From bc39c122551df74df4e9729c71c297476bcfb693 Mon Sep 17 00:00:00 2001 From: xu_lei_123 Date: Wed, 19 Apr 2023 22:03:44 +0800 Subject: [PATCH] update to 1.6.20 --- apply-patch | 4 +- containerd.spec | 11 +- ...-grpc-vendor-grpc-fix-grpc-map-panic.patch | 63 - ...ount-steal-time-when-calculating-Sys.patch | 44 - ...03-oci-oci-add-files-cgroups-support.patch | 51 - .../0004-runv-vendor-runv-compatibility.patch | 63 - .../0005-containerd-add-spec-for-build.patch | 69 - ...him-optimize-shim-lock-in-runtime-v1.patch | 320 - ...crease-reaper-buffer-size-and-non-bl.patch | 109 - ...untime-Use-named-pipes-for-shim-logs.patch | 578 -- ...-fix-pipe-in-broken-may-cause-shim-l.patch | 38 - ...-fix-pipe-in-broken-may-cause-shim-l.patch | 52 - ...-Add-timeout-and-cancel-to-shim-fifo.patch | 95 - ...0012-bump-bump-containerd-to-1.2.0.2.patch | 36 - ...port-log-init-pid-to-start-event-log.patch | 50 - ...end-exit-event-when-detect-container.patch | 84 - ...0015-restore-cleanup-container-pid-1.patch | 122 - ...eate-runc-delete-force-before-create.patch | 31 - ...g-init.exit-indicate-container-is-ex.patch | 65 - ...d-shim-Dump-log-to-file-when-docker-.patch | 42 - ...heck-shim-alive-when-containerd-is-r.patch | 47 - ...esend-pending-exit-events-on-restore.patch | 357 - ...d-Update-the-version-info-of-contain.patch | 59 - ...0022-containerd-bump-version-1.2.0.4.patch | 29 - ...ntainerd-set-create-and-exec-timeout.patch | 218 - ...te-cleanup-runc-dirty-files-on-start.patch | 54 - ...5-restore-skip-load-task-in-creating.patch | 74 - .../0026-exit-optimize-init.exit-record.patch | 96 - patch/0027-log-make-tester-happy.patch | 48 - ...-delete-task-in-containerd-restoring.patch | 33 - ...9-restore-delete-task-asynchronously.patch | 35 - ...fix-events-lost-when-loadTask-failed.patch | 45 - .../0031-containerd-enable-relro-flags.patch | 28 - .../0032-containerd-enable-bep-ldflags.patch | 45 - ...containerd-fix-opened-file-not-close.patch | 28 - ...4-containerd-add-buildid-in-Makefile.patch | 28 - ...d-fix-the-path-of-containerd.spec-in.patch | 82 - ...d-support-container-start-timeout-se.patch | 69 - ...7-containerd-Fix-fd-leak-of-shim-log.patch | 55 - ...d-fix-shim-std-logs-not-close-after-.patch | 59 - ...inerd-add-timeout-for-I-O-waitgroups.patch | 89 - ...inerd-support-kill-D-state-container.patch | 65 - ...ainerd-fix-shouldKillAllOnExit-check.patch | 43 - ...tainerd-modify-containerd-shim-to-ad.patch | 51 - ...d-add-shim-exit-when-bundle-dir-does.patch | 47 - ...containerd-call-runv-delete-directly.patch | 80 - ...d-close-inherit-shim.sock-fd-to-adap.patch | 34 - ...ontainerd-run-state-with-timeout-10s.patch | 77 - patch/0044-containerd-add-copyright.patch | 38 - ...d-change-tmpfile-directory-when-exec.patch | 29 - ...ntainerd-shim-disable-fast-gc-on-arm.patch | 53 - .../0046-containerd-support-hot-upgrade.patch | 630 -- ...ainerd-shim-exit-initiative-after-3s.patch | 30 - ...erd-modify-shim-initiative-exit-time.patch | 32 - ...m-initiative-exit-time-for-post-hook.patch | 84 - ...inerd-warp-and-process-return-errors.patch | 170 - ...nerd-add-timeout-for-containerd-shim.patch | 134 - ...nerd-modify-runtime-root-if-containe.patch | 266 - ...d-add-pid-check-to-avoid-poststop-ho.patch | 81 - ...ntainerd-clean-up-residual-container.patch | 100 - ...d-add-LLT-for-containerd-shim-timeou.patch | 115 - ...56-containerd-save-dumpstack-to-file.patch | 51 - ...inerd-add-timeout-for-delete-command.patch | 150 - ...rd-use-git-commit-to-store-commit-ID.patch | 26 - ...GO_GCFLAGS-to-containerd-shim-making.patch | 26 - ...t-disable-cgo-in-containerd-shim-mak.patch | 28 - ...-if-bundle-exists-before-create-bund.patch | 66 - ...nerd-use-path-based-socket-for-shims.patch | 318 - ...init-directly-if-runtime-kill-failed.patch | 37 - ...nerd-add-sys-symbol-to-support-riscv.patch | 7977 ----------------- ...-task-list-to-avoid-unnecessary-clea.patch | 30 - ...erd-add-blot-symbol-to-support-riscv.patch | 31 - patch/0065-containerd-fix-dead-loop.patch | 37 - ...p-dangling-shim-by-brand-new-context.patch | 41 - ...tial-panic-for-task-in-unknown-state.patch | 89 - ...containerd-compile-option-compliance.patch | 49 - patch/0069-containerd-add-check-in-spec.patch | 27 - ...container-init-process-if-runc-start.patch | 105 - ...ontainerd-shim-residual-when-kill-co.patch | 45 - ...tainerd-fix-deadlock-on-commit-error.patch | 60 - ...containerd-backport-upstream-patches.patch | 1212 --- ...-exec-event-missing-due-to-pid-reuse.patch | 71 - ...t-when-pause-contaienr-and-kill-shim.patch | 36 - ...tart-container-failed-with-id-exists.patch | 34 - patch/0077-containerd-drop-opt-package.patch | 25 - ...erd-bump-containerd-ttrpc-699c4e40d1.patch | 149 - ...rd-fix-race-access-for-mobySubcribed.patch | 47 - ...containerd-improve-log-for-debugging.patch | 137 - ...erd-reduce-permissions-for-bundle-di.patch | 138 - ...d-fix-publish-command-wait-block-for.patch | 25 - ...tainerd-optimize-cgo-compile-options.patch | 34 - ...erd-Use-fs.RootPath-when-mounting-vo.patch | 40 - ...id-lock-after-set-process-exited-to-.patch | 37 - ...-Limit-the-response-size-of-ExecSync.patch | 133 - ...t-manifest-provided-URLs-differently.patch | 65 - ...-Use-chmod-path-for-checking-symlink.patch | 30 - ...089-containerd-Add-lock-for-ListPids.patch | 31 - ...idate-document-type-before-unmarshal.patch | 117 - ...1-schema1-reject-ambiguous-documents.patch | 43 - ...nerd-add-CGO-sercurity-build-options.patch | 38 - ...-containerd-fix-version-number-wrong.patch | 36 - ...ontainerd-Fix-goroutine-leak-in-Exec.patch | 75 - v1.6.18.zip => v1.6.20.zip | Bin 11919492 -> 11989915 bytes 103 files changed, 10 insertions(+), 17400 deletions(-) delete mode 100644 patch/0001-grpc-vendor-grpc-fix-grpc-map-panic.patch delete mode 100644 patch/0002-sys-sys-count-steal-time-when-calculating-Sys.patch delete mode 100644 patch/0003-oci-oci-add-files-cgroups-support.patch delete mode 100644 patch/0004-runv-vendor-runv-compatibility.patch delete mode 100644 patch/0005-containerd-add-spec-for-build.patch delete mode 100644 patch/0006-shim-optimize-shim-lock-in-runtime-v1.patch delete mode 100644 patch/0007-shim-Increase-reaper-buffer-size-and-non-bl.patch delete mode 100644 patch/0008-runtime-Use-named-pipes-for-shim-logs.patch delete mode 100644 patch/0009-runtime-fix-pipe-in-broken-may-cause-shim-l.patch delete mode 100644 patch/0010-runtime-fix-pipe-in-broken-may-cause-shim-l.patch delete mode 100644 patch/0011-runtime-Add-timeout-and-cancel-to-shim-fifo.patch delete mode 100644 patch/0012-bump-bump-containerd-to-1.2.0.2.patch delete mode 100644 patch/0013-log-support-log-init-pid-to-start-event-log.patch delete mode 100644 patch/0014-event-resend-exit-event-when-detect-container.patch delete mode 100644 patch/0015-restore-cleanup-container-pid-1.patch delete mode 100644 patch/0016-create-runc-delete-force-before-create.patch delete mode 100644 patch/0017-exit-using-init.exit-indicate-container-is-ex.patch delete mode 100644 patch/0018-containerd-shim-Dump-log-to-file-when-docker-.patch delete mode 100644 patch/0019-restore-check-shim-alive-when-containerd-is-r.patch delete mode 100644 patch/0020-events-resend-pending-exit-events-on-restore.patch delete mode 100644 patch/0021-containerd-Update-the-version-info-of-contain.patch delete mode 100644 patch/0022-containerd-bump-version-1.2.0.4.patch delete mode 100644 patch/0023-containerd-set-create-and-exec-timeout.patch delete mode 100644 patch/0024-create-cleanup-runc-dirty-files-on-start.patch delete mode 100644 patch/0025-restore-skip-load-task-in-creating.patch delete mode 100644 patch/0026-exit-optimize-init.exit-record.patch delete mode 100644 patch/0027-log-make-tester-happy.patch delete mode 100644 patch/0028-restore-delete-task-in-containerd-restoring.patch delete mode 100644 patch/0029-restore-delete-task-asynchronously.patch delete mode 100644 patch/0030-event-fix-events-lost-when-loadTask-failed.patch delete mode 100644 patch/0031-containerd-enable-relro-flags.patch delete mode 100644 patch/0032-containerd-enable-bep-ldflags.patch delete mode 100644 patch/0033-containerd-fix-opened-file-not-close.patch delete mode 100644 patch/0034-containerd-add-buildid-in-Makefile.patch delete mode 100644 patch/0035-containerd-fix-the-path-of-containerd.spec-in.patch delete mode 100644 patch/0036-containerd-support-container-start-timeout-se.patch delete mode 100644 patch/0037-containerd-Fix-fd-leak-of-shim-log.patch delete mode 100644 patch/0037-containerd-fix-shim-std-logs-not-close-after-.patch delete mode 100644 patch/0038-containerd-add-timeout-for-I-O-waitgroups.patch delete mode 100644 patch/0038-containerd-support-kill-D-state-container.patch delete mode 100644 patch/0039-containerd-fix-shouldKillAllOnExit-check.patch delete mode 100644 patch/0039-containerd-modify-containerd-shim-to-ad.patch delete mode 100644 patch/0040-containerd-add-shim-exit-when-bundle-dir-does.patch delete mode 100644 patch/0041-containerd-fix-containerd-call-runv-delete-directly.patch delete mode 100644 patch/0042-containerd-close-inherit-shim.sock-fd-to-adap.patch delete mode 100644 patch/0043-containerd-run-state-with-timeout-10s.patch delete mode 100644 patch/0044-containerd-add-copyright.patch delete mode 100644 patch/0044-containerd-change-tmpfile-directory-when-exec.patch delete mode 100644 patch/0045-containerd-shim-disable-fast-gc-on-arm.patch delete mode 100644 patch/0046-containerd-support-hot-upgrade.patch delete mode 100644 patch/0047-containerd-shim-exit-initiative-after-3s.patch delete mode 100644 patch/0048-containerd-modify-shim-initiative-exit-time.patch delete mode 100644 patch/0049-contaienrd-modify-shim-initiative-exit-time-for-post-hook.patch delete mode 100644 patch/0050-containerd-warp-and-process-return-errors.patch delete mode 100644 patch/0051-containerd-add-timeout-for-containerd-shim.patch delete mode 100644 patch/0052-containerd-modify-runtime-root-if-containe.patch delete mode 100644 patch/0053-containerd-add-pid-check-to-avoid-poststop-ho.patch delete mode 100644 patch/0054-containerd-clean-up-residual-container.patch delete mode 100644 patch/0055-containerd-add-LLT-for-containerd-shim-timeou.patch delete mode 100644 patch/0056-containerd-save-dumpstack-to-file.patch delete mode 100644 patch/0057-containerd-add-timeout-for-delete-command.patch delete mode 100644 patch/0058-containerd-use-git-commit-to-store-commit-ID.patch delete mode 100644 patch/0059-containerd-add-GO_GCFLAGS-to-containerd-shim-making.patch delete mode 100644 patch/0060-containerd-do-not-disable-cgo-in-containerd-shim-mak.patch delete mode 100644 patch/0061-containerd-check-if-bundle-exists-before-create-bund.patch delete mode 100644 patch/0062-containerd-use-path-based-socket-for-shims.patch delete mode 100644 patch/0063-containerd-kill-init-directly-if-runtime-kill-failed.patch delete mode 100644 patch/0064-containerd-add-sys-symbol-to-support-riscv.patch delete mode 100644 patch/0064-containerd-check-task-list-to-avoid-unnecessary-clea.patch delete mode 100644 patch/0065-containerd-add-blot-symbol-to-support-riscv.patch delete mode 100644 patch/0065-containerd-fix-dead-loop.patch delete mode 100644 patch/0066-containerd-cleanup-dangling-shim-by-brand-new-context.patch delete mode 100644 patch/0067-containerd-fix-potential-panic-for-task-in-unknown-state.patch delete mode 100644 patch/0068-containerd-compile-option-compliance.patch delete mode 100644 patch/0069-containerd-add-check-in-spec.patch delete mode 100644 patch/0070-containerd-kill-container-init-process-if-runc-start.patch delete mode 100644 patch/0071-containerd-fix-containerd-shim-residual-when-kill-co.patch delete mode 100644 patch/0072-containerd-fix-deadlock-on-commit-error.patch delete mode 100644 patch/0073-containerd-backport-upstream-patches.patch delete mode 100644 patch/0074-containerd-fix-exec-event-missing-due-to-pid-reuse.patch delete mode 100644 patch/0075-containerd-fix-dm-left-when-pause-contaienr-and-kill-shim.patch delete mode 100644 patch/0076-containerd-fix-start-container-failed-with-id-exists.patch delete mode 100644 patch/0077-containerd-drop-opt-package.patch delete mode 100644 patch/0078-containerd-bump-containerd-ttrpc-699c4e40d1.patch delete mode 100644 patch/0079-containerd-fix-race-access-for-mobySubcribed.patch delete mode 100644 patch/0080-containerd-improve-log-for-debugging.patch delete mode 100644 patch/0081-containerd-reduce-permissions-for-bundle-di.patch delete mode 100644 patch/0082-containerd-fix-publish-command-wait-block-for.patch delete mode 100644 patch/0083-containerd-optimize-cgo-compile-options.patch delete mode 100644 patch/0084-containerd-Use-fs.RootPath-when-mounting-vo.patch delete mode 100644 patch/0085-containerd-put-get-pid-lock-after-set-process-exited-to-.patch delete mode 100644 patch/0086-containerd-Limit-the-response-size-of-ExecSync.patch delete mode 100644 patch/0087-containerd-treat-manifest-provided-URLs-differently.patch delete mode 100644 patch/0088-containerd-Use-chmod-path-for-checking-symlink.patch delete mode 100644 patch/0089-containerd-Add-lock-for-ListPids.patch delete mode 100644 patch/0090-images-validate-document-type-before-unmarshal.patch delete mode 100644 patch/0091-schema1-reject-ambiguous-documents.patch delete mode 100644 patch/0092-containerd-add-CGO-sercurity-build-options.patch delete mode 100644 patch/0093-containerd-fix-version-number-wrong.patch delete mode 100644 patch/0094-containerd-Fix-goroutine-leak-in-Exec.patch rename v1.6.18.zip => v1.6.20.zip (88%) diff --git a/apply-patch b/apply-patch index 26311ed..24d7d0b 100755 --- a/apply-patch +++ b/apply-patch @@ -7,11 +7,11 @@ set -ex -pkg=containerd-1.6.18 +pkg=containerd-1.6.20 cwd=$PWD src=$cwd/$pkg -unzip v1.6.18.zip +unzip v1.6.20.zip cd $src git init diff --git a/containerd.spec b/containerd.spec index 7e80ed6..1ec8a30 100644 --- a/containerd.spec +++ b/containerd.spec @@ -1,12 +1,12 @@ %global goipath github.com/containerd/containerd %global debug_package %{nil} -Version: 1.6.18 +Version: 1.6.20 Name: containerd Release: 1 Summary: An industry-standard container runtime License: ASL 2.0 URL: https://containerd.io -Source0: https://github.com/containerd/containerd/archive/v1.6.18.zip +Source0: https://github.com/containerd/containerd/archive/v1.6.20.zip Source1: apply-patch BuildRequires: golang glibc-static make btrfs-progs-devel git @@ -48,13 +48,18 @@ install -p -m 755 bin/ctr $RPM_BUILD_ROOT/%{_bindir}/ctr %{_bindir}/ctr %changelog +* Wed Apr 19 2023 xulei - 1.6.20-1 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:update to 1.6.20 + * Thu Feb 23 2023 xingweizheng - 1.6.18-1 - Type:bugfix - ID:NA - SUG:NA - DESC:update to 1.6.18 - * Thu Feb 23 2023 xingweizheng - 1.6.9-1 - Type:bugfix - ID:NA diff --git a/patch/0001-grpc-vendor-grpc-fix-grpc-map-panic.patch b/patch/0001-grpc-vendor-grpc-fix-grpc-map-panic.patch deleted file mode 100644 index d350d24..0000000 --- a/patch/0001-grpc-vendor-grpc-fix-grpc-map-panic.patch +++ /dev/null @@ -1,63 +0,0 @@ -From fe090d706a522392e30dd4c44447f915ec99c1a0 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Sat, 22 Dec 2018 15:16:53 +0800 -Subject: [PATCH 01/27] vendor: grpc: fix grpc map panic - -reason: Fix grpc map panic - -cherry-pick from containerd-0.2.8 - -a8cdda827867cec97568318368a7aa40097d0487 - -Fix grpc map panic - -Description: - In golang, if we read/write map in different goroutine, it may panic. - We need to add lock to protect the map data when read/write the map. - -Now the grpc map is only protected by a mutex while register, not -protected in reading process(handleStream function). - -This MR will use a RWMutex to protect this map. - -Change-Id: I786bd99234461c40fcb57621fd7c1fb4faa0c208 -Signed-off-by: jingrui ---- - vendor/google.golang.org/grpc/server.go | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/vendor/google.golang.org/grpc/server.go b/vendor/google.golang.org/grpc/server.go -index 4969331..77f7840 100644 ---- a/vendor/google.golang.org/grpc/server.go -+++ b/vendor/google.golang.org/grpc/server.go -@@ -90,7 +90,7 @@ type service struct { - type Server struct { - opts options - -- mu sync.Mutex // guards following -+ mu sync.RWMutex // guards following - lis map[net.Listener]bool - conns map[io.Closer]bool - serve bool -@@ -438,6 +438,8 @@ type ServiceInfo struct { - // Service names include the package names, in the form of .. - func (s *Server) GetServiceInfo() map[string]ServiceInfo { - ret := make(map[string]ServiceInfo) -+ s.mu.RLock() -+ defer s.mu.RUnlock() - for n, srv := range s.m { - methods := make([]MethodInfo, 0, len(srv.md)+len(srv.sd)) - for m := range srv.md { -@@ -1221,7 +1223,9 @@ func (s *Server) handleStream(t transport.ServerTransport, stream *transport.Str - } - service := sm[:pos] - method := sm[pos+1:] -+ s.mu.RLock() - srv, ok := s.m[service] -+ s.mu.RUnlock() - if !ok { - if unknownDesc := s.opts.unknownStreamDesc; unknownDesc != nil { - s.processStreamingRPC(t, stream, nil, unknownDesc, trInfo) --- -2.7.4.3 - diff --git a/patch/0002-sys-sys-count-steal-time-when-calculating-Sys.patch b/patch/0002-sys-sys-count-steal-time-when-calculating-Sys.patch deleted file mode 100644 index 57dc16b..0000000 --- a/patch/0002-sys-sys-count-steal-time-when-calculating-Sys.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 003dc7956765712fdf4a893c2d541af2e2d0f300 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Sat, 22 Dec 2018 15:44:50 +0800 -Subject: [PATCH 02/27] sys: sys: count steal time when calculating - SystemCPUUsage - -reason: count steal time when calculating SystemCPUUsage - -cherry-pick from containerd-0.2.8 - -13f22eecd33d30520ace277822ac5f0acb387e75 - -containerd: count steal time when calculating SystemCPUUsage - -[Changelog]: when counting docker stat in virtual machines, now containerd do not count steal time when calculating SystemCPUUsage, which causes that cpuusage value larger than its actua$ -[Author]git - -Change-Id: I2b62c9508cbdc444d514116f4bea5aad3d292af5 -Signed-off-by: jingrui ---- - sys/proc.go | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/sys/proc.go b/sys/proc.go -index 496eb1f..82a6351 100644 ---- a/sys/proc.go -+++ b/sys/proc.go -@@ -61,11 +61,11 @@ func GetSystemCPUUsage() (uint64, error) { - parts := strings.Fields(line) - switch parts[0] { - case "cpu": -- if len(parts) < 8 { -+ if len(parts) < 9 { - return 0, fmt.Errorf("bad format of cpu stats") - } - var totalClockTicks uint64 -- for _, i := range parts[1:8] { -+ for _, i := range parts[1:9] { - v, err := strconv.ParseUint(i, 10, 64) - if err != nil { - return 0, fmt.Errorf("error parsing cpu stats") --- -2.7.4.3 - diff --git a/patch/0003-oci-oci-add-files-cgroups-support.patch b/patch/0003-oci-oci-add-files-cgroups-support.patch deleted file mode 100644 index 41c89e9..0000000 --- a/patch/0003-oci-oci-add-files-cgroups-support.patch +++ /dev/null @@ -1,51 +0,0 @@ -From c9cc468949d80c663524f5b764e2c661af13bca2 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Sat, 22 Dec 2018 16:25:07 +0800 -Subject: [PATCH 03/27] oci: oci: add files cgroups support - -reason: Add file fds limit - -cherry-pick from containerd-0.2.8 - -29b822599b86f823d5a9f94df1cdceea485e0b19 - -Add file fds limit - -With the patch(https://lwn.net/Articles/604129/),we can limit the -num of open files in container. - -Change-Id: I72b45430dd7535727c4af9e190bbb345ba8ee316 -Signed-off-by: jingrui ---- - vendor/github.com/opencontainers/runtime-spec/specs-go/config.go | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go b/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go -index f32698c..ac24cde 100644 ---- a/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go -+++ b/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go -@@ -314,6 +314,12 @@ type LinuxPids struct { - Limit int64 `json:"limit"` - } - -+// Files for Linux cgroup 'files' resource management (https://lwn.net/Articles/604129/) -+type Files struct { -+ // Maximum number of open files". -+ Limit *int64 `json:"limit,omitempty"` -+} -+ - // LinuxNetwork identification and priority configuration - type LinuxNetwork struct { - // Set class identifier for container's network packets -@@ -340,6 +346,8 @@ type LinuxResources struct { - CPU *LinuxCPU `json:"cpu,omitempty"` - // Task resource restriction configuration. - Pids *LinuxPids `json:"pids,omitempty"` -+ // Files resource restriction configuration. -+ Files *Files `json:"files,omitempty"` - // BlockIO restriction configuration - BlockIO *LinuxBlockIO `json:"blockIO,omitempty"` - // Hugetlb limit (in bytes) --- -2.7.4.3 - diff --git a/patch/0004-runv-vendor-runv-compatibility.patch b/patch/0004-runv-vendor-runv-compatibility.patch deleted file mode 100644 index d86fadd..0000000 --- a/patch/0004-runv-vendor-runv-compatibility.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 5fa863a6ea74ed24cfcc0c16eaa5e5a4e77387ec Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Wed, 26 Dec 2018 12:08:20 +0800 -Subject: [PATCH 04/27] runv: vendor: runv compatibility - -reason: fix manslaughter of runtime delete process - -cherry-pick from containerd-0.2.8 - -reference: - -7906753998667b5a9fa9a996f4a0e41d4736d5c1 - -contaierd-17: fix manslaughter of runtime delete process - -fix manslaughter of runtime delete process - -f82956a89ca7d7cea3bdd5fcd4d4fd70c313f378 - -containerd-17: fix qemu remaining when dockerd restart - -fix qemu remaining when dockerd restart and container start concurrency - -Change-Id: Id23456e90961041194c946a289ae790327b874c8 -Signed-off-by: jingrui ---- - vendor/github.com/containerd/go-runc/command_linux.go | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - -diff --git a/vendor/github.com/containerd/go-runc/command_linux.go b/vendor/github.com/containerd/go-runc/command_linux.go -index 71b52f9..6ad27be 100644 ---- a/vendor/github.com/containerd/go-runc/command_linux.go -+++ b/vendor/github.com/containerd/go-runc/command_linux.go -@@ -20,9 +20,17 @@ import ( - "context" - "os" - "os/exec" -+ "strings" - "syscall" - ) - -+func (r *Runc) isrunv() bool { -+ if strings.Contains(r.Command, "runv") { -+ return true -+ } -+ return false -+} -+ - func (r *Runc) command(context context.Context, args ...string) *exec.Cmd { - command := r.Command - if command == "" { -@@ -33,7 +41,7 @@ func (r *Runc) command(context context.Context, args ...string) *exec.Cmd { - Setpgid: r.Setpgid, - } - cmd.Env = os.Environ() -- if r.PdeathSignal != 0 { -+ if r.PdeathSignal != 0 && !r.isrunv() { - cmd.SysProcAttr.Pdeathsig = r.PdeathSignal - } - --- -2.7.4.3 - diff --git a/patch/0005-containerd-add-spec-for-build.patch b/patch/0005-containerd-add-spec-for-build.patch deleted file mode 100644 index 3a67a02..0000000 --- a/patch/0005-containerd-add-spec-for-build.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 8e46f370733951e6decec6dd36b0c13308ced2c2 Mon Sep 17 00:00:00 2001 -From: caihaomin -Date: Mon, 21 Jan 2019 22:31:05 +0800 -Subject: [PATCH 05/27] containerd: add spec for build - -reason:add spec for build - -Change-Id: I42d9d32e4898c006194df1ead4735155b4785584 -Signed-off-by: caihaomin ---- - hack/containerd.spec | 46 ++++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 46 insertions(+) - create mode 100644 hack/containerd.spec - -diff --git a/hack/containerd.spec b/hack/containerd.spec -new file mode 100644 -index 0000000..f53c37b ---- /dev/null -+++ b/hack/containerd.spec -@@ -0,0 +1,46 @@ -+%global goipath github.com/containerd/containerd -+%global debug_package %{nil} -+Version: 1.2.0 -+ -+Name: containerd -+Release: 1%{?dist} -+Summary: An industry-standard container runtime -+License: ASL 2.0 -+URL: https://containerd.io -+Source0: containerd-1.2.0.tar.gz -+ -+BuildRequires: golang glibc-static make -+BuildRequires: btrfs-progs-devel -+ -+ -+%description -+containerd is an industry-standard container runtime with an emphasis on -+simplicity, robustness and portability. It is available as a daemon for Linux -+and Windows, which can manage the complete container lifecycle of its host -+system: image transfer and storage, container execution and supervision, -+low-level storage and network attachments, etc. -+ -+ -+%prep -+%setup -c -n containerd -+ -+%build -+GO_BUILD_PATH=$PWD/_build -+install -m 0755 -vd $(dirname $GO_BUILD_PATH/src/%{goipath}) -+ln -fs $PWD $GO_BUILD_PATH/src/%{goipath} -+cd $GO_BUILD_PATH/src/%{goipath} -+export GOPATH=$GO_BUILD_PATH:%{gopath} -+export BUILDTAGS="no_btrfs no_cri" -+make -+ -+%install -+install -d $RPM_BUILD_ROOT/%{_bindir} -+install -p -m 755 bin/containerd $RPM_BUILD_ROOT/%{_bindir}/containerd -+install -p -m 755 bin/containerd-shim $RPM_BUILD_ROOT/%{_bindir}/containerd-shim -+ -+%files -+%{_bindir}/containerd -+%{_bindir}/containerd-shim -+ -+ -+%changelog --- -2.7.4.3 - diff --git a/patch/0006-shim-optimize-shim-lock-in-runtime-v1.patch b/patch/0006-shim-optimize-shim-lock-in-runtime-v1.patch deleted file mode 100644 index 5b46980..0000000 --- a/patch/0006-shim-optimize-shim-lock-in-runtime-v1.patch +++ /dev/null @@ -1,320 +0,0 @@ -From 31621148229d56835575189c71e80339fba9f1fc Mon Sep 17 00:00:00 2001 -From: lujingxiao -Date: Wed, 23 Jan 2019 14:55:27 +0800 -Subject: [PATCH 06/27] shim: optimize shim lock in runtime v1 - -reason: apply lock only around process map of shim service, -avoid lock affect other procs operations. - -Cherry-pick from upstream c206da795 - -Change-Id: I33f0f6b3537673533fdb60afb7a0295ac9665f11 -Signed-off-by: Ace-Tang -Signed-off-by: lujingxiao ---- - runtime/v1/shim/service.go | 144 +++++++++++++++++++++++---------------------- - 1 file changed, 75 insertions(+), 69 deletions(-) - -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index d76d580..679982a 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -114,9 +114,6 @@ type Service struct { - - // Create a new initial process and container with the underlying OCI runtime - func (s *Service) Create(ctx context.Context, r *shimapi.CreateTaskRequest) (_ *shimapi.CreateTaskResponse, err error) { -- s.mu.Lock() -- defer s.mu.Unlock() -- - var mounts []proc.Mount - for _, m := range r.Rootfs { - mounts = append(mounts, proc.Mount{ -@@ -158,6 +155,10 @@ func (s *Service) Create(ctx context.Context, r *shimapi.CreateTaskRequest) (_ * - return nil, errors.Wrapf(err, "failed to mount rootfs component %v", m) - } - } -+ -+ s.mu.Lock() -+ defer s.mu.Unlock() -+ - process, err := newInit( - ctx, - s.config.Path, -@@ -187,11 +188,9 @@ func (s *Service) Create(ctx context.Context, r *shimapi.CreateTaskRequest) (_ * - - // Start a process - func (s *Service) Start(ctx context.Context, r *shimapi.StartRequest) (*shimapi.StartResponse, error) { -- s.mu.Lock() -- defer s.mu.Unlock() -- p := s.processes[r.ID] -- if p == nil { -- return nil, errdefs.ToGRPCf(errdefs.ErrNotFound, "process %s", r.ID) -+ p, err := s.getExecProcess(r.ID) -+ if err != nil { -+ return nil, err - } - if err := p.Start(ctx); err != nil { - return nil, err -@@ -204,16 +203,16 @@ func (s *Service) Start(ctx context.Context, r *shimapi.StartRequest) (*shimapi. - - // Delete the initial process and container - func (s *Service) Delete(ctx context.Context, r *ptypes.Empty) (*shimapi.DeleteResponse, error) { -- s.mu.Lock() -- defer s.mu.Unlock() -- p := s.processes[s.id] -- if p == nil { -- return nil, errdefs.ToGRPCf(errdefs.ErrFailedPrecondition, "container must be created") -+ p, err := s.getInitProcess() -+ if err != nil { -+ return nil, err - } - if err := p.Delete(ctx); err != nil { - return nil, err - } -+ s.mu.Lock() - delete(s.processes, s.id) -+ s.mu.Unlock() - s.platform.Close() - return &shimapi.DeleteResponse{ - ExitStatus: uint32(p.ExitStatus()), -@@ -227,11 +226,9 @@ func (s *Service) DeleteProcess(ctx context.Context, r *shimapi.DeleteProcessReq - if r.ID == s.id { - return nil, status.Errorf(codes.InvalidArgument, "cannot delete init process with DeleteProcess") - } -- s.mu.Lock() -- p := s.processes[r.ID] -- s.mu.Unlock() -- if p == nil { -- return nil, errors.Wrapf(errdefs.ErrNotFound, "process %s", r.ID) -+ p, err := s.getExecProcess(r.ID) -+ if err != nil { -+ return nil, err - } - if err := p.Delete(ctx); err != nil { - return nil, err -@@ -249,13 +246,14 @@ func (s *Service) DeleteProcess(ctx context.Context, r *shimapi.DeleteProcessReq - // Exec an additional process inside the container - func (s *Service) Exec(ctx context.Context, r *shimapi.ExecProcessRequest) (*ptypes.Empty, error) { - s.mu.Lock() -- defer s.mu.Unlock() - - if p := s.processes[r.ID]; p != nil { -+ s.mu.Unlock() - return nil, errdefs.ToGRPCf(errdefs.ErrAlreadyExists, "id %s", r.ID) - } - - p := s.processes[s.id] -+ s.mu.Unlock() - if p == nil { - return nil, errdefs.ToGRPCf(errdefs.ErrFailedPrecondition, "container must be created") - } -@@ -271,14 +269,14 @@ func (s *Service) Exec(ctx context.Context, r *shimapi.ExecProcessRequest) (*pty - if err != nil { - return nil, errdefs.ToGRPC(err) - } -+ s.mu.Lock() - s.processes[r.ID] = process -+ s.mu.Unlock() - return empty, nil - } - - // ResizePty of a process - func (s *Service) ResizePty(ctx context.Context, r *shimapi.ResizePtyRequest) (*ptypes.Empty, error) { -- s.mu.Lock() -- defer s.mu.Unlock() - if r.ID == "" { - return nil, errdefs.ToGRPCf(errdefs.ErrInvalidArgument, "id not provided") - } -@@ -286,7 +284,9 @@ func (s *Service) ResizePty(ctx context.Context, r *shimapi.ResizePtyRequest) (* - Width: uint16(r.Width), - Height: uint16(r.Height), - } -+ s.mu.Lock() - p := s.processes[r.ID] -+ s.mu.Unlock() - if p == nil { - return nil, errors.Errorf("process does not exist %s", r.ID) - } -@@ -298,11 +298,9 @@ func (s *Service) ResizePty(ctx context.Context, r *shimapi.ResizePtyRequest) (* - - // State returns runtime state information for a process - func (s *Service) State(ctx context.Context, r *shimapi.StateRequest) (*shimapi.StateResponse, error) { -- s.mu.Lock() -- defer s.mu.Unlock() -- p := s.processes[r.ID] -- if p == nil { -- return nil, errdefs.ToGRPCf(errdefs.ErrNotFound, "process id %s", r.ID) -+ p, err := s.getExecProcess(r.ID) -+ if err != nil { -+ return nil, err - } - st, err := p.Status(ctx) - if err != nil { -@@ -338,11 +336,9 @@ func (s *Service) State(ctx context.Context, r *shimapi.StateRequest) (*shimapi. - - // Pause the container - func (s *Service) Pause(ctx context.Context, r *ptypes.Empty) (*ptypes.Empty, error) { -- s.mu.Lock() -- defer s.mu.Unlock() -- p := s.processes[s.id] -- if p == nil { -- return nil, errdefs.ToGRPCf(errdefs.ErrFailedPrecondition, "container must be created") -+ p, err := s.getInitProcess() -+ if err != nil { -+ return nil, err - } - if err := p.