to be matched
+ *	Note, all additional fields must be ignored unless @flow_type
+ *	includes the %FLOW_EXT or %FLOW_MAC_EXT flag
+ *	(see &struct ethtool_flow_ext description).
+ * @ring_cookie: RX ring/queue index to deliver to, or %RX_CLS_FLOW_DISC
+ *	if packets should be discarded
+ * @location: Location of rule in the table.  Locations must be
+ *	numbered such that a flow matching multiple rules will be
+ *	classified according to the first (lowest numbered) rule.
+ */
+struct ethtool_rx_flow_spec {
+	__u32		flow_type;
+	union ethtool_flow_union h_u;
+	struct ethtool_flow_ext h_ext;
+	union ethtool_flow_union m_u;
+	struct ethtool_flow_ext m_ext;
+	__u64		ring_cookie;
+	__u32		location;
+};
+
+/**
+ * struct ethtool_rxnfc - command to get or set RX flow classification rules
+ * @cmd: Specific command number - %ETHTOOL_GRXFH, %ETHTOOL_SRXFH,
+ *	%ETHTOOL_GRXRINGS, %ETHTOOL_GRXCLSRLCNT, %ETHTOOL_GRXCLSRULE,
+ *	%ETHTOOL_GRXCLSRLALL, %ETHTOOL_SRXCLSRLDEL or %ETHTOOL_SRXCLSRLINS
+ * @flow_type: Type of flow to be affected, e.g. %TCP_V4_FLOW
+ * @data: Command-dependent value
+ * @fs: Flow classification rule
+ * @rule_cnt: Number of rules to be affected
+ * @rule_locs: Array of used rule locations
+ *
+ * For %ETHTOOL_GRXFH and %ETHTOOL_SRXFH, @data is a bitmask indicating
+ * the fields included in the flow hash, e.g. %RXH_IP_SRC.  The following
+ * structure fields must not be used.
+ *
+ * For %ETHTOOL_GRXRINGS, @data is set to the number of RX rings/queues
+ * on return.
+ *
+ * For %ETHTOOL_GRXCLSRLCNT, @rule_cnt is set to the number of defined
+ * rules on return.  If @data is non-zero on return then it is the
+ * size of the rule table, plus the flag %RX_CLS_LOC_SPECIAL if the
+ * driver supports any special location values.  If that flag is not
+ * set in @data then special location values should not be used.
+ *
+ * For %ETHTOOL_GRXCLSRULE, @fs.@location specifies the location of an
+ * existing rule on entry and @fs contains the rule on return.
+ *
+ * For %ETHTOOL_GRXCLSRLALL, @rule_cnt specifies the array size of the
+ * user buffer for @rule_locs on entry.  On return, @data is the size
+ * of the rule table, @rule_cnt is the number of defined rules, and
+ * @rule_locs contains the locations of the defined rules.  Drivers
+ * must use the second parameter to get_rxnfc() instead of @rule_locs.
+ *
+ * For %ETHTOOL_SRXCLSRLINS, @fs specifies the rule to add or update.
+ * @fs.@location either specifies the location to use or is a special
+ * location value with %RX_CLS_LOC_SPECIAL flag set.  On return,
+ * @fs.@location is the actual rule location.
+ *
+ * For %ETHTOOL_SRXCLSRLDEL, @fs.@location specifies the location of an
+ * existing rule on entry.
+ *
+ * A driver supporting the special location values for
+ * %ETHTOOL_SRXCLSRLINS may add the rule at any suitable unused
+ * location, and may remove a rule at a later location (lower
+ * priority) that matches exactly the same set of flows.  The special
+ * values are: %RX_CLS_LOC_ANY, selecting any location;
+ * %RX_CLS_LOC_FIRST, selecting the first suitable location (maximum
+ * priority); and %RX_CLS_LOC_LAST, selecting the last suitable
+ * location (minimum priority).  Additional special values may be
+ * defined in future and drivers must return -%EINVAL for any
+ * unrecognised value.
+ */
+struct ethtool_rxnfc {
+	__u32				cmd;
+	__u32				flow_type;
+	__u64				data;
+	struct ethtool_rx_flow_spec	fs;
+	__u32				rule_cnt;
+	__u32				rule_locs[0];
+};
+
+
+/**
+ * struct ethtool_rxfh_indir - command to get or set RX flow hash indirection
+ * @cmd: Specific command number - %ETHTOOL_GRXFHINDIR or %ETHTOOL_SRXFHINDIR
+ * @size: On entry, the array size of the user buffer, which may be zero.
+ *	On return from %ETHTOOL_GRXFHINDIR, the array size of the hardware
+ *	indirection table.
+ * @ring_index: RX ring/queue index for each hash value
+ *
+ * For %ETHTOOL_GRXFHINDIR, a @size of zero means that only the size
+ * should be returned.  For %ETHTOOL_SRXFHINDIR, a @size of zero means
+ * the table should be reset to default values.  This last feature
+ * is not supported by the original implementations.
+ */
+struct ethtool_rxfh_indir {
+	__u32	cmd;
+	__u32	size;
+	__u32	ring_index[0];
+};
+
+/**
+ * struct ethtool_rx_ntuple_flow_spec - specification for RX flow filter
+ * @flow_type: Type of match to perform, e.g. %TCP_V4_FLOW
+ * @h_u: Flow field values to match (dependent on @flow_type)
+ * @m_u: Masks for flow field value bits to be ignored
+ * @vlan_tag: VLAN tag to match
+ * @vlan_tag_mask: Mask for VLAN tag bits to be ignored
+ * @data: Driver-dependent data to match
+ * @data_mask: Mask for driver-dependent data bits to be ignored
+ * @action: RX ring/queue index to deliver to (non-negative) or other action
+ *	(negative, e.g. %ETHTOOL_RXNTUPLE_ACTION_DROP)
+ *
+ * For flow types %TCP_V4_FLOW, %UDP_V4_FLOW and %SCTP_V4_FLOW, where
+ * a field value and mask are both zero this is treated as if all mask
+ * bits are set i.e. the field is ignored.
+ */
+struct ethtool_rx_ntuple_flow_spec {
+	__u32		 flow_type;
+	union {
+		struct ethtool_tcpip4_spec		tcp_ip4_spec;
+		struct ethtool_tcpip4_spec		udp_ip4_spec;
+		struct ethtool_tcpip4_spec		sctp_ip4_spec;
+		struct ethtool_ah_espip4_spec		ah_ip4_spec;
+		struct ethtool_ah_espip4_spec		esp_ip4_spec;
+		struct ethtool_usrip4_spec		usr_ip4_spec;
+		struct ethhdr				ether_spec;
+		__u8					hdata[72];
+	} h_u, m_u;
+
+	__u16	        vlan_tag;
+	__u16	        vlan_tag_mask;
+	__u64		data;
+	__u64		data_mask;
+
+	__s32		action;
+#define ETHTOOL_RXNTUPLE_ACTION_DROP	(-1)	/* drop packet */
+#define ETHTOOL_RXNTUPLE_ACTION_CLEAR	(-2)	/* clear filter */
+};
+
+/**
+ * struct ethtool_rx_ntuple - command to set or clear RX flow filter
+ * @cmd: Command number - %ETHTOOL_SRXNTUPLE
+ * @fs: Flow filter specification
+ */
+struct ethtool_rx_ntuple {
+	__u32					cmd;
+	struct ethtool_rx_ntuple_flow_spec	fs;
+};
+
+#define ETHTOOL_FLASH_MAX_FILENAME	128
+enum ethtool_flash_op_type {
+	ETHTOOL_FLASH_ALL_REGIONS	= 0,
+};
+
+/* for passing firmware flashing related parameters */
+struct ethtool_flash {
+	__u32	cmd;
+	__u32	region;
+	char	data[ETHTOOL_FLASH_MAX_FILENAME];
+};
+
+/**
+ * struct ethtool_dump - used for retrieving, setting device dump
+ * @cmd: Command number - %ETHTOOL_GET_DUMP_FLAG, %ETHTOOL_GET_DUMP_DATA, or
+ * 	%ETHTOOL_SET_DUMP
+ * @version: FW version of the dump, filled in by driver
+ * @flag: driver dependent flag for dump setting, filled in by driver during
+ *        get and filled in by ethtool for set operation.
+ *        flag must be initialized by macro ETH_FW_DUMP_DISABLE value when
+ *        firmware dump is disabled.
+ * @len: length of dump data, used as the length of the user buffer on entry to
+ * 	 %ETHTOOL_GET_DUMP_DATA and this is returned as dump length by driver
+ * 	 for %ETHTOOL_GET_DUMP_FLAG command
+ * @data: data collected for get dump data operation
+ */
+
+#define ETH_FW_DUMP_DISABLE 0
+
+struct ethtool_dump {
+	__u32	cmd;
+	__u32	version;
+	__u32	flag;
+	__u32	len;
+	__u8	data[0];
+};
+
+/* for returning and changing feature sets */
+
+/**
+ * struct ethtool_get_features_block - block with state of 32 features
+ * @available: mask of changeable features
+ * @requested: mask of features requested to be enabled if possible
+ * @active: mask of currently enabled features
+ * @never_changed: mask of features not changeable for any device
+ */
+struct ethtool_get_features_block {
+	__u32	available;
+	__u32	requested;
+	__u32	active;
+	__u32	never_changed;
+};
+
+/**
+ * struct ethtool_gfeatures - command to get state of device's features
+ * @cmd: command number = %ETHTOOL_GFEATURES
+ * @size: in: number of elements in the features[] array;
+ *       out: number of elements in features[] needed to hold all features
+ * @features: state of features
+ */
+struct ethtool_gfeatures {
+	__u32	cmd;
+	__u32	size;
+	struct ethtool_get_features_block features[0];
+};
+
+/**
+ * struct ethtool_set_features_block - block with request for 32 features
+ * @valid: mask of features to be changed
+ * @requested: values of features to be changed
+ */
+struct ethtool_set_features_block {
+	__u32	valid;
+	__u32	requested;
+};
+
+/**
+ * struct ethtool_sfeatures - command to request change in device's features
+ * @cmd: command number = %ETHTOOL_SFEATURES
+ * @size: array size of the features[] array
+ * @features: feature change masks
+ */
+struct ethtool_sfeatures {
+	__u32	cmd;
+	__u32	size;
+	struct ethtool_set_features_block features[0];
+};
+
+/**
+ * struct ethtool_ts_info - holds a device's timestamping and PHC association
+ * @cmd: command number = %ETHTOOL_GET_TS_INFO
+ * @so_timestamping: bit mask of the sum of the supported SO_TIMESTAMPING flags
+ * @phc_index: device index of the associated PHC, or -1 if there is none
+ * @tx_types: bit mask of the supported hwtstamp_tx_types enumeration values
+ * @rx_filters: bit mask of the supported hwtstamp_rx_filters enumeration values
+ *
+ * The bits in the 'tx_types' and 'rx_filters' fields correspond to
+ * the 'hwtstamp_tx_types' and 'hwtstamp_rx_filters' enumeration values,
+ * respectively.  For example, if the device supports HWTSTAMP_TX_ON,
+ * then (1 << HWTSTAMP_TX_ON) in 'tx_types' will be set.
+ */
+struct ethtool_ts_info {
+	__u32	cmd;
+	__u32	so_timestamping;
+	__s32	phc_index;
+	__u32	tx_types;
+	__u32	tx_reserved[3];
+	__u32	rx_filters;
+	__u32	rx_reserved[3];
+};
+
+/*
+ * %ETHTOOL_SFEATURES changes features present in features[].valid to the
+ * values of corresponding bits in features[].requested. Bits in .requested
+ * not set in .valid or not changeable are ignored.
+ *
+ * Returns %EINVAL when .valid contains undefined or never-changeable bits
+ * or size is not equal to required number of features words (32-bit blocks).
+ * Returns >= 0 if request was completed; bits set in the value mean:
+ *   %ETHTOOL_F_UNSUPPORTED - there were bits set in .valid that are not
+ *	changeable (not present in %ETHTOOL_GFEATURES' features[].available)
+ *	those bits were ignored.
+ *   %ETHTOOL_F_WISH - some or all changes requested were recorded but the
+ *      resulting state of bits masked by .valid is not equal to .requested.
+ *      Probably there are other device-specific constraints on some features
+ *      in the set. When %ETHTOOL_F_UNSUPPORTED is set, .valid is considered
+ *      here as though ignored bits were cleared.
+ *   %ETHTOOL_F_COMPAT - some or all changes requested were made by calling
+ *      compatibility functions. Requested offload state cannot be properly
+ *      managed by kernel.
+ *
+ * Meaning of bits in the masks are obtained by %ETHTOOL_GSSET_INFO (number of
+ * bits in the arrays - always multiple of 32) and %ETHTOOL_GSTRINGS commands
+ * for ETH_SS_FEATURES string set. First entry in the table corresponds to least
+ * significant bit in features[0] fields. Empty strings mark undefined features.
+ */
+enum ethtool_sfeatures_retval_bits {
+	ETHTOOL_F_UNSUPPORTED__BIT,
+	ETHTOOL_F_WISH__BIT,
+	ETHTOOL_F_COMPAT__BIT,
+};
+
+#define ETHTOOL_F_UNSUPPORTED   (1 << ETHTOOL_F_UNSUPPORTED__BIT)
+#define ETHTOOL_F_WISH          (1 << ETHTOOL_F_WISH__BIT)
+#define ETHTOOL_F_COMPAT        (1 << ETHTOOL_F_COMPAT__BIT)
+
+
+/* CMDs currently supported */
+#define ETHTOOL_GSET		0x00000001 /* Get settings. */
+#define ETHTOOL_SSET		0x00000002 /* Set settings. */
+#define ETHTOOL_GDRVINFO	0x00000003 /* Get driver info. */
+#define ETHTOOL_GREGS		0x00000004 /* Get NIC registers. */
+#define ETHTOOL_GWOL		0x00000005 /* Get wake-on-lan options. */
+#define ETHTOOL_SWOL		0x00000006 /* Set wake-on-lan options. */
+#define ETHTOOL_GMSGLVL		0x00000007 /* Get driver message level */
+#define ETHTOOL_SMSGLVL		0x00000008 /* Set driver msg level. */
+#define ETHTOOL_NWAY_RST	0x00000009 /* Restart autonegotiation. */
+/* Get link status for host, i.e. whether the interface *and* the
+ * physical port (if there is one) are up (ethtool_value). */
+#define ETHTOOL_GLINK		0x0000000a
+#define ETHTOOL_GEEPROM		0x0000000b /* Get EEPROM data */
+#define ETHTOOL_SEEPROM		0x0000000c /* Set EEPROM data. */
+#define ETHTOOL_GCOALESCE	0x0000000e /* Get coalesce config */
+#define ETHTOOL_SCOALESCE	0x0000000f /* Set coalesce config. */
+#define ETHTOOL_GRINGPARAM	0x00000010 /* Get ring parameters */
+#define ETHTOOL_SRINGPARAM	0x00000011 /* Set ring parameters. */
+#define ETHTOOL_GPAUSEPARAM	0x00000012 /* Get pause parameters */
+#define ETHTOOL_SPAUSEPARAM	0x00000013 /* Set pause parameters. */
+#define ETHTOOL_GRXCSUM		0x00000014 /* Get RX hw csum enable (ethtool_value) */
+#define ETHTOOL_SRXCSUM		0x00000015 /* Set RX hw csum enable (ethtool_value) */
+#define ETHTOOL_GTXCSUM		0x00000016 /* Get TX hw csum enable (ethtool_value) */
+#define ETHTOOL_STXCSUM		0x00000017 /* Set TX hw csum enable (ethtool_value) */
+#define ETHTOOL_GSG		0x00000018 /* Get scatter-gather enable
+					    * (ethtool_value) */
+#define ETHTOOL_SSG		0x00000019 /* Set scatter-gather enable
+					    * (ethtool_value). */
+#define ETHTOOL_TEST		0x0000001a /* execute NIC self-test. */
+#define ETHTOOL_GSTRINGS	0x0000001b /* get specified string set */
+#define ETHTOOL_PHYS_ID		0x0000001c /* identify the NIC */
+#define ETHTOOL_GSTATS		0x0000001d /* get NIC-specific statistics */
+#define ETHTOOL_GTSO		0x0000001e /* Get TSO enable (ethtool_value) */
+#define ETHTOOL_STSO		0x0000001f /* Set TSO enable (ethtool_value) */
+#define ETHTOOL_GPERMADDR	0x00000020 /* Get permanent hardware address */
+#define ETHTOOL_GUFO		0x00000021 /* Get UFO enable (ethtool_value) */
+#define ETHTOOL_SUFO		0x00000022 /* Set UFO enable (ethtool_value) */
+#define ETHTOOL_GGSO		0x00000023 /* Get GSO enable (ethtool_value) */
+#define ETHTOOL_SGSO		0x00000024 /* Set GSO enable (ethtool_value) */
+#define ETHTOOL_GFLAGS		0x00000025 /* Get flags bitmap(ethtool_value) */
+#define ETHTOOL_SFLAGS		0x00000026 /* Set flags bitmap(ethtool_value) */
+#define ETHTOOL_GPFLAGS		0x00000027 /* Get driver-private flags bitmap */
+#define ETHTOOL_SPFLAGS		0x00000028 /* Set driver-private flags bitmap */
+
+#define ETHTOOL_GRXFH		0x00000029 /* Get RX flow hash configuration */
+#define ETHTOOL_SRXFH		0x0000002a /* Set RX flow hash configuration */
+#define ETHTOOL_GGRO		0x0000002b /* Get GRO enable (ethtool_value) */
+#define ETHTOOL_SGRO		0x0000002c /* Set GRO enable (ethtool_value) */
+#define ETHTOOL_GRXRINGS	0x0000002d /* Get RX rings available for LB */
+#define ETHTOOL_GRXCLSRLCNT	0x0000002e /* Get RX class rule count */
+#define ETHTOOL_GRXCLSRULE	0x0000002f /* Get RX classification rule */
+#define ETHTOOL_GRXCLSRLALL	0x00000030 /* Get all RX classification rule */
+#define ETHTOOL_SRXCLSRLDEL	0x00000031 /* Delete RX classification rule */
+#define ETHTOOL_SRXCLSRLINS	0x00000032 /* Insert RX classification rule */
+#define ETHTOOL_FLASHDEV	0x00000033 /* Flash firmware to device */
+#define ETHTOOL_RESET		0x00000034 /* Reset hardware */
+#define ETHTOOL_SRXNTUPLE	0x00000035 /* Add an n-tuple filter to device */
+#define ETHTOOL_GRXNTUPLE	0x00000036 /* deprecated */
+#define ETHTOOL_GSSET_INFO	0x00000037 /* Get string set info */
+#define ETHTOOL_GRXFHINDIR	0x00000038 /* Get RX flow hash indir'n table */
+#define ETHTOOL_SRXFHINDIR	0x00000039 /* Set RX flow hash indir'n table */
+
+#define ETHTOOL_GFEATURES	0x0000003a /* Get device offload settings */
+#define ETHTOOL_SFEATURES	0x0000003b /* Change device offload settings */
+#define ETHTOOL_GCHANNELS	0x0000003c /* Get no of channels */
+#define ETHTOOL_SCHANNELS	0x0000003d /* Set no of channels */
+#define ETHTOOL_SET_DUMP	0x0000003e /* Set dump settings */
+#define ETHTOOL_GET_DUMP_FLAG	0x0000003f /* Get dump settings */
+#define ETHTOOL_GET_DUMP_DATA	0x00000040 /* Get dump data */
+#define ETHTOOL_GET_TS_INFO	0x00000041 /* Get time stamping and PHC info */
+#define ETHTOOL_GMODULEINFO	0x00000042 /* Get plug-in module information */
+#define ETHTOOL_GMODULEEEPROM	0x00000043 /* Get plug-in module eeprom */
+#define ETHTOOL_GEEE		0x00000044 /* Get EEE settings */
+#define ETHTOOL_SEEE		0x00000045 /* Set EEE settings */
+
+/* compatibility with older code */
+#define SPARC_ETH_GSET		ETHTOOL_GSET
+#define SPARC_ETH_SSET		ETHTOOL_SSET
+
+/* Indicates what features are supported by the interface. */
+#define SUPPORTED_10baseT_Half		(1 << 0)
+#define SUPPORTED_10baseT_Full		(1 << 1)
+#define SUPPORTED_100baseT_Half		(1 << 2)
+#define SUPPORTED_100baseT_Full		(1 << 3)
+#define SUPPORTED_1000baseT_Half	(1 << 4)
+#define SUPPORTED_1000baseT_Full	(1 << 5)
+#define SUPPORTED_Autoneg		(1 << 6)
+#define SUPPORTED_TP			(1 << 7)
+#define SUPPORTED_AUI			(1 << 8)
+#define SUPPORTED_MII			(1 << 9)
+#define SUPPORTED_FIBRE			(1 << 10)
+#define SUPPORTED_BNC			(1 << 11)
+#define SUPPORTED_10000baseT_Full	(1 << 12)
+#define SUPPORTED_Pause			(1 << 13)
+#define SUPPORTED_Asym_Pause		(1 << 14)
+#define SUPPORTED_2500baseX_Full	(1 << 15)
+#define SUPPORTED_Backplane		(1 << 16)
+#define SUPPORTED_1000baseKX_Full	(1 << 17)
+#define SUPPORTED_10000baseKX4_Full	(1 << 18)
+#define SUPPORTED_10000baseKR_Full	(1 << 19)
+#define SUPPORTED_10000baseR_FEC	(1 << 20)
+#define SUPPORTED_20000baseMLD2_Full	(1 << 21)
+#define SUPPORTED_20000baseKR2_Full	(1 << 22)
+#define SUPPORTED_40000baseKR4_Full	(1 << 23)
+#define SUPPORTED_40000baseCR4_Full	(1 << 24)
+#define SUPPORTED_40000baseSR4_Full	(1 << 25)
+#define SUPPORTED_40000baseLR4_Full	(1 << 26)
+
+/* Indicates what features are advertised by the interface. */
+#define ADVERTISED_10baseT_Half		(1 << 0)
+#define ADVERTISED_10baseT_Full		(1 << 1)
+#define ADVERTISED_100baseT_Half	(1 << 2)
+#define ADVERTISED_100baseT_Full	(1 << 3)
+#define ADVERTISED_1000baseT_Half	(1 << 4)
+#define ADVERTISED_1000baseT_Full	(1 << 5)
+#define ADVERTISED_Autoneg		(1 << 6)
+#define ADVERTISED_TP			(1 << 7)
+#define ADVERTISED_AUI			(1 << 8)
+#define ADVERTISED_MII			(1 << 9)
+#define ADVERTISED_FIBRE		(1 << 10)
+#define ADVERTISED_BNC			(1 << 11)
+#define ADVERTISED_10000baseT_Full	(1 << 12)
+#define ADVERTISED_Pause		(1 << 13)
+#define ADVERTISED_Asym_Pause		(1 << 14)
+#define ADVERTISED_2500baseX_Full	(1 << 15)
+#define ADVERTISED_Backplane		(1 << 16)
+#define ADVERTISED_1000baseKX_Full	(1 << 17)
+#define ADVERTISED_10000baseKX4_Full	(1 << 18)
+#define ADVERTISED_10000baseKR_Full	(1 << 19)
+#define ADVERTISED_10000baseR_FEC	(1 << 20)
+#define ADVERTISED_20000baseMLD2_Full	(1 << 21)
+#define ADVERTISED_20000baseKR2_Full	(1 << 22)
+#define ADVERTISED_40000baseKR4_Full	(1 << 23)
+#define ADVERTISED_40000baseCR4_Full	(1 << 24)
+#define ADVERTISED_40000baseSR4_Full	(1 << 25)
+#define ADVERTISED_40000baseLR4_Full	(1 << 26)
+
+/* The following are all involved in forcing a particular link
+ * mode for the device for setting things.  When getting the
+ * devices settings, these indicate the current mode and whether
+ * it was forced up into this mode or autonegotiated.
+ */
+
+/* The forced speed, 10Mb, 100Mb, gigabit, 2.5Gb, 10GbE. */
+#define SPEED_10		10
+#define SPEED_100		100
+#define SPEED_1000		1000
+#define SPEED_2500		2500
+#define SPEED_10000		10000
+#define SPEED_UNKNOWN		-1
+
+/* Duplex, half or full. */
+#define DUPLEX_HALF		0x00
+#define DUPLEX_FULL		0x01
+#define DUPLEX_UNKNOWN		0xff
+
+/* Which connector port. */
+#define PORT_TP			0x00
+#define PORT_AUI		0x01
+#define PORT_MII		0x02
+#define PORT_FIBRE		0x03
+#define PORT_BNC		0x04
+#define PORT_DA			0x05
+#define PORT_NONE		0xef
+#define PORT_OTHER		0xff
+
+/* Which transceiver to use. */
+#define XCVR_INTERNAL		0x00
+#define XCVR_EXTERNAL		0x01
+#define XCVR_DUMMY1		0x02
+#define XCVR_DUMMY2		0x03
+#define XCVR_DUMMY3		0x04
+
+/* Enable or disable autonegotiation.  If this is set to enable,
+ * the forced link modes above are completely ignored.
+ */
+#define AUTONEG_DISABLE		0x00
+#define AUTONEG_ENABLE		0x01
+
+/* MDI or MDI-X status/control - if MDI/MDI_X/AUTO is set then
+ * the driver is required to renegotiate link
+ */
+#define ETH_TP_MDI_INVALID	0x00 /* status: unknown; control: unsupported */
+#define ETH_TP_MDI		0x01 /* status: MDI;     control: force MDI */
+#define ETH_TP_MDI_X		0x02 /* status: MDI-X;   control: force MDI-X */
+#define ETH_TP_MDI_AUTO		0x03 /*                  control: auto-select */
+
+/* Wake-On-Lan options. */
+#define WAKE_PHY		(1 << 0)
+#define WAKE_UCAST		(1 << 1)
+#define WAKE_MCAST		(1 << 2)
+#define WAKE_BCAST		(1 << 3)
+#define WAKE_ARP		(1 << 4)
+#define WAKE_MAGIC		(1 << 5)
+#define WAKE_MAGICSECURE	(1 << 6) /* only meaningful if WAKE_MAGIC */
+
+/* L2-L4 network traffic flow types */
+#define	TCP_V4_FLOW	0x01	/* hash or spec (tcp_ip4_spec) */
+#define	UDP_V4_FLOW	0x02	/* hash or spec (udp_ip4_spec) */
+#define	SCTP_V4_FLOW	0x03	/* hash or spec (sctp_ip4_spec) */
+#define	AH_ESP_V4_FLOW	0x04	/* hash only */
+#define	TCP_V6_FLOW	0x05	/* hash only */
+#define	UDP_V6_FLOW	0x06	/* hash only */
+#define	SCTP_V6_FLOW	0x07	/* hash only */
+#define	AH_ESP_V6_FLOW	0x08	/* hash only */
+#define	AH_V4_FLOW	0x09	/* hash or spec (ah_ip4_spec) */
+#define	ESP_V4_FLOW	0x0a	/* hash or spec (esp_ip4_spec) */
+#define	AH_V6_FLOW	0x0b	/* hash only */
+#define	ESP_V6_FLOW	0x0c	/* hash only */
+#define	IP_USER_FLOW	0x0d	/* spec only (usr_ip4_spec) */
+#define	IPV4_FLOW	0x10	/* hash only */
+#define	IPV6_FLOW	0x11	/* hash only */
+#define	ETHER_FLOW	0x12	/* spec only (ether_spec) */
+/* Flag to enable additional fields in struct ethtool_rx_flow_spec */
+#define	FLOW_EXT	0x80000000
+#define	FLOW_MAC_EXT	0x40000000
+
+/* L3-L4 network traffic flow hash options */
+#define	RXH_L2DA	(1 << 1)
+#define	RXH_VLAN	(1 << 2)
+#define	RXH_L3_PROTO	(1 << 3)
+#define	RXH_IP_SRC	(1 << 4)
+#define	RXH_IP_DST	(1 << 5)
+#define	RXH_L4_B_0_1	(1 << 6) /* src port in case of TCP/UDP/SCTP */
+#define	RXH_L4_B_2_3	(1 << 7) /* dst port in case of TCP/UDP/SCTP */
+#define	RXH_DISCARD	(1 << 31)
+
+#define	RX_CLS_FLOW_DISC	0xffffffffffffffffULL
+
+/* Special RX classification rule insert location values */
+#define RX_CLS_LOC_SPECIAL	0x80000000	/* flag */
+#define RX_CLS_LOC_ANY		0xffffffff
+#define RX_CLS_LOC_FIRST	0xfffffffe
+#define RX_CLS_LOC_LAST		0xfffffffd
+
+/* EEPROM Standards for plug in modules */
+#define ETH_MODULE_SFF_8079		0x1
+#define ETH_MODULE_SFF_8079_LEN		256
+#define ETH_MODULE_SFF_8472		0x2
+#define ETH_MODULE_SFF_8472_LEN		512
+
+/* Reset flags */
+/* The reset() operation must clear the flags for the components which
+ * were actually reset.  On successful return, the flags indicate the
+ * components which were not reset, either because they do not exist
+ * in the hardware or because they cannot be reset independently.  The
+ * driver must never reset any components that were not requested.
+ */
+enum ethtool_reset_flags {
+	/* These flags represent components dedicated to the interface
+	 * the command is addressed to.  Shift any flag left by
+	 * ETH_RESET_SHARED_SHIFT to reset a shared component of the
+	 * same type.
+	 */
+	ETH_RESET_MGMT		= 1 << 0,	/* Management processor */
+	ETH_RESET_IRQ		= 1 << 1,	/* Interrupt requester */
+	ETH_RESET_DMA		= 1 << 2,	/* DMA engine */
+	ETH_RESET_FILTER	= 1 << 3,	/* Filtering/flow direction */
+	ETH_RESET_OFFLOAD	= 1 << 4,	/* Protocol offload */
+	ETH_RESET_MAC		= 1 << 5,	/* Media access controller */
+	ETH_RESET_PHY		= 1 << 6,	/* Transceiver/PHY */
+	ETH_RESET_RAM		= 1 << 7,	/* RAM shared between
+						 * multiple components */
+
+	ETH_RESET_DEDICATED	= 0x0000ffff,	/* All components dedicated to
+						 * this interface */
+	ETH_RESET_ALL		= 0xffffffff,	/* All components used by this
+						 * interface, even if shared */
+};
+#define ETH_RESET_SHARED_SHIFT	16
+
+#endif /* _LINUX_ETHTOOL_H */
diff --git a/RM520N-5G/文件/source/main.c b/RM520N-5G/文件/source/main.c
new file mode 100644
index 0000000..4d5ff1c
--- /dev/null
+++ b/RM520N-5G/文件/source/main.c
@@ -0,0 +1,1197 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include "QMIThread.h"
+#include <sys/wait.h>
+#include <sys/utsname.h>
+#include <sys/time.h>
+#include <dirent.h>
+
+#include "util.h"
+//#define CONFIG_PID_FILE_FORMAT "/var/run/quectel-CM-%s.pid" //for example /var/run/quectel-CM-wwan0.pid
+
+static PROFILE_T s_profile;
+int debug_qmi = 0;
+int qmidevice_control_fd[2];
+static int signal_control_fd[2];
+#ifdef USE_IPC_MSG_STATUS_IND
+static int qcm_status_indication_fd[2];
+#endif
+int g_donot_exit_when_modem_hangup = 0;
+extern int ql_ifconfig(int argc, char *argv[]);
+extern int ql_get_netcard_driver_info(const char*);
+extern int ql_capture_usbmon_log(PROFILE_T *profile, const char *log_path);
+extern void ql_stop_usbmon_log(PROFILE_T *profile);
+//UINT ifc_get_addr(const char *ifname);
+extern int cdc_wdm_fd;
+static int s_link = -1;
+static void usbnet_link_change(int link, PROFILE_T *profile) {
+    if (s_link == link)
+        return;
+
+    s_link = link;
+
+    if (!(link & (1<<IpFamilyV4)))
+        memset(&profile->ipv4, 0, sizeof(IPV4_T));
+
+    if (!(link & (1<<IpFamilyV6)))
+        memset(&profile->ipv6, 0, sizeof(IPV6_T));
+
+    if (link) {
+        udhcpc_start(profile);
+    } else {
+        udhcpc_stop(profile);
+    }
+}
+
+static int check_ipv4_address(PROFILE_T *profile) {
+    uint32_t oldAddress = profile->ipv4.Address;
+
+    if (profile->request_ops == &mbim_request_ops)
+        return 1; //we will get a new ipv6 address per requestGetIPAddress()
+    if (profile->request_ops == &atc_request_ops) {
+       if (!profile->udhcpc_ip) return 1;
+       oldAddress = profile->udhcpc_ip;
+    }
+
+    if (profile->request_ops->requestGetIPAddress(profile, IpFamilyV4) == 0) {
+         if (profile->ipv4.Address != oldAddress || debug_qmi) {
+             unsigned char *l = (unsigned char *)&oldAddress;
+             unsigned char *r = (unsigned char *)&profile->ipv4.Address;
+             dbg_time("localIP: %d.%d.%d.%d VS remoteIP: %d.%d.%d.%d",
+                     l[3], l[2], l[1], l[0], r[3], r[2], r[1], r[0]);
+        }
+        return (profile->ipv4.Address == oldAddress);
+    }
+
+    return 0;
+}
+
+static void main_send_event_to_qmidevice(int triger_event) {
+     if (write(qmidevice_control_fd[0], &triger_event, sizeof(triger_event)) == -1) {};
+}
+
+static void send_signo_to_main(int signo) {
+     if (write(signal_control_fd[0], &signo, sizeof(signo)) == -1) {};
+}
+
+#ifdef USE_IPC_MSG_STATUS_IND
+static void main_send_status_to_fifo(uint8_t status) {
+     if (write(qcm_status_indication_fd[0], &status, sizeof(status)) == -1) {};
+}
+#endif
+
+void qmidevice_send_event_to_main(int triger_event) {
+     if (write(qmidevice_control_fd[1], &triger_event, sizeof(triger_event)) == -1) {};
+}
+
+void qmidevice_send_event_to_main_ext(int triger_event, void *data, unsigned len) {
+     if (write(qmidevice_control_fd[1], &triger_event, sizeof(triger_event)) == -1) {};
+     if (write(qmidevice_control_fd[1], data, len) == -1) {};
+}
+
+#ifdef USE_IPC_MSG_STATUS_IND
+static int msg_get()
+{
+    key_t key = ftok(MSG_FILE, 'a');
+    int msgid = msgget(key, IPC_CREAT | 0644);
+
+    if (msgid < 0)
+    {
+        dbg_time("msgget fail: key %d, %s", key, strerror(errno));
+        return -1;
+    }
+    return msgid;
+}
+
+static int msg_rm(int msgid)
+{
+    return msgctl(msgid, IPC_RMID, 0);
+}
+
+static int msg_send(int msgid, long type, const char *msg)
+{
+    struct message info;
+    info.mtype = type;
+    snprintf(info.mtext, MSGBUFFSZ, "%s", msg);
+    if (msgsnd(msgid, (void *)&info, MSGBUFFSZ, IPC_NOWAIT) < 0)
+    {
+        dbg_time("msgsnd faild: msg %s, %s", msg, strerror(errno));
+        return -1;
+    }
+    return 0;
+}
+
+void* qcm_status_thread(void *arg)
+{
+    uint8_t status = 0;
+    int msgid = -1;
+    char buf[MSGBUFFSZ] = {0};
+
+    uint8_t* tmp = arg;
+    if (tmp == NULL)
+    {
+        dbg_time("%s qcm start report status", __func__);
+    }
+
+    if (access(MSG_FILE, F_OK))
+    {
+        dbg_time("%s %s isn't exit", __func__, MSG_FILE);
+        pthread_exit(NULL);
+        return (void*)0;
+    }
+    else
+    {
+        msgid = msg_get();
+        if (msgid < 0)
+        {
+            dbg_time("%s msg_get fail", __func__);
+            pthread_exit(NULL);
+            return (void*)0;
+        }
+    }
+
+    while (1)
+    {
+        struct pollfd pollfds[] = {{qcm_status_indication_fd[1], POLLIN, 0}};
+        int ret;
+
+        do
+        {
+            ret = poll(pollfds, 1,  -1);
+        } while ((ret < 0) && (errno == EINTR));
+
+        if (ret <= 0) {
+            dbg_time("%s poll=%d, errno: %d (%s)", __func__, ret, errno, strerror(errno));
+            break;
+        }
+
+        if (pollfds[0].revents & (POLLERR | POLLHUP | POLLNVAL))
+        {
+            dbg_time("%s poll err/hup", __func__);
+            dbg_time("epoll pollfds[0].fd = %d, pollfds[0].events = 0x%04x", pollfds[0].fd, pollfds[0].revents);
+            break;
+        }
+
+        if ((pollfds[0].revents & POLLIN) == 0)
+        {
+            continue;
+        }
+
+        if (read(pollfds[0].fd, &status, sizeof(status)) == sizeof(status))
+        {
+            memset(buf, 0, sizeof(buf));
+            snprintf(buf, sizeof(buf), "%d", status);
+
+            if (msg_send(msgid, MSG_TYPE_IPC, buf) >= 0)
+            {
+                //dbg_time("%s msg_send success msgid = %d  status = %d", __func__, msgid, status);
+            }
+            else
+            {
+                dbg_time("%s msg_send fail", __func__);
+                break;
+            }
+
+            if (status == QCM_PROCESS_EXIT)
+            {
+                dbg_time("%s qcm process exit", __func__);
+                usleep(100000);
+                break;
+            }
+        }
+        else
+        {
+            dbg_time("%s read fail", __func__);
+            break;
+        }
+    }
+
+    if (msg_rm(msgid) < 0)
+    {
+        dbg_time("%s msg_rm fail", __func__);
+    }
+
+    dbg_time("%s exit", __func__);
+    pthread_exit(NULL);
+    return (void*)0;
+}
+#endif
+
+#define MAX_PATH 256
+
+static int ls_dir(const char *dir, int (*match)(const char *dir, const char *file, void *argv[]), void *argv[])
+{
+    DIR *pDir;
+    struct dirent* ent = NULL;
+    int match_times = 0;
+
+    pDir = opendir(dir);
+    if (pDir == NULL)  {
+        dbg_time("Cannot open directory: %s, errno: %d (%s)", dir, errno, strerror(errno));
+        return 0;
+    }
+
+    while ((ent = readdir(pDir)) != NULL)  {
+        match_times += match(dir, ent->d_name, argv);
+    }
+    closedir(pDir);
+
+    return match_times;
+}
+
+static int is_same_linkfile(const char *dir, const char *file,  void *argv[])
+{
+    const char *qmichannel = (const char *)argv[1];
+    char linkname[MAX_PATH*2+6];
+    char filename[MAX_PATH];
+    int linksize;
+
+    snprintf(linkname, sizeof(linkname), "%.256s/%s", dir, file);
+    linksize = readlink(linkname, filename, sizeof(filename));
+    if (linksize <= 0)
+        return 0;
+
+    filename[linksize] = 0;
+    if (strcmp(filename, qmichannel))
+        return 0;
+
+    dbg_time("%s -> %s", linkname, filename);
+    return 1;
+}
+
+static int is_brother_process(const char *dir, const char *file, void *argv[])
+{
+    //const char *myself = (const char *)argv[0];
+    char linkname[MAX_PATH*2+6];
+    char filename[MAX_PATH];
+    int linksize;
+    int i = 0, kill_timeout = 15;
+    pid_t pid;
+
+    //dbg_time("%s", file);
+    while (file[i]) {
+        if (!isdigit(file[i]))
+            break;
+        i++;
+    }
+
+    if (file[i]) {
+        //dbg_time("%s not digit", file);
+        return 0;
+    }
+
+    snprintf(linkname, sizeof(linkname), "%s/%s/exe", dir, file);
+    linksize = readlink(linkname, filename, sizeof(filename));
+    if (linksize <= 0)
+        return 0;
+
+    filename[linksize] = 0;
+
+    pid = atoi(file);
+    if (pid >= getpid())
+        return 0;
+
+    snprintf(linkname, sizeof(linkname), "%s/%s/fd", dir, file);
+    if (!ls_dir(linkname, is_same_linkfile, argv))
+        return 0;
+
+    dbg_time("%s/%s/exe -> %s", dir, file, filename);
+    while (kill_timeout-- && !kill(pid, 0))
+    {
+        kill(pid, SIGTERM);
+        sleep(1);
+    }
+    if (!kill(pid, 0))
+    {
+        dbg_time("force kill %s/%s/exe -> %s", dir, file, filename);
+        kill(pid, SIGKILL);
+        sleep(1);
+    }
+
+    return 1;
+}
+
+static int kill_brothers(const char *qmichannel)
+{
+    char myself[MAX_PATH];
+    int filenamesize;
+    void *argv[2] = {myself, (void *)qmichannel};
+
+    filenamesize = readlink("/proc/self/exe", myself, sizeof(myself));
+    if (filenamesize <= 0)
+        return 0;
+    myself[filenamesize] = 0;
+
+    if (ls_dir("/proc", is_brother_process, argv))
+        sleep(1);
+
+    return 0;
+}
+
+static int kill_data_call_pdp(int pdp, char *self) {
+    int pid;
+    char *p = NULL;
+
+    p = self;
+    while (*self) {
+        if (*self == '/')
+            p = self+1;
+        self++;
+    }
+
+    pid = getpid_by_pdp(pdp, p);
+    if (pid > 0) {
+        dbg_time("send SIGINT to process %d", pid);
+        return kill(pid, SIGINT);
+    }
+
+    return -1;
+}
+
+static void ql_sigaction(int signo) {
+     if (SIGALRM == signo)
+         send_signo_to_main(SIG_EVENT_START);
+     else
+     {
+        g_donot_exit_when_modem_hangup = 0;
+        send_signo_to_main(SIG_EVENT_STOP);
+        main_send_event_to_qmidevice(SIG_EVENT_STOP); //main may be wating qmi response
+    }
+}
+
+static int usage(const char *progname) {
+    dbg_time("Usage: %s [options]", progname);
+    dbg_time("-s [apn [user password auth]]          Set apn/user/password/auth get from your network provider. auth: 1~pap, 2~chap, 3~MsChapV2");
+    dbg_time("-p pincode                             Verify sim card pin if sim card is locked");
+    dbg_time("-p [quectel-][qmi|mbim]-proxy          Request to use proxy");
+    dbg_time("-f logfilename                         Save log message of this program to file");
+    dbg_time("-u usbmonlog filename                  Save usbmon log to file");
+    dbg_time("-i interface                           Specify which network interface to setup data call when multi-modems exits");
+    dbg_time("-4                                     Setup IPv4 data call (default)");
+    dbg_time("-6                                     Setup IPv6 data call");
+    dbg_time("-n pdn                                 Specify which pdn to setup data call (default 1 for QMI, 0 for MBIM)");
+    dbg_time("-k pdn                                 Specify which pdn to hangup data call (by send SIGINT to 'quectel-CM -n pdn')");
+    dbg_time("-m iface-idx                           Bind QMI data call to wwan0_<iface idx> when QMAP used. E.g '-n 7 -m 1' bind pdn-7 data call to wwan0_1");
+    dbg_time("-b                                     Enable network interface bridge function (default 0)");
+    dbg_time("-v                                     Verbose log mode, for debug purpose.");
+    dbg_time("-d                                     Obtain the IP address and dns through qmi");
+    dbg_time("-a                                     1:Device attempts to bring up a call with the APN name,if -a 1 need add -s apn_name ;2:Device attempts to bring up a call with the APN type,if -a 2 need add -y apn_type");
+    dbg_time("-y                                     Set APN type 0:APN type unspecified 1:internet traffic. 2:IMS");
+    dbg_time("[Examples]");
+    dbg_time("Example 1: %s ", progname);
+    dbg_time("Example 2: %s -s 3gnet ", progname);
+    dbg_time("Example 3: %s -s 3gnet carl 1234 1 -p 1234 -f gobinet_log.txt", progname);
+    return 0;
+}
+
+static int qmi_main(PROFILE_T *profile)
+{
+    int triger_event = 0;
+    int signo;
+#ifdef CONFIG_SIM
+    SIM_Status SIMStatus = SIM_ABSENT;
+#endif
+    UCHAR PSAttachedState = 0;
+    UCHAR  IPv4ConnectionStatus = QWDS_PKT_DATA_UNKNOW;
+    UCHAR  IPv6ConnectionStatus = QWDS_PKT_DATA_UNKNOW; 
+    unsigned SetupCallFail = 0;
+    unsigned long SetupCallAllowTime = clock_msec();
+#ifdef REBOOT_SIM_CARD_WHEN_LONG_TIME_NO_PS
+    unsigned PsAttachFail = 0;
+    unsigned long PsAttachTime = clock_msec();
+#endif
+    int qmierr = 0;
+    const struct request_ops *request_ops = profile ->request_ops;
+    pthread_t gQmiThreadID = 0;
+#ifdef USE_IPC_MSG_STATUS_IND
+    pthread_t gQcmStatusThreadID = 0;
+#endif
+
+//sudo apt-get install udhcpc
+//sudo apt-get remove ModemManager
+    if (profile->reattach_flag) {
+        if (!reattach_driver(profile)) 
+            sleep(2);
+    }
+
+    g_donot_exit_when_modem_hangup = 0;
+
+    /* try to recreate FDs*/
+    if (socketpair( AF_LOCAL, SOCK_STREAM, 0, signal_control_fd) < 0 ) {
+        dbg_time("%s Faild to create main_control_fd: %d (%s)", __func__, errno, strerror(errno));
+        return -1;
+    }
+
+    if ( socketpair( AF_LOCAL, SOCK_STREAM, 0, qmidevice_control_fd ) < 0 ) {
+        dbg_time("%s Failed to create thread control socket pair: %d (%s)", __func__, errno, strerror(errno));
+        return 0;
+    }
+
+#ifdef USE_IPC_MSG_STATUS_IND
+    if ( socketpair( AF_LOCAL, SOCK_STREAM, 0, qcm_status_indication_fd ) < 0 ) {
+        dbg_time("%s Failed to create thread qcm_status_indication_fd socket pair: %d (%s)", __func__, errno, strerror(errno));
+        return 0;
+    }
+#endif
+
+    if ((profile->qmap_mode == 0 || profile->qmap_mode == 1)
+        && (!profile->proxy[0] || strstr(profile->qmichannel, "_IPCR"))) {
+        kill_brothers(profile->qmichannel);
+    }
+
+#ifdef USE_IPC_MSG_STATUS_IND
+    if (pthread_create( &gQcmStatusThreadID, 0, qcm_status_thread, NULL) != 0) {
+        dbg_time("%s Failed to create QMIThread: %d (%s)", __func__, errno, strerror(errno));
+        return 0;
+    }
+#endif
+
+    if (pthread_create( &gQmiThreadID, 0, profile->qmi_ops->read, (void *)profile) != 0) {
+        dbg_time("%s Failed to create QMIThread: %d (%s)", __func__, errno, strerror(errno));
+        return 0;
+    }
+
+    if ((read(qmidevice_control_fd[0], &triger_event, sizeof(triger_event)) != sizeof(triger_event))
+        || (triger_event != RIL_INDICATE_DEVICE_CONNECTED)) {
+        dbg_time("%s Failed to init QMIThread: %d (%s)", __func__, errno, strerror(errno));
+        return 0;
+    }
+
+    if (profile->qmi_ops->init && profile->qmi_ops->init(profile)) {
+        dbg_time("%s Failed to qmi init: %d (%s)", __func__, errno, strerror(errno));
+        return 0;
+    }
+
+#ifdef USE_IPC_MSG_STATUS_IND
+    main_send_status_to_fifo(QCM_PARA_CONFIG_QUERY);
+#endif
+
+    if (request_ops->requestBaseBandVersion)
+        request_ops->requestBaseBandVersion(profile);
+
+    if (request_ops->requestSetEthMode)
+        request_ops->requestSetEthMode(profile);
+
+    if (request_ops->requestSetLoopBackState && profile->loopback_state) {
+    	qmierr = request_ops->requestSetLoopBackState(profile->loopback_state, profile->replication_factor);
+    	if (qmierr != QMI_ERR_INVALID_QMI_CMD) //X20 return this error 
+            profile->loopback_state = 0; //wait for RIL_UNSOL_LOOPBACK_CONFIG_IND
+    }
+
+    if (request_ops->requestGetSIMStatus) {
+        qmierr = request_ops->requestGetSIMStatus(&SIMStatus);
+
+        while (qmierr == QMI_ERR_OP_DEVICE_UNSUPPORTED) {
+            sleep(1);
+            qmierr = request_ops->requestGetSIMStatus(&SIMStatus);
+        }
+
+        if ((SIMStatus == SIM_PIN) && profile->pincode && request_ops->requestEnterSimPin) {
+            request_ops->requestEnterSimPin(profile->pincode);
+        }
+    }
+
+    if (SIMStatus == SIM_READY) {
+        if (request_ops->requestGetICCID)
+            request_ops->requestGetICCID();
+
+        if (request_ops->requestGetIMSI)
+            request_ops->requestGetIMSI();
+    }
+if(profile->usb_dev.idProduct != 0x0316)
+{
+    if (request_ops->requestGetProfile)
+        request_ops->requestGetProfile(profile);
+
+    if (request_ops->requestSetProfile && (profile->apn || profile->user || profile->pd)) {
+        if (request_ops->requestSetProfile(profile) == 1) {
+#ifdef REBOOT_SIM_CARD_WHEN_APN_CHANGE //enable at only when customer asked 
+            if (request_ops->requestRadioPower) {
+                request_ops->requestRadioPower(0);
+                request_ops->requestRadioPower(1);
+            }
+#endif
+        }
+    }
+}
+    request_ops->requestRegistrationState(&PSAttachedState);
+
+#ifdef CONFIG_ENABLE_QOS
+    request_ops->requestRegisterQos(profile);
+#endif
+
+#if 1 //USB disconnnect and re-connect, but not reboot modem, will get this bug
+    if (profile->enable_ipv4
+        && profile->request_ops == &atc_request_ops
+        && !request_ops->requestQueryDataCall(&IPv4ConnectionStatus, IpFamilyV4)
+        && IPv4ConnectionStatus == QWDS_PKT_DATA_CONNECTED) {
+        request_ops->requestDeactivateDefaultPDP(profile, IpFamilyV4);
+    }
+#endif
+
+    send_signo_to_main(SIG_EVENT_CHECK);
+
+    while (1)
+    {
+        struct pollfd pollfds[] = {{signal_control_fd[1], POLLIN, 0}, {qmidevice_control_fd[0], POLLIN, 0}};
+        int ne, ret, nevents = sizeof(pollfds)/sizeof(pollfds[0]);
+
+        do {
+            ret = poll(pollfds, nevents,  15*1000);
+        } while ((ret < 0) && (errno == EINTR));
+
+        if (ret == 0)
+        {
+            send_signo_to_main(SIG_EVENT_CHECK);
+            continue;
+        }
+
+        if (ret <= 0) {
+            dbg_time("%s poll=%d, errno: %d (%s)", __func__, ret, errno, strerror(errno));
+            goto __main_quit;
+        }
+
+        for (ne = 0; ne < nevents; ne++) {
+            int fd = pollfds[ne].fd;
+            short revents = pollfds[ne].revents;
+
+            if (revents & (POLLERR | POLLHUP | POLLNVAL)) {
+                dbg_time("%s poll err/hup", __func__);
+                dbg_time("epoll fd = %d, events = 0x%04x", fd, revents);
+                main_send_event_to_qmidevice(RIL_REQUEST_QUIT);
+#ifdef USE_IPC_MSG_STATUS_IND
+                main_send_status_to_fifo(QCM_PROCESS_EXIT);
+#endif
+                if (revents & POLLHUP)
+                    goto __main_quit;
+            }
+
+            if ((revents & POLLIN) == 0)
+                continue;
+
+            if (fd == signal_control_fd[1])
+            {
+                if (read(fd, &signo, sizeof(signo)) == sizeof(signo))
+                {
+                    alarm(0);
+                    switch (signo)
+                    {
+                        case SIG_EVENT_START:
+                            if (PSAttachedState != 1 && profile->loopback_state == 0)
+                                break;
+                            
+                            if (SetupCallAllowTime > clock_msec()) {
+                                alarm((SetupCallAllowTime - clock_msec()+999)/1000);
+                                break;
+                            }
+
+#ifdef USE_IPC_MSG_STATUS_IND