(*proc.Init).Pause(ctx); err != nil { - return nil, err -@@ -352,11 +348,9 @@ func (s *Service) Pause(ctx context.Context, r *ptypes.Empty) (*ptypes.Empty, er - - // Resume the container - func (s *Service) Resume(ctx context.Context, r *ptypes.Empty) (*ptypes.Empty, error) { -- s.mu.Lock() -- defer s.mu.Unlock() -- p := s.processes[s.id] -- if p == nil { -- return nil, errdefs.ToGRPCf(errdefs.ErrFailedPrecondition, "container must be created") -+ p, err := s.getInitProcess() -+ if err != nil { -+ return nil, err - } - if err := p.(*proc.Init).Resume(ctx); err != nil { - return nil, err -@@ -366,12 +360,10 @@ func (s *Service) Resume(ctx context.Context, r *ptypes.Empty) (*ptypes.Empty, e - - // Kill a process with the provided signal - func (s *Service) Kill(ctx context.Context, r *shimapi.KillRequest) (*ptypes.Empty, error) { -- s.mu.Lock() -- defer s.mu.Unlock() - if r.ID == "" { -- p := s.processes[s.id] -- if p == nil { -- return nil, errdefs.ToGRPCf(errdefs.ErrFailedPrecondition, "container must be created") -+ p, err := s.getInitProcess() -+ if err != nil { -+ return nil, err - } - if err := p.Kill(ctx, r.Signal, r.All); err != nil { - return nil, errdefs.ToGRPC(err) -@@ -379,9 +371,9 @@ func (s *Service) Kill(ctx context.Context, r *shimapi.KillRequest) (*ptypes.Emp - return empty, nil - } - -- p := s.processes[r.ID] -- if p == nil { -- return nil, errdefs.ToGRPCf(errdefs.ErrNotFound, "process id %s not found", r.ID) -+ p, err := s.getExecProcess(r.ID) -+ if err != nil { -+ return nil, err - } - if err := p.Kill(ctx, r.Signal, r.All); err != nil { - return nil, errdefs.ToGRPC(err) -@@ -422,11 +414,9 @@ func (s *Service) ListPids(ctx context.Context, r *shimapi.ListPidsRequest) (*sh - - // CloseIO of a process - func (s *Service) CloseIO(ctx context.Context, r *shimapi.CloseIORequest) (*ptypes.Empty, error) { -- s.mu.Lock() -- defer s.mu.Unlock() -- p := s.processes[r.ID] -- if p == nil { -- return nil, errdefs.ToGRPCf(errdefs.ErrNotFound, "process does not exist %s", r.ID) -+ p, err := s.getExecProcess(r.ID) -+ if err != nil { -+ return nil, err - } - if stdin := p.Stdin(); stdin != nil { - if err := stdin.Close(); err != nil { -@@ -438,11 +428,9 @@ func (s *Service) CloseIO(ctx context.Context, r *shimapi.CloseIORequest) (*ptyp - - // Checkpoint the container - func (s *Service) Checkpoint(ctx context.Context, r *shimapi.CheckpointTaskRequest) (*ptypes.Empty, error) { -- s.mu.Lock() -- defer s.mu.Unlock() -- p := s.processes[s.id] -- if p == nil { -- return nil, errdefs.ToGRPCf(errdefs.ErrFailedPrecondition, "container must be created") -+ p, err := s.getInitProcess() -+ if err != nil { -+ return nil, err - } - var options runctypes.CheckpointOptions - if r.Options != nil { -@@ -475,11 +463,9 @@ func (s *Service) ShimInfo(ctx context.Context, r *ptypes.Empty) (*shimapi.ShimI - - // Update a running container - func (s *Service) Update(ctx context.Context, r *shimapi.UpdateTaskRequest) (*ptypes.Empty, error) { -- s.mu.Lock() -- defer s.mu.Unlock() -- p := s.processes[s.id] -- if p == nil { -- return nil, errdefs.ToGRPCf(errdefs.ErrFailedPrecondition, "container must be created") -+ p, err := s.getInitProcess() -+ if err != nil { -+ return nil, err - } - if err := p.(*proc.Init).Update(ctx, r.Resources); err != nil { - return nil, errdefs.ToGRPC(err) -@@ -489,11 +475,9 @@ func (s *Service) Update(ctx context.Context, r *shimapi.UpdateTaskRequest) (*pt - - // Wait for a process to exit - func (s *Service) Wait(ctx context.Context, r *shimapi.WaitRequest) (*shimapi.WaitResponse, error) { -- s.mu.Lock() -- p := s.processes[r.ID] -- s.mu.Unlock() -- if p == nil { -- return nil, errdefs.ToGRPCf(errdefs.ErrFailedPrecondition, "container must be created") -+ p, err := s.getExecProcess(r.ID) -+ if err != nil { -+ return nil, err - } - p.Wait() - -@@ -563,11 +547,9 @@ func shouldKillAllOnExit(bundlePath string) (bool, error) { - } - - func (s *Service) getContainerPids(ctx context.Context, id string) ([]uint32, error) { -- s.mu.Lock() -- defer s.mu.Unlock() -- p := s.processes[s.id] -- if p == nil { -- return nil, errors.Wrapf(errdefs.ErrFailedPrecondition, "container must be created") -+ p, err := s.getInitProcess() -+ if err != nil { -+ return nil, err - } - - ps, err := p.(*proc.Init).Runtime().Ps(ctx, id) -@@ -589,6 +571,30 @@ func (s *Service) forward(publisher events.Publisher) { - } - } - -+// getInitProcess returns initial process -+func (s *Service) getInitProcess() (rproc.Process, error) { -+ s.mu.Lock() -+ defer s.mu.Unlock() -+ -+ p := s.processes[s.id] -+ if p == nil { -+ return nil, errdefs.ToGRPCf(errdefs.ErrFailedPrecondition, "container must be created") -+ } -+ return p, nil -+} -+ -+// getExecProcess returns exec process -+func (s *Service) getExecProcess(id string) (rproc.Process, error) { -+ s.mu.Lock() -+ defer s.mu.Unlock() -+ -+ p := s.processes[id] -+ if p == nil { -+ return nil, errdefs.ToGRPCf(errdefs.ErrNotFound, "process %s does not exist", id) -+ } -+ return p, nil -+} -+ - func getTopic(ctx context.Context, e interface{}) string { - switch e.(type) { - case *eventstypes.TaskCreate: --- -2.7.4.3 - diff --git a/patch/0007-shim-Increase-reaper-buffer-size-and-non-bl.patch b/patch/0007-shim-Increase-reaper-buffer-size-and-non-bl.patch deleted file mode 100644 index 5f17e23..0000000 --- a/patch/0007-shim-Increase-reaper-buffer-size-and-non-bl.patch +++ /dev/null @@ -1,109 +0,0 @@ -From 2e143a25ff02800afb569352c407cf71a9c0312b Mon Sep 17 00:00:00 2001 -From: lujingxiao -Date: Wed, 23 Jan 2019 14:56:19 +0800 -Subject: [PATCH 07/27] shim: Increase reaper buffer size and - non-blocking send - -reason: Fixes #2709 - -This increases the buffer size for process exit subscribers. It also -implements a non-blocking send on the subscriber channel. It is better -to drop an exit even than it is to block a shim for one slow subscriber. - -Cherry-pick from upstream 232a063496 - -Change-Id: Ibf9f06cc82945a8592fb02a87816d69d5dac2b6b -Signed-off-by: Michael Crosby -Signed-off-by: lujingxiao ---- - runtime/v1/shim/reaper.go | 14 +++++++++++--- - runtime/v2/shim/reaper_unix.go | 14 +++++++++++--- - 2 files changed, 22 insertions(+), 6 deletions(-) - -diff --git a/runtime/v1/shim/reaper.go b/runtime/v1/shim/reaper.go -index 2937f1a..10d5c30 100644 ---- a/runtime/v1/shim/reaper.go -+++ b/runtime/v1/shim/reaper.go -@@ -26,12 +26,13 @@ import ( - "github.com/containerd/containerd/sys" - runc "github.com/containerd/go-runc" - "github.com/pkg/errors" -+ "github.com/sirupsen/logrus" - ) - - // ErrNoSuchProcess is returned when the process no longer exists - var ErrNoSuchProcess = errors.New("no such process") - --const bufferSize = 32 -+const bufferSize = 2048 - - // Reap should be called when the process receives an SIGCHLD. Reap will reap - // all exited processes and close their wait channels -@@ -41,13 +42,20 @@ func Reap() error { - Default.Lock() - for c := range Default.subscribers { - for _, e := range exits { -- c <- runc.Exit{ -+ select { -+ case c <- runc.Exit{ - Timestamp: now, - Pid: e.Pid, - Status: e.Status, -+ }: -+ default: -+ logrus.WithFields(logrus.Fields{ -+ "subscriber": c, -+ "pid": e.Pid, -+ "status": e.Status, -+ }).Warn("failed to send exit to subscriber") - } - } -- - } - Default.Unlock() - return err -diff --git a/runtime/v2/shim/reaper_unix.go b/runtime/v2/shim/reaper_unix.go -index 2937f1a..10d5c30 100644 ---- a/runtime/v2/shim/reaper_unix.go -+++ b/runtime/v2/shim/reaper_unix.go -@@ -26,12 +26,13 @@ import ( - "github.com/containerd/containerd/sys" - runc "github.com/containerd/go-runc" - "github.com/pkg/errors" -+ "github.com/sirupsen/logrus" - ) - - // ErrNoSuchProcess is returned when the process no longer exists - var ErrNoSuchProcess = errors.New("no such process") - --const bufferSize = 32 -+const bufferSize = 2048 - - // Reap should be called when the process receives an SIGCHLD. Reap will reap - // all exited processes and close their wait channels -@@ -41,13 +42,20 @@ func Reap() error { - Default.Lock() - for c := range Default.subscribers { - for _, e := range exits { -- c <- runc.Exit{ -+ select { -+ case c <- runc.Exit{ - Timestamp: now, - Pid: e.Pid, - Status: e.Status, -+ }: -+ default: -+ logrus.WithFields(logrus.Fields{ -+ "subscriber": c, -+ "pid": e.Pid, -+ "status": e.Status, -+ }).Warn("failed to send exit to subscriber") - } - } -- - } - Default.Unlock() - return err --- -2.7.4.3 - diff --git a/patch/0008-runtime-Use-named-pipes-for-shim-logs.patch b/patch/0008-runtime-Use-named-pipes-for-shim-logs.patch deleted file mode 100644 index ba94785..0000000 --- a/patch/0008-runtime-Use-named-pipes-for-shim-logs.patch +++ /dev/null @@ -1,578 +0,0 @@ -From 9bdd5d485c6796c44356ae9482df8de467463feb Mon Sep 17 00:00:00 2001 -From: lujingxiao -Date: Wed, 23 Jan 2019 14:57:41 +0800 -Subject: [PATCH 08/27] runtime: Use named pipes for shim logs - -reason: TestDaemonRestart hangs if shim_debug is enabled -Relating to issue [#2606](https://github.com/containerd/containerd/issues/2606) - -Co-authored-by: Oliver Stenbom -Co-authored-by: Georgi Sabev -Co-authored-by: Giuseppe Capizzi -Co-authored-by: Danail Branekov - -Cherry-pick from upstream 1d4105cacf - -Change-Id: I0038401dda88c234750e8d1378a4dd97230400b0 -Signed-off-by: Oliver Stenbom -Signed-off-by: Georgi Sabev -Signed-off-by: Giuseppe Capizzi -Signed-off-by: Danail Branekov -Signed-off-by: lujingxiao ---- - client_test.go | 49 +++++++-- - cmd/containerd-shim/main_unix.go | 28 ++++++ - container_linux_test.go | 209 +++++++++++++++++++++++++++++++++++++++ - runtime/v1/linux/runtime.go | 26 +++++ - runtime/v1/shim.go | 38 +++++++ - runtime/v1/shim/client/client.go | 34 +++++-- - 6 files changed, 370 insertions(+), 14 deletions(-) - create mode 100644 runtime/v1/shim.go - -diff --git a/client_test.go b/client_test.go -index a6b1d59..1a4cf39 100644 ---- a/client_test.go -+++ b/client_test.go -@@ -21,6 +21,8 @@ import ( - "context" - "flag" - "fmt" -+ "io" -+ "io/ioutil" - "os" - "os/exec" - "testing" -@@ -36,11 +38,12 @@ import ( - ) - - var ( -- address string -- noDaemon bool -- noCriu bool -- supportsCriu bool -- testNamespace = "testing" -+ address string -+ noDaemon bool -+ noCriu bool -+ supportsCriu bool -+ testNamespace = "testing" -+ ctrdStdioFilePath string - - ctrd = &daemon{} - ) -@@ -76,13 +79,26 @@ func TestMain(m *testing.M) { - if !noDaemon { - sys.ForceRemoveAll(defaultRoot) - -- err := ctrd.start("containerd", address, []string{ -+ stdioFile, err := ioutil.TempFile("", "") -+ if err != nil { -+ fmt.Fprintf(os.Stderr, "could not create a new stdio temp file: %s\n", err) -+ os.Exit(1) -+ } -+ defer func() { -+ stdioFile.Close() -+ os.Remove(stdioFile.Name()) -+ }() -+ ctrdStdioFilePath = stdioFile.Name() -+ stdioWriter := io.MultiWriter(stdioFile, buf) -+ -+ err = ctrd.start("containerd", address, []string{ - "--root", defaultRoot, - "--state", defaultState, - "--log-level", "debug", -- }, buf, buf) -+ "--config", createShimDebugConfig(), -+ }, stdioWriter, stdioWriter) - if err != nil { -- fmt.Fprintf(os.Stderr, "%s: %s", err, buf.String()) -+ fmt.Fprintf(os.Stderr, "%s: %s\n", err, buf.String()) - os.Exit(1) - } - } -@@ -137,6 +153,7 @@ func TestMain(m *testing.M) { - fmt.Fprintln(os.Stderr, "failed to wait for containerd", err) - } - } -+ - if err := sys.ForceRemoveAll(defaultRoot); err != nil { - fmt.Fprintln(os.Stderr, "failed to remove test root dir", err) - os.Exit(1) -@@ -343,3 +360,19 @@ func TestClientReconnect(t *testing.T) { - t.Errorf("client closed returned error %v", err) - } - } -+ -+func createShimDebugConfig() string { -+ f, err := ioutil.TempFile("", "containerd-config-") -+ if err != nil { -+ fmt.Fprintf(os.Stderr, "Failed to create config file: %s\n", err) -+ os.Exit(1) -+ } -+ defer f.Close() -+ -+ if _, err := f.WriteString("[plugins.linux]\n\tshim_debug = true\n"); err != nil { -+ fmt.Fprintf(os.Stderr, "Failed to write to config file %s: %s\n", f.Name(), err) -+ os.Exit(1) -+ } -+ -+ return f.Name() -+} -diff --git a/cmd/containerd-shim/main_unix.go b/cmd/containerd-shim/main_unix.go -index ca0a90a..6c59cd1 100644 ---- a/cmd/containerd-shim/main_unix.go -+++ b/cmd/containerd-shim/main_unix.go -@@ -23,6 +23,7 @@ import ( - "context" - "flag" - "fmt" -+ "io" - "net" - "os" - "os/exec" -@@ -36,6 +37,7 @@ import ( - - "github.com/containerd/containerd/events" - "github.com/containerd/containerd/namespaces" -+ shimlog "github.com/containerd/containerd/runtime/v1" - "github.com/containerd/containerd/runtime/v1/linux/proc" - "github.com/containerd/containerd/runtime/v1/shim" - shimapi "github.com/containerd/containerd/runtime/v1/shim/v1" -@@ -92,12 +94,38 @@ func main() { - runtime.GOMAXPROCS(2) - } - -+ stdout, stderr, err := openStdioKeepAlivePipes(workdirFlag) -+ if err != nil { -+ fmt.Fprintf(os.Stderr, "containerd-shim: %s\n", err) -+ os.Exit(1) -+ } -+ defer func() { -+ stdout.Close() -+ stderr.Close() -+ }() -+ - if err := executeShim(); err != nil { - fmt.Fprintf(os.Stderr, "containerd-shim: %s\n", err) - os.Exit(1) - } - } - -+// If containerd server process dies, we need the shim to keep stdout/err reader -+// FDs so that Linux does not SIGPIPE the shim process if it tries to use its end of -+// these pipes. -+func openStdioKeepAlivePipes(dir string) (io.ReadCloser, io.ReadCloser, error) { -+ background := context.Background() -+ keepStdoutAlive, err := shimlog.OpenShimStdoutLog(background, dir) -+ if err != nil { -+ return nil, nil, err -+ } -+ keepStderrAlive, err := shimlog.OpenShimStderrLog(background, dir) -+ if err != nil { -+ return nil, nil, err -+ } -+ return keepStdoutAlive, keepStderrAlive, nil -+} -+ - func executeShim() error { - // start handling signals as soon as possible so that things are properly reaped - // or if runtime exits before we hit the handler -diff --git a/container_linux_test.go b/container_linux_test.go -index 60b0336..fa764d7 100644 ---- a/container_linux_test.go -+++ b/container_linux_test.go -@@ -24,7 +24,9 @@ import ( - "fmt" - "io" - "io/ioutil" -+ "os" - "os/exec" -+ "path/filepath" - "runtime" - "strings" - "sync" -@@ -258,6 +260,213 @@ func TestDaemonRestart(t *testing.T) { - <-statusC - } - -+func TestShimDoesNotLeakPipes(t *testing.T) { -+ containerdPid := ctrd.cmd.Process.Pid -+ initialPipes, err := numPipes(containerdPid) -+ if err != nil { -+ t.Fatal(err) -+ } -+ -+ client, err := newClient(t, address) -+ if err != nil { -+ t.Fatal(err) -+ } -+ defer client.Close() -+ -+ var ( -+ image Image -+ ctx, cancel = testContext() -+ id = t.Name() -+ ) -+ defer cancel() -+ -+ image, err = client.GetImage(ctx, testImage) -+ if err != nil { -+ t.Fatal(err) -+ } -+ -+ container, err := client.NewContainer(ctx, id, WithNewSnapshot(id, image), WithNewSpec(oci.WithImageConfig(image), withProcessArgs("sleep", "30"))) -+ if err != nil { -+ t.Fatal(err) -+ } -+ -+ task, err := container.NewTask(ctx, empty()) -+ if err != nil { -+ t.Fatal(err) -+ } -+ -+ exitChannel, err := task.Wait(ctx) -+ if err != nil { -+ t.Fatal(err) -+ } -+ -+ if err := task.Start(ctx); err != nil { -+ t.Fatal(err) -+ } -+ -+ if err := task.Kill(ctx, syscall.SIGKILL); err != nil { -+ t.Fatal(err) -+ } -+ -+ <-exitChannel -+ -+ if _, err := task.Delete(ctx); err != nil { -+ t.Fatal(err) -+ } -+ -+ if err := container.Delete(ctx, WithSnapshotCleanup); err != nil { -+ t.Fatal(err) -+ } -+ -+ currentPipes, err := numPipes(containerdPid) -+ if err != nil { -+ t.Fatal(err) -+ } -+ -+ if initialPipes != currentPipes { -+ t.Errorf("Pipes have leaked after container has been deleted. Initially there were %d pipes, after container deletion there were %d pipes", initialPipes, currentPipes) -+ } -+} -+ -+func numPipes(pid int) (int, error) { -+ cmd := exec.Command("sh", "-c", fmt.Sprintf("lsof -p %d | grep pipe", pid)) -+ -+ var stdout bytes.Buffer -+ cmd.Stdout = &stdout -+ if err := cmd.Run(); err != nil { -+ return 0, err -+ } -+ return strings.Count(stdout.String(), "\n"), nil -+} -+ -+func TestDaemonReconnectsToShimIOPipesOnRestart(t *testing.T) { -+ client, err := newClient(t, address) -+ if err != nil { -+ t.Fatal(err) -+ } -+ defer client.Close() -+ -+ var ( -+ image Image -+ ctx, cancel = testContext() -+ id = t.Name() -+ ) -+ defer cancel() -+ -+ image, err = client.GetImage(ctx, testImage) -+ if err != nil { -+ t.Fatal(err) -+ } -+ -+ container, err := client.NewContainer(ctx, id, WithNewSnapshot(id, image), WithNewSpec(oci.WithImageConfig(image), withProcessArgs("sleep", "30"))) -+ if err != nil { -+ t.Fatal(err) -+ } -+ defer container.Delete(ctx, WithSnapshotCleanup) -+ -+ task, err := container.NewTask(ctx, empty()) -+ if err != nil { -+ t.Fatal(err) -+ } -+ defer task.Delete(ctx) -+ -+ _, err = task.Wait(ctx) -+ if err != nil { -+ t.Fatal(err) -+ } -+ -+ if err := task.Start(ctx); err != nil { -+ t.Fatal(err) -+ } -+ -+ if err := ctrd.Restart(nil); err != nil { -+ t.Fatal(err) -+ } -+ -+ waitCtx, waitCancel := context.WithTimeout(ctx, 2*time.Second) -+ serving, err := client.IsServing(waitCtx) -+ waitCancel() -+ if !serving { -+ t.Fatalf("containerd did not start within 2s: %v", err) -+ } -+ -+ // After we restared containerd we write some messages to the log pipes, simulating shim writing stuff there. -+ // Then we make sure that these messages are available on the containerd log thus proving that the server reconnected to the log pipes -+ runtimeVersion := getRuntimeVersion() -+ logDirPath := getLogDirPath(runtimeVersion, id) -+ -+ switch runtimeVersion { -+ case "v1": -+ writeToFile(t, filepath.Join(logDirPath, "shim.stdout.log"), fmt.Sprintf("%s writing to stdout\n", id)) -+ writeToFile(t, filepath.Join(logDirPath, "shim.stderr.log"), fmt.Sprintf("%s writing to stderr\n", id)) -+ case "v2": -+ writeToFile(t, filepath.Join(logDirPath, "log"), fmt.Sprintf("%s writing to log\n", id)) -+ } -+ -+ statusC, err := task.Wait(ctx) -+ if err != nil { -+ t.Fatal(err) -+ } -+ -+ if err := task.Kill(ctx, syscall.SIGKILL); err != nil { -+ t.Fatal(err) -+ } -+ -+ <-statusC -+ -+ stdioContents, err := ioutil.ReadFile(ctrdStdioFilePath) -+ if err != nil { -+ t.Fatal(err) -+ } -+ -+ switch runtimeVersion { -+ case "v1": -+ if !strings.Contains(string(stdioContents), fmt.Sprintf("%s writing to stdout", id)) { -+ t.Fatal("containerd did not connect to the shim stdout pipe") -+ } -+ if !strings.Contains(string(stdioContents), fmt.Sprintf("%s writing to stderr", id)) { -+ t.Fatal("containerd did not connect to the shim stderr pipe") -+ } -+ case "v2": -+ if !strings.Contains(string(stdioContents), fmt.Sprintf("%s writing to log", id)) { -+ t.Fatal("containerd did not connect to the shim log pipe") -+ } -+ } -+} -+ -+func writeToFile(t *testing.T, filePath, message string) { -+ writer, err := os.OpenFile(filePath, os.O_WRONLY, 0600) -+ if err != nil { -+ t.Fatal(err) -+ } -+ if _, err := writer.WriteString(message); err != nil { -+ t.Fatal(err) -+ } -+ if err := writer.Close(); err != nil { -+ t.Fatal(err) -+ } -+} -+ -+func getLogDirPath(runtimeVersion, id string) string { -+ switch runtimeVersion { -+ case "v1": -+ return filepath.Join(defaultRoot, "io.containerd.runtime.v1.linux", testNamespace, id) -+ case "v2": -+ return filepath.Join(defaultState, "io.containerd.runtime.v2.task", testNamespace, id) -+ default: -+ panic(fmt.Errorf("Unsupported runtime version %s", runtimeVersion)) -+ } -+} -+ -+func getRuntimeVersion() string { -+ switch rt := os.Getenv("TEST_RUNTIME"); rt { -+ case "io.containerd.runc.v1": -+ return "v2" -+ default: -+ return "v1" -+ } -+} -+ - func TestContainerPTY(t *testing.T) { - t.Parallel() - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index d19b8e5..e1b3cac 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -21,6 +21,7 @@ package linux - import ( - "context" - "fmt" -+ "io" - "io/ioutil" - "os" - "path/filepath" -@@ -40,6 +41,7 @@ import ( - "github.com/containerd/containerd/plugin" - "github.com/containerd/containerd/runtime" - "github.com/containerd/containerd/runtime/linux/runctypes" -+ "github.com/containerd/containerd/runtime/v1" - "github.com/containerd/containerd/runtime/v1/linux/proc" - shim "github.com/containerd/containerd/runtime/v1/shim/v1" - runc "github.com/containerd/go-runc" -@@ -341,6 +343,30 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - continue - } - -+ logDirPath := filepath.Join(r.root, ns, id) -+ -+ shimStdoutLog, err := v1.OpenShimStdoutLog(ctx, logDirPath) -+ if err != nil { -+ log.G(ctx).WithError(err).WithFields(logrus.Fields{ -+ "id": id, -+ "namespace": ns, -+ "logDirPath": logDirPath, -+ }).Error("opening shim stdout log pipe") -+ continue -+ } -+ go io.Copy(os.Stdout, shimStdoutLog) -+ -+ shimStderrLog, err := v1.OpenShimStderrLog(ctx, logDirPath) -+ if err != nil { -+ log.G(ctx).WithError(err).WithFields(logrus.Fields{ -+ "id": id, -+ "namespace": ns, -+ "logDirPath": logDirPath, -+ }).Error("opening shim stderr log pipe") -+ continue -+ } -+ go io.Copy(os.Stderr, shimStderrLog) -+ - t, err := newTask(id, ns, pid, s, r.events, r.tasks, bundle) - if err != nil { - log.G(ctx).WithError(err).Error("loading task type") -diff --git a/runtime/v1/shim.go b/runtime/v1/shim.go -new file mode 100644 -index 0000000..3942968 ---- /dev/null -+++ b/runtime/v1/shim.go -@@ -0,0 +1,38 @@ -+// +build !windows -+ -+/* -+ Copyright The containerd Authors. -+ -+ Licensed under the Apache License, Version 2.0 (the "License"); -+ you may not use this file except in compliance with the License. -+ You may obtain a copy of the License at -+ -+ http://www.apache.org/licenses/LICENSE-2.0 -+ -+ Unless required by applicable law or agreed to in writing, software -+ distributed under the License is distributed on an "AS IS" BASIS, -+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+ See the License for the specific language governing permissions and -+ limitations under the License. -+*/ -+ -+package v1 -+ -+import ( -+ "context" -+ "io" -+ "path/filepath" -+ -+ "github.com/containerd/fifo" -+ "golang.org/x/sys/unix" -+) -+ -+// OpenShimStdoutLog opens the shim log for reading -+func OpenShimStdoutLog(ctx context.Context, logDirPath string) (io.ReadWriteCloser, error) { -+ return fifo.OpenFifo(ctx, filepath.Join(logDirPath, "shim.stdout.log"), unix.O_RDWR|unix.O_CREAT|unix.O_NONBLOCK, 0700) -+} -+ -+// OpenShimStderrLog opens the shim log -+func OpenShimStderrLog(ctx context.Context, logDirPath string) (io.ReadWriteCloser, error) { -+ return fifo.OpenFifo(ctx, filepath.Join(logDirPath, "shim.stderr.log"), unix.O_RDWR|unix.O_CREAT|unix.O_NONBLOCK, 0700) -+} -diff --git a/runtime/v1/shim/client/client.go b/runtime/v1/shim/client/client.go -index 015d88c..ef74030 100644 ---- a/runtime/v1/shim/client/client.go -+++ b/runtime/v1/shim/client/client.go -@@ -37,6 +37,7 @@ import ( - - "github.com/containerd/containerd/events" - "github.com/containerd/containerd/log" -+ v1 "github.com/containerd/containerd/runtime/v1" - "github.com/containerd/containerd/runtime/v1/shim" - shimapi "github.com/containerd/containerd/runtime/v1/shim/v1" - "github.com/containerd/containerd/sys" -@@ -62,7 +63,24 @@ func WithStart(binary, address, daemonAddress, cgroup string, debug bool, exitHa - } - defer f.Close() - -- cmd, err := newCommand(binary, daemonAddress, debug, config, f) -+ var stdoutLog io.ReadWriteCloser -+ var stderrLog io.ReadWriteCloser -+ if debug { -+ stdoutLog, err = v1.OpenShimStdoutLog(ctx, config.WorkDir) -+ if err != nil { -+ return nil, nil, errors.Wrapf(err, "failed to create stdout log") -+ } -+ -+ stderrLog, err = v1.OpenShimStderrLog(ctx, config.WorkDir) -+ if err != nil { -+ return nil, nil, errors.Wrapf(err, "failed to create stderr log") -+ } -+ -+ go io.Copy(os.Stdout, stdoutLog) -+ go io.Copy(os.Stderr, stderrLog) -+ } -+ -+ cmd, err := newCommand(binary, daemonAddress, debug, config, f, stdoutLog, stderrLog) - if err != nil { - return nil, nil, err - } -@@ -77,6 +95,12 @@ func WithStart(binary, address, daemonAddress, cgroup string, debug bool, exitHa - go func() { - cmd.Wait() - exitHandler() -+ if stdoutLog != nil { -+ stderrLog.Close() -+ } -+ if stdoutLog != nil { -+ stderrLog.Close() -+ } - }() - log.G(ctx).WithFields(logrus.Fields{ - "pid": cmd.Process.Pid, -@@ -104,7 +128,7 @@ func WithStart(binary, address, daemonAddress, cgroup string, debug bool, exitHa - } - } - --func newCommand(binary, daemonAddress string, debug bool, config shim.Config, socket *os.File) (*exec.Cmd, error) { -+func newCommand(binary, daemonAddress string, debug bool, config shim.Config, socket *os.File, stdout, stderr io.Writer) (*exec.Cmd, error) { - selfExe, err := os.Executable() - if err != nil { - return nil, err -@@ -137,10 +161,8 @@ func newCommand(binary, daemonAddress string, debug bool, config shim.Config, so - cmd.SysProcAttr = getSysProcAttr() - cmd.ExtraFiles = append(cmd.ExtraFiles, socket) - cmd.Env = append(os.Environ(), "GOMAXPROCS=2") -- if debug { -- cmd.Stdout = os.Stdout -- cmd.Stderr = os.Stderr -- } -+ cmd.Stdout = stdout -+ cmd.Stderr = stderr - return cmd, nil - } - --- -2.7.4.3 - diff --git a/patch/0009-runtime-fix-pipe-in-broken-may-cause-shim-l.patch b/patch/0009-runtime-fix-pipe-in-broken-may-cause-shim-l.patch deleted file mode 100644 index e8f2b86..0000000 --- a/patch/0009-runtime-fix-pipe-in-broken-may-cause-shim-l.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 77b025a48d9dc89666ef7c03709ef1fc2a4d0b34 Mon Sep 17 00:00:00 2001 -From: lujingxiao -Date: Wed, 23 Jan 2019 15:00:12 +0800 -Subject: [PATCH 09/27] runtime: fix pipe in broken may cause shim - lock forever for runtime v2 - -reason: fix pipe in broken may cause shim lock forever for runtime v2 - -Cherry-pick from upstream b3438f7a6f - -Change-Id: I3c324050531a1e68a5c3a688a51408a121a3f9f1 -Signed-off-by: Lifubang -Signed-off-by: lujingxiao ---- - runtime/v2/runc/service_linux.go | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/runtime/v2/runc/service_linux.go b/runtime/v2/runc/service_linux.go -index 5e30cfc..19d1fec 100644 ---- a/runtime/v2/runc/service_linux.go -+++ b/runtime/v2/runc/service_linux.go -@@ -49,9 +49,10 @@ func (p *linuxPlatform) CopyConsole(ctx context.Context, console console.Console - cwg.Add(1) - go func() { - cwg.Done() -- p := bufPool.Get().(*[]byte) -- defer bufPool.Put(p) -- io.CopyBuffer(epollConsole, in, *p) -+ bp := bufPool.Get().(*[]byte) -+ defer bufPool.Put(bp) -+ io.CopyBuffer(epollConsole, in, *bp) -+ epollConsole.Shutdown(p.epoller.CloseConsole) - }() - } - --- -2.7.4.3 - diff --git a/patch/0010-runtime-fix-pipe-in-broken-may-cause-shim-l.patch b/patch/0010-runtime-fix-pipe-in-broken-may-cause-shim-l.patch deleted file mode 100644 index e1a283c..0000000 --- a/patch/0010-runtime-fix-pipe-in-broken-may-cause-shim-l.patch +++ /dev/null @@ -1,52 +0,0 @@ -From d0e57aafce7c98b3c9b3004c862d5a15180df86c Mon Sep 17 00:00:00 2001 -From: lujingxiao -Date: Wed, 23 Jan 2019 15:03:08 +0800 -Subject: [PATCH 10/27] runtime: fix pipe in broken may cause shim - lock forever for runtime v1 - -reason: fix pipe in broken may cause shim lock forever for runtime v1 - -Cherry-pick from upstream e76a8879eb - -Change-Id: Ie603b36f92c4a6cc41777a9cd1e6a19b8584eaf1 -Signed-off-by: Lifubang -Signed-off-by: lujingxiao ---- - runtime/v1/shim/service_linux.go | 8 +++++--- - runtime/v2/runc/service_linux.go | 1 + - 2 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/runtime/v1/shim/service_linux.go b/runtime/v1/shim/service_linux.go -index 18ae650..307e20d 100644 ---- a/runtime/v1/shim/service_linux.go -+++ b/runtime/v1/shim/service_linux.go -@@ -49,9 +49,11 @@ func (p *linuxPlatform) CopyConsole(ctx context.Context, console console.Console - cwg.Add(1) - go func() { - cwg.Done() -- p := bufPool.Get().(*[]byte) -- defer bufPool.Put(p) -- io.CopyBuffer(epollConsole, in, *p) -+ bp := bufPool.Get().(*[]byte) -+ defer bufPool.Put(bp) -+ io.CopyBuffer(epollConsole, in, *bp) -+ // we need to shutdown epollConsole when pipe broken -+ epollConsole.Shutdown(p.epoller.CloseConsole) - }() - } - -diff --git a/runtime/v2/runc/service_linux.go b/runtime/v2/runc/service_linux.go -index 19d1fec..1161673 100644 ---- a/runtime/v2/runc/service_linux.go -+++ b/runtime/v2/runc/service_linux.go -@@ -52,6 +52,7 @@ func (p *linuxPlatform) CopyConsole(ctx context.Context, console console.Console - bp := bufPool.Get().