+                            main_send_status_to_fifo(QCM_PREPARE_START_DAIL);
+#endif
+
+                            if (profile->enable_ipv4 && IPv4ConnectionStatus !=  QWDS_PKT_DATA_CONNECTED) {
+                                qmierr = request_ops->requestSetupDataCall(profile, IpFamilyV4);
+
+                                if ((qmierr > 0) && profile->user && profile->user[0] && profile->pd && profile->pd[0]) {
+                                    int old_auto =  profile->auth;
+
+                                    //may be fail because wrong auth mode, try pap->chap, or chap->pap
+                                    profile->auth = (profile->auth == 1) ? 2 : 1;
+                                	qmierr = request_ops->requestSetupDataCall(profile, IpFamilyV4);
+
+                                    if (qmierr)
+                                        profile->auth = old_auto; //still fail, restore old auth moe
+                                }
+
+                                if (!qmierr) {
+                                    qmierr = request_ops->requestGetIPAddress(profile, IpFamilyV4);
+                                    if (!qmierr)
+                                    {
+                                        IPv4ConnectionStatus = QWDS_PKT_DATA_CONNECTED;
+#ifdef USE_IPC_MSG_STATUS_IND
+                                        main_send_status_to_fifo(QCM_NETWORK_IPV4_CONNECTED);
+#endif
+                                    }
+                                }
+                                        
+                            }
+
+                            if (profile->enable_ipv6 && IPv6ConnectionStatus !=  QWDS_PKT_DATA_CONNECTED) {
+                                if (profile->enable_ipv4 && profile->request_ops != &qmi_request_ops) {
+                                    IPv6ConnectionStatus = IPv4ConnectionStatus;
+                                }
+                                else {
+                                    qmierr = request_ops->requestSetupDataCall(profile, IpFamilyV6);
+
+                                    if (!qmierr) {
+                                        qmierr = request_ops->requestGetIPAddress(profile, IpFamilyV6);
+                                        if (!qmierr)
+                                        {
+                                            IPv6ConnectionStatus = QWDS_PKT_DATA_CONNECTED;
+#ifdef USE_IPC_MSG_STATUS_IND
+                                            main_send_status_to_fifo(QCM_NETWORK_IPV6_CONNECTED);
+#endif
+                                        }
+                                    }
+                                }
+                            }
+                                
+                            if ((profile->enable_ipv4 && IPv4ConnectionStatus ==  QWDS_PKT_DATA_DISCONNECTED)
+                                    || (profile->enable_ipv6 && IPv6ConnectionStatus ==  QWDS_PKT_DATA_DISCONNECTED)) {
+                                const unsigned allow_time[] = {5, 10, 20, 40, 60};
+
+                                if (SetupCallFail < (sizeof(allow_time)/sizeof(unsigned)))
+                                    SetupCallAllowTime = allow_time[SetupCallFail];
+                                else
+                                    SetupCallAllowTime = 60;
+                                SetupCallFail++;
+                                dbg_time("try to requestSetupDataCall %ld second later", SetupCallAllowTime);
+                                alarm(SetupCallAllowTime);
+                                SetupCallAllowTime = SetupCallAllowTime*1000 + clock_msec();
+#ifdef USE_IPC_MSG_STATUS_IND
+                                main_send_status_to_fifo(QCM_PREPARE_RESTART_DAIL);
+#endif
+                            }
+                            else if (IPv4ConnectionStatus ==  QWDS_PKT_DATA_CONNECTED || IPv6ConnectionStatus ==  QWDS_PKT_DATA_CONNECTED) {
+                                SetupCallFail = 0;
+                                SetupCallAllowTime = clock_msec();
+#ifdef USE_IPC_MSG_STATUS_IND
+                                main_send_status_to_fifo(QCM_PREPARE_DAIL_SUCC);
+#endif
+                            }
+                        break;
+
+                        case SIG_EVENT_CHECK:
+                            if (request_ops->requestGetSignalInfo)
+                                request_ops->requestGetSignalInfo();
+                            
+                            if (request_ops->requestGetCellInfoList)
+                                request_ops->requestGetCellInfoList();
+							
+                            if (request_ops->requestGetCoexWWANState)
+                                request_ops->requestGetCoexWWANState();
+							
+                            if (PSAttachedState != 1)
+                                request_ops->requestRegistrationState(&PSAttachedState);
+
+#ifdef REBOOT_SIM_CARD_WHEN_LONG_TIME_NO_PS
+                            if (PSAttachedState) {
+                                PsAttachTime = clock_msec();
+                                PsAttachFail = 0;
+                            }
+                            else {
+                                unsigned long diff = (clock_msec() - PsAttachTime) / 1000;
+                                unsigned long threshold = REBOOT_SIM_CARD_WHEN_LONG_TIME_NO_PS << PsAttachFail;
+
+                                if (diff > threshold || diff > 960) {
+                                    //interval time is 60 -> 120 - > 240 - > 480 -> 960
+                                    PsAttachTime = clock_msec();
+                                    PsAttachFail++;
+
+                                    if (request_ops->requestRadioPower) {
+                                        request_ops->requestRadioPower(0);
+                                        request_ops->requestRadioPower(1);
+                                    }
+                                }
+                            }
+#endif
+
+                            if (profile->enable_ipv4 && IPv4ConnectionStatus != QWDS_PKT_DATA_DISCONNECTED
+                                && !request_ops->requestQueryDataCall(&IPv4ConnectionStatus, IpFamilyV4))
+                            {
+                                if (QWDS_PKT_DATA_CONNECTED == IPv4ConnectionStatus && profile->ipv4.Address == 0) {
+                                    //killall -9 quectel-CM for MBIM and ATC call
+                                    qmierr = request_ops->requestGetIPAddress(profile, IpFamilyV4);
+                                    if (qmierr)
+                                        IPv4ConnectionStatus = QWDS_PKT_DATA_DISCONNECTED;
+                                }
+
+                                //local ip is different with remote ip
+                                if (QWDS_PKT_DATA_CONNECTED == IPv4ConnectionStatus && check_ipv4_address(profile) == 0) {
+                                    request_ops->requestDeactivateDefaultPDP(profile, IpFamilyV4);
+                                    IPv4ConnectionStatus = QWDS_PKT_DATA_DISCONNECTED;
+                                }
+                            }
+                            else {
+                                IPv4ConnectionStatus = QWDS_PKT_DATA_DISCONNECTED;
+                            }
+
+                            if (profile->enable_ipv6 && IPv6ConnectionStatus != QWDS_PKT_DATA_DISCONNECTED) {
+                                if (profile->enable_ipv4 && profile->request_ops != &qmi_request_ops) {
+                                    IPv6ConnectionStatus = IPv4ConnectionStatus;
+                                }
+                                else {
+                                    request_ops->requestQueryDataCall(&IPv6ConnectionStatus, IpFamilyV6);
+                                }
+                            }
+                            else {
+                                IPv6ConnectionStatus = QWDS_PKT_DATA_DISCONNECTED;
+                            }
+
+                            if (IPv4ConnectionStatus ==  QWDS_PKT_DATA_DISCONNECTED && IPv6ConnectionStatus ==  QWDS_PKT_DATA_DISCONNECTED) {
+                                usbnet_link_change(0, profile);
+                            }
+                            else if (IPv4ConnectionStatus ==  QWDS_PKT_DATA_CONNECTED || IPv6ConnectionStatus ==  QWDS_PKT_DATA_CONNECTED) {
+                                int link = 0;
+                                if (IPv4ConnectionStatus == QWDS_PKT_DATA_CONNECTED)
+                                    link |= (1<<IpFamilyV4);
+                                if (IPv6ConnectionStatus == QWDS_PKT_DATA_CONNECTED)
+                                    link |= (1<<IpFamilyV6);
+                                usbnet_link_change(link, profile);
+                            }
+
+#ifdef USE_IPC_MSG_STATUS_IND
+                            if ((profile->enable_ipv4 && IPv4ConnectionStatus ==  QWDS_PKT_DATA_DISCONNECTED))
+                            {
+                                main_send_status_to_fifo(QCM_NETWORK_IPV4_DISCONNECTED);
+                            }
+                            else
+                            {
+                                main_send_status_to_fifo(QCM_NETWORK_IPV4_CONNECTED);
+                            }
+
+                            if ((profile->enable_ipv6 && IPv6ConnectionStatus ==  QWDS_PKT_DATA_DISCONNECTED))
+                            {
+                                main_send_status_to_fifo(QCM_NETWORK_IPV6_DISCONNECTED);
+                            }
+                            else
+                            {
+                                main_send_status_to_fifo(QCM_NETWORK_IPV6_CONNECTED);
+                            }
+#endif
+
+                            if ((profile->enable_ipv4 && IPv4ConnectionStatus ==  QWDS_PKT_DATA_DISCONNECTED)
+                                || (profile->enable_ipv6 && IPv6ConnectionStatus ==  QWDS_PKT_DATA_DISCONNECTED)) {
+                                send_signo_to_main(SIG_EVENT_START);
+                            }
+                        break;
+
+                        case SIG_EVENT_STOP:
+                            if (profile->enable_ipv4 && IPv4ConnectionStatus ==  QWDS_PKT_DATA_CONNECTED) {
+                                request_ops->requestDeactivateDefaultPDP(profile, IpFamilyV4);
+                            }
+                            if (profile->enable_ipv6 && IPv6ConnectionStatus ==  QWDS_PKT_DATA_CONNECTED) {
+                                if (profile->enable_ipv4 && profile->request_ops != &qmi_request_ops) {
+                                    
+                                }
+                                else {
+                                    request_ops->requestDeactivateDefaultPDP(profile, IpFamilyV6);
+                                }
+                            }
+                            usbnet_link_change(0, profile);
+#ifdef USE_IPC_MSG_STATUS_IND
+                            main_send_status_to_fifo(QCM_PROCESS_EXIT);
+#endif
+                            if (profile->qmi_ops->deinit)
+                                profile->qmi_ops->deinit();
+                            main_send_event_to_qmidevice(RIL_REQUEST_QUIT);
+                            goto __main_quit;
+                        break;
+
+                        default:
+                        break;
+                    }
+                }
+            }
+
+            if (fd == qmidevice_control_fd[0]) {
+                if (read(fd, &triger_event, sizeof(triger_event)) == sizeof(triger_event)) {
+                    switch (triger_event) {
+                        case RIL_INDICATE_DEVICE_DISCONNECTED:
+                            usbnet_link_change(0, profile);                            
+                            goto __main_quit;
+                        break;
+
+                        case RIL_UNSOL_RESPONSE_VOICE_NETWORK_STATE_CHANGED:
+                            request_ops->requestRegistrationState(&PSAttachedState);
+                            if (PSAttachedState == 1) {
+                                if ((profile->enable_ipv4 && IPv4ConnectionStatus ==  QWDS_PKT_DATA_DISCONNECTED)
+                                    || (profile->enable_ipv6 && IPv6ConnectionStatus ==  QWDS_PKT_DATA_DISCONNECTED)) {
+                                    send_signo_to_main(SIG_EVENT_START);
+                                }
+                             } else {
+                                SetupCallAllowTime = clock_msec();
+                             }
+                        break;
+
+                        case RIL_UNSOL_DATA_CALL_LIST_CHANGED:
+                            if (IPv4ConnectionStatus ==  QWDS_PKT_DATA_CONNECTED || IPv6ConnectionStatus ==  QWDS_PKT_DATA_CONNECTED) {
+                                SetupCallAllowTime = clock_msec() + 1000; //from connect -> disconnect, do not re-dail immediately, wait network stable
+                            }
+                            send_signo_to_main(SIG_EVENT_CHECK);
+                        break;
+
+                        case MODEM_REPORT_RESET_EVENT:
+                        {
+                            dbg_time("main recv MODEM RESET SIGNAL");
+                            main_send_event_to_qmidevice(RIL_REQUEST_QUIT);
+                            g_donot_exit_when_modem_hangup = 1;
+                            goto __main_quit;
+                        }
+                        break;
+
+                    	case RIL_UNSOL_LOOPBACK_CONFIG_IND:
+                        {
+                            QMI_WDA_SET_LOOPBACK_CONFIG_IND_MSG SetLoopBackInd;
+                        	if (read(fd, &SetLoopBackInd, sizeof(SetLoopBackInd)) == sizeof(SetLoopBackInd)) {
+                            	profile->loopback_state = SetLoopBackInd.loopback_state.TLVVaule;
+                            	profile->replication_factor = le32_to_cpu(SetLoopBackInd.replication_factor.TLVVaule);
+                            	dbg_time("SetLoopBackInd: loopback_state=%d, replication_factor=%u",
+                                	profile->loopback_state, profile->replication_factor);
+                                    if (profile->loopback_state)
+                                        send_signo_to_main(SIG_EVENT_START);
+                            }
+                        }
+                    	break;
+#ifdef CONFIG_REG_QOS_IND
+                        case RIL_UNSOL_GLOBAL_QOS_FLOW_IND_QOS_ID:
+                        {
+                            UINT qos_id = 0;
+                            if (read(fd, &qos_id, sizeof(qos_id)) == sizeof(qos_id)) {
+                                profile->qos_id = qos_id;
+                            }
+                        }
+                    	break;
+#endif
+                        default:
+                        break;
+                    }
+                }
+            }
+        }
+    }
+
+__main_quit:
+    usbnet_link_change(0, profile);
+    if (gQmiThreadID && pthread_join(gQmiThreadID, NULL)) {
+        dbg_time("%s Error joining to listener thread (%s)", __func__, strerror(errno));
+    }
+
+#ifdef USE_IPC_MSG_STATUS_IND
+    if (gQcmStatusThreadID && pthread_join(gQcmStatusThreadID, NULL)) {
+        dbg_time("%s Error joining to gQcmStatusThreadID (%s)", __func__, strerror(errno));
+    }
+#endif
+
+    close(signal_control_fd[0]);
+    close(signal_control_fd[1]);
+    close(qmidevice_control_fd[0]);
+    close(qmidevice_control_fd[1]);
+#ifdef USE_IPC_MSG_STATUS_IND
+    close(qcm_status_indication_fd[0]);
+    close(qcm_status_indication_fd[1]);
+#endif
+    dbg_time("%s exit", __func__);
+
+    return 0;
+}
+
+static int quectel_CM(PROFILE_T *profile)
+{
+    int ret = 0;
+    char qmichannel[32] = {'\0'};
+    char usbnet_adapter[32] = {'\0'};
+
+    if (profile->expect_adapter[0])
+        strncpy(usbnet_adapter, profile->expect_adapter, sizeof(usbnet_adapter));
+    
+    if (qmidevice_detect(qmichannel, usbnet_adapter, sizeof(qmichannel), profile)) {
+    	profile->hardware_interface = HARDWARE_USB;
+    }
+    else if (mhidevice_detect(qmichannel, usbnet_adapter, profile)) {
+        profile->hardware_interface = HARDWARE_PCIE;
+    }
+    else if (atdevice_detect(qmichannel, usbnet_adapter, profile)) {
+        profile->hardware_interface = HARDWARE_PCIE;
+    }
+#ifdef CONFIG_QRTR
+    else if (!access("/sys/class/net/rmnet_mhi0", F_OK)) {
+        strcpy(usbnet_adapter, "rmnet_mhi0");
+        profile->hardware_interface = HARDWARE_PCIE;
+        strcpy(qmichannel, "qrtr");
+        profile->software_interface = SOFTWARE_QRTR;
+    }
+    else if (!access("/sys/class/net/rmnet_usb0", F_OK)) {
+        strcpy(usbnet_adapter, "rmnet_usb0");
+        profile->hardware_interface = HARDWARE_USB;
+        strcpy(qmichannel, "qrtr");
+        profile->software_interface = SOFTWARE_QRTR;
+    }
+    else if (!access("/sys/class/net/rmnet_ipa0", F_OK)) {
+        strcpy(usbnet_adapter, "rmnet_ipa0");
+        profile->hardware_interface = HARDWARE_IPA;
+        strcpy(qmichannel, "qrtr");
+        profile->software_interface = SOFTWARE_QRTR;
+    }
+#endif
+    else {
+        dbg_time("qmidevice_detect failed");
+        goto error;
+    }
+
+    strncpy(profile->qmichannel, qmichannel, sizeof(profile->qmichannel));
+    strncpy(profile->usbnet_adapter, usbnet_adapter, sizeof(profile->usbnet_adapter));
+    ql_get_netcard_driver_info(profile->usbnet_adapter);
+
+    if ((profile->hardware_interface == HARDWARE_USB) && profile->usblogfile)
+        ql_capture_usbmon_log(profile, profile->usblogfile);
+
+    if (profile->hardware_interface == HARDWARE_USB) {
+        profile->software_interface = get_driver_type(profile);
+    }
+
+    ql_qmap_mode_detect(profile);
+
+    if (profile->software_interface == SOFTWARE_MBIM) {
+        dbg_time("Modem works in MBIM mode");
+        profile->request_ops = &mbim_request_ops;
+        profile->qmi_ops = &mbim_dev_ops;
+        if (!profile->apn || !profile->apn[0]) {
+            //see FAE-51804  FAE-59811
+            dbg_time("When MBIM mode, must specify APN with '-s', or setup data call may fail!");
+            exit(-404); //if no such issue on your side, please comment this
+        }
+        ret = qmi_main(profile);
+    }
+    else if (profile->software_interface == SOFTWARE_QMI) {
+        dbg_time("Modem works in QMI mode");
+        profile->request_ops = &qmi_request_ops;
+        if (qmidev_is_gobinet(profile->qmichannel))
+            profile->qmi_ops = &gobi_qmidev_ops;
+        else
+            profile->qmi_ops = &qmiwwan_qmidev_ops;
+        qmidev_send = profile->qmi_ops->send;
+        ret = qmi_main(profile);
+    }
+    else if (profile->software_interface == SOFTWARE_ECM_RNDIS_NCM) {
+        dbg_time("Modem works in ECM_RNDIS_NCM mode");
+        profile->request_ops = &atc_request_ops;
+        profile->qmi_ops = &atc_dev_ops;
+        ret = qmi_main(profile);
+    }
+#ifdef CONFIG_QRTR
+    else if (profile->software_interface == SOFTWARE_QRTR) {
+        dbg_time("Modem works in QRTR mode");
+        profile->request_ops = &qmi_request_ops;
+        profile->qmi_ops = &qrtr_qmidev_ops;
+        qmidev_send = profile->qmi_ops->send;
+        ret = qmi_main(profile);
+    }
+#endif
+    else {
+        dbg_time("unsupport software_interface %d", profile->software_interface);
+    }
+
+    ql_stop_usbmon_log(profile);
+
+error:
+    return ret;
+}
+
+static int parse_user_input(int argc, char **argv, PROFILE_T *profile) {
+    int opt = 1;
+    int apn_name_or_type;
+    profile->pdp = CONFIG_DEFAULT_PDP;
+    profile->profile_index = CONFIG_DEFAULT_PDP;
+
+    if (!strcmp(argv[argc-1], "&"))
+        argc--;
+
+#define has_more_argv() ((opt < argc) && (argv[opt][0] != '-'))
+    while  (opt < argc) {
+        if (argv[opt][0] != '-') {
+            return usage(argv[0]);
+        }
+
+        switch (argv[opt++][1])
+        {
+            case 's':
+                profile->apn = profile->user = profile->pd = "";
+                if (has_more_argv()) {
+                    profile->apn = argv[opt++];
+                }
+                if (has_more_argv()) {
+                    profile->user = argv[opt++];
+                }
+                if (has_more_argv()) {
+                    profile->pd = argv[opt++];
+                    if (profile->pd && profile->pd[0])
+                        profile->auth = 2; //default chap, customers may miss auth
+                }
+                if (has_more_argv()) {
+                    const char *auth = argv[opt++];
+
+                    if (!strcmp(auth, "0") || !strcasecmp(auth, "none")) {
+                        profile->auth = 0;
+                    }
+                    else if (!strcmp(auth, "1") || !strcasecmp(auth, "pap")) {
+                        profile->auth = 1;
+                    }
+                    else if (!strcmp(auth, "2") || !strcasecmp(auth, "chap")) {
+                        profile->auth = 2;
+                    }
+					else if (!strcmp(auth, "3") || !strcasecmp(auth, "MsChapV2")) {
+                        profile->auth = 3;
+                    }
+                    else {
+                        dbg_time("unknow auth '%s'", auth);
+                        return usage(argv[0]);
+                    }
+                }
+            break;
+
+            case 'p':
+                if (has_more_argv()) {
+                    const char *arg = argv[opt++];
+
+                    if (!strcmp(arg, QUECTEL_QMI_PROXY) || !strcmp(arg, QUECTEL_MBIM_PROXY)
+                        || !strcmp(arg, LIBQMI_PROXY) || !strcmp(arg, LIBMBIM_PROXY) || !strcmp(arg, QUECTEL_ATC_PROXY)) {
+                        strncpy(profile->proxy, arg, sizeof(profile->proxy) - 1);
+                    }
+                    else if ((999 < atoi(arg)) && (atoi(arg) < 10000)) {
+                        profile->pincode = arg;
+                    }
+                    else {
+                        dbg_time("unknow -p '%s'", arg);
+                        return usage(argv[0]);
+                    }
+                }
+            break;
+
+            case 'm':
+                if (has_more_argv())
+                    profile->muxid = argv[opt++][0] - '0' + 0x80;
+            break;
+
+            case 'n':
+                if (has_more_argv())
+                    profile->pdp = argv[opt++][0] - '0';
+            break;
+
+            case 'f':
+                if (has_more_argv()) {
+                    profile->logfile = argv[opt++];
+                }
+            break;
+
+            case 'i':
+                if (has_more_argv()) {
+                    strncpy(profile->expect_adapter, argv[opt++], sizeof(profile->expect_adapter) - 1);
+                }
+            break;
+
+            case 'v':
+                debug_qmi = 1;
+            break;
+
+            case 'l':
+            	if (has_more_argv()) {
+                    profile->replication_factor = atoi(argv[opt++]);
+                	if (profile->replication_factor > 0) {
+                        	profile->loopback_state = 1;
+                     }
+                }
+            break;
+
+            case '4':
+                profile->enable_ipv4 = 1; 
+            break;
+
+            case '6':
+                profile->enable_ipv6 = 1;
+            break;
+
+            case 'd':
+                profile->no_dhcp = 1;
+            break;
+
+            case 'u':
+                if (has_more_argv()) {
+                    profile->usblogfile = argv[opt++];
+                }
+            break;
+
+            case 'b':
+                profile->enable_bridge = 1;
+            break;
+			
+            case 'k':
+                if (has_more_argv()) {
+                    profile->kill_pdp = argv[opt++][0] - '0';
+                }
+                break;
+
+            case 'a':
+                if (has_more_argv()) {
+                    apn_name_or_type = argv[opt++][0] - '0';
+                    if(apn_name_or_type == 1)
+                    profile->bring_up_by_apn_name = apn_name_or_type;
+                    else if(apn_name_or_type == 2) 
+                    profile->bring_up_by_apn_type = apn_name_or_type;   
+                }
+                break;
+            case 'y':
+                if (has_more_argv()) {
+                    profile->apn_type = argv[opt++][0] - '0';
+                }
+                break;            
+            default:
+                return usage(argv[0]);
+            break;
+        }
+    }
+
+    if (profile->enable_ipv4 != 1 && profile->enable_ipv6 != 1) { // default enable IPv4
+        profile->enable_ipv4 = 1;
+    }
+
+    return 1;
+}
+
+int main(int argc, char *argv[])
+{
+    int ret;
+    PROFILE_T *ctx = &s_profile;
+
+    dbg_time("QConnectManager_Linux_V1.6.8");
+
+    ret = parse_user_input(argc, argv, ctx);
+    if (!ret)
+        return ret;
+
+    if (ctx->kill_pdp) {
+        return kill_data_call_pdp(ctx->kill_pdp, argv[0]);
+    }
+
+    if (ctx->logfile) {
+        logfilefp = fopen(ctx->logfile, "a+");
+        if (!logfilefp) {
+            dbg_time("Fail to open %s, errno: %d(%s)", ctx->logfile, errno, strerror(errno));
+        }
+    }
+
+    signal(SIGINT, ql_sigaction);
+    signal(SIGTERM, ql_sigaction);
+    signal(SIGALRM, ql_sigaction);
+
+    do {
+        ret = quectel_CM(ctx);
+        if (g_donot_exit_when_modem_hangup > 0)
+            sleep(3);
+    } while (g_donot_exit_when_modem_hangup > 0);
+
+    if (logfilefp) {
+        fclose(logfilefp);
+    }
+
+    return ret;
+}
diff --git a/RM520N-5G/文件/source/mbim-cm.c b/RM520N-5G/文件/source/mbim-cm.c
new file mode 100644
index 0000000..67e802f
--- /dev/null
+++ b/RM520N-5G/文件/source/mbim-cm.c
@@ -0,0 +1,2422 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <fcntl.h>
+#include <stddef.h>
+#include <pthread.h>
+#include <errno.h>
+#include <time.h>
+#include <signal.h>
+#include <getopt.h>
+#include <poll.h>
+#include <sys/time.h>
+#include <time.h>
+#include <sys/types.h>
+#include <limits.h>
+#include <inttypes.h>
+#include "QMIThread.h"
+
+#define mbim_debug dbg_time
+
+#define UUID_BASIC_CONNECT "a289cc33-bcbb-8b4f-b6b0-133ec2aae6df"
+//https://docs.microsoft.com/en-us/windows-hardware/drivers/network/mb-5g-data-class-support
+#define UUID_BASIC_CONNECT_EXT "3d01dcc5-fef5-4d05-0d3a-bef7058e9aaf"
+#define UUID_SMS             "533fbeeb-14fe-4467-9f90-33a223e56c3f"
+#define UUID_USSD             "e550a0c8-5e82-479e-82f7-10abf4c3351f"
+#define UUID_PHONEBOOK     "4bf38476-1e6a-41db-b1d8-bed289c25bdb"
+#define UUID_STK             "d8f20131-fcb5-4e17-8602-d6ed3816164c"
+#define UUID_AUTH             "1d2b5ff7-0aa1-48b2-aa52-50f15767174e"
+#define UUID_DSS             "c08a26dd-7718-4382-8482-6e0d583c4d0e"
+#define uuid_ext_qmux "d1a30bc2-f97a-6e43-bf65-c7e24fb0f0d3"
+#define uuid_mshsd "883b7c26-985f-43fa-9804-27d7fb80959c"
+#define uuid_qmbe "2d0c12c9-0e6a-495a-915c-8d174fe5d63c"
+#define UUID_MSFWID "e9f7dea2-feaf-4009-93ce-90a3694103b6"
+#define uuid_atds "5967bdcc-7fd2-49a2-9f5c-b2e70e527db3"
+#define uuid_qdu "6427015f-579d-48f5-8c54-f43ed1e76f83"
+#define UUID_MS_UICC_LOW_LEVEL "c2f6588e-f037-4bc9-8665-f4d44bd09367"
+#define UUID_MS_SARControl "68223D04-9F6C-4E0F-822D-28441FB72340"
+#define UUID_VOICEEXTENSIONS	"8d8b9eba-37be-449b-8f1e-61cb034a702e"
+#define UUID_LIBMBIM_PROXY "838cf7fb-8d0d-4d7f-871e-d71dbefbb39b"
+
+#define UUID_MBIMContextTypeInternet "7E5E2A7E-4E6F-7272-736B-656E7E5E2A7E"
+
+typedef unsigned char UINT8;
+typedef unsigned short UINT16;
+typedef unsigned int UINT32;
+typedef unsigned long long UINT64;
+
+#pragma pack(4)
+typedef enum {
+    MBIM_CID_CMD_TYPE_QUERY = 0,
+    MBIM_CID_CMD_TYPE_SET = 1,
+} MBIM_CID_CMD_TYPE_E;
+
+typedef enum {
+     MBIM_CID_DEVICE_CAPS = 1, 
+     MBIM_CID_SUBSCRIBER_READY_STATUS = 2, 
+     MBIM_CID_RADIO_STATE = 3, MBIM_CID_PIN = 4,
+     MBIM_CID_PIN_LIS = 5,
+     MBIM_CID_HOME_PROVIDER = 6,
+     MBIM_CID_PREFERRED_PROVIDERS = 7,
+     MBIM_CID_VISIBLE_PROVIDERS = 8,
+     MBIM_CID_REGISTER_STATE = 9,
+     MBIM_CID_PACKET_SERVICE = 10,
+     MBIM_CID_SIGNAL_STATE = 11,
+     MBIM_CID_CONNECT = 12,
+     MBIM_CID_PROVISIONED_CONTEXTS = 13,
+     MBIM_CID_SERVICE_ACTIVATION = 14,
+     MBIM_CID_IP_CONFIGURATION =       15,
+     MBIM_CID_DEVICE_SERVICES = 16,
+     MBIM_CID_DEVICE_SERVICE_SUBSCRIBE_LIST = 19, 
+     MBIM_CID_PACKET_STATISTICS = 20, 
+     MBIM_CID_NETWORK_IDLE_HINT = 21,
+     MBIM_CID_EMERGENCY_MODE = 22,
+     MBIM_CID_IP_PACKET_FILTERS = 23, 
+     MBIM_CID_MULTICARRIER_PROVIDERS = 24,
+} UUID_BASIC_CONNECT_CID_E;
+
+typedef enum{
+    MBIM_CID_MS_PROVISIONED_CONTEXT_V2 = 1, 
+    MBIM_CID_MS_NETWORK_BLACKLIST = 2,
+    MBIM_CID_MS_LTE_ATTACH_CONFIG = 3, 
+    MBIM_CID_MS_LTE_ATTACH_STATUS = 4, 
+    MBIM_CID_MS_SYS_CAPS = 5, 
+    MBIM_CID_MS_DEVICE_CAPS_V2 = 6, 
+    MBIM_CID_MS_DEVICE_SLOT_MAPPING = 7, 
+    MBIM_CID_MS_SLOT_INFO_STATUS = 8, 
+    MBIM_CID_MS_PCO = 9, 
+    MBIM_CID_MS_DEVICE_RESET = 10, 
+    MBIM_CID_MS_BASE_STATIONS_INFO = 11, 
+    MBIM_CID_MS_LOCATION_INFO_STATUS = 12, 
+    MBIM_CID_NOT_DEFINED = 13, 
+    MBIM_CID_MS_PIN_EX = 14, 
+    MBIM_CID_MS_VERSION = 15,
+} UUID_BASIC_CONNECT_EXT_CID_E;
+
+typedef enum {
+    MBIM_CID_SMS_CONFIGURATION = 1, // Y Y Y
+    MBIM_CID_SMS_READ = 2, // N Y Y
+    MBIM_CID_SMS_SEND = 3, // Y N N
+    MBIM_CID_SMS_DELETE = 4, // Y N N
+    MBIM_CID_SMS_MESSAGE_STORE_STATUS = 5, // N Y Y
+} UUID_SMS_CID_E;
+
+typedef enum {
+    MBIM_CID_DSS_CONNECT = 1, // Y N N
+} UUID_DSS_CID_E;
+
+typedef enum{
+    MBIM_OPEN_MSG = 1, 
+    MBIM_CLOSE_MSG = 2, 
+    MBIM_COMMAND_MSG = 3, 
+    MBIM_HOST_ERROR_MSG = 4,
+    MBIM_OPEN_DONE = 0x80000001, 
+    MBIM_CLOSE_DONE = 0x80000002, 
+    MBIM_COMMAND_DONE = 0x80000003, 
+    MBIM_FUNCTION_ERROR_MSG = 0x80000004,       
+    MBIM_INDICATE_STATUS_MSG = 0x80000007,
+} MBIM_MSG_Type_E;
+ 
+typedef enum { /*< since=1.10 >*/
+    MBIM_CID_PROXY_CONTROL_UNKNOWN       = 0,
+    MBIM_CID_PROXY_CONTROL_CONFIGURATION = 1
+} UUID_LIBMBIM_PROXY_CID_E;
+
+typedef enum {
+    MBIM_CID_MS_UICC_ATR = 1,
+    MBIM_CID_MS_UICC_OPEN_CHANNEL = 2,
+    MBIM_CID_MS_UICC_CLOSE_CHANNEL  = 3,
+    MBIM_CID_MS_UICC_APDU = 4,
+    MBIM_CID_MS_UICC_TERMINAL_CAPABILITY = 5,
+    MBIM_CID_MS_UICC_RESET = 6,
+    MBIM_CID_MS_APP_LIST = 7,
+} UUID_MS_UICC_CID_E;
+
+typedef enum {
+    MBIM_ERROR_TIMEOUT_FRAGMENT = 1,
+    MBIM_ERROR_FRAGMENT_OUT_OF_SEQUENCE = 2,
+    MBIM_ERROR_LENGTH_MISMATCH = 3,
+    MBIM_ERROR_DUPLICATED_TID = 4,
+    MBIM_ERROR_NOT_OPENED = 5,
+    MBIM_ERROR_UNKNOWN = 6,
+    MBIM_ERROR_CANCEL = 7,
+    MBIM_ERROR_MAX_TRANSFER = 8,
+} MBIM_ERROR_E;
+
+typedef enum {
+    MBIM_STATUS_SUCCESS = 0,
+    MBIM_STATUS_BUSY =  1,
+    MBIM_STATUS_FAILURE = 2,
+    MBIM_STATUS_SIM_NOT_INSERTED = 3,
+    MBIM_STATUS_BAD_SIM = 4,
+    MBIM_STATUS_PIN_REQUIRED = 5,
+    MBIM_STATUS_PIN_DISABLED = 6,
+    MBIM_STATUS_NOT_REGISTERED = 7,
+    MBIM_STATUS_PROVIDERS_NOT_FOUND = 8,
+    MBIM_STATUS_NO_DEVICE_SUPPORT = 9,
+    MBIM_STATUS_PROVIDER_NOT_VISIBLE = 10,
+    MBIM_STATUS_DATA_CLASS_NOT_AVAILABL = 11,
+    MBIM_STATUS_PACKET_SERVICE_DETACHED = 12,
+}  MBIM_STATUS_CODES_E;
+
+typedef enum {
+    MBIMPacketServiceActionAttach = 0,
+    MBIMPacketServiceActionDetach = 1,
+} MBIM_PACKET_SERVICE_ACTION_E;
+
+typedef enum {
+    MBIMPacketServiceStateUnknown = 0,
+    MBIMPacketServiceStateAttaching = 1,
+    MBIMPacketServiceStateAttached = 2,
+    MBIMPacketServiceStateDetaching = 3,
+    MBIMPacketServiceStateDetached = 4,
+} MBIM_PACKET_SERVICE_STATE_E;
+
+static const char *MBIMPacketServiceStateStr(int _val) {
+    struct { int val;char *name;} _enumstr[] = {
+        {MBIMPacketServiceStateUnknown, "Unknown"},
+        {MBIMPacketServiceStateAttaching, "Attaching"},
+        {MBIMPacketServiceStateAttached, "Attached"},
+        {MBIMPacketServiceStateDetaching, "Detaching"},
+        {MBIMPacketServiceStateDetached, "Detached"},
+    };
+    int idx;
+
+    for (idx = 0; idx < (int)(sizeof(_enumstr)/sizeof(_enumstr[0])); idx++) {
+        if (_val == _enumstr[idx].val)
+            return _enumstr[idx].name;
+    }
+
+    return "Undefined";
+};
+
+typedef enum {
+    MBIMDataClassNone = 0x0,
+    MBIMDataClassGPRS = 0x1,
+    MBIMDataClassEDGE = 0x2,
+    MBIMDataClassUMTS = 0x4,
+    MBIMDataClassHSDPA = 0x8,
+    MBIMDataClassHSUPA = 0x10,
+    MBIMDataClassLTE = 0x20,
+    MBIMDataClass5G_NSA = 0x40,
+    MBIMDataClass5G_SA = 0x80,
+    MBIMDataClass1XRTT = 0x10000,
+    MBIMDataClass1XEVDO = 0x20000,
+    MBIMDataClass1XEVDORevA = 0x40000,
+    MBIMDataClass1XEVDV = 0x80000,
+    MBIMDataClass3XRTT = 0x100000,
+    MBIMDataClass1XEVDORevB = 0x200000,
+    MBIMDataClassUMB = 0x400000,
+    MBIMDataClassCustom = 0x80000000,
+} MBIM_DATA_CLASS_E;
+
+static const char *MBIMDataClassStr(int _val) {
+    struct { int val;char *name;} _enumstr[] = {
+        {MBIMDataClassNone, "None"},
+        {MBIMDataClassGPRS, "GPRS"},
+        {MBIMDataClassEDGE, "EDGE"},
+        {MBIMDataClassUMTS, "UMTS"},
+        {MBIMDataClassHSDPA, "HSDPA"},
+        {MBIMDataClassHSUPA, "HSUPA"},
+        {MBIMDataClassLTE, "LTE"},
+        {MBIMDataClass5G_NSA, "5G_NSA"},
+        {MBIMDataClass5G_SA, "5G_SA"},
+        {MBIMDataClass1XRTT, "1XRTT"},
+        {MBIMDataClass1XEVDO, "1XEVDO"},
+        {MBIMDataClass1XEVDORevA, "1XEVDORevA"},
+        {MBIMDataClass1XEVDV, "1XEVDV"},
+        {MBIMDataClass3XRTT, "3XRTT"},
+        {MBIMDataClass1XEVDORevB, "1XEVDORevB"},
+        {MBIMDataClassUMB, "UMB"},
+        {MBIMDataClassCustom, "Custom"},
+    };
+    int idx;
+
+    for (idx = 0; idx < (int)(sizeof(_enumstr)/sizeof(_enumstr[0])); idx++) {
+        if (_val == _enumstr[idx].val)
+            return _enumstr[idx].name;
+    }
+
+    return "Unknow";
+};
+
+typedef struct {
+    UINT32 NwError;
+    UINT32 PacketServiceState; //MBIM_PACKET_SERVICE_STATE_E
+    UINT32 HighestAvailableDataClass; //MBIM_DATA_CLASS_E
+    UINT64 UplinkSpeed;
+    UINT64 DownlinkSpeed;
+} MBIM_PACKET_SERVICE_INFO_T;
+
+typedef struct {
+    UINT32 NwError;
+    UINT32 PacketServiceState; //MBIM_PACKET_SERVICE_STATE_E
+    UINT32 CurrentDataClass; //MBIM_DATA_CLASS_E
+    UINT64 UplinkSpeed;
+    UINT64 DownlinkSpeed;
+    UINT32 FrequencyRange;
+} MBIM_PACKET_SERVICE_INFO_V2_T;
+
+typedef enum {
+    MBIMSubscriberReadyStateNotInitialized = 0,
+    MBIMSubscriberReadyStateInitialized = 1,
+    MBIMSubscriberReadyStateSimNotInserted = 2,
+    MBIMSubscriberReadyStateBadSim = 3,
+    MBIMSubscriberReadyStateFailure = 4,
+    MBIMSubscriberReadyStateNotActivated = 5,
+    MBIMSubscriberReadyStateDeviceLocked = 6,
+}MBIM_SUBSCRIBER_READY_STATE_E;
+
+static const char *MBIMSubscriberReadyStateStr(int _val) {
+    struct { int val;char *name;} _enumstr[] = {
+        {MBIMSubscriberReadyStateNotInitialized, "NotInitialized"},
+        {MBIMSubscriberReadyStateInitialized, "Initialized"},
+        {MBIMSubscriberReadyStateSimNotInserted, "NotInserted"},
+        {MBIMSubscriberReadyStateBadSim, "BadSim"},
+        {MBIMSubscriberReadyStateFailure, "Failure"},
+        {MBIMSubscriberReadyStateNotActivated, "NotActivated"},
+        {MBIMSubscriberReadyStateDeviceLocked, "DeviceLocked"},
+    };
+    int idx;
+
+    for (idx = 0; idx < (int)(sizeof(_enumstr)/sizeof(_enumstr[0])); idx++) {
+        if (_val == _enumstr[idx].val)
+            return _enumstr[idx].name;
+    }
+
+    return "Undefined";
+};
+
+typedef struct {
+    UINT32 DeviceType; //MBIM_DEVICE_TYPE
+    UINT32 CellularClass; //MBIM_CELLULAR_CLASS
+    UINT32 VoiceClass; //MBIM_VOICE_CLASS
+    UINT32 SimClass; //MBIM_SIM_CLASS
+    UINT32 DataClass; //MBIM_DATA_CLASS
+    UINT32 SmsCaps; //MBIM_SMS_CAPS
+    UINT32 ControlCaps; //MBIM_CTRL_CAPS
+    UINT32 MaxSessions;
+    UINT32 CustomDataClassOffset;
+    UINT32 CustomDataClassSize;
+    UINT32 DeviceIdOffset;
+    UINT32 DeviceIdSize;
+    UINT32 FirmwareInfoOffset;
+    UINT32 FirmwareInfoSize;
+    UINT32 HardwareInfoOffset;
+    UINT32 HardwareInfoSize;
+    UINT8 DataBuffer[0]; //DeviceId FirmwareInfo HardwareInfo
+} MBIM_DEVICE_CAPS_INFO_T;
+
+typedef enum {
+    MBIMRadioOff = 0,
+    MBIMRadioOn = 1,
+} MBIM_RADIO_SWITCH_STATE_E;
+
+typedef struct {
+    MBIM_RADIO_SWITCH_STATE_E RadioState;
+} MBIM_SET_RADIO_STATE_T;
+
+typedef struct {
+    MBIM_RADIO_SWITCH_STATE_E HwRadioState;
+    MBIM_RADIO_SWITCH_STATE_E SwRadioState;
+} MBIM_RADIO_STATE_INFO_T;
+
+typedef enum {
+    MBIMReadyInfoFlagsNone,
+    MBIMReadyInfoFlagsProtectUniqueID,
+}MBIM_UNIQUE_ID_FLAGS;
+
+typedef struct {
+    UINT32 ReadyState;
+    UINT32 SubscriberIdOffset;
+    UINT32 SubscriberIdSize;
+    UINT32 SimIccIdOffset;
+    UINT32 SimIccIdSize;
+    UINT32 ReadyInfo;
+    UINT32 ElementCount;
+    UINT8 *TelephoneNumbersRefList;
+    UINT8 *DataBuffer;
+} MBIM_SUBSCRIBER_READY_STATUS_T;
+
+typedef enum {
+    MBIMRegisterActionAutomatic,
+    MBIMRegisterActionManual,
+}MBIM_REGISTER_ACTION_E;
+
+typedef enum {
+    MBIMRegisterStateUnknown = 0,
+    MBIMRegisterStateDeregistered = 1,
+    MBIMRegisterStateSearching = 2,
+    MBIMRegisterStateHome = 3,
+    MBIMRegisterStateRoaming = 4,
+    MBIMRegisterStatePartner = 5,
+    MBIMRegisterStateDenied = 6,
+}MBIM_REGISTER_STATE_E;
+
+typedef enum {
+    MBIMRegisterModeUnknown = 0,
+    MBIMRegisterModeAutomatic = 1,
+    MBIMRegisterModeManual = 2,
+}MBIM_REGISTER_MODE_E;
+
+static const char *MBIMRegisterStateStr(int _val) {
+    struct { int val;char *name;} _enumstr[] ={
+        {MBIMRegisterStateUnknown, "Unknown"},
+        {MBIMRegisterStateDeregistered, "Deregistered"},
+        {MBIMRegisterStateSearching, "Searching"},
+        {MBIMRegisterStateHome, "Home"},
+        {MBIMRegisterStateRoaming, "Roaming"},
+        {MBIMRegisterStatePartner, "Partner"},
+        {MBIMRegisterStateDenied, "Denied"},
+    };
+    int idx;
+
+    for (idx = 0; idx < (int)(sizeof(_enumstr)/sizeof(_enumstr[0])); idx++) {
+        if (_val == _enumstr[idx].val)
+            return _enumstr[idx].name;
+    }
+
+    return "Undefined";
+};
+
+static const char *MBIMRegisterModeStr(int _val) {
+    struct { int val;char *name;} _enumstr[] = {
+        {MBIMRegisterModeUnknown, "Unknown"},
+        {MBIMRegisterModeAutomatic, "Automatic"},
+        {MBIMRegisterModeManual, "Manual"},
+    };
+    int idx;
+
+    for (idx = 0; idx < (int)(sizeof(_enumstr)/sizeof(_enumstr[0])); idx++) {
+        if (_val == _enumstr[idx].val)
+            return _enumstr[idx].name;
+    }
+
+    return "Undefined";
+};
+
+typedef enum {
+    MBIM_REGISTRATION_NONE,
+    MBIM_REGISTRATION_MANUAL_SELECTION_NOT_AVAILABLE,
+    MBIM_REGISTRATION_PACKET_SERVICE_AUTOMATIC_ATTACH,
+}MBIM_REGISTRATION_FLAGS_E;
+
+typedef struct {
+    UINT32 NwError;
+    UINT32 RegisterState; //MBIM_REGISTER_STATE_E
+    UINT32 RegisterMode;
+    UINT32 AvailableDataClasses;
+    UINT32 CurrentCellularClass;
+    UINT32 ProviderIdOffset;
+    UINT32 ProviderIdSize;
+    UINT32 ProviderNameOffset;
+    UINT32 ProviderNameSize;
+    UINT32 RoamingTextOffset;
+    UINT32 RoamingTextSize;
+    UINT32 RegistrationFlag;
+    UINT8 *DataBuffer;
+} MBIM_REGISTRATION_STATE_INFO_T;
+
+typedef struct {
+    UINT32 NwError;
+    UINT32 RegisterState; //MBIM_REGISTER_STATE_E
+    UINT32 RegisterMode;
+    UINT32 AvailableDataClasses;
+    UINT32 CurrentCellularClass;
+    UINT32 ProviderIdOffset;
+    UINT32 ProviderIdSize;
+    UINT32 ProviderNameOffset;
+    UINT32 ProviderNameSize;
+    UINT32 RoamingTextOffset;
+    UINT32 RoamingTextSize;
+    UINT32 RegistrationFlag;
+    UINT32 PreferredDataClass;
+    UINT8 *DataBuffer;
+} MBIM_REGISTRATION_STATE_INFO_V2_T;
+
+typedef struct {
+    UINT32 MessageType; //Specifies the MBIM message type.
+    UINT32 MessageLength; //Specifies the total length of this MBIM message in bytes.
+    /* Specifies the MBIM message id value.  This value is used to match host sent messages with function responses.
+    This value must be unique among all outstanding transactions.
+    For notifications, the TransactionId must be set to 0 by the function */
+    UINT32 TransactionId;
+} MBIM_MESSAGE_HEADER;
+
+typedef struct {
+    UINT32 TotalFragments; //this field indicates how many fragments there are intotal.
+    UINT32 CurrentFragment; //This field indicates which fragment this message is.  Values are 0 to TotalFragments?\1
+} MBIM_FRAGMENT_HEADER;
+
+typedef struct {
+    MBIM_MESSAGE_HEADER MessageHeader;
+    UINT32 MaxControlTransfer;
+} MBIM_OPEN_MSG_T;
+
+typedef struct {
+    MBIM_MESSAGE_HEADER MessageHeader;
+    UINT32 Status; //MBIM_STATUS_CODES_E
+} MBIM_OPEN_DONE_T;
+
+typedef struct {
+    MBIM_MESSAGE_HEADER MessageHeader;
+} MBIM_CLOSE_MSG_T;
+
+typedef struct {
+    MBIM_MESSAGE_HEADER MessageHeader;
+    UINT32 Status;
+} MBIM_CLOSE_DONE_T;
+
+typedef struct {
+    UINT8 uuid[16];
+} UUID_T;
+
+typedef struct {
+    MBIM_MESSAGE_HEADER MessageHeader;
+    MBIM_FRAGMENT_HEADER FragmentHeader;
+    UUID_T DeviceServiceId; //A 16 byte UUID that identifies the device service the following CID value applies.
+    UINT32 CID; //Specifies the CID that identifies the parameter being queried for
+    UINT32 CommandType; //0 for a query operation, 1 for a Set operation
+    UINT32 InformationBufferLength; //Size of the Total InformationBuffer, may be larger than current message if fragmented.
+    UINT8 InformationBuffer[0]; //Data supplied to device specific to the CID
+} MBIM_COMMAND_MSG_T;
+
+typedef struct {
+    MBIM_MESSAGE_HEADER MessageHeader;
+    MBIM_FRAGMENT_HEADER FragmentHeader;
+    UUID_T DeviceServiceId; //A 16 byte UUID that identifies the device service the following CID value applies.
+    UINT32 CID; //Specifies the CID that identifies the parameter being queried for
+    UINT32 Status;
+    UINT32 InformationBufferLength; //Size of the Total InformationBuffer, may be larger than current message if fragmented.
+    UINT8 InformationBuffer[0]; //Data supplied to device specific to the CID
+} MBIM_COMMAND_DONE_T;
+
+typedef struct {
+    MBIM_MESSAGE_HEADER MessageHeader;
+    UINT32 ErrorStatusCode;
+} MBIM_HOST_ERROR_MSG_T;
+
+typedef struct {
+    MBIM_MESSAGE_HEADER MessageHeader;
+    UINT32 ErrorStatusCode;
+} MBIM_FUNCTION_ERROR_MSG_T;
+
+typedef struct {
+    MBIM_MESSAGE_HEADER MessageHeader;
+    MBIM_FRAGMENT_HEADER FragmentHeader;
+    UUID_T DeviceServiceId; //A 16 byte UUID that identifies the device service the following CID value applies.
+    UINT32 CID; //Specifies the CID that identifies the parameter being queried for
+    UINT32 InformationBufferLength; //Size of the Total InformationBuffer, may be larger than current message if fragmented.
+    UINT8 InformationBuffer[0]; //Data supplied to device specific to the CID
+} MBIM_INDICATE_STATUS_MSG_T;
+
+typedef struct {
+    UINT32 offset;
+    UINT32 size;
+} OL_PAIR_LIST;
+
+typedef struct {
+    UUID_T DeviceServiceId;
+    UINT32 DssPayload;
+    UINT32 MaxDssInstances;
+    UINT32 CidCount;
+    UINT32 CidList[];
+} MBIM_DEVICE_SERVICE_ELEMENT_T;
+
+typedef struct {
+    UINT32 DeviceServicesCount;
+    UINT32 MaxDssSessions;
+    OL_PAIR_LIST DeviceServicesRefList[];
+} MBIM_DEVICE_SERVICES_INFO_T;
+
+typedef enum {
+    MBIMActivationCommandDeactivate = 0,
+    MBIMActivationCommandActivate = 1,
+} MBIM_ACTIVATION_COMMAND_E;
+
+typedef enum {
+    MBIMCompressionNone =  0,
+    MBIMCompressionEnable =  1,
+} MBIM_COMPRESSION_E;
+
+typedef enum {
+    MBIMAuthProtocolNone = 0,
+    MBIMAuthProtocolPap = 1,
+    MBIMAuthProtocolChap = 2,
+    MBIMAuthProtocolMsChapV2 = 3,
+} MBIM_AUTH_PROTOCOL_E;
+
+typedef enum {
+    MBIMContextIPTypeDefault = 0, 
+    MBIMContextIPTypeIPv4 = 1, 
+    MBIMContextIPTypeIPv6 = 2, 
+    MBIMContextIPTypeIPv4v6 = 3, 
+    MBIMContextIPTypeIPv4AndIPv6 = 4,
+} MBIM_CONTEXT_IP_TYPE_E;
+
+typedef enum {
+    MBIMActivationStateUnknown = 0,
+    MBIMActivationStateActivated = 1,
+    MBIMActivationStateActivating = 2,
+    MBIMActivationStateDeactivated = 3,
+    MBIMActivationStateDeactivating = 4,
+} MBIM_ACTIVATION_STATE_E;
+
+typedef enum {
+    MBIMVoiceCallStateNone = 0,
+    MBIMVoiceCallStateInProgress = 1,
+    MBIMVoiceCallStateHangUp = 2,
+} MBIM_VOICECALL_STATE_E;
+
+static const char *MBIMMSGTypeStr(int _val) {
+    struct { int val;char *name;} _enumstr[] = { 
+        {MBIM_OPEN_MSG, "MBIM_OPEN_MSG"}, 
+        {MBIM_CLOSE_MSG, "MBIM_CLOSE_MSG"}, 
+        {MBIM_COMMAND_MSG, "MBIM_COMMAND_MSG"}, 
+        {MBIM_HOST_ERROR_MSG, "MBIM_HOST_ERROR_MSG"}, 
+        {MBIM_OPEN_DONE, "MBIM_OPEN_DONE"}, 
+        {MBIM_CLOSE_DONE, "MBIM_CLOSE_DONE"}, 
+        {MBIM_COMMAND_DONE, "MBIM_COMMAND_DONE"}, 
+        {MBIM_FUNCTION_ERROR_MSG, "MBIM_FUNCTION_ERROR_MSG"}, 
+        {MBIM_INDICATE_STATUS_MSG, "MBIM_INDICATE_STATUS_MSG"}, 
+    }; 
+    int idx;
+
+    for (idx = 0; idx < (int)(sizeof(_enumstr)/sizeof(_enumstr[0])); idx++) { 
+        if (_val == _enumstr[idx].val) 
+            return _enumstr[idx].name;
+    } 
+
+    return "MBIMMSGTypeUnknow"; 
+};
+
+static const char *MBIMContextIPTypeStr(int _val) { 
+    struct { int val;char *name;} _enumstr[] = { 
+        {MBIMContextIPTypeDefault, "MBIMContextIPTypeDefault"}, 
+        {MBIMContextIPTypeIPv4, "MBIMContextIPTypeIPv4"}, 
+        {MBIMContextIPTypeIPv6, "MBIMContextIPTypeIPv6"}, 
+        {MBIMContextIPTypeIPv4v6, "MBIMContextIPTypeIPv4v6"}, 
+        {MBIMContextIPTypeIPv4AndIPv6, "MBIMContextIPTypeIPv4AndIPv6"}, 
+    }; 
+    int idx; 
+
+    for (idx = 0; idx < (int)(sizeof(_enumstr)/sizeof(_enumstr[0])); idx++) {
+        if (_val == _enumstr[idx].val)
+            return _enumstr[idx].name;
+    } 
+
+    return "MBIMContextIPTypeUnknow"; 
+}
+
+static const char *MBIMActivationStateStr(int _val) {
+    struct { int val;char *name;} _enumstr[] = {
+        {MBIMActivationStateUnknown, "Unknown"},
+        {MBIMActivationStateActivated, "Activated"},
+        {MBIMActivationStateActivating, "Activating"},
+        {MBIMActivationStateDeactivated, "Deactivated"},
+        {MBIMActivationStateDeactivating, "Deactivating"},
+    };
+    int idx;
+
+    for (idx = 0; idx < (int)(sizeof(_enumstr)/sizeof(_enumstr[0])); idx++) {
+        if (_val == _enumstr[idx].val)
+            return _enumstr[idx].name;
+    }
+
+    return "Undefined";
+};
+
+static const char *MBIMVoiceCallStateStr(int _val) {
+    struct { int val;char *name;} _enumstr[] = {
+        {MBIMVoiceCallStateNone, "None"},
+        {MBIMVoiceCallStateInProgress, "InProgress"},
+        {MBIMVoiceCallStateHangUp, "HangUp"},
+    };
+    int idx;
+
+    for (idx = 0; idx < (int)(sizeof(_enumstr)/sizeof(_enumstr[0])); idx++) {
+        if (_val == _enumstr[idx].val)
+        return _enumstr[idx].name;
+    }
+
+    return "Undefined";
+};
+
+typedef struct {
+    const char *uuid;
+    UINT32 cid;
+    const char *name;
+} UUID_CID_STR;
+
+static const  UUID_CID_STR uuid_cid_string[] = { 
+    {UUID_BASIC_CONNECT, MBIM_CID_DEVICE_CAPS, "MBIM_CID_DEVICE_CAPS"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_SUBSCRIBER_READY_STATUS, "MBIM_CID_SUBSCRIBER_READY_STATUS"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_RADIO_STATE, "MBIM_CID_RADIO_STATE"},
+    {UUID_BASIC_CONNECT, MBIM_CID_PIN, "MBIM_CID_PIN"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_PIN_LIS, "MBIM_CID_PIN_LIS"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_HOME_PROVIDER, "MBIM_CID_HOME_PROVIDER"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_PREFERRED_PROVIDERS, "MBIM_CID_PREFERRED_PROVIDERS"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_VISIBLE_PROVIDERS, "MBIM_CID_VISIBLE_PROVIDERS"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_REGISTER_STATE, "MBIM_CID_REGISTER_STATE"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_PACKET_SERVICE, "MBIM_CID_PACKET_SERVICE"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_SIGNAL_STATE, "MBIM_CID_SIGNAL_STATE"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_CONNECT, "MBIM_CID_CONNECT"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_PROVISIONED_CONTEXTS, "MBIM_CID_PROVISIONED_CONTEXTS"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_SERVICE_ACTIVATION, "MBIM_CID_SERVICE_ACTIVATION"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_IP_CONFIGURATION, "MBIM_CID_IP_CONFIGURATION"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_DEVICE_SERVICES, "MBIM_CID_DEVICE_SERVICES"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_DEVICE_SERVICE_SUBSCRIBE_LIST, "MBIM_CID_DEVICE_SERVICE_SUBSCRIBE_LIST"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_PACKET_STATISTICS, "MBIM_CID_PACKET_STATISTICS"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_NETWORK_IDLE_HINT, "MBIM_CID_NETWORK_IDLE_HINT"},
+    {UUID_BASIC_CONNECT, MBIM_CID_EMERGENCY_MODE, "MBIM_CID_EMERGENCY_MODE"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_IP_PACKET_FILTERS, "MBIM_CID_IP_PACKET_FILTERS"}, 
+    {UUID_BASIC_CONNECT, MBIM_CID_MULTICARRIER_PROVIDERS, "MBIM_CID_MULTICARRIER_PROVIDERS"},
+
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_PROVISIONED_CONTEXT_V2, "MBIM_CID_MS_PROVISIONED_CONTEXT_V2"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_NETWORK_BLACKLIST, "MBIM_CID_MS_NETWORK_BLACKLIST"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_LTE_ATTACH_CONFIG, "MBIM_CID_MS_LTE_ATTACH_CONFIG"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_LTE_ATTACH_STATUS, "MBIM_CID_MS_LTE_ATTACH_STATUS"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_SYS_CAPS, "MBIM_CID_MS_SYS_CAPS"},
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_DEVICE_CAPS_V2, "MBIM_CID_MS_DEVICE_CAPS_V2"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_DEVICE_SLOT_MAPPING, "MBIM_CID_MS_DEVICE_SLOT_MAPPING"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_SLOT_INFO_STATUS, "MBIM_CID_MS_SLOT_INFO_STATUS"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_PCO, "MBIM_CID_MS_PCO"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_DEVICE_RESET, "MBIM_CID_MS_DEVICE_RESET"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_BASE_STATIONS_INFO, "MBIM_CID_MS_BASE_STATIONS_INFO"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_LOCATION_INFO_STATUS, "MBIM_CID_MS_LOCATION_INFO_STATUS"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_NOT_DEFINED, "MBIM_CID_NOT_DEFINED"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_PIN_EX, "MBIM_CID_MS_PIN_EX"}, 
+    {UUID_BASIC_CONNECT_EXT, MBIM_CID_MS_VERSION, "MBIM_CID_MS_VERSION"}, 
+
+    {UUID_MS_UICC_LOW_LEVEL, MBIM_CID_MS_UICC_ATR, "MBIM_CID_MS_UICC_ATR"}, 
+    {UUID_MS_UICC_LOW_LEVEL, MBIM_CID_MS_UICC_OPEN_CHANNEL, "MBIM_CID_MS_UICC_OPEN_CHANNEL"}, 
+    {UUID_MS_UICC_LOW_LEVEL, MBIM_CID_MS_UICC_CLOSE_CHANNEL, "MBIM_CID_MS_UICC_CLOSE_CHANNEL"}, 
+    {UUID_MS_UICC_LOW_LEVEL, MBIM_CID_MS_UICC_APDU, "MBIM_CID_MS_UICC_APDU"}, 
+    {UUID_MS_UICC_LOW_LEVEL, MBIM_CID_MS_UICC_TERMINAL_CAPABILITY, "MBIM_CID_MS_UICC_TERMINAL_CAPABILITY"}, 
+    {UUID_MS_UICC_LOW_LEVEL, MBIM_CID_MS_UICC_RESET, "MBIM_CID_MS_UICC_RESET"}, 
+    {UUID_MS_UICC_LOW_LEVEL, MBIM_CID_MS_APP_LIST, "MBIM_CID_MS_APP_LIST"}, 
+}; 
+
+typedef struct {
+    UINT32 SessionId;
+    UINT32 ActivationCommand; //MBIM_ACTIVATION_COMMAND_E
+    UINT32 AccessStringOffset;
+    UINT32 AccessStringSize;
+    UINT32 UserNameOffset;
+    UINT32 UserNameSize;
+    UINT32 PasswordOffset;
+    UINT32 PasswordSize;
+    UINT32 Compression; //MBIM_COMPRESSION_E
+    UINT32 AuthProtocol; //MBIM_AUTH_PROTOCOL_E
+    UINT32 IPType; //MBIM_CONTEXT_IP_TYPE_E
+    UUID_T ContextType;
+    UINT8 DataBuffer[0];  /* apn, username, password */
+} MBIM_SET_CONNECT_T;
+
+typedef struct {
+    UINT32 SessionId;
+    UINT32 ActivationState; //MBIM_ACTIVATION_STATE_E
+    UINT32 VoiceCallState;
+    UINT32 IPType; //MBIM_CONTEXT_IP_TYPE_E
+    UUID_T ContextType;
+    UINT32 NwError;
+} MBIM_CONNECT_T;
+
+typedef struct {
+    UINT32 OnLinkPrefixLength;
+    UINT8 IPv4Address[4];
+} MBIM_IPV4_ELEMENT_T;
+
+typedef struct {
+    UINT32 OnLinkPrefixLength;
+    UINT8 IPv6Address[16];
+} MBIM_IPV6_ELEMENT_T;
+
+typedef struct {
+    UINT32 SessionId;
+    UINT32 IPv4ConfigurationAvailable; //bit0~Address, bit1~gateway, bit2~DNS, bit3~MTU
+    UINT32 IPv6ConfigurationAvailable; //bit0~Address, bit1~gateway, bit2~DNS, bit3~MTU
+    UINT32 IPv4AddressCount;
+    UINT32 IPv4AddressOffset;
+    UINT32 IPv6AddressCount;
+    UINT32 IPv6AddressOffset;
+    UINT32 IPv4GatewayOffset;
+    UINT32 IPv6GatewayOffset;
+    UINT32 IPv4DnsServerCount;
+    UINT32 IPv4DnsServerOffset;
+    UINT32 IPv6DnsServerCount;
+    UINT32 IPv6DnsServerOffset;
+    UINT32 IPv4Mtu;
+    UINT32 IPv6Mtu;
+    UINT8 DataBuffer[];
+} MBIM_IP_CONFIGURATION_INFO_T;
+
+typedef struct {
+    UINT32 RSRP;
+    UINT32 SNR;
+    UINT32 RSRPThreshold;
+    UINT32 SNRThreshold;
+    UINT32 SystemType;
+} MBIM_RSRP_SNR_INFO_T;
+
+typedef struct {
+    UINT32 Elementcount;
+    MBIM_RSRP_SNR_INFO_T RsrpSnr[0];
+} MBIM_RSRP_SNR_T;
+
+typedef struct {
+    UINT32 Rssi;
+    UINT32 ErrorRate;
+    UINT32 SignalStrengthInterval;
+    UINT32 RssiThreshold;
+    UINT32 ErrorRateThreshold;
+} MBIM_SIGNAL_STATE_INFO_T;
+
+typedef struct {
+    UINT32 Rssi;
+    UINT32 ErrorRate;
+    UINT32 SignalStrengthInterval;
+    UINT32 RssiThreshold;
+    UINT32 ErrorRateThreshold;
+    UINT32 RsrpSnrOffset;
+    UINT32 RsrpSnrSize;
+    UINT8 DataBuffer[];
+} MBIM_SIGNAL_STATE_INFO_V2_T;
+
+typedef struct {
+    UINT32 SignalStrengthInterval;
+    UINT32 RssiThreshold;
+    UINT32 ErrorRateThreshold;
+} MBIM_SET_SIGNAL_STATE_T;
+
+typedef struct {
+    UINT32 DevicePathOffset;
+    UINT32 DevicePathSize;
+    UINT32 Timeout;
+    UINT8 DataBuffer[];
+} MBIM_LIBQMI_PROXY_CONFIG_T;
+
+typedef struct {
+    UINT32 AtrSize;
+    UINT32 AtrOffset;
+    UINT8 DataBuffer[];
+} MBIM_MS_ATR_INFO_T;
+
+#pragma pack()
+
+static pthread_t s_tid_reader = 0;
+static int mbim_verbose = 0;
+static UINT32 TransactionId = 1;
+static unsigned mbim_default_timeout  = 30000;
+static const char *mbim_apn = NULL;
+static const char *mbim_user = NULL;
+static const char *mbim_pd = NULL;
+static int mbim_iptype = MBIMContextIPTypeDefault;
+static int mbim_auth = MBIMAuthProtocolNone;
+static int mbim_sessionID = 0;
+static int mbim_fd = -1;
+static MBIM_MESSAGE_HEADER *mbim_pRequest;
+static MBIM_MESSAGE_HEADER *mbim_pResponse;
+
+static unsigned int qmi_over_mbim_support = 0;
+static int qmi_over_mbim_sk[2] = {-1, -1};
+static pthread_mutex_t mbim_command_mutex = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t mbim_command_cond = PTHREAD_COND_INITIALIZER;
+static int mbim_ms_version = 1;
+static uint8_t qmi_over_mbim_nas = 0;
+int qmi_over_mbim_qmidev_send(PQCQMIMSG pQMI);
+
+static const UUID_T * str2uuid(const char *str) {
+    static UUID_T uuid;
+    UINT32 d[16];
+    char tmp[16*2+4+1];
+    unsigned i = 0;
+
+    while (str[i]) {
+        tmp[i] = tolower(str[i]);
+        i++;
+    }
+    tmp[i] = '\0';
+
+    sscanf(tmp, "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
+        &d[0], &d[1], &d[2], &d[3], &d[4], &d[5], &d[6], &d[7],
+        &d[8], &d[9], &d[10], &d[11], &d[12], &d[13], &d[14], &d[15]);
+
+    for (i = 0; i < 16; i++) {
+        uuid.uuid[i] = d[i]&0xFF;
+    }
+
+    return &uuid;
+}
+
+static void wchar2char(const char *src, size_t src_size, char *dst, size_t dst_len) {
+    size_t i;
+    
+    for (i = 0; i < (dst_len-1) && i < (src_size/2); i++)
+        dst[i] = src[i*2];
+    dst[i] = 0;
+}
+
+static size_t char2wchar(const char *src, size_t src_len, uint8_t *dst, size_t dst_len) {
+    size_t i;
+
+    if (src_len > (dst_len/2))
+        src_len = (dst_len/2);
+
+    for (i = 0; i < src_len; i++) {
+        *dst++ = *src++;
+        *dst++ = 0;
+    }
+
+    return i*2;
+}
+
+#define mbim_alloc( _size)  malloc(_size)
+#define mbim_free(_mem) do { if (_mem) { free(_mem); _mem = NULL;}} while(0)
+
+static int mbim_open_state = 0;
+static MBIM_SUBSCRIBER_READY_STATE_E ReadyState = MBIMSubscriberReadyStateNotInitialized;
+static MBIM_REGISTER_STATE_E RegisterState = MBIMRegisterStateUnknown;
+static MBIM_PACKET_SERVICE_STATE_E PacketServiceState = MBIMPacketServiceStateUnknown;
+static MBIM_ACTIVATION_STATE_E ActivationState = MBIMActivationStateUnknown;
+static MBIM_SUBSCRIBER_READY_STATE_E oldReadyState = MBIMSubscriberReadyStateNotInitialized;
+static MBIM_REGISTER_STATE_E oldRegisterState = MBIMRegisterStateUnknown;
+static MBIM_PACKET_SERVICE_STATE_E oldPacketServiceState = MBIMPacketServiceStateUnknown;
+static MBIM_ACTIVATION_STATE_E oldActivationState = MBIMActivationStateUnknown;
+static int mbim_update_state(void);
+
+static __inline uint32_t mbim2qmi_ipv4addr(uint32_t addr) {
+    return (addr>>24) | (addr>>8&0xff00) | (addr<<8&0xff0000) | (addr<<24);
+}
+
+static __inline void mbim2qmi_ipv6addr(const unsigned char *src, unsigned char *dst) {
+    int i;
+
+    for (i = 0; i < 16 ; i++) {
+        dst[i] = src[i];
+    }
+}
+
+static MBIM_MESSAGE_HEADER *compose_open_command(UINT32 MaxControlTransfer)
+{
+    MBIM_OPEN_MSG_T *pRequest = (MBIM_OPEN_MSG_T *)mbim_alloc(sizeof(MBIM_OPEN_MSG_T));
+
+    if(!pRequest)
+        return NULL;
+
+    pRequest->MessageHeader.MessageType = htole32(MBIM_OPEN_MSG);
+    pRequest->MessageHeader.MessageLength = htole32(sizeof(MBIM_OPEN_MSG_T));
+    pRequest->MessageHeader.TransactionId = htole32(TransactionId++);
+    pRequest->MaxControlTransfer = htole32(MaxControlTransfer);
+
+    return &pRequest->MessageHeader;
+}
+
+static MBIM_MESSAGE_HEADER *compose_close_command(void)
+{
+    MBIM_CLOSE_MSG_T *pRequest = (MBIM_CLOSE_MSG_T *)mbim_alloc(sizeof(MBIM_CLOSE_MSG_T));
+
+    if(!pRequest)
+        return NULL;
+
+    pRequest->MessageHeader.MessageType = htole32(MBIM_CLOSE_MSG);
+    pRequest->MessageHeader.MessageLength = htole32(sizeof(MBIM_CLOSE_MSG_T));
+    pRequest->MessageHeader.TransactionId = htole32(TransactionId++);
+
+    return &pRequest->MessageHeader;
+}
+
+static MBIM_MESSAGE_HEADER *compose_basic_connect_command(UINT32 CID, UINT32 CommandType, void *pInformationBuffer, UINT32 InformationBufferLength)
+{
+    MBIM_COMMAND_MSG_T *pRequest = (MBIM_COMMAND_MSG_T *)mbim_alloc(sizeof(MBIM_COMMAND_MSG_T) + InformationBufferLength);
+
+    if (!pRequest)
+        return NULL;
+
+    pRequest->MessageHeader.MessageType = htole32(MBIM_COMMAND_MSG);
+    pRequest->MessageHeader.MessageLength = htole32((sizeof(MBIM_COMMAND_MSG_T) + InformationBufferLength));
+    pRequest->MessageHeader.TransactionId = htole32(TransactionId++);
+
+    pRequest->FragmentHeader.TotalFragments = htole32(1);
+    pRequest->FragmentHeader.CurrentFragment= htole32(0);
+
+    memcpy(pRequest->DeviceServiceId.uuid, str2uuid(UUID_BASIC_CONNECT), 16);
+
+    pRequest->CID = htole32(CID);
+    pRequest->CommandType = htole32(CommandType);
+    if (InformationBufferLength && pInformationBuffer) {
+        pRequest->InformationBufferLength = htole32(InformationBufferLength);
+        memcpy(pRequest->InformationBuffer, pInformationBuffer, InformationBufferLength);
+    } else {
+        pRequest->InformationBufferLength = htole32(0);
+    }
+
+    return &pRequest->MessageHeader;
+}
+
+static MBIM_MESSAGE_HEADER *compose_basic_connect_ext_command(UINT32 CID, UINT32 CommandType, void *pInformationBuffer, UINT32 InformationBufferLength)
+{
+    MBIM_COMMAND_MSG_T *pRequest = (MBIM_COMMAND_MSG_T *)compose_basic_connect_command(CID, CommandType, pInformationBuffer, InformationBufferLength);
+
+    if (!pRequest)
+        return NULL;
+
+    memcpy(pRequest->DeviceServiceId.uuid, str2uuid(UUID_BASIC_CONNECT_EXT), 16);
+
+    return &pRequest->MessageHeader;
+}
+
+static MBIM_MESSAGE_HEADER *compose_qmi_over_mbim_command(UINT32 CID, UINT32 CommandType, void *pInformationBuffer, UINT32 InformationBufferLength)
+{
+    MBIM_COMMAND_MSG_T *pRequest = (MBIM_COMMAND_MSG_T *)compose_basic_connect_command(CID, CommandType, pInformationBuffer, InformationBufferLength);
+
+    if (!pRequest)
+        return NULL;
+
+    memcpy(pRequest->DeviceServiceId.uuid, str2uuid(uuid_ext_qmux), 16);
+
+    return &pRequest->MessageHeader;
+}
+
+static const char * uuid2str(const UUID_T *pUUID) {
+    static char str[16*2+4+1];
+    const UINT8 *d = pUUID->uuid;
+
+    snprintf(str, sizeof(str), "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
+        d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7],
+        d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]);
+
+    return str;
+}
+
+static const char *DeviceServiceId2str(const UUID_T *pUUID) {
+    const char *str = uuid2str(pUUID);
+
+    struct { char *val;char *name;} _enumstr[] = {
+        {UUID_BASIC_CONNECT, "UUID_BASIC_CONNECT"},
+        {UUID_BASIC_CONNECT_EXT, "UUID_BASIC_CONNECT_EXT"},
+        {UUID_SMS, "UUID_SMS"},
+        {UUID_USSD, "UUID_USSD"},
+        {UUID_PHONEBOOK, "UUID_PHONEBOOK"},
+        {UUID_STK, "UUID_STK"},
+        {UUID_AUTH, "UUID_AUTH"},
+        {UUID_DSS, "UUID_DSS"},
+        {uuid_ext_qmux, "uuid_ext_qmux"},
+        {uuid_mshsd, "uuid_mshsd"},
+        {uuid_qmbe, "uuid_qmbe"},
+        {UUID_MSFWID, "UUID_MSFWID"},
+        {uuid_atds, "uuid_atds"},
+        {uuid_qdu, "uuid_qdu"},
+        {UUID_MS_UICC_LOW_LEVEL, "UUID_MS_UICC_LOW_LEVEL"},
+        {UUID_MS_SARControl, "UUID_MS_SARControl"},
+        {UUID_VOICEEXTENSIONS, "UUID_VOICEEXTENSIONS"},
+        {UUID_LIBMBIM_PROXY, "UUID_LIBMBIM_PROXY"},
+    };
+    int idx;
+
+    for (idx = 0; idx < (int)(sizeof(_enumstr)/sizeof(_enumstr[0])); idx++) {
+        if (!strcasecmp(str, _enumstr[idx].val))
+            return _enumstr[idx].name;
+    }
+
+    return str;
+}
+
+static const char *mbim_get_segment(void *_pMsg, UINT32 offset, UINT32 len)
+{
+    int idx;
+    static char buff[256] = {'\0'};
+    UINT8 *pMsg = (UINT8*)_pMsg;
+
+    for (idx = 0; idx < (int)(len/2); idx++)
+        buff[idx] = pMsg[offset+idx*2];
+    buff[idx] = '\0';
+    return buff;
+}
+
+static void mbim_dump_header(MBIM_MESSAGE_HEADER *pMsg, const char *direction) {
+    mbim_debug("%s Header:", direction);
+    mbim_debug("%s MessageLength = %u", direction, le32toh(pMsg->MessageLength));
+    mbim_debug("%s MessageType =  %s (0x%08x)", direction, MBIMMSGTypeStr(le32toh(pMsg->MessageType)), le32toh(pMsg->MessageType));
+    mbim_debug("%s TransactionId = %u", direction, le32toh(pMsg->TransactionId));
+    mbim_debug("%s Contents:", direction);
+}
+
+static void mbim_dump_uuid_cid(const UUID_T *pUUID, UINT32 CID, const char *direction) {
+    size_t idx;
+    const char *uuidStr = uuid2str(pUUID);
+    const char *cidStr = "unknow";
+
+    for (idx = 0; idx < (sizeof(uuid_cid_string)/sizeof(uuid_cid_string[0])); idx++) {
+        if (!strcmp(uuidStr, uuid_cid_string[idx].uuid) && uuid_cid_string[idx].cid == CID) {
+            cidStr = uuid_cid_string[idx].name;
+        }
+    }
+
+    mbim_debug("%s DeviceServiceId = %s (%s)", direction, DeviceServiceId2str(pUUID), uuidStr);
+    mbim_debug("%s CID = %s (%u)", direction, cidStr, le32toh(CID));
+}
+
+
+static void mbim_dump_command_msg(MBIM_COMMAND_MSG_T *pCmdMsg, const char *direction) {
+    mbim_dump_uuid_cid(&pCmdMsg->DeviceServiceId, le32toh(pCmdMsg->CID), direction);
+    mbim_debug("%s CommandType = %s (%u)", direction, le32toh(pCmdMsg->CommandType) ? "set" : "query", le32toh(pCmdMsg->CommandType));
+    mbim_debug("%s InformationBufferLength = %u", direction, le32toh(pCmdMsg->InformationBufferLength));
+}
+
+static void mbim_dump_command_done(MBIM_COMMAND_DONE_T *pCmdDone, const char *direction) {
+    mbim_dump_uuid_cid(&pCmdDone->DeviceServiceId, le32toh(pCmdDone->CID), direction);
+    mbim_debug("%s Status = %u", direction, le32toh(pCmdDone->Status));
+    mbim_debug("%s InformationBufferLength = %u", direction, le32toh(pCmdDone->InformationBufferLength));
+}
+
+static void mbim_dump_indicate_msg(MBIM_INDICATE_STATUS_MSG_T *pIndMsg, const char *direction) {
+    mbim_dump_uuid_cid(&pIndMsg->DeviceServiceId, le32toh(pIndMsg->CID), direction);
+    mbim_debug("%s InformationBufferLength = %u", direction, le32toh(pIndMsg->InformationBufferLength));
+}
+
+static void mbim_dump_connect(MBIM_CONNECT_T *pInfo, const char *direction) {
+    mbim_debug("%s SessionId = %u", direction, le32toh(pInfo->SessionId));
+    mbim_debug("%s ActivationState = %s (%u)", direction, MBIMActivationStateStr(le32toh(pInfo->ActivationState)), le32toh(pInfo->ActivationState));
+    mbim_debug("%s IPType = %s", direction, MBIMContextIPTypeStr(le32toh(pInfo->IPType)));
+    mbim_debug("%s VoiceCallState = %s", direction, MBIMVoiceCallStateStr(le32toh(pInfo->VoiceCallState)));
+    mbim_debug("%s ContextType = %s", direction, uuid2str(&pInfo->ContextType));
+    mbim_debug("%s NwError = %u", direction, le32toh(pInfo->NwError));
+}
+
+static void mbim_dump_signal_state(MBIM_SIGNAL_STATE_INFO_T *pInfo, const char *direction)
+{
+    mbim_debug("%s Rssi = %u", direction, le32toh(pInfo->Rssi));
+    mbim_debug("%s ErrorRate = %u", direction, le32toh(pInfo->ErrorRate));
+    mbim_debug("%s SignalStrengthInterval = %u", direction, le32toh(pInfo->SignalStrengthInterval));
+    mbim_debug("%s RssiThreshold = %u", direction, le32toh(pInfo->RssiThreshold));
+    mbim_debug("%s ErrorRateThreshold = %u", direction, le32toh(pInfo->ErrorRateThreshold));
+}
+
+static void mbim_dump_packet_service(MBIM_PACKET_SERVICE_INFO_T *pInfo, const char *direction)
+{
+    mbim_debug("%s NwError = %u", direction, le32toh(pInfo->NwError));
+    mbim_debug("%s PacketServiceState = %s", direction, MBIMPacketServiceStateStr(le32toh(pInfo->PacketServiceState)));
+    mbim_debug("%s HighestAvailableDataClass = %s", direction, MBIMDataClassStr(le32toh(pInfo->HighestAvailableDataClass)));
+    mbim_debug("%s UplinkSpeed = %ld", direction, (long)le64toh(pInfo->UplinkSpeed));
+    mbim_debug("%s DownlinkSpeed = %ld", direction, (long)le64toh(pInfo->DownlinkSpeed));
+}
+
+static void mbim_dump_subscriber_status(MBIM_SUBSCRIBER_READY_STATUS_T *pInfo, const char *direction)
+{
+    mbim_debug("%s ReadyState = %s", direction, MBIMSubscriberReadyStateStr(le32toh(pInfo->ReadyState)));
+    mbim_debug("%s SIMICCID = %s", direction, mbim_get_segment(pInfo, le32toh(pInfo->SimIccIdOffset), le32toh(pInfo->SimIccIdSize)));
+    mbim_debug("%s SubscriberID = %s", direction, mbim_get_segment(pInfo, le32toh(pInfo->SubscriberIdOffset), le32toh(pInfo->SubscriberIdSize)));
+    /* maybe more than one number */
+    uint32_t idx;
+    for (idx = 0; idx < le32toh(pInfo->ElementCount); idx++) {
+        UINT32 offset = ((UINT32*)((UINT8*)pInfo+offsetof(MBIM_SUBSCRIBER_READY_STATUS_T, TelephoneNumbersRefList)))[0];
+        UINT32 length = ((UINT32*)((UINT8*)pInfo+offsetof(MBIM_SUBSCRIBER_READY_STATUS_T, TelephoneNumbersRefList)))[1];
+        mbim_debug("%s Number = %s", direction, mbim_get_segment(pInfo, le32toh(offset), le32toh(length)));
+    }
+}
+
+static void mbim_dump_regiester_status(MBIM_REGISTRATION_STATE_INFO_T *pInfo, const char *direction)
+{
+    mbim_debug("%s NwError = %u", direction, le32toh(pInfo->NwError));
+    mbim_debug("%s RegisterState = %s", direction, MBIMRegisterStateStr(le32toh(pInfo->RegisterState)));
+    mbim_debug("%s RegisterMode = %s", direction, MBIMRegisterModeStr(le32toh(pInfo->RegisterMode)));
+}
+
+static void mbim_dump_ipconfig(MBIM_IP_CONFIGURATION_INFO_T *pInfo, const char *direction)
+{
+    UINT8 prefix = 0, *ipv4=NULL, *ipv6=NULL, *gw=NULL, *dns1=NULL, *dns2=NULL;
+
+    mbim_debug("%s SessionId = %u", direction, le32toh(pInfo->SessionId));
+    mbim_debug("%s IPv4ConfigurationAvailable = 0x%x", direction, le32toh(pInfo->IPv4ConfigurationAvailable));
+    mbim_debug("%s IPv6ConfigurationAvailable = 0x%x", direction, le32toh(pInfo->IPv6ConfigurationAvailable));
+    mbim_debug("%s IPv4AddressCount = 0x%x", direction, le32toh(pInfo->IPv4AddressCount));
+    mbim_debug("%s IPv4AddressOffset = 0x%x", direction, le32toh(pInfo->IPv4AddressOffset));
+    mbim_debug("%s IPv6AddressCount = 0x%x", direction, le32toh(pInfo->IPv6AddressCount));
+    mbim_debug("%s IPv6AddressOffset = 0x%x", direction, le32toh(pInfo->IPv6AddressOffset));
+
+    /* IPv4 */
+    if (le32toh(pInfo->IPv4ConfigurationAvailable)&0x1) {
+        MBIM_IPV4_ELEMENT_T *pAddress = (MBIM_IPV4_ELEMENT_T *)(&pInfo->DataBuffer[le32toh(pInfo->IPv4AddressOffset)-sizeof(MBIM_IP_CONFIGURATION_INFO_T)]);
+        prefix = le32toh(pAddress->OnLinkPrefixLength);
+        ipv4 = pAddress->IPv4Address;
+        mbim_debug("%s IPv4 = %u.%u.%u.%u/%u", direction, ipv4[0], ipv4[1], ipv4[2], ipv4[3], prefix);
+    }
+    if (le32toh(pInfo->IPv4ConfigurationAvailable)&0x2) {
+        gw = (UINT8 *)(&pInfo->DataBuffer[le32toh(pInfo->IPv4GatewayOffset)-sizeof(MBIM_IP_CONFIGURATION_INFO_T)]);
+        mbim_debug("%s gw = %u.%u.%u.%u", direction, gw[0], gw[1], gw[2], gw[3]);
+    }
+    if (le32toh(pInfo->IPv4ConfigurationAvailable)&0x4) {
+        dns1 = (UINT8 *)(&pInfo->DataBuffer[le32toh(pInfo->IPv4DnsServerOffset) -sizeof(MBIM_IP_CONFIGURATION_INFO_T)]);
+        mbim_debug("%s dns1 = %u.%u.%u.%u", direction, dns1[0], dns1[1], dns1[2], dns1[3]);
+        if (le32toh(pInfo->IPv4DnsServerCount) == 2) {
+            dns2 = dns1 + 4;
+            mbim_debug("%s dns2 = %u.%u.%u.%u", direction, dns2[0], dns2[1], dns2[2], dns2[3]);
+        }
+    }
+    if (le32toh(pInfo->IPv4Mtu)) mbim_debug("%s ipv4 mtu = %u", direction, le32toh(pInfo->IPv4Mtu));
+
+    /* IPv6 */
+    if (le32toh(pInfo->IPv6ConfigurationAvailable)&0x1) {
+        MBIM_IPV6_ELEMENT_T *pAddress = (MBIM_IPV6_ELEMENT_T *)(&pInfo->DataBuffer[le32toh(pInfo->IPv6AddressOffset)-sizeof(MBIM_IP_CONFIGURATION_INFO_T)]);
+        prefix = le32toh(pAddress->OnLinkPrefixLength);
+        ipv6 = pAddress->IPv6Address;
+        mbim_debug("%s IPv6 = %02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x/%d", \
+            direction, ipv6[0], ipv6[1], ipv6[2], ipv6[3], ipv6[4], ipv6[5], ipv6[6], ipv6[7], \
+            ipv6[8], ipv6[9], ipv6[10], ipv6[11], ipv6[12], ipv6[13], ipv6[14], ipv6[15], prefix);
+    }
+    if (le32toh(pInfo->IPv6ConfigurationAvailable)&0x2) {
+        gw = (UINT8 *)(&pInfo->DataBuffer[le32toh(pInfo->IPv6GatewayOffset)-sizeof(MBIM_IP_CONFIGURATION_INFO_T)]);
+        mbim_debug("%s gw = %02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x", \
+            direction, gw[0], gw[1], gw[2], gw[3], gw[4], gw[5], gw[6], gw[7], \
+            gw[8], gw[9], gw[10], gw[11], gw[12], gw[13], gw[14], gw[15]);
+    }
+    if (le32toh(pInfo->IPv6ConfigurationAvailable)&0x4) {
+        dns1 = (UINT8 *)(&pInfo->DataBuffer[le32toh(pInfo->IPv6DnsServerOffset)-sizeof(MBIM_IP_CONFIGURATION_INFO_T)]);
+        mbim_debug("%s dns1 = %02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x", \
+            direction, dns1[0], dns1[1], dns1[2], dns1[3], dns1[4], dns1[5], dns1[6], dns1[7], \
+            dns1[8], dns1[9], dns1[10], dns1[11], dns1[12], dns1[13], dns1[14], dns1[15]);
+        if (le32toh(pInfo->IPv6DnsServerCount) == 2) {
+            dns2 = dns1 + 16;
+            mbim_debug("%s dns2 = %02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x", \
+                direction, dns2[0], dns2[1], dns2[2], dns2[3], dns1[4], dns1[5], dns1[6], dns1[7],
+                dns2[8], dns2[9], dns2[10], dns2[11], dns2[12], dns2[13], dns2[14], dns2[15]);
+        }
+    }
+    if (le32toh(pInfo->IPv6Mtu)) mbim_debug("%s ipv6 mtu = %u", direction, le32toh(pInfo->IPv6Mtu));
+}
+
+static void mbim_dump(MBIM_MESSAGE_HEADER *pMsg, int mbim_verbose) {
+    unsigned char *data = (unsigned char *)pMsg;
+    const char *direction = (le32toh(pMsg->MessageType) & 0x80000000) ? "<" : ">";
+
+    if (!mbim_verbose)
+        return;
+
+    if (mbim_verbose) {
+        unsigned i;
+        static char *_tmp = NULL;
+
+        if (!_tmp)
+            _tmp = (char *)malloc(4096);
+
+        if (_tmp) {
+            _tmp[0] = (le32toh(pMsg->MessageType) & 0x80000000) ? '<' : '>';
+            _tmp[1] = '\0';
+            for (i = 0; i < le32toh(pMsg->MessageLength) && i < 4096; i++)
+                snprintf(_tmp + strlen(_tmp), 4096 - strlen(_tmp), "%02X:", data[i]);
+            mbim_debug("%s", _tmp);
+        }
+    }
+
+    mbim_dump_header(pMsg, direction);
+
+    switch (le32toh(pMsg->MessageType)) {
+    case MBIM_OPEN_MSG: {
+        MBIM_OPEN_MSG_T *pOpenMsg = (MBIM_OPEN_MSG_T *)pMsg;
+        mbim_debug("%s MaxControlTransfer = %u", direction, le32toh(pOpenMsg->MaxControlTransfer));
+    }
+    break;
+    case MBIM_OPEN_DONE: {
+        MBIM_OPEN_DONE_T *pOpenDone = (MBIM_OPEN_DONE_T *)pMsg;
+        mbim_debug("%s Status = %u", direction, le32toh(pOpenDone->Status));
+    }
+    break;
+    case MBIM_CLOSE_MSG: {
+
+    }
+    break;
+    case MBIM_CLOSE_DONE: {
+        MBIM_CLOSE_DONE_T *pCloseDone = (MBIM_CLOSE_DONE_T *)pMsg;
+        mbim_debug("%s Status = %u", direction, le32toh(pCloseDone->Status));
+    }
+    break;
+    case MBIM_COMMAND_MSG: {
+        MBIM_COMMAND_MSG_T *pCmdMsg = (MBIM_COMMAND_MSG_T *)pMsg;
+
+        mbim_dump_command_msg(pCmdMsg, direction);
+        if (!memcmp(pCmdMsg->DeviceServiceId.uuid, str2uuid(UUID_BASIC_CONNECT), 16)) {
+            switch (le32toh(pCmdMsg->CID)) {
+               case  MBIM_CID_CONNECT: {
+                    MBIM_SET_CONNECT_T *pInfo = (MBIM_SET_CONNECT_T *)pCmdMsg->InformationBuffer;
+                    mbim_debug("%s SessionId = %u", direction, le32toh(pInfo->SessionId));
+                }
+                break;
+                case MBIM_CID_IP_CONFIGURATION: {
+                    MBIM_IP_CONFIGURATION_INFO_T *pInfo = (MBIM_IP_CONFIGURATION_INFO_T *)pCmdMsg->InformationBuffer;
+                    mbim_debug("%s SessionId = %u", direction, le32toh(pInfo->SessionId));
+                }
+                break;
+                default:
+                break;
+            }
+        }
+    }
+    break;
+    case MBIM_COMMAND_DONE: {
+        MBIM_COMMAND_DONE_T *pCmdDone = (MBIM_COMMAND_DONE_T *)pMsg;
+
+        mbim_dump_command_done(pCmdDone, direction);
+        if (le32toh(pCmdDone->InformationBufferLength) == 0)
+            return;
+
+        if (!memcmp(pCmdDone->DeviceServiceId.uuid, str2uuid(UUID_BASIC_CONNECT), 16)) {
+            switch (le32toh(pCmdDone->CID)) {
+                case MBIM_CID_CONNECT: {
+                MBIM_CONNECT_T *pInfo = (MBIM_CONNECT_T *)pCmdDone->InformationBuffer;
+                mbim_dump_connect(pInfo, direction);
+                }
+                break;
+                case MBIM_CID_IP_CONFIGURATION: {
+                    //MBIM_IP_CONFIGURATION_INFO_T *pInfo = (MBIM_IP_CONFIGURATION_INFO_T *)pCmdDone->InformationBuffer;
+                    //mbim_dump_ipconfig(pInfo, direction);
+                }
+                break;
+                case MBIM_CID_PACKET_SERVICE: {
+                    MBIM_PACKET_SERVICE_INFO_T *pInfo = (MBIM_PACKET_SERVICE_INFO_T *)pCmdDone->InformationBuffer;
+                    mbim_dump_packet_service(pInfo, direction);
+                }
+                break;
+                case MBIM_CID_SUBSCRIBER_READY_STATUS: {
+                    MBIM_SUBSCRIBER_READY_STATUS_T *pInfo = (MBIM_SUBSCRIBER_READY_STATUS_T *)pCmdDone->InformationBuffer;
+                    mbim_dump_subscriber_status(pInfo, direction);
+                }
+                break;
+                case MBIM_CID_REGISTER_STATE: {
+                    MBIM_REGISTRATION_STATE_INFO_T *pInfo = (MBIM_REGISTRATION_STATE_INFO_T *)pCmdDone->InformationBuffer;
+                    mbim_dump_regiester_status(pInfo, direction);
+                }
+                break;
+                default:
+                break;
+            }
+        }
+    }
+    break;
+    case MBIM_INDICATE_STATUS_MSG: {
+        MBIM_INDICATE_STATUS_MSG_T *pIndMsg = (MBIM_INDICATE_STATUS_MSG_T *)pMsg;
+
+        mbim_dump_indicate_msg(pIndMsg, direction);
+        if (le32toh(pIndMsg->InformationBufferLength) == 0)
+            return;
+
+        if (!memcmp(pIndMsg->DeviceServiceId.uuid, str2uuid(UUID_BASIC_CONNECT), 16)) {
+            switch (le32toh(pIndMsg->CID)) {
+                case MBIM_CID_CONNECT: {
+                    MBIM_CONNECT_T *pInfo = (MBIM_CONNECT_T *)pIndMsg->InformationBuffer;
+                    mbim_dump_connect(pInfo, direction);
+                }
+                break;
+                case MBIM_CID_SIGNAL_STATE: {
+                    MBIM_SIGNAL_STATE_INFO_T *pInfo = (MBIM_SIGNAL_STATE_INFO_T *)pIndMsg->InformationBuffer;
+                    mbim_dump_signal_state(pInfo, direction);
+                }
+                break;
+                case MBIM_CID_SUBSCRIBER_READY_STATUS: {
+                    MBIM_SUBSCRIBER_READY_STATUS_T *pInfo = (MBIM_SUBSCRIBER_READY_STATUS_T *)pIndMsg->InformationBuffer;
+                    mbim_dump_subscriber_status(pInfo, direction);
+                }
+                break;
+                case MBIM_CID_REGISTER_STATE: {
+                    MBIM_REGISTRATION_STATE_INFO_T *pInfo = (MBIM_REGISTRATION_STATE_INFO_T *)pIndMsg->InformationBuffer;
+                    mbim_dump_regiester_status(pInfo, direction);
+                }
+                break;
+                case MBIM_CID_PACKET_SERVICE: {
+                    MBIM_PACKET_SERVICE_INFO_T *pInfo = (MBIM_PACKET_SERVICE_INFO_T *)pIndMsg->InformationBuffer;
+                    mbim_dump_packet_service(pInfo, direction);
+                }
+                break;
+                default:
+                break;
+            }
+        }
+        else if (!memcmp(pIndMsg->DeviceServiceId.uuid, str2uuid(UUID_BASIC_CONNECT_EXT), 16)) {
+        }
+    }
+    break;
+    case MBIM_FUNCTION_ERROR_MSG: {
+        MBIM_FUNCTION_ERROR_MSG_T *pErrMsg = (MBIM_FUNCTION_ERROR_MSG_T*)pMsg;
+        mbim_debug("%s ErrorStatusCode = %u", direction, le32toh(pErrMsg->ErrorStatusCode));
+    }
+    break;
+    default:
+    break;
+    }
+}
+
+static void mbim_recv_command(MBIM_MESSAGE_HEADER *pResponse, unsigned size)
+{
+    (void)size;
+    pthread_mutex_lock(&mbim_command_mutex);
+
+    if (pResponse)
+        mbim_dump(pResponse, mbim_verbose);
+
+    if (pResponse == NULL) {
+        pthread_cond_signal(&mbim_command_cond);
+    }
+    else if (mbim_pRequest && le32toh(mbim_pRequest->TransactionId) == le32toh(pResponse->TransactionId)) {
+        mbim_pResponse = mbim_alloc(le32toh(pResponse->MessageLength));
+        if (mbim_pResponse)
+            memcpy(mbim_pResponse, pResponse, le32toh(pResponse->MessageLength));
+        pthread_cond_signal(&mbim_command_cond);
+    }
+    else if (le32toh(pResponse->MessageType) ==  MBIM_INDICATE_STATUS_MSG) {
+        MBIM_INDICATE_STATUS_MSG_T *pIndMsg = (MBIM_INDICATE_STATUS_MSG_T *)pResponse;
+
+        if (!memcmp(pIndMsg->DeviceServiceId.uuid, str2uuid(UUID_BASIC_CONNECT), 16))
+        {
+            switch (le32toh(pIndMsg->CID)) {
+                case MBIM_CID_SUBSCRIBER_READY_STATUS: {
+                    MBIM_SUBSCRIBER_READY_STATUS_T *pInfo = (MBIM_SUBSCRIBER_READY_STATUS_T *)pIndMsg->InformationBuffer;
+                    if (oldReadyState != le32toh(pInfo->ReadyState))
+                        qmidevice_send_event_to_main(RIL_UNSOL_RESPONSE_VOICE_NETWORK_STATE_CHANGED);
+                }
+                break;
+                case MBIM_CID_REGISTER_STATE: {
+                    MBIM_REGISTRATION_STATE_INFO_T *pInfo = (MBIM_REGISTRATION_STATE_INFO_T *)pIndMsg->InformationBuffer;
+                    if (oldRegisterState != le32toh(pInfo->RegisterState))
+                        qmidevice_send_event_to_main(RIL_UNSOL_RESPONSE_VOICE_NETWORK_STATE_CHANGED);
+                }
+                break;
+                case MBIM_CID_PACKET_SERVICE: {
+                    MBIM_PACKET_SERVICE_INFO_T *pInfo = (MBIM_PACKET_SERVICE_INFO_T *)pIndMsg->InformationBuffer;
+                    MBIM_PACKET_SERVICE_STATE_E state = le32toh(pInfo->PacketServiceState);
+
+                    if (oldPacketServiceState != state
+                            && (1 || MBIMPacketServiceStateAttached == state || MBIMPacketServiceStateDetached == state))
+                        qmidevice_send_event_to_main(RIL_UNSOL_RESPONSE_VOICE_NETWORK_STATE_CHANGED);
+                }
+                break;
+                case MBIM_CID_CONNECT: {
+                    MBIM_CONNECT_T *pInfo = (MBIM_CONNECT_T *)pIndMsg->InformationBuffer;
+                    if (pInfo->SessionId == (uint32_t)mbim_sessionID) {
+                        MBIM_ACTIVATION_STATE_E state = le32toh(pInfo->ActivationState);
+
+                        if (oldActivationState != state
+                            && (1 || MBIMActivationStateActivated == state || MBIMActivationStateDeactivated == state))
+                            qmidevice_send_event_to_main(RIL_UNSOL_DATA_CALL_LIST_CHANGED);
+                    }
+                }
+                break;
+                default:
+                break;
+            }
+        }
+    }
+
+    pthread_mutex_unlock(&mbim_command_mutex);
+}
+
+static int mbim_send_command(MBIM_MESSAGE_HEADER *pRequest, MBIM_COMMAND_DONE_T **ppCmdDone, unsigned msecs) {
+    int ret;
+
+    if (ppCmdDone)
+         *ppCmdDone = NULL;
+
+    if (mbim_fd <= 0)
+        return -ENODEV;
+
+   if (s_tid_reader == 0)
+      return -EINVAL;
+
+    if (!pRequest)
+        return -ENOMEM;
+
+    pthread_mutex_lock(&mbim_command_mutex);
+
+    if (pRequest) {
+        if (pRequest->TransactionId == (0xFFFFFF + 1)) { //quectel-mbim-proxy need 0xFF000000 to indicat client
+            TransactionId = 1;
+            pRequest->TransactionId = htole32(TransactionId++);
+        }
+        mbim_dump(pRequest, mbim_verbose);
+    }
+
+    mbim_pRequest = pRequest;
+    mbim_pResponse = NULL;
+
+    ret = write(mbim_fd, pRequest, le32toh(pRequest->MessageLength));
+
+    if (ret > 0 && (uint32_t)ret == le32toh(pRequest->MessageLength)) {
+        ret = pthread_cond_timeout_np(&mbim_command_cond, &mbim_command_mutex, msecs);
+        if (!ret) {
+            if (mbim_pResponse && ppCmdDone) {
+                *ppCmdDone = (MBIM_COMMAND_DONE_T *)mbim_pResponse;
+            }
+        }
+    } else {
+        mbim_debug("%s pthread_cond_timeout_np=%d", __func__, ret);
+    }
+
+    mbim_pRequest = mbim_pResponse = NULL;
+
+    pthread_mutex_unlock(&mbim_command_mutex);
+
+    return ret;
+}
+
+static ssize_t mbim_proxy_read (int fd, MBIM_MESSAGE_HEADER *pResponse, size_t size) {
+    ssize_t nreads;
+
+    nreads = read(fd, pResponse, sizeof(MBIM_MESSAGE_HEADER));
+    if (nreads == sizeof(MBIM_MESSAGE_HEADER) && le32toh(pResponse->MessageLength) <= size) {
+        nreads += read(fd, pResponse+1, le32toh(pResponse->MessageLength) - sizeof(MBIM_MESSAGE_HEADER));
+    }
+
+    return nreads;
+}
+
+static void * mbim_read_thread(void *param) {
+    PROFILE_T *profile = (PROFILE_T *)param;
+    const char *cdc_wdm = (const char *)profile->qmichannel;
+    int wait_for_request_quit = 0;
+
+    mbim_verbose = debug_qmi;
+    s_tid_reader = pthread_self();
+
+    if (profile->qmap_mode > 1 && profile->qmapnet_adapter[0]) {
+        if (!profile->proxy[0])
+             sprintf(profile->proxy, "%s", QUECTEL_MBIM_PROXY);
+        mbim_sessionID = profile->pdp;
+    }
+
+    if (profile->proxy[0]) {
+        mbim_fd = cm_open_proxy(profile->proxy);
+    } 
+    else {
+        mbim_fd = cm_open_dev(cdc_wdm);
+    }
+
+    if (mbim_fd <= 0) {
+        mbim_debug("fail to open (%s), errno: %d (%s)", cdc_wdm, errno, strerror(errno));
+        goto __quit;
+    }
+
+    dbg_time("cdc_wdm_fd = %d", mbim_fd);
+
+    qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_CONNECTED);
+
+    while (mbim_fd > 0) {
+        struct pollfd pollfds[] = {{mbim_fd, POLLIN, 0}, {qmidevice_control_fd[1], POLLIN, 0}, {qmi_over_mbim_sk[1], POLLIN, 0}};
+        int ne, ret, nevents = 2;
+
+        if (pollfds[nevents].fd != -1)
+            nevents++;
+
+        ret = poll(pollfds, nevents, wait_for_request_quit ? 1000 : -1);
+
+        if (ret == 0 && wait_for_request_quit) {
+            break;
+        }
+
+        if (ret < 0) {
+            mbim_debug("%s poll=%d, errno: %d (%s)", __func__, ret, errno, strerror(errno));
+            break;
+        }
+
+        for (ne = 0; ne < nevents; ne++) {
+            int fd = pollfds[ne].fd;
+            short revents = pollfds[ne].revents;
+
+            if (revents & (POLLERR | POLLHUP | POLLNVAL)) {
+                mbim_debug("%s poll err/hup/inval", __func__);
+                mbim_debug("epoll fd = %d, events = 0x%04x", fd, revents);
+                if (revents & (POLLERR | POLLHUP | POLLNVAL))
+                goto __quit;
+            }
+
+            if ((revents & POLLIN) == 0)
+                continue;
+
+            if (mbim_fd == fd) {
+                ssize_t nreads;
+                MBIM_MESSAGE_HEADER *pResponse = (MBIM_MESSAGE_HEADER *) cm_recv_buf;
+
+                if (profile->proxy[0])
+                    nreads = mbim_proxy_read(fd, pResponse, sizeof(cm_recv_buf));
+                else
+                    nreads = read(fd, pResponse, sizeof(cm_recv_buf));
+
+                if (nreads <= 0) {
+                    mbim_debug("%s read=%d errno: %d (%s)",  __func__, (int)nreads, errno, strerror(errno));
+                    break;
+                }
+
+                mbim_recv_command(pResponse, nreads);
+            }
+            else if (fd == qmidevice_control_fd[1]) {
+                int triger_event;
+                if (read(fd, &triger_event, sizeof(triger_event)) == sizeof(triger_event)) {
+                    //mbim_debug("triger_event = 0x%x", triger_event);
+                    switch (triger_event) {
+                        case RIL_REQUEST_QUIT:
+                            goto __quit;
+                        break;
+                        case SIG_EVENT_STOP:
+                            wait_for_request_quit = 1;
+                        break;
+                        default:
+                        break;
+                    }
+                }
+            }
+            else if (fd == qmi_over_mbim_sk[1]) {
+                    ssize_t nreads = read(fd, cm_recv_buf, sizeof(cm_recv_buf));
+                    if (nreads > 0)
+                        QmiThreadRecvQMI((PQCQMIMSG)cm_recv_buf);
+            }
+        }
+    }
+
+__quit:
+    if (mbim_fd != -1) { close(mbim_fd); mbim_fd = -1; }
+    mbim_recv_command(NULL, 0);
+    qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_DISCONNECTED);
+    mbim_debug("%s exit", __func__);
+    s_tid_reader = 0;
+
+    return NULL;
+}
+
+static int mbim_status_code(MBIM_MESSAGE_HEADER *pMsgHdr) {
+    int status = 0;
+
+    if (!pMsgHdr)
+        return 0;
+
+    switch (le32toh(pMsgHdr->MessageType)) {
+        case MBIM_OPEN_DONE: {
+            MBIM_OPEN_DONE_T *pOpenDone = (MBIM_OPEN_DONE_T *)pMsgHdr;
+            status = le32toh(pOpenDone->Status);
+        }
+        break;
+        case MBIM_CLOSE_DONE: {
+            MBIM_CLOSE_DONE_T *pCloseDone = (MBIM_CLOSE_DONE_T *)pMsgHdr;
+            status = le32toh(pCloseDone->Status);
+        }
+        break;
+        case MBIM_COMMAND_DONE: {
+            MBIM_COMMAND_DONE_T *pCmdDone = (MBIM_COMMAND_DONE_T *)pMsgHdr;
+            status = le32toh(pCmdDone->Status);
+        }
+        break;
+        case MBIM_FUNCTION_ERROR_MSG: {
+            MBIM_FUNCTION_ERROR_MSG_T *pErrMsg = (MBIM_FUNCTION_ERROR_MSG_T *)pMsgHdr;
+            status = le32toh(pErrMsg->ErrorStatusCode);
+            if (status == MBIM_ERROR_NOT_OPENED)
+                mbim_open_state = 0; //EM06ELAR03A05M4G when suspend/resume, may get this error
+        }
+        break;
+        default:
+        break;
+    }
+
+    return status;
+}
+
+#define mbim_check_err(err, pRequest, pCmdDone) do { \
+    int _status = mbim_status_code(pCmdDone ? &pCmdDone->MessageHeader : NULL); \
+    if (err || _status || !pCmdDone) { \
+        if (pCmdDone) { mbim_dump(&pCmdDone->MessageHeader, (mbim_verbose == 0)); } \
+        mbim_free(pRequest); mbim_free(pCmdDone); \
+        mbim_debug("%s:%d err=%d, Status=%d", __func__, __LINE__, err, _status); \
+        if (err) return err; \
+        if (_status) return _status; \
+        return 8888; \
+    } \
+} while(0)
+
+/*
+ * MBIM device can be open repeatly without error
+ * So, we can call the function, no matter it have been opened or not
+ */
+static int mbim_open_device(uint32_t MaxControlTransfer) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_OPEN_DONE_T *pOpenDone = NULL;
+    int err = 0;
+
+    mbim_debug("%s()", __func__);
+    pRequest = compose_open_command(MaxControlTransfer);
+    err = mbim_send_command(pRequest, (MBIM_COMMAND_DONE_T **)&pOpenDone, 3*1000); //EM06ELAR03A09M4G take about 2.5 seconds
+    mbim_check_err(err, pRequest, pOpenDone);
+
+    err = le32toh(pOpenDone->Status);
+    mbim_free(pRequest); mbim_free(pOpenDone);
+
+    return err;
+}
+
+static int mbim_close_device(void) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_CLOSE_DONE_T *pCloseDone = NULL;
+    int err = 0;
+
+    mbim_debug("%s()", __func__);
+    pRequest = compose_close_command();
+    err = mbim_send_command(pRequest, (MBIM_COMMAND_DONE_T **)&pCloseDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCloseDone);
+
+    err = le32toh(pCloseDone->Status);
+    mbim_free(pRequest); mbim_free(pCloseDone);
+
+    return err;
+}
+
+static int mbim_query_connect(int sessionID) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    MBIM_SET_CONNECT_T set_connect;
+    int err;
+
+    if (ActivationState != MBIMActivationStateActivated  || mbim_verbose)
+        mbim_debug("%s(sessionID=%d)", __func__, sessionID); //avoid two many log
+    set_connect.SessionId = htole32(sessionID);
+    pRequest = compose_basic_connect_command(MBIM_CID_CONNECT, MBIM_CID_CMD_TYPE_QUERY, &set_connect, sizeof(set_connect));
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    if (le32toh(pCmdDone->InformationBufferLength))
+    {
+        MBIM_CONNECT_T *pInfo = (MBIM_CONNECT_T *)pCmdDone->InformationBuffer;
+        ActivationState = le32toh(pInfo->ActivationState);
+        mbim_update_state();
+    }
+    mbim_free(pRequest); mbim_free(pCmdDone);
+    return err;
+}
+
+static int mbim_ms_version_query(void) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    int err;
+
+    struct _bc_ext_version {
+            UINT8 ver_minor;
+            UINT8 ver_major;
+            UINT8 ext_ver_minor;
+            UINT8 ext_ver_major;
+    } __attribute__ ((packed)) bc_ext_version;
+
+    bc_ext_version.ver_major = 1;
+    bc_ext_version.ver_minor = 0;
+    bc_ext_version.ext_ver_major = 2;
+    bc_ext_version.ext_ver_minor = 0;
+