(*[]byte) - defer bufPool.Put(bp) - io.CopyBuffer(epollConsole, in, *bp) -+ // we need to shutdown epollConsole when pipe broken - epollConsole.Shutdown(p.epoller.CloseConsole) - }() - } --- -2.7.4.3 - diff --git a/patch/0011-runtime-Add-timeout-and-cancel-to-shim-fifo.patch b/patch/0011-runtime-Add-timeout-and-cancel-to-shim-fifo.patch deleted file mode 100644 index 79b4204..0000000 --- a/patch/0011-runtime-Add-timeout-and-cancel-to-shim-fifo.patch +++ /dev/null @@ -1,95 +0,0 @@ -From 8eb1ab31006f3079d1bf95b4ab089e049a4f45f2 Mon Sep 17 00:00:00 2001 -From: lujingxiao -Date: Wed, 23 Jan 2019 15:04:03 +0800 -Subject: [PATCH 11/27] runtime: Add timeout and cancel to shim fifo - open - -reason: Add timeout and cancel to shim fifo open -There is still a special case where the client side fails to open or -load causes things to be slow and the shim can lock up when this -happens. This adds a timeout to the context for this case to abort fifo -creation. - -Cherry-pick from upstream 18f57e20b0 - -Signed-off-by: Michael Crosby -(cherry picked from commit a2a4241979f615eb0a1084c7638c21f830f48ac5) -Signed-off-by: Andrew Hsu -Signed-off-by: lujingxiao - -Change-Id: Ic7f285b149f97f4d6526b3f2c28b6ac6790332b0 ---- - runtime/v1/linux/proc/exec.go | 5 +++++ - runtime/v1/linux/proc/init.go | 5 +++++ - 2 files changed, 10 insertions(+) - -diff --git a/runtime/v1/linux/proc/exec.go b/runtime/v1/linux/proc/exec.go -index 96c425d..715a977 100644 ---- a/runtime/v1/linux/proc/exec.go -+++ b/runtime/v1/linux/proc/exec.go -@@ -172,22 +172,27 @@ func (e *execProcess) start(ctx context.Context) (err error) { - e.stdin = sc - } - var copyWaitGroup sync.WaitGroup -+ ctx, cancel := context.WithTimeout(ctx, 30*time.Second) - if socket != nil { - console, err := socket.ReceiveMaster() - if err != nil { -+ cancel() - return errors.Wrap(err, "failed to retrieve console master") - } - if e.console, err = e.parent.Platform.CopyConsole(ctx, console, e.stdio.Stdin, e.stdio.Stdout, e.stdio.Stderr, &e.wg, ©WaitGroup); err != nil { -+ cancel() - return errors.Wrap(err, "failed to start console copy") - } - } else if !e.stdio.IsNull() { - if err := copyPipes(ctx, e.io, e.stdio.Stdin, e.stdio.Stdout, e.stdio.Stderr, &e.wg, ©WaitGroup); err != nil { -+ cancel() - return errors.Wrap(err, "failed to start io pipe copy") - } - } - copyWaitGroup.Wait() - pid, err := runc.ReadPidFile(opts.PidFile) - if err != nil { -+ cancel() - return errors.Wrap(err, "failed to retrieve OCI runtime exec pid") - } - e.pid = pid -diff --git a/runtime/v1/linux/proc/init.go b/runtime/v1/linux/proc/init.go -index 5bf5f83..5b23671 100644 ---- a/runtime/v1/linux/proc/init.go -+++ b/runtime/v1/linux/proc/init.go -@@ -168,18 +168,22 @@ func (p *Init) Create(ctx context.Context, r *CreateConfig) error { - p.closers = append(p.closers, sc) - } - var copyWaitGroup sync.WaitGroup -+ ctx, cancel := context.WithTimeout(ctx, 30*time.Second) - if socket != nil { - console, err := socket.ReceiveMaster() - if err != nil { -+ cancel() - return errors.Wrap(err, "failed to retrieve console master") - } - console, err = p.Platform.CopyConsole(ctx, console, r.Stdin, r.Stdout, r.Stderr, &p.wg, ©WaitGroup) - if err != nil { -+ cancel() - return errors.Wrap(err, "failed to start console copy") - } - p.console = console - } else if !hasNoIO(r) { - if err := copyPipes(ctx, p.io, r.Stdin, r.Stdout, r.Stderr, &p.wg, ©WaitGroup); err != nil { -+ cancel() - return errors.Wrap(err, "failed to start io pipe copy") - } - } -@@ -187,6 +191,7 @@ func (p *Init) Create(ctx context.Context, r *CreateConfig) error { - copyWaitGroup.Wait() - pid, err := runc.ReadPidFile(pidFile) - if err != nil { -+ cancel() - return errors.Wrap(err, "failed to retrieve OCI runtime container pid") - } - p.pid = pid --- -2.7.4.3 - diff --git a/patch/0012-bump-bump-containerd-to-1.2.0.2.patch b/patch/0012-bump-bump-containerd-to-1.2.0.2.patch deleted file mode 100644 index 2f8ac24..0000000 --- a/patch/0012-bump-bump-containerd-to-1.2.0.2.patch +++ /dev/null @@ -1,36 +0,0 @@ -From ea92cca7c1d4dfbd6a563588a6ea9b56a764fc39 Mon Sep 17 00:00:00 2001 -From: lujingxiao -Date: Wed, 23 Jan 2019 15:31:56 +0800 -Subject: [PATCH 12/27] bump: bump containerd to 1.2.0.2 - -reason: bump containerd to 1.2.0.2 after cherry-picked patches from -upstream: -- runtime: Add timeout and cancel to shim fifo open -- runtime: fix pipe in broken may cause shim lock forever for runtime v1 -- runtime: fix pipe in broken may cause shim lock forever for runtime v2 -- runtime: Use named pipes for shim logs -- shim: Increase reaper buffer size and non-blocking send -- shim: optimize shim lock in runtime v1 - -Change-Id: Ibd7574e2ab18a2f783c694931101e1459bc779ad -Signed-off-by: lujingxiao ---- - hack/containerd.spec | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/hack/containerd.spec b/hack/containerd.spec -index f53c37b..c7d358d 100644 ---- a/hack/containerd.spec -+++ b/hack/containerd.spec -@@ -3,7 +3,7 @@ - Version: 1.2.0 - - Name: containerd --Release: 1%{?dist} -+Release: 2%{?dist} - Summary: An industry-standard container runtime - License: ASL 2.0 - URL: https://containerd.io --- -2.7.4.3 - diff --git a/patch/0013-log-support-log-init-pid-to-start-event-log.patch b/patch/0013-log-support-log-init-pid-to-start-event-log.patch deleted file mode 100644 index da79fdd..0000000 --- a/patch/0013-log-support-log-init-pid-to-start-event-log.patch +++ /dev/null @@ -1,50 +0,0 @@ -From d4d3f8a239f4b4afd009d954453e585704ddb112 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Thu, 24 Jan 2019 11:55:10 +0800 -Subject: [PATCH 13/27] log: support log init pid to start event log - -reason: DFX support start event with init pid - -Change-Id: I8ae9c7a9652f694680979965829682416aed4055 -Signed-off-by: jingrui ---- - hack/containerd.spec | 2 +- - runtime/v1/linux/task.go | 2 ++ - 2 files changed, 3 insertions(+), 1 deletion(-) - -diff --git a/hack/containerd.spec b/hack/containerd.spec -index c7d358d..462d35e 100644 ---- a/hack/containerd.spec -+++ b/hack/containerd.spec -@@ -3,7 +3,7 @@ - Version: 1.2.0 - - Name: containerd --Release: 2%{?dist} -+Release: 3%{?dist} - Summary: An industry-standard container runtime - License: ASL 2.0 - URL: https://containerd.io -diff --git a/runtime/v1/linux/task.go b/runtime/v1/linux/task.go -index 38da35c..1c650c4 100644 ---- a/runtime/v1/linux/task.go -+++ b/runtime/v1/linux/task.go -@@ -36,6 +36,7 @@ import ( - "github.com/containerd/typeurl" - "github.com/gogo/protobuf/types" - "github.com/pkg/errors" -+ "github.com/sirupsen/logrus" - ) - - // Task on a linux based system -@@ -131,6 +132,7 @@ func (t *Task) Start(ctx context.Context) error { - t.cg = cg - t.mu.Unlock() - } -+ logrus.Infof("publish event %s for container %s with pid %d", runtime.TaskStartEventTopic, t.id, t.pid) - t.events.Publish(ctx, runtime.TaskStartEventTopic, &eventstypes.TaskStart{ - ContainerID: t.id, - Pid: uint32(t.pid), --- -2.7.4.3 - diff --git a/patch/0014-event-resend-exit-event-when-detect-container.patch b/patch/0014-event-resend-exit-event-when-detect-container.patch deleted file mode 100644 index de4a802..0000000 --- a/patch/0014-event-resend-exit-event-when-detect-container.patch +++ /dev/null @@ -1,84 +0,0 @@ -From 200ae6f4b733f8a869aac36a730da90e79213387 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Sun, 10 Feb 2019 18:40:59 +0800 -Subject: [PATCH 14/27] event: resend exit event when detect - containerd restarted - -reason: testCE_docker_containerd_ABN.026.sh -fix docker stop no effect. - -Change-Id: I024b2f6a03d74fcbb5623c696212dcbfb624b285 -Signed-off-by: jingrui ---- - cmd/containerd-shim/main_unix.go | 38 +++++++++++++++++++++++++++++++++++++- - 1 file changed, 37 insertions(+), 1 deletion(-) - -diff --git a/cmd/containerd-shim/main_unix.go b/cmd/containerd-shim/main_unix.go -index 6c59cd1..d1f41b0 100644 ---- a/cmd/containerd-shim/main_unix.go -+++ b/cmd/containerd-shim/main_unix.go -@@ -24,12 +24,14 @@ import ( - "flag" - "fmt" - "io" -+ "io/ioutil" - "net" - "os" - "os/exec" - "os/signal" - "runtime" - "runtime/debug" -+ "strconv" - "strings" - "sync" - "syscall" -@@ -263,7 +265,7 @@ type remoteEventsPublisher struct { - address string - } - --func (l *remoteEventsPublisher) Publish(ctx context.Context, topic string, event events.Event) error { -+func (l *remoteEventsPublisher) doPublish(ctx context.Context, topic string, event events.Event) error { - ns, _ := namespaces.Namespace(ctx) - encoded, err := typeurl.MarshalAny(event) - if err != nil { -@@ -288,3 +290,37 @@ func (l *remoteEventsPublisher) Publish(ctx context.Context, topic string, event - } - return nil - } -+ -+func getContainerdPid() int { -+ pidFile := "/var/run/docker/containerd/containerd.pid" -+ data, err := ioutil.ReadFile(pidFile) -+ if err != nil { -+ return -1 -+ } -+ pid, err := strconv.Atoi(string(data)) -+ if err != nil { -+ return -1 -+ } -+ return pid -+} -+ -+func (l *remoteEventsPublisher) Publish(ctx context.Context, topic string, event events.Event) error { -+ old := getContainerdPid() -+ for i := 1; i <= 10; i++ { -+ err := l.doPublish(ctx, topic, event) -+ logrus.Infof("try publish event(%d) %s %v %v", i, topic, event, err) -+ if err == nil { -+ new := getContainerdPid() -+ if old == new { -+ return nil -+ } -+ logrus.Warnf("containerd pid %d changed to %d", old, new) -+ old = new -+ } -+ if i == 10 { -+ return err -+ } -+ time.Sleep(time.Duration(i) * time.Second) -+ } -+ return nil -+} --- -2.7.4.3 - diff --git a/patch/0015-restore-cleanup-container-pid-1.patch b/patch/0015-restore-cleanup-container-pid-1.patch deleted file mode 100644 index 1cdfd22..0000000 --- a/patch/0015-restore-cleanup-container-pid-1.patch +++ /dev/null @@ -1,122 +0,0 @@ -From fd1c8dda8cc02b9aef28f1e3e4e51ab216338e2b Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Sun, 10 Feb 2019 15:40:52 +0800 -Subject: [PATCH 15/27] restore: cleanup container pid=-1 - -reason: fix testCE_docker_hook_spec_ABN.050.sh -when containerd killed during task create, see Runtime.Create(). the -defer function will not execute, so shim residual. cleanup shim for -container pid=-1 - -Change-Id: Ie9a7f6dff5f8a922cc97c5fcf44664ab60ac1a7a -Signed-off-by: jingrui ---- - runtime/v1/linux/runtime.go | 10 +++++++--- - runtime/v1/linux/task.go | 26 ++++++++++++++++++++++++-- - 2 files changed, 31 insertions(+), 5 deletions(-) - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index e1b3cac..3b66304 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -316,6 +316,7 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - continue - } - id := path.Name() -+ log.G(ctx).Infof("load-task %s", id) - bundle := loadBundle( - id, - filepath.Join(r.state, ns, id), -@@ -372,6 +373,12 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - log.G(ctx).WithError(err).Error("loading task type") - continue - } -+ if pid == -1 { -+ _, err := t.DeleteForce(ctx) -+ log.G(ctx).Warnf("delete force %s Pid=-1 error=%v", id, err) -+ continue -+ } -+ log.G(ctx).Infof("load-task %s Pid=%d done", id, pid) - o = append(o, t) - } - return o, nil -@@ -380,9 +387,6 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - func (r *Runtime) cleanupAfterDeadShim(ctx context.Context, bundle *bundle, ns, id string, pid int) error { - ctx = namespaces.WithNamespace(ctx, ns) - if err := r.terminate(ctx, bundle, ns, id); err != nil { -- if r.config.ShimDebug { -- return errors.Wrap(err, "failed to terminate task, leaving bundle for debugging") -- } - log.G(ctx).WithError(err).Warn("failed to terminate task") - } - -diff --git a/runtime/v1/linux/task.go b/runtime/v1/linux/task.go -index 1c650c4..6995156 100644 ---- a/runtime/v1/linux/task.go -+++ b/runtime/v1/linux/task.go -@@ -21,6 +21,7 @@ package linux - import ( - "context" - "sync" -+ "time" - - "github.com/containerd/cgroups" - eventstypes "github.com/containerd/containerd/api/events" -@@ -37,6 +38,7 @@ import ( - "github.com/gogo/protobuf/types" - "github.com/pkg/errors" - "github.com/sirupsen/logrus" -+ "golang.org/x/sys/unix" - ) - - // Task on a linux based system -@@ -86,10 +88,13 @@ func (t *Task) Namespace() string { - } - - // Delete the task and return the exit status --func (t *Task) Delete(ctx context.Context) (*runtime.Exit, error) { -+func (t *Task) delete(ctx context.Context, force bool) (*runtime.Exit, error) { - rsp, err := t.shim.Delete(ctx, empty) - if err != nil { -- return nil, errdefs.FromGRPC(err) -+ log.G(ctx).WithError(err).Error("failed to delete container, force=%t", force) -+ if !force { -+ return nil, errdefs.FromGRPC(err) -+ } - } - t.tasks.Delete(ctx, t.id) - if err := t.shim.KillShim(ctx); err != nil { -@@ -98,6 +103,14 @@ func (t *Task) Delete(ctx context.Context) (*runtime.Exit, error) { - if err := t.bundle.Delete(); err != nil { - log.G(ctx).WithError(err).Error("failed to delete bundle") - } -+ -+ if rsp == nil { -+ rsp = &shim.DeleteResponse{} -+ rsp.ExitStatus = 128 + uint32(unix.SIGKILL) -+ rsp.ExitedAt = time.Now().UTC() -+ rsp.Pid = 0 -+ } -+ - t.events.Publish(ctx, runtime.TaskDeleteEventTopic, &eventstypes.TaskDelete{ - ContainerID: t.id, - ExitStatus: rsp.ExitStatus, -@@ -111,6 +124,15 @@ func (t *Task) Delete(ctx context.Context) (*runtime.Exit, error) { - }, nil - } - -+// Delete the task and return the exit status -+func (t *Task) Delete(ctx context.Context) (*runtime.Exit, error) { -+ return t.delete(ctx, false) -+} -+ -+func (t *Task) DeleteForce(ctx context.Context) (*runtime.Exit, error) { -+ return t.delete(ctx, true) -+} -+ - // Start the task - func (t *Task) Start(ctx context.Context) error { - t.mu.Lock() --- -2.7.4.3 - diff --git a/patch/0016-create-runc-delete-force-before-create.patch b/patch/0016-create-runc-delete-force-before-create.patch deleted file mode 100644 index 3aa5ece..0000000 --- a/patch/0016-create-runc-delete-force-before-create.patch +++ /dev/null @@ -1,31 +0,0 @@ -From e7827a737c42861afd6b41e2e7dc953c249278fc Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Mon, 11 Feb 2019 17:40:31 +0800 -Subject: [PATCH 16/27] create: runc delete force before create - -reason: testCE_docker_hook_spec_ABN.051.sh -kill -9 shim will generate residual runc files, cleanup runc files using -runc delete before create. - -Change-Id: I3efa3c4d0989ba8d688bcb6f35ba543b6ab91b2d -Signed-off-by: jingrui ---- - vendor/github.com/containerd/go-runc/runc.go | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/vendor/github.com/containerd/go-runc/runc.go b/vendor/github.com/containerd/go-runc/runc.go -index 96262af..e688881 100644 ---- a/vendor/github.com/containerd/go-runc/runc.go -+++ b/vendor/github.com/containerd/go-runc/runc.go -@@ -138,6 +138,8 @@ func (o *CreateOpts) args() (out []string, err error) { - - // Create creates a new container and returns its pid if it was created successfully - func (r *Runc) Create(context context.Context, id, bundle string, opts *CreateOpts) error { -+ r.Delete(context, id, &DeleteOpts{Force: true}) -+ - args := []string{"create", "--bundle", bundle} - if opts != nil { - oargs, err := opts.args() --- -2.7.4.3 - diff --git a/patch/0017-exit-using-init.exit-indicate-container-is-ex.patch b/patch/0017-exit-using-init.exit-indicate-container-is-ex.patch deleted file mode 100644 index 92c6ef4..0000000 --- a/patch/0017-exit-using-init.exit-indicate-container-is-ex.patch +++ /dev/null @@ -1,65 +0,0 @@ -From f83e391aef03283b30431a960b66f720cf0d9dd3 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Mon, 11 Feb 2019 20:12:15 +0800 -Subject: [PATCH 17/27] exit: using init.exit indicate container is - exiting - -reason: testCE_docker_hook_spec_ABN.053.sh -kill dockerd during docker stop in post-stophook, containerd will load -task and treat as ok when shim response client. add init.exit to forbid -load exiting task. - -Change-Id: I8f03cd51088d43d4fb457b32981f3eebd8558f84 -Signed-off-by: jingrui ---- - runtime/v1/linux/proc/init.go | 1 + - runtime/v1/linux/runtime.go | 5 +++++ - runtime/v1/shim/service.go | 4 +++- - 3 files changed, 9 insertions(+), 1 deletion(-) - -diff --git a/runtime/v1/linux/proc/init.go b/runtime/v1/linux/proc/init.go -index 5b23671..caa31c3 100644 ---- a/runtime/v1/linux/proc/init.go -+++ b/runtime/v1/linux/proc/init.go -@@ -43,6 +43,7 @@ import ( - - // InitPidFile name of the file that contains the init pid - const InitPidFile = "init.pid" -+const InitExit = "init.exit" - - // Init represents an initial process for a container - type Init struct { -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 3b66304..123d675 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -378,6 +378,11 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - log.G(ctx).Warnf("delete force %s Pid=-1 error=%v", id, err) - continue - } -+ if _, err := os.Stat(filepath.Join(bundle.path, proc.InitExit)); err == nil { -+ _, err := t.DeleteForce(ctx) -+ log.G(ctx).Warnf("delete force %s Pid=%d(exiting) error=%v", id, pid, err) -+ continue -+ } - log.G(ctx).Infof("load-task %s Pid=%d done", id, pid) - o = append(o, t) - } -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index 679982a..8c7984f 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -504,7 +504,9 @@ func (s *Service) checkProcesses(e runc.Exit) { - - for _, p := range s.processes { - if p.Pid() == e.Pid { -- -+ if ip, ok := p.(*proc.Init); ok { -+ ioutil.WriteFile(filepath.Join(ip.Bundle, proc.InitExit), []byte(fmt.Sprintf("%d", e.Pid)), 0600) -+ } - if shouldKillAll { - if ip, ok := p.(*proc.Init); ok { - // Ensure all children are killed --- -2.7.4.3 - diff --git a/patch/0018-containerd-shim-Dump-log-to-file-when-docker-.patch b/patch/0018-containerd-shim-Dump-log-to-file-when-docker-.patch deleted file mode 100644 index e911513..0000000 --- a/patch/0018-containerd-shim-Dump-log-to-file-when-docker-.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 7f483b7d5a6bd88ea35f5dcf1a5fea5d165044fe Mon Sep 17 00:00:00 2001 -From: lixiang172 -Date: Tue, 12 Feb 2019 15:22:06 +0800 -Subject: [PATCH 18/27] containerd-shim: Dump log to file when docker - received signal - -reason: Dump stack log to file when docker received "kill -SIGUSR1 -PID" signal -The name of log files is "shim-stack-[time].log". -The log file can be found at: -/run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/container-id/shim-stack-[time].log - -Change-Id: I6d7e03c9a0fd36e9a76f1dd45cfd5312985d03f8 -Signed-off-by: lixiang172 ---- - cmd/containerd-shim/main_unix.go | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/cmd/containerd-shim/main_unix.go b/cmd/containerd-shim/main_unix.go -index d1f41b0..38b3eb4 100644 ---- a/cmd/containerd-shim/main_unix.go -+++ b/cmd/containerd-shim/main_unix.go -@@ -246,6 +246,8 @@ func handleSignals(logger *logrus.Entry, signals chan os.Signal, server *ttrpc.S - } - } - -+const stacksLogNameTemplate = "shim-stacks-%s.log" -+ - func dumpStacks(logger *logrus.Entry) { - var ( - buf []byte -@@ -258,6 +260,7 @@ func dumpStacks(logger *logrus.Entry) { - bufferLen *= 2 - } - buf = buf[:stackSize] -+ ioutil.WriteFile(fmt.Sprintf(stacksLogNameTemplate, strings.Replace(time.Now().Format(time.RFC3339), ":", "", -1)), buf, 0600) - logger.Infof("=== BEGIN goroutine stack dump ===\n%s\n=== END goroutine stack dump ===", buf) - } - --- -2.7.4.3 - diff --git a/patch/0019-restore-check-shim-alive-when-containerd-is-r.patch b/patch/0019-restore-check-shim-alive-when-containerd-is-r.patch deleted file mode 100644 index 4557c56..0000000 --- a/patch/0019-restore-check-shim-alive-when-containerd-is-r.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 112c2ef89b1085e95959285ce5328af5d74ba8db Mon Sep 17 00:00:00 2001 -From: xueshaojia -Date: Thu, 14 Feb 2019 10:48:14 +0800 -Subject: [PATCH 19/27] restore: check shim alive when containerd is - restarted - -reason: fix docker_containerd-shim:testCE_docker_containerd_shim_ABN.021.sh - When containerd is restarted, it will load all tasks.In some cases, the - containerd-shim is killed and the sock file will exist for a while. - Containerd should check the containerd-shim is available using the sock file. - If the containerd-shim server not responses, do r.cleanupAfterDeadShim - -Change-Id: I448c8caefa8c1252bd5cdcff79deb8eff1005903 -Signed-off-by: xueshaojia ---- - runtime/v1/linux/runtime.go | 15 +++++++++++++++ - 1 file changed, 15 insertions(+) - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 123d675..477cda0 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -343,6 +343,21 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - } - continue - } -+ ctxContact, cancel := context.WithTimeout(ctx, 5*time.Second) -+ defer cancel() -+ alive, err := s.IsAlive(ctxContact) -+ if !alive { -+ log.G(ctx).WithError(err).WithFields(logrus.Fields{ -+ "id": id, -+ "namespace": ns, -+ }).Error("contacting to shim") -+ err := r.cleanupAfterDeadShim(ctx, bundle, ns, id, pid) -+ if err != nil { -+ log.G(ctx).WithError(err).WithField("bundle", bundle.path). -+ Error("cleaning up after dead shim") -+ } -+ continue -+ } - - logDirPath := filepath.Join(r.root, ns, id) - --- -2.7.4.3 - diff --git a/patch/0020-events-resend-pending-exit-events-on-restore.patch b/patch/0020-events-resend-pending-exit-events-on-restore.patch deleted file mode 100644 index 8d2b63b..0000000 --- a/patch/0020-events-resend-pending-exit-events-on-restore.patch +++ /dev/null @@ -1,357 +0,0 @@ -From 27762e8d75c00c8898c725873c17a23105ba5b7c Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Tue, 12 Feb 2019 17:03:11 +0800 -Subject: [PATCH 20/27] events: resend pending exit events on restore - -reason: fix exit event may lost. -testCE_docker_containerd_ABN.026.sh - -Change-Id: I5bcdf06ad4ee7b8a0ca782e610186f52e3d79bbd -Signed-off-by: jingrui ---- - events/events.go | 13 +++++ - events/exchange/exchange.go | 12 +++++ - events/exit.go | 79 +++++++++++++++++++++++++++++ - runtime/v1/linux/runtime.go | 56 +++++++++++++++++--- - runtime/v1/linux/task.go | 10 ++-- - runtime/v1/shim/service.go | 2 + - vendor/github.com/docker/go-events/queue.go | 8 +++ - 7 files changed, 167 insertions(+), 13 deletions(-) - create mode 100644 events/exit.go - -diff --git a/events/events.go b/events/events.go -index b7eb86f..aa07236 100644 ---- a/events/events.go -+++ b/events/events.go -@@ -22,6 +22,7 @@ import ( - - "github.com/containerd/typeurl" - "github.com/gogo/protobuf/types" -+ apievents "github.com/containerd/containerd/api/events" - ) - - // Envelope provides the packaging for an event. -@@ -32,6 +33,18 @@ type Envelope struct { - Event *types.Any - } - -+func (e *Envelope) ExitFile() string { -+ decoded, err := typeurl.UnmarshalAny(e.Event) -+ if err != nil { -+ return "" -+ } -+ -+ if e, ok := decoded.(*apievents.TaskExit); ok { -+ return ExitFile(e.ContainerID, e.Pid, e.ExitStatus) -+ } -+ -+ return "" -+} - // Field returns the value for the given fieldpath as a string, if defined. - // If the value is not defined, the second value will be false. - func (e *Envelope) Field(fieldpath []string) (string, bool) { -diff --git a/events/exchange/exchange.go b/events/exchange/exchange.go -index 95d21b7..540f180 100644 ---- a/events/exchange/exchange.go -+++ b/events/exchange/exchange.go -@@ -49,6 +49,11 @@ func NewExchange() *Exchange { - var _ events.Publisher = &Exchange{} - var _ events.Forwarder = &Exchange{} - var _ events.Subscriber = &Exchange{} -+var mobySubcribed = false -+ -+func MobySubscribed() bool { -+ return mobySubcribed -+} - - // Forward accepts an envelope to be direcly distributed on the exchange. - // -@@ -161,6 +166,13 @@ func (e *Exchange) Subscribe(ctx context.Context, fs ...string) (ch <-chan *even - } - - e.broadcaster.Add(dst) -+ logrus.Infof("subscribe ctx=%v fs=%v", ctx, fs) -+ for _, s := range fs { -+ if !MobySubscribed() && s == "namespace==moby,topic~=|^/tasks/|" { -+ queue.Namespace = "moby" -+ mobySubcribed = true -+ } -+ } - - go func() { - defer closeAll() -diff --git a/events/exit.go b/events/exit.go -new file mode 100644 -index 0000000..e1ce089 ---- /dev/null -+++ b/events/exit.go -@@ -0,0 +1,79 @@ -+package events -+ -+import ( -+ "fmt" -+ "io/ioutil" -+ "os" -+ "path/filepath" -+ "strconv" -+ "strings" -+ "github.com/sirupsen/logrus" -+) -+ -+const ExitDir = "/var/run/docker/containerd/exit" -+const ExitStatusDefault = 137 -+ -+func ExitFile(cid string, pid uint32, status uint32) string { -+ return fmt.Sprintf("%s.%d.%d", cid, pid, status) -+} -+ -+func ExitInfo(ef string) (string, uint32, uint32) { -+ s := strings.Split(ef, ".") -+ if len(s) != 3 { -+ return "", 0, 0 -+ } -+ -+ cid := s[0] -+ pid, err := strconv.ParseUint(s[1], 10, 32) -+ if err != nil { -+ return "", 0, 0 -+ } -+ status, err := strconv.ParseUint(s[2], 10, 32) -+ if err != nil { -+ return "", 0, 0 -+ } -+ -+ return cid, uint32(pid), uint32(status) -+} -+ -+func ExitAddFile(ns string, ef string, reason string) { -+ os.MkdirAll(filepath.Join(ExitDir, ns), 0700) -+ err := ioutil.WriteFile(filepath.Join(ExitDir, ns, ef), []byte{}, 0600) -+ logrus.Infof("exit-add %s/%s [reason: %s] error=%v", ns, ef, reason, err) -+} -+ -+func ExitDelFile(ns string, ef string) { -+ err := os.RemoveAll(filepath.Join(ExitDir, ns, ef)) -+ logrus.Infof("exit-del %s/%s error=%v", ns, ef, err) -+} -+ -+func ExitGetFile(ns string, cid string, pid uint32, status uint32) string { -+ ef := ExitFile(cid, pid, status) -+ if _, err := os.Stat(filepath.Join(ExitDir, ns, ef)); err == nil { -+ return ef -+ } -+ return "" -+} -+ -+func ExitGetFiles(ns string) []string { -+ files, err := ioutil.ReadDir(filepath.Join(ExitDir, ns)) -+ if err != nil { -+ return []string{} -+ } -+ -+ names := []string{} -+ for _, f := range files { -+ names = append(names, f.Name()) -+ } -+ -+ return names -+} -+ -+func ExitPending(ns string, cid string, pid uint32) bool { -+ for _, ef := range ExitGetFiles(ns) { -+ if strings.Contains(ef, fmt.Sprintf("%s.%d", cid, pid)) { -+ return true -+ } -+ } -+ return false -+} -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 477cda0..add4d52 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -31,6 +31,7 @@ import ( - "github.com/containerd/containerd/api/types" - "github.com/containerd/containerd/containers" - "github.com/containerd/containerd/errdefs" -+ "github.com/containerd/containerd/events" - "github.com/containerd/containerd/events/exchange" - "github.com/containerd/containerd/identifiers" - "github.com/containerd/containerd/log" -@@ -129,6 +130,7 @@ func New(ic *plugin.InitContext) (interface{}, error) { - return nil, err - } - } -+ go r.resendExitEvents(ic.Context, "moby") - return r, nil - } - -@@ -175,7 +177,8 @@ func (r *Runtime) Create(ctx context.Context, id string, opts runtime.CreateOpts - } - defer func() { - if err != nil { -- bundle.Delete() -+ errd := bundle.Delete() -+ log.G(ctx).WithError(err).Errorf("revert: delete bundle error=%v", errd) - } - }() - -@@ -218,9 +221,8 @@ func (r *Runtime) Create(ctx context.Context, id string, opts runtime.CreateOpts - } - defer func() { - if err != nil { -- if kerr := s.KillShim(ctx); kerr != nil { -- log.G(ctx).WithError(err).Error("failed to kill shim") -- } -+ kerr := s.KillShim(ctx) -+ log.G(ctx).WithError(err).Errorf("revert: kill shim error=%v", kerr) - } - }() - -@@ -305,6 +307,41 @@ func (r *Runtime) Get(ctx context.Context, id string) (runtime.Task, error) { - return r.tasks.Get(ctx, id) - } - -+func (r *Runtime) resendExitEvents(ctx context.Context, ns string) { -+ for { -+ time.Sleep(time.Second) -+ efs := events.ExitGetFiles(ns) -+ if len(efs) == 0 { -+ break -+ } -+ -+ if !exchange.MobySubscribed() { -+ logrus.Infof("waiting moby event stream ...") -+ continue -+ } -+ time.Sleep(time.Second) -+ -+ for _, ef := range efs { -+ cid, pid, status := events.ExitInfo(ef) -+ if cid == "" { -+ continue -+ } -+ -+ e := &eventstypes.TaskExit{ -+ ContainerID: cid, -+ ID: cid, -+ ExitStatus: status, -+ ExitedAt: time.Now().UTC(), -+ Pid: uint32(pid), -+ } -+ -+ ctx := namespaces.WithNamespace(context.Background(), ns) -+ err := r.events.Publish(ctx, runtime.TaskExitEventTopic, e) -+ logrus.Infof("resend exit event %v error=%v", e, err) -+ } -+ } -+} -+ - func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - dir, err := ioutil.ReadDir(filepath.Join(r.state, ns)) - if err != nil { -@@ -388,13 +425,16 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - log.G(ctx).WithError(err).Error("loading task type") - continue - } -- if pid == -1 { -- _, err := t.DeleteForce(ctx) -- log.G(ctx).Warnf("delete force %s Pid=-1 error=%v", id, err) -+ if pid <= 0 { -+ _, err := t.DeleteForce(ctx, 0) -+ log.G(ctx).Warnf("delete force %s Pid=%d error=%v", id, pid, err) - continue - } - if _, err := os.Stat(filepath.Join(bundle.path, proc.InitExit)); err == nil { -- _, err := t.DeleteForce(ctx) -+ if !events.ExitPending(ns, t.id, uint32(pid)) { -+ events.ExitAddFile(ns, events.ExitFile(t.id, uint32(pid), uint32(events.ExitStatusDefault)), "cleanup dirty task") -+ } -+ _, err := t.DeleteForce(ctx, uint32(pid)) - log.G(ctx).Warnf("delete force %s Pid=%d(exiting) error=%v", id, pid, err) - continue - } -diff --git a/runtime/v1/linux/task.go b/runtime/v1/linux/task.go -index 6995156..b692ae7 100644 ---- a/runtime/v1/linux/task.go -+++ b/runtime/v1/linux/task.go -@@ -88,7 +88,7 @@ func (t *Task) Namespace() string { - } - - // Delete the task and return the exit status --func (t *Task) delete(ctx context.Context, force bool) (*runtime.Exit, error) { -+func (t *Task) delete(ctx context.Context, force bool, pid uint32) (*runtime.Exit, error) { - rsp, err := t.shim.Delete(ctx, empty) - if err != nil { - log.G(ctx).WithError(err).Error("failed to delete container, force=%t", force) -@@ -108,7 +108,7 @@ func (t *Task) delete(ctx context.Context, force bool) (*runtime.Exit, error) { - rsp = &shim.DeleteResponse{} - rsp.ExitStatus = 128 + uint32(unix.SIGKILL) - rsp.ExitedAt = time.Now().UTC() -- rsp.Pid = 0 -+ rsp.Pid = pid - } - - t.events.Publish(ctx, runtime.TaskDeleteEventTopic, &eventstypes.TaskDelete{ -@@ -126,11 +126,11 @@ func (t *Task) delete(ctx context.Context, force bool) (*runtime.Exit, error) { - - // Delete the task and return the exit status - func (t *Task) Delete(ctx context.Context) (*runtime.Exit, error) { -- return t.delete(ctx, false) -+ return t.delete(ctx, false, 0) - } - --func (t *Task) DeleteForce(ctx context.Context) (*runtime.Exit, error) { -- return t.delete(ctx, true) -+func (t *Task) DeleteForce(ctx context.Context, pid uint32) (*runtime.Exit, error) { -+ return t.delete(ctx, true, pid) - } - - // Start the task -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index 8c7984f..a2eb35b 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -505,6 +505,8 @@ func (s *Service) checkProcesses(e runc.Exit) { - for _, p := range s.processes { - if p.Pid() == e.Pid { - if ip, ok := p.(*proc.Init); ok { -+ ns := filepath.Base(filepath.Dir(ip.Bundle)) -+ events.ExitAddFile(ns, events.ExitFile(s.id, uint32(e.Pid), uint32(e.Status)), "init exited") - ioutil.WriteFile(filepath.Join(ip.Bundle, proc.InitExit), []byte(fmt.Sprintf("%d", e.Pid)), 0600) - } - if shouldKillAll { -diff --git a/vendor/github.com/docker/go-events/queue.go b/vendor/github.com/docker/go-events/queue.go -index 4bb770a..0608e7e 100644 ---- a/vendor/github.com/docker/go-events/queue.go -+++ b/vendor/github.com/docker/go-events/queue.go -@@ -5,12 +5,14 @@ import ( - "sync" - - "github.com/sirupsen/logrus" -+ topevents "github.com/containerd/containerd/events" - ) - - // Queue accepts all messages into a queue for asynchronous consumption - // by a sink. It is unbounded and thread safe but the sink must be reliable or - // events will be dropped. - type Queue struct { -+ Namespace string - dst Sink - events *list.List - cond *sync.Cond -@@ -83,6 +85,12 @@ func (eq *Queue) run() { - "event": event, - "sink": eq.dst, - }).WithError(err).Debug("eventqueue: dropped event") -+ } else { -+ if e, ok := event.(*topevents.Envelope); ok { -+ if ef := e.ExitFile(); ef != "" { -+ topevents.ExitDelFile(eq.Namespace, ef) -+ } -+ } - } - } - } --- -2.7.4.3 - diff --git a/patch/0021-containerd-Update-the-version-info-of-contain.patch b/patch/0021-containerd-Update-the-version-info-of-contain.patch deleted file mode 100644 index c1db668..0000000 --- a/patch/0021-containerd-Update-the-version-info-of-contain.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 818ef5fe43d3b9b4c53301800d545ce4c775afff Mon Sep 17 00:00:00 2001 -From: lixiang172 -Date: Tue, 12 Feb 2019 11:37:37 +0800 -Subject: [PATCH 21/27] containerd: Update the version info of - containerd - -reason: Update the version info after type "containerd -v" -The version info now is defined by "containerd.spec" rather than -"version.go" - -Change-Id: I04c6b78737e09f93a3e84a100c88be19294a5c4f -Signed-off-by: lixiang172 ---- - Makefile | 8 ++++---- - version/version.go | 2 +- - 2 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/Makefile b/Makefile -index 35021fd..e38dfb3 100644 ---- a/Makefile -+++ b/Makefile -@@ -20,8 +20,8 @@ ROOTDIR=$(dir $(abspath $(lastword $(MAKEFILE_LIST)))) - DESTDIR=/usr/local - - # Used to populate variables in version package. --VERSION=$(shell git describe --match 'v[0-9]*' --dirty='.m' --always) --REVISION=$(shell git rev-parse HEAD)$(shell if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi) -+VERSION=$(shell echo version:)$(shell grep '^Version' ${ROOTDIR}/hack/containerd.spec | sed 's/[^0-9.]*\([0-9.]*\).*/\1/').$(shell grep '^Release:' ${ROOTDIR}/hack/containerd.spec | sed 's/[^0-9.]*\([0-9.]*\).*/\1/') -+REVISION=$(shell echo commit:)$(shell git rev-parse HEAD)$(shell if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi) - - ifneq "$(strip $(shell command -v go 2>/dev/null))" "" - GOOS ?= $(shell go env GOOS) -@@ -77,8 +77,8 @@ MANPAGES=ctr.1 containerd.1 containerd-config.1 containerd-config.toml.5 - # Build tags seccomp and apparmor are needed by CRI plugin. - BUILDTAGS ?= seccomp apparmor - GO_TAGS=$(if $(BUILDTAGS),-tags "$(BUILDTAGS)",) --GO_LDFLAGS=-ldflags '-s -w -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -X $(PKG)/version.Package=$(PKG) $(EXTRA_LDFLAGS)' --SHIM_GO_LDFLAGS=-ldflags '-s -w -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -X $(PKG)/version.Package=$(PKG) -extldflags "-static"' -+GO_LDFLAGS=-ldflags '-s -w -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) $(EXTRA_LDFLAGS)' -+SHIM_GO_LDFLAGS=-ldflags '-s -w -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -extldflags "-static"' - - #Replaces ":" (*nix), ";" (windows) with newline for easy parsing - GOPATHS=$(shell echo ${GOPATH} | tr ":" "\n" | tr ";" "\n") -diff --git a/version/version.go b/version/version.go -index b2874bf..04b7097 100644 ---- a/version/version.go -+++ b/version/version.go -@@ -18,7 +18,7 @@ package version - - var ( - // Package is filled at linking time -- Package = "github.com/containerd/containerd" -+ Package = "" - - // Version holds the complete version number. Filled in at linking time. - Version = "1.2.0+unknown" --- -2.7.4.3 - diff --git a/patch/0022-containerd-bump-version-1.2.0.4.patch b/patch/0022-containerd-bump-version-1.2.0.4.patch deleted file mode 100644 index 515b1f8..0000000 --- a/patch/0022-containerd-bump-version-1.2.0.4.patch +++ /dev/null @@ -1,29 +0,0 @@ -From bea413085725db89439817284b63bb4061e62753 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Wed, 13 Feb 2019 22:03:08 +0800 -Subject: [PATCH 22/27] containerd: bump version 1.2.0.4 - -reason: bump version - -Change-Id: Iee2348e931a723929ccfe63b3539c812514acc90 -Signed-off-by: jingrui ---- - hack/containerd.spec | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/hack/containerd.spec b/hack/containerd.spec -index 462d35e..f8d9084 100644 ---- a/hack/containerd.spec -+++ b/hack/containerd.spec -@@ -3,7 +3,7 @@ - Version: 1.2.0 - - Name: containerd --Release: 3%{?dist} -+Release: 4%{?dist} - Summary: An industry-standard container runtime - License: ASL 2.0 - URL: https://containerd.io --- -2.7.4.3 - diff --git a/patch/0023-containerd-set-create-and-exec-timeout.patch b/patch/0023-containerd-set-create-and-exec-timeout.patch deleted file mode 100644 index f994109..0000000 --- a/patch/0023-containerd-set-create-and-exec-timeout.patch +++ /dev/null @@ -1,218 +0,0 @@ -From 006bc6d0a9e0c233d0d14de53de0b18799c67081 Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Fri, 15 Feb 2019 06:00:52 +0800 -Subject: [PATCH 23/27] containerd: set create and exec timeout - -reason:set create and exec timeout to avild block when command failed - -Change-Id: I6bc55f4ccc953bdc1d926ab940f0900811d68760 -Signed-off-by: xiadanni ---- - hack/containerd.spec | 2 +- - runtime/v1/shim/reaper.go | 50 +++++++++++++++++++++++++ - runtime/v2/shim/reaper_unix.go | 4 ++ - vendor/github.com/containerd/go-runc/monitor.go | 6 +++ - vendor/github.com/containerd/go-runc/runc.go | 31 +++++++++++++-- - 5 files changed, 88 insertions(+), 5 deletions(-) - -diff --git a/hack/containerd.spec b/hack/containerd.spec -index f8d9084..f39c57a 100644 ---- a/hack/containerd.spec -+++ b/hack/containerd.spec -@@ -3,7 +3,7 @@ - Version: 1.2.0 - - Name: containerd --Release: 4%{?dist} -+Release: 5%{?dist} - Summary: An industry-standard container runtime - License: ASL 2.0 - URL: https://containerd.io -diff --git a/runtime/v1/shim/reaper.go b/runtime/v1/shim/reaper.go -index 10d5c30..a2b90fe 100644 ---- a/runtime/v1/shim/reaper.go -+++ b/runtime/v1/shim/reaper.go -@@ -19,8 +19,13 @@ - package shim - - import ( -+ "io/ioutil" - "os/exec" -+ "path/filepath" -+ "strconv" -+ "strings" - "sync" -+ "syscall" - "time" - - "github.com/containerd/containerd/sys" -@@ -100,6 +105,34 @@ func (m *Monitor) Wait(c *exec.Cmd, ec chan runc.Exit) (int, error) { - return -1, ErrNoSuchProcess - } - -+// WaitTimeout is used to skip the blocked command and kill the left process. -+func (m *Monitor) WaitTimeout(c *exec.Cmd, ec chan runc.Exit, sec int64) (int, error) { -+ sch := make(chan int) -+ ech := make(chan error) -+ go func() { -+ for e := range ec { -+ if e.Pid == c.Process.Pid { -+ // make sure we flush all IO -+ c.Wait() -+ m.Unsubscribe(ec) -+ sch <- e.Status -+ return -+ } -+ } -+ }() -+ select { -+ case <-time.After(time.Duration(sec) * time.Second): -+ if SameProcess(c, c.Process.Pid) { -+ syscall.Kill(c.Process.Pid, syscall.SIGKILL) -+ } -+ return 0, errors.Errorf("timeout %ds for cmd(pid= %d): %s, %s", sec, c.Process.Pid, c.Path, c.Args) -+ case status := <-sch: -+ return status, nil -+ case err := <-ech: -+ return -1, err -+ } -+} -+ - // Subscribe to process exit changes - func (m *Monitor) Subscribe() chan runc.Exit { - c := make(chan runc.Exit, bufferSize) -@@ -116,3 +149,20 @@ func (m *Monitor) Unsubscribe(c chan runc.Exit) { - close(c) - m.Unlock() - } -+ -+func SameProcess(cmd *exec.Cmd, pid int) bool { -+ bytes, err := ioutil.ReadFile(filepath.Join("/proc", strconv.Itoa(pid), "cmdline")) -+ if err != nil { -+ return false -+ } -+ for i := range bytes { -+ if bytes[i] == 0 { -+ bytes[i] = 32 -+ } -+ } -+ cmdline := string(bytes) -+ if strings.EqualFold(cmdline, strings.Join(cmd.Args, " ")+" ") { -+ return true -+ } -+ return false -+} -diff --git a/runtime/v2/shim/reaper_unix.go b/runtime/v2/shim/reaper_unix.go -index 10d5c30..8bd7dd1 100644 ---- a/runtime/v2/shim/reaper_unix.go -+++ b/runtime/v2/shim/reaper_unix.go -@@ -100,6 +100,10 @@ func (m *Monitor) Wait(c *exec.Cmd, ec chan runc.Exit) (int, error) { - return -1, ErrNoSuchProcess - } - -+func (m *Monitor) WaitTimeout(c *exec.Cmd, ec chan runc.Exit, sec int64) (int, error) { -+ return m.Wait(c, ec) -+} -+ - // Subscribe to process exit changes - func (m *Monitor) Subscribe() chan runc.Exit { - c := make(chan runc.Exit, bufferSize) -diff --git a/vendor/github.com/containerd/go-runc/monitor.go b/vendor/github.com/containerd/go-runc/monitor.go -index ff06a3f..2c184d2 100644 ---- a/vendor/github.com/containerd/go-runc/monitor.go -+++ b/vendor/github.com/containerd/go-runc/monitor.go -@@ -40,6 +40,7 @@ type Exit struct { - type ProcessMonitor interface { - Start(*exec.Cmd) (chan Exit, error) - Wait(*exec.Cmd, chan Exit) (int, error) -+ WaitTimeout(*exec.Cmd, chan Exit, int64) (int, error) - } - - type defaultMonitor struct { -@@ -74,3 +75,8 @@ func (m *defaultMonitor) Wait(c *exec.Cmd, ec chan Exit) (int, error) { - e := <-ec - return e.Status, nil - } -+ -+func (m *defaultMonitor) WaitTimeout(c *exec.Cmd, ec chan Exit, sec int64) (int, error) { -+ e := <-ec -+ return e.Status, nil -+} -\ No newline at end of file -diff --git a/vendor/github.com/containerd/go-runc/runc.go b/vendor/github.com/containerd/go-runc/runc.go -index e688881..fc64e8a 100644 ---- a/vendor/github.com/containerd/go-runc/runc.go -+++ b/vendor/github.com/containerd/go-runc/runc.go -@@ -52,6 +52,8 @@ const ( - Text Format = "text" - // DefaultCommand is the default command for Runc - DefaultCommand = "runc" -+ execTimeout = 30 -+ createTimeout = 120 - ) - - // Runc is the client to the runc cli -@@ -155,7 +157,7 @@ func (r *Runc) Create(context context.Context, id, bundle string, opts *CreateOp - cmd.ExtraFiles = opts.ExtraFiles - - if cmd.Stdout == nil && cmd.Stderr == nil { -- data, err := cmdOutput(cmd, true) -+ data, err := cmdOutputTimeout(cmd, true, createTimeout) - if err != nil { - return fmt.Errorf("%s: %s", err, data) - } -@@ -172,7 +174,7 @@ func (r *Runc) Create(context context.Context, id, bundle string, opts *CreateOp - } - } - } -- status, err := Monitor.Wait(cmd, ec) -+ status, err := Monitor.WaitTimeout(cmd, ec, createTimeout) - if err == nil && status != 0 { - err = fmt.Errorf("%s did not terminate sucessfully", cmd.Args[0]) - } -@@ -234,7 +236,7 @@ func (r *Runc) Exec(context context.Context, id string, spec specs.Process, opts - opts.Set(cmd) - } - if cmd.Stdout == nil && cmd.Stderr == nil { -- data, err := cmdOutput(cmd, true) -+ data, err := cmdOutputTimeout(cmd, true, execTimeout) - if err != nil { - return fmt.Errorf("%s: %s", err, data) - } -@@ -251,7 +253,7 @@ func (r *Runc) Exec(context context.Context, id string, spec specs.Process, opts - } - } - } -- status, err := Monitor.Wait(cmd, ec) -+ status, err := Monitor.WaitTimeout(cmd, ec, execTimeout) - if err == nil && status != 0 { - err = fmt.Errorf("%s did not terminate sucessfully", cmd.Args[0]) - } -@@ -707,3 +709,24 @@ func cmdOutput(cmd *exec.Cmd, combined bool) ([]byte, error) { - - return b.Bytes(), err - } -+ -+func cmdOutputTimeout(cmd *exec.Cmd, combined bool, timeout int64) ([]byte, error) { -+ b := getBuf() -+ defer putBuf(b) -+ -+ cmd.Stdout = b -+ if combined { -+ cmd.Stderr = b -+ } -+ ec, err := Monitor.Start(cmd) -+ if err != nil { -+ return nil, err -+ } -+ -+ status, err := Monitor.WaitTimeout(cmd, ec, timeout) -+ if err == nil && status != 0 { -+ err = fmt.Errorf("%s did not terminate sucessfully", cmd.Args[0]) -+ } -+ -+ return b.Bytes(), err -+} --- -2.7.4.3 - diff --git a/patch/0024-create-cleanup-runc-dirty-files-on-start.patch b/patch/0024-create-cleanup-runc-dirty-files-on-start.patch deleted file mode 100644 index c951cea..0000000 --- a/patch/0024-create-cleanup-runc-dirty-files-on-start.patch +++ /dev/null @@ -1,54 +0,0 @@ -From f96039fcd94c5bc75dcec297668418811d60e785 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Tue, 19 Feb 2019 11:53:41 +0800 -Subject: [PATCH 24/27] create: cleanup runc dirty files on start - -reason: add check before cleanup runtime dirty files. - -Change-Id: I6f218fd8d19ed65d8b13ae1ea744b80574279f83 -Signed-off-by: jingrui ---- - hack/containerd.spec | 2 +- - vendor/github.com/containerd/go-runc/runc.go | 6 +++++- - 2 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/hack/containerd.spec b/hack/containerd.spec -index f39c57a..869012a 100644 ---- a/hack/containerd.spec -+++ b/hack/containerd.spec -@@ -3,7 +3,7 @@ - Version: 1.2.0 - - Name: containerd --Release: 5%{?dist} -+Release: 6%{?dist} - Summary: An industry-standard container runtime - License: ASL 2.0 - URL: https://containerd.io -diff --git a/vendor/github.com/containerd/go-runc/runc.go b/vendor/github.com/containerd/go-runc/runc.go -index fc64e8a..e66ea5b 100644 ---- a/vendor/github.com/containerd/go-runc/runc.go -+++ b/vendor/github.com/containerd/go-runc/runc.go -@@ -30,6 +30,7 @@ import ( - "strings" - "syscall" - "time" -+ "github.com/sirupsen/logrus" - - specs "github.com/opencontainers/runtime-spec/specs-go" - ) -@@ -140,7 +141,10 @@ func (o *CreateOpts) args() (out []string, err error) { - - // Create creates a new container and returns its pid if it was created successfully - func (r *Runc) Create(context context.Context, id, bundle string, opts *CreateOpts) error { -- r.Delete(context, id, &DeleteOpts{Force: true}) -+ if _, err := os.Stat(filepath.Join(r.Root, id)); err == nil { -+ logrus.Warnf("cleanup residue runtime with bundle %s root=%s", bundle, r.Root) -+ r.Delete(context, id, &DeleteOpts{Force: true}) -+ } - - args := []string{"create", "--bundle", bundle} - if opts != nil { --- -2.7.4.3 - diff --git a/patch/0025-restore-skip-load-task-in-creating.patch b/patch/0025-restore-skip-load-task-in-creating.patch deleted file mode 100644 index 143f1c4..0000000 --- a/patch/0025-restore-skip-load-task-in-creating.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 869ceecb455640da5e90f7827f75275665e93e95 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Sat, 23 Feb 2019 15:51:24 +0800 -Subject: [PATCH 25/27] restore: skip load task in creating - -load task in creating will stuck containerd restore process. - -Change-Id: I2f8b77a88d78597ef2be5122708fc8ab16fad956 -Signed-off-by: jingrui ---- - runtime/v1/linux/runtime.go | 5 ++--- - runtime/v1/shim/service.go | 6 ++++++ - 2 files changed, 8 insertions(+), 3 deletions(-) - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index add4d52..5647f94 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -353,7 +353,6 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - continue - } - id := path.Name() -- log.G(ctx).Infof("load-task %s", id) - bundle := loadBundle( - id, - filepath.Join(r.state, ns, id), -@@ -361,6 +360,7 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - ) - ctx = namespaces.WithNamespace(ctx, ns) - pid, _ := runc.ReadPidFile(filepath.Join(bundle.path, proc.InitPidFile)) -+ log.G(ctx).Infof("load-task %s/%s/%s Pid=%d", r.state, ns, id, pid) - s, err := bundle.NewShimClient(ctx, ns, ShimConnect(r.config, func() { - err := r.cleanupAfterDeadShim(ctx, bundle, ns, id, pid) - if err != nil { -@@ -426,8 +426,7 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - continue - } - if pid <= 0 { -- _, err := t.DeleteForce(ctx, 0) -- log.G(ctx).Warnf("delete force %s Pid=%d error=%v", id, pid, err) -+ log.G(ctx).Warnf("skip load task in creating %s", id) - continue - } - if _, err := os.Stat(filepath.Join(bundle.path, proc.InitExit)); err == nil { -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index a2eb35b..d7fdcaf 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -26,6 +26,7 @@ import ( - "os" - "path/filepath" - "sync" -+ "time" - - "github.com/containerd/console" - eventstypes "github.com/containerd/containerd/api/events" -@@ -140,9 +141,14 @@ func (s *Service) Create(ctx context.Context, r *shimapi.CreateTaskRequest) (_ * - rootfs := filepath.Join(r.Bundle, "rootfs") - defer func() { - if err != nil { -+ logrus.Errorf("create init %s failed error=%v", r.ID, err) - if err2 := mount.UnmountAll(rootfs, 0); err2 != nil { - log.G(ctx).WithError(err2).Warn("Failed to cleanup rootfs mount") - } -+ go func() { -+ time.Sleep(10*time.Second) -+ os.Exit(0) -+ }() - } - }() - for _, rm := range mounts { --- -2.7.4.3 - diff --git a/patch/0026-exit-optimize-init.exit-record.patch b/patch/0026-exit-optimize-init.exit-record.patch deleted file mode 100644 index 80eaae2..0000000 --- a/patch/0026-exit-optimize-init.exit-record.patch +++ /dev/null @@ -1,96 +0,0 @@ -From c26316153098e72a9b30668befc36fcfcba3b76f Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Sat, 23 Feb 2019 15:55:21 +0800 -Subject: [PATCH 26/27] exit: optimize init.exit record - -Change-Id: If1319f7d87defed16d1113337957f36b7320e9b9 -Signed-off-by: jingrui ---- - events/exit.go | 21 +++++++++++++++++++++ - runtime/v1/linux/proc/init.go | 1 - - runtime/v1/linux/runtime.go | 2 +- - runtime/v1/shim/service.go | 2 +- - 4 files changed, 23 insertions(+), 3 deletions(-) - -diff --git a/events/exit.go b/events/exit.go -index e1ce089..772dc24 100644 ---- a/events/exit.go -+++ b/events/exit.go -@@ -7,11 +7,13 @@ import ( - "path/filepath" - "strconv" - "strings" -+ - "github.com/sirupsen/logrus" - ) - - const ExitDir = "/var/run/docker/containerd/exit" - const ExitStatusDefault = 137 -+const InitExit = "init.exit" - - func ExitFile(cid string, pid uint32, status uint32) string { - return fmt.Sprintf("%s.%d.%d", cid, pid, status) -@@ -77,3 +79,22 @@ func ExitPending(ns string, cid string, pid uint32) bool { - } - return false - } -+ -+func InitExitWrite(bundle string, pid int) { -+ if _, err := os.Stat(bundle); err != nil { -+ logrus.Infof("skip write init.exit %s error=%v", bundle, err) -+ return -+ } -+ err := ioutil.WriteFile(filepath.Join(bundle, InitExit), []byte(fmt.Sprintf("%d", pid)), 0600) -+ if err != nil { -+ logrus.Infof("failed write init.exit error=%s", bundle, err) -+ } -+} -+ -+func InitExitExist(bundle string) bool { -+ if _, err := os.Stat(filepath.Join(bundle, InitExit)); err == nil { -+ return true -+ } -+ return false -+} -+ -diff --git a/runtime/v1/linux/proc/init.go b/runtime/v1/linux/proc/init.go -index caa31c3..5b23671 100644 ---- a/runtime/v1/linux/proc/init.go -+++ b/runtime/v1/linux/proc/init.go -@@ -43,7 +43,6 @@ import ( - - // InitPidFile name of the file that contains the init pid - const InitPidFile = "init.pid" --const InitExit = "init.exit" - - // Init represents an initial process for a container - type Init struct { -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 5647f94..e92904e 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -429,7 +429,7 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - log.G(ctx).Warnf("skip load task in creating %s", id) - continue - } -- if _, err := os.Stat(filepath.Join(bundle.path, proc.InitExit)); err == nil { -+ if events.InitExitExist(bundle.path) { - if !events.ExitPending(ns, t.id, uint32(pid)) { - events.ExitAddFile(ns, events.ExitFile(t.id, uint32(pid), uint32(events.ExitStatusDefault)), "cleanup dirty task") - } -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index d7fdcaf..f421fde 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -513,7 +513,7 @@ func (s *Service) checkProcesses(e runc.Exit) { - if ip, ok := p.(*proc.Init); ok { - ns := filepath.Base(filepath.Dir(ip.Bundle)) - events.ExitAddFile(ns, events.ExitFile(s.id, uint32(e.Pid), uint32(e.Status)), "init exited") -- ioutil.WriteFile(filepath.Join(ip.Bundle, proc.InitExit), []byte(fmt.Sprintf("%d", e.Pid)), 0600) -+ events.InitExitWrite(ip.Bundle, e.Pid) - } - if shouldKillAll { - if ip, ok := p.(*proc.Init); ok { --- -2.7.4.3 - diff --git a/patch/0027-log-make-tester-happy.patch b/patch/0027-log-make-tester-happy.patch deleted file mode 100644 index f3e9295..0000000 --- a/patch/0027-log-make-tester-happy.patch +++ /dev/null @@ -1,48 +0,0 @@ -From a275b359b2e85d8f353eab12d538a94609171918 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Sat, 23 Feb 2019 18:32:00 +0800 -Subject: [PATCH 27/27] log: make tester happy - -reason: make tester happy -+ check_docker_error /tmp/tmp_11955/log2 b3357887148bc59212d30dba46d3eea9490cfe94594fa00aa7706c7addb92d91 -+ grep docker /tmp/tmp_11955/log2 -+ grep error -+ grep b3357887148bc59212d30dba46d3eea9490cfe94594fa00aa7706c7addb92d91 -+ grep -w 'container did not start before the specified timeout' - -Change-Id: Iddd40bd42212bf09f52c17f28119a6b5364f4de7 -Signed-off-by: jingrui ---- - hack/containerd.spec | 2 +- - runtime/v1/shim/reaper.go | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/hack/containerd.spec b/hack/containerd.spec -index 869012a..05f68c7 100644 ---- a/hack/containerd.spec -+++ b/hack/containerd.spec -@@ -3,7 +3,7 @@ - Version: 1.2.0 - - Name: containerd --Release: 6%{?dist} -+Release: 7%{?dist} - Summary: An industry-standard container runtime - License: ASL 2.0 - URL: https://containerd.io -diff --git a/runtime/v1/shim/reaper.go b/runtime/v1/shim/reaper.go -index a2b90fe..529a533 100644 ---- a/runtime/v1/shim/reaper.go -+++ b/runtime/v1/shim/reaper.go -@@ -125,7 +125,7 @@ func (m *Monitor) WaitTimeout(c *exec.Cmd, ec chan runc.Exit, sec int64) (int, e - if SameProcess(c, c.Process.Pid) { - syscall.Kill(c.Process.Pid, syscall.SIGKILL) - } -- return 0, errors.Errorf("timeout %ds for cmd(pid= %d): %s, %s", sec, c.Process.Pid, c.Path, c.Args) -+ return 0, errors.Errorf("container did not start before the specified timeout %ds for cmd(pid=%d): %s, %s", sec, c.Process.Pid, c.Path, c.Args) - case status := <-sch: - return status, nil - case err := <-ech: --- -2.7.4.3 - diff --git a/patch/0028-restore-delete-task-in-containerd-restoring.patch b/patch/0028-restore-delete-task-in-containerd-restoring.patch deleted file mode 100644 index e5b36a1..0000000 --- a/patch/0028-restore-delete-task-in-containerd-restoring.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 1130a0bc101c3f59c99eb850b24d0799c216d677 Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Fri, 22 Mar 2019 21:22:08 +0800 -Subject: [PATCH] restore: delete task in containerd restoring - -reason: delete task quickly when containerd is restoring to avoid container restart fail. - -Change-Id: Ide5e8c9bbd873addc6c35b9604e4cda03ca78b5e -Signed-off-by: xiadanni1 ---- - runtime/v1/linux/runtime.go | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index e92904e..2a45aaa 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -426,7 +426,11 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - continue - } - if pid <= 0 { -- log.G(ctx).Warnf("skip load task in creating %s", id) -+ go func() { -+ log.G(ctx).Infof("del task in creating %s", id) -+ t.DeleteForce(ctx, uint32(pid)) -+ log.G(ctx).Infof("del task in creating %s done", id) -+ }() - continue - } - if events.InitExitExist(bundle.path) { --- -1.8.3.1 - diff --git a/patch/0029-restore-delete-task-asynchronously.patch b/patch/0029-restore-delete-task-asynchronously.patch deleted file mode 100644 index 2d3dc90..0000000 --- a/patch/0029-restore-delete-task-asynchronously.patch +++ /dev/null @@ -1,35 +0,0 @@ -From de14f9d00033a9596823e0ea953437f5f244cb74 Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Sat, 23 Mar 2019 07:18:57 +0800 -Subject: [PATCH] restore: delete task asynchronously - -reason: set delete task to asynchronous to avoid containerd be killed when delete is blocking. - testCE_docker_hook_spec_ABN.059.sh - -Change-Id: I5fae8e60987b9617a835ea07710ca3c842efab14 -Signed-off-by: xiadanni1 ---- - runtime/v1/linux/runtime.go | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 2a45aaa..cca72fe 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -437,8 +437,11 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - if !events.ExitPending(ns, t.id, uint32(pid)) { - events.ExitAddFile(ns, events.ExitFile(t.id, uint32(pid), uint32(events.ExitStatusDefault)), "cleanup dirty task") - } -- _, err := t.DeleteForce(ctx, uint32(pid)) -- log.G(ctx).Warnf("delete force %s Pid=%d(exiting) error=%v", id, pid, err) -+ go func(){ -+ log.G(ctx).Infof("delete force %s start, Pid=%d(exiting)", id, pid) -+ _, err := t.DeleteForce(ctx, uint32(pid)) -+ log.G(ctx).Infof("delete force %s done, Pid=%d(exiting) error=%v", id, pid, err) -+ }() - continue - } - log.G(ctx).Infof("load-task %s Pid=%d done", id, pid) --- -1.8.3.1 - diff --git a/patch/0030-event-fix-events-lost-when-loadTask-failed.patch b/patch/0030-event-fix-events-lost-when-loadTask-failed.patch deleted file mode 100644 index 959460d..0000000 --- a/patch/0030-event-fix-events-lost-when-loadTask-failed.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 375689497320d105aa2ed026710e20d9b0bd2a72 Mon Sep 17 00:00:00 2001 -From: jiangpengfei9 -Date: Mon, 1 Apr 2019 13:08:50 -0400 -Subject: [PATCH] event: fix events lost when loadTask failed - -reason: If containerd-shim and containerd process is killed, container will exit, -however containerd exit event which generates when containerd restart to reload -tasks can not publish to dockerd, because at the time of loading tasks the connection -between dockerd and containerd isn't established. - -So we add this unpublish exit event to file and resend this event after grpc connection -is established. - -Signed-off-by: jiangpengfei9 ---- - runtime/v1/linux/runtime.go | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index cca72fe..af823b2 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -373,6 +373,9 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - "id": id, - "namespace": ns, - }).Error("connecting to shim") -+ if !events.ExitPending(ns, id, uint32(pid)) { -+ events.ExitAddFile(ns, events.ExitFile(id, uint32(pid), uint32(events.ExitStatusDefault)), "cleanup dirty task") -+ } - err := r.cleanupAfterDeadShim(ctx, bundle, ns, id, pid) - if err != nil { - log.G(ctx).WithError(err).WithField("bundle", bundle.path). -@@ -388,6 +391,9 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - "id": id, - "namespace": ns, - }).Error("contacting to shim") -+ if !events.ExitPending(ns, id, uint32(pid)) { -+ events.ExitAddFile(ns, events.ExitFile(id, uint32(pid), uint32(events.ExitStatusDefault)), "cleanup dirty task") -+ } - err := r.cleanupAfterDeadShim(ctx, bundle, ns, id, pid) - if err != nil { - log.G(ctx).WithError(err).WithField("bundle", bundle.path). --- -1.8.3.1 - diff --git a/patch/0031-containerd-enable-relro-flags.patch b/patch/0031-containerd-enable-relro-flags.patch deleted file mode 100644 index 2ee4f4b..0000000 --- a/patch/0031-containerd-enable-relro-flags.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 2db6e4cda2e042fab327493c0fa095723d7c0352 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Mon, 15 Apr 2019 10:58:07 +0800 -Subject: [PATCH] containerd: enable relro flags - -Change-Id: I5f32e7bf794842a14e1644f7aa3115a65b1bc698 -Signed-off-by: jingrui ---- - Makefile | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index e38dfb38..921b2d50 100644 ---- a/Makefile -+++ b/Makefile -@@ -77,7 +77,8 @@ MANPAGES=ctr.1 containerd.1 containerd-config.1 containerd-config.toml.5 - # Build tags seccomp and apparmor are needed by CRI plugin. - BUILDTAGS ?= seccomp apparmor - GO_TAGS=$(if $(BUILDTAGS),-tags "$(BUILDTAGS)",) --GO_LDFLAGS=-ldflags '-s -w -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) $(EXTRA_LDFLAGS)' -+GO_LDFLAGS=-ldflags '-s -w -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) $(EXTRA_LDFLAGS)' \ -+ -ldflags=-extldflags=-zrelro -ldflags=-extldflags=-znow - SHIM_GO_LDFLAGS=-ldflags '-s -w -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -extldflags "-static"' - - #Replaces ":" (*nix), ";" (windows) with newline for easy parsing --- -2.17.1 - diff --git a/patch/0032-containerd-enable-bep-ldflags.patch b/patch/0032-containerd-enable-bep-ldflags.patch deleted file mode 100644 index e557af1..0000000 --- a/patch/0032-containerd-enable-bep-ldflags.patch +++ /dev/null @@ -1,45 +0,0 @@ -From da6ea77f9f47c740fe85e7e4d34889e131135b81 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Mon, 15 Apr 2019 23:44:55 +0800 -Subject: [PATCH] containerd: enable bep ldflags - -Change-Id: I820b100aa1420fc399878a905de14fb6a25ca1a4 -Signed-off-by: jingrui ---- - Makefile | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/Makefile b/Makefile -index 921b2d50..612330b4 100644 ---- a/Makefile -+++ b/Makefile -@@ -77,9 +77,12 @@ MANPAGES=ctr.1 containerd.1 containerd-config.1 containerd-config.toml.5 - # Build tags seccomp and apparmor are needed by CRI plugin. - BUILDTAGS ?= seccomp apparmor - GO_TAGS=$(if $(BUILDTAGS),-tags "$(BUILDTAGS)",) --GO_LDFLAGS=-ldflags '-s -w -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) $(EXTRA_LDFLAGS)' \ -- -ldflags=-extldflags=-zrelro -ldflags=-extldflags=-znow --SHIM_GO_LDFLAGS=-ldflags '-s -w -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -extldflags "-static"' -+ -+BEP_DIR=/tmp/containerd-build-bep -+BEP_FLAGS=-tmpdir=/tmp/containerd-build-bep -+ -+GO_LDFLAGS=-ldflags '-s -w -extldflags=-zrelro -extldflags=-znow $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) $(EXTRA_LDFLAGS)' -+SHIM_GO_LDFLAGS=-ldflags '-s -w $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -extldflags "-static"' - - #Replaces ":" (*nix), ";" (windows) with newline for easy parsing - GOPATHS=$(shell echo ${GOPATH} | tr ":" "\n" | tr ";" "\n") -@@ -166,8 +169,9 @@ FORCE: - - # Build a binary from a cmd. - bin/%: cmd/% FORCE -+ mkdir -p $(BEP_DIR) - @echo "$(WHALE) $@${BINARY_SUFFIX}" -- @go build ${GO_GCFLAGS} ${GO_BUILD_FLAGS} -o $@${BINARY_SUFFIX} ${GO_LDFLAGS} ${GO_TAGS} ./$< -+ go build ${GO_GCFLAGS} ${GO_BUILD_FLAGS} -o $@${BINARY_SUFFIX} ${GO_LDFLAGS} ${GO_TAGS} ./$< - - bin/containerd-shim: cmd/containerd-shim FORCE # set !cgo and omit pie for a static shim build: https://github.com/golang/go/issues/17789#issuecomment-258542220 - @echo "$(WHALE) bin/containerd-shim" --- -2.17.1 - diff --git a/patch/0033-containerd-fix-opened-file-not-close.patch b/patch/0033-containerd-fix-opened-file-not-close.patch deleted file mode 100644 index 8ba547c..0000000 --- a/patch/0033-containerd-fix-opened-file-not-close.patch +++ /dev/null @@ -1,28 +0,0 @@ -From b5806942e2938d4800298df276f1a095b859bacb Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Fri, 19 Apr 2019 22:05:18 +0800 -Subject: [PATCH] containerd: fix opened file not close - -reason: fix opened file not close - -Change-Id: I69f53255eabd3dd2e87a61ba963fa8027870e014 -Signed-off-by: xiadanni1 ---- - runtime/v1/linux/proc/utils.go | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/runtime/v1/linux/proc/utils.go b/runtime/v1/linux/proc/utils.go -index 3d0334c..ab9f5fa 100644 ---- a/runtime/v1/linux/proc/utils.go -+++ b/runtime/v1/linux/proc/utils.go -@@ -41,6 +41,7 @@ func getLastRuntimeError(r *runc.Runc) (string, error) { - if err != nil { - return "", err - } -+ defer f.Close() - - var ( - errMsg string --- -1.8.3.1 - diff --git a/patch/0034-containerd-add-buildid-in-Makefile.patch b/patch/0034-containerd-add-buildid-in-Makefile.patch deleted file mode 100644 index 8d92ee0..0000000 --- a/patch/0034-containerd-add-buildid-in-Makefile.patch +++ /dev/null @@ -1,28 +0,0 @@ -From e61f2c1664c91b5c8a8cb48641002c7c471c1d45 Mon Sep 17 00:00:00 2001 -From: zhangyu235 -Date: Tue, 23 Apr 2019 12:24:50 +0800 -Subject: [PATCH] containerd: add buildid in Makefile - -Change-Id: I1c2ff035db2a02d125139b9ff170f91e81181541 ---- - Makefile | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/Makefile b/Makefile -index 612330b..a400899 100644 ---- a/Makefile -+++ b/Makefile -@@ -81,8 +81,8 @@ GO_TAGS=$(if $(BUILDTAGS),-tags "$(BUILDTAGS)",) - BEP_DIR=/tmp/containerd-build-bep - BEP_FLAGS=-tmpdir=/tmp/containerd-build-bep - --GO_LDFLAGS=-ldflags '-s -w -extldflags=-zrelro -extldflags=-znow $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) $(EXTRA_LDFLAGS)' --SHIM_GO_LDFLAGS=-ldflags '-s -w $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -extldflags "-static"' -+GO_LDFLAGS=-ldflags '-s -w -buildid=IdByIsula -extldflags=-zrelro -extldflags=-znow $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) $(EXTRA_LDFLAGS)' -+SHIM_GO_LDFLAGS=-ldflags '-s -w -buildid=IdByIsula $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -extldflags "-static"' - - #Replaces ":" (*nix), ";" (windows) with newline for easy parsing - GOPATHS=$(shell echo ${GOPATH} | tr ":" "\n" | tr ";" "\n") --- -2.7.4.3 - diff --git a/patch/0035-containerd-fix-the-path-of-containerd.spec-in.patch b/patch/0035-containerd-fix-the-path-of-containerd.spec-in.patch deleted file mode 100644 index 0f7659a..0000000 --- a/patch/0035-containerd-fix-the-path-of-containerd.spec-in.