+    pRequest = compose_basic_connect_ext_command(MBIM_CID_MS_VERSION, MBIM_CID_CMD_TYPE_QUERY, &bc_ext_version, sizeof(bc_ext_version));
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    if (le32toh(pCmdDone->InformationBufferLength)) {
+        struct _bc_ext_version *pInfo = (struct _bc_ext_version *)pCmdDone->InformationBuffer;
+        //mbim_debug("%s ext_rel_ver major=%d, minor=%d", __func__, pInfo->ext_ver_major, pInfo->ext_ver_minor);
+        mbim_ms_version = pInfo->ext_ver_major;
+    }
+
+    mbim_free(pRequest); mbim_free(pCmdDone);
+    return err;
+}
+
+static int mbim_device_services_query(void) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    int err;
+    int mbim_v2_support = 0;
+
+    mbim_debug("%s()", __func__);
+    pRequest = compose_basic_connect_command(MBIM_CID_DEVICE_SERVICES, MBIM_CID_CMD_TYPE_QUERY, NULL, 0);
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    if (pCmdDone->InformationBufferLength) {
+         MBIM_DEVICE_SERVICES_INFO_T *pInfo = (MBIM_DEVICE_SERVICES_INFO_T *)pCmdDone->InformationBuffer;
+         UINT32 i;
+
+        for (i = 0; i < le32toh(pInfo->DeviceServicesCount) ; i++) {
+            //UINT32 size = pInfo->DeviceServicesRefList[i].size;
+            UINT32 offset = le32toh(pInfo->DeviceServicesRefList[i].offset);
+            MBIM_DEVICE_SERVICE_ELEMENT_T *pSrvEle = (MBIM_DEVICE_SERVICE_ELEMENT_T *)((void *)pInfo + offset);
+
+            //mbim_debug("\t[%2d] %s (%s)", i, DeviceServiceId2str(&pSrvEle->DeviceServiceId), uuid2str(&pSrvEle->DeviceServiceId));
+            if (!strcasecmp(UUID_BASIC_CONNECT_EXT, uuid2str(&pSrvEle->DeviceServiceId))) {
+                UINT32 cid = 0;
+
+                for (cid = 0; cid < le32toh(pSrvEle->CidCount); cid++) {
+                  if (MBIM_CID_MS_VERSION == le32toh(pSrvEle->CidList[cid])) {
+                        mbim_v2_support = 1;
+                    }
+                }
+            }
+            else if (!strcasecmp(uuid_ext_qmux, uuid2str(&pSrvEle->DeviceServiceId))) {
+                qmi_over_mbim_support = 1;
+            }
+        }
+    }
+    mbim_free(pRequest); mbim_free(pCmdDone);
+
+    if (mbim_v2_support) {
+        mbim_ms_version_query();
+    }
+
+    return err;
+}
+
+static int mbim_device_caps_query(PROFILE_T *profile) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    int err;
+
+    mbim_debug("%s()", __func__);
+    pRequest = compose_basic_connect_command(MBIM_CID_DEVICE_CAPS, MBIM_CID_CMD_TYPE_QUERY, NULL, 0);
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    if (le32toh(pCmdDone->InformationBufferLength)) {
+         MBIM_DEVICE_CAPS_INFO_T *pInfo = (MBIM_DEVICE_CAPS_INFO_T *)pCmdDone->InformationBuffer;
+         char tmp[32];
+
+         if (le32toh(pInfo->DeviceIdOffset) && le32toh(pInfo->DeviceIdSize)) {
+            wchar2char((const char *)pInfo + le32toh(pInfo->DeviceIdOffset), le32toh(pInfo->DeviceIdSize), tmp, sizeof(tmp));
+            mbim_debug("DeviceId:     %s", tmp);
+         }
+         if (le32toh(pInfo->FirmwareInfoOffset) && le32toh(pInfo->FirmwareInfoSize)) {
+            wchar2char((const char *)pInfo + le32toh(pInfo->FirmwareInfoOffset), le32toh(pInfo->FirmwareInfoSize), tmp, sizeof(tmp));
+            strncpy(profile->BaseBandVersion, tmp, sizeof(profile->BaseBandVersion));
+            mbim_debug("FirmwareInfo: %s", tmp);
+         }
+         if (le32toh(pInfo->HardwareInfoOffset) && le32toh(pInfo->HardwareInfoSize)) {
+            wchar2char((const char *)pInfo + le32toh(pInfo->HardwareInfoOffset), le32toh(pInfo->HardwareInfoSize), tmp, sizeof(tmp));
+            mbim_debug("HardwareInfo: %s", tmp);
+         }
+    }
+    mbim_free(pRequest); mbim_free(pCmdDone);
+    return err;
+}
+
+#if 0
+static int mbim_radio_state_query(void) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    int err;
+
+    mbim_debug("%s()", __func__);
+    pRequest = compose_basic_connect_command(MBIM_CID_RADIO_STATE, MBIM_CID_CMD_TYPE_QUERY, NULL, 0);
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    if (pCmdDone->InformationBufferLength) {
+         MBIM_RADIO_STATE_INFO_T *pInfo = (MBIM_RADIO_STATE_INFO_T *)pCmdDone->InformationBuffer;
+        mbim_debug("HwRadioState: %d, SwRadioState: %d", pInfo->HwRadioState, pInfo->SwRadioState);
+    }
+    mbim_free(pRequest); mbim_free(pCmdDone);
+    return err;
+}
+#endif
+
+static int mbim_set_radio_state(MBIM_RADIO_SWITCH_STATE_E RadioState) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    UINT32 value = htole32(RadioState);
+    int err;
+
+    mbim_debug("%s( %d )", __func__, RadioState);
+    pRequest = compose_basic_connect_command(MBIM_CID_RADIO_STATE, MBIM_CID_CMD_TYPE_SET, &value, sizeof(value));
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    if (le32toh(pCmdDone->InformationBufferLength)) {
+         MBIM_RADIO_STATE_INFO_T *pInfo = (MBIM_RADIO_STATE_INFO_T *)pCmdDone->InformationBuffer;
+        mbim_debug("HwRadioState: %d, SwRadioState: %d", le32toh(pInfo->HwRadioState), le32toh(pInfo->SwRadioState));
+    }
+    mbim_free(pRequest); mbim_free(pCmdDone);
+    return err;
+}
+
+static int mbim_subscriber_status_query(void) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    int err;
+
+    mbim_debug("%s()", __func__);
+    pRequest = compose_basic_connect_command(MBIM_CID_SUBSCRIBER_READY_STATUS, MBIM_CID_CMD_TYPE_QUERY, NULL, 0);
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    if (le32toh(pCmdDone->InformationBufferLength)) {
+         MBIM_SUBSCRIBER_READY_STATUS_T *pInfo = (MBIM_SUBSCRIBER_READY_STATUS_T *)pCmdDone->InformationBuffer;
+         char tmp[32];
+
+        wchar2char((const char *)pInfo + le32toh(pInfo->SubscriberIdOffset), le32toh(pInfo->SubscriberIdSize), tmp, sizeof(tmp));
+        mbim_debug("SubscriberId: %s", tmp);
+        wchar2char((const char *)pInfo + le32toh(pInfo->SimIccIdOffset), le32toh(pInfo->SimIccIdSize), tmp, sizeof(tmp));
+        mbim_debug("SimIccId:     %s", tmp);
+        ReadyState = le32toh(pInfo->ReadyState);
+        mbim_update_state();
+    }
+    mbim_free(pRequest); mbim_free(pCmdDone);
+    return err;
+}
+
+static int mbim_register_state_query(void) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    int err;
+
+    mbim_debug("%s()", __func__);
+    pRequest = compose_basic_connect_command(MBIM_CID_REGISTER_STATE, MBIM_CID_CMD_TYPE_QUERY, NULL, 0);
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    if (le32toh(pCmdDone->InformationBufferLength)) {
+        MBIM_REGISTRATION_STATE_INFO_T *pInfo = (MBIM_REGISTRATION_STATE_INFO_T *)pCmdDone->InformationBuffer;;
+        RegisterState = le32toh(pInfo->RegisterState);
+        mbim_update_state();
+    }
+    mbim_free(pRequest); mbim_free(pCmdDone);
+    return err;
+}
+
+static int mbim_packet_service_query(void) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    int err;
+
+    mbim_debug("%s()", __func__);
+    pRequest = compose_basic_connect_command(MBIM_CID_PACKET_SERVICE, MBIM_CID_CMD_TYPE_QUERY, NULL, 0);
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    if (le32toh(pCmdDone->InformationBufferLength)) {
+        MBIM_PACKET_SERVICE_INFO_T *pInfo = (MBIM_PACKET_SERVICE_INFO_T *)pCmdDone->InformationBuffer;
+        PacketServiceState = le32toh(pInfo->PacketServiceState);
+        mbim_update_state();
+
+        if (le32toh(pCmdDone->InformationBufferLength) == sizeof(MBIM_PACKET_SERVICE_INFO_V2_T)) {
+            MBIM_PACKET_SERVICE_INFO_V2_T *pInfo = (MBIM_PACKET_SERVICE_INFO_V2_T *)pCmdDone->InformationBuffer;
+            mbim_debug("CurrentDataClass = %s", MBIMDataClassStr(le32toh(pInfo->CurrentDataClass)));
+        }
+    }
+    mbim_free(pRequest); mbim_free(pCmdDone);
+    return err;
+}
+
+static int mbim_packet_service_set(MBIM_PACKET_SERVICE_ACTION_E action) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    UINT32 value = htole32(action);
+    int err;
+
+    mbim_debug("%s()", __func__);
+    pRequest = compose_basic_connect_command(MBIM_CID_PACKET_SERVICE, MBIM_CID_CMD_TYPE_SET, &value, sizeof(value));
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    if (le32toh(pCmdDone->InformationBufferLength)) {
+        MBIM_PACKET_SERVICE_INFO_T *pInfo = (MBIM_PACKET_SERVICE_INFO_T *)pCmdDone->InformationBuffer;
+        PacketServiceState = le32toh(pInfo->PacketServiceState);
+        mbim_update_state();
+    }
+    mbim_free(pRequest); mbim_free(pCmdDone);
+    return err;
+}
+
+#define _align_32(len) {len += (len % 4) ? (4 - (len % 4)) : 0;}
+static int mbim_populate_connect_data(MBIM_SET_CONNECT_T **connect_req_ptr) {
+    int offset;
+    int buflen = 0;
+
+    if (mbim_apn && strlen(mbim_apn) > 0) buflen += 2*strlen(mbim_apn) ;
+    _align_32(buflen);
+    if (mbim_user && strlen(mbim_user) > 0) buflen += 2*strlen(mbim_user);
+    _align_32(buflen);
+    if (mbim_pd && strlen(mbim_pd) > 0) buflen += 2*strlen(mbim_pd);
+    _align_32(buflen);
+
+    *connect_req_ptr = (MBIM_SET_CONNECT_T*)malloc(sizeof(MBIM_SET_CONNECT_T) + buflen);
+    if (! *connect_req_ptr) {
+        mbim_debug("not enough memory\n");
+        return -1;
+    }
+    memset(*connect_req_ptr, 0, sizeof(MBIM_SET_CONNECT_T) + buflen);
+
+    offset = 0;
+    if (mbim_apn && strlen(mbim_apn) > 0) {
+        (*connect_req_ptr)->AccessStringSize = htole32(2*strlen(mbim_apn));
+        (*connect_req_ptr)->AccessStringOffset = htole32(offset + sizeof(MBIM_SET_CONNECT_T));
+        offset = char2wchar(mbim_apn, strlen(mbim_apn), &(*connect_req_ptr)->DataBuffer[offset], buflen - offset);
+        _align_32(offset);
+    }
+
+    if (mbim_user && strlen(mbim_user) > 0) {
+        (*connect_req_ptr)->UserNameSize = htole32(2*strlen(mbim_user));
+        (*connect_req_ptr)->UserNameOffset = htole32(offset + sizeof(MBIM_SET_CONNECT_T));
+        offset = char2wchar(mbim_user, strlen(mbim_user), &(*connect_req_ptr)->DataBuffer[offset], buflen - offset);
+        _align_32(offset);
+    }
+
+    if (mbim_pd && strlen(mbim_pd) > 0) {
+        (*connect_req_ptr)->PasswordSize = htole32(2*strlen(mbim_pd));
+        (*connect_req_ptr)->PasswordOffset = htole32(offset + sizeof(MBIM_SET_CONNECT_T));
+        offset = char2wchar(mbim_pd, strlen(mbim_pd), &(*connect_req_ptr)->DataBuffer[offset], buflen - offset);
+    }
+
+    return buflen;
+}
+
+static int mbim_set_connect(int onoff, int sessionID) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    MBIM_SET_CONNECT_T *set_connect = NULL;
+    int err;
+
+    mbim_debug("%s(onoff=%d, sessionID=%d)", __func__, onoff, sessionID);
+    /* alloc memory then populate APN USERNAME PASSWORD */
+    int buflen = mbim_populate_connect_data(&set_connect);
+    if (buflen < 0) {
+        return ENOMEM;
+     }
+
+    set_connect->SessionId = htole32(sessionID);
+    if (onoff == 0)
+        set_connect->ActivationCommand = htole32(MBIMActivationCommandDeactivate);
+    else
+        set_connect->ActivationCommand = htole32(MBIMActivationCommandActivate);
+
+    set_connect->Compression = htole32(MBIMCompressionNone);
+    set_connect->AuthProtocol = htole32(mbim_auth);
+    set_connect->IPType = htole32(mbim_iptype);
+    memcpy(set_connect->ContextType.uuid, str2uuid(UUID_MBIMContextTypeInternet), 16);
+
+    pRequest = compose_basic_connect_command(MBIM_CID_CONNECT, MBIM_CID_CMD_TYPE_SET, set_connect, sizeof(MBIM_SET_CONNECT_T) + buflen);
+    mbim_free(set_connect);
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout*10);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    if (le32toh(pCmdDone->InformationBufferLength)) {
+        MBIM_CONNECT_T *pInfo = (MBIM_CONNECT_T *)pCmdDone->InformationBuffer;
+        ActivationState = le32toh(pInfo->ActivationState);
+        mbim_update_state();
+    }
+
+    mbim_free(pRequest); mbim_free(pCmdDone);
+    return err;
+}
+
+static int mbim_ip_config(PROFILE_T *profile, int sessionID) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    MBIM_IP_CONFIGURATION_INFO_T ip_info;
+    int err;
+
+    if (profile->ipv4.Address == 0 || mbim_verbose)
+        mbim_debug("%s(sessionID=%d)", __func__, sessionID);
+    ip_info.SessionId = htole32(sessionID);
+    pRequest = compose_basic_connect_command(MBIM_CID_IP_CONFIGURATION, MBIM_CID_CMD_TYPE_QUERY, &ip_info, sizeof(ip_info));
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    if (le32toh(pCmdDone->InformationBufferLength)) {
+        UINT8 prefix, *ipv4=NULL, *ipv6=NULL, *gw=NULL, *dns1=NULL, *dns2=NULL;
+        UINT32 mtu = 1500;
+        MBIM_IP_CONFIGURATION_INFO_T *pInfo = (MBIM_IP_CONFIGURATION_INFO_T *)pCmdDone->InformationBuffer;
+
+        /* IPv4 network configration */
+        if (le32toh(pInfo->IPv4ConfigurationAvailable)&0x1) {
+            MBIM_IPV4_ELEMENT_T *pAddress = (MBIM_IPV4_ELEMENT_T *)(&pInfo->DataBuffer[le32toh(pInfo->IPv4AddressOffset)-sizeof(MBIM_IP_CONFIGURATION_INFO_T)]);
+            prefix = le32toh(pAddress->OnLinkPrefixLength);
+            ipv4 = pAddress->IPv4Address;
+
+            if (le32toh(pInfo->IPv4ConfigurationAvailable)&0x2)
+                gw = (UINT8 *)(&pInfo->DataBuffer[le32toh(pInfo->IPv4GatewayOffset)-sizeof(MBIM_IP_CONFIGURATION_INFO_T)]);
+
+            if (le32toh(pInfo->IPv4ConfigurationAvailable)&0x4) {
+                dns1 = (UINT8 *)(&pInfo->DataBuffer[le32toh(pInfo->IPv4DnsServerOffset)-sizeof(MBIM_IP_CONFIGURATION_INFO_T)]);
+                if (le32toh(pInfo->IPv4DnsServerCount) == 2)
+                    dns2 = dns1 + 4;
+            }
+
+            if (le32toh(pInfo->IPv4ConfigurationAvailable)&0x8)
+                mtu =  le32toh(pInfo->IPv4Mtu);
+
+            if (profile->ipv4.Address != mbim2qmi_ipv4addr(*(uint32_t *)ipv4) || mbim_verbose) {
+                mbim_dump_ipconfig(pInfo, "<");
+                profile->ipv4.Address = mbim2qmi_ipv4addr(*(uint32_t *)ipv4);
+            }
+
+			if(gw != NULL)
+            	profile->ipv4.Gateway = mbim2qmi_ipv4addr(*(uint32_t *)gw);
+            profile->ipv4.SubnetMask = mbim2qmi_ipv4addr(0xFFFFFFFF>>(32-prefix)<<(32-prefix));
+			if(dns1 != NULL)
+            	profile->ipv4.DnsPrimary = mbim2qmi_ipv4addr(*(uint32_t *)dns1);
+			if(dns2 != NULL)
+            	profile->ipv4.DnsSecondary = mbim2qmi_ipv4addr(*(uint32_t *)dns2);
+            profile->ipv4.Mtu = mbim2qmi_ipv4addr(mtu);
+        }
+
+        /* IPv6 network configration */
+        if (le32toh(pInfo->IPv6ConfigurationAvailable)&0x1) {
+			gw = NULL; dns1 = NULL; dns2 = NULL;
+            MBIM_IPV6_ELEMENT_T *pAddress = (MBIM_IPV6_ELEMENT_T *)(&pInfo->DataBuffer[le32toh(pInfo->IPv6AddressOffset)-sizeof(MBIM_IP_CONFIGURATION_INFO_T)]);
+            prefix = le32toh(pAddress->OnLinkPrefixLength);
+            ipv6 = pAddress->IPv6Address;
+
+            if (le32toh(pInfo->IPv6ConfigurationAvailable)&0x2)
+                gw = (UINT8 *)(&pInfo->DataBuffer[le32toh(pInfo->IPv6GatewayOffset)-sizeof(MBIM_IP_CONFIGURATION_INFO_T)]);
+
+            if (le32toh(pInfo->IPv6ConfigurationAvailable)&0x4) {
+                dns1 = (UINT8 *)(&pInfo->DataBuffer[le32toh(pInfo->IPv6DnsServerOffset)-sizeof(MBIM_IP_CONFIGURATION_INFO_T)]);
+                if (le32toh(pInfo->IPv6DnsServerCount) == 2)
+                    dns2 = dns1 + 16;
+            }
+
+            if (le32toh(pInfo->IPv6ConfigurationAvailable)&0x8)
+                mtu =  le32toh(pInfo->IPv6Mtu);
+
+            if(ipv6 != NULL)
+            	mbim2qmi_ipv6addr(ipv6, profile->ipv6.Address);
+			if(gw != NULL)
+            	mbim2qmi_ipv6addr(gw, profile->ipv6.Gateway);
+			if(dns1 != NULL)
+            	mbim2qmi_ipv6addr(dns1, profile->ipv6.DnsPrimary);
+			if(dns2 != NULL)
+            	mbim2qmi_ipv6addr(dns2, profile->ipv6.DnsSecondary);
+            profile->ipv6.PrefixLengthIPAddr = prefix;
+            profile->ipv6.PrefixLengthGateway = prefix;
+            profile->ipv6.Mtu = mbim2qmi_ipv4addr(mtu);
+        }
+    }
+    return err;
+}
+
+int mbim_proxy_configure(const char *dev) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    MBIM_LIBQMI_PROXY_CONFIG_T *cfg;
+    int err;
+
+    pRequest = compose_basic_connect_command(
+                                                    MBIM_CID_PROXY_CONTROL_CONFIGURATION,
+                                                    MBIM_CID_CMD_TYPE_SET,
+                                                    NULL,
+                                                    sizeof(*cfg) + strlen(dev)*2);
+    if (pRequest) {
+        memcpy(((MBIM_COMMAND_MSG_T *)pRequest)->DeviceServiceId.uuid, str2uuid(UUID_LIBMBIM_PROXY), 16);
+        cfg = (MBIM_LIBQMI_PROXY_CONFIG_T *)((MBIM_COMMAND_MSG_T *)pRequest)->InformationBuffer;
+
+        cfg->DevicePathOffset = sizeof(*cfg);
+        cfg->DevicePathSize = char2wchar(dev, strlen(dev), cfg->DataBuffer, strlen(dev)*2);
+        cfg->Timeout = 15;
+    }
+
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    mbim_free(pRequest); mbim_free(pCmdDone);
+    return err;
+}
+
+static int mbim_update_state(void) {
+    int chages = 0;
+
+    if (oldReadyState != ReadyState) {
+        mbim_debug("SubscriberReadyState %s -> %s ", MBIMSubscriberReadyStateStr(oldReadyState), MBIMSubscriberReadyStateStr(ReadyState));
+        oldReadyState = ReadyState; chages++;
+    }
+    if (oldRegisterState != RegisterState) {
+        mbim_debug("RegisterState %s -> %s ", MBIMRegisterStateStr(oldRegisterState), MBIMRegisterStateStr(RegisterState));
+        oldRegisterState = RegisterState; chages++;
+    }
+    if (oldPacketServiceState != PacketServiceState) {
+        mbim_debug("PacketServiceState %s -> %s ", MBIMPacketServiceStateStr(oldPacketServiceState), MBIMPacketServiceStateStr(PacketServiceState));
+        oldPacketServiceState = PacketServiceState; chages++;
+    }
+    if (oldActivationState != ActivationState) {
+        mbim_debug("ActivationState %s -> %s ", MBIMActivationStateStr(oldActivationState), MBIMActivationStateStr(ActivationState));
+        oldActivationState = ActivationState; chages++;
+    }
+
+    return chages;
+}
+
+static int mbim_init(PROFILE_T *profile) {
+    int retval;
+    int t = 0;
+
+    if (profile->proxy[0] && !strcmp(profile->proxy, LIBMBIM_PROXY)) {
+        retval = mbim_proxy_configure(profile->qmichannel);
+        if (retval) goto exit;
+    }
+
+    while (t++ < 10) {
+        retval = mbim_open_device(4096);
+        if (retval != ETIMEDOUT)
+            break;
+    }
+    if (retval) goto exit;
+    retval = mbim_device_caps_query(profile);
+    if (retval) goto exit;
+    mbim_update_state();
+    retval = mbim_device_services_query();
+    if (retval) goto exit;
+    mbim_update_state();
+    retval = mbim_set_radio_state(MBIMRadioOn);
+    if (retval) goto exit;
+    mbim_update_state();
+
+    if (qmi_over_mbim_support) {
+        if (!socketpair( AF_LOCAL, SOCK_STREAM, 0, qmi_over_mbim_sk)) {
+            qmidev_send = qmi_over_mbim_qmidev_send;
+#ifdef CONFIG_CELLINFO //by now, only this function need QMI OVER MBIM
+            qmi_over_mbim_nas = qmi_over_mbim_get_client_id(QMUX_TYPE_NAS);
+#endif
+        }
+    }
+
+    return 0;
+
+exit:
+    return retval;
+}
+
+static int mbim_deinit(void) {
+    if (qmi_over_mbim_nas) {
+        qmi_over_mbim_release_client_id(QMUX_TYPE_NAS, qmi_over_mbim_nas);
+        qmi_over_mbim_nas = 0;
+    }
+    
+    mbim_close_device();
+
+    if (qmi_over_mbim_sk[0] != -1) {
+        close(qmi_over_mbim_sk[0]);
+        close(qmi_over_mbim_sk[1]);
+    }
+
+    return 0;
+}
+
+const struct qmi_device_ops mbim_dev_ops = {
+    .init = mbim_init,
+    .deinit = mbim_deinit,
+    .read = mbim_read_thread,
+};
+
+static int requestBaseBandVersion(PROFILE_T *profile) {
+    (void)profile;
+    return 0;
+}
+
+static int requestGetSIMStatus(SIM_Status *pSIMStatus)
+{
+    int retval;
+
+    *pSIMStatus = SIM_ABSENT;
+    retval = mbim_subscriber_status_query();
+    if (retval)
+        goto exit;
+    mbim_update_state();
+
+     switch(ReadyState) {
+        case MBIMSubscriberReadyStateNotInitialized: *pSIMStatus = SIM_NOT_READY; break;
+        case MBIMSubscriberReadyStateInitialized: *pSIMStatus = SIM_READY; break;
+        case MBIMSubscriberReadyStateSimNotInserted: *pSIMStatus = SIM_ABSENT; break;
+        case MBIMSubscriberReadyStateBadSim: *pSIMStatus = SIM_BAD; break;
+        case MBIMSubscriberReadyStateFailure: *pSIMStatus = SIM_ABSENT; break;
+        case MBIMSubscriberReadyStateNotActivated: *pSIMStatus = SIM_ABSENT; break;
+        case MBIMSubscriberReadyStateDeviceLocked: *pSIMStatus = SIM_PIN; break;
+        default: *pSIMStatus = SIM_ABSENT; break;
+    }
+
+exit:
+    return retval;
+}
+
+static int requestRegistrationState(UCHAR *pPSAttachedState) {
+    int retval;
+
+    *pPSAttachedState = 0;
+    retval = mbim_register_state_query();
+    if (retval)
+        goto exit;
+    mbim_update_state();
+
+    switch (RegisterState) {
+        case MBIMRegisterStateUnknown: *pPSAttachedState = 0; break;
+        case MBIMRegisterStateDeregistered: *pPSAttachedState = 0; break;
+        case MBIMRegisterStateSearching: *pPSAttachedState = 0; break;
+        case MBIMRegisterStateHome: *pPSAttachedState = 1; break;
+        case MBIMRegisterStateRoaming: *pPSAttachedState = 1; break;
+        case MBIMRegisterStatePartner: *pPSAttachedState = 0; break;
+        case MBIMRegisterStateDenied: *pPSAttachedState = 0; break;
+        default: *pPSAttachedState = 0; break;
+    }
+
+    if (*pPSAttachedState == 0)
+        goto exit;
+
+    retval =  mbim_packet_service_query();
+    if (retval)
+        goto exit;
+
+    switch (PacketServiceState) {
+        case MBIMPacketServiceStateUnknown: *pPSAttachedState = 0; break;
+        case MBIMPacketServiceStateAttaching: *pPSAttachedState = 0; break;
+        case MBIMPacketServiceStateAttached: *pPSAttachedState = 1; break;
+        case MBIMPacketServiceStateDetaching: *pPSAttachedState = 0; break;
+        case MBIMPacketServiceStateDetached: *pPSAttachedState = 0; break;
+        default: *pPSAttachedState = 0; break;
+    }
+
+    if (*pPSAttachedState == 0)
+        mbim_packet_service_set(MBIMPacketServiceActionAttach);
+
+exit:
+    return retval;
+}
+
+static int requestSetupDataCall(PROFILE_T *profile, int curIpFamily) {
+    int retval;
+
+    (void)curIpFamily;
+
+    if (profile->apn)
+        mbim_apn = profile->apn;
+    if (profile->user)
+        mbim_user = profile->user;
+    if (profile->pd)
+        mbim_pd = profile->pd;
+    if (profile->auth)
+        mbim_auth = profile->auth;
+    if (profile->enable_ipv4)
+        mbim_iptype = MBIMContextIPTypeIPv4;
+    if (profile->enable_ipv6)
+        mbim_iptype = MBIMContextIPTypeIPv6;
+    if (profile->enable_ipv4 && profile->enable_ipv6)
+        mbim_iptype = MBIMContextIPTypeIPv4AndIPv6;
+
+    retval = mbim_set_connect(1, mbim_sessionID);
+    if (retval)
+        goto exit;
+
+exit:
+    return retval;
+}
+
+static int requestQueryDataCall(UCHAR  *pConnectionStatus, int curIpFamily) {
+    int retval;
+
+    (void)curIpFamily;
+
+    *pConnectionStatus = QWDS_PKT_DATA_DISCONNECTED;
+
+    retval = mbim_query_connect(mbim_sessionID);
+    if (retval)
+        goto exit;
+
+    switch(ActivationState) {
+        case MBIMActivationStateUnknown: *pConnectionStatus = QWDS_PKT_DATA_UNKNOW; break;
+        case MBIMActivationStateActivated: *pConnectionStatus = QWDS_PKT_DATA_CONNECTED; break;
+        case MBIMActivationStateActivating: *pConnectionStatus = QWDS_PKT_DATA_DISCONNECTED; break;
+        case MBIMActivationStateDeactivated: *pConnectionStatus = QWDS_PKT_DATA_DISCONNECTED; break;
+        case MBIMActivationStateDeactivating: *pConnectionStatus = QWDS_PKT_DATA_DISCONNECTED; break;
+        default: *pConnectionStatus = QWDS_PKT_DATA_DISCONNECTED; break;
+    }
+
+exit:
+    return retval;
+}
+
+static int requestDeactivateDefaultPDP(PROFILE_T *profile, int curIpFamily) {
+    int retval;
+    
+    (void)profile;
+    (void)curIpFamily;
+
+    retval = mbim_set_connect(0, mbim_sessionID);
+    if (retval)
+        goto exit;
+
+exit:
+    return retval;
+}
+
+static int requestGetIPAddress(PROFILE_T *profile, int curIpFamily) {
+    int retval;
+    
+    (void)curIpFamily;
+    retval = mbim_ip_config(profile, mbim_sessionID);
+    if (retval)
+        goto exit;
+
+exit:
+    return retval;
+}
+
+#ifdef CONFIG_CELLINFO
+static int requestGetCellInfoList(void) {
+    if (qmi_over_mbim_nas) {
+        if (qmi_request_ops.requestGetCellInfoList)
+            return qmi_request_ops.requestGetCellInfoList();
+    }
+
+    return 0;
+}
+#endif
+
+const struct request_ops mbim_request_ops = {
+    .requestBaseBandVersion = requestBaseBandVersion,
+    .requestGetSIMStatus = requestGetSIMStatus,
+    .requestRegistrationState = requestRegistrationState,
+    .requestSetupDataCall = requestSetupDataCall,
+    .requestQueryDataCall = requestQueryDataCall,
+    .requestDeactivateDefaultPDP = requestDeactivateDefaultPDP,
+    .requestGetIPAddress = requestGetIPAddress,
+#ifdef CONFIG_CELLINFO
+    .requestGetCellInfoList = requestGetCellInfoList,
+#endif
+};
+
+int qmi_over_mbim_qmidev_send(PQCQMIMSG pQMI) {
+    MBIM_MESSAGE_HEADER *pRequest = NULL;
+    MBIM_COMMAND_DONE_T *pCmdDone = NULL;
+    int err;
+    size_t len = le16toh(pQMI->QMIHdr.Length) + 1;
+
+    if (pQMI->QMIHdr.QMIType != QMUX_TYPE_CTL) {
+        if (pQMI->QMIHdr.QMIType == QMUX_TYPE_NAS)
+            pQMI->QMIHdr.ClientId = qmi_over_mbim_nas;
+
+        if (pQMI->QMIHdr.ClientId == 0) {
+            dbg_time("QMIType %d has no clientID", pQMI->QMIHdr.QMIType);
+            return -ENODEV;
+        }
+    }
+
+    pRequest = compose_qmi_over_mbim_command(1, MBIM_CID_CMD_TYPE_SET, pQMI, len);
+    err = mbim_send_command(pRequest, &pCmdDone, mbim_default_timeout);
+    mbim_check_err(err, pRequest, pCmdDone);
+
+    err = -1;
+    len = le32toh(pCmdDone->InformationBufferLength);
+    if (len) {
+        if (write(qmi_over_mbim_sk[0], pCmdDone->InformationBuffer, len) == (long)len) {
+            err = 0;
+        };
+    }
+
+    mbim_free(pRequest); mbim_free(pCmdDone);
+    return err;
+}
diff --git a/RM520N-5G/文件/source/qendian.h b/RM520N-5G/文件/source/qendian.h
new file mode 100644
index 0000000..0219ca0
--- /dev/null
+++ b/RM520N-5G/文件/source/qendian.h
@@ -0,0 +1,63 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#ifndef __QUECTEL_ENDIAN_H__
+#define __QUECTEL_ENDIAN_H__
+#include <endian.h>
+
+#ifndef htole32 
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+#define htole16(x) (uint16_t)(x)
+#define le16toh(x) (uint16_t)(x)
+#define letoh16(x) (uint16_t)(x)
+#define htole32(x) (uint32_t)(x)
+#define le32toh(x) (uint32_t)(x)
+#define letoh32(x) (uint32_t)(x)
+#define htole64(x) (uint64_t)(x)
+#define le64toh(x) (uint64_t)(x)
+#define letoh64(x) (uint64_t)(x)
+#else
+static __inline uint16_t __bswap16(uint16_t __x) {
+    return (__x<<8) | (__x>>8);
+}
+
+static __inline uint32_t __bswap32(uint32_t __x) {
+    return (__x>>24) | (__x>>8&0xff00) | (__x<<8&0xff0000) | (__x<<24);
+}
+
+static __inline uint64_t __bswap64(uint64_t __x) {
+    return (__bswap32(__x)+0ULL<<32) | (__bswap32(__x>>32));
+}
+
+#define htole16(x) __bswap16(x)
+#define le16toh(x) __bswap16(x)
+#define letoh16(x) __bswap16(x)
+#define htole32(x) __bswap32(x)
+#define le32toh(x) __bswap32(x)
+#define letoh32(x) __bswap32(x)
+#define htole64(x) __bswap64(x)
+#define le64toh(x) __bswap64(x)
+#define letoh64(x) __bswap64(x)
+#endif
+#endif
+
+#define le16_to_cpu(x) le16toh((uint16_t)(x))
+#define le32_to_cpu(x) le32toh((uint32_t)(x))
+#define le64_to_cpu(x) le64toh((uint64_t)(x))
+#define cpu_to_le16(x) htole16((uint16_t)(x))
+#define cpu_to_le32(x) htole32((uint32_t)(x))
+#define cpu_to_le64(x) htole64((uint64_t)(x))
+
+static __inline uint32_t ql_swap32(uint32_t __x) {
+    return (__x>>24) | (__x>>8&0xff00) | (__x<<8&0xff0000) | (__x<<24);
+}
+#endif //__QUECTEL_ENDIAN_H__
+
diff --git a/RM520N-5G/文件/source/qlist.h b/RM520N-5G/文件/source/qlist.h
new file mode 100644
index 0000000..891d50d
--- /dev/null
+++ b/RM520N-5G/文件/source/qlist.h
@@ -0,0 +1,49 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#ifndef __QUECTEL_LIST_H__
+#define __QUECTEL_LIST_H__
+struct qlistnode
+{
+    struct qlistnode *next;
+    struct qlistnode *prev;
+};
+
+#define qnode_to_item(node, container, member) \
+    (container *) (((char*) (node)) - offsetof(container, member))
+
+#define qlist_for_each(node, list) \
+    for (node = (list)->next; node != (list); node = node->next)
+
+#define qlist_empty(list) ((list) == (list)->next)
+#define qlist_head(list) ((list)->next)
+#define qlist_tail(list) ((list)->prev)
+
+static void qlist_init(struct qlistnode *node)
+{
+    node->next = node;
+    node->prev = node;
+}
+
+static void qlist_add_tail(struct qlistnode *head, struct qlistnode *item)
+{
+    item->next = head;
+    item->prev = head->prev;
+    head->prev->next = item;
+    head->prev = item;
+}
+
+static void qlist_remove(struct qlistnode *item)
+{
+    item->next->prev = item->prev;
+    item->prev->next = item->next;
+}
+#endif
\ No newline at end of file
diff --git a/RM520N-5G/文件/source/qmap_bridge_mode.c b/RM520N-5G/文件/source/qmap_bridge_mode.c
new file mode 100644
index 0000000..82cfa8a
--- /dev/null
+++ b/RM520N-5G/文件/source/qmap_bridge_mode.c
@@ -0,0 +1,455 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include "QMIThread.h"
+
+static size_t ql_fread(const char *filename, void *buf, size_t size) {
+    FILE *fp = fopen(filename , "r");
+    size_t n = 0;
+
+    memset(buf, 0x00, size);
+
+    if (fp) {
+        n = fread(buf, 1, size, fp);
+        if (n <= 0 || n == size) {
+            dbg_time("warnning: fail to fread(%s), fread=%zu, buf_size=%zu: (%s)", filename, n, size, strerror(errno));
+        }
+        fclose(fp);
+    }
+
+    return n > 0 ? n : 0;
+}
+
+static size_t ql_fwrite(const char *filename, const void *buf, size_t size) {
+    FILE *fp = fopen(filename , "w");
+    size_t n = 0;
+
+    if (fp) {
+        n = fwrite(buf, 1, size, fp);
+        if (n != size) {
+            dbg_time("warnning: fail to fwrite(%s), fwrite=%zu, buf_size=%zu: (%s)", filename, n, size, strerror(errno));
+        }
+        fclose(fp);
+    }
+
+    return n > 0 ? n : 0;
+}
+
+int ql_bridge_mode_detect(PROFILE_T *profile) {
+    const char *ifname = profile->qmapnet_adapter[0] ? profile->qmapnet_adapter : profile->usbnet_adapter;
+    const char *driver;
+    char bridge_mode[128];
+    char bridge_ipv4[128];
+    char ipv4[128];
+    char buf[64];
+    size_t n;
+    int in_bridge = 0;
+
+    driver = profile->driver_name;
+    snprintf(bridge_mode, sizeof(bridge_mode), "/sys/class/net/%s/bridge_mode", ifname);
+    snprintf(bridge_ipv4, sizeof(bridge_ipv4), "/sys/class/net/%s/bridge_ipv4", ifname);
+
+    if (access(bridge_ipv4, R_OK)) {
+        if (errno != ENOENT) {
+            dbg_time("fail to access %s, errno: %d (%s)", bridge_mode, errno, strerror(errno));
+            return 0;
+        }
+
+        snprintf(bridge_mode, sizeof(bridge_mode), "/sys/module/%s/parameters/bridge_mode", driver);
+        snprintf(bridge_ipv4, sizeof(bridge_ipv4), "/sys/module/%s/parameters/bridge_ipv4", driver);
+
+        if (access(bridge_mode, R_OK)) {
+            if (errno != ENOENT) {
+                dbg_time("fail to access %s, errno: %d (%s)", bridge_mode, errno, strerror(errno));
+            }
+            return 0;
+        }
+    }
+
+    n = ql_fread(bridge_mode, buf, sizeof(buf));
+    if (n > 0) {
+        in_bridge = (buf[0] != '0');
+    }
+    if (!in_bridge)
+        return 0;
+   
+    memset(ipv4, 0, sizeof(ipv4));
+
+    if (strstr(bridge_ipv4, "/sys/class/net/") || profile->qmap_mode == 0 || profile->qmap_mode == 1) {
+        snprintf(ipv4, sizeof(ipv4), "0x%x", profile->ipv4.Address);
+        dbg_time("echo '%s' > %s", ipv4, bridge_ipv4);
+        ql_fwrite(bridge_ipv4, ipv4, strlen(ipv4));
+    }
+    else {
+        snprintf(ipv4, sizeof(ipv4), "0x%x:%d", profile->ipv4.Address, profile->muxid);
+        dbg_time("echo '%s' > %s", ipv4, bridge_ipv4);
+        ql_fwrite(bridge_ipv4, ipv4, strlen(ipv4));
+    }
+
+    return in_bridge;
+}
+
+int ql_enable_qmi_wwan_rawip_mode(PROFILE_T *profile) {
+    char filename[256];
+    char buf[4];
+    size_t n;
+    FILE *fp;
+
+    if (!qmidev_is_qmiwwan(profile->qmichannel))
+        return 0;
+
+    snprintf(filename, sizeof(filename), "/sys/class/net/%s/qmi/rawip", profile->usbnet_adapter);
+    n = ql_fread(filename, buf, sizeof(buf));
+
+    if (n == 0)
+        return 0;
+
+    if (buf[0] == '1' || buf[0] == 'Y')
+        return 0;
+
+    fp = fopen(filename , "w");
+    if (fp == NULL) {
+        dbg_time("Fail to fopen(%s, \"w\"), errno: %d (%s)", filename, errno, strerror(errno));
+        return 1;
+    }
+
+    buf[0] = 'Y';
+    n = fwrite(buf, 1, 1, fp);
+    if (n != 1) {
+        dbg_time("Fail to fwrite(%s), errno: %d (%s)", filename, errno, strerror(errno));
+        fclose(fp);
+        return 1;
+    }
+    fclose(fp);
+
+    return 0;
+}
+
+int ql_driver_type_detect(PROFILE_T *profile) {
+    if (qmidev_is_gobinet(profile->qmichannel)) {
+        profile->qmi_ops = &gobi_qmidev_ops;
+    }
+    else {
+        profile->qmi_ops = &qmiwwan_qmidev_ops;
+    }
+    qmidev_send = profile->qmi_ops->send;
+
+    return 0;
+}
+
+static void ql_set_driver_bridge_mode(PROFILE_T *profile) {
+    char enable[16];
+    char filename[256];
+
+    if(profile->qmap_mode)
+        snprintf(filename, sizeof(filename), "/sys/class/net/%s/bridge_mode", profile->qmapnet_adapter);
+    else
+        snprintf(filename, sizeof(filename), "/sys/class/net/%s/bridge_mode", profile->usbnet_adapter);
+    snprintf(enable, sizeof(enable), "%02d\n", profile->enable_bridge);
+    ql_fwrite(filename, enable, sizeof(enable));
+}
+
+#ifdef CONFIG_QRTR
+static int ql_create_or_detect_rmnet_data(PROFILE_T *profile) {
+    char tmp[128];
+    int muxid = 0,  qmap_version = 0;
+
+    if (access("/sys/module/rmnet_data", F_OK) != 0 /* spf11.x */
+        && access("/sys/module/rmnet_core", F_OK) != 0 /* spf12.x */) {
+        dbg_time("rmnet_data/rmnet_core driver is not support!\n");
+        return -ENOENT;
+    }
+
+    snprintf(tmp, sizeof(tmp), "/sys/class/net/%s", profile->qmapnet_adapter);
+    if (access(tmp, F_OK) && errno == ENOENT) {
+        uint32_t ul_agg_cnt = 0, ul_agg_size = 0;
+
+        if (profile->hardware_interface == HARDWARE_USB) {
+            ul_agg_cnt = 11;
+            ul_agg_size = 4096; //sdx modem may only support 4096
+        }
+        rtrmnet_ctl_new_vnd(profile->usbnet_adapter, profile->qmapnet_adapter,
+              profile->muxid, profile->qmap_version, ul_agg_cnt, ul_agg_size);
+    }
+
+    if (access(tmp, F_OK) && errno == ENOENT) {
+         dbg_time("Fail to detect %s", profile->qmapnet_adapter);
+         return -1;
+    }
+
+    rtrmnet_ctl_get_vnd(profile->qmapnet_adapter, &muxid, &qmap_version);
+    if (qmap_version != profile->qmap_version || muxid != profile->muxid) {
+         dbg_time("wrong qmap_version: %d - %d, muxid: %d - %d",
+              qmap_version, profile->qmap_version, muxid, profile->muxid);
+         return -1;
+    }
+
+    return 0;
+}
+#endif
+
+static int ql_qmi_qmap_mode_detect(PROFILE_T *profile) {
+    char buf[128];
+    int n;
+    struct {
+        char filename[255 * 2];
+        char linkname[255 * 2];
+    } *pl;
+
+    pl = (typeof(pl)) malloc(sizeof(*pl));
+
+    snprintf(pl->linkname, sizeof(pl->linkname), "/sys/class/net/%s/device/driver", profile->usbnet_adapter);
+    n = readlink(pl->linkname, pl->filename, sizeof(pl->filename));
+    pl->filename[n] = '\0';
+    while (pl->filename[n] != '/')
+        n--;
+    strncpy(profile->driver_name, &pl->filename[n+1], sizeof(profile->driver_name) - 1);
+
+    ql_get_driver_rmnet_info(profile, &profile->rmnet_info);
+    if (profile->rmnet_info.size) {
+        profile->qmap_mode = profile->rmnet_info.qmap_mode;
+        if (profile->qmap_mode) {
+            int offset_id = (profile->muxid == 0)? profile->pdp - 1 : profile->muxid - 0x81;
+
+            if (profile->qmap_mode == 1)
+                offset_id = 0;
+            profile->muxid = profile->rmnet_info.mux_id[offset_id];
+            strncpy(profile->qmapnet_adapter, profile->rmnet_info.ifname[offset_id], sizeof(profile->qmapnet_adapter) - 1);
+            profile->qmap_size = profile->rmnet_info.rx_urb_size;
+            profile->qmap_version = profile->rmnet_info.qmap_version;
+        }
+
+#ifdef CONFIG_QRTR
+        if (!strcmp(profile->qmapnet_adapter, "use_rmnet_data")) {
+            snprintf(profile->qmapnet_adapter, sizeof(profile->qmapnet_adapter), "%.16s_%d",
+                            profile->usbnet_adapter, profile->pdp);
+             ql_create_or_detect_rmnet_data(profile);
+        }
+#endif
+
+        goto _out;
+    }
+
+    snprintf(pl->filename, sizeof(pl->filename), "/sys/class/net/%s/qmap_mode", profile->usbnet_adapter);
+    if (access(pl->filename, R_OK)) {
+        if (errno != ENOENT) {
+            dbg_time("fail to access %s, errno: %d (%s)", pl->filename, errno, strerror(errno));
+            goto _out;
+        }
+        
+        snprintf(pl->filename, sizeof(pl->filename), "/sys/module/%s/parameters/qmap_mode", profile->driver_name);
+        if (access(pl->filename, R_OK)) {
+            if (errno != ENOENT) {
+                dbg_time("fail to access %s, errno: %d (%s)", pl->filename, errno, strerror(errno));
+                goto _out;
+            }
+            
+            snprintf(pl->filename, sizeof(pl->filename), "/sys/class/net/%s/device/driver/module/parameters/qmap_mode", profile->usbnet_adapter);
+            if (access(pl->filename, R_OK)) {
+                if (errno != ENOENT) {
+                    dbg_time("fail to access %s, errno: %d (%s)", pl->filename, errno, strerror(errno));
+                    goto _out;
+                }
+            }
+        }
+    }
+
+    if (!access(pl->filename, R_OK)) {
+        n = ql_fread(pl->filename, buf, sizeof(buf));
+        if (n > 0) {
+            profile->qmap_mode = atoi(buf);
+            
+            if (profile->qmap_mode > 1) {
+                if(!profile->muxid)
+                     profile->muxid = profile->pdp + 0x80; //muxis is 0x8X for PDN-X
+                snprintf(profile->qmapnet_adapter, sizeof(profile->qmapnet_adapter),
+                    "%.16s.%d", profile->usbnet_adapter, profile->muxid - 0x80);
+           } if (profile->qmap_mode == 1) {
+                profile->muxid = 0x81;
+                strncpy(profile->qmapnet_adapter, profile->usbnet_adapter, sizeof(profile->qmapnet_adapter));
+           }
+        }
+    }
+    else if (qmidev_is_qmiwwan(profile->qmichannel)) {
+        snprintf(pl->filename, sizeof(pl->filename), "/sys/class/net/qmimux%d", profile->pdp - 1);
+        if (access(pl->filename, R_OK)) {
+            if (errno != ENOENT) {
+                dbg_time("fail to access %s, errno: %d (%s)", pl->filename, errno, strerror(errno));
+            }
+            goto _out;
+        }
+
+        //upstream Kernel Style QMAP qmi_wwan.c
+        snprintf(pl->filename, sizeof(pl->filename), "/sys/class/net/%s/qmi/add_mux", profile->usbnet_adapter);
+        n = ql_fread(pl->filename, buf, sizeof(buf));
+        if (n >= 5) {
+            dbg_time("If use QMAP by /sys/class/net/%s/qmi/add_mux", profile->usbnet_adapter);
+            #if 1
+            dbg_time("Please set mtu of wwan0 >= max dl qmap packet size");
+            #else
+            dbg_time("File:%s Line:%d Please make sure add next patch to qmi_wwan.c", __func__, __LINE__);
+            /*
+            diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+            index 74bebbd..db8a777 100644
+            --- a/drivers/net/usb/qmi_wwan.c
+            +++ b/drivers/net/usb/qmi_wwan.c
+            @@ -379,6 +379,24 @@ static ssize_t add_mux_store(struct device *d,  struct device_attribute *attr, c
+                if (!ret) {
+                        info->flags |= QMI_WWAN_FLAG_MUX;
+                        ret = len;
+            +#if 1 //Add by Quectel
+            +               if (le16_to_cpu(dev->udev->descriptor.idVendor) == 0x2c7c) {
+            +                       int idProduct = le16_to_cpu(dev->udev->descriptor.idProduct);
+            +
+            +                       if (idProduct == 0x0121 || idProduct == 0x0125 || idProduct == 0x0435) //MDM9x07
+            +                               dev->rx_urb_size = 4*1024;
+            +                       else if (idProduct == 0x0306) //MDM9x40
+            +                               dev->rx_urb_size = 16*1024;
+            +                       else if (idProduct == 0x0512) //SDX20
+            +                               dev->rx_urb_size = 32*1024;
+            +                       else if (idProduct == 0x0620) //SDX24
+            +                               dev->rx_urb_size = 32*1024;
+            +                       else if (idProduct == 0x0800) //SDX55
+            +                               dev->rx_urb_size = 32*1024;
+            +                       else
+            +                               dev->rx_urb_size = 32*1024;
+            +               }
+            +#endif
+                }
+            err:
+                rtnl_unlock();
+            */
+            #endif
+            profile->qmap_mode = n/5; //0x11\n0x22\n0x33\n
+            if (profile->qmap_mode > 1) {
+                //PDN-X map to qmimux-X
+                if(!profile->muxid) {
+                    profile->muxid = (buf[5*(profile->pdp - 1) + 2] - '0')*16 + (buf[5*(profile->pdp - 1) + 3] - '0');
+                    snprintf(profile->qmapnet_adapter, sizeof(profile->qmapnet_adapter), "qmimux%d", profile->pdp - 1);
+                } else {
+                    profile->muxid = (buf[5*(profile->muxid - 0x81) + 2] - '0')*16 + (buf[5*(profile->muxid - 0x81) + 3] - '0');
+                    snprintf(profile->qmapnet_adapter, sizeof(profile->qmapnet_adapter), "qmimux%d", profile->muxid - 0x81);
+                }
+            } else if (profile->qmap_mode == 1) {
+                profile->muxid = (buf[5*0 + 2] - '0')*16 + (buf[5*0 + 3] - '0');
+                snprintf(profile->qmapnet_adapter, sizeof(profile->qmapnet_adapter),
+                    "qmimux%d", 0);
+            }
+        }
+    } 
+
+_out:
+    if (profile->qmap_mode) {
+      if (profile->qmap_size == 0) {
+            profile->qmap_size = 16*1024;
+            snprintf(pl->filename, sizeof(pl->filename), "/sys/class/net/%s/qmap_size", profile->usbnet_adapter);
+            if (!access(pl->filename, R_OK)) {
+                size_t n;
+                char buf[32];
+                n = ql_fread(pl->filename, buf, sizeof(buf));
+                if (n > 0) {
+                    profile->qmap_size = atoi(buf);
+                }
+            }
+        }
+
+        if (profile->qmap_version == 0) {
+            profile->qmap_version = WDA_DL_DATA_AGG_QMAP_ENABLED;
+        }
+
+        dbg_time("qmap_mode = %d, qmap_version = %d, qmap_size = %d, muxid = 0x%02x, qmap_netcard = %s",
+            profile->qmap_mode, profile->qmap_version, profile->qmap_size, profile->muxid, profile->qmapnet_adapter);
+    }
+    ql_set_driver_bridge_mode(profile);
+    free(pl);
+
+    return 0;
+}
+
+static int ql_mbim_usb_vlan_mode_detect(PROFILE_T *profile) {
+    char tmp[128];
+
+    snprintf(tmp, sizeof(tmp), "/sys/class/net/%s.%d", profile->usbnet_adapter, profile->pdp);
+    if (!access(tmp, F_OK)) {
+        profile->qmap_mode = 4;
+        profile->muxid = profile->pdp;
+        no_trunc_strncpy(profile->qmapnet_adapter, tmp + strlen("/sys/class/net/"), sizeof(profile->qmapnet_adapter) - 1);
+
+        dbg_time("mbim_qmap_mode = %d, vlan_id = 0x%02x, qmap_netcard = %s",
+            profile->qmap_mode, profile->muxid, profile->qmapnet_adapter);
+    }
+
+    return 0;
+}
+
+static int ql_mbim_mhi_qmap_mode_detect(PROFILE_T *profile) {
+    ql_get_driver_rmnet_info(profile, &profile->rmnet_info);
+    if (profile->rmnet_info.size) {
+        profile->qmap_mode = profile->rmnet_info.qmap_mode;
+        if (profile->qmap_mode) {
+            int offset_id = profile->pdp - 1;
+
+            if (profile->qmap_mode == 1)
+                offset_id = 0;
+            profile->muxid = profile->pdp;
+            strcpy(profile->qmapnet_adapter, profile->rmnet_info.ifname[offset_id]);
+            profile->qmap_size = profile->rmnet_info.rx_urb_size;
+            profile->qmap_version = profile->rmnet_info.qmap_version;
+        
+            dbg_time("mbim_qmap_mode = %d, vlan_id = 0x%02x, qmap_netcard = %s",
+                profile->qmap_mode, profile->muxid, profile->qmapnet_adapter);
+        }
+
+        goto _out;
+    }
+    
+_out:
+    return 0;
+}
+
+int ql_qmap_mode_detect(PROFILE_T *profile) {
+    if (profile->software_interface == SOFTWARE_MBIM) {
+        if (profile->hardware_interface == HARDWARE_USB)
+            return ql_mbim_usb_vlan_mode_detect(profile);
+        else if (profile->hardware_interface == HARDWARE_PCIE)
+            return ql_mbim_mhi_qmap_mode_detect(profile);
+    } else if (profile->software_interface == SOFTWARE_QMI) {
+        return ql_qmi_qmap_mode_detect(profile);
+    }
+#ifdef CONFIG_QRTR
+    else if (profile->software_interface == SOFTWARE_QRTR) {
+            profile->qmap_mode = 1;
+            profile->qmap_version = WDA_DL_DATA_AGG_QMAP_V5_ENABLED;
+            profile->qmap_size = 15*1024;
+            profile->muxid = 0x80 | profile->pdp;
+
+            if (!strcmp(profile->driver_name, "mhi_netdev")) {
+                char linkname[64];
+                char filename[128];
+                int n;
+
+                snprintf(linkname, sizeof(linkname), "/sys/class/net/%s/device", profile->usbnet_adapter);
+                n = readlink(linkname, filename, sizeof(filename));
+                if (n > 0) {
+                    //../../../0308_00.01.00_IP_HW0
+                    filename[n] = '\0';
+                    if (strstr(filename, "_IP_HW0") && strstr(filename+n, "0303_")) //EG18
+                        profile->qmap_version = WDA_DL_DATA_AGG_QMAP_ENABLED;
+                }
+        }
+
+        snprintf(profile->qmapnet_adapter, sizeof(profile->qmapnet_adapter), "rmnet_data%d",
+                        profile->pdp);
+        return ql_create_or_detect_rmnet_data(profile);
+    }
+#endif
+    return 0;
+}
diff --git a/RM520N-5G/文件/source/qrtr.c b/RM520N-5G/文件/source/qrtr.c
new file mode 100644
index 0000000..26a7898
--- /dev/null
+++ b/RM520N-5G/文件/source/qrtr.c
@@ -0,0 +1,652 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <stdio.h>
+#include <string.h>
+#include <termios.h>
+#include <stdio.h>
+#include <ctype.h>
+#include "QMIThread.h"
+
+typedef struct {
+    uint32_t service;
+    uint32_t version;
+    uint32_t instance;
+    uint32_t node;
+    uint32_t port;
+} QrtrService;
+
+#define QRTR_MAX (QMUX_TYPE_WDS_ADMIN + 1)
+static QrtrService service_list[QRTR_MAX];
+static int qmiclientId[QRTR_MAX];
+static int get_client(UCHAR QMIType);
+static uint32_t node_modem = 3; //IPQ ~ 3, QCM ~ 0
+
+#ifdef USE_LINUX_MSM_IPC
+#include <linux/msm_ipc.h>
+
+struct xport_ipc_router_server_addr {
+        uint32_t service;
+        uint32_t instance;
+        uint32_t node_id;
+        uint32_t port_id;
+};
+
+union ctl_msg {
+        uint32_t cmd;
+                struct {
+                uint32_t cmd;
+                        uint32_t service;
+                        uint32_t instance;
+                uint32_t node_id;
+                uint32_t port_id;
+        } srv;
+                struct {
+                uint32_t cmd;
+                uint32_t node_id;
+                uint32_t port_id;
+        } cli;
+        };
+#define CTL_CMD_NEW_SERVER          4
+#define CTL_CMD_REMOVE_SERVER       5
+
+#define VERSION_MASK 0xff
+#define GET_VERSION(x) (x & 0xff)
+#define GET_XPORT_SVC_INSTANCE(x) GET_VERSION(x)
+#define GET_INSTANCE(x) ((x & 0xff00) >> 8)
+
+static int msm_ipc_socket(const char *name)
+{
+    int sock;
+    int flags;