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 8f97c7a7353c05a8b64ef9ee522ee62fba66a608 Mon Sep 17 00:00:00 2001 -From: zhangyu235 -Date: Sun, 5 May 2019 19:50:56 +0800 -Subject: [PATCH] containerd: fix the path of containerd.spec in - Makefile - -Change-Id: I4ec87e5ddf256574513f977e53e4bdf050e0169c -Signed-off-by: zhangyu235 ---- - Makefile | 2 +- - hack/containerd.spec | 46 ---------------------------------------------- - 2 files changed, 1 insertion(+), 47 deletions(-) - delete mode 100644 hack/containerd.spec - -diff --git a/Makefile b/Makefile -index a400899..5de5cf7 100644 ---- a/Makefile -+++ b/Makefile -@@ -20,7 +20,7 @@ ROOTDIR=$(dir $(abspath $(lastword $(MAKEFILE_LIST)))) - DESTDIR=/usr/local - - # Used to populate variables in version package. --VERSION=$(shell echo version:)$(shell grep '^Version' ${ROOTDIR}/hack/containerd.spec | sed 's/[^0-9.]*\([0-9.]*\).*/\1/').$(shell grep '^Release:' ${ROOTDIR}/hack/containerd.spec | sed 's/[^0-9.]*\([0-9.]*\).*/\1/') -+VERSION=$(shell echo version:)$(shell grep '^Version' ${ROOTDIR}/containerd.spec | sed 's/[^0-9.]*\([0-9.]*\).*/\1/').$(shell grep '^Release:' ${ROOTDIR}/containerd.spec | sed 's/[^0-9.]*\([0-9.]*\).*/\1/') - REVISION=$(shell echo commit:)$(shell git rev-parse HEAD)$(shell if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi) - - ifneq "$(strip $(shell command -v go 2>/dev/null))" "" -diff --git a/hack/containerd.spec b/hack/containerd.spec -deleted file mode 100644 -index 05f68c7..0000000 ---- a/hack/containerd.spec -+++ /dev/null -@@ -1,46 +0,0 @@ --%global goipath github.com/containerd/containerd --%global debug_package %{nil} --Version: 1.2.0 -- --Name: containerd --Release: 7%{?dist} --Summary: An industry-standard container runtime --License: ASL 2.0 --URL: https://containerd.io --Source0: containerd-1.2.0.tar.gz -- --BuildRequires: golang glibc-static make --BuildRequires: btrfs-progs-devel -- -- --%description --containerd is an industry-standard container runtime with an emphasis on --simplicity, robustness and portability. It is available as a daemon for Linux --and Windows, which can manage the complete container lifecycle of its host --system: image transfer and storage, container execution and supervision, --low-level storage and network attachments, etc. -- -- --%prep --%setup -c -n containerd -- --%build --GO_BUILD_PATH=$PWD/_build --install -m 0755 -vd $(dirname $GO_BUILD_PATH/src/%{goipath}) --ln -fs $PWD $GO_BUILD_PATH/src/%{goipath} --cd $GO_BUILD_PATH/src/%{goipath} --export GOPATH=$GO_BUILD_PATH:%{gopath} --export BUILDTAGS="no_btrfs no_cri" --make -- --%install --install -d $RPM_BUILD_ROOT/%{_bindir} --install -p -m 755 bin/containerd $RPM_BUILD_ROOT/%{_bindir}/containerd --install -p -m 755 bin/containerd-shim $RPM_BUILD_ROOT/%{_bindir}/containerd-shim -- --%files --%{_bindir}/containerd --%{_bindir}/containerd-shim -- -- --%changelog --- -2.7.4.3 - diff --git a/patch/0036-containerd-support-container-start-timeout-se.patch b/patch/0036-containerd-support-container-start-timeout-se.patch deleted file mode 100644 index 40c5310..0000000 --- a/patch/0036-containerd-support-container-start-timeout-se.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 1980e34108cf2fab407c4e0b45cb07fc06e15642 Mon Sep 17 00:00:00 2001 -From: lixiang172 -Date: Thu, 9 May 2019 21:36:56 +0800 -Subject: [PATCH] containerd: support container start timeout setting - -Change-Id: I8c958a1c16ed6c7a86e4c6299ad1ef81c7476120 -Signed-off-by: lixiang172 ---- - vendor/github.com/containerd/go-runc/runc.go | 24 ++++++++++++++++++++++-- - 1 file changed, 22 insertions(+), 2 deletions(-) - -diff --git a/vendor/github.com/containerd/go-runc/runc.go b/vendor/github.com/containerd/go-runc/runc.go -index e66ea5b..6323bf2 100644 ---- a/vendor/github.com/containerd/go-runc/runc.go -+++ b/vendor/github.com/containerd/go-runc/runc.go -@@ -30,9 +30,9 @@ import ( - "strings" - "syscall" - "time" -- "github.com/sirupsen/logrus" - - specs "github.com/opencontainers/runtime-spec/specs-go" -+ "github.com/sirupsen/logrus" - ) - - // Format is the type of log formatting options avaliable -@@ -54,7 +54,10 @@ const ( - // DefaultCommand is the default command for Runc - DefaultCommand = "runc" - execTimeout = 30 -- createTimeout = 120 -+) -+ -+var ( -+ createTimeout int64 = 120 - ) - - // Runc is the client to the runc cli -@@ -72,6 +75,15 @@ type Runc struct { - Rootless *bool // nil stands for "auto" - } - -+func init() { -+ runtimeTimeout, err := convertTime(os.Getenv("DOCKER_RUNTIME_START_TIMEOUT")) -+ if err != nil { -+ logrus.Warnf("init error, wrong runtimeTimeout format: %v", err) -+ } else { -+ createTimeout = runtimeTimeout -+ } -+} -+ - // List returns all containers created inside the provided runc root directory - func (r *Runc) List(context context.Context) ([]*Container, error) { - data, err := cmdOutput(r.command(context, "list", "--format=json"), false) -@@ -734,3 +746,11 @@ func cmdOutputTimeout(cmd *exec.Cmd, combined bool, timeout int64) ([]byte, erro - - return b.Bytes(), err - } -+ -+func convertTime(timeout string) (int64, error) { -+ timeDura, err := time.ParseDuration(timeout) -+ if err != nil { -+ return 0, err -+ } -+ return timeDura.Nanoseconds() / 1e9, nil -+} --- -1.8.3.1 - diff --git a/patch/0037-containerd-Fix-fd-leak-of-shim-log.patch b/patch/0037-containerd-Fix-fd-leak-of-shim-log.patch deleted file mode 100644 index a621446..0000000 --- a/patch/0037-containerd-Fix-fd-leak-of-shim-log.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 26c6307f1cab31105583ef22c2da8fe44a8d45e4 Mon Sep 17 00:00:00 2001 -From: zhangyu235 -Date: Fri, 17 May 2019 16:52:06 +0800 -Subject: [PATCH] containerd: Fix fd leak of shim log - -reason:Open shim v2 log with the flag `O_RDWR` will cause the `Read()` block -forever even if the pipe has been closed on the shim side. Then the -`io.Copy()` would never return and lead to a fd leak. -Fix typo when closing shim v1 log which causes the `stdouLog` leak. -Update `numPipes` function in test case to get the opened FIFO -correctly. - -Cherry-pick from upstream cf6e00854 -Reference from https://github.com/containerd/containerd/pull/3266 - -Change-Id: If83a4ca9b9ec0079ac0f0015d1f6768581571030 -Signed-off-by: Li Yuxuan -Signed-off-by: zhangyu235 ---- - container_linux_test.go | 2 +- - runtime/v1/shim/client/client.go | 4 ++-- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/container_linux_test.go b/container_linux_test.go -index fa764d7..fdf6349 100644 ---- a/container_linux_test.go -+++ b/container_linux_test.go -@@ -329,7 +329,7 @@ func TestShimDoesNotLeakPipes(t *testing.T) { - } - - func numPipes(pid int) (int, error) { -- cmd := exec.Command("sh", "-c", fmt.Sprintf("lsof -p %d | grep pipe", pid)) -+ cmd := exec.Command("sh", "-c", fmt.Sprintf("lsof -p %d | grep FIFO", pid)) - - var stdout bytes.Buffer - cmd.Stdout = &stdout -diff --git a/runtime/v1/shim/client/client.go b/runtime/v1/shim/client/client.go -index ef74030..a819be6 100644 ---- a/runtime/v1/shim/client/client.go -+++ b/runtime/v1/shim/client/client.go -@@ -96,9 +96,9 @@ func WithStart(binary, address, daemonAddress, cgroup string, debug bool, exitHa - cmd.Wait() - exitHandler() - if stdoutLog != nil { -- stderrLog.Close() -+ stdoutLog.Close() - } -- if stdoutLog != nil { -+ if stderrLog != nil { - stderrLog.Close() - } - }() --- -2.7.4.3 - diff --git a/patch/0037-containerd-fix-shim-std-logs-not-close-after-.patch b/patch/0037-containerd-fix-shim-std-logs-not-close-after-.patch deleted file mode 100644 index 77aa6ca..0000000 --- a/patch/0037-containerd-fix-shim-std-logs-not-close-after-.patch +++ /dev/null @@ -1,59 +0,0 @@ -From d13733a390a987006bd5febb7d28a2d1c7873af2 Mon Sep 17 00:00:00 2001 -From: zhangyu235 -Date: Thu, 30 May 2019 09:27:00 +0800 -Subject: [PATCH] containerd: fix shim std logs not close after shim - exit - -reason:fix shim std logs not close after shim exit - -Change-Id: I980fb17b1d46de099b81529ea46681cf9f4bf09c -Signed-off-by: zhangyu235 ---- - runtime/v1/linux/runtime.go | 16 +++++++++++++++- - 1 file changed, 15 insertions(+), 1 deletion(-) - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index af823b2..66914fe 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -361,7 +361,9 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - ctx = namespaces.WithNamespace(ctx, ns) - pid, _ := runc.ReadPidFile(filepath.Join(bundle.path, proc.InitPidFile)) - log.G(ctx).Infof("load-task %s/%s/%s Pid=%d", r.state, ns, id, pid) -+ shimExit := make(chan struct{}) - s, err := bundle.NewShimClient(ctx, ns, ShimConnect(r.config, func() { -+ close(shimExit) - err := r.cleanupAfterDeadShim(ctx, bundle, ns, id, pid) - if err != nil { - log.G(ctx).WithError(err).WithField("bundle", bundle.path). -@@ -426,6 +428,18 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - } - go io.Copy(os.Stderr, shimStderrLog) - -+ go func() { -+ select { -+ case <-shimExit: -+ if shimStdoutLog != nil { -+ shimStdoutLog.Close() -+ } -+ if shimStderrLog != nil { -+ shimStderrLog.Close() -+ } -+ } -+ }() -+ - t, err := newTask(id, ns, pid, s, r.events, r.tasks, bundle) - if err != nil { - log.G(ctx).WithError(err).Error("loading task type") -@@ -443,7 +457,7 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - if !events.ExitPending(ns, t.id, uint32(pid)) { - events.ExitAddFile(ns, events.ExitFile(t.id, uint32(pid), uint32(events.ExitStatusDefault)), "cleanup dirty task") - } -- go func(){ -+ go func() { - log.G(ctx).Infof("delete force %s start, Pid=%d(exiting)", id, pid) - _, err := t.DeleteForce(ctx, uint32(pid)) - log.G(ctx).Infof("delete force %s done, Pid=%d(exiting) error=%v", id, pid, err) --- -2.7.4.3 - diff --git a/patch/0038-containerd-add-timeout-for-I-O-waitgroups.patch b/patch/0038-containerd-add-timeout-for-I-O-waitgroups.patch deleted file mode 100644 index 9c7e857..0000000 --- a/patch/0038-containerd-add-timeout-for-I-O-waitgroups.patch +++ /dev/null @@ -1,89 +0,0 @@ -From d886f6c03cca051b45fd77cc77d0cc870aed1aed Mon Sep 17 00:00:00 2001 -From: build -Date: Wed, 4 Sep 2019 05:21:06 -0400 -Subject: [PATCH] containerd: add timeout for I/O waitgroups - -reason: This and a combination of a couple Docker changes are needed to fully -resolve the issue on the Docker side. However, this ensures that after -processes exit, we still leave some time for the I/O to fully flush -before closing. Without this timeout, the delete methods would block -forever. - -Cherry-pick from upstream 245052243d -Reference from https://github.com/containerd/containerd/pull/3361 - -Signed-off-by: Michael Crosby ---- - runtime/v1/linux/proc/exec.go | 2 +- - runtime/v1/linux/proc/init.go | 2 +- - runtime/v1/linux/proc/utils.go | 20 ++++++++++++++++++++ - 3 files changed, 22 insertions(+), 2 deletions(-) - -diff --git a/runtime/v1/linux/proc/exec.go b/runtime/v1/linux/proc/exec.go -index 715a977..08c581f 100644 ---- a/runtime/v1/linux/proc/exec.go -+++ b/runtime/v1/linux/proc/exec.go -@@ -94,7 +94,7 @@ func (e *execProcess) setExited(status int) { - } - - func (e *execProcess) delete(ctx context.Context) error { -- e.wg.Wait() -+ waitTimeout(ctx, &e.wg, 2*time.Second) - if e.io != nil { - for _, c := range e.closers { - c.Close() -diff --git a/runtime/v1/linux/proc/init.go b/runtime/v1/linux/proc/init.go -index 44d3f58..49fa8ec 100644 ---- a/runtime/v1/linux/proc/init.go -+++ b/runtime/v1/linux/proc/init.go -@@ -263,7 +263,7 @@ func (p *Init) setExited(status int) { - } - - func (p *Init) delete(context context.Context) error { -- p.wg.Wait() -+ waitTimeout(context, &p.wg, 2*time.Second) - err := p.runtime.Delete(context, p.id, nil) - // ignore errors if a runtime has already deleted the process - // but we still hold metadata and pipes -diff --git a/runtime/v1/linux/proc/utils.go b/runtime/v1/linux/proc/utils.go -index ab9f5fa..d6f047c 100644 ---- a/runtime/v1/linux/proc/utils.go -+++ b/runtime/v1/linux/proc/utils.go -@@ -19,10 +19,12 @@ - package proc - - import ( -+ "context" - "encoding/json" - "io" - "os" - "strings" -+ "sync" - "time" - - "github.com/containerd/containerd/errdefs" -@@ -103,3 +105,21 @@ func checkKillError(err error) error { - func hasNoIO(r *CreateConfig) bool { - return r.Stdin == "" && r.Stdout == "" && r.Stderr == "" - } -+ -+// waitTimeout handles waiting on a waitgroup with a specified timeout. -+// this is commonly used for waiting on IO to finish after a process has exited -+func waitTimeout(ctx context.Context, wg *sync.WaitGroup, timeout time.Duration) error { -+ ctx, cancel := context.WithTimeout(ctx, timeout) -+ defer cancel() -+ done := make(chan struct{}, 1) -+ go func() { -+ wg.Wait() -+ close(done) -+ }() -+ select { -+ case <-done: -+ return nil -+ case <-ctx.Done(): -+ return ctx.Err() -+ } -+} --- -2.20.1 - diff --git a/patch/0038-containerd-support-kill-D-state-container.patch b/patch/0038-containerd-support-kill-D-state-container.patch deleted file mode 100644 index bc94d1f..0000000 --- a/patch/0038-containerd-support-kill-D-state-container.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 8ab02b5aecb0fa04ad747988d838e1c4de535222 Mon Sep 17 00:00:00 2001 -From: Jing Rui -Date: Tue, 18 Jun 2019 00:12:41 +0800 -Subject: [PATCH] containerd: support kill D state container - -Change-Id: I057553f2b8d3f57b71e5ea79930067bb7071e524 -Signed-off-by: Jing Rui ---- - runtime/v1/shim/service.go | 21 +++++++++++++++++++++ - 1 file changed, 21 insertions(+) - -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index f421fdef..8adaf35b 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -26,6 +26,7 @@ import ( - "os" - "path/filepath" - "sync" -+ "syscall" - "time" - - "github.com/containerd/console" -@@ -366,11 +367,30 @@ func (s *Service) Resume(ctx context.Context, r *ptypes.Empty) (*ptypes.Empty, e - - // Kill a process with the provided signal - func (s *Service) Kill(ctx context.Context, r *shimapi.KillRequest) (*ptypes.Empty, error) { -+ delayKill := func(p rproc.Process) { -+ if s.id != p.ID() || r.Signal != uint32(syscall.SIGKILL) { -+ return -+ } -+ -+ for i := 1; i < 5; i++ { -+ time.Sleep(10 * time.Second) -+ err := p.Kill(ctx, r.Signal, r.All) -+ logrus.Infof("delay kill %s retry %d error=%v", s.id, i, err) -+ } -+ -+ logrus.Infof("force exit shim %s ...", s.id) -+ p.SetExited(137) -+ err := p.Delete(ctx) -+ logrus.Infof("force exit shim %s error=%v", s.id, err) -+ os.Exit(0) -+ } -+ - if r.ID == "" { - p, err := s.getInitProcess() - if err != nil { - return nil, err - } -+ go delayKill(p) - if err := p.Kill(ctx, r.Signal, r.All); err != nil { - return nil, errdefs.ToGRPC(err) - } -@@ -381,6 +401,7 @@ func (s *Service) Kill(ctx context.Context, r *shimapi.KillRequest) (*ptypes.Emp - if err != nil { - return nil, err - } -+ go delayKill(p) - if err := p.Kill(ctx, r.Signal, r.All); err != nil { - return nil, errdefs.ToGRPC(err) - } --- -2.17.1 - diff --git a/patch/0039-containerd-fix-shouldKillAllOnExit-check.patch b/patch/0039-containerd-fix-shouldKillAllOnExit-check.patch deleted file mode 100644 index 1f894bf..0000000 --- a/patch/0039-containerd-fix-shouldKillAllOnExit-check.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 7741b1a960799b1724e92d23c6b2d9473ca71fee Mon Sep 17 00:00:00 2001 -From: liuzekun -Date: Thu, 31 Oct 2019 23:25:40 -0400 -Subject: [PATCH] containerd: fix shouldKillAllOnExit check - -reason: fix shouldKillAllOnExit check -v1 https://github.com/containerd/containerd/commit/fa5f744a790356472d4649b9ad1d955e36d0c7c0 -v2 https://github.com/containerd/containerd/commit/872296642ac395acbc4344f529fcf4c6fddb5de2 -Signed-off-by: Lifubang ---- - runtime/v1/shim/service.go | 2 +- - runtime/v2/runc/service.go | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index ac545ea..88f7e0d 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -578,7 +578,7 @@ func shouldKillAllOnExit(bundlePath string) (bool, error) { - - if bundleSpec.Linux != nil { - for _, ns := range bundleSpec.Linux.Namespaces { -- if ns.Type == specs.PIDNamespace { -+ if ns.Type == specs.PIDNamespace && ns.Path == "" { - return false, nil - } - } -diff --git a/runtime/v2/runc/service.go b/runtime/v2/runc/service.go -index e37fb29..82beb8d 100644 ---- a/runtime/v2/runc/service.go -+++ b/runtime/v2/runc/service.go -@@ -680,7 +680,7 @@ func shouldKillAllOnExit(bundlePath string) (bool, error) { - - if bundleSpec.Linux != nil { - for _, ns := range bundleSpec.Linux.Namespaces { -- if ns.Type == specs.PIDNamespace { -+ if ns.Type == specs.PIDNamespace && ns.Path == "" { - return false, nil - } - } --- -2.20.1 - diff --git a/patch/0039-containerd-modify-containerd-shim-to-ad.patch b/patch/0039-containerd-modify-containerd-shim-to-ad.patch deleted file mode 100644 index e475ee3..0000000 --- a/patch/0039-containerd-modify-containerd-shim-to-ad.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 5eef82c3c41eabb532cd7520acf7e8587b76d8b5 Mon Sep 17 00:00:00 2001 -From: jiangpengfei -Date: Wed, 10 Jul 2019 15:07:46 -0400 -Subject: [PATCH] containerd: modify containerd-shim to adapt runv - runtime - -reason: containerd-shim pass a too long runtime root path to runv runtime, which cause hyperstartgrpc.sock -file absolute path exceed the max length of Unix Socket(max length is 108). - -Signed-off-by: jiangpengfei ---- - runtime/v1/linux/proc/init.go | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - -diff --git a/runtime/v1/linux/proc/init.go b/runtime/v1/linux/proc/init.go -index 5b23671..d464147 100644 ---- a/runtime/v1/linux/proc/init.go -+++ b/runtime/v1/linux/proc/init.go -@@ -44,6 +44,9 @@ import ( - // InitPidFile name of the file that contains the init pid - const InitPidFile = "init.pid" - -+// Default runv runtime root dir -+const defaultRunvRoot = "/run/runv" -+ - // Init represents an initial process for a container - type Init struct { - wg sync.WaitGroup -@@ -83,12 +86,18 @@ func NewRunc(root, path, namespace, runtime, criu string, systemd bool) *runc.Ru - if root == "" { - root = RuncRoot - } -+ -+ rootPath := filepath.Join(root, namespace) -+ if strings.Contains(runtime, "runv") { -+ rootPath = defaultRunvRoot -+ } -+ - return &runc.Runc{ - Command: runtime, - Log: filepath.Join(path, "log.json"), - LogFormat: runc.JSON, - PdeathSignal: syscall.SIGKILL, -- Root: filepath.Join(root, namespace), -+ Root: rootPath, - Criu: criu, - SystemdCgroup: systemd, - } --- -1.8.3.1 - diff --git a/patch/0040-containerd-add-shim-exit-when-bundle-dir-does.patch b/patch/0040-containerd-add-shim-exit-when-bundle-dir-does.patch deleted file mode 100644 index b266393..0000000 --- a/patch/0040-containerd-add-shim-exit-when-bundle-dir-does.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 07605707cce769e4f4c79b700586b5c59ec0b15a Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Sat, 13 Jul 2019 06:32:54 +0800 -Subject: [PATCH] containerd: add shim exit when bundle dir does not - exist - -reason: when bundle dir is deleted, containerd-shim should exit to avoid -shim.sock is occupied when container restart next time. - -Change-Id: I956412598e17d15f25b91afe1cbb9e24463f04be -Signed-off-by: xiadanni1 ---- - runtime/v1/shim/service.go | 12 +++++++++++- - 1 file changed, 11 insertions(+), 1 deletion(-) - -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index 8adaf35..ac545ea 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -141,13 +141,23 @@ func (s *Service) Create(ctx context.Context, r *shimapi.CreateTaskRequest) (_ * - } - rootfs := filepath.Join(r.Bundle, "rootfs") - defer func() { -+ go func() { -+ for i := 0; i < 60; i++ { -+ time.Sleep(time.Second) -+ _, err := os.Stat(r.Bundle) -+ if os.IsNotExist(err) { -+ logrus.Errorf("bundle dir: %v does not exist, containerd-shim exit", r.Bundle) -+ os.Exit(0) -+ } -+ } -+ }() - if err != nil { - logrus.Errorf("create init %s failed error=%v", r.ID, err) - if err2 := mount.UnmountAll(rootfs, 0); err2 != nil { - log.G(ctx).WithError(err2).Warn("Failed to cleanup rootfs mount") - } - go func() { -- time.Sleep(10*time.Second) -+ time.Sleep(10 * time.Second) - os.Exit(0) - }() - } --- -1.8.3.1 - diff --git a/patch/0041-containerd-fix-containerd-call-runv-delete-directly.patch b/patch/0041-containerd-fix-containerd-call-runv-delete-directly.patch deleted file mode 100644 index 910cb60..0000000 --- a/patch/0041-containerd-fix-containerd-call-runv-delete-directly.patch +++ /dev/null @@ -1,80 +0,0 @@ -From be9c04e9a90be92437c12ce90c8ff6d4ec1d83b3 Mon Sep 17 00:00:00 2001 -From: jiangpengfei -Date: Thu, 18 Jul 2019 07:57:52 -0400 -Subject: [PATCH] containerd: fix containerd call runv delete directly - use wrong --root parameters - -reason: When containerd-shim process is killed abnormaly, containerd will exec runv -delete command directly, however it will use the wrong --root parameters which is not -compatible with runv runtime. - -Signed-off-by: jiangpengfei ---- - runtime/v1/linux/proc/init.go | 4 ++-- - runtime/v1/linux/runtime.go | 10 +++++++++- - 2 files changed, 11 insertions(+), 3 deletions(-) - -diff --git a/runtime/v1/linux/proc/init.go b/runtime/v1/linux/proc/init.go -index d464147..44d3f58 100644 ---- a/runtime/v1/linux/proc/init.go -+++ b/runtime/v1/linux/proc/init.go -@@ -45,7 +45,7 @@ import ( - const InitPidFile = "init.pid" - - // Default runv runtime root dir --const defaultRunvRoot = "/run/runv" -+const DefaultRunvRoot = "/run/runv" - - // Init represents an initial process for a container - type Init struct { -@@ -89,7 +89,7 @@ func NewRunc(root, path, namespace, runtime, criu string, systemd bool) *runc.Ru - - rootPath := filepath.Join(root, namespace) - if strings.Contains(runtime, "runv") { -- rootPath = defaultRunvRoot -+ rootPath = DefaultRunvRoot - } - - return &runc.Runc{ -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 66914fe..f8e3074 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -25,6 +25,7 @@ import ( - "io/ioutil" - "os" - "path/filepath" -+ "strings" - "time" - - eventstypes "github.com/containerd/containerd/api/events" -@@ -506,6 +507,7 @@ func (r *Runtime) terminate(ctx context.Context, bundle *bundle, ns, id string) - if err != nil { - return err - } -+ - if err := rt.Delete(ctx, id, &runc.DeleteOpts{ - Force: true, - }); err != nil { -@@ -539,11 +541,17 @@ func (r *Runtime) getRuntime(ctx context.Context, ns, id string) (*runc.Runc, er - } - } - -+ rootPath := filepath.Join(root, ns) -+ -+ if strings.Contains(cmd, "runv") { -+ rootPath = proc.DefaultRunvRoot -+ } -+ - return &runc.Runc{ - Command: cmd, - LogFormat: runc.JSON, - PdeathSignal: unix.SIGKILL, -- Root: filepath.Join(root, ns), -+ Root: rootPath, - Debug: r.config.ShimDebug, - }, nil - } --- -1.8.3.1 - diff --git a/patch/0042-containerd-close-inherit-shim.sock-fd-to-adap.patch b/patch/0042-containerd-close-inherit-shim.sock-fd-to-adap.patch deleted file mode 100644 index 73af8e4..0000000 --- a/patch/0042-containerd-close-inherit-shim.sock-fd-to-adap.patch +++ /dev/null @@ -1,34 +0,0 @@ -From dcef6fcbdc78f7e9c14bdcd58e79d3eac8bc1c1b Mon Sep 17 00:00:00 2001 -From: jiangpengfei -Date: Thu, 18 Jul 2019 15:44:12 -0400 -Subject: [PATCH] containerd: close inherit shim.sock fd to adapt runv - -reason: runv create prcess is created by containerd-shim process and will -inherit the abstract unix socket shim.sock fd from containerd-shim. -If pause container restart, qemu and runv-proxy process are still running, -and shim.sock fd doesn't close, so pause container can not reuse the shim.sock -path and restart failed! - -Signed-off-by: jiangpengfei ---- - cmd/containerd-shim/main_unix.go | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/cmd/containerd-shim/main_unix.go b/cmd/containerd-shim/main_unix.go -index 38b3eb4..89f6be9 100644 ---- a/cmd/containerd-shim/main_unix.go -+++ b/cmd/containerd-shim/main_unix.go -@@ -189,6 +189,10 @@ func serve(ctx context.Context, server *ttrpc.Server, path string) error { - ) - if path == "" { - l, err = net.FileListener(os.NewFile(3, "socket")) -+ _, _, errnoValue := unix.Syscall(unix.SYS_FCNTL, 3, uintptr(unix.F_SETFD), unix.FD_CLOEXEC) -+ if errnoValue != 0 { -+ logrus.Errorf("SYS_FCNTL set fd 3 FD_CLOEXEC flag failed: %v", errnoValue) -+ } - path = "[inherited from parent]" - } else { - if len(path) > 106 { --- -1.8.3.1 - diff --git a/patch/0043-containerd-run-state-with-timeout-10s.patch b/patch/0043-containerd-run-state-with-timeout-10s.patch deleted file mode 100644 index cfe0706..0000000 --- a/patch/0043-containerd-run-state-with-timeout-10s.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 7b9e8a793fa6c0ec67effac0bc53d55c275e13be Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Thu, 25 Jul 2019 19:29:50 +0800 -Subject: [PATCH] containerd: run state with timeout 10s - -Change-Id: Idf55f750c2e7c6a9268318f519f1c8bc1595e09e -Signed-off-by: jingrui ---- - Makefile | 4 ++-- - runtime/v1/linux/task.go | 3 --- - services/tasks/local.go | 11 +++++++++++ - 3 files changed, 13 insertions(+), 5 deletions(-) - -diff --git a/Makefile b/Makefile -index 5de5cf75..9e7f3ae3 100644 ---- a/Makefile -+++ b/Makefile -@@ -81,8 +81,8 @@ GO_TAGS=$(if $(BUILDTAGS),-tags "$(BUILDTAGS)",) - BEP_DIR=/tmp/containerd-build-bep - BEP_FLAGS=-tmpdir=/tmp/containerd-build-bep - --GO_LDFLAGS=-ldflags '-s -w -buildid=IdByIsula -extldflags=-zrelro -extldflags=-znow $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) $(EXTRA_LDFLAGS)' --SHIM_GO_LDFLAGS=-ldflags '-s -w -buildid=IdByIsula $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -extldflags "-static"' -+GO_LDFLAGS=-ldflags ' -buildid=IdByIsula -extldflags=-zrelro -extldflags=-znow $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) $(EXTRA_LDFLAGS)' -+SHIM_GO_LDFLAGS=-ldflags ' -buildid=IdByIsula $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -extldflags "-static"' - - #Replaces ":" (*nix), ";" (windows) with newline for easy parsing - GOPATHS=$(shell echo ${GOPATH} | tr ":" "\n" | tr ";" "\n") -diff --git a/runtime/v1/linux/task.go b/runtime/v1/linux/task.go -index b692ae78..d2bbb764 100644 ---- a/runtime/v1/linux/task.go -+++ b/runtime/v1/linux/task.go -@@ -92,9 +92,6 @@ func (t *Task) delete(ctx context.Context, force bool, pid uint32) (*runtime.Exi - rsp, err := t.shim.Delete(ctx, empty) - if err != nil { - log.G(ctx).WithError(err).Error("failed to delete container, force=%t", force) -- if !force { -- return nil, errdefs.FromGRPC(err) -- } - } - t.tasks.Delete(ctx, t.id) - if err := t.shim.KillShim(ctx); err != nil { -diff --git a/services/tasks/local.go b/services/tasks/local.go -index ce9ee59d..990e8411 100644 ---- a/services/tasks/local.go -+++ b/services/tasks/local.go -@@ -47,6 +47,7 @@ import ( - ptypes "github.com/gogo/protobuf/types" - ocispec "github.com/opencontainers/image-spec/specs-go/v1" - "github.com/pkg/errors" -+ "github.com/sirupsen/logrus" - bolt "go.etcd.io/bbolt" - "google.golang.org/grpc" - "google.golang.org/grpc/codes" -@@ -185,9 +186,19 @@ func (l *local) Create(ctx context.Context, r *api.CreateTaskRequest, _ ...grpc. - if err := l.monitor.Monitor(c); err != nil { - return nil, errors.Wrap(err, "monitor task") - } -+ -+ ctx, cancel := context.WithTimeout(ctx, 20*time.Second) -+ defer cancel() -+ - state, err := c.State(ctx) - if err != nil { - log.G(ctx).Error(err) -+ go func() { -+ ctx, cancel := context.WithTimeout(context.Background(), time.Second) -+ defer cancel() -+ _, err := c.Delete(ctx) -+ logrus.Errorf("failed get pid, delete force error=%v", err) -+ }() - } - return &api.CreateTaskResponse{ - ContainerID: r.ContainerID, --- -2.17.1 - diff --git a/patch/0044-containerd-add-copyright.patch b/patch/0044-containerd-add-copyright.patch deleted file mode 100644 index f40d272..0000000 --- a/patch/0044-containerd-add-copyright.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 80972f7d142540b886068d67a49794aaa7232fb5 Mon Sep 17 00:00:00 2001 -From: lixiang -Date: Fri, 6 Sep 2019 15:16:21 +0800 -Subject: [PATCH] containerd: add copyright - -reason: add copyright - -Change-Id: I93ef565c6bf10d6f8cb66d956dddbfbd14477138 -Signed-off-by: lixiang ---- - events/exit.go | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - -diff --git a/events/exit.go b/events/exit.go -index 772dc24..d3b3027 100644 ---- a/events/exit.go -+++ b/events/exit.go -@@ -1,3 +1,12 @@ -+/* -+Copyright (c) Huawei Technologies Co., Ltd. 2019. All rights reserved. -+Use of this source code is governed by Apache-2.0 -+license that can be found in the LICENSE file -+Description: common functions -+Author: jingrui -+Create: 2019-02-12 -+*/ -+ - package events - - import ( -@@ -97,4 +106,3 @@ func InitExitExist(bundle string) bool { - } - return false - } -- --- -1.8.3.1 - diff --git a/patch/0044-containerd-change-tmpfile-directory-when-exec.patch b/patch/0044-containerd-change-tmpfile-directory-when-exec.patch deleted file mode 100644 index 4e1adbe..0000000 --- a/patch/0044-containerd-change-tmpfile-directory-when-exec.