+
+    sock = socket(AF_MSM_IPC, SOCK_DGRAM, 0);
+    if (sock < 0) {
+        dbg_time("%s(%s) errno: %d (%s)\n", __func__, name, errno, strerror(errno));
+        return -1;
+    }
+
+    fcntl(sock, F_SETFD, FD_CLOEXEC);
+    flags = fcntl(sock, F_GETFL, 0);
+    fcntl(sock, F_SETFL, flags | O_NONBLOCK);
+
+    return sock;
+}
+
+static uint32_t xport_lookup
+(
+ int lookup_sock_fd,
+ uint32_t service_id,
+ uint32_t version
+)
+{
+  uint32_t num_servers_found = 0;
+  uint32_t num_entries_to_fill = 4;
+  struct server_lookup_args *lookup_arg;
+  int i;
+
+  lookup_arg = (struct server_lookup_args *)malloc(sizeof(*lookup_arg)
+      + (num_entries_to_fill * sizeof(struct msm_ipc_server_info)));
+  if (!lookup_arg)
+  {
+    dbg_time("%s: Malloc failed\n", __func__);
+    return 0;
+  }
+
+  lookup_arg->port_name.service = service_id;
+  lookup_arg->port_name.instance = GET_XPORT_SVC_INSTANCE(version);
+  lookup_arg->num_entries_in_array = num_entries_to_fill;
+  lookup_arg->lookup_mask =  VERSION_MASK;
+  lookup_arg->num_entries_found = 0;
+  if (ioctl(lookup_sock_fd, IPC_ROUTER_IOCTL_LOOKUP_SERVER, lookup_arg) < 0)
+  {
+    dbg_time("%s: Lookup failed for %08x: %08x\n", __func__, service_id, version);
+    free(lookup_arg);
+    return 0;
+  }
+
+  dbg_time("%s: num_entries_found %d for type=%d instance=%d", __func__,
+    lookup_arg->num_entries_found, service_id, version);
+  num_servers_found = 0;
+  for (i = 0; ((i < (int)num_entries_to_fill) && (i < lookup_arg->num_entries_found)); i++)
+  {
+     QrtrService service_info[1];
+
+    if (lookup_arg->srv_info[i].node_id != node_modem)
+        continue;
+    num_servers_found++;
+
+    service_info[0].service = lookup_arg->srv_info[i].service;
+    service_info[0].version = GET_VERSION(lookup_arg->srv_info[i].instance);
+    service_info[0].instance = GET_INSTANCE(lookup_arg->srv_info[i].instance);
+    service_info[0].node = lookup_arg->srv_info[i].node_id;
+    service_info[0].port = lookup_arg->srv_info[i].port_id;
+
+    service_list[service_id] = service_info[0];
+    qmiclientId[service_id] = get_client(service_id);
+  }
+
+  free(lookup_arg);
+  return num_servers_found;
+}
+
+static int xport_send(int sock, uint32_t node, uint32_t port, const void *data, unsigned int sz)
+{
+    struct sockaddr_msm_ipc addr = {};
+    int rc;
+
+    addr.family = AF_MSM_IPC;
+    addr.address.addrtype = MSM_IPC_ADDR_ID;
+    addr.address.addr.port_addr.node_id = node;
+    addr.address.addr.port_addr.port_id = port;
+
+    rc = sendto(sock, data, sz, MSG_DONTWAIT, (void *)&addr, sizeof(addr));
+    if (rc < 0) {
+        dbg_time("xport_send errno: %d (%s)\n", errno, strerror(errno));
+        return -1;
+    }
+
+    return 0;
+}
+
+static int xport_recv(int sock, void *data, unsigned int sz, uint32_t *node, uint32_t *port)
+{
+    struct sockaddr_msm_ipc addr = {};
+    socklen_t addr_size = sizeof(struct sockaddr_msm_ipc);
+    int rc;
+
+    rc = recvfrom(sock, data, sz, MSG_DONTWAIT, (void *)&addr, &addr_size);
+    if (rc < 0) {
+        dbg_time("xport_recv errno: %d (%s)\n", errno, strerror(errno));
+    }
+    else if (addr.address.addrtype != MSM_IPC_ADDR_ID) {
+        dbg_time("xport_recv addrtype is NOT MSM_IPC_ADDR_ID\n");
+        rc = -1;
+    }
+
+    *node = addr.address.addr.port_addr.node_id;
+    *port = addr.address.addr.port_addr.port_id;
+    return rc;
+}
+#define qmi_recv xport_recv
+
+static int xport_ctrl_init(void)
+{
+    int ctrl_sock;
+    int rc;
+    uint32_t instance = 1; //modem
+    uint32_t version;
+
+    ctrl_sock = msm_ipc_socket("ctrl_port");
+    if (ctrl_sock == -1)
+        return -1;
+
+    rc = ioctl(ctrl_sock, IPC_ROUTER_IOCTL_GET_VERSION, &version);
+    if (rc < 0) {
+        dbg_time("%s: failed to get ipc version\n", __func__);
+        goto init_close_ctrl_fd;
+    }
+    dbg_time("%s ipc_version = %d", __func__, version);
+
+    rc = ioctl(ctrl_sock, IPC_ROUTER_IOCTL_BIND_CONTROL_PORT, NULL);
+    if (rc < 0) {
+        dbg_time("%s: failed to bind as control port\n", __func__);
+        goto init_close_ctrl_fd;
+    }
+
+    //cat /sys/kernel/debug/msm_ipc_router/dump_servers
+    rc = 0;
+    rc += xport_lookup(ctrl_sock, QMUX_TYPE_WDS, instance);
+    if (service_list[QMUX_TYPE_WDS].port) {
+        qmiclientId[QMUX_TYPE_WDS_IPV6] = get_client(QMUX_TYPE_WDS);
+    }
+    rc += xport_lookup(ctrl_sock, QMUX_TYPE_NAS, instance);
+    rc += xport_lookup(ctrl_sock, QMUX_TYPE_UIM, instance);
+    rc += xport_lookup(ctrl_sock, QMUX_TYPE_DMS, instance);
+    rc += xport_lookup(ctrl_sock, QMUX_TYPE_WDS_ADMIN, instance);
+
+    if (rc == 0) {
+        dbg_time("%s: failed to lookup qmi service\n", __func__);
+        goto init_close_ctrl_fd;
+    }
+
+    return ctrl_sock;
+
+init_close_ctrl_fd:
+    close(ctrl_sock);
+    return -1;
+}
+
+static void handle_ctrl_pkt(int sock) {
+    union ctl_msg pkt;
+    uint32_t type;
+    int rc;
+
+    rc = recvfrom(sock, &pkt, sizeof(pkt), 0, NULL, NULL);
+    if (rc < 0)
+        return;
+
+    type = le32toh(pkt.cmd);
+    if (CTL_CMD_NEW_SERVER == type || CTL_CMD_REMOVE_SERVER == type) {
+        QrtrService s;
+
+        s.service = le32toh(pkt.srv.service);
+        s.version = le32toh(pkt.srv.instance) & 0xff;
+        s.instance = le32toh(pkt.srv.instance) >> 8;
+        s.node = le32toh(pkt.srv.node_id);
+        s.port = le32toh(pkt.srv.port_id);
+
+        if (debug_qmi)
+            dbg_time ("[qrtr] %s  server on %u:%u -> service %u, version %u, instance %u",
+                    CTL_CMD_NEW_SERVER == type ? "add" : "remove",
+                     s.node, s.port, s.service, s.version, s.instance);
+
+        if (CTL_CMD_NEW_SERVER == type) {
+            if (s.service < QRTR_MAX) {
+                service_list[s.service] = s;
+            }
+        }
+        else if (CTL_CMD_REMOVE_SERVER == type) {
+            if (s.service < QRTR_MAX) {
+                memset(&service_list[s.service], 0, sizeof(QrtrService));
+            }
+        }
+    }
+}
+#else
+#include <linux/socket.h>
+#include <linux/qrtr.h>
+#endif
+
+static int qrtr_socket(void)
+{
+    struct sockaddr_qrtr sq;
+    socklen_t sl = sizeof(sq);
+    int sock;
+    int rc;
+
+    sock = socket(AF_QIPCRTR, SOCK_DGRAM, 0);
+    if (sock < 0) {
+        dbg_time("qrtr_socket errno: %d (%s)\n", errno, strerror(errno));
+        return -1;
+    }
+
+    rc = getsockname(sock, (void *)&sq, &sl);
+    if (rc || sq.sq_family != AF_QIPCRTR || sl != sizeof(sq)) {
+        dbg_time("getsockname: %d (%s)\n", errno, strerror(errno));
+        close(sock);
+        return -1;
+    }
+
+    return sock;
+}
+
+static int qrtr_send(int sock, uint32_t node, uint32_t port, const void *data, unsigned int sz)
+{
+    struct sockaddr_qrtr sq;
+    int rc;
+
+    sq.sq_family = AF_QIPCRTR;
+    sq.sq_node = node;
+    sq.sq_port = port;
+
+    rc = sendto(sock, data, sz, MSG_DONTWAIT, (void *)&sq, sizeof(sq));
+    if (rc < 0) {
+        dbg_time("sendto errno: %d (%s)\n", errno, strerror(errno));
+        return -1;
+    }
+
+    return 0;
+}
+
+static int qrtr_recv(int sock, void *data, unsigned int sz, uint32_t *node, uint32_t *port)
+{
+    struct sockaddr_qrtr sq;
+    socklen_t sl = sizeof(sq);
+    int rc;
+
+    rc = recvfrom(sock, data, sz, MSG_DONTWAIT, (void *)&sq, &sl);
+    if (rc < 0) {
+        dbg_time("qrtr_recv errno: %d (%s)\n", errno, strerror(errno));
+    }
+
+    *node  = sq.sq_node;
+    *port  = sq.sq_port;
+    return rc;
+    }
+#define qmi_recv qrtr_recv
+
+static int qrtr_ctrl_init(void) {
+    int sock;
+    int rc;
+    struct qrtr_ctrl_pkt pkt;
+    struct sockaddr_qrtr sq;
+    socklen_t sl = sizeof(sq);
+
+    sock = qrtr_socket();
+    if (sock == -1)
+        return -1;
+
+    memset(&pkt, 0, sizeof(pkt));
+    pkt.cmd = htole32(QRTR_TYPE_NEW_LOOKUP);
+
+    getsockname(sock, (void *)&sq, &sl);
+    rc = qrtr_send(sock, sq.sq_node, QRTR_PORT_CTRL, &pkt, sizeof(pkt));
+    if (rc == -1) {
+        dbg_time("qrtr_send errno: %d (%s)\n", errno, strerror(errno));
+        close(sock);
+        return -1;
+    }
+
+    return sock;
+}
+
+static void handle_server_change(uint32_t type, struct qrtr_ctrl_pkt *ppkt) {
+    struct qrtr_ctrl_pkt pkt = *ppkt;
+        QrtrService s;
+
+        s.service = le32toh(pkt.server.service);
+        s.version = le32toh(pkt.server.instance) & 0xff;
+        s.instance = le32toh(pkt.server.instance) >> 8;
+        s.node = le32toh(pkt.server.node);
+        s.port = le32toh(pkt.server.port);
+
+        if (debug_qmi)
+            dbg_time ("[qrtr] %s  server on %u:%u -> service %u, version %u, instance %u",
+                    QRTR_TYPE_NEW_SERVER == type ? "add" : "remove",
+                     s.node, s.port, s.service, s.version, s.instance);
+
+        if (s.node != node_modem)
+            return; //we only care modem
+
+        if (QRTR_TYPE_NEW_SERVER == type) {
+            if (s.service < QRTR_MAX) {
+                service_list[s.service] = s;
+            }
+        }
+        else if (QRTR_TYPE_DEL_SERVER == type) {
+            if (s.service < QRTR_MAX) {
+                memset(&service_list[s.service], 0, sizeof(QrtrService));
+            }
+        }
+    }
+
+static void handle_ctrl_pkt(int sock) {
+    struct qrtr_ctrl_pkt pkt;
+    struct sockaddr_qrtr sq;
+    socklen_t sl = sizeof(sq);
+    uint32_t type;
+    int rc;
+
+    rc = recvfrom(sock, &pkt, sizeof(pkt), 0, (void *)&sq, &sl);
+    if (rc < 0)
+        return;
+
+    type = le32toh(pkt.cmd);
+    if (debug_qmi)
+        dbg_time("type %u, node %u, sq.port %x, len: %d", type, sq.sq_node, sq.sq_port, rc);
+
+    if (sq.sq_port != QRTR_PORT_CTRL)
+        return;
+
+    if (QRTR_TYPE_NEW_SERVER == type || QRTR_TYPE_DEL_SERVER == type) {
+        handle_server_change(type, &pkt);
+    }
+}
+
+static int get_client(UCHAR QMIType) {
+    int ClientId;
+    QrtrService *s = &service_list[QMIType];
+
+    if (!s ->service) {
+        dbg_time("%s service: %d for QMIType: %d", __func__, s ->service, QMIType);
+        return -ENODEV;
+    }
+
+#ifdef USE_LINUX_MSM_IPC
+    ClientId = msm_ipc_socket("xport");
+#else
+    ClientId = qrtr_socket();
+#endif
+    if (ClientId == -1) {
+        return 0;
+    }
+
+    switch (QMIType) {
+        case QMUX_TYPE_WDS: dbg_time("Get clientWDS = %d", ClientId); break;
+        case QMUX_TYPE_DMS: dbg_time("Get clientDMS = %d", ClientId); break;
+        case QMUX_TYPE_NAS: dbg_time("Get clientNAS = %d", ClientId); break;
+        case QMUX_TYPE_QOS: dbg_time("Get clientQOS = %d", ClientId); break;
+        case QMUX_TYPE_WMS: dbg_time("Get clientWMS = %d", ClientId); break;
+        case QMUX_TYPE_PDS: dbg_time("Get clientPDS = %d", ClientId); break;
+        case QMUX_TYPE_UIM: dbg_time("Get clientUIM = %d", ClientId); break;
+        case QMUX_TYPE_WDS_ADMIN: dbg_time("Get clientWDA = %d", ClientId);
+        break;
+        default: break;
+    }
+
+    return ClientId;
+}
+
+static void handle_alloc_client(PROFILE_T *profile) {
+    int srv_list[] = {QMUX_TYPE_WDS, QMUX_TYPE_NAS, QMUX_TYPE_UIM, QMUX_TYPE_DMS, QMUX_TYPE_WDS_ADMIN};
+    size_t i = 0, srv_ready = 0;
+    static int report = -1;
+
+    if (report != -1)
+        return;
+
+    for(i = 0; i < sizeof(srv_list)/sizeof(srv_list[0]); i++) {
+        int srv = srv_list[i];
+
+        if (service_list[srv].service)
+            srv_ready++;
+        else
+            continue;
+
+        if (qmiclientId[srv] == 0) {
+            qmiclientId[srv] = get_client(srv);
+
+            if (qmiclientId[srv] != 0) {
+                if (srv == QMUX_TYPE_WDS) {
+                    qmiclientId[QMUX_TYPE_WDS_IPV6] = get_client(QMUX_TYPE_WDS);
+                }
+                else if (srv == QMUX_TYPE_WDS_ADMIN) {
+                     profile->wda_client = qmiclientId[QMUX_TYPE_WDS_ADMIN];
+                }
+            }
+        }
+    }
+
+    if (srv_ready == sizeof(srv_list)/sizeof(srv_list[0])) {
+        if (qmiclientId[QMUX_TYPE_WDS]) {
+            qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_CONNECTED);
+        } else {
+            qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_DISCONNECTED);
+        }
+        report = 1;
+    }
+}
+
+static int qmi_send(PQCQMIMSG pRequest) {
+    uint8_t QMIType = pRequest->QMIHdr.QMIType;
+    int sock;
+    QrtrService *s = &service_list[QMIType == QMUX_TYPE_WDS_IPV6 ? QMUX_TYPE_WDS: QMIType];
+    sock = qmiclientId[QMIType];
+
+    pRequest->QMIHdr.ClientId = 0xaa;
+    if (!s ->service || !sock) {
+        dbg_time("%s service: %d, sock: %d for QMIType: %d", __func__, s ->service, sock, QMIType);
+        return -ENODEV;
+    }
+
+#ifdef USE_LINUX_MSM_IPC
+    return xport_send(sock, s->node, s->port, &pRequest->MUXMsg,
+            le16_to_cpu(pRequest->QMIHdr.Length) + 1 - sizeof(QCQMI_HDR));
+#else
+    return qrtr_send(sock, s->node, s->port, &pRequest->MUXMsg,
+            le16_to_cpu(pRequest->QMIHdr.Length) + 1 - sizeof(QCQMI_HDR));
+#endif
+}
+
+static int qmi_deinit(void) {
+    unsigned int i;
+
+    for (i = 0; i < sizeof(qmiclientId)/sizeof(qmiclientId[0]); i++)
+    {
+        if (qmiclientId[i] != 0)
+        {
+            close(qmiclientId[i]);
+            qmiclientId[i] = 0;
+        }
+    }
+
+    return 0;
+}
+
+static void * qmi_read(void *pData) {
+    PROFILE_T *profile = (PROFILE_T *)pData;
+    int ctrl_sock;
+    int wait_for_request_quit = 0;   
+
+#ifdef USE_LINUX_MSM_IPC
+    ctrl_sock = xport_ctrl_init();
+    if (ctrl_sock != -1)
+        qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_CONNECTED);
+#else
+    ctrl_sock = qrtr_ctrl_init();
+#endif
+
+    if (ctrl_sock == -1)
+        goto _quit;
+
+    while (1) {
+        struct pollfd pollfds[16] = {{qmidevice_control_fd[1], POLLIN, 0}, {ctrl_sock, POLLIN, 0}};
+        int ne, ret, nevents = 2;
+        unsigned int i;
+
+        for (i = 0; i < sizeof(qmiclientId)/sizeof(qmiclientId[0]); i++)
+        {
+            if (qmiclientId[i] != 0)
+            {
+                pollfds[nevents].fd = qmiclientId[i];
+                pollfds[nevents].events = POLLIN;
+                pollfds[nevents].revents = 0;
+                nevents++;
+            }
+        }
+
+        do {
+            ret = poll(pollfds, nevents, wait_for_request_quit ? 1000 : -1);
+         } while ((ret < 0) && (errno == EINTR));
+
+	if (ret == 0 && wait_for_request_quit) {
+            QmiThreadRecvQMI(NULL); //main thread may pending on QmiThreadSendQMI()
+            continue;
+	}
+
+        if (ret <= 0) {
+            dbg_time("%s poll=%d, errno: %d (%s)", __func__, ret, errno, strerror(errno));
+            break;
+        }
+
+        for (ne = 0; ne < nevents; ne++) {
+            int fd = pollfds[ne].fd;
+            short revents = pollfds[ne].revents;
+
+            if (revents & (POLLERR | POLLHUP | POLLNVAL)) {
+                dbg_time("%s poll err/hup/inval", __func__);
+                dbg_time("epoll fd = %d, events = 0x%04x", fd, revents);
+                if (fd == qmidevice_control_fd[1]) {
+                } else {
+                }
+                if (revents & (POLLERR | POLLHUP | POLLNVAL))
+                    goto _quit;
+            }
+
+            if ((revents & POLLIN) == 0)
+                continue;
+
+            if (fd == qmidevice_control_fd[1]) {
+                int triger_event;
+                if (read(fd, &triger_event, sizeof(triger_event)) == sizeof(triger_event)) {
+                    //DBG("triger_event = 0x%x", triger_event);
+                    switch (triger_event) {
+                        case RIL_REQUEST_QUIT:
+                            goto _quit;
+                        break;
+                        case SIG_EVENT_STOP:
+                            wait_for_request_quit = 1;   
+                        break;
+                        default:
+                        break;
+                    }
+                }
+            }
+            else  if (fd == ctrl_sock) {
+                handle_ctrl_pkt(ctrl_sock);
+                handle_alloc_client(profile);
+            }
+            else
+            {
+                PQCQMIMSG pResponse = (PQCQMIMSG)cm_recv_buf;
+                int rc;
+                uint32_t sq_node = 0;
+                uint32_t sq_port = 0;
+
+                rc = qmi_recv(fd, &pResponse->MUXMsg, sizeof(cm_recv_buf) - sizeof(QCQMI_HDR), &sq_node, &sq_port);
+                if (debug_qmi)
+                    dbg_time("fd %d, node %u, port %x, len: %d", fd, sq_node, sq_port, rc);
+
+                if (rc <= 0)
+                {
+                    dbg_time("%s read=%d errno: %d (%s)",  __func__, rc, errno, strerror(errno));
+                    break;
+                }
+
+                for (i = 0; i < sizeof(qmiclientId)/sizeof(qmiclientId[0]); i++)
+                {
+                    if (qmiclientId[i] == fd)
+                    {
+                        pResponse->QMIHdr.QMIType = i;
+
+                        if (service_list[i].node != sq_node || service_list[i].port != sq_port) {
+                            continue;
+                        }
+                    }
+                }
+
+                pResponse->QMIHdr.IFType = USB_CTL_MSG_TYPE_QMI;
+                pResponse->QMIHdr.Length = cpu_to_le16(rc + sizeof(QCQMI_HDR)  - 1);
+                pResponse->QMIHdr.CtlFlags = 0x00;
+                pResponse->QMIHdr.ClientId = 0xaa;
+
+                QmiThreadRecvQMI(pResponse);
+            }
+        }
+    }
+
+_quit:
+    qmi_deinit();
+    close(ctrl_sock);
+    qmidevice_send_event_to_main(RIL_INDICATE_DEVICE_DISCONNECTED);
+    QmiThreadRecvQMI(NULL); //main thread may pending on QmiThreadSendQMI()
+    dbg_time("%s exit", __func__);
+    pthread_exit(NULL);
+    return NULL;
+}
+
+const struct qmi_device_ops qrtr_qmidev_ops = {
+	.deinit = qmi_deinit,
+	.send = qmi_send,
+	.read = qmi_read,
+};
+
diff --git a/RM520N-5G/文件/source/qrtr.h b/RM520N-5G/文件/source/qrtr.h
new file mode 100644
index 0000000..6db00d5
--- /dev/null
+++ b/RM520N-5G/文件/source/qrtr.h
@@ -0,0 +1,85 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _LINUX_QRTR_H
+#define _LINUX_QRTR_H
+
+#include <linux/socket.h>
+#include <linux/types.h>
+
+#ifndef AF_QIPCRTR
+#define AF_QIPCRTR 42
+#endif
+
+#define QRTR_NODE_BCAST	0xffffffffu
+#define QRTR_PORT_CTRL	0xfffffffeu
+
+struct sockaddr_qrtr {
+	__kernel_sa_family_t sq_family;
+	__u32 sq_node;
+	__u32 sq_port;
+};
+
+enum qrtr_pkt_type {
+	QRTR_TYPE_DATA		= 1,
+	QRTR_TYPE_HELLO		= 2,
+	QRTR_TYPE_BYE		= 3,
+	QRTR_TYPE_NEW_SERVER	= 4,
+	QRTR_TYPE_DEL_SERVER	= 5,
+	QRTR_TYPE_DEL_CLIENT	= 6,
+	QRTR_TYPE_RESUME_TX	= 7,
+	QRTR_TYPE_EXIT          = 8,
+	QRTR_TYPE_PING          = 9,
+	QRTR_TYPE_NEW_LOOKUP	= 10,
+	QRTR_TYPE_DEL_LOOKUP	= 11,
+};
+
+#define QRTR_TYPE_DEL_PROC 13
+
+struct qrtr_ctrl_pkt {
+	__le32 cmd;
+
+	union {
+		struct {
+			__le32 service;
+			__le32 instance;
+			__le32 node;
+			__le32 port;
+		} server;
+
+		struct {
+			__le32 node;
+			__le32 port;
+		} client;
+
+		struct {
+			__le32 rsvd;
+			__le32 node;
+		} proc;
+
+	};
+} __attribute__ ((packed));
+
+#define QRTR_PROTO_VER_1 1
+
+struct qrtr_hdr_v1 {
+	__le32 version;
+	__le32 type;
+	__le32 src_node_id;
+	__le32 src_port_id;
+	__le32 confirm_rx;
+	__le32 size;
+	__le32 dst_node_id;
+	__le32 dst_port_id;
+} __attribute__ ((packed));
+
+#endif /* _LINUX_QRTR_H */
diff --git a/RM520N-5G/文件/source/quectel-atc-proxy.c b/RM520N-5G/文件/source/quectel-atc-proxy.c
new file mode 100644
index 0000000..bbe6951
--- /dev/null
+++ b/RM520N-5G/文件/source/quectel-atc-proxy.c
@@ -0,0 +1,502 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <fcntl.h>
+#include <stddef.h>
+#include <pthread.h>
+#include <errno.h>
+#include <time.h>
+#include <signal.h>
+#include <getopt.h>
+#include <poll.h>
+#include <sys/time.h>
+#include <endian.h>
+#include <time.h>
+#include <sys/types.h>
+#include <limits.h>
+#include <inttypes.h>
+#include <sys/socket.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/ioctl.h>
+#include <linux/un.h>
+#include <linux/if.h>
+#include <dirent.h>
+#include <signal.h>
+#include <endian.h>
+#include <inttypes.h>
+
+#include "qlist.h"
+#include "QMIThread.h"
+#include "atchannel.h"
+#include "at_tok.h"
+
+#define dprintf(fmt, args...) do { fprintf(stdout, "%s " fmt, get_time(), ##args); } while(0);
+#define SYSCHECK(c) do{if((c)<0) {dprintf("%s %d error: '%s' (code: %d)\n", __func__, __LINE__, strerror(errno), errno); return -1;}}while(0)
+#define cfmakenoblock(fd) do{fcntl(fd, F_SETFL, fcntl(fd,F_GETFL) | O_NONBLOCK);}while(0)
+
+#define safe_free(__x) do { if (__x) { free((void *)__x); __x = NULL;}} while(0)
+#define safe_at_response_free(__x) { if (__x) { at_response_free(__x); __x = NULL;}}
+
+#define at_response_error(err, p_response) \
+    (err \
+    || p_response == NULL \
+    || p_response->finalResponse == NULL \
+    || p_response->success == 0)
+
+typedef struct {
+    struct qlistnode qnode;
+    int ClientFd;
+    unsigned AccessTime;
+} ATC_PROXY_CONNECTION;
+
+static int atc_proxy_quit = 0;
+static pthread_t thread_id = 0;
+static int atc_dev_fd = -1;
+static int atc_proxy_server_fd = -1;
+static struct qlistnode atc_proxy_connection;
+static int verbose_debug = 0;
+static int modem_reset_flag = 0;
+static uint8_t atc_buf[4096];
+static int asr_style_atc =  0;
+extern int asprintf(char **s, const char *fmt, ...);
+static ATC_PROXY_CONNECTION *current_client_fd = NULL;
+
+static void dump_atc(uint8_t *pATC, int fd,int size, const char flag)
+{
+    if (verbose_debug) {
+        printf("%c %d:\n", flag, fd);
+        printf("%.*s\n", size, pATC);
+    }
+}
+
+static int send_atc_to_client(int clientFd, uint8_t *pATC, int size) {
+    struct pollfd pollfds[]= {{clientFd, POLLOUT, 0}};
+    ssize_t ret = 0;
+
+    do {
+        ret = poll(pollfds, sizeof(pollfds)/sizeof(pollfds[0]), 5000);
+    } while (ret == -1 && errno == EINTR && atc_proxy_quit == 0);
+
+    if (pollfds[0].revents & POLLOUT) {
+        ret = write(clientFd, pATC, size);
+    }
+
+    return ret;
+}
+
+static void onUnsolicited (const char *s, const char *sms_pdu)
+{
+    struct qlistnode *con_node;
+    int ret;
+    char buf[1024];
+
+    if(s) {
+        strcpy(buf, s);
+        strcat(buf, "\r\n");
+    }
+    if(sms_pdu) {
+        strcat(buf, sms_pdu);
+        strcat(buf, "\r\n");
+    }
+
+    if(current_client_fd) {
+        ATC_PROXY_CONNECTION *atc_con = current_client_fd;
+        ret = send_atc_to_client(atc_con->ClientFd, (uint8_t *)buf, strlen(buf));
+        if(ret < 0) {
+            close(atc_con->ClientFd);
+            qlist_remove(&atc_con->qnode);
+            free(atc_con); 
+        }
+        return;
+    }
+
+    qlist_for_each(con_node, &atc_proxy_connection) {
+        ATC_PROXY_CONNECTION *atc_con = qnode_to_item(con_node, ATC_PROXY_CONNECTION, qnode);
+        if(atc_con && atc_con->ClientFd > 0) {
+            ret = send_atc_to_client(atc_con->ClientFd, (uint8_t *)buf, strlen(buf));
+            if(ret < 0) {
+                close(atc_con->ClientFd);
+                con_node = con_node->prev;
+                qlist_remove(&atc_con->qnode); 
+                free(atc_con);
+                continue;
+            }
+        }
+    }
+}
+
+static void onTimeout(void) {
+    dprintf("%s", __func__);
+    //TODO
+}
+
+static void onClose(void) {
+    dprintf("%s", __func__);
+}
+
+static int create_local_server(const char *name) {
+    int sockfd = -1;
+    int reuse_addr = 1;
+    struct sockaddr_un sockaddr;
+    socklen_t alen;
+
+    /*Create server socket*/
+    SYSCHECK(sockfd = socket(AF_LOCAL, SOCK_STREAM, 0));
+
+    memset(&sockaddr, 0, sizeof(sockaddr));
+    sockaddr.sun_family = AF_LOCAL;
+    sockaddr.sun_path[0] = 0;
+    memcpy(sockaddr.sun_path + 1, name, strlen(name) );
+
+    alen = strlen(name) + offsetof(struct sockaddr_un, sun_path) + 1;
+    SYSCHECK(setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &reuse_addr,sizeof(reuse_addr)));
+    if(bind(sockfd, (struct sockaddr *)&sockaddr, alen) < 0) {
+        close(sockfd);
+        dprintf("bind %s errno: %d (%s)\n", name, errno, strerror(errno));
+        return -1;
+    }
+
+    dprintf("local server: %s sockfd = %d\n", name, sockfd);
+    cfmakenoblock(sockfd);
+    listen(sockfd, 1);    
+
+    return sockfd;
+}
+
+static void accept_atc_connection(int serverfd) {
+    int clientfd = -1;
+    unsigned char addr[128];
+    socklen_t alen = sizeof(addr);
+    ATC_PROXY_CONNECTION *atc_con;
+
+    clientfd = accept(serverfd, (struct sockaddr *)addr, &alen);
+
+    atc_con = (ATC_PROXY_CONNECTION *)malloc(sizeof(ATC_PROXY_CONNECTION));
+    if (atc_con) {
+        qlist_init(&atc_con->qnode);
+        atc_con->ClientFd= clientfd;
+        atc_con->AccessTime = 0;
+        dprintf("+++ ClientFd=%d\n", atc_con->ClientFd);
+        qlist_add_tail(&atc_proxy_connection, &atc_con->qnode);
+    }
+
+    cfmakenoblock(clientfd);
+}
+
+static void cleanup_atc_connection(int clientfd) {
+    struct qlistnode *con_node;
+    
+    qlist_for_each(con_node, &atc_proxy_connection) {
+        ATC_PROXY_CONNECTION *atc_con = qnode_to_item(con_node, ATC_PROXY_CONNECTION, qnode);
+        if (atc_con->ClientFd == clientfd) {
+            dprintf("--- ClientFd=%d\n", atc_con->ClientFd);    
+            close(atc_con->ClientFd);
+            qlist_remove(&atc_con->qnode);
+            free(atc_con);
+            if (current_client_fd == atc_con)
+                current_client_fd = NULL;
+            break;
+        }
+    }
+}
+
+static int atc_proxy_init(void) {
+    int err;
+    char *cmd;
+    ATResponse *p_response = NULL;
+
+    err = at_handshake();
+    if (err) {
+        dprintf("handshake fail, TODO ... ");
+        goto exit;
+    }
+	
+    at_send_command_singleline("AT+QCFG=\"usbnet\"", "+QCFG:", NULL);
+    at_send_command_multiline("AT+QNETDEVCTL=?", "+QNETDEVCTL:", NULL);
+    at_send_command("AT+CGREG=2", NULL); //GPRS Network Registration Status
+    at_send_command("AT+CEREG=2", NULL); //EPS Network Registration Status
+    at_send_command("AT+C5GREG=2", NULL); //5GS Network Registration Status
+
+    at_send_command_singleline("AT+QNETDEVSTATUS=?", "+QNETDEVSTATUS:", &p_response);
+    if (at_response_error(err, p_response))
+        asr_style_atc = 1; //EC200T/EC100Y do not support this AT, but RG801/RG500U support 
+	
+    safe_at_response_free(p_response);
+
+    err = at_send_command_singleline("AT+QCFG=\"NAT\"", "+QCFG:", &p_response);
+    if (!at_response_error(err, p_response)) {
+        int old_nat, new_nat = asr_style_atc ? 1 : 0;
+
+        err = at_tok_scanf(p_response->p_intermediates->line, "%s%d", NULL, &old_nat);
+        if (err == 2 && old_nat != new_nat) {
+            safe_at_response_free(p_response);
+            asprintf(&cmd, "AT+QCFG=\"NAT\",%d", new_nat);
+            err = at_send_command(cmd, &p_response);
+            safe_free(cmd);
+            if (!at_response_error(err, p_response)) {
+                err = at_send_command("at+cfun=1,1",NULL);
+            }
+            safe_at_response_free(p_response);
+        }
+        err = 0;
+    }
+    safe_at_response_free(p_response);
+
+exit:
+    return err;
+}
+
+static void atc_start_server(const char* servername) {
+    atc_proxy_server_fd = create_local_server(servername);
+    dprintf("atc_proxy_server_fd = %d\n", atc_proxy_server_fd);
+    if (atc_proxy_server_fd == -1) {
+        dprintf("Failed to create %s, errno: %d (%s)\n", servername, errno, strerror(errno));
+    }
+}
+
+static void atc_close_server(const char* servername) {
+    if (atc_proxy_server_fd != -1) {
+        dprintf("%s %s close server\n", __func__, servername);
+        close(atc_proxy_server_fd);
+        atc_proxy_server_fd = -1;
+    }
+}
+
+static void *atc_proxy_loop(void *param)
+{
+    uint8_t *pATC = atc_buf;
+    struct qlistnode *con_node;
+    ATC_PROXY_CONNECTION *atc_con;
+
+    (void)param;
+    dprintf("%s enter thread_id %p\n", __func__, (void *)pthread_self());
+
+    qlist_init(&atc_proxy_connection);
+    while (atc_dev_fd > 0 && atc_proxy_quit == 0) {
+        struct pollfd pollfds[2+64];
+        int ne, ret, nevents = 0;
+        ssize_t nreads;
+
+        pollfds[nevents].fd = atc_dev_fd;
+        pollfds[nevents].events = POLLIN;
+        pollfds[nevents].revents= 0;
+        nevents++;
+        
+        if (atc_proxy_server_fd > 0) {
+            pollfds[nevents].fd = atc_proxy_server_fd;
+            pollfds[nevents].events = POLLIN;
+            pollfds[nevents].revents= 0;
+            nevents++;
+        }
+
+        qlist_for_each(con_node, &atc_proxy_connection) {
+            atc_con = qnode_to_item(con_node, ATC_PROXY_CONNECTION, qnode);
+            
+            pollfds[nevents].fd = atc_con->ClientFd;
+            pollfds[nevents].events = POLLIN;
+            pollfds[nevents].revents= 0;
+            nevents++;
+
+            if (nevents == (sizeof(pollfds)/sizeof(pollfds[0])))
+                break;
+        }
+
+        do {
+            ret = poll(pollfds, nevents, (atc_proxy_server_fd > 0) ? -1 : 200);
+         } while (ret == -1 && errno == EINTR && atc_proxy_quit == 0);
+         
+        if (ret < 0) {
+            dprintf("%s poll=%d, errno: %d (%s)\n", __func__, ret, errno, strerror(errno));
+            goto atc_proxy_loop_exit;
+        }
+
+        for (ne = 0; ne < nevents; ne++) {
+            int fd = pollfds[ne].fd;
+            short revents = pollfds[ne].revents;
+
+            if (revents & (POLLERR | POLLHUP | POLLNVAL)) {
+                dprintf("%s poll fd = %d, revents = %04x\n", __func__, fd, revents);
+                if (fd == atc_dev_fd) {
+                    goto atc_proxy_loop_exit;
+                } else if(fd == atc_proxy_server_fd) {
+                
+                } else {
+                    cleanup_atc_connection(fd);
+                }
+                continue;
+            }
+
+            if (!(pollfds[ne].revents & POLLIN)) {
+                continue;
+            }
+
+            if (fd == atc_proxy_server_fd) {
+                accept_atc_connection(fd);
+            }
+            else if (fd == atc_dev_fd) {
+                usleep(10*1000); //let atchannel.c read at response.
+                if (modem_reset_flag)
+                    goto atc_proxy_loop_exit;
+            }
+            else {
+                memset(atc_buf, 0x0, sizeof(atc_buf));
+                nreads = read(fd, pATC, sizeof(atc_buf));
+                if (nreads <= 0) {
+                    dprintf("%s read=%d errno: %d (%s)",  __func__, (int)nreads, errno, strerror(errno));
+                    cleanup_atc_connection(fd);
+                    break;
+                }
+
+                dump_atc(pATC, fd, nreads, 'r');
+                qlist_for_each(con_node, &atc_proxy_connection) {
+                    atc_con = qnode_to_item(con_node, ATC_PROXY_CONNECTION, qnode);
+                    if (atc_con->ClientFd == pollfds[nevents].fd) {
+                        current_client_fd = atc_con;
+                        break;
+                    }
+                }
+                at_send_command ((const char *)pATC, NULL);
+                current_client_fd = NULL;
+            }
+        }
+    }
+
+atc_proxy_loop_exit:
+    at_close();
+    while (!qlist_empty(&atc_proxy_connection)) {
+        ATC_PROXY_CONNECTION *atc_con = qnode_to_item(qlist_head(&atc_proxy_connection), ATC_PROXY_CONNECTION, qnode);
+        cleanup_atc_connection(atc_con->ClientFd);
+    }
+    dprintf("%s exit, thread_id %p\n", __func__, (void *)pthread_self());
+
+    return NULL;
+}
+
+static void usage(void) {
+    dprintf(" -d <device_name>                      A valid atc device\n"
+            "                                       default /dev/ttyUSB2, but /dev/ttyUSB2 may be invalid\n"
+            " -i <netcard_name>                     netcard name\n"
+            " -v                                    Will show all details\n");
+}
+
+static void sig_action(int sig) {
+    if (atc_proxy_quit == 0) {
+        atc_proxy_quit = 1;
+        if (thread_id)
+            pthread_kill(thread_id, sig);
+    }
+}
+
+int main(int argc, char *argv[]) {
+    int opt;
+    char atc_dev[32+1] = "/dev/ttyUSB2";
+    int retry_times = 0;
+    char servername[64] = {0};
+
+    optind = 1;
+    signal(SIGINT, sig_action);
+
+    while ( -1 != (opt = getopt(argc, argv, "d:i:vh"))) {
+        switch (opt) {
+            case 'd':
+                strcpy(atc_dev, optarg);
+                break;
+            case 'v':
+                verbose_debug = 1;
+                break;
+            default:
+                usage();
+                return 0;
+        }
+    }
+
+    if (access(atc_dev, R_OK | W_OK)) {
+        dprintf("Fail to access %s, errno: %d (%s). break\n", atc_dev, errno, strerror(errno));
+        return -1;
+    }
+
+          sprintf(servername, "quectel-atc-proxy%c", atc_dev[strlen(atc_dev) - 1]);
+    dprintf("Will use atc-dev='%s', proxy='%s'\n", atc_dev, servername);
+
+    while (atc_proxy_quit == 0) {
+        if (access(atc_dev, R_OK | W_OK)) {
+            dprintf("Fail to access %s, errno: %d (%s). continue\n", atc_dev, errno, strerror(errno));
+            // wait device
+            sleep(3);
+            continue;
+        }
+
+        atc_dev_fd = open(atc_dev, O_RDWR | O_NONBLOCK | O_NOCTTY);
+        if (atc_dev_fd == -1) {
+            dprintf("Failed to open %s, errno: %d (%s). break\n", atc_dev, errno, strerror(errno));
+            return -1;
+        }
+        cfmakenoblock(atc_dev_fd);
+        if (at_open(atc_dev_fd, onUnsolicited, 1)) {
+            close(atc_dev_fd);
+            atc_dev_fd = -1;
+        }
+        at_set_on_timeout(onTimeout);
+        at_set_on_reader_closed(onClose);
+
+        /* no atc_proxy_loop lives, create one */
+        pthread_create(&thread_id, NULL, atc_proxy_loop, NULL);
+        /* try to redo init if failed, init function must be successfully */
+        while (atc_proxy_init() != 0) {
+            if (retry_times < 5) {
+                dprintf("fail to init proxy, try again in 2 seconds.\n");
+                sleep(2);
+                retry_times++;
+            } else {
+                dprintf("has failed too much times, restart the modem and have a try...\n");
+                break;
+            }
+            /* break loop if modem is detached */
+            if (access(atc_dev, F_OK|R_OK|W_OK))
+                break;
+        }
+        retry_times = 0;
+        atc_start_server(servername);
+        if (atc_proxy_server_fd == -1)
+            pthread_cancel(thread_id); 
+        pthread_join(thread_id, NULL);
+
+        /* close local server at last */
+        atc_close_server(servername);
+        close(atc_dev_fd);
+        /* DO RESTART IN 20s IF MODEM RESET ITSELF */
+        if (modem_reset_flag) {
+            unsigned int time_to_wait = 20;
+            while (time_to_wait) {
+                time_to_wait = sleep(time_to_wait);
+            }
+            modem_reset_flag = 0;
+        }
+    }
+
+    return 0;
+}
\ No newline at end of file
diff --git a/RM520N-5G/文件/source/quectel-mbim-proxy.c b/RM520N-5G/文件/source/quectel-mbim-proxy.c
new file mode 100644
index 0000000..dbda963
--- /dev/null
+++ b/RM520N-5G/文件/source/quectel-mbim-proxy.c
@@ -0,0 +1,464 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/ioctl.h>
+#include <linux/un.h>
+#include <linux/in.h>
+#include <linux/if.h>
+#include <dirent.h>
+#include <signal.h>
+#include <inttypes.h>
+#include <getopt.h>
+#include "qendian.h"
+
+#define QUECTEL_MBIM_PROXY "quectel-mbim-proxy"
+#define safe_close(_fd) do { if (_fd > 0) { close(_fd); _fd = -1; } } while(0)
+
+#define CM_MAX_CLIENT 32
+#define TID_MASK (0xFFFFFF)
+#define TID_SHIFT (24)
+
+typedef enum {
+    MBIM_OPEN_MSG = 1,
+    MBIM_CLOSE_MSG = 2,
+    MBIM_OPEN_DONE = 0x80000001,
+    MBIM_CLOSE_DONE = 0x80000002,
+} MBIM_MSG;
+
+typedef struct {
+    unsigned int  MessageType;
+    unsigned int  MessageLength;
+    unsigned int  TransactionId;
+} MBIM_MESSAGE_HEADER;
+
+typedef struct {
+    MBIM_MESSAGE_HEADER MessageHeader;
+    unsigned int MaxControlTransfer;
+} MBIM_OPEN_MSG_T;
+
+typedef struct {
+    MBIM_MESSAGE_HEADER MessageHeader;
+    unsigned int Status;
+} MBIM_OPEN_DONE_T;
+
+typedef struct {
+    int client_fd;
+    int client_idx;
+} CM_CLIENT_T;
+
+static unsigned char cm_recv_buffer[4096];
+static CM_CLIENT_T cm_clients[CM_MAX_CLIENT];
+static int verbose = 0;
+
+const char * get_time(void) {
+    static char time_buf[128];
+    struct timeval  tv;
+    time_t time;
+    suseconds_t millitm;
+    struct tm *ti;
+
+    gettimeofday (&tv, NULL);
+
+    time= tv.tv_sec;
+    millitm = (tv.tv_usec + 500) / 1000;
+
+    if (millitm == 1000) {
+        ++time;
+        millitm = 0;
+    }
+
+    ti = localtime(&time);
+    sprintf(time_buf, "[%02d-%02d_%02d:%02d:%02d:%03d]", ti->tm_mon+1, ti->tm_mday, ti->tm_hour, ti->tm_min, ti->tm_sec, (int)millitm);
+    return time_buf;
+}
+
+#define mbim_debug(fmt, args...) do { fprintf(stdout, "%s " fmt, get_time(), ##args); } while(0);
+
+static int non_block_write(int fd, void *data, int len)
+{
+    int ret;
+    struct pollfd pollfd = {fd, POLLOUT, 0};
+    ret = poll(&pollfd, 1, 3000);
+
+    if (ret <= 0) {
+        mbim_debug("%s poll ret=%d, errno: %d(%s)\n", __func__, ret, errno, strerror(errno));
+    }
+
+    ret = write (fd, data, len);
+    if (ret != len)
+        mbim_debug("%s write ret=%d, errno: %d(%s)\n", __func__, ret, errno, strerror(errno));
+
+    return len;
+}
+
+static int mbim_send_open_msg(int mbim_dev_fd, uint32_t MaxControlTransfer) {
+    MBIM_OPEN_MSG_T open_msg;
+    MBIM_OPEN_MSG_T *pRequest = &open_msg;
+
+    pRequest->MessageHeader.MessageType = htole32(MBIM_OPEN_MSG);
+    pRequest->MessageHeader.MessageLength = htole32(sizeof(MBIM_OPEN_MSG_T));
+    pRequest->MessageHeader.TransactionId = htole32(1);
+    pRequest->MaxControlTransfer = htole32(MaxControlTransfer);
+
+    mbim_debug("%s()\n", __func__);
+    return non_block_write(mbim_dev_fd, pRequest, sizeof(MBIM_OPEN_MSG_T));
+}
+
+/*
+ * parameter: proxy name
+ * return: local proxy server fd or -1
+*/
+static int proxy_make_server(const char *proxy_name)
+{
+    int len, flag;
+    struct sockaddr_un sockaddr;
+    int mbim_server_fd;
+
+    mbim_server_fd = socket(AF_LOCAL, SOCK_STREAM, 0);
+    if (mbim_server_fd < 0) {
+        mbim_debug("socket failed: %s\n", strerror(errno));
+        return -1;
+    }
+    if (fcntl(mbim_server_fd, F_SETFL, fcntl(mbim_server_fd, F_GETFL) | O_NONBLOCK) < 0)
+        mbim_debug("fcntl set server(%d) NONBLOCK attribute failed: %s\n", mbim_server_fd, strerror(errno));
+
+    memset(&sockaddr, 0, sizeof(sockaddr));
+    sockaddr.sun_family = AF_LOCAL;
+    sockaddr.sun_path[0] = 0;
+    snprintf(sockaddr.sun_path, UNIX_PATH_MAX, "0%s", proxy_name);
+    sockaddr.sun_path[0] = '\0';  // string starts with leading '\0'
+    flag = 1;
+    if (setsockopt(mbim_server_fd, SOL_SOCKET, SO_REUSEADDR, &flag, sizeof(flag)) < 0) {
+        safe_close(mbim_server_fd);
+        mbim_debug("setsockopt failed\n");
+    }
+
+    len = strlen(proxy_name) + offsetof(struct sockaddr_un, sun_path) + 1;
+    if (bind(mbim_server_fd, (struct sockaddr*)&sockaddr, len) < 0) {
+        safe_close(mbim_server_fd);
+        mbim_debug("bind failed: %s\n", strerror(errno));
+        return -1;
+    }
+
+    listen(mbim_server_fd, 4);
+    return mbim_server_fd;
+}
+
+static int handle_client_connect(int server_fd)
+{
+    int i, client_fd;
+    struct sockaddr_in cli_addr;
+    socklen_t len = sizeof(cli_addr);
+
+    client_fd = accept(server_fd, (struct sockaddr *)&cli_addr, &len);
+    if (client_fd < 0) {
+        mbim_debug("proxy accept failed: %s\n", strerror(errno));
+        return -1;
+    }
+
+    if (fcntl(client_fd, F_SETFL, fcntl(client_fd, F_GETFL) | O_NONBLOCK) < 0)
+        mbim_debug("fcntl set client(%d) NONBLOCK attribute failed: %s\n", client_fd, strerror(errno));
+
+    for (i = 0; i < CM_MAX_CLIENT; i++) {
+        if (cm_clients[i].client_fd <= 0) {
+            cm_clients[i].client_fd = client_fd;
+            cm_clients[i].client_idx= i+1;
+            mbim_debug("%s client_fd=%d, client_idx=%d\n", __func__, cm_clients[i].client_fd, cm_clients[i].client_idx);
+            return 0;
+        }
+    }
+
+    close(client_fd);
+    return -1;
+}
+
+static void handle_client_disconnect(int client_fd)
+{
+    int i;
+
+    for (i = 0; i < CM_MAX_CLIENT; i++) {
+        if (cm_clients[i].client_fd == client_fd) {
+            mbim_debug("%s client_fd=%d, client_idx=%d\n", __func__, cm_clients[i].client_fd, cm_clients[i].client_idx);
+            safe_close(cm_clients[i].client_fd);
+            return;
+        }
+    }
+}
+
+static int handle_client_request(int mbim_dev_fd, int client_fd, void *pdata, int len)
+{
+    int i;
+    int client_idx = -1;
+    int ret;
+    MBIM_MESSAGE_HEADER *pRequest = (MBIM_MESSAGE_HEADER *)pdata;
+    unsigned int  TransactionId = le32toh(pRequest->TransactionId);
+
+    for (i = 0; i < CM_MAX_CLIENT; i++) {
+        if (cm_clients[i].client_fd == client_fd) {
+            client_idx = cm_clients[i].client_idx;
+            break;
+        }
+    }
+
+    if (client_idx == -1) {
+        goto error;
+    }
+
+    if (le32toh(pRequest->MessageType) == MBIM_OPEN_MSG
+        || le32toh(pRequest->MessageType) == MBIM_CLOSE_MSG) {
+        MBIM_OPEN_DONE_T OpenDone;
+        OpenDone.MessageHeader.MessageType = htole32(le32toh(pRequest->MessageType) | 0x80000000);
+        OpenDone.MessageHeader.MessageLength = htole32(sizeof(OpenDone));
+        OpenDone.MessageHeader.TransactionId = htole32(TransactionId);
+        OpenDone.Status = htole32(0);
+        non_block_write (client_fd, &OpenDone, sizeof(OpenDone));
+        return 0;
+    }
+
+    /* transfer TransicationID to proxy transicationID and record in sender list */
+    pRequest->TransactionId = htole32(TransactionId | (client_idx << TID_SHIFT));
+    if (verbose) mbim_debug("REQ client_fd=%d, client_idx=%d, tid=%u\n",
+        cm_clients[client_idx].client_fd, cm_clients[client_idx].client_idx, TransactionId);
+    ret = non_block_write (mbim_dev_fd, pRequest, len);
+    if (ret == len)
+        return 0;
+
+error:
+    return -1;
+}
+
+/*
+ * Will read message from device and transfer it to clients/client
+ * Notice:
+ *  unsocial message will be send to all clients
+ */
+static int handle_device_response(void *pdata, int len)
+{
+    int i;
+    MBIM_MESSAGE_HEADER *pResponse = (MBIM_MESSAGE_HEADER *)pdata;
+    unsigned int  TransactionId = le32toh(pResponse->TransactionId);
+
+    /* unsocial/function error message */
+    if (TransactionId == 0) {
+        for (i = 0; i < CM_MAX_CLIENT; i++) {
+            if (cm_clients[i].client_fd > 0) {
+                non_block_write(cm_clients[i].client_fd, pResponse, len);
+            }
+        }
+    }
+    else {
+        /* try to find the sender */
+        int client_idx = (TransactionId >> TID_SHIFT);
+
+        for (i = 0; i < CM_MAX_CLIENT; i++) {
+            if (cm_clients[i].client_idx == client_idx && cm_clients[i].client_fd > 0) {
+                TransactionId &= TID_MASK;
+                pResponse->TransactionId = htole32(TransactionId);
+                if (verbose) mbim_debug("RSP client_fd=%d, client_idx=%d, tid=%u\n",
+                    cm_clients[i].client_fd, cm_clients[i].client_idx, TransactionId);
+                non_block_write(cm_clients[i].client_fd, pResponse, len);
+                break;
+            }
+        }
+
+        if (i == CM_MAX_CLIENT) {
+           mbim_debug("%s nobody care tid=%u\n", __func__, TransactionId);     
+        }
+    }
+
+    return 0;
+}
+
+static int proxy_loop(int mbim_dev_fd)
+{
+    int i;
+    int mbim_server_fd = -1;
+
+    while (mbim_dev_fd > 0) {
+        struct pollfd pollfds[2+CM_MAX_CLIENT];
+        int ne, ret, nevents = 0;
+
+        pollfds[nevents].fd = mbim_dev_fd;
+        pollfds[nevents].events = POLLIN;
+        pollfds[nevents].revents= 0;
+        nevents++;
+        
+        if (mbim_server_fd > 0) {
+            pollfds[nevents].fd = mbim_server_fd;
+            pollfds[nevents].events = POLLIN;
+            pollfds[nevents].revents= 0;
+            nevents++;
+
+            for (i = 0; i < CM_MAX_CLIENT; i++) {
+                if (cm_clients[i].client_fd > 0) {
+                    pollfds[nevents].fd = cm_clients[i].client_fd;
+                    pollfds[nevents].events = POLLIN;
+                    pollfds[nevents].revents= 0;
+                    nevents++;
+                }
+            }
+        }
+
+        ret = poll(pollfds, nevents, (mbim_server_fd > 0) ? -1 : (10*1000));
+        if (ret <= 0) {
+            goto error;
+        }
+
+        for (ne = 0; ne < nevents; ne++) {
+            int fd = pollfds[ne].fd;
+            short revents = pollfds[ne].revents;
+
+            if (revents & (POLLERR | POLLHUP | POLLNVAL)) {
+                mbim_debug("%s poll fd = %d, revents = %04x\n", __func__, fd, revents);
+                if (fd == mbim_dev_fd) {
+                    goto error;
+                } else if(fd == mbim_server_fd) {
+                
+                } else {
+                    handle_client_disconnect(fd);
+                }
+                continue;
+            }
+
+            if (!(pollfds[ne].revents & POLLIN)) {
+                continue;
+            }
+
+            if (fd == mbim_server_fd) {
+                handle_client_connect(fd);
+            }
+            else {
+                    int len = read(fd, cm_recv_buffer, sizeof(cm_recv_buffer));
+
+                    if (len <= 0) {
+                        mbim_debug("%s read fd=%d, len=%d, errno: %d(%s)\n", __func__, fd, len, errno, strerror(errno));
+                        if (fd == mbim_dev_fd)
+                            goto error;
+                        else
+                            handle_client_disconnect(fd);
+
+                        return len;
+                    }
+
+                    if (fd == mbim_dev_fd) {
+                        if (mbim_server_fd == -1) {
+                            MBIM_OPEN_DONE_T *pOpenDone = (MBIM_OPEN_DONE_T *)cm_recv_buffer;
+
+                            if (le32toh(pOpenDone->MessageHeader.MessageType) == MBIM_OPEN_DONE) {
+                                mbim_debug("receive MBIM_OPEN_DONE, status=%d\n", htole32(pOpenDone->Status));
+                                if (htole32(pOpenDone->Status))
+                                    goto error;
+                                mbim_server_fd = proxy_make_server(QUECTEL_MBIM_PROXY);
+                                mbim_debug("mbim_server_fd=%d\n", mbim_server_fd);
+                            }
+                        }
+                        else {
+                            handle_device_response(cm_recv_buffer, len);
+                        }
+                    }
+                    else {
+                        handle_client_request(mbim_dev_fd, fd, cm_recv_buffer, len);
+                    }
+            }
+        }
+    }
+
+error:
+    safe_close(mbim_server_fd);
+    for (i = 0; i < CM_MAX_CLIENT; i++) {
+        safe_close(cm_clients[i].client_fd);
+    }
+
+    mbim_debug("%s exit\n", __func__);
+    return 0;
+}
+
+/*
+ * How to use this proxy?
+ * 1. modprobe -a 8021q
+ * 2. Create network interface for channels: 
+ *      ip link add link wwan0 name wwan0.1 type vlan id 1
+ *      ip link add link wwan0 name wwan0.2 type vlan id 2
+ * 3. Start './mbim-proxy' with -d 'device'
+ * 4. Start Clients: ./quectel-CM -n id1
+ * 5. Start Clients: ./quectel-CM -n id2
+ * ...
+ * Notice:
+ *      mbim-proxy can work in backgroud as a daemon
+ *      '-n' sessionID
+ *  The modem may not support multi-PDN mode or how many PDN it supports is undefined. It depends!!!
+ *  Besides, some modem also may not support some sessionID. For instance EC20 doesn't support SessionId 1... 
+ */
+int main(int argc, char **argv)
+{
+    int optidx = 0;
+    int opt;
+    char *optstr = "d:vh";
+    const char *device = "/dev/cdc-wdm0";
+
+    struct option options[] = {
+        {"verbose", no_argument,        NULL, 'v'},
+        {"device", required_argument,   NULL, 'd'},
+        {0, 0, 0, 0},
+    };
+    while ((opt = getopt_long(argc, argv, optstr, options, &optidx)) != -1) {
+        switch (opt) {
+        case 'v':
+            verbose = 1;
+            break;
+        case 'd':
+            device = optarg;
+            break;
+        case 'h':
+            mbim_debug("-h              Show this message\n");
+            mbim_debug("-v              Verbose\n");
+            mbim_debug("-d [device]     MBIM device\n");
+            return 0;
+        default:
+            mbim_debug("illegal argument\n");
+            return -1;
+        }
+    }
+
+    if (!device) {
+        mbim_debug("Missing parameter: device\n");
+        return -1;
+    }
+
+    while (1) {
+        int mbim_dev_fd = open(device, O_RDWR | O_NONBLOCK | O_NOCTTY);
+        if (mbim_dev_fd < 0) {
+            mbim_debug("cannot open mbim_device %s: %s\n", device, strerror(errno));
+            sleep(2);
+            continue;
+        }
+        mbim_debug ("mbim_dev_fd=%d\n", mbim_dev_fd);
+
+        memset(cm_clients, 0, sizeof(cm_clients));
+        mbim_send_open_msg(mbim_dev_fd, sizeof(cm_recv_buffer));
+        proxy_loop(mbim_dev_fd);
+        safe_close(mbim_dev_fd);
+    }
+
+    return -1;
+}
diff --git a/RM520N-5G/文件/source/quectel-qmi-proxy.c b/RM520N-5G/文件/source/quectel-qmi-proxy.c
new file mode 100644
index 0000000..4cb4c9f
--- /dev/null
+++ b/RM520N-5G/文件/source/quectel-qmi-proxy.c
@@ -0,0 +1,696 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/ioctl.h>
+#include <linux/un.h>
+#include <linux/if.h>
+#include <dirent.h>
+#include <signal.h>
+#include <inttypes.h>
+
+#include "qendian.h"
+#include "qlist.h"
+#include "QCQMI.h"
+#include "QCQCTL.h"
+#include "QCQMUX.h"
+
+#ifndef MIN
+#define MIN(a, b)	((a) < (b)? (a): (b))
+#endif
+
+const char * get_time(void) {
+    static char time_buf[128];
+    struct timeval  tv;
+    time_t time;
+    suseconds_t millitm;
+    struct tm *ti;
+
+    gettimeofday (&tv, NULL);
+
+    time= tv.tv_sec;
+    millitm = (tv.tv_usec + 500) / 1000;
+
+    if (millitm == 1000) {
+        ++time;
+        millitm = 0;
+    }
+
+    ti = localtime(&time);
+    sprintf(time_buf, "[%02d-%02d_%02d:%02d:%02d:%03d]", ti->tm_mon+1, ti->tm_mday, ti->tm_hour, ti->tm_min, ti->tm_sec, (int)millitm);
+    return time_buf;
+}
+
+#define dprintf(fmt, args...) do { fprintf(stdout, "%s " fmt, get_time(), ##args); } while(0);
+#define SYSCHECK(c) do{if((c)<0) {dprintf("%s %d error: '%s' (code: %d)\n", __func__, __LINE__, strerror(errno), errno); return -1;}}while(0)
+#define cfmakenoblock(fd) do{fcntl(fd, F_SETFL, fcntl(fd,F_GETFL) | O_NONBLOCK);}while(0)
+
+typedef struct {
+    struct qlistnode qnode;
+    int ClientFd;
+    QCQMIMSG qmi[0];
+} QMI_PROXY_MSG;
+
+typedef struct {
+    struct qlistnode qnode;
+    uint8_t QMIType;
+    uint8_t ClientId;
+    unsigned AccessTime;
+} QMI_PROXY_CLINET;
+
+typedef struct {
+    struct qlistnode qnode;
+    struct qlistnode client_qnode;
+    int ClientFd;
+    unsigned AccessTime;
+} QMI_PROXY_CONNECTION;
+
+#ifdef QUECTEL_QMI_MERGE
+#define MERGE_PACKET_IDENTITY 0x2c7c
+#define MERGE_PACKET_VERSION 0x0001
+#define MERGE_PACKET_MAX_PAYLOAD_SIZE 56
+typedef struct __QMI_MSG_HEADER {
+    uint16_t idenity;
+    uint16_t version;
+    uint16_t cur_len;
+    uint16_t total_len;
+} QMI_MSG_HEADER;
+
+typedef struct __QMI_MSG_PACKET {
+    QMI_MSG_HEADER header;
+    uint16_t len;
+    char buf[4096];
+} QMI_MSG_PACKET;
+#endif
+
+static int qmi_proxy_quit = 0;
+static pthread_t thread_id = 0;
+static int cdc_wdm_fd = -1;
+static int qmi_proxy_server_fd = -1;
+static struct qlistnode qmi_proxy_connection;
+static struct qlistnode qmi_proxy_ctl_msg;
+static int verbose_debug = 0;
+static int modem_reset_flag = 0;
+static int qmi_sync_done = 0;
+static uint8_t qmi_buf[4096];
+
+static int send_qmi_to_cdc_wdm(PQCQMIMSG pQMI);
+
+#ifdef QUECTEL_QMI_MERGE
+static int merge_qmi_rsp_packet(void *buf, ssize_t *src_size) {
+    static QMI_MSG_PACKET s_QMIPacket;
+    QMI_MSG_HEADER *header = NULL;
+    ssize_t size = *src_size;
+
+    if((uint16_t)size < sizeof(QMI_MSG_HEADER))
+        return -1;
+
+    header = (QMI_MSG_HEADER *)buf;
+    if(le16toh(header->idenity) != MERGE_PACKET_IDENTITY || le16toh(header->version) != MERGE_PACKET_VERSION || le16toh(header->cur_len) > le16toh(header->total_len)) 
+        return -1;
+
+    if(le16toh(header->cur_len) == le16toh(header->total_len)) {
+        *src_size = le16toh(header->total_len);
+        memcpy(buf, buf + sizeof(QMI_MSG_HEADER), *src_size);
+        s_QMIPacket.len = 0;  
+        return 0;
+    } 
+
+    memcpy(s_QMIPacket.buf + s_QMIPacket.len, buf + sizeof(QMI_MSG_HEADER), le16toh(header->cur_len));
+    s_QMIPacket.len += le16toh(header->cur_len);
+
+    if (le16toh(header->cur_len) < MERGE_PACKET_MAX_PAYLOAD_SIZE || s_QMIPacket.len >= le16toh(header->total_len)) { 
+       memcpy(buf, s_QMIPacket.buf, s_QMIPacket.len);      
+       *src_size = s_QMIPacket.len;
+       s_QMIPacket.len = 0;
+       return 0;           
+    }
+
+    return -1;
+}
+#endif
+
+static int create_local_server(const char *name) {
+    int sockfd = -1;
+    int reuse_addr = 1;
+    struct sockaddr_un sockaddr;
+    socklen_t alen;
+
+    /*Create server socket*/
+    SYSCHECK(sockfd = socket(AF_LOCAL, SOCK_STREAM, 0));
+
+    memset(&sockaddr, 0, sizeof(sockaddr));
+    sockaddr.sun_family = AF_LOCAL;
+    sockaddr.sun_path[0] = 0;
+    memcpy(sockaddr.sun_path + 1, name, strlen(name) );
+
+    alen = strlen(name) + offsetof(struct sockaddr_un, sun_path) + 1;
+    SYSCHECK(setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &reuse_addr,sizeof(reuse_addr)));
+    if(bind(sockfd, (struct sockaddr *)&sockaddr, alen) < 0) {
+        dprintf("bind %s errno: %d (%s)\n", name, errno, strerror(errno));
+        close(sockfd);
+        return -1;
+    }
+
+    dprintf("local server: %s sockfd = %d\n", name, sockfd);
+    cfmakenoblock(sockfd);
+    listen(sockfd, 1);    
+
+    return sockfd;
+}
+
+static void accept_qmi_connection(int serverfd) {
+    int clientfd = -1;
+    unsigned char addr[128];
+    socklen_t alen = sizeof(addr);
+    QMI_PROXY_CONNECTION *qmi_con;
+
+    clientfd = accept(serverfd, (struct sockaddr *)addr, &alen);
+
+    qmi_con = (QMI_PROXY_CONNECTION *)malloc(sizeof(QMI_PROXY_CONNECTION));
+    if (qmi_con) {
+        qlist_init(&qmi_con->qnode);
+        qlist_init(&qmi_con->client_qnode);
+        qmi_con->ClientFd= clientfd;
+        qmi_con->AccessTime = 0;
+        dprintf("+++ ClientFd=%d\n", qmi_con->ClientFd);
+        qlist_add_tail(&qmi_proxy_connection, &qmi_con->qnode);
+    }
+
+    cfmakenoblock(clientfd);
+}
+
+static void cleanup_qmi_connection(int clientfd, int clientDisconnect) {
+    struct qlistnode *con_node, *qmi_node;
+    
+    qlist_for_each(con_node, &qmi_proxy_connection) {
+        QMI_PROXY_CONNECTION *qmi_con = qnode_to_item(con_node, QMI_PROXY_CONNECTION, qnode);
+
+        if (qmi_con->ClientFd == clientfd) {
+            while (!qlist_empty(&qmi_con->client_qnode)) {
+                QMI_PROXY_CLINET *qmi_client = qnode_to_item(qlist_head(&qmi_con->client_qnode), QMI_PROXY_CLINET, qnode);
+
+                if (clientDisconnect) {
+                    int size = 17;
+                    QMI_PROXY_MSG *qmi_msg = malloc(sizeof(QMI_PROXY_MSG) + size);
+                    PQCQMIMSG pQMI = &qmi_msg->qmi[0];
+
+                    dprintf("xxx ClientFd=%d QMIType=%d ClientId=%d\n", qmi_con->ClientFd, qmi_client->QMIType, qmi_client->ClientId);
+                    qlist_init(&qmi_msg->qnode);
+                    qmi_msg->ClientFd = qmi_proxy_server_fd;
+                    pQMI->QMIHdr.IFType   = USB_CTL_MSG_TYPE_QMI;
+                    pQMI->QMIHdr.Length = htole16(16);
+                    pQMI->QMIHdr.CtlFlags = 0x00;
+                    pQMI->QMIHdr.QMIType  = QMUX_TYPE_CTL;
+                    pQMI->QMIHdr.ClientId= 0x00;
+                    pQMI->CTLMsg.ReleaseClientIdReq.CtlFlags = QMICTL_FLAG_REQUEST;
+                    pQMI->CTLMsg.ReleaseClientIdReq.TransactionId = 255;    
+                    pQMI->CTLMsg.ReleaseClientIdReq.QMICTLType = htole16(QMICTL_RELEASE_CLIENT_ID_REQ);
+                    pQMI->CTLMsg.ReleaseClientIdReq.Length = htole16(5);
+                    pQMI->CTLMsg.ReleaseClientIdReq.TLVType = QCTLV_TYPE_REQUIRED_PARAMETER;
+                    pQMI->CTLMsg.ReleaseClientIdReq.TLVLength = htole16(2);
+                    pQMI->CTLMsg.ReleaseClientIdReq.QMIType = qmi_client->QMIType;
+                    pQMI->CTLMsg.ReleaseClientIdReq.ClientId = qmi_client->ClientId;
+
+                    if (qlist_empty(&qmi_proxy_ctl_msg))
+                        send_qmi_to_cdc_wdm(pQMI);
+                    qlist_add_tail(&qmi_proxy_ctl_msg, &qmi_msg->qnode);
+                }
+                
+                qlist_remove(&qmi_client->qnode);
+                free(qmi_client);
+            }
+           
+            qlist_for_each(qmi_node, &qmi_proxy_ctl_msg) {
+                QMI_PROXY_MSG *qmi_msg = qnode_to_item(qmi_node, QMI_PROXY_MSG, qnode);
+
+                if (qmi_msg->ClientFd == qmi_con->ClientFd) {
+                    qlist_remove(&qmi_msg->qnode);
+                    free(qmi_msg);
+                    break;
+                 }
+            }
+
+            dprintf("--- ClientFd=%d\n", qmi_con->ClientFd);    
+            close(qmi_con->ClientFd);
+            qlist_remove(&qmi_con->qnode);
+            free(qmi_con);
+            break;
+        }
+    }
+}
+
+static void get_client_id(QMI_PROXY_CONNECTION *qmi_con, PQMICTL_GET_CLIENT_ID_RESP_MSG pClient) {
+    if (pClient->QMIResult == 0 && pClient->QMIError == 0) {
+        QMI_PROXY_CLINET *qmi_client = (QMI_PROXY_CLINET *)malloc(sizeof(QMI_PROXY_CLINET));
+
+        qlist_init(&qmi_client->qnode);
+        qmi_client->QMIType = pClient->QMIType;
+        qmi_client->ClientId = pClient->ClientId;
+        qmi_client->AccessTime = 0;
+
+        dprintf("+++ ClientFd=%d QMIType=%d ClientId=%d\n", qmi_con->ClientFd, qmi_client->QMIType, qmi_client->ClientId);
+        qlist_add_tail(&qmi_con->client_qnode, &qmi_client->qnode);
+    }
+}
+
+static void release_client_id(QMI_PROXY_CONNECTION *qmi_con, PQMICTL_RELEASE_CLIENT_ID_RESP_MSG pClient) {
+    struct qlistnode *client_node;
+    
+    if (pClient->QMIResult == 0 && pClient->QMIError == 0) {
+        qlist_for_each (client_node, &qmi_con->client_qnode) {
+            QMI_PROXY_CLINET *qmi_client = qnode_to_item(client_node, QMI_PROXY_CLINET, qnode);
+            
+            if (pClient->QMIType == qmi_client->QMIType && pClient->ClientId == qmi_client->ClientId) {
+                dprintf("--- ClientFd=%d QMIType=%d ClientId=%d\n", qmi_con->ClientFd, qmi_client->QMIType, qmi_client->ClientId);
+                qlist_remove(&qmi_client->qnode);
+                free(qmi_client);
+                break;
+            }
+        }
+    }
+}
+
+static void dump_qmi(PQCQMIMSG pQMI, int fd, const char flag)
+{
+    if (verbose_debug)
+    {
+        unsigned i;
+        unsigned size = le16toh(pQMI->QMIHdr.Length) + 1;
+        char buf[128];
+        int cnt = 0;
+
+        cnt += snprintf(buf + cnt, sizeof(buf) - cnt, "%c %d %u: ", flag, fd, size);
+        for (i = 0; i < size && i < 24; i++)
+            cnt += snprintf(buf + cnt, sizeof(buf) - cnt, "%02x ", ((uint8_t *)pQMI)[i]);
+        dprintf("%s\n", buf)
+    }
+}
+
+static int send_qmi_to_cdc_wdm(PQCQMIMSG pQMI) {
+    struct pollfd pollfds[]= {{cdc_wdm_fd, POLLOUT, 0}};
+    ssize_t ret = 0;
+
+    do {
+        ret = poll(pollfds, sizeof(pollfds)/sizeof(pollfds[0]), 5000);
+    } while (ret == -1 && errno == EINTR && qmi_proxy_quit == 0);
+
+    if (pollfds[0].revents & POLLOUT) {
+        ssize_t size = le16toh(pQMI->QMIHdr.Length) + 1;
+        ret = write(cdc_wdm_fd, pQMI, size);
+        dump_qmi(pQMI, cdc_wdm_fd, 'w');
+    }
+
+    return ret;
+}
+
+static int send_qmi_to_client(PQCQMIMSG pQMI, int clientFd) {
+    struct pollfd pollfds[]= {{clientFd, POLLOUT, 0}};
+    ssize_t ret = 0;
+
+    do {
+        ret = poll(pollfds, sizeof(pollfds)/sizeof(pollfds[0]), 5000);
+    } while (ret == -1 && errno == EINTR && qmi_proxy_quit == 0);
+
+    if (pollfds[0].revents & POLLOUT) {
+        ssize_t size = le16toh(pQMI->QMIHdr.Length) + 1;
+        ret = write(clientFd, pQMI, size);
+        dump_qmi(pQMI, clientFd, 'w');
+    }
+
+    return ret;
+}
+
+static void recv_qmi_from_dev(PQCQMIMSG pQMI) {
+    struct qlistnode *con_node, *client_node;
+
+    if (qmi_proxy_server_fd == -1) {
+        qmi_sync_done = 1;
+    }
+    else if (pQMI->QMIHdr.QMIType == QMUX_TYPE_CTL) {
+        if (pQMI->CTLMsg.QMICTLMsgHdr.CtlFlags == QMICTL_CTL_FLAG_RSP) {            
+            if (!qlist_empty(&qmi_proxy_ctl_msg)) {
+                QMI_PROXY_MSG *qmi_msg = qnode_to_item(qlist_head(&qmi_proxy_ctl_msg), QMI_PROXY_MSG, qnode);
+
+                if (qmi_msg->qmi[0].CTLMsg.QMICTLMsgHdrRsp.TransactionId != pQMI->CTLMsg.QMICTLMsgHdrRsp.TransactionId
+                    || qmi_msg->qmi[0].CTLMsg.QMICTLMsgHdrRsp.QMICTLType != pQMI->CTLMsg.QMICTLMsgHdrRsp.QMICTLType) {
+                    dprintf("ERROR: ctl rsp tid:%d, type:%d - ctl req %d, %d\n",
+                        pQMI->CTLMsg.QMICTLMsgHdrRsp.TransactionId, pQMI->CTLMsg.QMICTLMsgHdrRsp.QMICTLType,
+                        qmi_msg->qmi[0].CTLMsg.QMICTLMsgHdrRsp.TransactionId, qmi_msg->qmi[0].CTLMsg.QMICTLMsgHdrRsp.QMICTLType);
+                }
+                else if (qmi_msg->ClientFd == qmi_proxy_server_fd) {
+                    if (le16toh(pQMI->CTLMsg.QMICTLMsgHdrRsp.QMICTLType) == QMICTL_RELEASE_CLIENT_ID_RESP) {
+                        dprintf("--- ClientFd=%d QMIType=%d ClientId=%d\n", qmi_proxy_server_fd,
+                                pQMI->CTLMsg.ReleaseClientIdRsp.QMIType,  pQMI->CTLMsg.ReleaseClientIdRsp.ClientId);
+                    }
+                }
+                else {
+                    qlist_for_each(con_node, &qmi_proxy_connection) {
+                        QMI_PROXY_CONNECTION *qmi_con = qnode_to_item(con_node, QMI_PROXY_CONNECTION, qnode);
+
+                        if (qmi_con->ClientFd == qmi_msg->ClientFd) {
+                            send_qmi_to_client(pQMI, qmi_msg->ClientFd);
+
+                            if (le16toh(pQMI->CTLMsg.QMICTLMsgHdrRsp.QMICTLType) == QMICTL_GET_CLIENT_ID_RESP) {
+                                get_client_id(qmi_con, &pQMI->CTLMsg.GetClientIdRsp);                                                        
+                            }
+                            else if (le16toh(pQMI->CTLMsg.QMICTLMsgHdrRsp.QMICTLType) == QMICTL_RELEASE_CLIENT_ID_RESP) {
+                                release_client_id(qmi_con, &pQMI->CTLMsg.ReleaseClientIdRsp);
+                            }
+                            else {
+                            }
+                        }
+                    }
+                }
+
+                qlist_remove(&qmi_msg->qnode);
+                free(qmi_msg);
+
+                if (!qlist_empty(&qmi_proxy_ctl_msg)) {
+                    QMI_PROXY_MSG *qmi_msg = qnode_to_item(qlist_head(&qmi_proxy_ctl_msg), QMI_PROXY_MSG, qnode);
+
+                    send_qmi_to_cdc_wdm(qmi_msg->qmi);
+                }
+            }
+        } 
+        else if (pQMI->QMIHdr.QMIType == QMICTL_CTL_FLAG_IND) {
+            if (le16toh(pQMI->CTLMsg.QMICTLMsgHdrRsp.QMICTLType) == QMICTL_REVOKE_CLIENT_ID_IND) {
+                modem_reset_flag = 1;
+            }
+        }
+    }
+    else  {
+        qlist_for_each(con_node, &qmi_proxy_connection) {
+            QMI_PROXY_CONNECTION *qmi_con = qnode_to_item(con_node, QMI_PROXY_CONNECTION, qnode);
+            
+            qlist_for_each(client_node, &qmi_con->client_qnode) {
+                QMI_PROXY_CLINET *qmi_client = qnode_to_item(client_node, QMI_PROXY_CLINET, qnode);
+                if (pQMI->QMIHdr.QMIType == qmi_client->QMIType) {
+                    if (pQMI->QMIHdr.ClientId == 0 || pQMI->QMIHdr.ClientId == qmi_client->ClientId) {
+                        send_qmi_to_client(pQMI, qmi_con->ClientFd);
+                    }
+                }
+            }
+        }
+    }
+}
+
+static int recv_qmi_from_client(PQCQMIMSG pQMI, unsigned size, int clientfd) {
+    if (qmi_proxy_server_fd == -1)
+        return -1;
+
+    if (pQMI->QMIHdr.QMIType == QMUX_TYPE_CTL) {  
+        QMI_PROXY_MSG *qmi_msg;
+
+        if (pQMI->CTLMsg.QMICTLMsgHdr.QMICTLType == QMICTL_SYNC_REQ) {
+            dprintf("do not allow client send QMICTL_SYNC_REQ\n");
+            return 0;
+        }
+
+        qmi_msg = malloc(sizeof(QMI_PROXY_MSG) + size);
+        qlist_init(&qmi_msg->qnode);
+        qmi_msg->ClientFd = clientfd;
+        memcpy(qmi_msg->qmi, pQMI, size);
+
+        if (qlist_empty(&qmi_proxy_ctl_msg))
+            send_qmi_to_cdc_wdm(pQMI);
+        qlist_add_tail(&qmi_proxy_ctl_msg, &qmi_msg->qnode);
+    }
+    else {
+        send_qmi_to_cdc_wdm(pQMI);
+    }
+
+    return 0;
+}
+
+static int qmi_proxy_init(unsigned retry) {
+    unsigned i;
+    QCQMIMSG _QMI;
+    PQCQMIMSG pQMI = &_QMI;
+
+    dprintf("%s enter\n", __func__);
+
+    pQMI->QMIHdr.IFType   = USB_CTL_MSG_TYPE_QMI;
+    pQMI->QMIHdr.CtlFlags = 0x00;
+    pQMI->QMIHdr.QMIType  = QMUX_TYPE_CTL;
+    pQMI->QMIHdr.ClientId= 0x00;
+    
+    pQMI->CTLMsg.QMICTLMsgHdr.CtlFlags = QMICTL_FLAG_REQUEST;
+
+    qmi_sync_done = 0;
+    for (i = 0; i < retry; i++) {
+        pQMI->CTLMsg.SyncReq.TransactionId = i+1;    
+        pQMI->CTLMsg.SyncReq.QMICTLType = htole16(QMICTL_SYNC_REQ);
+        pQMI->CTLMsg.SyncReq.Length = htole16(0);
+
+        pQMI->QMIHdr.Length = 
+            htole16(le16toh(pQMI->CTLMsg.QMICTLMsgHdr.Length) + sizeof(QCQMI_HDR) + sizeof(QCQMICTL_MSG_HDR) - 1);
+
+        if (send_qmi_to_cdc_wdm(pQMI) <= 0)
+            break;
+
+        sleep(1);
+        if (qmi_sync_done)
+            break;
+    }
+
+    dprintf("%s %s\n", __func__, qmi_sync_done ? "succful" : "fail");
+    return qmi_sync_done ? 0 : -1;
+}
+
+static void *qmi_proxy_loop(void *param)
+{
+    PQCQMIMSG pQMI = (PQCQMIMSG)qmi_buf;
+    struct qlistnode *con_node;
+    QMI_PROXY_CONNECTION *qmi_con;
+
+    (void)param;
+    dprintf("%s enter thread_id %p\n", __func__, (void *)pthread_self());
+
+    qlist_init(&qmi_proxy_connection);
+    qlist_init(&qmi_proxy_ctl_msg);
+
+    while (cdc_wdm_fd > 0 && qmi_proxy_quit == 0) {
+        struct pollfd pollfds[2+64];
+        int ne, ret, nevents = 0;
+        ssize_t nreads;
+
+        pollfds[nevents].fd = cdc_wdm_fd;
+        pollfds[nevents].events = POLLIN;
+        pollfds[nevents].revents= 0;
+        nevents++;
+        
+        if (qmi_proxy_server_fd > 0) {
+            pollfds[nevents].fd = qmi_proxy_server_fd;
+            pollfds[nevents].events = POLLIN;
+            pollfds[nevents].revents= 0;
+            nevents++;
+        }
+
+        qlist_for_each(con_node, &qmi_proxy_connection) {
+            qmi_con = qnode_to_item(con_node, QMI_PROXY_CONNECTION, qnode);
+            
+            pollfds[nevents].fd = qmi_con->ClientFd;
+            pollfds[nevents].events = POLLIN;
+            pollfds[nevents].revents= 0;
+            nevents++;
+
+            if (nevents == (sizeof(pollfds)/sizeof(pollfds[0])))
+                break;
+        }
+
+#if 0
+        dprintf("poll ");
+        for (ne = 0; ne < nevents; ne++) {
+            dprintf("%d ", pollfds[ne].fd);
+        }
+        dprintf("\n");
+#endif
+
+        do {
+            //ret = poll(pollfds, nevents, -1);
+            ret = poll(pollfds, nevents, (qmi_proxy_server_fd > 0) ? -1 : 200);
+        } while (ret == -1 && errno == EINTR && qmi_proxy_quit == 0);
+         
+        if (ret < 0) {
+            dprintf("%s poll=%d, errno: %d (%s)\n", __func__, ret, errno, strerror(errno));
+            goto qmi_proxy_loop_exit;
+        }
+
+        for (ne = 0; ne < nevents; ne++) {
+            int fd = pollfds[ne].fd;
+            short revents = pollfds[ne].revents;
+
+            if (revents & (POLLERR | POLLHUP | POLLNVAL)) {
+                dprintf("%s poll fd = %d, revents = %04x\n", __func__, fd, revents);
+                if (fd == cdc_wdm_fd) {
+                    goto qmi_proxy_loop_exit;
+                } else if(fd == qmi_proxy_server_fd) {
+                
+                } else {
+                    cleanup_qmi_connection(fd, 1);
+                }
+
+                continue;
+            }
+
+            if (!(pollfds[ne].revents & POLLIN)) {
+                continue;
+            }
+
+            if (fd == qmi_proxy_server_fd) {
+                accept_qmi_connection(fd);
+            }
+            else if (fd == cdc_wdm_fd) {
+                nreads = read(fd, pQMI, sizeof(qmi_buf));
+                if (nreads <= 0) {
+                    dprintf("%s read=%d errno: %d (%s)\n",  __func__, (int)nreads, errno, strerror(errno));
+                    goto qmi_proxy_loop_exit;
+                }
+#ifdef QUECTEL_QMI_MERGE
+                if(merge_qmi_rsp_packet(pQMI, &nreads))
+                    continue;             
+#endif
+                if (nreads != (le16toh(pQMI->QMIHdr.Length) + 1)) {
+                    dprintf("%s nreads=%d,  pQCQMI->QMIHdr.Length = %d\n",  __func__, (int)nreads, le16toh(pQMI->QMIHdr.Length));
+                    continue;
+                }
+
+                dump_qmi(pQMI, fd, 'r');
+                recv_qmi_from_dev(pQMI);
+                if (modem_reset_flag)
+                    goto qmi_proxy_loop_exit;
+            }
+            else {
+                nreads = read(fd, pQMI, sizeof(qmi_buf));
+  
+                if (nreads <= 0) {
+                    dprintf("%s read=%d errno: %d (%s)",  __func__, (int)nreads, errno, strerror(errno));
+                    cleanup_qmi_connection(fd, 1);
+                    break;
+                }
+
+                if (nreads != (le16toh(pQMI->QMIHdr.Length) + 1)) {
+                    dprintf("%s nreads=%d,  pQCQMI->QMIHdr.Length = %d\n",  __func__, (int)nreads, le16toh(pQMI->QMIHdr.Length));
+                    continue;
+                }
+
+                dump_qmi(pQMI, fd, 'r');
+                recv_qmi_from_client(pQMI, nreads, fd);
+            }
+        }
+    }
+
+qmi_proxy_loop_exit:
+    while (!qlist_empty(&qmi_proxy_connection)) {
+        QMI_PROXY_CONNECTION *qmi_con = qnode_to_item(qlist_head(&qmi_proxy_connection), QMI_PROXY_CONNECTION, qnode);
+
+        cleanup_qmi_connection(qmi_con->ClientFd, 0);
+    }
+    
+    dprintf("%s exit, thread_id %p\n", __func__, (void *)pthread_self());
+
+    return NULL;
+}
+
+static void usage(void) {
+    dprintf(" -d <device_name>                      A valid qmi device\n"
+            "                                       default /dev/cdc-wdm0, but cdc-wdm0 may be invalid\n"
+            " -i <netcard_name>                     netcard name\n"
+            " -v                                    Will show all details\n");
+}
+
+static void sig_action(int sig) {
+    if (qmi_proxy_quit++ == 0) {
+        if (thread_id)
+            pthread_kill(thread_id, sig);
+    }
+}
+
+int main(int argc, char *argv[]) {
+    int opt;
+    char cdc_wdm[32+1] = "/dev/cdc-wdm0";
+    char servername[64] = {0};
+
+    optind = 1;
+
+    signal(SIGINT, sig_action);
+
+    while ( -1 != (opt = getopt(argc, argv, "d:i:vh"))) {
+        switch (opt) {
+            case 'd':
+                strcpy(cdc_wdm, optarg);
+                break;
+            case 'v':
+                verbose_debug = 1;
+                break;
+            default:
+                usage();
+                return 0;
+        }
+    }
+
+    sprintf(servername, "quectel-qmi-proxy%c", cdc_wdm[strlen(cdc_wdm)-1]);
+    dprintf("Will use cdc-wdm='%s', proxy='%s'\n", cdc_wdm, servername);
+
+    while (qmi_proxy_quit == 0) {
+        cdc_wdm_fd = open(cdc_wdm, O_RDWR | O_NONBLOCK | O_NOCTTY);
+        if (cdc_wdm_fd == -1) {
+            dprintf("Failed to open %s, errno: %d (%s)\n", cdc_wdm, errno, strerror(errno));
+            sleep(3);
+            continue;
+        }
+        cfmakenoblock(cdc_wdm_fd);
+        
+        /* no qmi_proxy_loop lives, create one */
+        pthread_create(&thread_id, NULL, qmi_proxy_loop, NULL);
+
+        if (qmi_proxy_init(60) == 0) {
+            qmi_proxy_server_fd = create_local_server(servername);
+            dprintf("qmi_proxy_server_fd = %d\n", qmi_proxy_server_fd);
+            if (qmi_proxy_server_fd == -1) {
+                dprintf("Failed to create %s, errno: %d (%s)\n", servername, errno, strerror(errno));
+                pthread_cancel(thread_id);
+            }
+        }
+        else {
+            pthread_cancel(thread_id);
+        }
+
+        pthread_join(thread_id, NULL);
+        thread_id = 0;
+
+        if (qmi_proxy_server_fd != -1) {
+            dprintf("close server %s\n", servername);
+            close(qmi_proxy_server_fd);
+            qmi_proxy_server_fd = -1;
+        }
+        close(cdc_wdm_fd);
+        cdc_wdm_fd = -1;
+
+        if (qmi_proxy_quit == 0)
+            sleep(modem_reset_flag ? 30 : 3);
+        modem_reset_flag = 0;
+    }
+
+    return 0;
+}
diff --git a/RM520N-5G/文件/source/quectel-qrtr-proxy.c b/RM520N-5G/文件/source/quectel-qrtr-proxy.c
new file mode 100644
index 0000000..77a6914
--- /dev/null
+++ b/RM520N-5G/文件/source/quectel-qrtr-proxy.c
@@ -0,0 +1,902 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/ioctl.h>
+#include <linux/un.h>
+#include <linux/if.h>
+#include <dirent.h>
+#include <signal.h>
+#include <inttypes.h>
+#include <linux/socket.h>
+#include <linux/qrtr.h>
+
+#define QRTR_PROTO_VER_1 1
+struct qrtr_hdr_v1 {
+	__le32 version;
+	__le32 type;
+	__le32 src_node_id;
+	__le32 src_port_id;
+	__le32 confirm_rx;
+	__le32 size;
+	__le32 dst_node_id;
+	__le32 dst_port_id;
+} __attribute__ ((packed));
+
+#include "qendian.h"
+#include "qlist.h"
+#include "QCQMI.h"
+#include "QCQCTL.h"
+#include "QCQMUX.h"
+
+static const char * get_time(void) {
+    static char time_buf[128];
+    struct timeval  tv;
+    time_t time;
+    suseconds_t millitm;
+    struct tm *ti;
+
+    gettimeofday (&tv, NULL);
+
+    time= tv.tv_sec;
+    millitm = (tv.tv_usec + 500) / 1000;
+
+    if (millitm == 1000) {
+        ++time;
+        millitm = 0;
+    }
+
+    ti = localtime(&time);
+    sprintf(time_buf, "[%02d-%02d_%02d:%02d:%02d:%03d]", ti->tm_mon+1, ti->tm_mday, ti->tm_hour, ti->tm_min, ti->tm_sec, (int)millitm);
+    return time_buf;
+}
+
+#define dprintf(fmt, args...) do { fprintf(stdout, "%s " fmt, get_time(), ##args); } while(0);
+#define SYSCHECK(c) do{if((c)<0) {dprintf("%s %d error: '%s' (code: %d)\n", __func__, __LINE__, strerror(errno), errno); return -1;}}while(0)
+#define cfmakenoblock(fd) do{fcntl(fd, F_SETFL, fcntl(fd,F_GETFL) | O_NONBLOCK);}while(0)
+#define align_4(_len) (((_len) + 3) & ~3)
+
+typedef struct {
+    struct qlistnode qnode;
+    int ClientFd;
+    QCQMIMSG qrtr[0];
+} QRTR_PROXY_MSG;
+
+typedef struct {
+    struct qlistnode qnode;
+    uint8_t QMIType;
+    uint8_t ClientId;
+    uint32_t node_id;
+    uint32_t port_id;
+    unsigned AccessTime;
+} QRTR_PROXY_CLINET;
+
+typedef struct {
+    struct qlistnode qnode;
+    struct qlistnode client_qnode;
+    int ClientFd;
+    unsigned AccessTime;
+} QRTR_PROXY_CONNECTION;
+
+typedef struct {
+    struct qlistnode qnode;
+    uint32_t service;
+    uint32_t version;
+    uint32_t instance;
+    uint32_t node;
+    uint32_t port;
+
+    __le32 src_node_id;
+    __le32 src_port_id;
+} QRTR_SERVICE;
+
+static int qrtr_proxy_quit = 0;
+static pthread_t thread_id = 0;
+static int cdc_wdm_fd = -1;
+static int qrtr_proxy_server_fd = -1;
+static struct qlistnode qrtr_proxy_connection;
+static struct qlistnode qrtr_server_list;
+static int verbose_debug = 0;
+static uint32_t node_modem = 3; //IPQ ~ 3, QCM ~ 0
+static uint32_t node_myself = 1;
+
+static QRTR_SERVICE *find_qrtr_service(uint8_t QMIType)
+{
+    struct qlistnode *node;
+
+    qlist_for_each (node, &qrtr_server_list) {
+        QRTR_SERVICE *srv = qnode_to_item(node, QRTR_SERVICE, qnode);
+        if (srv->service == QMIType)
+            return srv;
+    }
+        
+    return NULL;
+}
+
+static uint8_t client_bitmap[0xf0];
+static uint8_t port_bitmap[0xff0];
+static int alloc_client_id(void) {
+    int id = 1;
+
+    for (id = 1; id < (int)sizeof(client_bitmap); id++) {
+        if (client_bitmap[id] == 0) {
+            client_bitmap[id] = id;
+            return id;
+        }
+    }
+
+    dprintf("NOT find %s()\n", __func__);
+    return 0;
+}
+
+static void free_client_id(int id) {
+    if (id < (int)sizeof(client_bitmap) && client_bitmap[id] == id) {
+        client_bitmap[id] = 0;
+        return;
+    }
+    dprintf("NOT find %s(id=%d)\n", __func__, id);
+}
+
+static int alloc_port_id(void) {
+    int id = 1;
+
+    for (id = 1; id < (int)sizeof(port_bitmap); id++) {
+        if (port_bitmap[id] == 0) {
+            port_bitmap[id] = id;
+            return id;
+        }
+    }
+
+    dprintf("NOT find %s()\n", __func__);
+   return 0;
+}
+
+static void free_port_id(int id) {
+    if (id < (int)sizeof(port_bitmap) && port_bitmap[id] == id) {
+        port_bitmap[id] = 0;
+        return;
+    }
+    dprintf("NOT find %s(id=%d)\n", __func__, id);
+}
+
+static void dump_qrtr(void *buf, size_t len, char flag)
+{
+    size_t i;
+    static char printf_buf[1024];
+    int cnt = 0, limit=1024;
+    unsigned char *d = (unsigned char *)buf;
+    struct qrtr_hdr_v1 *hdr = (struct qrtr_hdr_v1 *)buf;
+    const char *ctrl_pkt_strings[] = {
+    	[QRTR_TYPE_DATA]	= "data",
+    	[QRTR_TYPE_HELLO]	= "hello",
+    	[QRTR_TYPE_BYE]		= "bye",
+    	[QRTR_TYPE_NEW_SERVER]	= "new-server",
+    	[QRTR_TYPE_DEL_SERVER]	= "del-server",
+    	[QRTR_TYPE_DEL_CLIENT]	= "del-client",
+    	[QRTR_TYPE_RESUME_TX]	= "resume-tx",
+    	[QRTR_TYPE_EXIT]	= "exit",
+    	[QRTR_TYPE_PING]	= "ping",
+    	[QRTR_TYPE_NEW_LOOKUP]	= "new-lookup",
+    	[QRTR_TYPE_DEL_LOOKUP]	= "del-lookup",
+    };
+
+    for (i = 0; i < len && i < 64; i++) {
+        if (i%4 == 0)
+            cnt += snprintf(printf_buf+cnt, limit-cnt, " ");
+        cnt += snprintf(printf_buf+cnt, limit-cnt, "%02x", d[i]);
+    }
+    dprintf("%s\n", printf_buf);
+
+    dprintf("%c ver=%d, type=%d(%s), %x,%x -> %x,%x, confirm_rx=%d, size=%u\n",
+        flag,
+        le32toh(hdr->version), le32toh(hdr->type), ctrl_pkt_strings[le32toh(hdr->type)],
+        le32toh(hdr->src_node_id), le32toh(hdr->src_port_id), le32toh(hdr->dst_node_id), le32toh(hdr->dst_port_id),
+        le32toh(hdr->confirm_rx), le32toh(hdr->size));
+}
+
+static int send_qmi_to_client(PQCQMIMSG pQMI, int fd) {
+    struct pollfd pollfds[]= {{fd, POLLOUT, 0}};
+    ssize_t ret = 0;
+    ssize_t size = le16toh(pQMI->QMIHdr.Length) + 1;
+
+    do {
+        ret = poll(pollfds, sizeof(pollfds)/sizeof(pollfds[0]), 5000);
+    } while (ret == -1 && errno == EINTR && qrtr_proxy_quit == 0);
+
+    if (pollfds[0].revents & POLLOUT) {
+        ret = write(fd, pQMI, size);
+    }
+
+    return ret == size ? 0 : -1;
+}
+
+static int send_qrtr_to_dev(struct qrtr_hdr_v1 *hdr, int fd) {
+    struct pollfd pollfds[]= {{fd, POLLOUT, 0}};
+    ssize_t ret = 0;
+    ssize_t size = align_4(le32toh(hdr->size) + sizeof(*hdr));
+
+    do {
+        ret = poll(pollfds, sizeof(pollfds)/sizeof(pollfds[0]), 5000);
+    } while (ret == -1 && errno == EINTR && qrtr_proxy_quit == 0);
+
+    if (pollfds[0].revents & POLLOUT) {
+        ret = write(fd, hdr, size);
+    }
+
+    return ret == size ? 0 : -1;
+}
+
+static int qrtr_node_enqueue(const void *data, size_t len,
+			     int type, struct sockaddr_qrtr *from,
+			     struct sockaddr_qrtr *to, unsigned int confirm_rx)
+{
+    int rc = -1;
+    size_t size = sizeof(struct qrtr_hdr_v1) + len;
+    struct qrtr_hdr_v1 *hdr = (struct qrtr_hdr_v1 *)malloc(align_4(size));
+
+    if (hdr) {
+        hdr->version = htole32(QRTR_PROTO_VER_1);
+        hdr->type = htole32(type);
+        hdr->src_node_id = htole32(from->sq_node);
+        hdr->src_port_id = htole32(from->sq_port);
+        hdr->dst_node_id = htole32(to->sq_node);
+        hdr->dst_port_id = htole32(to->sq_port);
+        hdr->size = htole32(len);
+        hdr->confirm_rx = htole32(!!confirm_rx);
+
+        memcpy(hdr + 1, data, len);
+        dump_qrtr(hdr, size, '>');
+        send_qrtr_to_dev(hdr, cdc_wdm_fd);
+        free(hdr);
+    }
+
+    return rc;
+}
+
+static int send_ctrl_hello(__u32 sq_node, __u32 sq_port)
+{
+    struct qrtr_ctrl_pkt pkt;
+    int rc;
+    struct sockaddr_qrtr to = {AF_QIPCRTR, sq_node, sq_port};
+    struct sockaddr_qrtr from = {AF_QIPCRTR, node_myself, QRTR_PORT_CTRL};
+
+    memset(&pkt, 0, sizeof(pkt));
+    pkt.cmd =  htole32(QRTR_TYPE_HELLO);
+
+    rc = qrtr_node_enqueue(&pkt, sizeof(pkt), QRTR_TYPE_HELLO, &from, &to, 0);
+    if (rc < 0)
+        return rc;
+
+    return 0;
+}
+
+static int ctrl_cmd_del_client(__u32 sq_node, __u32 sq_port, uint8_t QMIType) 
+{
+    struct qrtr_ctrl_pkt pkt;
+    int rc;
+    struct sockaddr_qrtr to = {AF_QIPCRTR, QRTR_NODE_BCAST, QRTR_PORT_CTRL};
+    struct sockaddr_qrtr from = {AF_QIPCRTR, sq_node, sq_port};
+    QRTR_SERVICE *srv = find_qrtr_service(QMIType);
+
+    if (srv) {
+        to.sq_node = srv->src_node_id;
+    }
+
+    memset(&pkt, 0, sizeof(pkt));
+    pkt.cmd = htole32(QRTR_TYPE_DEL_CLIENT);
+    pkt.client.node = htole32(sq_node);
+    pkt.client.port = htole32(sq_port);
+
+    rc = qrtr_node_enqueue(&pkt, sizeof(pkt), QRTR_TYPE_DATA, &from, &to, 0);
+    if (rc < 0)
+        return rc;
+
+    return 0;
+}
+
+static void handle_server_change(struct qrtr_hdr_v1 *hdr) {
+    struct qrtr_ctrl_pkt *pkt = (struct qrtr_ctrl_pkt *)(hdr + 1);
+    QRTR_SERVICE *s;
+
+    dprintf ("[qrtr] %s  server on %u:%u(%u:%u) -> service %u, instance %x\n",
+            QRTR_TYPE_NEW_SERVER == hdr->type ? "add" : "remove",
+             le32toh(pkt->server.node), le32toh(pkt->server.port),
+             le32toh(hdr->src_node_id),  le32toh(hdr->src_port_id),
+             le32toh(pkt->server.service), le32toh(pkt->server.instance));
+
+    if (le32toh(pkt->server.node) != node_modem) {
+        return; //we only care modem
+    }
+
+    s = (QRTR_SERVICE *)malloc(sizeof(QRTR_SERVICE));
+    if (!s)
+        return;
+
+    qlist_init(&s->qnode);
+    s->service = le32toh(pkt->server.service);
+    s->version = le32toh(pkt->server.instance) & 0xff;
+    s->instance = le32toh(pkt->server.instance) >> 8;
+    s->node = le32toh(pkt->server.node);
+    s->port = le32toh(pkt->server.port);
+
+    s->src_node_id = le32toh(hdr->src_node_id);
+    s->src_port_id = le32toh(hdr->src_port_id);
+
+    if (QRTR_TYPE_NEW_SERVER == hdr->type) {
+        qlist_add_tail(&qrtr_server_list, &s->qnode);
+    }
+    else if (QRTR_TYPE_DEL_SERVER == hdr->type) {
+        qlist_remove(&s->qnode);
+    }
+}
+
+static int create_local_server(const char *name) {
+    int sockfd = -1;
+    int reuse_addr = 1;
+    struct sockaddr_un sockaddr;
+    socklen_t alen;
+
+    /*Create server socket*/
+    SYSCHECK(sockfd = socket(AF_LOCAL, SOCK_STREAM, 0));
+
+    memset(&sockaddr, 0, sizeof(sockaddr));
+    sockaddr.sun_family = AF_LOCAL;
+    sockaddr.sun_path[0] = 0;
+    memcpy(sockaddr.sun_path + 1, name, strlen(name) );
+
+    alen = strlen(name) + offsetof(struct sockaddr_un, sun_path) + 1;
+    SYSCHECK(setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &reuse_addr,sizeof(reuse_addr)));
+    if(bind(sockfd, (struct sockaddr *)&sockaddr, alen) < 0) {
+        close(sockfd);
+        dprintf("bind %s errno: %d (%s)\n", name, errno, strerror(errno));
+        return -1;
+    }
+
+    dprintf("local server: %s sockfd = %d\n", name, sockfd);
+    cfmakenoblock(sockfd);
+    listen(sockfd, 1);    
+
+    return sockfd;
+}
+
+static uint8_t alloc_qrtr_client_id(QRTR_PROXY_CONNECTION *qrtr_con, uint8_t QMIType) {
+    QRTR_PROXY_CLINET *qrtr_client = (QRTR_PROXY_CLINET *)malloc(sizeof(QRTR_PROXY_CLINET));
+
+    qlist_init(&qrtr_client->qnode);
+    qrtr_client->QMIType = QMIType;
+    qrtr_client->ClientId = alloc_client_id();
+    qrtr_client->node_id = 1;
+    qrtr_client->port_id = alloc_port_id();
+    qrtr_client->AccessTime = 0;
+
+    dprintf("+++ ClientFd=%d QMIType=%d ClientId=%d, node_id=%d, port_id=%d\n",
+        qrtr_con->ClientFd, qrtr_client->QMIType, qrtr_client->ClientId,
+        qrtr_client->node_id, qrtr_client->port_id);
+    qlist_add_tail(&qrtr_con->client_qnode, &qrtr_client->qnode);
+
+    return qrtr_client->ClientId;
+}
+
+static void release_qrtr_client_id(QRTR_PROXY_CONNECTION *qrtr_con, uint8_t QMIType, uint8_t ClientId) {
+    struct qlistnode *client_node;
+    int find = 0;
+
+    qlist_for_each (client_node, &qrtr_con->client_qnode) {
+        QRTR_PROXY_CLINET *qrtr_client = qnode_to_item(client_node, QRTR_PROXY_CLINET, qnode);
+        
+        if (QMIType == qrtr_client->QMIType && ClientId == qrtr_client->ClientId) {
+            dprintf("--- ClientFd=%d QMIType=%d ClientId=%d, node_id=%d, port_id=%d\n",
+                qrtr_con->ClientFd, qrtr_client->QMIType, qrtr_client->ClientId,
+                qrtr_client->node_id, qrtr_client->port_id);
+            ctrl_cmd_del_client(qrtr_client->node_id, qrtr_client->port_id, qrtr_client->QMIType);
+            free_client_id(qrtr_client->ClientId);
+            free_port_id(qrtr_client->port_id);
+            qlist_remove(&qrtr_client->qnode);
+            free(qrtr_client);
+            find++;
+            break;
+        }
+    }
+
+    if (!find) {
+        dprintf("NOT find on %s(ClientFd=%d, QMIType=%d, ClientId=%d)\n",
+            __func__, qrtr_con->ClientFd, QMIType, ClientId);
+    }
+}
+
+static void accept_qrtr_connection(int serverfd) {
+    int clientfd = -1;
+    unsigned char addr[128];
+    socklen_t alen = sizeof(addr);
+    QRTR_PROXY_CONNECTION *qrtr_con;
+
+    clientfd = accept(serverfd, (struct sockaddr *)addr, &alen);
+
+    qrtr_con = (QRTR_PROXY_CONNECTION *)malloc(sizeof(QRTR_PROXY_CONNECTION));
+    if (qrtr_con) {
+        qlist_init(&qrtr_con->qnode);
+        qlist_init(&qrtr_con->client_qnode);
+        qrtr_con->ClientFd= clientfd;
+        qrtr_con->AccessTime = 0;
+        dprintf("+++ ClientFd=%d\n", qrtr_con->ClientFd);
+        qlist_add_tail(&qrtr_proxy_connection, &qrtr_con->qnode);
+    }
+
+    cfmakenoblock(clientfd);
+}
+
+static void cleanup_qrtr_connection(int clientfd) {
+    struct qlistnode *con_node;
+    int find = 0;
+    
+    qlist_for_each(con_node, &qrtr_proxy_connection) {
+        QRTR_PROXY_CONNECTION *qrtr_con = qnode_to_item(con_node, QRTR_PROXY_CONNECTION, qnode);
+
+        if (qrtr_con->ClientFd == clientfd) {
+            while (!qlist_empty(&qrtr_con->client_qnode)) {
+                QRTR_PROXY_CLINET *qrtr_client = qnode_to_item(qlist_head(&qrtr_con->client_qnode), QRTR_PROXY_CLINET, qnode);
+
+                release_qrtr_client_id(qrtr_con, qrtr_client->QMIType, qrtr_client->ClientId);
+            }
+           
+            dprintf("--- ClientFd=%d\n", qrtr_con->ClientFd);    
+            close(qrtr_con->ClientFd);
+            qlist_remove(&qrtr_con->qnode);
+            free(qrtr_con);
+            find = 1;
+            break;
+        }
+    }
+
+    if (!find) {
+        dprintf("NOT find on %s(ClientFd=%d)\n", __func__, clientfd);
+    }
+}
+
+static void recv_qrtr_from_dev(struct qrtr_hdr_v1 *hdr) {
+    int find = 0;
+    uint32_t type = le32toh(hdr->type);
+
+    if (type == QRTR_TYPE_HELLO) {
+        send_ctrl_hello(le32toh(hdr->src_node_id), le32toh(hdr->src_port_id));
+        find++;
+    }
+    else if (type == QRTR_TYPE_NEW_SERVER || type == QRTR_TYPE_DEL_SERVER) {
+        handle_server_change(hdr);
+        find++;
+    }
+    else if (type == QRTR_TYPE_DATA) {
+        struct qlistnode *con_node, *client_node;
+
+        qlist_for_each(con_node, &qrtr_proxy_connection) {
+            QRTR_PROXY_CONNECTION *qrtr_con = qnode_to_item(con_node, QRTR_PROXY_CONNECTION, qnode);
+            
+            qlist_for_each(client_node, &qrtr_con->client_qnode) {
+                QRTR_PROXY_CLINET *qrtr_client = qnode_to_item(client_node, QRTR_PROXY_CLINET, qnode);
+
+                if (qrtr_client->node_id == le32toh(hdr->dst_node_id) && qrtr_client->port_id == le32toh(hdr->dst_port_id)) {
+                    PQCQMIMSG pQMI = (PQCQMIMSG)malloc(hdr->size + sizeof(QCQMI_HDR));
+
+                    if (pQMI) {
+                        pQMI->QMIHdr.IFType = USB_CTL_MSG_TYPE_QMI;
+                        pQMI->QMIHdr.Length = htole16(hdr->size + sizeof(QCQMI_HDR) - 1);
+                        pQMI->QMIHdr.CtlFlags = 0x00;
+                        pQMI->QMIHdr.QMIType = qrtr_client->QMIType;
+                        pQMI->QMIHdr.ClientId = qrtr_client->ClientId;
+                        memcpy(&pQMI->MUXMsg, hdr + 1, hdr->size);
+                        send_qmi_to_client(pQMI, qrtr_con->ClientFd);
+                        free(pQMI);
+                        find++;
+                    }
+                }
+            }
+        }
+
+        if (hdr->confirm_rx) {
+            struct qrtr_ctrl_pkt pkt;
+            struct sockaddr_qrtr from = {AF_QIPCRTR, le32toh(hdr->dst_node_id), le32toh(hdr->dst_port_id)};
+            struct sockaddr_qrtr to = {AF_QIPCRTR, le32toh(hdr->src_node_id), le32toh(hdr->src_port_id)};
+
+            memset(&pkt, 0, sizeof(pkt));
+            pkt.cmd = htole32(QRTR_TYPE_RESUME_TX);
+            pkt.client.node = hdr->dst_node_id;
+            pkt.client.port = hdr->dst_port_id;
+
+            qrtr_node_enqueue(&pkt, sizeof(pkt), QRTR_TYPE_RESUME_TX, &from, &to, 0);
+        }
+    }
+    else if (type == QRTR_TYPE_RESUME_TX) {
+    }
+
+    if (!find) {
+        dprintf("NOT find on %s()\n", __func__);
+    }    
+}
+
+static int recv_qmi_from_client(PQCQMIMSG pQMI, int clientfd) {
+    QRTR_PROXY_CONNECTION *qrtr_con;
+    struct qlistnode *con_node, *client_node;
+    int find = 0;
+
+    qlist_for_each(con_node, &qrtr_proxy_connection) {
+        qrtr_con = qnode_to_item(con_node, QRTR_PROXY_CONNECTION, qnode);
+        if (qrtr_con->ClientFd == clientfd)
+            break;
+        qrtr_con = NULL;
+    }
+
+    if (!qrtr_con) {
+        return -1;
+    }
+            
+    if (le16toh(pQMI->QMIHdr.QMIType) == QMUX_TYPE_CTL) {  
+        if (pQMI->CTLMsg.QMICTLMsgHdr.QMICTLType == QMICTL_SYNC_REQ) {
+            dprintf("do not allow client send QMICTL_SYNC_REQ\n");
+            return 0;
+        }
+        else if (le16toh(pQMI->CTLMsg.QMICTLMsgHdr.QMICTLType) == QMICTL_GET_CLIENT_ID_REQ) {
+            uint8_t QMIType = pQMI->CTLMsg.GetClientIdReq.QMIType;
+            PQCQMIMSG pRsp = (PQCQMIMSG)malloc(256);
+
+            if (pRsp) {
+                uint8_t ClientId = 0;
+
+                if (find_qrtr_service(QMIType)) {
+                    ClientId = alloc_qrtr_client_id(qrtr_con, QMIType);
+                }
+
+                pRsp->QMIHdr.IFType = USB_CTL_MSG_TYPE_QMI;
+                pRsp->QMIHdr.Length = htole16(sizeof(pRsp->CTLMsg.GetClientIdRsp) + sizeof(pRsp->QMIHdr) - 1);
+                pRsp->QMIHdr.CtlFlags = 0x00;
+                pRsp->QMIHdr.QMIType = QMUX_TYPE_CTL;
+                pRsp->QMIHdr.ClientId = 0;
+
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.CtlFlags = QMICTL_FLAG_RESPONSE;
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.TransactionId = pQMI->CTLMsg.QMICTLMsgHdr.TransactionId;
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.QMICTLType = pQMI->CTLMsg.QMICTLMsgHdr.QMICTLType;
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.Length = htole16(sizeof(pRsp->CTLMsg.GetClientIdRsp) - sizeof(pRsp->CTLMsg.QMICTLMsgHdr));
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.TLVType = QCTLV_TYPE_RESULT_CODE;
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.TLVLength = htole16(4);
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.QMUXResult = htole16(ClientId ? 0 : QMI_RESULT_FAILURE);
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.QMUXError = htole16(ClientId ? 0 : QMI_ERR_INTERNAL);
+                pRsp->CTLMsg.GetClientIdRsp.TLV2Type = QCTLV_TYPE_REQUIRED_PARAMETER;
+                pRsp->CTLMsg.GetClientIdRsp.TLV2Length = htole16(2);
+                pRsp->CTLMsg.GetClientIdRsp.QMIType = QMIType;
+                pRsp->CTLMsg.GetClientIdRsp.ClientId = ClientId;
+
+                send_qmi_to_client(pRsp, clientfd);
+                free(pRsp);
+                find++;
+            }
+        }
+        else if (le16toh(pQMI->CTLMsg.QMICTLMsgHdr.QMICTLType) == QMICTL_RELEASE_CLIENT_ID_REQ) {
+            PQCQMIMSG pRsp = (PQCQMIMSG)malloc(256);
+            release_qrtr_client_id(qrtr_con, pQMI->CTLMsg.ReleaseClientIdReq.QMIType, pQMI->CTLMsg.ReleaseClientIdReq.ClientId);
+
+            if (pRsp) {
+                pRsp->QMIHdr.IFType = USB_CTL_MSG_TYPE_QMI;
+                pRsp->QMIHdr.Length = htole16(sizeof(pRsp->CTLMsg.ReleaseClientIdRsp) + sizeof(pRsp->QMIHdr) - 1);
+                pRsp->QMIHdr.CtlFlags = 0x00;
+                pRsp->QMIHdr.QMIType = QMUX_TYPE_CTL;
+                pRsp->QMIHdr.ClientId = 0;
+
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.CtlFlags = QMICTL_FLAG_RESPONSE;
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.TransactionId = pQMI->CTLMsg.QMICTLMsgHdr.TransactionId;
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.QMICTLType = pQMI->CTLMsg.QMICTLMsgHdr.QMICTLType;
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.Length = htole16(sizeof(pRsp->CTLMsg.ReleaseClientIdRsp) - sizeof(pRsp->CTLMsg.QMICTLMsgHdr));
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.TLVType = QCTLV_TYPE_RESULT_CODE;
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.TLVLength = htole16(4);
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.QMUXResult = htole16(0);
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.QMUXError = htole16(0);
+                pRsp->CTLMsg.ReleaseClientIdRsp.TLV2Type = QCTLV_TYPE_REQUIRED_PARAMETER;
+                pRsp->CTLMsg.ReleaseClientIdRsp.TLV2Length = htole16(2);
+                pRsp->CTLMsg.ReleaseClientIdRsp.QMIType = pQMI->CTLMsg.ReleaseClientIdReq.QMIType;
+                pRsp->CTLMsg.ReleaseClientIdRsp.ClientId = pQMI->CTLMsg.ReleaseClientIdReq.ClientId;
+
+                send_qmi_to_client(pRsp, clientfd);
+                free(pRsp);
+                find++;
+            }
+        }
+        else if (le16toh(pQMI->CTLMsg.QMICTLMsgHdr.QMICTLType) == QMICTL_GET_VERSION_REQ) {
+            PQCQMIMSG pRsp = (PQCQMIMSG)malloc(256);
+
+            if (pRsp) {
+                pRsp->QMIHdr.IFType = USB_CTL_MSG_TYPE_QMI;
+                pRsp->QMIHdr.Length = htole16(sizeof(pRsp->CTLMsg.GetVersionRsp) + sizeof(pRsp->QMIHdr) - 1);
+                pRsp->QMIHdr.CtlFlags = 0x00;
+                pRsp->QMIHdr.QMIType = QMUX_TYPE_CTL;
+                pRsp->QMIHdr.ClientId = 0;
+
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.CtlFlags = QMICTL_FLAG_RESPONSE;
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.TransactionId = pQMI->CTLMsg.QMICTLMsgHdr.TransactionId;
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.QMICTLType = pQMI->CTLMsg.QMICTLMsgHdr.QMICTLType;
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.Length = htole16(sizeof(pRsp->CTLMsg.GetVersionRsp) - sizeof(pRsp->CTLMsg.QMICTLMsgHdr));
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.TLVType = QCTLV_TYPE_RESULT_CODE;
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.TLVLength = htole16(4);
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.QMUXResult = htole16(0);
+                pRsp->CTLMsg.QMICTLMsgHdrRsp.QMUXError = htole16(0);
+                pRsp->CTLMsg.GetVersionRsp.TLV2Type = QCTLV_TYPE_REQUIRED_PARAMETER;
+                pRsp->CTLMsg.GetVersionRsp.TLV2Length = htole16(1);
+                pRsp->CTLMsg.GetVersionRsp.NumElements = 0;
+
+                send_qmi_to_client(pRsp, clientfd);
+                free(pRsp);
+                find++;
+            }
+        }
+    }
+    else {
+        qlist_for_each (client_node, &qrtr_con->client_qnode) {
+            QRTR_PROXY_CLINET *qrtr_client = qnode_to_item(client_node, QRTR_PROXY_CLINET, qnode);
+            
+            if (pQMI->QMIHdr.QMIType == qrtr_client->QMIType && pQMI->QMIHdr.ClientId == qrtr_client->ClientId) {
+                QRTR_SERVICE *srv = find_qrtr_service(pQMI->QMIHdr.QMIType);
+
+                if (srv && srv->service) {
+                    struct sockaddr_qrtr from = {AF_QIPCRTR, qrtr_client->node_id, qrtr_client->port_id};
+                    struct sockaddr_qrtr to = {AF_QIPCRTR, srv->node, srv->port};
+
+                    qrtr_node_enqueue(&pQMI->MUXMsg, le16toh(pQMI->QMIHdr.Length) + 1 - sizeof(QCQMI_HDR),
+                        QRTR_TYPE_DATA, &from, &to, 0);
+                    find++;
+                }
+                break;
+            }
+        }
+    }
+
+    if (!find) {
+        dprintf("NOT find on %s()\n", __func__);
+    } 
+
+    return 0;
+}
+
+static int qrtr_proxy_init(void) {
+    unsigned i;
+    int qrtr_sync_done = 0;
+
+    dprintf("%s enter\n", __func__);
+    send_ctrl_hello(QRTR_NODE_BCAST, QRTR_PORT_CTRL);
+
+    for (i = 0; i < 10; i++) {
+        sleep(1);
+        qrtr_sync_done = !qlist_empty(&qrtr_server_list);
+        if (qrtr_sync_done)
+            break;
+    }
+
+    dprintf("%s %s\n", __func__, qrtr_sync_done ? "succful" : "fail");
+    return qrtr_sync_done ? 0 : -1;
+}
+
+static void qrtr_start_server(const char* servername) {
+    qrtr_proxy_server_fd = create_local_server(servername);
+    dprintf("qrtr_proxy_server_fd = %d\n", qrtr_proxy_server_fd);
+    if (qrtr_proxy_server_fd == -1) {
+        dprintf("Failed to create %s, errno: %d (%s)\n", servername, errno, strerror(errno));
+    }
+}
+
+static void qrtr_close_server(const char* servername) {
+    if (qrtr_proxy_server_fd != -1) {
+        dprintf("%s %s\n", __func__, servername);
+        close(qrtr_proxy_server_fd);
+        qrtr_proxy_server_fd = -1;
+    }
+}
+
+static void *qrtr_proxy_loop(void *param)
+{
+    void *rx_buf;
+    struct qlistnode *con_node;
+    QRTR_PROXY_CONNECTION *qrtr_con;
+
+    (void)param;
+    dprintf("%s enter thread_id %p\n", __func__, (void *)pthread_self());
+    
+    rx_buf = malloc(8192);
+    if (!rx_buf)
+        return NULL;
+
+    while (cdc_wdm_fd > 0 && qrtr_proxy_quit == 0) {
+        struct pollfd pollfds[32];
+        int ne, ret, nevents = 0;
+        ssize_t nreads;
+
+        pollfds[nevents].fd = cdc_wdm_fd;
+        pollfds[nevents].events = POLLIN;
+        pollfds[nevents].revents= 0;
+        nevents++;
+        
+        if (qrtr_proxy_server_fd > 0) {
+            pollfds[nevents].fd = qrtr_proxy_server_fd;
+            pollfds[nevents].events = POLLIN;
+            pollfds[nevents].revents= 0;
+            nevents++;
+        }
+
+        qlist_for_each(con_node, &qrtr_proxy_connection) {
+            qrtr_con = qnode_to_item(con_node, QRTR_PROXY_CONNECTION, qnode);
+            
+            pollfds[nevents].fd = qrtr_con->ClientFd;
+            pollfds[nevents].events = POLLIN;
+            pollfds[nevents].revents= 0;
+            nevents++;
+
+            if (nevents == (sizeof(pollfds)/sizeof(pollfds[0])))
+                break;
+        }
+
+        do {
+            //ret = poll(pollfds, nevents, -1);
+            ret = poll(pollfds, nevents, (qrtr_proxy_server_fd > 0) ? -1 : 200);
+         } while (ret == -1 && errno == EINTR && qrtr_proxy_quit == 0);
+         
+        if (ret < 0) {
+            dprintf("%s poll=%d, errno: %d (%s)\n", __func__, ret, errno, strerror(errno));
+            goto qrtr_proxy_loop_exit;