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 8f3291f805c641a6fcf043eb8c4e1a2f4174b579 Mon Sep 17 00:00:00 2001 -From: wujibin -Date: Wed, 14 Aug 2019 17:18:24 +0800 -Subject: [PATCH] containerd: change tmpfile directory when exec - -reason: tmp file stored /tmp before change, if mountain of containers -are runing, the diretory will exist too many tmp file - -Change-Id: I1879ba9d09dca41a7571131d7447bf67356ea79c ---- - vendor/github.com/containerd/go-runc/runc.go | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/vendor/github.com/containerd/go-runc/runc.go b/vendor/github.com/containerd/go-runc/runc.go -index 6323bf21..7a2a8c4d 100644 ---- a/vendor/github.com/containerd/go-runc/runc.go -+++ b/vendor/github.com/containerd/go-runc/runc.go -@@ -229,7 +229,7 @@ func (o *ExecOpts) args() (out []string, err error) { - // Exec executres and additional process inside the container based on a full - // OCI Process specification - func (r *Runc) Exec(context context.Context, id string, spec specs.Process, opts *ExecOpts) error { -- f, err := ioutil.TempFile(os.Getenv("XDG_RUNTIME_DIR"), "runc-process") -+ f, err := ioutil.TempFile(".", "runc-process") - if err != nil { - return err - } --- -2.19.0 - diff --git a/patch/0045-containerd-shim-disable-fast-gc-on-arm.patch b/patch/0045-containerd-shim-disable-fast-gc-on-arm.patch deleted file mode 100644 index ea8fc65..0000000 --- a/patch/0045-containerd-shim-disable-fast-gc-on-arm.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 4a8367ce3a9a8321ceeffbf2934380b139a74f90 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Fri, 18 Oct 2019 14:49:47 +0800 -Subject: [PATCH] containerd: stw gc sweep for arm64 - -Change-Id: I855c13a21c72bf0e91563db7c11e1348a1a78d55 -Signed-off-by: jingrui ---- - cmd/containerd-shim/main_unix.go | 5 ----- - runtime/v1/shim/client/client.go | 4 ++++ - 2 files changed, 4 insertions(+), 5 deletions(-) - -diff --git a/cmd/containerd-shim/main_unix.go b/cmd/containerd-shim/main_unix.go -index 89f6be91..22283626 100644 ---- a/cmd/containerd-shim/main_unix.go -+++ b/cmd/containerd-shim/main_unix.go -@@ -80,11 +80,6 @@ func init() { - - func main() { - debug.SetGCPercent(40) -- go func() { -- for range time.Tick(30 * time.Second) { -- debug.FreeOSMemory() -- } -- }() - - if debugFlag { - logrus.SetLevel(logrus.DebugLevel) -diff --git a/runtime/v1/shim/client/client.go b/runtime/v1/shim/client/client.go -index a819be6c..a4669d33 100644 ---- a/runtime/v1/shim/client/client.go -+++ b/runtime/v1/shim/client/client.go -@@ -24,6 +24,7 @@ import ( - "net" - "os" - "os/exec" -+ "runtime" - "strings" - "sync" - "syscall" -@@ -161,6 +162,9 @@ func newCommand(binary, daemonAddress string, debug bool, config shim.Config, so - cmd.SysProcAttr = getSysProcAttr() - cmd.ExtraFiles = append(cmd.ExtraFiles, socket) - cmd.Env = append(os.Environ(), "GOMAXPROCS=2") -+ if runtime.GOARCH == "arm64" { -+ cmd.Env = append(cmd.Env, "GODEBUG=gcstoptheworld=2") -+ } - cmd.Stdout = stdout - cmd.Stderr = stderr - return cmd, nil --- -2.17.1 - diff --git a/patch/0046-containerd-support-hot-upgrade.patch b/patch/0046-containerd-support-hot-upgrade.patch deleted file mode 100644 index 9aac729..0000000 --- a/patch/0046-containerd-support-hot-upgrade.patch +++ /dev/null @@ -1,630 +0,0 @@ -From 4656fbac6e4a23cf4e2fcb332777fb17895e67ca Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Wed, 14 Aug 2019 10:51:19 +0800 -Subject: [PATCH] containerd: hot-upgrade support from - containerd-0.2.8 - -This patch support hot-upgrade from containerd-0.2.8. When restore -tasks, it will find containers started by containerd-0.2.8, then start -fake task create, the fake create will run a new shim process, the shim -process will manage the container created by runc. - -After restore legacy created tasks, each task will has 2 shim -process. So it support down-grade to docker-1.11.2 with container still -running. - -Change-Id: I94cd48cbf8ceb408dbc8849fe6916e0ec3d889b0 -Signed-off-by: jingrui ---- - legacy/legacy.go | 145 ++++++++++++++++++++ - runtime/v1/linux/leruntime.go | 243 ++++++++++++++++++++++++++++++++++ - runtime/v1/linux/proc/init.go | 27 +++- - runtime/v1/linux/proc/io.go | 11 +- - runtime/v1/linux/runtime.go | 5 + - runtime/v1/shim/service.go | 10 +- - services/containers/local.go | 19 ++- - 7 files changed, 452 insertions(+), 8 deletions(-) - create mode 100644 legacy/legacy.go - create mode 100644 runtime/v1/linux/leruntime.go - -diff --git a/legacy/legacy.go b/legacy/legacy.go -new file mode 100644 -index 00000000..fde9f709 ---- /dev/null -+++ b/legacy/legacy.go -@@ -0,0 +1,145 @@ -+/* -+Copyright (c) Huawei Technologies Co., Ltd. 2019-2019. All rights reserved. -+Description: support containerd hot-upgrade from 0.2.8 -+Author: jingrui jingrui@huawei.com -+Create: 2019-09-20 -+*/ -+ -+package legacy -+ -+import ( -+ "encoding/json" -+ "fmt" -+ "io" -+ "io/ioutil" -+ "os" -+ "path/filepath" -+ "runtime" -+ "strings" -+ -+ "github.com/sirupsen/logrus" -+ "github.com/opencontainers/runtime-spec/specs-go" -+) -+ -+const ( -+ LegacyFile = "legacy" -+ Config120 = "/var/run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/" -+ Stdio120 = "/var/run/docker/containerd/" -+ Config028 = "/var/run/docker/libcontainerd/" -+ State028 = "/var/run/docker/libcontainerd/containerd/" -+ Runtime = "io.containerd.runtime.v1" -+) -+ -+// IsLegacy is used to check if im legacy. -+func IsLegacy(id string) bool { -+ lf := Config120 + id + "/" + LegacyFile -+ if _, err := os.Stat(lf); err == nil { -+ caller := "??" -+ if pc, file, line, ok := runtime.Caller(1); ok { -+ caller = fmt.Sprintf("%s:%d:%s()", file, line, runtime.FuncForPC(pc).Name()) -+ } -+ logrus.Infof("shim pretend to be 0.2.8 in %s", caller) -+ return true -+ } -+ return false -+} -+ -+// IsRunning is used to detect whether legacy container is running. -+func IsRunning(id string) bool { -+ path := State028 + id + "/init/pid" -+ bpid, err := ioutil.ReadFile(path) -+ if err != nil { -+ return false -+ } -+ -+ path = State028 + id + "/init/starttime" -+ btime, err := ioutil.ReadFile(path) -+ if err != nil { -+ return false -+ } -+ -+ path = fmt.Sprintf("/proc/%s/stat", string(bpid)) -+ bstat, err := ioutil.ReadFile(path) -+ if err != nil { -+ return false -+ } -+ -+ if !strings.Contains(string(bstat), string(btime)) { -+ return false -+ } -+ -+ return true -+} -+ -+// CopyFile used to copy a file. -+func CopyFile(dstName, srcName string) (written int64, err error) { -+ src, err := os.Open(srcName) -+ if err != nil { -+ return -+ } -+ defer src.Close() -+ -+ dst, err := os.OpenFile(dstName, os.O_WRONLY|os.O_CREATE, 0644) -+ if err != nil { -+ return -+ } -+ defer dst.Close() -+ -+ return io.Copy(dst, src) -+} -+ -+// InitBundle will copy files from 0.2.8 dirs to 1.2.0 dirs. -+func InitBundle(root string, id string) error { -+ err := os.MkdirAll(Config120+id, 0711) -+ if err != nil { -+ return err -+ } -+ err = os.MkdirAll(Stdio120+id, 0711) -+ if err != nil { -+ return err -+ } -+ err = os.MkdirAll(filepath.Join(root, "moby", id), 0711) -+ if err != nil { -+ return err -+ } -+ -+ err = ioutil.WriteFile(Config120+id+"/"+LegacyFile, []byte{}, 0644) -+ if err != nil { -+ return err -+ } -+ CopyFile(Config120+id+"/config.json", Config028+id+"/config.json") -+ CopyFile(Config120+id+"/init.pid", State028+id+"/init/pid") -+ return nil -+} -+ -+// DeleteBundle will delete unused legacy bundle files. -+func DeleteBundle(id string) error { -+ err1 := os.RemoveAll(Config120 + id) -+ err2 := os.RemoveAll(Stdio120 + id) -+ if err1 != nil { -+ return err1 -+ } -+ if err2 != nil { -+ return err2 -+ } -+ -+ return nil -+} -+ -+// LoadSpec load config.json into spec. -+func LoadSpec(id string) (*specs.Spec, error) { -+ f, err := os.OpenFile(Config120+id+"/config.json", os.O_RDONLY, 0400) -+ if err != nil { -+ return nil, err -+ } -+ defer f.Close() -+ -+ spec := specs.Spec{} -+ dec := json.NewDecoder(f) -+ err = dec.Decode(&spec) -+ if err != nil { -+ return nil, err -+ } -+ -+ return &spec, nil -+} -diff --git a/runtime/v1/linux/leruntime.go b/runtime/v1/linux/leruntime.go -new file mode 100644 -index 00000000..5b887935 ---- /dev/null -+++ b/runtime/v1/linux/leruntime.go -@@ -0,0 +1,243 @@ -+/* -+Copyright (c) Huawei Technologies Co., Ltd. 2019-2019. All rights reserved. -+Description: support containerd hot-upgrade from 0.2.8 -+Author: jingrui jingrui@huawei.com -+Create: 2019-09-20 -+*/ -+ -+package linux -+ -+import ( -+ "context" -+ "fmt" -+ "io/ioutil" -+ goruntime "runtime" -+ -+ "github.com/containerd/containerd/api/types" -+ "github.com/containerd/containerd/containers" -+ "github.com/containerd/containerd/errdefs" -+ "github.com/containerd/containerd/legacy" -+ "github.com/containerd/containerd/log" -+ "github.com/containerd/containerd/namespaces" -+ "github.com/containerd/containerd/runtime" -+ "github.com/containerd/containerd/runtime/linux/runctypes" -+ shim "github.com/containerd/containerd/runtime/v1/shim/v1" -+ scontainers "github.com/containerd/containerd/services/containers" -+ "github.com/containerd/typeurl" -+ "github.com/sirupsen/logrus" -+) -+ -+func taskIsExist(tasks []*Task, id string) bool { -+ for _, t := range tasks { -+ if t.id == id { -+ return true -+ } -+ } -+ return false -+} -+ -+func loadCreateOpts(id string) runtime.CreateOpts { -+ opts := runtime.CreateOpts{ -+ IO: runtime.IO{ -+ Stdin: fmt.Sprintf("/var/run/docker/libcontainerd/%s/init-stdin", id), -+ Stdout: fmt.Sprintf("/var/run/docker/libcontainerd/%s/init-stdout", id), -+ }, -+ } -+ -+ return opts -+} -+ -+func (r *Runtime) legacyCreateMeta(ctx context.Context, id string) { -+ spec, err := legacy.LoadSpec(id) -+ if err != nil { -+ logrus.Errorf("load spec for %s failed %v", id, err) -+ return -+ } -+ -+ s, err := typeurl.MarshalAny(spec) -+ if err != nil { -+ logrus.Errorf("marshal-any for %s failed %v", id, err) -+ return -+ } -+ -+ c := containers.Container{ -+ ID: id, -+ Runtime: containers.RuntimeInfo{ -+ Name: fmt.Sprintf("%s.%s", legacy.Runtime, goruntime.GOOS), -+ }, -+ Spec: s, -+ } -+ -+ err = scontainers.CreateMeta(ctx, c) -+ if err != nil { -+ logrus.Infof("create meta for %s failed %v", c.ID, err) -+ } -+} -+ -+func (r *Runtime) legacyCreate(ctx context.Context, id string, opts runtime.CreateOpts) (*Task, error) { -+ namespace, err := namespaces.NamespaceRequired(ctx) -+ if err != nil { -+ return nil, err -+ } -+ if namespace != "moby" { -+ return nil, fmt.Errorf("legacy not support ns=%s", namespace) -+ } -+ -+ ropts := &runctypes.RuncOptions{} -+ bundle := loadBundle(id, -+ legacy.Config120+id, -+ legacy.Config120+id) -+ -+ defer func() { -+ if err != nil { -+ errd := bundle.Delete() -+ log.G(ctx).WithError(err).Errorf("revert: delete bundle error=%v", errd) -+ } -+ }() -+ -+ shimopt := ShimLocal(r.config, r.events) -+ -+ var cgroup string -+ if opts.TaskOptions != nil { -+ v, err := typeurl.UnmarshalAny(opts.TaskOptions) -+ if err != nil { -+ return nil, err -+ } -+ cgroup = v.(*runctypes.CreateOptions).ShimCgroup -+ } -+ exitHandler := func() { -+ log.G(ctx).WithField("id", id).Info("shim reaped") -+ t, err := r.tasks.Get(ctx, id) -+ if err != nil { -+ // Task was never started or was already successfully deleted -+ return -+ } -+ lc := t.(*Task) -+ -+ log.G(ctx).WithFields(logrus.Fields{ -+ "id": id, -+ "namespace": namespace, -+ }).Warn("cleaning up after killed shim") -+ if err = r.cleanupAfterDeadShim(context.Background(), bundle, namespace, id, lc.pid); err != nil { -+ log.G(ctx).WithError(err).WithFields(logrus.Fields{ -+ "id": id, -+ "namespace": namespace, -+ }).Warn("failed to clean up after killed shim") -+ } -+ } -+ shimopt = ShimRemote(r.config, r.address, cgroup, exitHandler) -+ -+ s, err := bundle.NewShimClient(ctx, namespace, shimopt, ropts) -+ if err != nil { -+ return nil, err -+ } -+ -+ defer func() { -+ if err != nil { -+ kerr := s.KillShim(ctx) -+ log.G(ctx).WithError(err).Errorf("revert: kill shim error=%v", kerr) -+ } -+ }() -+ -+ rt := r.config.Runtime -+ if ropts != nil && ropts.Runtime != "" { -+ rt = ropts.Runtime -+ } -+ sopts := &shim.CreateTaskRequest{ -+ ID: id, -+ Bundle: bundle.path, -+ Runtime: rt, -+ Stdin: opts.IO.Stdin, -+ Stdout: opts.IO.Stdout, -+ Stderr: opts.IO.Stderr, -+ Terminal: opts.IO.Terminal, -+ Checkpoint: opts.Checkpoint, -+ Options: opts.TaskOptions, -+ } -+ for _, m := range opts.Rootfs { -+ sopts.Rootfs = append(sopts.Rootfs, &types.Mount{ -+ Type: m.Type, -+ Source: m.Source, -+ Options: m.Options, -+ }) -+ } -+ cr, err := s.Create(ctx, sopts) -+ if err != nil { -+ return nil, errdefs.FromGRPC(err) -+ } -+ t, err := newTask(id, namespace, int(cr.Pid), s, r.events, r.tasks, bundle) -+ if err != nil { -+ return nil, err -+ } -+ -+ // dont add task to tasklist, restoreTasks() will add it later. -+ -+ return t, nil -+} -+ -+func (r *Runtime) loadLegacyTask(id string) (*Task, error) { -+ logrus.Infof("load-letask id=%s", id) -+ err := legacy.InitBundle(r.root, id) -+ if err != nil { -+ logrus.Errorf("letask %s init bundle failed %s", id, err) -+ return nil, err -+ } -+ -+ defer func() { -+ if err != nil { -+ err1 := legacy.DeleteBundle(id) -+ logrus.Errorf("letask %s failed %v, drop bundle error=%s", id, err, err1) -+ } -+ }() -+ -+ ctx := namespaces.WithNamespace(context.Background(), "moby") -+ r.legacyCreateMeta(ctx, id) -+ task, err := r.legacyCreate(ctx, id, loadCreateOpts(id)) -+ if err != nil { -+ logrus.Errorf("letask %s create failed %v", id, err) -+ return nil, err -+ } -+ -+ return task, nil -+} -+ -+func (r *Runtime) loadLegacyTasks(tasks []*Task, ctx context.Context, ns string) ([]*Task, error) { -+ var o []*Task -+ -+ if ns != "moby" { -+ logrus.Infof("loadLegacyTasks ignore ns=%s", ns) -+ return o, nil -+ } -+ -+ dir, err := ioutil.ReadDir(legacy.State028) -+ if err != nil { -+ logrus.Infof("loadLegacyTasks skipped, no legacy residual") -+ return o, nil -+ } -+ -+ for _, path := range dir { -+ if !path.IsDir() { -+ continue -+ } -+ -+ id := path.Name() -+ if taskIsExist(tasks, id) { -+ logrus.Infof("letask %s already loaded", id) -+ continue -+ } -+ if !legacy.IsRunning(id) { -+ logrus.Infof("letask %s not running", id) -+ continue -+ } -+ -+ task, err := r.loadLegacyTask(id) -+ if err != nil { -+ logrus.Errorf("letask %s load failed %s", err) -+ continue -+ } -+ -+ o = append(o, task) -+ logrus.Infof("letask id=%s load ok", id) -+ } -+ return o, nil -+} -diff --git a/runtime/v1/linux/proc/init.go b/runtime/v1/linux/proc/init.go -index 44d3f58b..ace98621 100644 ---- a/runtime/v1/linux/proc/init.go -+++ b/runtime/v1/linux/proc/init.go -@@ -31,6 +31,7 @@ import ( - "time" - - "github.com/containerd/console" -+ "github.com/containerd/containerd/legacy" - "github.com/containerd/containerd/log" - "github.com/containerd/containerd/mount" - "github.com/containerd/containerd/runtime/proc" -@@ -39,6 +40,7 @@ import ( - google_protobuf "github.com/gogo/protobuf/types" - specs "github.com/opencontainers/runtime-spec/specs-go" - "github.com/pkg/errors" -+ "github.com/sirupsen/logrus" - ) - - // InitPidFile name of the file that contains the init pid -@@ -113,6 +115,19 @@ func New(id string, runtime *runc.Runc, stdio proc.Stdio) *Init { - waitBlock: make(chan struct{}), - } - p.initState = &createdState{p: p} -+ // legacy container is exist, set it running state directly. -+ if legacy.IsLegacy(id) { -+ p.initState = &runningState{p: p} -+ go func(id string) { -+ for { -+ time.Sleep(3 * time.Second) -+ if !legacy.IsRunning(id) { -+ logrus.Infof("legacy container %s exited", id) -+ os.Exit(0) -+ } -+ } -+ }(id) -+ } - return p - } - -@@ -122,6 +137,17 @@ func (p *Init) Create(ctx context.Context, r *CreateConfig) error { - err error - socket *runc.Socket - ) -+ pidFile := filepath.Join(p.Bundle, InitPidFile) -+ -+ if legacy.IsLegacy(r.ID) { -+ pid, err := runc.ReadPidFile(pidFile) -+ if err != nil { -+ return errors.Wrap(err, "failed to retrieve OCI runtime container pid") -+ } -+ p.pid = pid -+ return nil -+ } -+ - if r.Terminal { - if socket, err = runc.NewTempConsoleSocket(); err != nil { - return errors.Wrap(err, "failed to create OCI runtime console socket") -@@ -136,7 +162,6 @@ func (p *Init) Create(ctx context.Context, r *CreateConfig) error { - return errors.Wrap(err, "failed to create OCI runtime io pipes") - } - } -- pidFile := filepath.Join(p.Bundle, InitPidFile) - if r.Checkpoint != "" { - opts := &runc.RestoreOpts{ - CheckpointOpts: runc.CheckpointOpts{ -diff --git a/runtime/v1/linux/proc/io.go b/runtime/v1/linux/proc/io.go -index 71f6ee1b..36066270 100644 ---- a/runtime/v1/linux/proc/io.go -+++ b/runtime/v1/linux/proc/io.go -@@ -79,6 +79,9 @@ func copyPipes(ctx context.Context, rio runc.IO, stdin, stdout, stderr string, w - }, - }, - } { -+ if i.name == "" { -+ continue -+ } - ok, err := isFifo(i.name) - if err != nil { - return err -@@ -89,10 +92,10 @@ func copyPipes(ctx context.Context, rio runc.IO, stdin, stdout, stderr string, w - ) - if ok { - if fw, err = fifo.OpenFifo(ctx, i.name, syscall.O_WRONLY, 0); err != nil { -- return fmt.Errorf("containerd-shim: opening %s failed: %s", i.name, err) -+ return fmt.Errorf("containerd-shim syscall.O_WRONLY: opening %s failed: %s", i.name, err) - } - if fr, err = fifo.OpenFifo(ctx, i.name, syscall.O_RDONLY, 0); err != nil { -- return fmt.Errorf("containerd-shim: opening %s failed: %s", i.name, err) -+ return fmt.Errorf("containerd-shim syscall.O_RDONLY: opening %s failed: %s", i.name, err) - } - } else { - if sameFile != nil { -@@ -100,7 +103,7 @@ func copyPipes(ctx context.Context, rio runc.IO, stdin, stdout, stderr string, w - continue - } - if fw, err = os.OpenFile(i.name, syscall.O_WRONLY|syscall.O_APPEND, 0); err != nil { -- return fmt.Errorf("containerd-shim: opening %s failed: %s", i.name, err) -+ return fmt.Errorf("containerd-shim syscall.O_WRONLY|syscall.O_APPEND: opening %s failed: %s", i.name, err) - } - if stdout == stderr { - sameFile = fw -@@ -113,7 +116,7 @@ func copyPipes(ctx context.Context, rio runc.IO, stdin, stdout, stderr string, w - } - f, err := fifo.OpenFifo(ctx, stdin, syscall.O_RDONLY|syscall.O_NONBLOCK, 0) - if err != nil { -- return fmt.Errorf("containerd-shim: opening %s failed: %s", stdin, err) -+ return fmt.Errorf("containerd-shim syscall.O_RDONLY|syscall.O_NONBLOCK: opening %s failed: %s", stdin, err) - } - cwg.Add(1) - go func() { -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index f8e30742..1b763fbc 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -300,6 +300,11 @@ func (r *Runtime) restoreTasks(ctx context.Context) ([]*Task, error) { - } - o = append(o, tasks...) - } -+ lo, err := r.loadLegacyTasks(o, ctx, "moby") -+ if err != nil { -+ logrus.Errorf("load legacy with error %v", err) -+ } -+ o = append(o, lo...) - return o, nil - } - -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index ac545ea4..6411fdd9 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -34,6 +34,7 @@ import ( - "github.com/containerd/containerd/api/types/task" - "github.com/containerd/containerd/errdefs" - "github.com/containerd/containerd/events" -+ "github.com/containerd/containerd/legacy" - "github.com/containerd/containerd/log" - "github.com/containerd/containerd/mount" - "github.com/containerd/containerd/namespaces" -@@ -381,7 +382,9 @@ func (s *Service) Kill(ctx context.Context, r *shimapi.KillRequest) (*ptypes.Emp - if s.id != p.ID() || r.Signal != uint32(syscall.SIGKILL) { - return - } -- -+ if legacy.IsLegacy(s.id) { -+ return -+ } - for i := 1; i < 5; i++ { - time.Sleep(10 * time.Second) - err := p.Kill(ctx, r.Signal, r.All) -@@ -676,6 +679,11 @@ func newInit(ctx context.Context, path, workDir, runtimeRoot, namespace, criu st - - rootfs := filepath.Join(path, "rootfs") - runtime := proc.NewRunc(runtimeRoot, path, namespace, r.Runtime, criu, systemdCgroup) -+ // legacy container using /run/runc as runc root. -+ if legacy.IsLegacy(r.ID) { -+ runtime.Root = "/run/runc" -+ } -+ - p := proc.New(r.ID, runtime, rproc.Stdio{ - Stdin: r.Stdin, - Stdout: r.Stdout, -diff --git a/services/containers/local.go b/services/containers/local.go -index 95a09872..5934d5ad 100644 ---- a/services/containers/local.go -+++ b/services/containers/local.go -@@ -48,10 +48,11 @@ func init() { - if err != nil { - return nil, err - } -- return &local{ -+ helperLocal = local{ - db: m.(*metadata.DB), - publisher: ic.Events, -- }, nil -+ } -+ return &helperLocal, nil - }, - }) - } -@@ -243,3 +244,17 @@ func (s *localStream) SendMsg(m interface{}) error { - func (s *localStream) RecvMsg(m interface{}) error { - return nil - } -+ -+var helperLocal local // used for create meta only. -+// CreateMeta used only by legacy module to create meta. -+func CreateMeta(ctx context.Context, c containers.Container) error { -+ l := &helperLocal -+ err := l.withStoreUpdate(ctx, func(ctx context.Context, store containers.Store) error { -+ _, err := store.Create(ctx, c) -+ if err != nil { -+ return err -+ } -+ return nil -+ }) -+ return err -+} --- -2.17.1 - diff --git a/patch/0047-containerd-shim-exit-initiative-after-3s.patch b/patch/0047-containerd-shim-exit-initiative-after-3s.patch deleted file mode 100644 index f8e325c..0000000 --- a/patch/0047-containerd-shim-exit-initiative-after-3s.patch +++ /dev/null @@ -1,30 +0,0 @@ -From fe778eb160fc1e3a492b5304890af3843aa91f32 Mon Sep 17 00:00:00 2001 -From: liuzekun -Date: Tue, 5 Nov 2019 23:07:49 -0500 -Subject: [PATCH] containerd: containerd-shim exit initiative after 3s - -reason: containerd-shim exit initiative after 3s - -Signed-off-by: liuzekun ---- - runtime/v1/shim/service.go | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index 326096c..3abaa99 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -548,6 +548,10 @@ func (s *Service) checkProcesses(e runc.Exit) { - ns := filepath.Base(filepath.Dir(ip.Bundle)) - events.ExitAddFile(ns, events.ExitFile(s.id, uint32(e.Pid), uint32(e.Status)), "init exited") - events.InitExitWrite(ip.Bundle, e.Pid) -+ go func() { -+ time.Sleep(3 * time.Second) -+ os.Exit(0) -+ }() - } - if shouldKillAll { - if ip, ok := p.(*proc.Init); ok { --- -2.20.1 - diff --git a/patch/0048-containerd-modify-shim-initiative-exit-time.patch b/patch/0048-containerd-modify-shim-initiative-exit-time.patch deleted file mode 100644 index f76982c..0000000 --- a/patch/0048-containerd-modify-shim-initiative-exit-time.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 1735262dfdbc434c3e734c2a4b7e3c5407cd541f Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Sat, 16 Nov 2019 02:28:31 +0800 -Subject: [PATCH] containerd: modify shim initiative exit time - -reason: We set shim exit initiative after 3s of container init process -exiting, but poststop hook will run abnormally if it needs more than 3s. -So we modify the exit time to 120s to avoid this case, as poststop hook -is suggested not more than 120s. - -Change-Id: I3e78b6344fabb0687bc40c3b6da153f403a9f211 -Signed-off-by: xiadanni1 ---- - runtime/v1/shim/service.go | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index 3abaa99..9721660 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -549,7 +549,7 @@ func (s *Service) checkProcesses(e runc.Exit) { - events.ExitAddFile(ns, events.ExitFile(s.id, uint32(e.Pid), uint32(e.Status)), "init exited") - events.InitExitWrite(ip.Bundle, e.Pid) - go func() { -- time.Sleep(3 * time.Second) -+ time.Sleep(120 * time.Second) - os.Exit(0) - }() - } --- -1.8.3.1 - diff --git a/patch/0049-contaienrd-modify-shim-initiative-exit-time-for-post-hook.patch b/patch/0049-contaienrd-modify-shim-initiative-exit-time-for-post-hook.patch deleted file mode 100644 index 9876c45..0000000 --- a/patch/0049-contaienrd-modify-shim-initiative-exit-time-for-post-hook.patch +++ /dev/null @@ -1,84 +0,0 @@ -From d2e10b3f23adf3338ee451c926167d18e5ac02e1 Mon Sep 17 00:00:00 2001 -From: liuzekun -Date: Thu, 21 Nov 2019 08:23:35 -0500 -Subject: [PATCH] contaienrd: modify shim initiative exit time for post hook - -reason: Modify shim initiative exit time for post hook. In consideration -of each post hook has a execution time with timeout(default 120s), we -should ensure enough time to call all post hook. - -Signed-off-by: liuzekun ---- - runtime/v1/shim/service.go | 29 ++++++++++++++++++++++------- - 1 file changed, 22 insertions(+), 7 deletions(-) - -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index 9721660..cfba225 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -537,7 +537,7 @@ func (s *Service) checkProcesses(e runc.Exit) { - s.mu.Lock() - defer s.mu.Unlock() - -- shouldKillAll, err := shouldKillAllOnExit(s.bundle) -+ shouldKillAll, bundleSpec, err := shouldKillAllOnExit(s.bundle) - if err != nil { - log.G(s.context).WithError(err).Error("failed to check shouldKillAll") - } -@@ -549,8 +549,23 @@ func (s *Service) checkProcesses(e runc.Exit) { - events.ExitAddFile(ns, events.ExitFile(s.id, uint32(e.Pid), uint32(e.Status)), "init exited") - events.InitExitWrite(ip.Bundle, e.Pid) - go func() { -- time.Sleep(120 * time.Second) -- os.Exit(0) -+ t := 30 -+ defer func() { -+ time.Sleep(time.Duration(t) * time.Second) -+ os.Exit(0) -+ }() -+ if bundleSpec.Hooks == nil { -+ return -+ } -+ postStopHooks := bundleSpec.Hooks.Poststop -+ for _, postStopHook := range postStopHooks { -+ hookTimeout := postStopHook.Timeout -+ if hookTimeout == nil { -+ t += 120 -+ } else { -+ t += *hookTimeout -+ } -+ } - }() - } - if shouldKillAll { -@@ -575,23 +590,23 @@ func (s *Service) checkProcesses(e runc.Exit) { - } - } - --func shouldKillAllOnExit(bundlePath string) (bool, error) { -+func shouldKillAllOnExit(bundlePath string) (bool, specs.Spec, error) { - var bundleSpec specs.Spec - bundleConfigContents, err := ioutil.ReadFile(filepath.Join(bundlePath, "config.json")) - if err != nil { -- return false, err -+ return false, specs.Spec{}, err - } - json.Unmarshal(bundleConfigContents, &bundleSpec) - - if bundleSpec.Linux != nil { - for _, ns := range bundleSpec.Linux.Namespaces { - if ns.Type == specs.PIDNamespace && ns.Path == "" { -- return false, nil -+ return false, bundleSpec, nil - } - } - } - -- return true, nil -+ return true, bundleSpec, nil - } - - func (s *Service) getContainerPids(ctx context.Context, id string) ([]uint32, error) { --- -2.20.1 - diff --git a/patch/0050-containerd-warp-and-process-return-errors.patch b/patch/0050-containerd-warp-and-process-return-errors.patch deleted file mode 100644 index fc20562..0000000 --- a/patch/0050-containerd-warp-and-process-return-errors.patch +++ /dev/null @@ -1,170 +0,0 @@ -From 20cb595625dcfdf89fdf766028625a7864674dec Mon Sep 17 00:00:00 2001 -From: liuzekun -Date: Mon, 23 Dec 2019 03:10:49 -0500 -Subject: [PATCH] containerd: wrap and process return errors - -reason: wrap and process return errors - -Signed-off-by: liuzekun ---- - cmd/containerd-shim/main_unix.go | 2 +- - events/exit.go | 4 ++-- - legacy/legacy.go | 8 +++++--- - runtime/v1/linux/leruntime.go | 5 ++++- - runtime/v1/linux/runtime.go | 7 +++++-- - runtime/v1/shim/reaper.go | 4 ++-- - runtime/v1/shim/service.go | 1 + - vendor/github.com/sirupsen/logrus/exported.go | 5 +++++ - 8 files changed, 25 insertions(+), 11 deletions(-) - -diff --git a/cmd/containerd-shim/main_unix.go b/cmd/containerd-shim/main_unix.go -index 2228362..e9c1426 100644 ---- a/cmd/containerd-shim/main_unix.go -+++ b/cmd/containerd-shim/main_unix.go -@@ -259,7 +259,7 @@ func dumpStacks(logger *logrus.Entry) { - bufferLen *= 2 - } - buf = buf[:stackSize] -- ioutil.WriteFile(fmt.Sprintf(stacksLogNameTemplate, strings.Replace(time.Now().Format(time.RFC3339), ":", "", -1)), buf, 0600) -+ logrus.Devour(ioutil.WriteFile(fmt.Sprintf(stacksLogNameTemplate, strings.Replace(time.Now().Format(time.RFC3339), ":", "", -1)), buf, 0600)) - logger.Infof("=== BEGIN goroutine stack dump ===\n%s\n=== END goroutine stack dump ===", buf) - } - -diff --git a/events/exit.go b/events/exit.go -index 772dc24..c0a3583 100644 ---- a/events/exit.go -+++ b/events/exit.go -@@ -48,13 +48,14 @@ func ExitInfo(ef string) (string, uint32, uint32) { - } - - func ExitAddFile(ns string, ef string, reason string) { -- os.MkdirAll(filepath.Join(ExitDir, ns), 0700) -+ logrus.Devour(os.MkdirAll(filepath.Join(ExitDir, ns), 0700)) - err := ioutil.WriteFile(filepath.Join(ExitDir, ns, ef), []byte{}, 0600) - logrus.Infof("exit-add %s/%s [reason: %s] error=%v", ns, ef, reason, err) - } - - func ExitDelFile(ns string, ef string) { - err := os.RemoveAll(filepath.Join(ExitDir, ns, ef)) -+ logrus.Devour(err) - logrus.Infof("exit-del %s/%s error=%v", ns, ef, err) - } - -diff --git a/legacy/legacy.go b/legacy/legacy.go -index fde9f70..219508c 100644 ---- a/legacy/legacy.go -+++ b/legacy/legacy.go -@@ -17,8 +17,8 @@ import ( - "runtime" - "strings" - -- "github.com/sirupsen/logrus" - "github.com/opencontainers/runtime-spec/specs-go" -+ "github.com/sirupsen/logrus" - ) - - const ( -@@ -107,8 +107,10 @@ func InitBundle(root string, id string) error { - if err != nil { - return err - } -- CopyFile(Config120+id+"/config.json", Config028+id+"/config.json") -- CopyFile(Config120+id+"/init.pid", State028+id+"/init/pid") -+ _, err = CopyFile(Config120+id+"/config.json", Config028+id+"/config.json") -+ logrus.Devour(err) -+ _, err = CopyFile(Config120+id+"/init.pid", State028+id+"/init/pid") -+ logrus.Devour(err) - return nil - } - -diff --git a/runtime/v1/linux/leruntime.go b/runtime/v1/linux/leruntime.go -index 9c793a5..e8fbe61 100644 ---- a/runtime/v1/linux/leruntime.go -+++ b/runtime/v1/linux/leruntime.go -@@ -112,7 +112,10 @@ func (r *Runtime) legacyCreate(ctx context.Context, id string, opts runtime.Crea - // Task was never started or was already successfully deleted - return - } -- lc := t.(*Task) -+ lc, ok := t.(*Task) -+ if !ok { -+ log.G(ctx).WithField("id", id).Errorf("task t's type is %T, cannot convert to a *Task value", t) -+ } - - log.G(ctx).WithFields(logrus.Fields{ - "id": id, -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 1b763fb..c334bf4 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -43,7 +43,7 @@ import ( - "github.com/containerd/containerd/plugin" - "github.com/containerd/containerd/runtime" - "github.com/containerd/containerd/runtime/linux/runctypes" -- "github.com/containerd/containerd/runtime/v1" -+ v1 "github.com/containerd/containerd/runtime/v1" - "github.com/containerd/containerd/runtime/v1/linux/proc" - shim "github.com/containerd/containerd/runtime/v1/shim/v1" - runc "github.com/containerd/go-runc" -@@ -200,7 +200,10 @@ func (r *Runtime) Create(ctx context.Context, id string, opts runtime.CreateOpts - // Task was never started or was already successfully deleted - return - } -- lc := t.(*Task) -+ lc, ok := t.