+        }
+
+        for (ne = 0; ne < nevents; ne++) {
+            int fd = pollfds[ne].fd;
+            short revents = pollfds[ne].revents;
+
+            if (revents & (POLLERR | POLLHUP | POLLNVAL)) {
+                dprintf("%s poll fd = %d, revents = %04x\n", __func__, fd, revents);
+                if (fd == cdc_wdm_fd) {
+                    goto qrtr_proxy_loop_exit;
+                }
+                else if (fd == qrtr_proxy_server_fd) {
+                
+                }
+                else {
+                    cleanup_qrtr_connection(fd);
+                }
+
+                continue;
+            }
+
+            if (!(pollfds[ne].revents & POLLIN)) {
+                continue;
+            }
+
+            if (fd == qrtr_proxy_server_fd) {
+                accept_qrtr_connection(fd);
+            }
+            else if (fd == cdc_wdm_fd) {
+                struct qrtr_hdr_v1 *hdr = (struct qrtr_hdr_v1 *)rx_buf;
+
+                nreads = read(fd, rx_buf, 8192);
+                if (nreads <= 0) {
+                    dprintf("%s read=%d errno: %d (%s)\n",  __func__, (int)nreads, errno, strerror(errno));
+                    goto qrtr_proxy_loop_exit;
+                }
+                else if (nreads != (int)align_4(le32toh(hdr->size) + sizeof(*hdr))) {
+                    dprintf("%s nreads=%d,  hdr->size = %d\n",  __func__, (int)nreads, le32toh(hdr->size));
+                    continue;
+                }
+
+                dump_qrtr(hdr, nreads, '<');
+                recv_qrtr_from_dev(hdr);
+            }
+            else {
+                PQCQMIMSG pQMI = (PQCQMIMSG)rx_buf;
+
+                nreads = read(fd, rx_buf, 8192);
+                if (nreads <= 0) {
+                    dprintf("%s read=%d errno: %d (%s)",  __func__, (int)nreads, errno, strerror(errno));
+                    cleanup_qrtr_connection(fd);
+                    break;
+                }
+                else if (nreads != (le16toh(pQMI->QMIHdr.Length) + 1)) {
+                    dprintf("%s nreads=%d,  pQCQMI->QMIHdr.Length = %d\n",  __func__, (int)nreads, le16toh(pQMI->QMIHdr.Length));
+                    continue;
+                }
+
+                recv_qmi_from_client(pQMI, fd);
+            }
+        }
+    }
+
+qrtr_proxy_loop_exit:
+    while (!qlist_empty(&qrtr_proxy_connection)) {
+        QRTR_PROXY_CONNECTION *qrtr_con = qnode_to_item(qlist_head(&qrtr_proxy_connection), QRTR_PROXY_CONNECTION, qnode);
+
+        cleanup_qrtr_connection(qrtr_con->ClientFd);
+    }
+    
+    dprintf("%s exit, thread_id %p\n", __func__, (void *)pthread_self());
+    free(rx_buf);
+
+    return NULL;
+}
+
+static void usage(void) {
+    dprintf(" -d <device_name>                      A valid qrtr device\n"
+            "                                       default /dev/mhi_IPCR, but mhi_IPCR may be invalid\n"
+            " -i <netcard_name>                     netcard name\n"
+            " -v                                    Will show all details\n");
+}
+
+static void sig_action(int sig) {
+    if (qrtr_proxy_quit == 0) {
+        qrtr_proxy_quit = 1;
+        if (thread_id)
+            pthread_kill(thread_id, sig);
+    }
+}
+
+int main(int argc, char *argv[]) {
+    int opt;
+    char cdc_wdm[32+1] = "/dev/mhi_IPCR";
+    char servername[64] = {0};
+
+    signal(SIGINT, sig_action);
+    signal(SIGTERM, sig_action);
+
+    optind = 1;
+    while ( -1 != (opt = getopt(argc, argv, "d:i:vh"))) {
+        switch (opt) {
+            case 'd':
+                strcpy(cdc_wdm, optarg);
+                break;
+            case 'v':
+                verbose_debug = 1;
+                break;
+            default:
+                usage();
+                return 0;
+        }
+    }
+
+    sprintf(servername, "quectel-qrtr-proxy%c", cdc_wdm[strlen(cdc_wdm)-1]);
+    dprintf("Will use cdc-wdm='%s', proxy='%s'\n", cdc_wdm, servername);
+
+    while (qrtr_proxy_quit == 0) {
+        cdc_wdm_fd = open(cdc_wdm, O_RDWR | O_NONBLOCK | O_NOCTTY);
+        if (cdc_wdm_fd == -1) {
+            dprintf("Failed to open %s, errno: %d (%s)\n", cdc_wdm, errno, strerror(errno));
+            sleep(5);
+            continue;
+        }
+        cfmakenoblock(cdc_wdm_fd);
+        qlist_init(&qrtr_proxy_connection);
+        qlist_init(&qrtr_server_list);
+        pthread_create(&thread_id, NULL, qrtr_proxy_loop, NULL);
+
+        if (qrtr_proxy_init() == 0) {
+            qrtr_start_server(servername);
+            pthread_join(thread_id, NULL);
+            qrtr_close_server(servername);
+        }
+        else {
+            pthread_cancel(thread_id);
+            pthread_join(thread_id, NULL);
+        }
+
+        close(cdc_wdm_fd);
+    }
+
+    return 0;
+}
diff --git a/RM520N-5G/文件/source/rmnetctl.c b/RM520N-5G/文件/source/rmnetctl.c
new file mode 100644
index 0000000..1ccc59d
--- /dev/null
+++ b/RM520N-5G/文件/source/rmnetctl.c
@@ -0,0 +1,508 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+//https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/dataservices/tree/rmnetctl
+#include <sys/socket.h>
+#include <stdint.h>
+#include <linux/netlink.h>
+#include <string.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <linux/rtnetlink.h>
+#include <linux/gen_stats.h>
+#include <net/if.h>
+#include <asm/types.h>
+#include <linux/rmnet_data.h>
+#include "QMIThread.h"
+
+#undef RMNET_EGRESS_FORMAT_AGGREGATION //QSDK SPF11.4
+#define RMNET_EGRESS_FORMAT_AGGREGATION         (1U << 31)
+#ifndef RMNET_FLAGS_INGRESS_MAP_CKSUMV5
+#define RMNET_FLAGS_INGRESS_MAP_CKSUMV5           (1U << 5)
+#define RMNET_FLAGS_EGRESS_MAP_CKSUMV5            (1U << 6)
+#endif
+
+#define RMNETCTL_SUCCESS 0
+#define RMNETCTL_LIB_ERR 1
+#define RMNETCTL_KERNEL_ERR 2
+#define RMNETCTL_INVALID_ARG 3
+
+#define CONFIG_QRTR_IPQ_NSS_OFFLOAD //defined for ipq nss offload support
+
+enum rmnetctl_error_codes_e {
+    RMNETCTL_API_SUCCESS = 0,
+
+    RMNETCTL_API_FIRST_ERR = 1,
+    RMNETCTL_API_ERR_MESSAGE_SEND = 3,
+    RMNETCTL_API_ERR_MESSAGE_RECEIVE = 4,
+
+    RMNETCTL_INIT_FIRST_ERR = 5,
+    RMNETCTL_INIT_ERR_PROCESS_ID = RMNETCTL_INIT_FIRST_ERR,
+    RMNETCTL_INIT_ERR_NETLINK_FD = 6,
+    RMNETCTL_INIT_ERR_BIND = 7,
+
+    RMNETCTL_API_SECOND_ERR = 9,
+    RMNETCTL_API_ERR_HNDL_INVALID = RMNETCTL_API_SECOND_ERR,
+    RMNETCTL_API_ERR_RETURN_TYPE = 13,
+
+    RMNETCTL_API_THIRD_ERR = 25,
+    /* Failed to copy data into netlink message */
+    RMNETCTL_API_ERR_RTA_FAILURE = RMNETCTL_API_THIRD_ERR,
+};
+
+struct rmnetctl_hndl_s {
+     uint32_t pid;
+     uint32_t transaction_id;
+     int netlink_fd;
+     struct sockaddr_nl src_addr, dest_addr;
+};
+typedef struct rmnetctl_hndl_s rmnetctl_hndl_t;
+
+#define NLMSG_TAIL(nmsg) \
+    ((struct rtattr *) (((char *)(nmsg)) + NLMSG_ALIGN((nmsg)->nlmsg_len)))
+
+struct nlmsg {
+    struct nlmsghdr nl_addr;
+    struct ifinfomsg ifmsg;
+    char data[500];
+};
+
+#define MIN_VALID_PROCESS_ID 0
+#define MIN_VALID_SOCKET_FD 0
+#define KERNEL_PROCESS_ID 0
+#define UNICAST 0
+
+/* IFLA Attributes for the RT RmNet driver */
+enum {
+    RMNETCTL_IFLA_UNSPEC,
+    RMNETCTL_IFLA_MUX_ID,
+    RMNETCTL_IFLA_FLAGS,
+    RMNETCTL_IFLA_DFC_QOS,
+    RMNETCTL_IFLA_UPLINK_PARAMS,
+    RMNETCTL_IFLA_NSS_OFFLOAD,
+    __RMNETCTL_IFLA_MAX,
+};
+
+struct rmnetctl_uplink_params {
+    uint16_t byte_count;
+    uint8_t packet_count;
+    uint8_t features;
+    uint32_t time_limit;
+};
+
+static void rta_parse(struct rtattr **tb, int maxtype, struct rtattr *head,
+              int len)
+{
+    struct rtattr *rta;
+
+    memset(tb, 0, sizeof(struct rtattr *) * maxtype);
+    for (rta = head; RTA_OK(rta, len);
+         rta = RTA_NEXT(rta, len)) {
+        __u16 type = rta->rta_type & NLA_TYPE_MASK;
+
+        if (type > 0 && type < maxtype)
+            tb[type] = rta;
+    }
+}
+
+static struct rtattr *rta_find(struct rtattr *rta, int attrlen, uint16_t type)
+{
+    for (; RTA_OK(rta, attrlen); rta = RTA_NEXT(rta, attrlen)) {
+        if (rta->rta_type == (type & NLA_TYPE_MASK))
+            return rta;
+    }
+
+    return NULL;
+}
+
+static struct rtattr * rta_put(struct nlmsg *req,int type, int len, void *data)
+{
+    struct rtattr *attrinfo = NLMSG_TAIL(&req->nl_addr);
+
+    attrinfo->rta_type = type;
+    attrinfo->rta_len = RTA_ALIGN(RTA_LENGTH(len));
+    if (data && len)
+        memcpy(RTA_DATA(attrinfo), data, len);
+    req->nl_addr.nlmsg_len = NLMSG_ALIGN(req->nl_addr.nlmsg_len) +
+                RTA_ALIGN(RTA_LENGTH(len));
+    return attrinfo;
+}
+
+static int rmnet_get_ack(rmnetctl_hndl_t *hndl, uint16_t *error_code)
+{
+    struct nlack {
+        struct nlmsghdr ackheader;
+        struct nlmsgerr ackdata;
+        char   data[256];
+
+    } ack;
+    int i;
+
+    if (!hndl || !error_code)
+        return RMNETCTL_INVALID_ARG;
+
+    if ((i = recv(hndl->netlink_fd, &ack, sizeof(ack), 0)) < 0) {
+        *error_code = errno;
+        return RMNETCTL_API_ERR_MESSAGE_RECEIVE;
+    }
+
+    /*Ack should always be NLMSG_ERROR type*/
+    if (ack.ackheader.nlmsg_type == NLMSG_ERROR) {
+        if (ack.ackdata.error == 0) {
+            *error_code = RMNETCTL_API_SUCCESS;
+            return RMNETCTL_SUCCESS;
+        } else {
+            *error_code = -ack.ackdata.error;
+            return RMNETCTL_KERNEL_ERR;
+        }
+    }
+
+    *error_code = RMNETCTL_API_ERR_RETURN_TYPE;
+    return RMNETCTL_API_FIRST_ERR;
+}
+
+static int rtrmnet_ctl_init(rmnetctl_hndl_t **hndl, uint16_t *error_code)
+{
+    struct sockaddr_nl __attribute__((__may_alias__)) *saddr_ptr;
+    int netlink_fd = -1;
+    pid_t pid = 0;
+
+    if (!hndl || !error_code)
+        return RMNETCTL_INVALID_ARG;
+
+    *hndl = (rmnetctl_hndl_t *)malloc(sizeof(rmnetctl_hndl_t));
+    if (!*hndl) {
+        *error_code = RMNETCTL_API_ERR_HNDL_INVALID;
+        return RMNETCTL_LIB_ERR;
+    }
+
+    memset(*hndl, 0, sizeof(rmnetctl_hndl_t));
+
+    pid = getpid();
+    if (pid  < MIN_VALID_PROCESS_ID) {
+        free(*hndl);
+        *error_code = RMNETCTL_INIT_ERR_PROCESS_ID;
+        return RMNETCTL_LIB_ERR;
+    }
+    (*hndl)->pid = KERNEL_PROCESS_ID;
+    netlink_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
+    if (netlink_fd < MIN_VALID_SOCKET_FD) {
+        free(*hndl);
+        *error_code = RMNETCTL_INIT_ERR_NETLINK_FD;
+        return RMNETCTL_LIB_ERR;
+    }
+
+    (*hndl)->netlink_fd = netlink_fd;
+
+    memset(&(*hndl)->src_addr, 0, sizeof(struct sockaddr_nl));
+
+    (*hndl)->src_addr.nl_family = AF_NETLINK;
+    (*hndl)->src_addr.nl_pid = (*hndl)->pid;
+
+    saddr_ptr = &(*hndl)->src_addr;
+    if (bind((*hndl)->netlink_fd,
+        (struct sockaddr *)saddr_ptr,
+        sizeof(struct sockaddr_nl)) < 0) {
+        close((*hndl)->netlink_fd);
+        free(*hndl);
+        *error_code = RMNETCTL_INIT_ERR_BIND;
+        return RMNETCTL_LIB_ERR;
+    }
+
+    memset(&(*hndl)->dest_addr, 0, sizeof(struct sockaddr_nl));
+
+    (*hndl)->dest_addr.nl_family = AF_NETLINK;
+    (*hndl)->dest_addr.nl_pid = KERNEL_PROCESS_ID;
+    (*hndl)->dest_addr.nl_groups = UNICAST;
+
+    return RMNETCTL_SUCCESS;
+}
+
+static int rtrmnet_ctl_deinit(rmnetctl_hndl_t *hndl)
+{
+    if (!hndl)
+        return RMNETCTL_SUCCESS;
+
+    close(hndl->netlink_fd);
+    free(hndl);
+
+    return RMNETCTL_SUCCESS;
+}
+
+static int rtrmnet_ctl_newvnd(rmnetctl_hndl_t *hndl, char *devname, char *vndname,
+               uint16_t *error_code, uint8_t  index,
+               uint32_t flagconfig, uint32_t ul_agg_cnt, uint32_t ul_agg_size)
+{
+    struct rtattr *datainfo, *linkinfo;
+    struct ifla_vlan_flags flags;
+    int devindex;
+    char *kind = "rmnet";
+    struct nlmsg req;
+    short id;
+
+    if (!hndl || !devname || !vndname || !error_code)
+        return RMNETCTL_INVALID_ARG;
+
+    memset(&req, 0, sizeof(req));
+    req.nl_addr.nlmsg_type = RTM_NEWLINK;
+    req.nl_addr.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg));
+    req.nl_addr.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL |
+                  NLM_F_ACK;
+    req.nl_addr.nlmsg_seq = hndl->transaction_id;
+    hndl->transaction_id++;
+
+    /* Get index of devname*/
+    devindex = if_nametoindex(devname);
+    if (devindex < 0) {
+        *error_code = errno;
+        return RMNETCTL_KERNEL_ERR;
+    }
+
+    /* Setup link attr with devindex as data */
+    rta_put(&req, IFLA_LINK, sizeof(devindex), &devindex);
+    rta_put(&req, IFLA_IFNAME, strlen(vndname) + 1, vndname);
+
+    /* Set up IFLA info kind  RMNET that has linkinfo and type */
+    linkinfo = rta_put(&req, IFLA_LINKINFO, 0, NULL);
+    rta_put(&req, IFLA_INFO_KIND, strlen(kind), kind);
+
+    datainfo = rta_put(&req, IFLA_INFO_DATA, 0, NULL);
+    id = index;
+    rta_put(&req, RMNETCTL_IFLA_MUX_ID, sizeof(id), &id);
+
+    if (flagconfig != 0) {
+        flags.mask  = flagconfig;
+        flags.flags = flagconfig;
+
+        rta_put(&req, RMNETCTL_IFLA_FLAGS, sizeof(flags), &flags);
+    }
+
+#ifdef CONFIG_QRTR_IPQ_NSS_OFFLOAD
+    if (!access("/sys/module/rmnet_nss/", F_OK)) {
+        uint8_t offload = 1;
+
+        rta_put(&req, RMNETCTL_IFLA_NSS_OFFLOAD, sizeof(offload), &offload);
+    }
+#endif
+
+    if (ul_agg_cnt > 1) {
+            struct rmnetctl_uplink_params ul_agg;
+
+            ul_agg.byte_count = ul_agg_size;
+            ul_agg.packet_count = ul_agg_cnt;
+            ul_agg.features = 0;
+            ul_agg.time_limit = 3000000;
+
+            rta_put(&req, RMNETCTL_IFLA_UPLINK_PARAMS, sizeof(ul_agg), &ul_agg);
+    }
+
+    datainfo->rta_len = (char *)NLMSG_TAIL(&req.nl_addr) - (char *)datainfo;
+    linkinfo->rta_len = (char *)NLMSG_TAIL(&req.nl_addr) - (char *)linkinfo;
+
+    if (send(hndl->netlink_fd, &req, req.nl_addr.nlmsg_len, 0) < 0) {
+        *error_code = RMNETCTL_API_ERR_MESSAGE_SEND;
+        return RMNETCTL_LIB_ERR;
+    }
+
+    return rmnet_get_ack(hndl, error_code);
+}
+
+int rtrmnet_ctl_new_vnd(char *devname, char *vndname, uint8_t muxid,
+               uint32_t qmap_version, uint32_t ul_agg_cnt, uint32_t ul_agg_size)
+{
+    struct rmnetctl_hndl_s *handle;
+    uint16_t error_code;
+    int return_code;
+    uint32_t flagconfig = RMNET_FLAGS_INGRESS_DEAGGREGATION;
+
+    dbg_time("%s dev: %s, vnd: %s, muxid: %d, qmap_version: %d",
+        __func__, devname, vndname, muxid, qmap_version);
+
+    if (ul_agg_cnt > 1)
+        flagconfig |= RMNET_EGRESS_FORMAT_AGGREGATION;
+
+    if (qmap_version == 9) { //QMAPV5
+        flagconfig |= RMNET_FLAGS_INGRESS_MAP_CKSUMV5;
+        flagconfig |= RMNET_FLAGS_EGRESS_MAP_CKSUMV5;
+    }
+    else if (qmap_version == 5) { //QMAPV1
+    }
+    else {
+        dbg_time("%s donot support qmap_version %d\n", __func__, qmap_version);
+        return -1001;
+    }
+    
+    return_code = rtrmnet_ctl_init(&handle, &error_code);
+    if (return_code != RMNETCTL_SUCCESS) {
+        dbg_time("rtrmnet_ctl_init error_code: %d, return_code: %d, errno: %d (%s)",
+            error_code, return_code, errno, strerror(errno));
+    }
+
+    return_code = rtrmnet_ctl_newvnd(handle, devname, vndname, &error_code,
+        muxid, flagconfig, ul_agg_cnt, ul_agg_size);
+    if (return_code == RMNETCTL_KERNEL_ERR)
+        dbg_time("rtrmnet_ctl_newvnd RMNETCTL_KERNEL_ERR errno: %d (%s)",
+            error_code, strerror(error_code));
+    else if (return_code != RMNETCTL_SUCCESS) {
+        dbg_time("rtrmnet_ctl_newvnd error_code: %d, return_code: %d",
+            error_code, return_code);
+    }
+
+    rtrmnet_ctl_deinit(handle);
+
+    return return_code;
+}
+
+static int rtrmnet_ctl_getvnd(rmnetctl_hndl_t *hndl, char *vndname,
+               uint16_t *error_code, uint16_t *mux_id,
+               uint32_t *flagconfig, struct rmnetctl_uplink_params *ul_agg)
+{
+    struct nlmsg req;
+    struct nlmsghdr *resp;
+    struct rtattr *attrs, *linkinfo, *datainfo;
+    struct rtattr *tb[__RMNETCTL_IFLA_MAX];
+    unsigned int devindex = 0;
+    int resp_len;
+
+    memset(&req, 0, sizeof(req));
+
+    if (!hndl || !vndname || !error_code || !(mux_id || flagconfig))
+        return RMNETCTL_INVALID_ARG;
+
+    req.nl_addr.nlmsg_type = RTM_GETLINK;
+    req.nl_addr.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg));
+    req.nl_addr.nlmsg_flags = NLM_F_REQUEST;
+    req.nl_addr.nlmsg_seq = hndl->transaction_id;
+    hndl->transaction_id++;
+
+    /* Get index of vndname */
+    devindex = if_nametoindex(vndname);
+    if (devindex == 0) {
+        *error_code = errno;
+        return RMNETCTL_KERNEL_ERR;
+    }
+
+    req.ifmsg.ifi_index = devindex;
+    if (send(hndl->netlink_fd, &req, req.nl_addr.nlmsg_len, 0) < 0) {
+        *error_code = RMNETCTL_API_ERR_MESSAGE_SEND;
+        return RMNETCTL_LIB_ERR;
+    }
+
+    resp_len = recv(hndl->netlink_fd, NULL, 0, MSG_PEEK | MSG_TRUNC);
+    if (resp_len < 0) {
+        *error_code = errno;
+        return RMNETCTL_API_ERR_MESSAGE_RECEIVE;
+    }
+
+    resp = malloc((size_t)resp_len);
+    if (!resp) {
+        *error_code = errno;
+        return RMNETCTL_LIB_ERR;
+    }
+
+    resp_len = recv(hndl->netlink_fd, (char *)resp, (size_t)resp_len, 0);
+    if (resp_len < 0) {
+        *error_code = errno;
+        free(resp);
+        return RMNETCTL_API_ERR_MESSAGE_RECEIVE;
+    }
+
+    /* Parse out the RT attributes */
+    attrs = (struct rtattr *)((char *)NLMSG_DATA(resp) + NLMSG_ALIGN(sizeof(req.ifmsg)));
+    linkinfo = rta_find(attrs, NLMSG_PAYLOAD(resp, sizeof(req.ifmsg)), IFLA_LINKINFO);
+    if (!linkinfo) {
+        free(resp);
+        *error_code = RMNETCTL_API_ERR_RTA_FAILURE;
+        return RMNETCTL_KERNEL_ERR;
+    }
+
+    datainfo = rta_find(RTA_DATA(linkinfo), RTA_PAYLOAD(linkinfo), IFLA_INFO_DATA);
+    if (!datainfo) {
+        free(resp);
+        *error_code = RMNETCTL_API_ERR_RTA_FAILURE;
+        return RMNETCTL_KERNEL_ERR;
+    }
+
+    /* Parse all the rmnet-specific information from the kernel */
+    rta_parse(tb, __RMNETCTL_IFLA_MAX, RTA_DATA(datainfo), RTA_PAYLOAD(datainfo));
+    if (tb[RMNETCTL_IFLA_MUX_ID] && mux_id) {
+        *mux_id = *((uint16_t *)RTA_DATA(tb[RMNETCTL_IFLA_MUX_ID]));
+        dbg_time("\tMux id: %d", *mux_id);
+    }
+
+    if (tb[RMNETCTL_IFLA_FLAGS] && flagconfig) {
+        struct ifla_vlan_flags *flags;
+
+        flags = (struct ifla_vlan_flags *)RTA_DATA(tb[RMNETCTL_IFLA_FLAGS]);
+        *flagconfig = flags->flags;
+        dbg_time("\tData format: 0x%x", *flagconfig);
+    }
+
+    if (tb[RMNETCTL_IFLA_UPLINK_PARAMS]) {
+        *ul_agg = *(struct rmnetctl_uplink_params *)
+        RTA_DATA(tb[RMNETCTL_IFLA_UPLINK_PARAMS]);
+
+        dbg_time("\tUplink Aggregation parameters:");
+        dbg_time("\t\tPacket limit: %u", ul_agg->packet_count);
+        dbg_time("\t\tByte limit: %u", ul_agg->byte_count);
+        dbg_time("\t\tTime limit (ns): %u", ul_agg->time_limit);
+        dbg_time("\t\tFeatures : 0x%x", ul_agg->features);
+    }
+
+    free(resp);
+    return RMNETCTL_API_SUCCESS;
+}
+
+int rtrmnet_ctl_get_vnd(char *vndname, int *muxid, int *qmap_version)
+{
+    struct rmnetctl_hndl_s *handle;
+    uint16_t error_code;
+    int return_code;
+    uint32_t flagconfig = 0;
+    uint16_t mux_id = 0;
+    struct rmnetctl_uplink_params ul_agg;
+
+    dbg_time("%s vnd: %s", __func__, vndname);
+    
+    return_code = rtrmnet_ctl_init(&handle, &error_code);
+    if (return_code != RMNETCTL_SUCCESS) {
+        dbg_time("rtrmnet_ctl_init error_code: %d, return_code: %d, errno: %d (%s)",
+            error_code, return_code, errno, strerror(errno));
+        return -1;
+    }
+
+    // rmnetcli -n getlink rmnet_data0
+    return_code = rtrmnet_ctl_getvnd(handle, /*devname, */vndname, &error_code,
+        &mux_id, &flagconfig, &ul_agg);
+    if (return_code == RMNETCTL_KERNEL_ERR)
+        dbg_time("rtrmnet_ctl_uplinkparam RMNETCTL_KERNEL_ERR errno: %d (%s)",
+                error_code, strerror(error_code));
+    else if (return_code != RMNETCTL_SUCCESS) {
+        dbg_time("rtrmnet_ctl_uplinkparam error_code: %d, return_code: %d",
+                error_code, return_code);
+    }
+    rtrmnet_ctl_deinit(handle);
+
+    if (return_code == RMNETCTL_SUCCESS) {
+        *muxid = mux_id;
+        if (flagconfig&RMNET_FLAGS_INGRESS_DEAGGREGATION) {
+            if ((flagconfig&RMNET_FLAGS_INGRESS_MAP_CKSUMV5) && (flagconfig&RMNET_FLAGS_EGRESS_MAP_CKSUMV5))
+                *qmap_version = 9; //QMAPV5
+            else
+                *qmap_version = 5; //QMAPV1
+        }
+    }
+
+    return return_code;
+}
+
diff --git a/RM520N-5G/文件/source/udhcpc.c b/RM520N-5G/文件/source/udhcpc.c
new file mode 100644
index 0000000..c2e92a2
--- /dev/null
+++ b/RM520N-5G/文件/source/udhcpc.c
@@ -0,0 +1,741 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <sys/socket.h>
+#include <sys/select.h>
+#include <sys/types.h>
+#include <net/if.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <endian.h>
+
+#include "util.h"
+#include "QMIThread.h"
+extern int ql_get_netcard_carrier_state(const char *devname);
+
+static __inline in_addr_t qmi2addr(uint32_t __x) {
+    return (__x>>24) | (__x>>8&0xff00) | (__x<<8&0xff0000) | (__x<<24);
+}
+
+static int ql_system(const char *shell_cmd) {
+    dbg_time("%s", shell_cmd);
+    return system(shell_cmd);
+}
+
+static void ifc_init_ifr(const char *name, struct ifreq *ifr)
+{
+    memset(ifr, 0, sizeof(struct ifreq));
+    no_trunc_strncpy(ifr->ifr_name, name, IFNAMSIZ);
+    ifr->ifr_name[IFNAMSIZ - 1] = 0;
+}
+
+static void ql_set_mtu(const char *ifname, int ifru_mtu) {
+    int inet_sock;
+    struct ifreq ifr;
+
+    inet_sock = socket(AF_INET, SOCK_DGRAM, 0);
+
+    if (inet_sock > 0) {
+        ifc_init_ifr(ifname, &ifr);
+
+        if (!ioctl(inet_sock, SIOCGIFMTU, &ifr)) {
+            if (ifr.ifr_ifru.ifru_mtu != ifru_mtu) {
+                dbg_time("change mtu %d -> %d", ifr.ifr_ifru.ifru_mtu , ifru_mtu);
+                ifr.ifr_ifru.ifru_mtu = ifru_mtu;
+                ioctl(inet_sock, SIOCSIFMTU, &ifr);
+            }
+        }
+
+        close(inet_sock);
+    }
+}
+
+static int ifc_get_addr(const char *name, in_addr_t *addr)
+{
+    int inet_sock;
+    struct ifreq ifr;
+    int ret = 0;
+
+    inet_sock = socket(AF_INET, SOCK_DGRAM, 0);
+
+    ifc_init_ifr(name, &ifr);
+    if (addr != NULL) {
+        ret = ioctl(inet_sock, SIOCGIFADDR, &ifr);
+        if (ret < 0) {
+            *addr = 0;
+        } else {
+            *addr = ((struct sockaddr_in*) &ifr.ifr_addr)->sin_addr.s_addr;
+        }
+    }
+    close(inet_sock);
+    return ret;
+}
+
+static short ifc_get_flags(const char *ifname)
+{
+    int inet_sock;
+    struct ifreq ifr;
+    int ret = 0;
+
+    inet_sock = socket(AF_INET, SOCK_DGRAM, 0);
+
+    if (inet_sock > 0) {
+        ifc_init_ifr(ifname, &ifr);
+
+        if (!ioctl(inet_sock, SIOCGIFFLAGS, &ifr)) {
+            ret = ifr.ifr_ifru.ifru_flags;
+        }
+
+        close(inet_sock);
+    }
+
+    return ret;
+}
+
+static void ifc_set_state(const char *ifname, int state) {
+    char shell_cmd[128];
+
+    if (!access("/sbin/ip", X_OK)) {
+        snprintf(shell_cmd, sizeof(shell_cmd), "ip link set dev %s %s", ifname, state ? "up" : "down");
+    } else {
+        snprintf(shell_cmd, sizeof(shell_cmd), "ifconfig %s %s", ifname, state ? "up" : "down");
+    }
+    ql_system(shell_cmd);
+}
+
+static int ql_netcard_ipv4_address_check(const char *ifname, in_addr_t ip) {
+    in_addr_t addr = 0;
+
+    ifc_get_addr(ifname, &addr);
+    return addr == ip;
+}
+
+static int ql_raw_ip_mode_check(const char *ifname, uint32_t ip) {
+    int fd;
+    char raw_ip[128];
+    char mode[2] = "X";
+    int mode_change = 0;
+
+    if (ql_netcard_ipv4_address_check(ifname, qmi2addr(ip)))
+        return 0;
+    
+    snprintf(raw_ip, sizeof(raw_ip), "/sys/class/net/%s/qmi/raw_ip", ifname);
+    if (access(raw_ip, F_OK))
+        return 0;
+
+    fd = open(raw_ip, O_RDWR | O_NONBLOCK | O_NOCTTY);
+    if (fd < 0) {
+        dbg_time("%s %d fail to open(%s), errno:%d (%s)", __FILE__, __LINE__, raw_ip, errno, strerror(errno));
+        return 0;
+    }
+
+    if (read(fd, mode, 2) == -1) {};
+    if (mode[0] == '0' || mode[0] == 'N') {
+        dbg_time("File:%s Line:%d udhcpc fail to get ip address, try next:", __func__, __LINE__);
+        ifc_set_state(ifname, 0);
+        dbg_time("echo Y > /sys/class/net/%s/qmi/raw_ip", ifname);
+        mode[0] = 'Y';
+        if (write(fd, mode, 2) == -1) {};
+        mode_change = 1;
+        ifc_set_state(ifname, 1);
+    }
+
+    close(fd);
+    return mode_change;
+}
+
+static void* udhcpc_thread_function(void* arg) {
+    FILE * udhcpc_fp;
+    char *udhcpc_cmd = (char *)arg;
+
+    if (udhcpc_cmd == NULL)
+        return NULL;
+
+    dbg_time("%s", udhcpc_cmd);
+    udhcpc_fp = popen(udhcpc_cmd, "r");
+    free(udhcpc_cmd);
+    if (udhcpc_fp) {
+        char buf[0xff];
+
+        buf[sizeof(buf)-1] = '\0';
+        while((fgets(buf, sizeof(buf)-1, udhcpc_fp)) != NULL) {
+            if ((strlen(buf) > 1) && (buf[strlen(buf) - 1] == '\n'))
+                buf[strlen(buf) - 1] = '\0';
+            dbg_time("%s", buf);
+        }
+
+        pclose(udhcpc_fp);
+    }
+
+    return NULL;
+}
+
+//#define USE_DHCLIENT
+#ifdef USE_DHCLIENT
+static int dhclient_alive = 0;
+#endif
+static int dibbler_client_alive = 0;
+
+void ql_set_driver_link_state(PROFILE_T *profile, int link_state) {
+    char link_file[128];
+    int fd;
+    int new_state = 0;
+
+    snprintf(link_file, sizeof(link_file), "/sys/class/net/%s/link_state", profile->usbnet_adapter);
+    fd = open(link_file, O_RDWR | O_NONBLOCK | O_NOCTTY);
+    if (fd == -1) {
+        if (errno != ENOENT)
+            dbg_time("Fail to access %s, errno: %d (%s)", link_file, errno, strerror(errno));
+        return;
+    }
+
+    if (profile->qmap_mode <= 1)
+        new_state = !!link_state;
+    else {
+        //0x80 means link off this pdp
+        new_state = (link_state ? 0x00 : 0x80) + (profile->muxid & 0x7F);
+    }
+
+    snprintf(link_file, sizeof(link_file), "%d\n", new_state);
+    if (write(fd, link_file, sizeof(link_file)) == -1) {};
+
+    if (link_state == 0 && profile->qmapnet_adapter[0]
+        && strcmp(profile->qmapnet_adapter, profile->usbnet_adapter)) {
+        size_t rc;
+
+        lseek(fd, 0, SEEK_SET);
+        rc = read(fd, link_file, sizeof(link_file));
+        if (rc > 1 && (!strncasecmp(link_file, "0\n", 2) || !strncasecmp(link_file, "0x0\n", 4))) {
+            ifc_set_state(profile->usbnet_adapter, 0);
+        }
+    }
+
+    close(fd);
+}
+
+static const char *ipv4Str(const uint32_t Address) {
+    static char str[] = {"255.225.255.255"};
+    uint8_t *ip = (uint8_t *)&Address;
+
+    snprintf(str, sizeof(str), "%d.%d.%d.%d", ip[3], ip[2], ip[1], ip[0]);
+    return str;
+}
+
+static const char *ipv6Str(const UCHAR Address[16]) {
+    static char str[64];
+    uint16_t ip[8];
+    int i;
+    for (i = 0; i < 8; i++) {
+        ip[i] = (Address[i*2]<<8) + Address[i*2+1];
+    }
+
+    snprintf(str, sizeof(str), "%x:%x:%x:%x:%x:%x:%x:%x",
+        ip[0], ip[1], ip[2], ip[3], ip[4], ip[5], ip[6], ip[7]);
+
+    return str;
+}
+
+void update_ipv4_address(const char *ifname, const char *ip, const char *gw, unsigned prefix)
+{
+    char shell_cmd[128];
+
+    if (!ifname)
+        return;
+
+    if (!access("/sbin/ip", X_OK)) {
+        snprintf(shell_cmd, sizeof(shell_cmd), "ip -%d address flush dev %s", 4, ifname);
+        ql_system(shell_cmd);
+
+        snprintf(shell_cmd, sizeof(shell_cmd), "ip -%d address add %s/%u dev %s", 4, ip, prefix, ifname);
+        ql_system(shell_cmd);
+
+        //ping6 www.qq.com
+        snprintf(shell_cmd, sizeof(shell_cmd), "ip -%d route add default via %s dev %s", 4, gw, ifname);
+        ql_system(shell_cmd);
+    } else {
+        unsigned n =  (0xFFFFFFFF >> (32 - prefix)) << (32 - prefix);
+       // n = (n>>24) | (n>>8&0xff00) | (n<<8&0xff0000) | (n<<24);
+
+        snprintf(shell_cmd, sizeof(shell_cmd), "ifconfig %s %s netmask %s", ifname, ip, ipv4Str(n));
+        ql_system(shell_cmd);
+
+        //Resetting default routes
+        snprintf(shell_cmd, sizeof(shell_cmd), "route del default dev %s", ifname);
+        while(!system(shell_cmd));
+
+        snprintf(shell_cmd, sizeof(shell_cmd), "route add default gw %s dev %s", gw, ifname);
+        ql_system(shell_cmd);
+    }
+}
+
+void update_ipv6_address(const char *ifname, const char *ip, const char *gw, unsigned prefix) {
+    char shell_cmd[128];
+
+    (void)gw;
+    if (!access("/sbin/ip", X_OK)) {
+        snprintf(shell_cmd, sizeof(shell_cmd), "ip -%d address flush dev %s", 6, ifname);
+        ql_system(shell_cmd);
+
+        snprintf(shell_cmd, sizeof(shell_cmd), "ip -%d address add %s/%u dev %s", 6, ip, prefix, ifname);
+        ql_system(shell_cmd);
+
+        //ping6 www.qq.com
+        snprintf(shell_cmd, sizeof(shell_cmd), "ip -%d route add default dev %s", 6, ifname);
+        ql_system(shell_cmd);
+    } else {
+        snprintf(shell_cmd, sizeof(shell_cmd), "ifconfig %s %s/%d", ifname, ip, prefix);
+        ql_system(shell_cmd);
+
+        snprintf(shell_cmd, sizeof(shell_cmd), "route -A inet6 add default dev %s", ifname);
+        ql_system(shell_cmd);
+    }
+}
+
+static void update_ip_address_by_qmi(const char *ifname, const IPV4_T *ipv4, const IPV6_T *ipv6) {
+    char *d1, *d2;
+
+    if (ipv4 && ipv4->Address) {
+        d1 = strdup(ipv4Str(ipv4->Address));
+        d2 = strdup(ipv4Str(ipv4->Gateway));
+        unsigned prefix = 0;
+        unsigned n = 0;
+
+        for (n = 0; n < 32; n++) {
+            if (ipv4->SubnetMask&((unsigned)1<<n)) {
+                prefix++;
+            }
+        }
+
+        update_ipv4_address(ifname, d1, d2, prefix);
+        free(d1); free(d2);
+
+        //Adding DNS
+        if (ipv4->DnsPrimary) {
+            d1 = strdup(ipv4Str(ipv4->DnsPrimary));
+            d2 = strdup(ipv4Str(ipv4->DnsSecondary ? ipv4->DnsSecondary : ipv4->DnsPrimary));
+            update_resolv_conf(4, ifname, d1, d2);
+            free(d1); free(d2);
+        }
+    }
+
+    if (ipv6 && ipv6->Address[0] && ipv6->PrefixLengthIPAddr) {
+        d1 = strdup(ipv6Str(ipv6->Address));
+        d2 = strdup(ipv6Str(ipv6->Gateway));
+
+        update_ipv6_address(ifname, d1, d2, ipv6->PrefixLengthIPAddr);
+        free(d1); free(d2);
+
+        //Adding DNS
+        if (ipv6->DnsPrimary[0]) {
+            d1 = strdup(ipv6Str(ipv6->DnsPrimary));
+            d2 = strdup(ipv6Str(ipv6->DnsSecondary[0] ? ipv6->DnsSecondary : ipv6->DnsPrimary));
+            update_resolv_conf(6, ifname, d1, d2);
+            free(d1); free(d2);
+        }
+    }
+}
+
+//#define QL_OPENWER_NETWORK_SETUP
+#ifdef QL_OPENWER_NETWORK_SETUP
+static const char *openwrt_lan = "br-lan";
+static const char *openwrt_wan = "wwan0";
+
+static int ql_openwrt_system(const char *cmd) {
+    int i;
+    int ret = 1;
+    char shell_cmd[128];
+
+    snprintf(shell_cmd, sizeof(shell_cmd), "%s 2>1 > /dev/null", cmd);
+    
+    for (i = 0; i < 15; i++) {
+        dbg_time("%s", cmd);
+        ret = system(shell_cmd);
+        if (!ret)
+            break;
+        sleep(1);
+    }
+
+    return ret;
+}
+
+static int ql_openwrt_is_wan(const char *ifname) {
+    if (openwrt_lan == NULL) {
+        system("uci show network.wan.ifname");
+    }
+
+    if (strcmp(ifname, openwrt_wan))
+        return 0;
+
+    return 1;
+}
+
+static void ql_openwrt_setup_wan(const char *ifname, const IPV4_T *ipv4) {
+    FILE *fp = NULL;
+    char config[64];
+
+    snprintf(config, sizeof(config), "/tmp/rmnet_%s_ipv4config", ifname);
+     
+    if (ipv4 == NULL) {
+        if (ql_openwrt_is_wan(ifname))
+            ql_openwrt_system("ifdown wan");
+        return;
+    }
+
+    fp = fopen(config, "w");
+    if (fp == NULL)
+        return;
+
+    fprintf(fp, "IFNAME=\"%s\"\n", ifname);
+    fprintf(fp, "PUBLIC_IP=\"%s\"\n", ipv4Str(ipv4->Address));
+    fprintf(fp, "NETMASK=\"%s\"\n", ipv4Str(ipv4->SubnetMask));
+    fprintf(fp, "GATEWAY=\"%s\"\n", ipv4Str(ipv4->Gateway));
+    fprintf(fp, "DNSSERVERS=\"%s", ipv4Str(ipv4->DnsPrimary));
+    if (ipv4->DnsSecondary != 0)
+        fprintf(fp, " %s", ipv4Str(ipv4->DnsSecondary));
+    fprintf(fp, "\"\n");
+
+    fclose(fp);
+
+    if (!ql_openwrt_is_wan(ifname))
+        return;
+    
+    ql_openwrt_system("ifup wan");
+}
+
+static void ql_openwrt_setup_wan6(const char *ifname, const IPV6_T *ipv6) {
+    FILE *fp = NULL;
+    char config[64];
+    int first_ifup;
+     
+    snprintf(config, sizeof(config), "/tmp/rmnet_%s_ipv6config", ifname);
+     
+    if (ipv6 == NULL) {
+        if (ql_openwrt_is_wan(ifname))
+            ql_openwrt_system("ifdown wan6");
+        return;
+    }
+
+    first_ifup = (access(config, F_OK) != 0);
+
+    fp = fopen(config, "w");
+    if (fp == NULL)
+        return;
+
+    fprintf(fp, "IFNAME=\"%s\"\n", ifname);
+    fprintf(fp, "PUBLIC_IP=\"%s\"\n", ipv6Str(ipv6->Address));
+    fprintf(fp, "NETMASK=\"%s\"\n", ipv6Str(ipv6->SubnetMask));
+    fprintf(fp, "GATEWAY=\"%s\"\n", ipv6Str(ipv6->Gateway));
+    fprintf(fp, "PrefixLength=\"%d\"\n", ipv6->PrefixLengthIPAddr);
+    fprintf(fp, "DNSSERVERS=\"%s", ipv6Str(ipv6->DnsPrimary));
+    if (ipv6->DnsSecondary[0])
+        fprintf(fp, " %s", ipv6Str(ipv6->DnsSecondary));
+    fprintf(fp, "\"\n");
+
+    fclose(fp);
+
+    if (!ql_openwrt_is_wan(ifname))
+        return;
+
+    if (first_ifup)
+        ql_openwrt_system("ifup wan6");
+    else
+        ql_openwrt_system("/etc/init.d/network restart"); //make PC to release old IPV6 address, and RS new IPV6 address
+
+#if 1 //TODO? why need this?
+    if (openwrt_lan) {
+        int i;
+        char shell_cmd[128];
+        UCHAR Address[16] = {0};
+
+        ql_openwrt_system(("ifstatus lan"));
+
+        for (i = 0; i < (ipv6->PrefixLengthIPAddr/8); i++)
+            Address[i] = ipv6->Address[i];
+
+        snprintf(shell_cmd, sizeof(shell_cmd), "ip route del %s/%u dev %s", ipv6Str(Address), ipv6->PrefixLengthIPAddr, ifname);
+        ql_openwrt_system(shell_cmd);
+
+        snprintf(shell_cmd, sizeof(shell_cmd), "ip route add %s/%u dev %s", ipv6Str(Address), ipv6->PrefixLengthIPAddr, openwrt_lan);
+        ql_system(shell_cmd);        
+    }
+#endif
+}
+#endif
+
+void udhcpc_start(PROFILE_T *profile) {
+    char *ifname = profile->usbnet_adapter;
+
+    ql_set_driver_link_state(profile, 1);
+
+    if (profile->qmapnet_adapter[0]) {
+        ifname = profile->qmapnet_adapter;
+    }
+
+    if (profile->rawIP && profile->ipv4.Address && profile->ipv4.Mtu) {
+        ql_set_mtu(ifname, (profile->ipv4.Mtu));
+    }
+
+    if (strcmp(ifname, profile->usbnet_adapter)) {
+        ifc_set_state(profile->usbnet_adapter, 1);
+        if (ifc_get_flags(ifname)&IFF_UP) {
+            ifc_set_state(ifname, 0);
+        }
+    }
+
+    ifc_set_state(ifname, 1);
+    if (profile->ipv4.Address) {
+        if (profile->PCSCFIpv4Addr1)
+            dbg_time("pcscf1: %s", ipv4Str(profile->PCSCFIpv4Addr1));
+        if (profile->PCSCFIpv4Addr2)
+            dbg_time("pcscf2: %s", ipv4Str(profile->PCSCFIpv4Addr2));
+    }
+
+    if (profile->ipv6.Address[0] && profile->ipv6.PrefixLengthIPAddr) {
+        if (profile->PCSCFIpv6Addr1[0])
+            dbg_time("pcscf1: %s", ipv6Str(profile->PCSCFIpv6Addr1));
+        if (profile->PCSCFIpv6Addr2[0])
+            dbg_time("pcscf2: %s", ipv6Str(profile->PCSCFIpv6Addr2));
+    }
+
+#if 1 //for bridge mode, only one public IP, so do udhcpc manually
+    if (ql_bridge_mode_detect(profile)) {
+        return;
+    }
+#endif
+
+//because must use udhcpc to obtain IP when working on ETH mode,
+//so it is better also use udhcpc to obtain IP when working on IP mode.
+//use the same policy for all modules
+#if 0
+    if (profile->rawIP != 0) //mdm9x07/ec25,ec20 R2.0
+    {
+        update_ip_address_by_qmi(ifname, &profile->ipv4, &profile->ipv6);
+        return;
+    }
+#endif
+
+    if (profile->ipv4.Address == 0)
+        goto set_ipv6;
+
+    if (profile->no_dhcp || profile->usb_dev.idProduct == 0x0316 || profile->request_ops == &mbim_request_ops) { //lots of mbim modem do not support DHCP
+        update_ip_address_by_qmi(ifname, &profile->ipv4, NULL);
+    }
+    else
+/* Do DHCP using busybox tools */
+    {
+        char udhcpc_cmd[128];
+        pthread_attr_t udhcpc_thread_attr;
+        pthread_t udhcpc_thread_id;
+
+        pthread_attr_init(&udhcpc_thread_attr);
+        pthread_attr_setdetachstate(&udhcpc_thread_attr, PTHREAD_CREATE_DETACHED);
+
+#ifdef USE_DHCLIENT
+            snprintf(udhcpc_cmd, sizeof(udhcpc_cmd), "dhclient -4 -d --no-pid %s", ifname);
+            dhclient_alive++;
+#else
+            if (access("/usr/share/udhcpc/default.script", X_OK)
+                && access("/etc//udhcpc/default.script", X_OK)) {
+                dbg_time("No default.script found, it should be in '/usr/share/udhcpc/' or '/etc//udhcpc' depend on your udhcpc version!");
+            }
+
+            //-f,--foreground    Run in foreground
+            //-b,--background    Background if lease is not obtained
+            //-n,--now        Exit if lease is not obtained
+            //-q,--quit        Exit after obtaining lease
+            //-t,--retries N        Send up to N discover packets (default 3)
+            snprintf(udhcpc_cmd, sizeof(udhcpc_cmd), "busybox udhcpc -f -n -q -t 5 -i %s", ifname);
+#endif
+
+#if 1 //for OpenWrt
+            if (!access("/lib/netifd/dhcp.script", X_OK) && !access("/sbin/ifup", X_OK) && !access("/sbin/ifstatus", X_OK)) {
+#if 0 //20210415 do not promot these message
+                dbg_time("you are use OpenWrt?");
+                dbg_time("should not calling udhcpc manually?");
+                dbg_time("should modify /etc/config/network as below?");
+                dbg_time("config interface wan");
+                dbg_time("\toption ifname	%s", ifname);
+                dbg_time("\toption proto	dhcp");
+                dbg_time("should use \"/sbin/ifstaus wan\" to check %s 's status?", ifname);
+#endif
+            }
+#endif
+
+#ifdef USE_DHCLIENT            
+            pthread_create(&udhcpc_thread_id, &udhcpc_thread_attr, udhcpc_thread_function, (void*)strdup(udhcpc_cmd));
+            sleep(1);
+#else
+            pthread_create(&udhcpc_thread_id, NULL, udhcpc_thread_function, (void*)strdup(udhcpc_cmd));
+            pthread_join(udhcpc_thread_id, NULL);
+
+            if (profile->request_ops == &atc_request_ops) {
+                profile->udhcpc_ip = 0;
+                ifc_get_addr(ifname, &profile->udhcpc_ip);
+                if (profile->udhcpc_ip != profile->ipv4.Address) {
+                    unsigned char *l = (unsigned char *)&profile->udhcpc_ip;
+                    unsigned char *r = (unsigned char *)&profile->ipv4.Address;
+                    dbg_time("ERROR: IP from udhcpc (%d.%d.%d.%d) is different to IP from ATC (%d.%d.%d.%d)!",
+                              l[0], l[1], l[2], l[3], r[0], r[1], r[2], r[3]);
+                    ql_get_netcard_carrier_state(ifname); //miss udhcpc default.script or modem not report usb-net-cdc-linkup
+                }
+            }
+
+            if (profile->request_ops != &qmi_request_ops) { //only QMI modem support next fixup!
+                goto set_ipv6;
+            }
+
+            if (ql_raw_ip_mode_check(ifname, profile->ipv4.Address)) {
+                pthread_create(&udhcpc_thread_id, NULL, udhcpc_thread_function, (void*)strdup(udhcpc_cmd));
+                pthread_join(udhcpc_thread_id, NULL);
+            }
+
+            if (!ql_netcard_ipv4_address_check(ifname, qmi2addr(profile->ipv4.Address))) {
+                //no udhcpc's default.script exist, directly set ip and dns
+                update_ip_address_by_qmi(ifname, &profile->ipv4, NULL);
+            }
+            //Add by Demon. check default route 
+            FILE *rt_fp = NULL;
+            char rt_cmd[128] = {0};
+            
+            //Check if there is a default route. 
+            snprintf(rt_cmd, sizeof(rt_cmd), "route -n | grep %s | awk '{print $1}' | grep 0.0.0.0", ifname);
+            rt_fp = popen((const char *)rt_cmd, "r");
+            if (rt_fp != NULL) {
+              char buf[20] = {0};
+              int found_default_rt = 0;
+
+              if (fgets(buf, sizeof(buf), rt_fp) != NULL) {
+                //Find the specified interface
+                found_default_rt = 1;
+              }
+
+              if (1 == found_default_rt) {
+                //dbg_time("Route items found for %s", ifname);
+              }
+              else {
+                dbg_time("Warning: No route items found for %s", ifname);
+              }
+
+              pclose(rt_fp);
+            }
+            //End by Demon.
+#endif
+    }
+
+#ifdef QL_OPENWER_NETWORK_SETUP
+    ql_openwrt_setup_wan(ifname, &profile->ipv4);
+#endif
+
+set_ipv6:
+    if (profile->ipv6.Address[0] && profile->ipv6.PrefixLengthIPAddr) {
+#if 1
+        //module do not support DHCPv6, only support 'Router Solicit'
+        //and it seem if enable /proc/sys/net/ipv6/conf/all/forwarding, Kernel do not send RS
+        const char *forward_file = "/proc/sys/net/ipv6/conf/all/forwarding";
+        int forward_fd = open(forward_file, O_RDONLY);
+        if (forward_fd > 0) {
+            char forward_state[2];
+            if (read(forward_fd, forward_state, 2) == -1) {};
+            if (forward_state[0] == '1') {
+                //dbg_time("%s enabled, kernel maybe donot send 'Router Solicit'", forward_file);
+            }
+            close(forward_fd);
+        }
+
+        update_ip_address_by_qmi(ifname, NULL, &profile->ipv6);
+
+        if (profile->ipv6.DnsPrimary[0] || profile->ipv6.DnsSecondary[0]) {
+            char dns1str[64], dns2str[64];
+
+            if (profile->ipv6.DnsPrimary[0]) {
+                strcpy(dns1str, ipv6Str(profile->ipv6.DnsPrimary));
+            }
+
+            if (profile->ipv6.DnsSecondary[0]) {
+                strcpy(dns2str, ipv6Str(profile->ipv6.DnsSecondary));
+            }
+
+            update_resolv_conf(6, ifname, profile->ipv6.DnsPrimary[0] ? dns1str : NULL,
+                               profile->ipv6.DnsSecondary[0] != '\0' ? dns2str : NULL);
+        }
+
+#ifdef QL_OPENWER_NETWORK_SETUP
+            ql_openwrt_setup_wan6(ifname, &profile->ipv6);
+#endif
+#else
+#ifdef USE_DHCLIENT
+        snprintf(udhcpc_cmd, sizeof(udhcpc_cmd), "dhclient -6 -d --no-pid %s",  ifname);
+        dhclient_alive++;
+#else
+        /*
+            DHCPv6: Dibbler - a portable DHCPv6
+            1. download from http://klub.com.pl/dhcpv6/
+            2. cross-compile
+                2.1 ./configure --host=arm-linux-gnueabihf
+                2.2 copy dibbler-client to your board
+            3. mkdir -p /var/log/dibbler/ /var/lib/ on your board
+            4. create /etc/dibbler/client.conf on your board, the content is
+                log-mode short
+                log-level 7
+                iface wwan0 {
+                    ia
+                    option dns-server
+                }
+             5. run "dibbler-client start" to get ipV6 address
+             6. run "route -A inet6 add default dev wwan0" to add default route
+        */
+        snprintf(shell_cmd, sizeof(shell_cmd), "route -A inet6 add default %s", ifname);
+        ql_system(shell_cmd);
+        snprintf(udhcpc_cmd, sizeof(udhcpc_cmd), "dibbler-client run");
+        dibbler_client_alive++;
+#endif
+
+        pthread_create(&udhcpc_thread_id, &udhcpc_thread_attr, udhcpc_thread_function, (void*)strdup(udhcpc_cmd));
+#endif
+    }
+}
+
+void udhcpc_stop(PROFILE_T *profile) {
+    char *ifname = profile->usbnet_adapter;
+    char shell_cmd[128];
+
+    ql_set_driver_link_state(profile, 0);
+
+    if (profile->qmapnet_adapter[0]) {
+        ifname = profile->qmapnet_adapter;
+    }
+
+#ifdef USE_DHCLIENT
+    if (dhclient_alive) {
+        system("killall dhclient");
+        dhclient_alive = 0;
+    }
+#endif
+    if (dibbler_client_alive) {
+        if (system("killall dibbler-client")) {};
+        dibbler_client_alive = 0;
+    }
+
+    profile->udhcpc_ip = 0;
+//it seems when call netif_carrier_on(), and netcard 's IP is "0.0.0.0", will cause netif_queue_stopped()
+    if (!access("/sbin/ip", X_OK))
+        snprintf(shell_cmd, sizeof(shell_cmd), "ip addr flush dev %s", ifname);
+    else
+        snprintf(shell_cmd, sizeof(shell_cmd), "ifconfig %s 0.0.0.0", ifname);
+    ql_system(shell_cmd);
+    ifc_set_state(ifname, 0);
+
+#ifdef QL_OPENWER_NETWORK_SETUP
+    ql_openwrt_setup_wan(ifname, NULL);
+    ql_openwrt_setup_wan6(ifname, NULL);
+#endif
+}
diff --git a/RM520N-5G/文件/source/udhcpc_netlink.c b/RM520N-5G/文件/source/udhcpc_netlink.c
new file mode 100644
index 0000000..163a580
--- /dev/null
+++ b/RM520N-5G/文件/source/udhcpc_netlink.c
@@ -0,0 +1,190 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <sys/socket.h>
+#include <sys/select.h>
+#include <sys/types.h>
+#include <net/if.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <endian.h>
+
+#include "libmnl/ifutils.h"
+#include "libmnl/dhcp/dhcp.h"
+#include "util.h"
+#include "QMIThread.h"
+
+static int ql_raw_ip_mode_check(const char *ifname)
+{
+    int fd;
+    char raw_ip[128];
+    char mode[2] = "X";
+    int mode_change = 0;
+
+    snprintf(raw_ip, sizeof(raw_ip), "/sys/class/net/%s/qmi/raw_ip", ifname);
+    if (access(raw_ip, F_OK))
+        return 0;
+
+    fd = open(raw_ip, O_RDWR | O_NONBLOCK | O_NOCTTY);
+    if (fd < 0)
+    {
+        dbg_time("%s %d fail to open(%s), errno:%d (%s)", __FILE__, __LINE__, raw_ip, errno, strerror(errno));
+        return 0;
+    }
+
+    read(fd, mode, 2);
+    if (mode[0] == '0' || mode[0] == 'N')
+    {
+        if_link_down(ifname);
+        dbg_time("echo Y > /sys/class/net/%s/qmi/raw_ip", ifname);
+        mode[0] = 'Y';
+        write(fd, mode, 2);
+        mode_change = 1;
+        if_link_up(ifname);
+    }
+
+    close(fd);
+    return mode_change;
+}
+
+void ql_set_driver_link_state(PROFILE_T *profile, int link_state)
+{
+    char link_file[128];
+    int fd;
+    int new_state = 0;
+
+    snprintf(link_file, sizeof(link_file), "/sys/class/net/%s/link_state", profile->usbnet_adapter);
+    fd = open(link_file, O_RDWR | O_NONBLOCK | O_NOCTTY);
+    if (fd == -1)
+    {
+        if (errno != ENOENT)
+            dbg_time("Fail to access %s, errno: %d (%s)", link_file, errno, strerror(errno));
+        return;
+    }
+
+    if (profile->qmap_mode <= 1)
+        new_state = !!link_state;
+    else
+    {
+        //0x80 means link off this pdp
+        new_state = (link_state ? 0x00 : 0x80) + profile->pdp;
+    }
+
+    snprintf(link_file, sizeof(link_file), "%d\n", new_state);
+    write(fd, link_file, sizeof(link_file));
+
+    if (link_state == 0 && profile->qmap_mode > 1)
+    {
+        size_t rc;
+
+        lseek(fd, 0, SEEK_SET);
+        rc = read(fd, link_file, sizeof(link_file));
+        if (rc > 1 && (!strcasecmp(link_file, "0\n") || !strcasecmp(link_file, "0x0\n")))
+        {
+            if_link_down(profile->usbnet_adapter);
+        }
+    }
+
+    close(fd);
+}
+
+void udhcpc_start(PROFILE_T *profile)
+{
+    char *ifname = profile->usbnet_adapter;
+
+    ql_set_driver_link_state(profile, 1);
+    ql_raw_ip_mode_check(ifname);
+
+    if (profile->qmapnet_adapter)
+    {
+        ifname = profile->qmapnet_adapter;
+    }
+    if (profile->rawIP && profile->ipv4.Address && profile->ipv4.Mtu)
+    {
+        if_set_mtu(ifname, (profile->ipv4.Mtu));
+    }
+
+    if (strcmp(ifname, profile->usbnet_adapter))
+    {
+        if_link_up(profile->usbnet_adapter);
+    }
+
+    if_link_up(ifname);
+
+#if 1 //for bridge mode, only one public IP, so do udhcpc manually
+    if (ql_bridge_mode_detect(profile))
+    {
+        return;
+    }
+#endif
+    // if use DHCP(should make with ${DHCP} src files)
+    // do_dhcp(ifname);
+    // return 0;
+    /* IPv4 Addr Info */
+    if (profile->ipv4.Address)
+    {
+        dbg_time("IPv4 MTU: %d", profile->ipv4.Mtu);
+        dbg_time("IPv4 Address: %s", ipaddr_to_string_v4(ntohl(profile->ipv4.Address)));
+        dbg_time("IPv4 Netmask: %d", mask_to_prefix_v4(ntohl(profile->ipv4.SubnetMask)));
+        dbg_time("IPv4 Gateway: %s", ipaddr_to_string_v4(ntohl(profile->ipv4.Gateway)));
+        dbg_time("IPv4 DNS1: %s", ipaddr_to_string_v4(ntohl(profile->ipv4.DnsPrimary)));
+        dbg_time("IPv4 DNS2: %s", ipaddr_to_string_v4(ntohl(profile->ipv4.DnsSecondary)));
+        if_set_network_v4(ifname, ntohl(profile->ipv4.Address),
+                       mask_to_prefix_v4(profile->ipv4.SubnetMask),
+                       ntohl(profile->ipv4.Gateway),
+                       ntohl(profile->ipv4.DnsPrimary),
+                       ntohl(profile->ipv4.DnsSecondary));
+    }
+
+    if (profile->ipv6.Address[0] && profile->ipv6.PrefixLengthIPAddr)
+    {
+        //module do not support DHCPv6, only support 'Router Solicit'
+        //and it seem if enable /proc/sys/net/ipv6/conf/all/forwarding, Kernel do not send RS
+        const char *forward_file = "/proc/sys/net/ipv6/conf/all/forwarding";
+        int forward_fd = open(forward_file, O_RDONLY);
+        if (forward_fd > 0)
+        {
+            char forward_state[2];
+            read(forward_fd, forward_state, 2);
+            if (forward_state[0] == '1')
+            {
+                dbg_time("%s enabled, kernel maybe donot send 'Router Solicit'", forward_file);
+            }
+            close(forward_fd);
+        }
+
+        dbg_time("IPv6 MTU: %d", profile->ipv6.Mtu);
+        dbg_time("IPv6 Address: %s", ipaddr_to_string_v6(profile->ipv6.Address));
+        dbg_time("IPv6 Netmask: %d", profile->ipv6.PrefixLengthIPAddr);
+        dbg_time("IPv6 Gateway: %s", ipaddr_to_string_v6(profile->ipv6.Gateway));
+        dbg_time("IPv6 DNS1: %s", ipaddr_to_string_v6(profile->ipv6.DnsPrimary));
+        dbg_time("IPv6 DNS2: %s", ipaddr_to_string_v6(profile->ipv6.DnsSecondary));
+        if_set_network_v6(ifname, profile->ipv6.Address, profile->ipv6.PrefixLengthIPAddr,
+                       profile->ipv6.Gateway, profile->ipv6.DnsPrimary, profile->ipv6.DnsSecondary);
+    }
+}
+
+void udhcpc_stop(PROFILE_T *profile)
+{
+    char *ifname = profile->usbnet_adapter;
+
+    ql_set_driver_link_state(profile, 0);
+
+    if (profile->qmapnet_adapter)
+    {
+        ifname = profile->qmapnet_adapter;
+    }
+
+    if_link_down(ifname);
+    if_flush_v4_addr(ifname);
+    if_flush_v6_addr(ifname);
+}
diff --git a/RM520N-5G/文件/source/udhcpc_script.c b/RM520N-5G/文件/source/udhcpc_script.c
new file mode 100644
index 0000000..2cc114d
--- /dev/null
+++ b/RM520N-5G/文件/source/udhcpc_script.c
@@ -0,0 +1,128 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <sys/socket.h>
+#include <sys/select.h>
+#include <sys/types.h>
+#include <net/if.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <endian.h>
+
+#include "util.h"
+#include "QMIThread.h"
+
+#define IFDOWN_SCRIPT "/etc/quectel/ifdown.sh"
+#define IFUP_SCRIPT "/etc/quectel/ifup.sh"
+
+static int ql_system(const char *shell_cmd)
+{
+    dbg_time("%s", shell_cmd);
+    return system(shell_cmd);
+}
+
+uint32_t mask_to_prefix_v4(uint32_t mask)
+{
+    uint32_t prefix = 0;
+    while (mask)
+    {
+        mask = mask & (mask - 1);
+        prefix++;
+    }
+    return prefix;
+}
+
+uint32_t mask_from_prefix_v4(uint32_t prefix)
+{
+    return ~((1 << (32 - prefix)) - 1);
+}
+
+/* mask in int */
+uint32_t broadcast_from_mask(uint32_t ip, uint32_t mask)
+{
+    return (ip & mask) | (~mask);
+}
+
+const char *ipaddr_to_string_v4(in_addr_t ipaddr, char *buf, size_t size)
+{
+    //    static char buf[INET6_ADDRSTRLEN] = {'\0'};
+    buf[0] = '\0';
+    uint32_t addr = ipaddr;
+    return inet_ntop(AF_INET, &addr, buf, size);
+}
+
+const char *ipaddr_to_string_v6(uint8_t *ipaddr, char *buf, size_t size)
+{
+    buf[0] = '\0';
+    return inet_ntop(AF_INET6, ipaddr, buf, size);
+}
+
+/**
+ * For more details see default.script
+ * 
+ * The main aim of this function is offload ip management to script, CM has not interest in manage IP address.