(*Task) -+ if !ok { -+ log.G(ctx).WithField("id", id).Errorf("task t's type is %T, cannot convert to a *Task value", t) -+ } - - log.G(ctx).WithFields(logrus.Fields{ - "id": id, -diff --git a/runtime/v1/shim/reaper.go b/runtime/v1/shim/reaper.go -index 2846152..c657397 100644 ---- a/runtime/v1/shim/reaper.go -+++ b/runtime/v1/shim/reaper.go -@@ -95,7 +95,7 @@ func (m *Monitor) Wait(c *exec.Cmd, ec chan runc.Exit) (int, error) { - for e := range ec { - if e.Pid == c.Process.Pid { - // make sure we flush all IO -- c.Wait() -+ logrus.Devour(c.Wait()) - m.Unsubscribe(ec) - return e.Status, nil - } -@@ -123,7 +123,7 @@ func (m *Monitor) WaitTimeout(c *exec.Cmd, ec chan runc.Exit, sec int64) (int, e - select { - case <-time.After(time.Duration(sec) * time.Second): - if SameProcess(c, c.Process.Pid) { -- syscall.Kill(c.Process.Pid, syscall.SIGKILL) -+ logrus.Devour(syscall.Kill(c.Process.Pid, syscall.SIGKILL)) - } - return 0, errors.Errorf("container did not start before the specified timeout %ds for cmd(pid=%d): %s, %s", sec, c.Process.Pid, c.Path, c.Args) - case status := <-sch: -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index 4025a72..beb0ed8 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -146,6 +146,7 @@ func (s *Service) Create(ctx context.Context, r *shimapi.CreateTaskRequest) (_ * - for i := 0; i < 60; i++ { - time.Sleep(time.Second) - _, err := os.Stat(r.Bundle) -+ logrus.Devour(err) - if os.IsNotExist(err) { - logrus.Errorf("bundle dir: %v does not exist, containerd-shim exit", r.Bundle) - os.Exit(0) -diff --git a/vendor/github.com/sirupsen/logrus/exported.go b/vendor/github.com/sirupsen/logrus/exported.go -index 1aeaa90..46fa7f8 100644 ---- a/vendor/github.com/sirupsen/logrus/exported.go -+++ b/vendor/github.com/sirupsen/logrus/exported.go -@@ -191,3 +191,8 @@ func Panicln(args ...interface{}) { - func Fatalln(args ...interface{}) { - std.Fatalln(args...) - } -+ -+// Devour will do nothing and return directly -+func Devour(args ...interface{}) { -+ return -+} --- -2.20.1 - diff --git a/patch/0051-containerd-add-timeout-for-containerd-shim.patch b/patch/0051-containerd-add-timeout-for-containerd-shim.patch deleted file mode 100644 index 62125c1..0000000 --- a/patch/0051-containerd-add-timeout-for-containerd-shim.patch +++ /dev/null @@ -1,134 +0,0 @@ -From ea6e8c7b10fe1552d14fb9b0337d850a1f4a7178 Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Fri, 3 Jan 2020 03:06:00 +0800 -Subject: [PATCH] containerd: add timeout for containerd-shim - -reason:add timeout for containerd-shim to avoid dead lock - -Change-Id: I7886eb9e73dc1a3c8b837687c8ac8361d67f5e4f -Signed-off-by: xiadanni1 ---- - runtime/v1/shim/reaper.go | 2 +- - vendor/github.com/containerd/go-runc/runc.go | 37 ++++++++++++++++++++++------ - 2 files changed, 30 insertions(+), 9 deletions(-) - -diff --git a/runtime/v1/shim/reaper.go b/runtime/v1/shim/reaper.go -index c657397..d8e8274 100644 ---- a/runtime/v1/shim/reaper.go -+++ b/runtime/v1/shim/reaper.go -@@ -125,7 +125,7 @@ func (m *Monitor) WaitTimeout(c *exec.Cmd, ec chan runc.Exit, sec int64) (int, e - if SameProcess(c, c.Process.Pid) { - logrus.Devour(syscall.Kill(c.Process.Pid, syscall.SIGKILL)) - } -- return 0, errors.Errorf("container did not start before the specified timeout %ds for cmd(pid=%d): %s, %s", sec, c.Process.Pid, c.Path, c.Args) -+ return 0, errors.Errorf("timeout %ds for cmd(pid=%d): %s, %s", sec, c.Process.Pid, c.Path, c.Args) - case status := <-sch: - return status, nil - case err := <-ech: -diff --git a/vendor/github.com/containerd/go-runc/runc.go b/vendor/github.com/containerd/go-runc/runc.go -index 7a2a8c4..430648d 100644 ---- a/vendor/github.com/containerd/go-runc/runc.go -+++ b/vendor/github.com/containerd/go-runc/runc.go -@@ -53,7 +53,9 @@ const ( - Text Format = "text" - // DefaultCommand is the default command for Runc - DefaultCommand = "runc" -- execTimeout = 30 -+ defaultTimeout = 30 -+ startTimeout = 120 -+ updateTimeout = 60 - ) - - var ( -@@ -99,7 +101,7 @@ func (r *Runc) List(context context.Context) ([]*Container, error) { - - // State returns the state for the container provided by id - func (r *Runc) State(context context.Context, id string) (*Container, error) { -- data, err := cmdOutput(r.command(context, "state", id), true) -+ data, err := cmdOutputTimeout(r.command(context, "state", id), true, defaultTimeout) - if err != nil { - return nil, fmt.Errorf("%s: %s", err, data) - } -@@ -199,7 +201,7 @@ func (r *Runc) Create(context context.Context, id, bundle string, opts *CreateOp - - // Start will start an already created container - func (r *Runc) Start(context context.Context, id string) error { -- return r.runOrError(r.command(context, "start", id)) -+ return r.runOrErrorTimeout(r.command(context, "start", id), startTimeout) - } - - type ExecOpts struct { -@@ -252,7 +254,7 @@ func (r *Runc) Exec(context context.Context, id string, spec specs.Process, opts - opts.Set(cmd) - } - if cmd.Stdout == nil && cmd.Stderr == nil { -- data, err := cmdOutputTimeout(cmd, true, execTimeout) -+ data, err := cmdOutputTimeout(cmd, true, defaultTimeout) - if err != nil { - return fmt.Errorf("%s: %s", err, data) - } -@@ -269,7 +271,7 @@ func (r *Runc) Exec(context context.Context, id string, spec specs.Process, opts - } - } - } -- status, err := Monitor.WaitTimeout(cmd, ec, execTimeout) -+ status, err := Monitor.WaitTimeout(cmd, ec, defaultTimeout) - if err == nil && status != 0 { - err = fmt.Errorf("%s did not terminate sucessfully", cmd.Args[0]) - } -@@ -338,7 +340,7 @@ func (r *Runc) Kill(context context.Context, id string, sig int, opts *KillOpts) - if opts != nil { - args = append(args, opts.args()...) - } -- return r.runOrError(r.command(context, append(args, id, strconv.Itoa(sig))...)) -+ return r.runOrErrorTimeout(r.command(context, append(args, id, strconv.Itoa(sig))...), defaultTimeout) - } - - // Stats return the stats for a container like cpu, memory, and io -@@ -414,7 +416,7 @@ func (r *Runc) Resume(context context.Context, id string) error { - - // Ps lists all the processes inside the container returning their pids - func (r *Runc) Ps(context context.Context, id string) ([]int, error) { -- data, err := cmdOutput(r.command(context, "ps", "--format", "json", id), true) -+ data, err := cmdOutputTimeout(r.command(context, "ps", "--format", "json", id), true, defaultTimeout) - if err != nil { - return nil, fmt.Errorf("%s: %s", err, data) - } -@@ -604,7 +606,7 @@ func (r *Runc) Update(context context.Context, id string, resources *specs.Linux - args := []string{"update", "--resources", "-", id} - cmd := r.command(context, args...) - cmd.Stdin = buf -- return r.runOrError(cmd) -+ return r.runOrErrorTimeout(cmd, updateTimeout) - } - - var ErrParseRuncVersion = errors.New("unable to parse runc version") -@@ -705,6 +707,25 @@ func (r *Runc) runOrError(cmd *exec.Cmd) error { - return nil - } - -+func (r *Runc) runOrErrorTimeout(cmd *exec.Cmd, runTimeout int64) error { -+ if cmd.Stdout != nil || cmd.Stderr != nil { -+ ec, err := Monitor.Start(cmd) -+ if err != nil { -+ return err -+ } -+ status, err := Monitor.WaitTimeout(cmd, ec, runTimeout) -+ if err == nil && status != 0 { -+ err = fmt.Errorf("%s did not terminate sucessfully", cmd.Args[0]) -+ } -+ return err -+ } -+ data, err := cmdOutputTimeout(cmd, true, runTimeout) -+ if err != nil { -+ return fmt.Errorf("%s: %s", err, data) -+ } -+ return nil -+} -+ - func cmdOutput(cmd *exec.Cmd, combined bool) ([]byte, error) { - b := getBuf() - defer putBuf(b) --- -1.8.3.1 - diff --git a/patch/0052-containerd-modify-runtime-root-if-containe.patch b/patch/0052-containerd-modify-runtime-root-if-containe.patch deleted file mode 100644 index 92d5a63..0000000 --- a/patch/0052-containerd-modify-runtime-root-if-containe.patch +++ /dev/null @@ -1,266 +0,0 @@ -From 3ccf18b7d72ef484093e8a6f578ef9381418bc54 Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Fri, 17 Jan 2020 07:07:34 +0800 -Subject: [PATCH] containerd: modify runtime root if container is created by - 1.11.2 - -reason:if container is created by 1.11.2, runtime root is /run/runc, -so we need to modify the root dir when this container stops first time. - -Change-Id: If30e26a719ed61be0a08344860a066ab77b4cb40 -Signed-off-by: xiadanni1 ---- - runtime/v1/linux/runtime.go | 14 ++++--- - .../github.com/containerd/go-runc/command_linux.go | 4 +- - .../github.com/containerd/go-runc/command_other.go | 2 +- - vendor/github.com/containerd/go-runc/runc.go | 45 ++++++++++++---------- - 4 files changed, 37 insertions(+), 28 deletions(-) - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index c334bf4..08e563d 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -35,6 +35,7 @@ import ( - "github.com/containerd/containerd/events" - "github.com/containerd/containerd/events/exchange" - "github.com/containerd/containerd/identifiers" -+ "github.com/containerd/containerd/legacy" - "github.com/containerd/containerd/log" - "github.com/containerd/containerd/metadata" - "github.com/containerd/containerd/mount" -@@ -521,11 +522,14 @@ func (r *Runtime) terminate(ctx context.Context, bundle *bundle, ns, id string) - }); err != nil { - log.G(ctx).WithError(err).Warnf("delete runtime state %s", id) - } -- if err := mount.Unmount(filepath.Join(bundle.path, "rootfs"), 0); err != nil { -- log.G(ctx).WithError(err).WithFields(logrus.Fields{ -- "path": bundle.path, -- "id": id, -- }).Warnf("unmount task rootfs") -+ -+ if !legacy.IsLegacy(id) { -+ if err := mount.Unmount(filepath.Join(bundle.path, "rootfs"), 0); err != nil { -+ log.G(ctx).WithError(err).WithFields(logrus.Fields{ -+ "path": bundle.path, -+ "id": id, -+ }).Warnf("unmount task rootfs") -+ } - } - return nil - } -diff --git a/vendor/github.com/containerd/go-runc/command_linux.go b/vendor/github.com/containerd/go-runc/command_linux.go -index 6ad27be..0aa6040 100644 ---- a/vendor/github.com/containerd/go-runc/command_linux.go -+++ b/vendor/github.com/containerd/go-runc/command_linux.go -@@ -31,12 +31,12 @@ func (r *Runc) isrunv() bool { - return false - } - --func (r *Runc) command(context context.Context, args ...string) *exec.Cmd { -+func (r *Runc) command(id string, context context.Context, args ...string) *exec.Cmd { - command := r.Command - if command == "" { - command = DefaultCommand - } -- cmd := exec.CommandContext(context, command, append(r.args(), args...)...) -+ cmd := exec.CommandContext(context, command, append(r.args(id), args...)...) - cmd.SysProcAttr = &syscall.SysProcAttr{ - Setpgid: r.Setpgid, - } -diff --git a/vendor/github.com/containerd/go-runc/command_other.go b/vendor/github.com/containerd/go-runc/command_other.go -index b8fd4b8..21bb699 100644 ---- a/vendor/github.com/containerd/go-runc/command_other.go -+++ b/vendor/github.com/containerd/go-runc/command_other.go -@@ -29,7 +29,7 @@ func (r *Runc) command(context context.Context, args ...string) *exec.Cmd { - if command == "" { - command = DefaultCommand - } -- cmd := exec.CommandContext(context, command, append(r.args(), args...)...) -+ cmd := exec.CommandContext(context, command, append(r.args(""), args...)...) - cmd.Env = os.Environ() - return cmd - } -diff --git a/vendor/github.com/containerd/go-runc/runc.go b/vendor/github.com/containerd/go-runc/runc.go -index 430648d..c1748ff 100644 ---- a/vendor/github.com/containerd/go-runc/runc.go -+++ b/vendor/github.com/containerd/go-runc/runc.go -@@ -31,6 +31,7 @@ import ( - "syscall" - "time" - -+ "github.com/containerd/containerd/legacy" - specs "github.com/opencontainers/runtime-spec/specs-go" - "github.com/sirupsen/logrus" - ) -@@ -88,7 +89,7 @@ func init() { - - // List returns all containers created inside the provided runc root directory - func (r *Runc) List(context context.Context) ([]*Container, error) { -- data, err := cmdOutput(r.command(context, "list", "--format=json"), false) -+ data, err := cmdOutput(r.command("", context, "list", "--format=json"), false) - if err != nil { - return nil, err - } -@@ -101,7 +102,7 @@ func (r *Runc) List(context context.Context) ([]*Container, error) { - - // State returns the state for the container provided by id - func (r *Runc) State(context context.Context, id string) (*Container, error) { -- data, err := cmdOutputTimeout(r.command(context, "state", id), true, defaultTimeout) -+ data, err := cmdOutputTimeout(r.command(id, context, "state", id), true, defaultTimeout) - if err != nil { - return nil, fmt.Errorf("%s: %s", err, data) - } -@@ -168,7 +169,7 @@ func (r *Runc) Create(context context.Context, id, bundle string, opts *CreateOp - } - args = append(args, oargs...) - } -- cmd := r.command(context, append(args, id)...) -+ cmd := r.command(id, context, append(args, id)...) - if opts != nil && opts.IO != nil { - opts.Set(cmd) - } -@@ -201,7 +202,7 @@ func (r *Runc) Create(context context.Context, id, bundle string, opts *CreateOp - - // Start will start an already created container - func (r *Runc) Start(context context.Context, id string) error { -- return r.runOrErrorTimeout(r.command(context, "start", id), startTimeout) -+ return r.runOrErrorTimeout(r.command(id, context, "start", id), startTimeout) - } - - type ExecOpts struct { -@@ -249,7 +250,7 @@ func (r *Runc) Exec(context context.Context, id string, spec specs.Process, opts - } - args = append(args, oargs...) - } -- cmd := r.command(context, append(args, id)...) -+ cmd := r.command(id, context, append(args, id)...) - if opts != nil && opts.IO != nil { - opts.Set(cmd) - } -@@ -289,7 +290,7 @@ func (r *Runc) Run(context context.Context, id, bundle string, opts *CreateOpts) - } - args = append(args, oargs...) - } -- cmd := r.command(context, append(args, id)...) -+ cmd := r.command(id, context, append(args, id)...) - if opts != nil && opts.IO != nil { - opts.Set(cmd) - } -@@ -317,7 +318,7 @@ func (r *Runc) Delete(context context.Context, id string, opts *DeleteOpts) erro - if opts != nil { - args = append(args, opts.args()...) - } -- return r.runOrError(r.command(context, append(args, id)...)) -+ return r.runOrError(r.command(id, context, append(args, id)...)) - } - - // KillOpts specifies options for killing a container and its processes -@@ -340,12 +341,12 @@ func (r *Runc) Kill(context context.Context, id string, sig int, opts *KillOpts) - if opts != nil { - args = append(args, opts.args()...) - } -- return r.runOrErrorTimeout(r.command(context, append(args, id, strconv.Itoa(sig))...), defaultTimeout) -+ return r.runOrErrorTimeout(r.command(id, context, append(args, id, strconv.Itoa(sig))...), defaultTimeout) - } - - // Stats return the stats for a container like cpu, memory, and io - func (r *Runc) Stats(context context.Context, id string) (*Stats, error) { -- cmd := r.command(context, "events", "--stats", id) -+ cmd := r.command(id, context, "events", "--stats", id) - rd, err := cmd.StdoutPipe() - if err != nil { - return nil, err -@@ -367,7 +368,7 @@ func (r *Runc) Stats(context context.Context, id string) (*Stats, error) { - - // Events returns an event stream from runc for a container with stats and OOM notifications - func (r *Runc) Events(context context.Context, id string, interval time.Duration) (chan *Event, error) { -- cmd := r.command(context, "events", fmt.Sprintf("--interval=%ds", int(interval.Seconds())), id) -+ cmd := r.command(id, context, "events", fmt.Sprintf("--interval=%ds", int(interval.Seconds())), id) - rd, err := cmd.StdoutPipe() - if err != nil { - return nil, err -@@ -406,17 +407,17 @@ func (r *Runc) Events(context context.Context, id string, interval time.Duration - - // Pause the container with the provided id - func (r *Runc) Pause(context context.Context, id string) error { -- return r.runOrError(r.command(context, "pause", id)) -+ return r.runOrError(r.command(id, context, "pause", id)) - } - - // Resume the container with the provided id - func (r *Runc) Resume(context context.Context, id string) error { -- return r.runOrError(r.command(context, "resume", id)) -+ return r.runOrError(r.command(id, context, "resume", id)) - } - - // Ps lists all the processes inside the container returning their pids - func (r *Runc) Ps(context context.Context, id string) ([]int, error) { -- data, err := cmdOutputTimeout(r.command(context, "ps", "--format", "json", id), true, defaultTimeout) -+ data, err := cmdOutputTimeout(r.command(id, context, "ps", "--format", "json", id), true, defaultTimeout) - if err != nil { - return nil, fmt.Errorf("%s: %s", err, data) - } -@@ -429,7 +430,7 @@ func (r *Runc) Ps(context context.Context, id string) ([]int, error) { - - // Top lists all the processes inside the container returning the full ps data - func (r *Runc) Top(context context.Context, id string, psOptions string) (*TopResults, error) { -- data, err := cmdOutput(r.command(context, "ps", "--format", "table", id, psOptions), true) -+ data, err := cmdOutput(r.command(id, context, "ps", "--format", "table", id, psOptions), true) - if err != nil { - return nil, fmt.Errorf("%s: %s", err, data) - } -@@ -528,7 +529,7 @@ func (r *Runc) Checkpoint(context context.Context, id string, opts *CheckpointOp - for _, a := range actions { - args = a(args) - } -- return r.runOrError(r.command(context, append(args, id)...)) -+ return r.runOrError(r.command(id, context, append(args, id)...)) - } - - type RestoreOpts struct { -@@ -577,7 +578,7 @@ func (r *Runc) Restore(context context.Context, id, bundle string, opts *Restore - args = append(args, oargs...) - } - args = append(args, "--bundle", bundle) -- cmd := r.command(context, append(args, id)...) -+ cmd := r.command(id, context, append(args, id)...) - if opts != nil && opts.IO != nil { - opts.Set(cmd) - } -@@ -604,7 +605,7 @@ func (r *Runc) Update(context context.Context, id string, resources *specs.Linux - return err - } - args := []string{"update", "--resources", "-", id} -- cmd := r.command(context, args...) -+ cmd := r.command(id, context, args...) - cmd.Stdin = buf - return r.runOrErrorTimeout(cmd, updateTimeout) - } -@@ -619,7 +620,7 @@ type Version struct { - - // Version returns the runc and runtime-spec versions - func (r *Runc) Version(context context.Context) (Version, error) { -- data, err := cmdOutput(r.command(context, "--version"), false) -+ data, err := cmdOutput(r.command("", context, "--version"), false) - if err != nil { - return Version{}, err - } -@@ -658,9 +659,13 @@ func parseVersion(data []byte) (Version, error) { - return v, nil - } - --func (r *Runc) args() (out []string) { -+func (r *Runc) args(id string) (out []string) { - if r.Root != "" { -- out = append(out, "--root", r.Root) -+ if id != "" && legacy.IsLegacy(id) { -+ out = append(out, "--root", "/run/runc") -+ } else { -+ out = append(out, "--root", r.Root) -+ } - } - if r.Debug { - out = append(out, "--debug") --- -1.8.3.1 - diff --git a/patch/0053-containerd-add-pid-check-to-avoid-poststop-ho.patch b/patch/0053-containerd-add-pid-check-to-avoid-poststop-ho.patch deleted file mode 100644 index fddaf56..0000000 --- a/patch/0053-containerd-add-pid-check-to-avoid-poststop-ho.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 489f69209650aa743ffd6e53571b822ad0b63c2d Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Sat, 18 Jan 2020 04:18:22 +0800 -Subject: [PATCH] containerd: add pid check to avoid poststop hook - execute twice - -reason:If start a container at docker 1.11.2, upgrade docker to 18.09, -downgrade to 1.11.2, stop/restart container, upgrade to 18.09 again, -poststop hook will execute again when containerd load task. -So we add pid check to avoid poststop hook execute twice. - -Change-Id: I8b88b69bfa0a4141bd9595da8ad4e786666e114b -Signed-off-by: xiadanni1 ---- - legacy/legacy.go | 21 +++++++++++++++++++++ - runtime/v1/linux/runtime.go | 10 ++++++---- - 2 files changed, 27 insertions(+), 4 deletions(-) - -diff --git a/legacy/legacy.go b/legacy/legacy.go -index 219508c..644f94a 100644 ---- a/legacy/legacy.go -+++ b/legacy/legacy.go -@@ -44,6 +44,25 @@ func IsLegacy(id string) bool { - return false - } - -+func IsSamePid(id string) bool { -+ pid120, err := ioutil.ReadFile(filepath.Join(Config120, id, "init.pid")) -+ if err != nil { -+ logrus.Infof("read 1.2.0 init.pid file error: %v", err) -+ return false -+ } -+ pid028, err := ioutil.ReadFile(filepath.Join(State028, id, "init", "pid")) -+ if err != nil { -+ logrus.Infof("read 0.2.8 pid file error: %v", err) -+ return false -+ } -+ logrus.Infof("pid1.2.0: %v, pid0.2.8: %v", string(pid120), string(pid028)) -+ if string(pid120) != string(pid028) { -+ return false -+ } -+ -+ return true -+} -+ - // IsRunning is used to detect whether legacy container is running. - func IsRunning(id string) bool { - path := State028 + id + "/init/pid" -@@ -111,6 +130,8 @@ func InitBundle(root string, id string) error { - logrus.Devour(err) - _, err = CopyFile(Config120+id+"/init.pid", State028+id+"/init/pid") - logrus.Devour(err) -+ _, err = CopyFile(Config120+id+"/starttime", State028+id+"/init/starttime") -+ logrus.Devour(err) - return nil - } - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 08e563d..96ad815 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -517,10 +517,12 @@ func (r *Runtime) terminate(ctx context.Context, bundle *bundle, ns, id string) - return err - } - -- if err := rt.Delete(ctx, id, &runc.DeleteOpts{ -- Force: true, -- }); err != nil { -- log.G(ctx).WithError(err).Warnf("delete runtime state %s", id) -+ if !legacy.IsLegacy(id) || legacy.IsSamePid(id) { -+ if err := rt.Delete(ctx, id, &runc.DeleteOpts{ -+ Force: true, -+ }); err != nil { -+ log.G(ctx).WithError(err).Warnf("delete runtime state %s", id) -+ } - } - - if !legacy.IsLegacy(id) { --- -1.8.3.1 - diff --git a/patch/0054-containerd-clean-up-residual-container.patch b/patch/0054-containerd-clean-up-residual-container.patch deleted file mode 100644 index 645b90f..0000000 --- a/patch/0054-containerd-clean-up-residual-container.patch +++ /dev/null @@ -1,100 +0,0 @@ -From a2310cbcff07f660b8d17584f687561b64bf27ad Mon Sep 17 00:00:00 2001 -From: zhangtianyang -Date: Thu, 27 Feb 2020 16:51:59 +0800 -Subject: [PATCH] containerd: clean up residual container after - shim abnormal exit - -reason:from update/revert test an occasional failure has been found that -shim process has exited but container is still running, then following exec -call all report ttrpc close error. -the triggering condition is uncertain. this patch will make up the clean -work of the residual container after such failure occurred to avoid -subsequent call errors. - -Change-Id: I0da9d4e46010cbe58f2fda21895caeb301936c47 -Signed-off-by: zhangtianyang ---- - runtime/v1/linux/runtime.go | 11 +++++++++++ - services/tasks/local.go | 25 +++++++++++++++++++++++++ - 2 files changed, 36 insertions(+) - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 96ad815..47a0cb6 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -511,6 +511,17 @@ func (r *Runtime) cleanupAfterDeadShim(ctx context.Context, bundle *bundle, ns, - return nil - } - -+func (r *Runtime) CleanupAfterDeadShim(ctx context.Context, ns, id string) error { -+ bund := &bundle{id: id, -+ path: filepath.Join(r.state, ns, id), -+ workDir: filepath.Join(r.root, ns, id)} -+ pid, err := runc.ReadPidFile(filepath.Join(bund.path, proc.InitPidFile)) -+ if err != nil { -+ return fmt.Errorf("failed to read pid from %s", proc.InitPidFile) -+ } -+ return r.cleanupAfterDeadShim(ctx, bund, ns, id, pid) -+} -+ - func (r *Runtime) terminate(ctx context.Context, bundle *bundle, ns, id string) error { - rt, err := r.getRuntime(ctx, ns, id) - if err != nil { -diff --git a/services/tasks/local.go b/services/tasks/local.go -index 990e841..9818971 100644 ---- a/services/tasks/local.go -+++ b/services/tasks/local.go -@@ -24,6 +24,7 @@ import ( - "io/ioutil" - "os" - "path/filepath" -+ "strings" - "time" - - api "github.com/containerd/containerd/api/services/tasks/v1" -@@ -41,6 +42,7 @@ import ( - "github.com/containerd/containerd/mount" - "github.com/containerd/containerd/plugin" - "github.com/containerd/containerd/runtime" -+ "github.com/containerd/containerd/runtime/v1/linux" - "github.com/containerd/containerd/runtime/v2" - "github.com/containerd/containerd/services" - "github.com/containerd/typeurl" -@@ -383,11 +385,34 @@ func (l *local) Kill(ctx context.Context, r *api.KillRequest, _ ...grpc.CallOpti - } - } - if err := p.Kill(ctx, r.Signal, r.All); err != nil { -+ if (r.Signal == 9 || r.Signal == 15) && strings.Contains(err.Error(), "ttrpc: client shutting down") { -+ // not sure under what conditions will cause such ttrpc error. since the error has -+ // happened, we have to make up the clean up work to avoid container residue. -+ cleanErr := l.cleanupResidualContainer(ctx, r, t.Namespace()) -+ log.G(ctx).WithField("clean error", cleanErr).Warnf( -+ "previous actions might encounter failure, try clean up the dead container.") -+ } - return nil, errdefs.ToGRPC(err) - } - return empty, nil - } - -+func (l *local) cleanupResidualContainer(ctx context.Context, r *api.KillRequest, namespace string) error { -+ container, err := l.getContainer(ctx, r.ContainerID) -+ if err != nil { -+ return fmt.Errorf("failed to get container %s, %v", r.ContainerID, err) -+ } -+ rt, err := l.getRuntime(container.Runtime.Name) -+ if err != nil { -+ return fmt.Errorf("failed to get runtime %s, %v", container.Runtime.Name, err) -+ } -+ lRuntime, ok := rt.(*linux.Runtime) -+ if !ok { -+ return fmt.Errorf("no clean work for runtime other than linux ones") -+ } -+ return lRuntime.CleanupAfterDeadShim(ctx, namespace, r.ContainerID) -+} -+ - func (l *local) ListPids(ctx context.Context, r *api.ListPidsRequest, _ ...grpc.CallOption) (*api.ListPidsResponse, error) { - t, err := l.getTask(ctx, r.ContainerID) - if err != nil { --- -1.8.3.1 - diff --git a/patch/0055-containerd-add-LLT-for-containerd-shim-timeou.patch b/patch/0055-containerd-add-LLT-for-containerd-shim-timeou.patch deleted file mode 100644 index 0daafda..0000000 --- a/patch/0055-containerd-add-LLT-for-containerd-shim-timeou.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 47e981ebb8996e432968ed68f08e3fc108210cd4 Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Tue, 3 Mar 2020 06:29:56 +0800 -Subject: [PATCH 1/2] containerd:add LLT for containerd-shim timeout - requirement - -reason:add LLT testcases for containerd-shim timeout requirement. - -Change-Id: If422542b72f3550d86a6eba6b19d0cdea2d2a660 -Signed-off-by: xiadanni1 - ---- - vendor/github.com/containerd/go-runc/runc_test.go | 90 +++++++++++++++++++++++ - 1 file changed, 90 insertions(+) - create mode 100644 vendor/github.com/containerd/go-runc/runc_test.go - -diff --git a/vendor/github.com/containerd/go-runc/runc_test.go b/vendor/github.com/containerd/go-runc/runc_test.go -new file mode 100644 -index 0000000..8f9212d ---- /dev/null -+++ b/vendor/github.com/containerd/go-runc/runc_test.go -@@ -0,0 +1,90 @@ -+package runc -+ -+import ( -+ "context" -+ "os" -+ "os/exec" -+ "testing" -+ -+ specs "github.com/opencontainers/runtime-spec/specs-go" -+) -+ -+func TestRuncCommandInvoke(t *testing.T) { -+ rc := &Runc{ -+ Command: "/bin/true", -+ } -+ ctx := context.Background() -+ id := "containerid" -+ bundle := "bundlepath" -+ -+ createOpts := CreateOpts{} -+ err := rc.Create(ctx, id, bundle, &createOpts) -+ if err != nil { -+ t.Errorf("Create command invoke error, %v", err) -+ } -+ -+ err = rc.Start(ctx, id) -+ if err != nil { -+ t.Errorf("Start command invoke error, %v", err) -+ } -+ -+ execSpec := specs.Process{} -+ nullIO, _ := NewNullIO() -+ execOpts := ExecOpts{IO: nullIO} -+ err = rc.Exec(ctx, id, execSpec, &execOpts) -+ if err != nil { -+ t.Errorf("Exec command invoke error, %v", err) -+ } -+ -+ execOptsnil := ExecOpts{} -+ err = rc.Exec(ctx, id, execSpec, &execOptsnil) -+ if err != nil { -+ t.Errorf("Exec command invoke error, %v", err) -+ } -+ -+ killOpts := KillOpts{} -+ err = rc.Kill(ctx, id, 9, &killOpts) -+ if err != nil { -+ t.Errorf("Kill command invoke error, %v", err) -+ } -+ -+ resource := specs.LinuxResources{} -+ err = rc.Update(ctx, id, &resource) -+ if err != nil { -+ t.Errorf("Update command invoke error, %v", err) -+ } -+ -+ _, err = rc.State(ctx, id) -+ if err == nil { -+ t.Errorf("State command invoke should return error") -+ } -+ -+ _, err = rc.Ps(ctx, id) -+ if err == nil { -+ t.Errorf("Ps command invoke should return error") -+ } -+} -+ -+func TestRunOrErrorTimeout(t *testing.T) { -+ rc := &Runc{} -+ -+ cmd := exec.Cmd{Path: "/bin/bash2"} -+ cmd.Stdout = os.Stdout -+ err := rc.runOrErrorTimeout(&cmd, 10) -+ if err == nil { -+ t.Errorf("runOrErrorTimeout should return error") -+ } -+ -+ cmd = exec.Cmd{Path: "/usr/bin/sleep", Args: []string{"2"}} -+ cmd.Stdout = os.Stdout -+ rc.runOrErrorTimeout(&cmd, 1) -+ if err == nil { -+ t.Errorf("runOrErrorTimeout should return error") -+ } -+ -+ cmd = exec.Cmd{Path: "/usr/bin/sleep", Args: []string{"2"}} -+ rc.runOrErrorTimeout(&cmd, 1) -+ if err == nil { -+ t.Errorf("runOrErrorTimeout should return error") -+ } -+} --- -1.8.3.1 - diff --git a/patch/0056-containerd-save-dumpstack-to-file.patch b/patch/0056-containerd-save-dumpstack-to-file.patch deleted file mode 100644 index 2a67217..0000000 --- a/patch/0056-containerd-save-dumpstack-to-file.