+ * just tell script all the info about ip, mask, router, dns...
+ */
+void udhcpc_start(PROFILE_T *profile)
+{
+    char shell_cmd[1024];
+    char ip[128];
+    char subnet[128];
+    char broadcast[128];
+    char router[128];
+    char domain1[128];
+    char domain2[128];
+
+    if (NULL == getenv(IFUP_SCRIPT))
+        return;
+
+    // manage IPv4???
+    // check rawip ???
+    snprintf(shell_cmd, sizeof(shell_cmd),
+             " netiface=%s interface=%s mtu=%u ip=%s subnet=%s broadcast=%s router=%s"
+             " domain=\"%s %s\" %s",
+             profile->usbnet_adapter,
+             profile->qmapnet_adapter ? profile->qmapnet_adapter : profile->usbnet_adapter,
+             profile->ipv4.Mtu,
+             ipaddr_to_string_v4(ntohl(profile->ipv4.Address), ip, sizeof(ip)),
+             ipaddr_to_string_v4(ntohl(profile->ipv4.SubnetMask), subnet, sizeof(subnet)),
+             ipaddr_to_string_v4(ntohl(broadcast_from_mask(profile->ipv4.Address, profile->ipv4.SubnetMask)),
+                                 broadcast, sizeof(broadcast)),
+             ipaddr_to_string_v4(ntohl(profile->ipv4.Gateway), router, sizeof(router)),
+             ipaddr_to_string_v4(ntohl(profile->ipv4.DnsPrimary), domain1, sizeof(domain1)),
+             ipaddr_to_string_v4(ntohl(profile->ipv4.DnsSecondary), domain2, sizeof(domain2)),
+             getenv(IFUP_SCRIPT));
+    ql_system(shell_cmd);
+
+    // manage IPv6???
+}
+
+/**
+ * For more details see default.script
+ * 
+ * The main aim of this function is offload ip management to script, CM has not interest in manage IP address.
+ * just tell script all the info about ip, mask, router, dns...
+ */
+void udhcpc_stop(PROFILE_T *profile)
+{
+    char shell_cmd[1024];
+
+    if (NULL == getenv(IFDOWN_SCRIPT))
+        return;
+
+    snprintf(shell_cmd, sizeof(shell_cmd),
+             "netiface=%s interface=%s %s",
+             profile->usbnet_adapter,
+             profile->qmapnet_adapter ? profile->qmapnet_adapter : profile->usbnet_adapter,
+             getenv(IFDOWN_SCRIPT));
+    ql_system(shell_cmd);
+}
diff --git a/RM520N-5G/文件/source/util.c b/RM520N-5G/文件/source/util.c
new file mode 100644
index 0000000..7d9c2a8
--- /dev/null
+++ b/RM520N-5G/文件/source/util.c
@@ -0,0 +1,356 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#include <sys/time.h>
+#include <net/if.h>
+typedef unsigned short sa_family_t;
+#include <linux/un.h>
+
+#if defined(__STDC__)
+#include <stdarg.h>
+#define __V(x)	x
+#else
+#include <varargs.h>
+#define __V(x)	(va_alist) va_dcl
+#define const
+#define volatile
+#endif
+
+#include <syslog.h>
+
+#include "QMIThread.h"
+
+pthread_mutex_t cm_command_mutex = PTHREAD_MUTEX_INITIALIZER;
+pthread_cond_t cm_command_cond = PTHREAD_COND_INITIALIZER;
+unsigned int cm_recv_buf[1024];
+
+int cm_open_dev(const char *dev) {
+    int fd;
+
+    fd = open(dev, O_RDWR | O_NONBLOCK | O_NOCTTY);
+    if (fd != -1) {
+        fcntl(fd, F_SETFL, fcntl(fd,F_GETFL) | O_NONBLOCK);
+        fcntl(fd, F_SETFD, FD_CLOEXEC);
+
+        if (!strncmp(dev, "/dev/tty", strlen("/dev/tty")))
+        {
+            //disable echo on serial ports 
+            struct termios  ios;
+
+            memset(&ios, 0, sizeof(ios));
+            tcgetattr( fd, &ios );
+            cfmakeraw(&ios);
+            cfsetispeed(&ios, B115200);
+            cfsetospeed(&ios, B115200);
+            tcsetattr( fd, TCSANOW, &ios );
+            tcflush(fd, TCIOFLUSH);
+        }
+    } else {
+        dbg_time("Failed to open %s, errno: %d (%s)", dev, errno, strerror(errno));
+    }
+
+    return fd;
+}
+
+int cm_open_proxy(const char *name) {
+    int sockfd = -1;
+    int reuse_addr = 1;
+    struct sockaddr_un sockaddr;
+    socklen_t alen;
+
+    /*Create server socket*/
+    sockfd = socket(AF_LOCAL, SOCK_STREAM, 0);
+    if (sockfd < 0)
+        return sockfd;
+
+    memset(&sockaddr, 0, sizeof(sockaddr));
+    sockaddr.sun_family = AF_LOCAL;
+    sockaddr.sun_path[0] = 0;
+    memcpy(sockaddr.sun_path + 1, name, strlen(name) );
+
+    alen = strlen(name) + offsetof(struct sockaddr_un, sun_path) + 1;
+    if(connect(sockfd, (struct sockaddr *)&sockaddr, alen) < 0) {
+        close(sockfd);
+        dbg_time("connect %s errno: %d (%s)", name, errno, strerror(errno));
+        return -1;
+    }
+    setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &reuse_addr,sizeof(reuse_addr));
+    fcntl(sockfd, F_SETFL, fcntl(sockfd,F_GETFL) | O_NONBLOCK);
+    fcntl(sockfd, F_SETFD, FD_CLOEXEC);
+
+    dbg_time("connect to %s sockfd = %d", name, sockfd);
+
+    return sockfd;
+}
+
+static void setTimespecRelative(struct timespec *p_ts, long long msec)
+{
+    struct timeval tv;
+
+    gettimeofday(&tv, (struct timezone *) NULL);
+
+    /* what's really funny about this is that I know
+       pthread_cond_timedwait just turns around and makes this
+       a relative time again */
+    p_ts->tv_sec = tv.tv_sec + (msec / 1000);
+    p_ts->tv_nsec = (tv.tv_usec + (msec % 1000) * 1000L ) * 1000L;
+    if ((unsigned long)p_ts->tv_nsec >= 1000000000UL) {
+        p_ts->tv_sec += 1;
+        p_ts->tv_nsec -= 1000000000UL;
+    }
+}
+
+int pthread_cond_timeout_np(pthread_cond_t *cond, pthread_mutex_t * mutex, unsigned msecs) {
+    if (msecs != 0) {
+        unsigned i;
+        unsigned t = msecs/4;
+        int ret = 0;
+
+        if (t == 0)
+            t = 1;
+
+        for (i = 0; i < msecs; i += t) {
+            struct timespec ts;
+            setTimespecRelative(&ts, t);
+//very old uclibc do not support pthread_condattr_setclock(CLOCK_MONOTONIC)
+            ret = pthread_cond_timedwait(cond, mutex, &ts); //to advoid system time change
+            if (ret != ETIMEDOUT) {
+                if(ret) dbg_time("ret=%d, msecs=%u, t=%u", ret, msecs, t);
+                break;
+            }
+        }
+
+        return ret;
+    } else {
+        return pthread_cond_wait(cond, mutex);
+    }
+}
+
+const char * get_time(void) {
+    static char time_buf[128];
+    struct timeval  tv;
+    time_t time;
+    suseconds_t millitm;
+    struct tm *ti;
+
+    gettimeofday (&tv, NULL);
+
+    time= tv.tv_sec;
+    millitm = (tv.tv_usec + 500) / 1000;
+
+    if (millitm == 1000) {
+        ++time;
+        millitm = 0;
+    }
+
+    ti = localtime(&time);
+    sprintf(time_buf, "%02d-%02d_%02d:%02d:%02d:%03d", ti->tm_mon+1, ti->tm_mday, ti->tm_hour, ti->tm_min, ti->tm_sec, (int)millitm);
+    return time_buf;
+}
+
+unsigned long clock_msec(void)
+{
+	struct timespec tm;
+	clock_gettime( CLOCK_MONOTONIC, &tm);
+	return (unsigned long)(tm.tv_sec*1000 + (tm.tv_nsec/1000000));
+}
+
+FILE *logfilefp = NULL;
+
+void update_resolv_conf(int iptype, const char *ifname, const char *dns1, const char *dns2) {
+    const char *dns_file = "/etc/resolv.conf";
+    FILE *dns_fp;
+    char dns_line[256];
+    #define MAX_DNS 16
+    char *dns_info[MAX_DNS];
+    char dns_tag[64];
+    int dns_match = 0;
+    int i;
+
+    snprintf(dns_tag, sizeof(dns_tag), "# IPV%d %s", iptype, ifname);
+
+    for (i = 0; i < MAX_DNS; i++)
+        dns_info[i] = NULL;
+    
+    dns_fp = fopen(dns_file, "r");
+    if (dns_fp) {
+        i = 0;    
+        dns_line[sizeof(dns_line)-1] = '\0';
+        
+        while((fgets(dns_line, sizeof(dns_line)-1, dns_fp)) != NULL) {
+            if ((strlen(dns_line) > 1) && (dns_line[strlen(dns_line) - 1] == '\n'))
+                dns_line[strlen(dns_line) - 1] = '\0';
+            //dbg_time("%s", dns_line);
+            if (strstr(dns_line, dns_tag)) {
+                dns_match++;
+                continue;
+            }
+            dns_info[i++] = strdup(dns_line);
+            if (i == MAX_DNS)
+                break;
+        }
+
+        fclose(dns_fp);
+    }
+    else if (errno != ENOENT) {
+        dbg_time("fopen %s fail, errno:%d (%s)", dns_file, errno, strerror(errno));
+        return;
+    }
+    
+    if (dns1 == NULL && dns_match == 0)
+        return;
+
+    dns_fp = fopen(dns_file, "w");
+    if (dns_fp) {
+        if (dns1)
+            fprintf(dns_fp, "nameserver %s %s\n", dns1, dns_tag);
+        if (dns2)
+            fprintf(dns_fp, "nameserver %s %s\n", dns2, dns_tag);
+        
+        for (i = 0; i < MAX_DNS && dns_info[i]; i++)
+            fprintf(dns_fp, "%s\n", dns_info[i]);
+        fclose(dns_fp);
+    }
+    else {
+        dbg_time("fopen %s fail, errno:%d (%s)", dns_file, errno, strerror(errno));
+    }
+
+    for (i = 0; i < MAX_DNS && dns_info[i]; i++)
+        free(dns_info[i]);
+}
+
+pid_t getpid_by_pdp(int pdp, const char* program_name)
+{
+    glob_t gt;
+    int ret;
+    char filter[16];
+    pid_t pid;
+
+    snprintf(filter, sizeof(filter), "-n %d", pdp);
+    ret = glob("/proc/*/cmdline", GLOB_NOSORT, NULL, &gt);
+    if (ret != 0) {
+        dbg_time("glob error, errno = %d(%s)", errno, strerror(errno));
+		return -1;
+    } else {
+        int i = 0, fd = -1;
+        ssize_t nreads;
+        char cmdline[512] = {0};
+
+		for (i = 0; i < (int)gt.gl_pathc; i++) {
+            fd = open(gt.gl_pathv[i], O_RDONLY);
+            if (fd == -1) {
+                dbg_time("open %s failed, errno = %d(%s)", gt.gl_pathv[i], errno, strerror(errno));
+                globfree(&gt);
+                return -1;
+            }
+            
+            nreads = read(fd, cmdline, sizeof(cmdline));
+            if (nreads > 0) {
+                int pos = 0;
+                while (pos < nreads-1) {
+                    if (cmdline[pos] == '\0')
+                        cmdline[pos] = ' ';  // space
+                    pos++;
+                }
+                // printf("%s\n", cmdline);
+            }
+
+            if (strstr(cmdline, program_name) && strstr(cmdline, filter)) {
+            	char path[64] = {0};
+            	char pidstr[64] = {0};
+            	char *p;
+            	
+                dbg_time("%s: %s", gt.gl_pathv[i], cmdline);
+            	strcpy(path, gt.gl_pathv[i]);
+            	p = strstr(gt.gl_pathv[i], "/cmdline");
+            	*p = '\0';
+            	while (*(--p) != '/') ;
+            		
+            	strcpy(pidstr, p+1);
+            	pid = atoi(pidstr);
+            	globfree(&gt);
+                
+                return pid;
+            }
+        }
+    }
+
+    globfree(&gt);
+    return -1;
+}
+
+void ql_get_driver_rmnet_info(PROFILE_T *profile, RMNET_INFO *rmnet_info) {
+    int ifc_ctl_sock;
+    struct ifreq ifr;
+    int rc;
+    int request = 0x89F3;
+    unsigned char data[512];
+
+    memset(rmnet_info, 0x00, sizeof(*rmnet_info));
+
+    ifc_ctl_sock = socket(AF_INET, SOCK_DGRAM, 0);
+    if (ifc_ctl_sock <= 0) {
+        dbg_time("socket() failed: %s\n", strerror(errno));
+        return;
+    }
+    
+    memset(&ifr, 0, sizeof(struct ifreq));
+    strncpy(ifr.ifr_name, profile->usbnet_adapter, IFNAMSIZ);
+    ifr.ifr_name[IFNAMSIZ - 1] = 0;    
+    ifr.ifr_ifru.ifru_data = (void *)data;
+        
+    rc = ioctl(ifc_ctl_sock, request, &ifr);
+    if (rc < 0) {
+        if (errno != ENOTSUP)
+            dbg_time("ioctl(0x%x, qmap_settings) errno:%d (%s), rc=%d", request, errno, strerror(errno), rc);
+    }
+    else {
+        memcpy(rmnet_info, data, sizeof(*rmnet_info));
+    }
+
+    close(ifc_ctl_sock);
+}
+
+void ql_set_driver_qmap_setting(PROFILE_T *profile, QMAP_SETTING *qmap_settings) {
+    int ifc_ctl_sock;
+    struct ifreq ifr;
+    int rc;
+    int request = 0x89F2;
+
+    ifc_ctl_sock = socket(AF_INET, SOCK_DGRAM, 0);
+    if (ifc_ctl_sock <= 0) {
+        dbg_time("socket() failed: %s\n", strerror(errno));
+        return;
+    }
+    
+    memset(&ifr, 0, sizeof(struct ifreq));
+    strncpy(ifr.ifr_name, profile->usbnet_adapter, IFNAMSIZ);
+    ifr.ifr_name[IFNAMSIZ - 1] = 0;    
+    ifr.ifr_ifru.ifru_data = (void *)qmap_settings;
+        
+    rc = ioctl(ifc_ctl_sock, request, &ifr);
+    if (rc < 0) {
+        dbg_time("ioctl(0x%x, qmap_settings) failed: %s, rc=%d", request, strerror(errno), rc);
+    }
+
+    close(ifc_ctl_sock);	
+}
+
+void no_trunc_strncpy(char *dest, const char *src, size_t dest_size)
+{
+    size_t i = 0;
+
+    for (i = 0; i < dest_size && *src; i++) {
+        *dest++ = *src++;
+    }
+
+    *dest = 0;
+}
diff --git a/RM520N-5G/文件/source/util.h b/RM520N-5G/文件/source/util.h
new file mode 100644
index 0000000..eea1756
--- /dev/null
+++ b/RM520N-5G/文件/source/util.h
@@ -0,0 +1,54 @@
+/*
+    Copyright 2025 Quectel Wireless Solutions Co.,Ltd
+
+    Quectel hereby grants customers of Quectel a license to use, modify,
+    distribute and publish the Software in binary form provided that
+    customers shall have no right to reverse engineer, reverse assemble,
+    decompile or reduce to source code form any portion of the Software. 
+    Under no circumstances may customers modify, demonstrate, use, deliver 
+    or disclose any portion of the Software in source code form.
+*/
+
+#ifndef _UTILS_H_
+#define _UTILS_H_
+
+#include <stddef.h>
+#include <glob.h>
+
+struct listnode
+{
+    struct listnode *next;
+    struct listnode *prev;
+};
+
+#define node_to_item(node, container, member) \
+    (container *) (((char*) (node)) - offsetof(container, member))
+
+#define list_declare(name) \
+    struct listnode name = { \
+        .next = &name, \
+        .prev = &name, \
+    }
+
+#define list_for_each(node, list) \
+    for (node = (list)->next; node != (list); node = node->next)
+
+#define list_for_each_reverse(node, list) \
+    for (node = (list)->prev; node != (list); node = node->prev)
+
+void list_init(struct listnode *list);
+void list_add_tail(struct listnode *list, struct listnode *item);
+void list_add_head(struct listnode *head, struct listnode *item);
+void list_remove(struct listnode *item);
+
+#define list_empty(list) ((list) == (list)->next)
+#define list_head(list) ((list)->next)
+#define list_tail(list) ((list)->prev)
+
+int epoll_register(int  epoll_fd, int  fd, unsigned int events);
+int epoll_deregister(int  epoll_fd, int  fd);
+const char * get_time(void);
+unsigned long clock_msec(void);
+pid_t getpid_by_pdp(int, const char*);
+
+#endif
diff --git a/RM520N-5G/文件/多WAN配置/90-pcie_mhi.txt b/RM520N-5G/文件/多WAN配置/90-pcie_mhi.txt
new file mode 100644
index 0000000..dfc0992
--- /dev/null
+++ b/RM520N-5G/文件/多WAN配置/90-pcie_mhi.txt
@@ -0,0 +1 @@
+pcie_mhi mhi_mbim_enabled=1
diff --git a/RM520N-5G/文件/多WAN配置/README-多WAN.md b/RM520N-5G/文件/多WAN配置/README-多WAN.md
new file mode 100644
index 0000000..8366166
--- /dev/null
+++ b/RM520N-5G/文件/多WAN配置/README-多WAN.md
@@ -0,0 +1,57 @@
+# 多 WAN 配置说明（eth1 走 5G / eth0 走宽带，双出口）
+
+> 日期：2026-08-19
+> 目标：istoreos 上，eth0 走宽带（管理+SSH），eth1+5G 专门给主路由当 wan2 备份上游
+
+## 架构
+```
+主路由 (wan1=宽带优先, wan2=5G备份)
+   ├── LAN口 → istoreos eth0 = 192.168.110.200/24 (静态)  走宽带, 管理+SSH
+   └── wan2口 = 192.168.200.2/24, 网关 192.168.200.1
+             └── istoreos eth1 → br-lan = 192.168.200.1/24  (5G NAT出口)
+                  └── 5G rmnet_mhi0.1 (MBIM拨号, 动态IP) → 主路由wan2备份
+```
+- **istoreos 自身流量**（从 eth0 发出）→ 走宽带（默认路由 110.1）
+- **来自 eth1/192.168.200.x 网段**（即主路由 wan2 侧）→ 走 5G（策略路由表 200）
+
+## 关键配置文件（本目录）
+| 文件 | 部署到 istoreos | 作用 |
+|---|---|---|
+| `network.txt` | `/etc/config/network` | eth0 静态 110.200、eth1/br-lan 200.1 |
+| `init.d_wan5g-route` | `/etc/init.d/wan5g-route`(enable) | 策略路由表200 + NAT，开机执行 S96 |
+| `init.d_modem5g` | `/etc/init.d/modem5g`(enable) | MBIM 拨号自启 S95 |
+| `90-pcie_mhi.txt` | `/etc/modules.d/90-pcie_mhi` | 驱动 MBIM 模式 mhi_mbim_enabled=1 |
+| `rc.local` | `/etc/rc.local` | mhi_q 绑定修复(重启失联兜底) |
+
+## 重启后自启顺序
+1. `S95modem5g`：等待 /dev/mhi_MBIM → quectel-CM 拨号 wonet
+2. `rc.local`：MHI 绑定修复（兜底）
+3. `S96wan5g-route`：等待 rmnet_mhi0.1 有 IP → 加策略路由 + NAT
+
+### wan5g-route 核心命令（可手动执行）
+```bash
+grep -q "wan5g" /etc/iproute2/rt_tables || echo "200 wan5g" >> /etc/iproute2/rt_tables
+sysctl -w net.ipv4.ip_forward=1
+# 等待 rmnet 有 IP 后:
+ip rule del from 192.168.200.0/24 lookup wan5g 2>/dev/null
+ip rule add from 192.168.200.0/24 lookup wan5g pref 100
+ip route replace default dev rmnet_mhi0.1 table 200
+iptables -t nat -C POSTROUTING -s 192.168.200.0/24 -o rmnet_mhi0.1 -j MASQUERADE 2>/dev/null || \
+  iptables -t nat -A POSTROUTING -s 192.168.200.0/24 -o rmnet_mhi0.1 -j MASQUERADE
+```
+
+## 验证
+```bash
+# 模拟主路由 wan2 侧流量走 5G（源 200.x 网段）
+ip addr add 192.168.200.2/24 dev br-lan
+ping -c 3 -W 3 -I 192.168.200.2 223.5.5.5   # 应通, 延迟高(走5G)
+ip addr del 192.168.200.2/24 dev br-lan
+# 对比管理流量走宽带
+ping -c 2 -W 2 -I 192.168.110.200 223.5.5.5  # 应通, 延迟低(走宽带)
+```
+
+## 备注
+- **mwan3 已安装**(2.11.16) + luci-app-mwan3，但**未启用**。当前用手写策略路由（更贴合 5G 动态 IP）。如需 wan1/wan2 真负载均衡可后续启用 mwan3。
+- 5G 每次拨号 IP 动态，istoreos 默认路由始终走宽带，5G 只服务 eth1(200 网段)。
+- istoreos 软件源：mirrors.cernet.edu.cn（kmods 源 curl 22 失败，但不影响纯脚本包安装）。
+- 备份：原 `/etc/config/network`（eth0 曾 DHCP 拿 110.135）可回滚。
diff --git a/RM520N-5G/文件/多WAN配置/init.d_modem5g b/RM520N-5G/文件/多WAN配置/init.d_modem5g
new file mode 100644
index 0000000..1a62b89
--- /dev/null
+++ b/RM520N-5G/文件/多WAN配置/init.d_modem5g
@@ -0,0 +1,29 @@
+#!/bin/sh /etc/rc.common
+# RM520N-GL PCIe MBIM 拨号自启 (2026-08-19)
+# 依赖: /etc/rc.local 的 mhi_q 绑定修复先跑, /dev/mhi_MBIM 出现后拨号
+START=95
+STOP=15
+
+start() {
+    echo "modem5g: 等待 /dev/mhi_MBIM ..."
+    local i=0
+    while [ $i -lt 30 ]; do
+        [ -c /dev/mhi_MBIM ] && break
+        sleep 2
+        i=$((i+1))
+    done
+    if [ ! -c /dev/mhi_MBIM ]; then
+        echo "modem5g: /dev/mhi_MBIM 未出现, 放弃拨号"
+        return 1
+    fi
+    echo "modem5g: 开始 MBIM 拨号 (wonet)"
+    start-stop-daemon -S -b -m -p /var/run/quectel_cm.pid \
+        -x /usr/bin/quectel-CM -- -s wonet -f /tmp/quectel_cm.log
+    echo "modem5g: 已启动 quectel-CM"
+}
+
+stop() {
+    echo "modem5g: 停止拨号"
+    start-stop-daemon -K -p /var/run/quectel_cm.pid 2>/dev/null
+    return 0
+}
diff --git a/RM520N-5G/文件/多WAN配置/init.d_wan5g-route b/RM520N-5G/文件/多WAN配置/init.d_wan5g-route
new file mode 100644
index 0000000..b023e86
--- /dev/null
+++ b/RM520N-5G/文件/多WAN配置/init.d_wan5g-route
@@ -0,0 +1,49 @@
+#!/bin/sh /etc/rc.common
+# 5G(rmnet_mhi0.1) 作为 eth1/192.168.200.x 的出口 (2026-08-19)
+# 让主路由 wan2 的流量经 eth1 -> 5G 上网; eth0 管理流量走宽带
+# 依赖: S95modem5g 先拨号, rmnet_mhi0.1 有 IP
+START=96
+STOP=14
+
+setup() {
+    # 确保路由表定义
+    grep -q "wan5g" /etc/iproute2/rt_tables 2>/dev/null || echo "200 wan5g" >> /etc/iproute2/rt_tables
+
+    # 确保 ip_forward
+    sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1
+
+    # 等待 rmnet_mhi0.1 有 IP (拨号需完成)
+    local i=0
+    local rmnet_ip=""
+    while [ $i -lt 60 ]; do
+        rmnet_ip=$(ip -4 addr show rmnet_mhi0.1 2>/dev/null | sed -n "s/.*inet \([0-9.]*\)\/.*/\1/p" | head -1)
+        [ -n "$rmnet_ip" ] && break
+        sleep 2
+        i=$((i+1))
+    done
+    [ -z "$rmnet_ip" ] && { echo "wan5g-route: rmnet_mhi0.1 无IP, 5G未拨号"; return 1; }
+    echo "wan5g-route: rmnet_mhi0.1 = $rmnet_ip"
+
+    # 策略规则 (幂等)
+    ip rule del from 192.168.200.0/24 lookup wan5g 2>/dev/null
+    ip rule add from 192.168.200.0/24 lookup wan5g pref 100 2>/dev/null
+
+    # 5G 默认路由填入表200
+    ip route replace default dev rmnet_mhi0.1 table 200 2>/dev/null
+
+    # NAT: 200网段 -> 5G出口
+    iptables -t nat -C POSTROUTING -s 192.168.200.0/24 -o rmnet_mhi0.1 -j MASQUERADE 2>/dev/null || \
+    iptables -t nat -A POSTROUTING -s 192.168.200.0/24 -o rmnet_mhi0.1 -j MASQUERADE
+
+    echo "wan5g-route: 策略路由+NAT 就绪"
+}
+
+start() { setup; }
+reload() { setup; }
+restart() { setup; }
+stop() {
+    ip rule del from 192.168.200.0/24 lookup wan5g 2>/dev/null
+    ip route del default table 200 2>/dev/null
+    iptables -t nat -D POSTROUTING -s 192.168.200.0/24 -o rmnet_mhi0.1 -j MASQUERADE 2>/dev/null
+    return 0
+}
diff --git a/RM520N-5G/文件/多WAN配置/network.txt b/RM520N-5G/文件/多WAN配置/network.txt
new file mode 100644
index 0000000..6fda699
--- /dev/null
+++ b/RM520N-5G/文件/多WAN配置/network.txt
@@ -0,0 +1,34 @@
+
+config interface 'loopback'
+	option device 'lo'
+	option proto 'static'
+	option ipaddr '127.0.0.1'
+	option netmask '255.0.0.0'
+
+config globals 'globals'
+	option ula_prefix 'fdcf:8956:3e66::/48'
+
+config interface 'wan'
+	option device 'eth0'
+	option proto 'static'
+	option ipaddr '192.168.110.200'
+	option netmask '255.255.255.0'
+	option gateway '192.168.110.1'
+	option dns '223.5.5.5'
+
+config interface 'wan6'
+	option device 'eth0'
+	option proto 'dhcpv6'
+
+config device
+	option name 'br-lan'
+	option type 'bridge'
+	list ports 'eth1'
+
+config interface 'lan'
+	option device 'br-lan'
+	option proto 'static'
+	option ipaddr '192.168.200.1'
+	option netmask '255.255.255.0'
+	option ip6assign '60'
+
diff --git a/RM520N-5G/文件/多WAN配置/rc.local b/RM520N-5G/文件/多WAN配置/rc.local
new file mode 100644
index 0000000..617c32e
--- /dev/null
+++ b/RM520N-5G/文件/多WAN配置/rc.local
@@ -0,0 +1,12 @@
+# Put your custom commands here that should be executed once
+# the system init finished. By default this file does nothing.
+
+# ===== RM520N-GL 说明 (2026-08-20 更新) =====
+# pcie_mhi 驱动由 /etc/modules.d/90-pcie_mhi 开机自动加载(mhi_mbim_enabled=1)。
+# 原生流程即可自启拨号(S95modem5g 等待 /dev/mhi_MBIM 后起 quectel-CM)。
+# 无需在此手动 bind mhi_q —— 手动强绑会抢设备导致 pcie_mhi 失联(SYS_ERR)。
+# 自启链路: 90-pcie_mhi -> S95modem5g(拨号) -> S96wan5g-route(策略路由+NAT)
+# 诊断: dmesg | grep -iE "mhi|pcie_mhi"; ls /dev/mhi_*
+# 故障处理: 模块失联无 /dev/mhi_DUN 时, 先断电重启飞牛; 仍无效再:
+#   echo 0000:00:0a.0 > /sys/bus/pci/drivers/mhi_q/bind  # 临时唤醒
+exit 0
diff --git a/RM520N-5G/文档/RM520N-MBIM拨号成功路线.md b/RM520N-5G/文档/RM520N-MBIM拨号成功路线.md
new file mode 100644
index 0000000..1fff6eb
--- /dev/null
+++ b/RM520N-5G/文档/RM520N-MBIM拨号成功路线.md
@@ -0,0 +1,207 @@
+# RM520N-GL 5G 模块在 iStoreOS(虚拟化直通)下 MBIM 拨号成功路线
+
+> 日期：2026-08-19
+> 环境：宿主飞牛(Fnos) 将移远 RM520N-GL 5G 模块通过 PCIe(vfio-pci) 直通给 iStoreOS 虚拟机
+> 目标：让 iStoreOS 能够拨号上网，5G 模块作为宽带备用(wan2)
+> 状态：✅ 5G 拨号成功、稳定上网、已固化开机自启
+
+---
+
+## 一、最终成果一句话
+
+在 iStoreOS 里，用 **移远官方 Quectel-CM V1.6.8（musl 静态编译）** 通过 **MBIM 模式** 拨号，模块成功拿到运营商内网 IP 并上网（`ping 223.5.5.5` 通）。
+
+**关键结论：RM520N-GL 在 PCIe 直通 + pcie_mhi 驱动下，QMI 模式是死路（模块不响应 QMI），必须用 MBIM 模式。**
+
+---
+
+## 二、环境与拓扑
+
+| 项 | 值 |
+|---|---|
+| 5G 模块 | 移远 RM520N-GL，固件 `RM520NGLAAR03A04M4G`，IMEI 868371050275649 |
+| 模块宿主位置 | 飞牛 `06:00.0 17cb:0308` |
+| 直通方式 | vfio-pci 直通给 istoreos 虚拟机 |
+| 虚拟机内位置 | `00:0a.0 Qualcomm SDX62` |
+| iStoreOS IP | 192.168.110.135 |
+| iStoreOS 登录 | root / SSH 已开启 |
+| 数据通道 | PCIe/RMNET + qmap vlan（MBIM 模式走 `rmnet_mhi0.1`） |
+| AT 通道 | `/dev/mhi_DUN` |
+
+### 关键驱动
+- **pcie_mhi 驱动** V1.3.8（移远私有 MHI 驱动）
+- 加载参数：`mhi_mbim_enabled=1`（**MBIM 模式**）
+- MBIM 模式设备节点：`/dev/mhi_MBIM`（QMI 模式是 `/dev/mhi_QMI0`）
+
+---
+
+## 三、为什么是这样（决策记录）
+
+### 走过的弯路
+1. **ModemManager 识别不了**：移远 pcie_mhi 驱动把控制通道暴露为私有 `/dev/mhi_QMI0`，不是标准 cdc-wdm，mmcli 扫不到。
+2. **luci-app-modem 界面管不到**：修好 `at_port=/dev/mhi_DUN` + `manufacturer=quectel` 后，界面能读到信息但不拨号。
+3. **QMI 拨号失败（V1.6.7）**：系统自带 quectel-CM 1.6.7 只支持 ECM 分支，报 `unsupport software_interface 1`。
+4. **升级 V1.6.8 仍失败（QMI）**：V1.6.8 支持 QMI 分支，但 **模块对 QMI 请求从不响应**——手动发 QMI SYNC 能写入但读不到任何响应；换 `qmap_mode`、软重启都不行。判定是 **RM520N-GL + pcie_mhi v1.3.8 的 QMI 硬伤**。
+5. **✅ 切 MBIM 成功**：驱动 `mhi_mbim_enabled=1` → `/dev/mhi_MBIM` 出现 → quectel-CM 直接拨号成功。完全复现移远官方日志 `pcie_mhi_mbim.txt` 的流程。
+
+### 核心经验
+- **RM520N-GL 在 PCIe/MHI 下能用 MBIM，QMI 通道是死的**（至少 pcie_mhi v1.3.8 + 此固件下如此）。
+- MBIM 模式**不需要 proxy**，`quectel-CM -s <apn>` 直接拨号即可。
+- iStoreOS 是 **musl libc**，必须用 **musl-gcc 静态编译** quectel-CM（glibc 静态编译的 qmi-proxy 在 musl 上闪退/卡死）。
+
+---
+
+## 四、完整复现步骤
+
+### 步骤 1：确认模块拓扑与直通
+```bash
+# 宿主(飞牛)
+lspci | grep 17cb          # 找到 06:00.0 17cb:0308
+# 直通给 istoreos VM 后，guest 内
+lspci | grep -i qualcomm   # 00:0a.0 Qualcomm SDX62
+ls /sys/bus/mhi_q/devices/ # 应看到 0308_00.00.0a_DIAG/DUN/EFS/QMI0 等
+ls /dev/mhi_DUN /dev/mhi_QMI0   # AT 通道在
+```
+
+### 步骤 2：切到 MBIM 模式（关键！）
+```bash
+# 备份当前配置
+cp /etc/modules.d/90-pcie_mhi /etc/modules.d/90-pcie_mhi.bak
+# 卸载驱动
+rmmod pcie_mhi
+# 以 MBIM 模式重新加载
+insmod /lib/modules/$(uname -r)/pcie_mhi.ko mhi_mbim_enabled=1
+# 验证：/dev/mhi_MBIM 出现，/dev/mhi_QMI0 消失
+ls /dev/mhi_MBIM
+# 固化（重启自动 MBIM）
+echo "pcie_mhi mhi_mbim_enabled=1" > /etc/modules.d/90-pcie_mhi
+```
+
+### 步骤 3：部署 musl 版 quectel-CM V1.6.8
+```bash
+# 二进制在 文件/binaries/quectel-CM（musl 静态编译 V1.6.8）
+# 备份旧版 V1.6.7
+cp /usr/bin/quectel-CM /usr/bin/quectel-CM.bak-20260819-167
+# 替换
+cp quectel-CM /usr/bin/quectel-CM
+chmod 755 /usr/bin/quectel-CM
+/usr/bin/quectel-CM 2>&1 | head -1   # 应显示 QConnectManager_Linux_V1.6.8
+```
+
+### 步骤 4：MBIM 拨号（核心命令）
+```bash
+# 直接拨号，不需要 proxy
+/usr/bin/quectel-CM -s wonet -f /tmp/quectel_cm.log
+# 注意：MBIM 模式不要加 -i rmnet_mhi0（会异常）；APN 用 wonet（联通卡）
+```
+成功标志：日志出现 `ActivationState Deactivated -> Activated`，`rmnet_mhi0.1` 拿到 `inet` IP，`ping -I rmnet_mhi0.1 223.5.5.5` 通。
+
+### 步骤 5：开机自启
+```bash
+# 使用 文件/configs/init.d_modem5g
+cp 文件/configs/init.d_modem5g /etc/init.d/modem5g
+chmod 755 /etc/init.d/modem5g
+/etc/init.d/modem5g enable     # 建立 S95modem5g
+# 手动测试
+/etc/init.d/modem5g start
+/etc/init.d/modem5g stop
+```
+
+### 步骤 6：开机绑定修复（已确认非必需，默认跳过）
+```bash
+# 说明 (2026-08-20 更新):
+# 原生流程即可自启拨号: 90-pcie_mhi(驱动) -> S95modem5g(拨号) -> S96wan5g-route(策略路由)
+# rc.local **不需要**手动 bind mhi_q。
+# 教训: 手动强绑`echo 0000:00:0a.0 > /sys/bus/pci/drivers/mhi_q/bind`可能抢设备致 SYS_ERR。
+# 若模块失联(无/dev/mhi_DUN)，先断电重启飞牛，仍无效才可手动 bind 临时唤醒。
+```
+
+---
+
+## 五、已验证的关键事实
+
+### 拨号成功日志（节选，完整见 文件/logs/）
+```
+[08-19_13:00:xx] Quectel_QConnectManager_Linux_V1.6.8
+[08-19_13:00:xx] Modem works in MBIM mode
+[08-19_13:00:xx] cdc_wdm_fd = 8                    # 成功打开 /dev/mhi_MBIM
+[08-19_13:00:xx] mbim_device_caps_query()
+[08-19_13:00:xx] DeviceId:     868371050275649
+[08-19_13:00:xx] FirmwareInfo: RM520NGLAAR03A04M4G
+[08-19_13:00:xx] mbim_subscriber_status_query()
+[08-19_13:00:xx] SimIccId:     89860125801671811893
+[08-19_13:00:xx] RegisterState Unknown -> Home     # 已注册
+[08-19_13:00:xx] PacketServiceState Unknown -> Attached
+[08-19_13:00:xx] mbim_set_connect(onoff=1, sessionID=0)
+[08-19_13:00:xx] ActivationState Deactivated -> Activated   # ← 拨号成功!
+[08-19_13:00:xx] mbim_ip_config(sessionID=0)
+[08-19_13:00:xx] IPv4 = 10.98.xxx.xxx/30            # 拿到内网 IP
+```
+接口验证：
+```
+ip addr show rmnet_mhi0.1   # inet 10.98.xxx.xxx/30 ... state UP
+ping -c 3 -W 2 -I rmnet_mhi0.1 223.5.5.5   # 2/2 received
+```
+
+### 界面管理（MBIM 下 luci 正常）
+```
+sh /usr/share/modem/modem_info.sh /dev/mhi_DUN quectel quectel 1
+# 返回 manufacturer=Quectel, temperature, SIM ready, IMEI/IMSI 正常
+```
+luci 界面（网络→Modem）可作**状态监控**；但 luci 自动拨号(AT激活)不适用于 PCIe MBIM（数据通道由 quectel-CM 控制）。
+
+---
+
+## 六、目录文件清单
+
+```
+RM520N-5G-成功路线/
+├── 文档/
+│   └── RM520N-MBIM拨号成功路线.md        # 本文档
+├── 文件/
+│   ├── binaries/                         # musl 静态编译的 V1.6.8 二进制
+│   │   ├── quectel-CM                    # ★ 拨号主程序（部署到 /usr/bin）
+│   │   ├── quectel-qmi-proxy             # (备用，QMI 模式才需要)
+│   │   ├── quectel-mbim-proxy
+│   │   └── quectel-atc-proxy
+│   ├── source/                           # V1.6.8 完整源码(21 .c + 头文件 + PDF文档)
+│   │   └── Quectel_QConnectManager_Linux_User_Guide_V1.0.pdf
+│   ├── configs/                          # istoreos 配置文件(可直接复用)
+│   │   ├── modem_config.txt              # /etc/config/modem
+│   │   ├── 90-pcie_mhi.txt               # /etc/modules.d/90-pcie_mhi (mhi_mbim_enabled=1)
+│   │   ├── rc.local                      # /etc/rc.local (默认无需绑定, 见故障排查文档)
+│   │   └── init.d_modem5g                # /etc/init.d/modem5g (开机自启拨号)
+│   └── logs/
+│       ├── quectel_cm_success_log.txt    # 本次成功拨号日志(真实)
+│       └── 官方参考_pcie_mhi_mbim.txt    # 移远官方 MBIM 成功日志(参考)
+```
+
+---
+
+## 七、编译说明（如需重编）
+
+iStoreOS 是 musl libc，必须 musl 静态编译：
+
+```bash
+# 在 WSL(Ubuntu) 或其他 x86_64 glibc 环境
+sudo apt install musl-tools
+# musl-gcc 需要 linux 头文件，复制到 musl include
+sudo cp -r /usr/include/linux /usr/include/x86_64-linux-musl/
+sudo cp -r /usr/include/x86_64-linux-gnu/asm /usr/include/x86_64-linux-musl/
+sudo cp -r /usr/include/asm-generic /usr/include/x86_64-linux-musl/
+
+# 编译 quectel-CM（V1.6.8，QMI 分支）
+cd 文件/source
+musl-gcc -O1 -static -pthread -o quectel-CM \
+  QmiWwanCM.c GobiNetCM.c main.c QCQMUX.c QMIThread.c util.c \
+  qmap_bridge_mode.c mbim-cm.c device.c atc.c atchannel.c at_tok.c udhcpc.c
+```
+
+---
+
+## 八、遗留 / 建议
+
+1. **wan2 备份（最终目标）**：5G 已能上网，还差把 `rmnet_mhi0.1` 配成 wan2 备份（wan1 宽带优先）。推荐 mwan3 或 OpenWrt 策略路由。
+2. **luci 界面**：目前可作状态监控。如需界面控制拨号(启停 modem5g)，可在 luci-app-modem 加轻量入口。
+3. **QMI 死路提醒**：不要再尝试 QMI 拨号，此模块此驱动下不通，MBIM 是正解。
+4. **APN**：本次用 `wonet`(联通)。换卡需改 `/etc/init.d/modem5g` 里的 `-s` 参数。
diff --git a/RM520N-5G/文档/RM520N-故障排查与自启链路.md b/RM520N-5G/文档/RM520N-故障排查与自启链路.md
new file mode 100644
index 0000000..05fdda6
--- /dev/null
+++ b/RM520N-5G/文档/RM520N-故障排查与自启链路.md
@@ -0,0 +1,41 @@
+# RM520N-GL 5G 模块故障排查与自启链路（2026-08-20 更新）
+
+## 开机自启链路（已验证可靠）
+```
+/etc/modules.d/90-pcie_mhi  (pcie_mhi mhi_mbim_enabled=1)  驱动加载
+        ↓
+/etc/rc.d/S95modem5g        (等待 /dev/mhi_MBIM 后起 quectel-CM -s wonet)
+        ↓
+/etc/rc.d/S96wan5g-route    (策略路由 from 200.0/24 lookup wan5g + MASQUERADE)
+```
+- **无需**在 rc.local 里手动 bind mhi_q（那会抢设备导致 SYS_ERR）
+- 飞牛断电重启后，原生流程自动恢复拨号（2026-08-20 实测：rmnet_mhi0.1 = 10.x，ping 223.5.5.5 ≈ 8.9ms）
+
+## 故障现象：5G 起不来 / 模块 SYS_ERR
+**症状**：无 rmnet_mhi0.1、无 /dev/mhi_DUN|MBIM、只有 /dev/mhi_BHI、无 quectel-CM 进程
+**dmesg**：`dev_state:SYS_ERR`、`probe failed error -5/-110`
+
+### 排查顺序（重要教训）
+1. **优先断电重启飞牛**（模块真正断电复位；istoreos 内 reboot 不动 PCIe 供电，治不好 SYS_ERR）
+2. 若重启无效，**临时手动唤醒**：
+   ```
+   echo 0000:00:0a.0 > /sys/bus/pci/drivers/mhi_q/bind
+   ```
+   （mhi_q = pcie_mhi 驱动注册名。bind 后 /dev/mhi_MBIM 出现，rmnet 接口建立）
+3. **不要**手动 unbind/rmmod pcie_mhi / rescan 折腾——会把设备弄成"无驱动孤儿"，反而更难恢复
+
+### 已确认的死路（勿重复踩）
+- 禁用 modules.d 里的内核 mhi 驱动（mhi_pci_generic 等）**无效**：它们是 PCI autoload（modalias 拉起的），禁 modules.d 拦不住
+- 手动 rmmod pcie_mhi + 重 insmod **不唤醒**（refcnt 仍 0）
+
+## 移远 pcie_mhi 驱动机制
+- `/lib/modules/6.6.144/pcie_mhi.ko`，alias 为 `MHI_CORE`（非标准 PCI ID 匹配）
+- insmod 后 PCI probe 函数注册为驱动名 **mhi_q**（dmesg 里 `mhi_q 0000:00:0a.0` 就是 pcie_mhi 在跑）
+- 与内核 `mhi_pci_generic`（识别为 qcom-sdx65m，需装高通固件，实际加载失败）竞争同一设备
+- 模块正常时 pcie_mhi 首发 probe 能成功；异常时需要 bind mhi_q 手动唤醒
+
+## 5G 出口行为（2026-08-20 实测）
+- IPv4 HTTP/HTTPS 国内站点：正常（baidu 200）
+- 国外明文 HTTP（如 neverssl.com）：可能被运营商/防火墙过滤（返回空/卡住）
+- 5G 出口 **无 IPv6**（curl -6 返回 000）
+- 主路由双 WAN failover 检测可能因此误判：若主路由用国外站点/双栈做健康检查会误报"外网不通"
diff --git a/RM520N-5G/文档/RM520N-硬件结构与网络拓扑.md b/RM520N-5G/文档/RM520N-硬件结构与网络拓扑.md
new file mode 100644
index 0000000..6726de6
--- /dev/null
+++ b/RM520N-5G/文档/RM520N-硬件结构与网络拓扑.md
@@ -0,0 +1,131 @@
+# 硬件结构与网络拓扑（2026-08-19）
+
+> 峰的家用 NAS/软路由硬件拓扑与 RM520N-GL 5G 模块直通结构
+> 整理日期：2026-08-19
+
+---
+
+## 一、硬件结构
+
+### 宿主机（飞牛 Fnos）
+| 项 | 值 |
+|---|---|
+| 系统 | 飞牛 fnOS（云主机/软路由宿主） |
+| CPU | Intel Core i5-8250U @ 1.60GHz（4核8线程） |
+| 内存 | 15 GiB |
+| 网卡 | 4 × Intel I226-V（enp1s0 / enp2s0 / enp3s0 / enp4s0） |
+| 网卡现状 | enp1s0 = UP，enp4s0 = UP；enp2s0 / enp3s0 = 未接（DOWN） |
+| 虚拟化 | KVM/QEMU（libvirt，`pc-i440fx-7.2`），需用 `vfio` 直通 |
+
+### 5G 模块（移远 RM520N-GL）
+| 项 | 值 |
+|---|---|
+| 型号 | Quectel RM520N-GL |
+| PCI 位置（宿主） | `06:00.0`，PCI_ID `17cb:0308`（Qualcomm Device 0308） |
+| 物理接口 | PCIe / M.2 转接卡（M.2→PCIE ×1） |
+| 直通方式 | vfio-pci 直通给 istoreos 虚拟机 |
+| 固件 | RM520NGLAAR03A04M4G |
+| IMEI | 868371050275649 |
+| SIM | 联通（ICCID 89860125801671811893，IMSI 460092810130406） |
+
+### istoreos 虚拟机（5G 路由器）
+| 项 | 值 |
+|---|---|
+| VM 名称 | adwi9jj4（libvirt domain-1） |
+| 系统 | iStoreOS（OpenWrt 定制版，musl libc） |
+| 登录 IP | 192.168.110.200（root，SSH） |
+| 虚拟网卡 | 2 × virtio-net-pci（tap 桥接） |
+| 直通 | vfio-pci hostdev `0000:06:00.0` → guest PCI `00:0a.0` |
+
+---
+
+## 二、虚拟网卡映射（宿主 ↔ istoreos）
+
+| 宿主网卡 | istoreos 虚拟网卡 | guest 接口 | MAC | 网段/用途 |
+|---|---|---|---|---|
+| enp1s0 (UP) | net0 (virtio, tap) | **eth0** | dc:f9:90:7a:e3:d8 | 192.168.110.200 → 走宽带（管理+SSH） |
+| enp4s0 (UP) | net1 (virtio, tap) | **eth1** | ec:45:6d:3b:62:ef | 192.168.200.1 → 5G 出口（给主路由 wan2） |
+
+> 注：宿主网卡通过 OVS/veth（`enp1s0-ovs`、`enp4s0-ovs` 等）连接。
+
+---
+
+## 三、网络拓扑（逻辑）
+
+```
+                    ┌─────────────────────────────────────────┐
+                    │               主路由 (OpenWrt)             │
+                    │   wan1 = 192.168.1.2  → 光猫宽带 (优先)    │
+                    │   wan2 = 192.168.200.2 → istoreos eth1    │
+                    │   lan  = 192.168.110.1                    │
+                    └──────┬────────────────────┬──────────────┘
+                           │                    │
+                (宽带)     │                    │  (5G 备份出口)
+                           │                    │
+              ┌────────────▼──────┐   ┌─────────▼──────────┐
+              │  istoreos eth0     │   │  istoreos eth1     │
+              │  192.168.110.200   │   │  192.168.200.1     │
+              │  (管理/SSH)        │   │  (NAT → 5G)        │
+              └────────┬──────────┘   └─────────┬──────────┘
+                       │                        │
+                  (直通vfio)                    │
+           ┌───────────▼──────────┐             │
+           │  RM520N-GL 5G 模块    │◄────────────┘
+           │  06:00.0 → 00:0a.0    │
+           │  MBIM → rmnet_mhi0.1  │
+           └──────────────────────┘
+```
+
+### 数据流向
+| 流量 | 路径 | 出口 |
+|---|---|---|
+| istoreos 自身管理 | eth0 → 默认路由 110.1 | **宽带**（主路由 wan1） |
+| 主路由 wan2 侧 (200.x) | eth1 → 策略路由表 200 → 5G NAT | **5G** |
+| 主路由正常上网 | wan1 宽带（192.168.1.2） | **宽带**（优先） |
+| 宽带断时 | 主路由自动切 wan2 → istoreos 5G | **5G**（备份） |
+
+---
+
+## 四、关键驱动与配置
+
+### 驱动
+- **pcie_mhi** V1.3.8（移远私有 MHI 驱动），参数 `mhi_mbim_enabled=1`（**MBIM 模式**）
+- MBIM 设备节点：`/dev/mhi_MBIM`（控制通道）、`/dev/mhi_DUN`（AT 通道）
+- 数据接口：`rmnet_mhi0`（主）、`rmnet_mhi0.1`（实际拨号数据面，qmap vlan）
+
+### istoreos 关键接口
+| 接口 | IP | 作用 |
+|---|---|---|
+| eth0 (wan) | 192.168.110.200/24，网关 110.1 | 宽带/管理 |
+| eth1 (br-lan) | 192.168.200.1/24 | 主路由 wan2 网关 |
+| rmnet_mhi0.1 | 运营商动态 IP (10.x) | 5G 数据面 |
+| docker0 / br-lan | — | 系统默认 |
+
+### 开机自启链（重启自动恢复）
+1. **/etc/modules.d/90-pcie_mhi**：`pcie_mhi mhi_mbim_enabled=1` 驱动加载
+2. **S95modem5g**：等待 `/dev/mhi_MBIM` → `quectel-CM -s wonet` 拨号（MBIM）
+3. **S96wan5g-route**：等待 `rmnet_mhi0.1` 有 IP → 加策略路由表 200 + NAT
+
+> 注：rc.local **不需要**手动 bind mhi_q（手动强绑会抢设备致 SYS_ERR）。模块失联时先断电重启飞牛，仍无效再手动 `echo 0000:00:0a.0 > /sys/bus/pci/drivers/mhi_q/bind` 临时唤醒。详见《RM520N-故障排查与自启链路.md》
+
+---
+
+## 五、当前 IP 网段一览
+
+| 网段 | 用途 | 关键设备 |
+|---|---|---|
+| 192.168.1.0/24 | 光猫宽带 | 主路由 wan1 = 192.168.1.2 |
+| 192.168.110.0/24 | 主路由 LAN | 主路由 110.1，istoreos eth0 = 110.200 |
+| 192.168.200.0/24 | 主路由 wan2 ↔ istoreos eth1 | 主路由 wan2 = 200.2，istoreos eth1 = 200.1 |
+| 10.x.x.x | 5G 运营商内网 | istoreos rmnet_mhi0.1 |
+
+---
+
+## 六、备份与归档
+
+- 完整成功路线归档于本目录上级：`/vol2/1000/OS/RM520N-5G-成功路线/`
+  - `文件/configs/` 基础拨号配置
+  - `文件/多WAN配置/` 双出口（eth1→5G / eth0→宽带）
+  - `文件/binaries/` musl 编译的 Quectel-CM V1.6.8
+  - `文件/source/` V1.6.8 源码
+- 归档压缩包：`/vol2/1000/OS/RM520N-5G-成功路线.tar.gz`
diff --git a/lede b/lede
new file mode 160000
index 0000000..a09ade8
--- /dev/null
+++ b/lede
@@ -0,0 +1 @@
+Subproject commit a09ade85b34407039303bbe55131d2b8b1328465
diff --git a/luci-feed-inspect b/luci-feed-inspect
new file mode 160000
index 0000000..ee9eee0
--- /dev/null
+++ b/luci-feed-inspect
@@ -0,0 +1 @@
+Subproject commit ee9eee076753591af594cac548881a5feca8ca82