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 7db93cf813023f2a5ac209617aaae5c3f5c202d5 Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Tue, 3 Mar 2020 09:01:22 +0800 -Subject: [PATCH] containerd:save dumpstack to file - -Change-Id: I54a41a13b4523de279337a9ff208347859c0fb4d -Signed-off-by: xiadanni1 ---- - cmd/containerd/command/main_unix.go | 5 +++++ - runtime/v1/linux/runtime.go | 1 + - 2 files changed, 6 insertions(+) - -diff --git a/cmd/containerd/command/main_unix.go b/cmd/containerd/command/main_unix.go -index 12c1426..2f9398f 100644 ---- a/cmd/containerd/command/main_unix.go -+++ b/cmd/containerd/command/main_unix.go -@@ -20,8 +20,12 @@ package command - - import ( - "context" -+ "fmt" -+ "io/ioutil" - "os" - "runtime" -+ "strings" -+ "time" - - "github.com/containerd/containerd/log" - "github.com/containerd/containerd/services/server" -@@ -79,5 +83,6 @@ func dumpStacks() { - bufferLen *= 2 - } - buf = buf[:stackSize] -+ logrus.Devour(ioutil.WriteFile(fmt.Sprintf("/var/run/docker/containerd/containerd-stacks-%s.log", strings.Replace(time.Now().Format(time.RFC3339), ":", "", -1)), buf, 0600)) - logrus.Infof("=== BEGIN goroutine stack dump ===\n%s\n=== END goroutine stack dump ===", buf) - } -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 47a0cb6..5be785d 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -481,6 +481,7 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - } - - func (r *Runtime) cleanupAfterDeadShim(ctx context.Context, bundle *bundle, ns, id string, pid int) error { -+ logrus.Infof("cleanup dead shim(legacy=%t): %s %d", legacy.IsLegacy(id), id, pid) - ctx = namespaces.WithNamespace(ctx, ns) - if err := r.terminate(ctx, bundle, ns, id); err != nil { - log.G(ctx).WithError(err).Warn("failed to terminate task") --- -1.8.3.1 - diff --git a/patch/0057-containerd-add-timeout-for-delete-command.patch b/patch/0057-containerd-add-timeout-for-delete-command.patch deleted file mode 100644 index 7a0cb9e..0000000 --- a/patch/0057-containerd-add-timeout-for-delete-command.patch +++ /dev/null @@ -1,150 +0,0 @@ -From 313e7f972e887c715b8feaad332ffe505653c496 Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Tue, 3 Mar 2020 06:31:18 +0800 -Subject: [PATCH] containerd:add timeout for delete command - -Change-Id: I620d2f19a8ac9086b5c83792a6fe49b0389da87d -Signed-off-by: xiadanni1 ---- - runtime/v1/linux/task.go | 2 +- - runtime/v1/shim/reaper.go | 23 +-------------- - vendor/github.com/containerd/go-runc/monitor.go | 37 +++++++++++++++++++++++-- - vendor/github.com/containerd/go-runc/runc.go | 3 +- - 4 files changed, 38 insertions(+), 27 deletions(-) - -diff --git a/runtime/v1/linux/task.go b/runtime/v1/linux/task.go -index d2bbb76..d200e9d 100644 ---- a/runtime/v1/linux/task.go -+++ b/runtime/v1/linux/task.go -@@ -91,7 +91,7 @@ func (t *Task) Namespace() string { - func (t *Task) delete(ctx context.Context, force bool, pid uint32) (*runtime.Exit, error) { - rsp, err := t.shim.Delete(ctx, empty) - if err != nil { -- log.G(ctx).WithError(err).Error("failed to delete container, force=%t", force) -+ log.G(ctx).WithError(err).Errorf("failed to delete container, force=%t", force) - } - t.tasks.Delete(ctx, t.id) - if err := t.shim.KillShim(ctx); err != nil { -diff --git a/runtime/v1/shim/reaper.go b/runtime/v1/shim/reaper.go -index d8e8274..f5f8096 100644 ---- a/runtime/v1/shim/reaper.go -+++ b/runtime/v1/shim/reaper.go -@@ -19,11 +19,7 @@ - package shim - - import ( -- "io/ioutil" - "os/exec" -- "path/filepath" -- "strconv" -- "strings" - "sync" - "syscall" - "time" -@@ -122,7 +118,7 @@ func (m *Monitor) WaitTimeout(c *exec.Cmd, ec chan runc.Exit, sec int64) (int, e - }() - select { - case <-time.After(time.Duration(sec) * time.Second): -- if SameProcess(c, c.Process.Pid) { -+ if runc.SameProcess(c, c.Process.Pid) { - logrus.Devour(syscall.Kill(c.Process.Pid, syscall.SIGKILL)) - } - return 0, errors.Errorf("timeout %ds for cmd(pid=%d): %s, %s", sec, c.Process.Pid, c.Path, c.Args) -@@ -149,20 +145,3 @@ func (m *Monitor) Unsubscribe(c chan runc.Exit) { - close(c) - m.Unlock() - } -- --func SameProcess(cmd *exec.Cmd, pid int) bool { -- bytes, err := ioutil.ReadFile(filepath.Join("/proc", strconv.Itoa(pid), "cmdline")) -- if err != nil { -- return false -- } -- for i := range bytes { -- if bytes[i] == 0 { -- bytes[i] = 32 -- } -- } -- cmdline := string(bytes) -- if strings.EqualFold(cmdline, strings.Join(cmd.Args, " ")+" ") { -- return true -- } -- return false --} -diff --git a/vendor/github.com/containerd/go-runc/monitor.go b/vendor/github.com/containerd/go-runc/monitor.go -index 2c184d2..bb8bbab 100644 ---- a/vendor/github.com/containerd/go-runc/monitor.go -+++ b/vendor/github.com/containerd/go-runc/monitor.go -@@ -20,6 +20,13 @@ import ( - "os/exec" - "syscall" - "time" -+ "io/ioutil" -+ "path/filepath" -+ "strconv" -+ "strings" -+ -+ "github.com/pkg/errors" -+ "github.com/sirupsen/logrus" - ) - - var Monitor ProcessMonitor = &defaultMonitor{} -@@ -77,6 +84,30 @@ func (m *defaultMonitor) Wait(c *exec.Cmd, ec chan Exit) (int, error) { - } - - func (m *defaultMonitor) WaitTimeout(c *exec.Cmd, ec chan Exit, sec int64) (int, error) { -- e := <-ec -- return e.Status, nil --} -\ No newline at end of file -+ select { -+ case <-time.After(time.Duration(sec) * time.Second): -+ if SameProcess(c, c.Process.Pid) { -+ logrus.Devour(syscall.Kill(c.Process.Pid, syscall.SIGKILL)) -+ } -+ return 0, errors.Errorf("timeout %ds for cmd(pid=%d): %s, %s", sec, c.Process.Pid, c.Path, c.Args) -+ case e := <-ec: -+ return e.Status, nil -+ } -+} -+ -+func SameProcess(cmd *exec.Cmd, pid int) bool { -+ bytes, err := ioutil.ReadFile(filepath.Join("/proc", strconv.Itoa(pid), "cmdline")) -+ if err != nil { -+ return false -+ } -+ for i := range bytes { -+ if bytes[i] == 0 { -+ bytes[i] = 32 -+ } -+ } -+ cmdline := string(bytes) -+ if strings.EqualFold(cmdline, strings.Join(cmd.Args, " ")+" ") { -+ return true -+ } -+ return false -+} -diff --git a/vendor/github.com/containerd/go-runc/runc.go b/vendor/github.com/containerd/go-runc/runc.go -index c1748ff..1c96317 100644 ---- a/vendor/github.com/containerd/go-runc/runc.go -+++ b/vendor/github.com/containerd/go-runc/runc.go -@@ -57,6 +57,7 @@ const ( - defaultTimeout = 30 - startTimeout = 120 - updateTimeout = 60 -+ deleteTimeout = 120 - ) - - var ( -@@ -318,7 +319,7 @@ func (r *Runc) Delete(context context.Context, id string, opts *DeleteOpts) erro - if opts != nil { - args = append(args, opts.args()...) - } -- return r.runOrError(r.command(id, context, append(args, id)...)) -+ return r.runOrErrorTimeout(r.command(id, context, append(args, id)...), deleteTimeout) - } - - // KillOpts specifies options for killing a container and its processes --- -1.8.3.1 - diff --git a/patch/0058-containerd-use-git-commit-to-store-commit-ID.patch b/patch/0058-containerd-use-git-commit-to-store-commit-ID.patch deleted file mode 100644 index 8cfc1c1..0000000 --- a/patch/0058-containerd-use-git-commit-to-store-commit-ID.patch +++ /dev/null @@ -1,26 +0,0 @@ -From fe8ce77e756f7f468ed65c8c42a9f91becabbf4e Mon Sep 17 00:00:00 2001 -From: liuzekun -Date: Wed, 10 Jun 2020 00:37:01 -0400 -Subject: [PATCH] containerd: use git-commit to store commit ID - -Signed-off-by: liuzekun ---- - Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index 9e7f3ae..6011aa1 100644 ---- a/Makefile -+++ b/Makefile -@@ -21,7 +21,7 @@ DESTDIR=/usr/local - - # Used to populate variables in version package. - VERSION=$(shell echo version:)$(shell grep '^Version' ${ROOTDIR}/containerd.spec | sed 's/[^0-9.]*\([0-9.]*\).*/\1/').$(shell grep '^Release:' ${ROOTDIR}/containerd.spec | sed 's/[^0-9.]*\([0-9.]*\).*/\1/') --REVISION=$(shell echo commit:)$(shell git rev-parse HEAD)$(shell if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi) -+REVISION=$(shell cat ./git-commit | head -c 40) - - ifneq "$(strip $(shell command -v go 2>/dev/null))" "" - GOOS ?= $(shell go env GOOS) --- -2.19.1 - diff --git a/patch/0059-containerd-add-GO_GCFLAGS-to-containerd-shim-making.patch b/patch/0059-containerd-add-GO_GCFLAGS-to-containerd-shim-making.patch deleted file mode 100644 index 7f0bf1c..0000000 --- a/patch/0059-containerd-add-GO_GCFLAGS-to-containerd-shim-making.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 44079d9ee81c215d39ed81e39eb2ae31cf0ad453 Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Tue, 11 Aug 2020 05:55:59 +0800 -Subject: [PATCH] add GO_GCFLAGS to containerd-shim making - -Signed-off-by: xiadanni1 ---- - Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index 6011aa1..ba512ef 100644 ---- a/Makefile -+++ b/Makefile -@@ -175,7 +175,7 @@ bin/%: cmd/% FORCE - - bin/containerd-shim: cmd/containerd-shim FORCE # set !cgo and omit pie for a static shim build: https://github.com/golang/go/issues/17789#issuecomment-258542220 - @echo "$(WHALE) bin/containerd-shim" -- @CGO_ENABLED=0 go build ${GO_BUILD_FLAGS} -o bin/containerd-shim ${SHIM_GO_LDFLAGS} ${GO_TAGS} ./cmd/containerd-shim -+ @CGO_ENABLED=0 go build ${GO_GCFLAGS} ${GO_BUILD_FLAGS} -o bin/containerd-shim ${SHIM_GO_LDFLAGS} ${GO_TAGS} ./cmd/containerd-shim - - bin/containerd-shim-runc-v1: cmd/containerd-shim-runc-v1 FORCE # set !cgo and omit pie for a static shim build: https://github.com/golang/go/issues/17789#issuecomment-258542220 - @echo "$(WHALE) bin/containerd-shim-runc-v1" --- -1.8.3.1 - diff --git a/patch/0060-containerd-do-not-disable-cgo-in-containerd-shim-mak.patch b/patch/0060-containerd-do-not-disable-cgo-in-containerd-shim-mak.patch deleted file mode 100644 index baf09bd..0000000 --- a/patch/0060-containerd-do-not-disable-cgo-in-containerd-shim-mak.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 6523d7e39a9bb45be632ff114c64329f43e1499a Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Wed, 12 Aug 2020 01:52:16 +0800 -Subject: [PATCH] containerd: do not disable cgo in containerd-shim making - -reason: for debuginfo - -Signed-off-by: xiadanni1 ---- - Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index ba512ef..f69559b 100644 ---- a/Makefile -+++ b/Makefile -@@ -175,7 +175,7 @@ bin/%: cmd/% FORCE - - bin/containerd-shim: cmd/containerd-shim FORCE # set !cgo and omit pie for a static shim build: https://github.com/golang/go/issues/17789#issuecomment-258542220 - @echo "$(WHALE) bin/containerd-shim" -- @CGO_ENABLED=0 go build ${GO_GCFLAGS} ${GO_BUILD_FLAGS} -o bin/containerd-shim ${SHIM_GO_LDFLAGS} ${GO_TAGS} ./cmd/containerd-shim -+ go build ${GO_BUILD_FLAGS} -o bin/containerd-shim ${SHIM_GO_LDFLAGS} ${GO_TAGS} ./cmd/containerd-shim - - bin/containerd-shim-runc-v1: cmd/containerd-shim-runc-v1 FORCE # set !cgo and omit pie for a static shim build: https://github.com/golang/go/issues/17789#issuecomment-258542220 - @echo "$(WHALE) bin/containerd-shim-runc-v1" --- -1.8.3.1 - diff --git a/patch/0061-containerd-check-if-bundle-exists-before-create-bund.patch b/patch/0061-containerd-check-if-bundle-exists-before-create-bund.patch deleted file mode 100644 index 2969e08..0000000 --- a/patch/0061-containerd-check-if-bundle-exists-before-create-bund.patch +++ /dev/null @@ -1,66 +0,0 @@ -From c56df3dd08d709e8ee81675661527aac47a7cba2 Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Fri, 6 Nov 2020 10:19:26 +0800 -Subject: [PATCH] containerd: check if bundle exists before create bundle - -reason: If container starts following tightly the last stop, bundle -directory may be deleted by the not yet completed stop, which may cause -container start fail. So we add bundle check during start to avoid this, -if bundle exists, wait for it to clean up. - -Signed-off-by: xiadanni1 ---- - runtime/v1/linux/bundle.go | 17 ++++++++++++++++- - 1 file changed, 16 insertions(+), 1 deletion(-) - -diff --git a/runtime/v1/linux/bundle.go b/runtime/v1/linux/bundle.go -index d73866a..b4f7b4c 100644 ---- a/runtime/v1/linux/bundle.go -+++ b/runtime/v1/linux/bundle.go -@@ -23,12 +23,14 @@ import ( - "io/ioutil" - "os" - "path/filepath" -+ "time" - - "github.com/containerd/containerd/events/exchange" - "github.com/containerd/containerd/runtime/linux/runctypes" - "github.com/containerd/containerd/runtime/v1/shim" - "github.com/containerd/containerd/runtime/v1/shim/client" - "github.com/pkg/errors" -+ "github.com/sirupsen/logrus" - ) - - // loadBundle loads an existing bundle from disk -@@ -46,6 +48,20 @@ func newBundle(id, path, workDir string, spec []byte) (b *bundle, err error) { - return nil, err - } - path = filepath.Join(path, id) -+ workDir = filepath.Join(workDir, id) -+ -+ for waitTime := 10 * time.Millisecond; ; waitTime *= 2 { -+ if _, err = os.Stat(workDir); err != nil { -+ break -+ } -+ logrus.Debugf("bundle-check: wait time %v", waitTime) -+ if waitTime > 2*time.Second { -+ logrus.Warnf("bundle-check: waiting cleanup bundle timeout, start anyway") -+ break -+ } -+ time.Sleep(waitTime) -+ } -+ - if err := os.Mkdir(path, 0711); err != nil { - return nil, err - } -@@ -54,7 +70,6 @@ func newBundle(id, path, workDir string, spec []byte) (b *bundle, err error) { - os.RemoveAll(path) - } - }() -- workDir = filepath.Join(workDir, id) - if err := os.MkdirAll(workDir, 0711); err != nil { - return nil, err - } --- -1.8.3.1 - diff --git a/patch/0062-containerd-use-path-based-socket-for-shims.patch b/patch/0062-containerd-use-path-based-socket-for-shims.patch deleted file mode 100644 index b96cd00..0000000 --- a/patch/0062-containerd-use-path-based-socket-for-shims.patch +++ /dev/null @@ -1,318 +0,0 @@ -From 4185b832a4f89e671e6ecf201d21b75d866a48e4 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Sat, 14 Nov 2020 15:55:30 +0800 -Subject: [PATCH] use path based socket for shims - -Signed-off-by: jingrui ---- - cmd/containerd-shim/main_unix.go | 16 +++-- - cmd/ctr/commands/shim/shim.go | 2 + - runtime/v1/linux/bundle.go | 37 +++++++++- - runtime/v1/shim/client/client.go | 118 ++++++++++++++++++++++++++++--- - 4 files changed, 159 insertions(+), 14 deletions(-) - -diff --git a/cmd/containerd-shim/main_unix.go b/cmd/containerd-shim/main_unix.go -index e9c14263b..3a5bb6170 100644 ---- a/cmd/containerd-shim/main_unix.go -+++ b/cmd/containerd-shim/main_unix.go -@@ -66,7 +66,7 @@ var ( - func init() { - flag.BoolVar(&debugFlag, "debug", false, "enable debug output in logs") - flag.StringVar(&namespaceFlag, "namespace", "", "namespace that owns the shim") -- flag.StringVar(&socketFlag, "socket", "", "abstract socket path to serve") -+ flag.StringVar(&socketFlag, "socket", "", "socket path to serve") - flag.StringVar(&addressFlag, "address", "", "grpc address back to main containerd") - flag.StringVar(&workdirFlag, "workdir", "", "path used to storge large temporary data") - flag.StringVar(&runtimeRootFlag, "runtime-root", proc.RuncRoot, "root directory for the runtime") -@@ -190,10 +190,18 @@ func serve(ctx context.Context, server *ttrpc.Server, path string) error { - } - path = "[inherited from parent]" - } else { -- if len(path) > 106 { -- return errors.Errorf("%q: unix socket path too long (> 106)", path) -+ const ( -+ abstractSocketPrefix = "\x00" -+ socketPathLimit = 106 -+ ) -+ p := strings.TrimPrefix(path, "unix://") -+ if len(p) == len(path) { -+ p = abstractSocketPrefix + p - } -- l, err = net.Listen("unix", "\x00"+path) -+ if len(p) > socketPathLimit { -+ return errors.Errorf("%q: unix socket path too long (> %d)", p, socketPathLimit) -+ } -+ l, err = net.Listen("unix", p) - } - if err != nil { - return err -diff --git a/cmd/ctr/commands/shim/shim.go b/cmd/ctr/commands/shim/shim.go -index ec08cc68b..8ef068292 100644 ---- a/cmd/ctr/commands/shim/shim.go -+++ b/cmd/ctr/commands/shim/shim.go -@@ -23,6 +23,7 @@ import ( - "fmt" - "io/ioutil" - "net" -+ "strings" - - "github.com/containerd/console" - "github.com/containerd/containerd/cmd/ctr/commands" -@@ -231,6 +232,7 @@ func getTaskService(context *cli.Context) (task.TaskService, error) { - return nil, errors.New("socket path must be specified") - } - -+ bindSocket = strings.TrimPrefix(bindSocket, "unix://") - conn, err := net.Dial("unix", "\x00"+bindSocket) - if err != nil { - return nil, err -diff --git a/runtime/v1/linux/bundle.go b/runtime/v1/linux/bundle.go -index ef4200b29..0442246f9 100644 ---- a/runtime/v1/linux/bundle.go -+++ b/runtime/v1/linux/bundle.go -@@ -20,6 +20,7 @@ package linux - - import ( - "context" -+ "fmt" - "io/ioutil" - "os" - "path/filepath" -@@ -117,7 +118,7 @@ func ShimLocal(c *Config, exchange *exchange.Exchange) ShimOpt { - // ShimConnect is a ShimOpt for connecting to an existing remote shim - func ShimConnect(c *Config, onClose func()) ShimOpt { - return func(b *bundle, ns string, ropts *runctypes.RuncOptions) (shim.Config, client.Opt) { -- return b.shimConfig(ns, c, ropts), client.WithConnect(b.shimAddress(ns), onClose) -+ return b.shimConfig(ns, c, ropts), client.WithConnect(b.decideShimAddress(ns), onClose) - } - } - -@@ -129,6 +130,11 @@ func (b *bundle) NewShimClient(ctx context.Context, namespace string, getClientO - - // Delete deletes the bundle from disk - func (b *bundle) Delete() error { -+ address, _ := b.loadAddress() -+ if address != "" { -+ // we don't care about errors here -+ client.RemoveSocket(address) -+ } - err := os.RemoveAll(b.path) - if err == nil { - return os.RemoveAll(b.workDir) -@@ -141,10 +147,37 @@ func (b *bundle) Delete() error { - return errors.Wrapf(err, "Failed to remove both bundle and workdir locations: %v", err2) - } - --func (b *bundle) shimAddress(namespace string) string { -+func (b *bundle) legacyShimAddress(namespace string) string { - return filepath.Join(string(filepath.Separator), "containerd-shim", namespace, b.id, "shim.sock") - } - -+const socketRoot = "/run/containerd" -+ -+func (b *bundle) shimAddress(namespace string) string { -+ return fmt.Sprintf("unix://%s", b.shimSock()) -+} -+ -+func (b *bundle) shimSock() string { -+ return filepath.Join(socketRoot, "s", b.id) -+} -+ -+func (b *bundle) loadAddress() (string, error) { -+ addressPath := filepath.Join(b.path, "address") -+ data, err := ioutil.ReadFile(addressPath) -+ if err != nil { -+ return "", err -+ } -+ return string(data), nil -+} -+ -+func (b *bundle) decideShimAddress(namespace string) string { -+ address, err := b.loadAddress() -+ if err != nil { -+ return b.legacyShimAddress(namespace) -+ } -+ return address -+} -+ - func (b *bundle) shimConfig(namespace string, c *Config, runcOptions *runctypes.RuncOptions) shim.Config { - var ( - criuPath string -diff --git a/runtime/v1/shim/client/client.go b/runtime/v1/shim/client/client.go -index a4669d33c..06453b35a 100644 ---- a/runtime/v1/shim/client/client.go -+++ b/runtime/v1/shim/client/client.go -@@ -20,11 +20,14 @@ package client - - import ( - "context" -+ "fmt" - "io" - "net" - "os" - "os/exec" -+ "path/filepath" - "runtime" -+ "strconv" - "strings" - "sync" - "syscall" -@@ -55,9 +58,17 @@ func WithStart(binary, address, daemonAddress, cgroup string, debug bool, exitHa - return func(ctx context.Context, config shim.Config) (_ shimapi.ShimService, _ io.Closer, err error) { - socket, err := newSocket(address) - if err != nil { -- return nil, nil, err -+ if !eaddrinuse(err) { -+ return nil, nil, err -+ } -+ if err := RemoveSocket(address); err != nil { -+ return nil, nil, errors.Wrap(err, "remove already used socket") -+ } -+ if socket, err = newSocket(address); err != nil { -+ return nil, nil, err -+ } - } -- defer socket.Close() -+ - f, err := socket.File() - if err != nil { - return nil, nil, errors.Wrapf(err, "failed to get fd for socket %s", address) -@@ -102,12 +113,22 @@ func WithStart(binary, address, daemonAddress, cgroup string, debug bool, exitHa - if stderrLog != nil { - stderrLog.Close() - } -+ socket.Close() -+ RemoveSocket(address) - }() - log.G(ctx).WithFields(logrus.Fields{ - "pid": cmd.Process.Pid, - "address": address, - "debug": debug, - }).Infof("shim %s started", binary) -+ -+ if err := writeFile(filepath.Join(config.Path, "address"), address); err != nil { -+ return nil, nil, err -+ } -+ if err := writeFile(filepath.Join(config.Path, "shim.pid"), strconv.Itoa(cmd.Process.Pid)); err != nil { -+ return nil, nil, err -+ } -+ - // set shim in cgroup if it is provided - if cgroup != "" { - if err := setCgroup(cgroup, cmd); err != nil { -@@ -170,25 +191,106 @@ func newCommand(binary, daemonAddress string, debug bool, config shim.Config, so - return cmd, nil - } - -+// writeFile writes a address file atomically -+func writeFile(path, address string) error { -+ path, err := filepath.Abs(path) -+ if err != nil { -+ return err -+ } -+ tempPath := filepath.Join(filepath.Dir(path), fmt.Sprintf(".%s", filepath.Base(path))) -+ f, err := os.OpenFile(tempPath, os.O_RDWR|os.O_CREATE|os.O_EXCL|os.O_SYNC, 0666) -+ if err != nil { -+ return err -+ } -+ _, err = f.WriteString(address) -+ f.Close() -+ if err != nil { -+ return err -+ } -+ return os.Rename(tempPath, path) -+} -+ -+const ( -+ abstractSocketPrefix = "\x00" -+ socketPathLimit = 106 -+) -+ -+func eaddrinuse(err error) bool { -+ cause := errors.Cause(err) -+ netErr, ok := cause.(*net.OpError) -+ if !ok { -+ return false -+ } -+ if netErr.Op != "listen" { -+ return false -+ } -+ syscallErr, ok := netErr.Err.(*os.SyscallError) -+ if !ok { -+ return false -+ } -+ errno, ok := syscallErr.Err.(syscall.Errno) -+ if !ok { -+ return false -+ } -+ return errno == syscall.EADDRINUSE -+} -+ -+type socket string -+ -+func (s socket) isAbstract() bool { -+ return !strings.HasPrefix(string(s), "unix://") -+} -+ -+func (s socket) path() string { -+ path := strings.TrimPrefix(string(s), "unix://") -+ // if there was no trim performed, we assume an abstract socket -+ if len(path) == len(s) { -+ path = abstractSocketPrefix + path -+ } -+ return path -+} -+ - func newSocket(address string) (*net.UnixListener, error) { -- if len(address) > 106 { -- return nil, errors.Errorf("%q: unix socket path too long (> 106)", address) -+ if len(address) > socketPathLimit { -+ return nil, errors.Errorf("%q: unix socket path too long (> %d)", address, socketPathLimit) -+ } -+ var ( -+ sock = socket(address) -+ path = sock.path() -+ ) -+ if !sock.isAbstract() { -+ if err := os.MkdirAll(filepath.Dir(path), 0600); err != nil { -+ return nil, errors.Wrapf(err, "%s", path) -+ } - } -- l, err := net.Listen("unix", "\x00"+address) -+ l, err := net.Listen("unix", path) - if err != nil { -- return nil, errors.Wrapf(err, "failed to listen to abstract unix socket %q", address) -+ return nil, errors.Wrapf(err, "failed to listen to unix socket %q (abstract: %t)", address, sock.isAbstract()) -+ } -+ if err := os.Chmod(path, 0600); err != nil { -+ l.Close() -+ return nil, err - } - - return l.(*net.UnixListener), nil - } - -+// RemoveSocket removes the socket at the specified address if -+// it exists on the filesystem -+func RemoveSocket(address string) error { -+ sock := socket(address) -+ if !sock.isAbstract() { -+ return os.Remove(sock.path()) -+ } -+ return nil -+} -+ - func connect(address string, d func(string, time.Duration) (net.Conn, error)) (net.Conn, error) { - return d(address, 100*time.Second) - } - - func annonDialer(address string, timeout time.Duration) (net.Conn, error) { -- address = strings.TrimPrefix(address, "unix://") -- return net.DialTimeout("unix", "\x00"+address, timeout) -+ return net.DialTimeout("unix", socket(address).path(), timeout) - } - - // WithConnect connects to an existing shim --- -2.17.1 - diff --git a/patch/0063-containerd-kill-init-directly-if-runtime-kill-failed.patch b/patch/0063-containerd-kill-init-directly-if-runtime-kill-failed.patch deleted file mode 100644 index a3e9bfc..0000000 --- a/patch/0063-containerd-kill-init-directly-if-runtime-kill-failed.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 3ec035244d33b4cb64adacb8133ae3e204cae55f Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Thu, 19 Nov 2020 15:49:53 +0800 -Subject: [PATCH] containerd: kill init directly if runtime kill failed - -Change-Id: I80a1c0c4f88530fe9732e6e9a2d1fb222ece118c -Signed-off-by: jingrui ---- - runtime/v1/shim/service.go | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index beb0ed8d5..7e07ab011 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -49,6 +49,7 @@ import ( - specs "github.com/opencontainers/runtime-spec/specs-go" - "github.com/pkg/errors" - "github.com/sirupsen/logrus" -+ "golang.org/x/sys/unix" - "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" - ) -@@ -390,6 +391,10 @@ func (s *Service) Kill(ctx context.Context, r *shimapi.KillRequest) (*ptypes.Emp - time.Sleep(10 * time.Second) - err := p.Kill(ctx, r.Signal, r.All) - logrus.Infof("delay kill %s retry %d error=%v", s.id, i, err) -+ if err != nil { -+ err := unix.Kill(p.Pid(), syscall.SIGKILL) -+ logrus.Infof("delay kill-direct %s retry %d error=%v", s.id, i, err) -+ } - } - - logrus.Infof("force exit shim %s ...", s.id) --- -2.17.1 - diff --git a/patch/0064-containerd-add-sys-symbol-to-support-riscv.patch b/patch/0064-containerd-add-sys-symbol-to-support-riscv.patch deleted file mode 100644 index 3665d97..0000000 --- a/patch/0064-containerd-add-sys-symbol-to-support-riscv.patch +++ /dev/null @@ -1,7977 +0,0 @@ -From 7414e986b522f84f8a4bebefe2e23b02a94dbb38 Mon Sep 17 00:00:00 2001 -From: yangyanchao -Date: Tue, 15 Dec 2020 03:24:35 +0000 -Subject: [PATCH 1/2] containerd-add-sys-symbol-to-support-riscv - ---- - .../golang.org/x/sys/unix/asm_linux_riscv64.s | 26 + - .../x/sys/unix/syscall_linux_riscv64.go | 226 ++ - .../x/sys/unix/zerrors_linux_riscv64.go | 2826 +++++++++++++++++ - .../x/sys/unix/zsyscall_linux_riscv64.go | 2217 +++++++++++++ - .../x/sys/unix/zsysnum_linux_riscv64.go | 289 ++ - .../x/sys/unix/ztypes_linux_riscv64.go | 2334 ++++++++++++++ - 6 files changed, 7918 insertions(+) - create mode 100644 vendor/golang.org/x/sys/unix/asm_linux_riscv64.s - create mode 100644 vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go - create mode 100644 vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go - create mode 100644 vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go - create mode 100644 vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go - create mode 100644 vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go - -diff --git a/vendor/golang.org/x/sys/unix/asm_linux_riscv64.s b/vendor/golang.org/x/sys/unix/asm_linux_riscv64.s -new file mode 100644 -index 0000000..5b740f7 ---- /dev/null -+++ b/vendor/golang.org/x/sys/unix/asm_linux_riscv64.s -@@ -0,0 +1,26 @@ -+// Copyright 2019 The Go Authors. All rights reserved. -+// Use of this source code is governed by a BSD-style -+// license that can be found in the LICENSE file. -+ -+// +build riscv64,!gccgo -+ -+#include "textflag.h" -+ -+// -+// System calls for linux/riscv64. -+// -+// Where available, just jump to package syscall's implementation of -+// these functions. -+ -+TEXT ·Syscall(SB),NOSPLIT,$0-56 -+ JMP syscall·Syscall(SB) -+ -+TEXT ·Syscall6(SB),NOSPLIT,$0-80 -+ JMP syscall·Syscall6(SB) -+ -+TEXT ·RawSyscall(SB),NOSPLIT,$0-56 -+ JMP syscall·RawSyscall(SB) -+ -+TEXT ·RawSyscall6(SB),NOSPLIT,$0-80 -+ JMP syscall·RawSyscall6(SB) -+ -diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go b/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go -new file mode 100644 -index 0000000..6230f64 ---- /dev/null -+++ b/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go -@@ -0,0 +1,226 @@ -+// Copyright 2018 The Go Authors. All rights reserved. -+// Use of this source code is governed by a BSD-style -+// license that can be found in the LICENSE file. -+ -+// +build riscv64,linux -+ -+package unix -+ -+import "unsafe" -+ -+func EpollCreate(size int) (fd int, err error) { -+ if size <= 0 { -+ return -1, EINVAL -+ } -+ return EpollCreate1(0) -+} -+ -+//sys EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) = SYS_EPOLL_PWAIT -+//sys Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64 -+//sys Fchown(fd int, uid int, gid int) (err error) -+//sys Fstat(fd int, stat *Stat_t) (err error) -+//sys Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) -+//sys Fstatfs(fd int, buf *Statfs_t) (err error) -+//sys Ftruncate(fd int, length int64) (err error) -+//sysnb Getegid() (egid int) -+//sysnb Geteuid() (euid int) -+//sysnb Getgid() (gid int) -+//sysnb Getrlimit(resource int, rlim *Rlimit) (err error) -+//sysnb Getuid() (uid int) -+//sys Listen(s int, n int) (err error) -+//sys Pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64 -+//sys Pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64 -+//sys Seek(fd int, offset int64, whence int) (off int64, err error) = SYS_LSEEK -+ -+func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) { -+ var ts *Timespec -+ if timeout != nil { -+ ts = &Timespec{Sec: timeout.Sec, Nsec: timeout.Usec * 1000} -+ } -+ return Pselect(nfd, r, w, e, ts, nil) -+} -+ -+//sys sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) -+//sys Setfsgid(gid int) (err error) -+//sys Setfsuid(uid int) (err error) -+//sysnb Setregid(rgid int, egid int) (err error) -+//sysnb Setresgid(rgid int, egid int, sgid int) (err error) -+//sysnb Setresuid(ruid int, euid int, suid int) (err error) -+//sysnb Setrlimit(resource int, rlim *Rlimit) (err error) -+//sysnb Setreuid(ruid int, euid int) (err error) -+//sys Shutdown(fd int, how int) (err error) -+//sys Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error) -+ -+func Stat(path string, stat *Stat_t) (err error) { -+ return Fstatat(AT_FDCWD, path, stat, 0) -+} -+ -+func Lchown(path string, uid int, gid int) (err error) { -+ return Fchownat(AT_FDCWD, path, uid, gid, AT_SYMLINK_NOFOLLOW) -+} -+ -+func Lstat(path string, stat *Stat_t) (err error) { -+ return Fstatat(AT_FDCWD, path, stat, AT_SYMLINK_NOFOLLOW) -+} -+ -+//sys Statfs(path string, buf *Statfs_t) (err error) -+//sys SyncFileRange(fd int, off int64, n int64, flags int) (err error) -+//sys Truncate(path string, length int64) (err error) -+ -+func Ustat(dev int, ubuf *Ustat_t) (err error) { -+ return ENOSYS -+} -+ -+//sys accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) -+//sys accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) -+//sys bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) -+//sys connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) -+//sysnb getgroups(n int, list *_Gid_t) (nn int, err error) -+//sysnb setgroups(n int, list *_Gid_t) (err error) -+//sys getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) -+//sys setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) -+//sysnb socket(domain int, typ int, proto int) (fd int, err error) -+//sysnb socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) -+//sysnb getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) -+//sysnb getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) -+//sys recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) -+//sys sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error) -+//sys recvmsg(s int, msg *Msghdr, flags int) (n int, err error) -+//sys sendmsg(s int, msg *Msghdr, flags int) (n int, err error) -+//sys mmap(addr uintptr, length uintptr, prot int, flags int, fd int, offset int64) (xaddr uintptr, err error) -+ -+//sysnb Gettimeofday(tv *Timeval) (err error) -+ -+func setTimespec(sec, nsec int64) Timespec { -+ return Timespec{Sec: sec, Nsec: nsec} -+} -+ -+func setTimeval(sec, usec int64) Timeval { -+ return Timeval{Sec: sec, Usec: usec} -+} -+ -+func futimesat(dirfd int, path string, tv *[2]Timeval) (err error) { -+ if tv == nil { -+ return utimensat(dirfd, path, nil, 0) -+ } -+ -+ ts := []Timespec{ -+ NsecToTimespec(TimevalToNsec(tv[0])), -+ NsecToTimespec(TimevalToNsec(tv[1])), -+ } -+ return utimensat(dirfd, path, (*[2]Timespec)(unsafe.Pointer(&ts[0])), 0) -+} -+ -+func Time(t *Time_t) (Time_t, error) { -+ var tv Timeval -+ err := Gettimeofday(&tv) -+ if err != nil { -+ return 0, err -+ } -+ if t != nil { -+ *t = Time_t(tv.Sec) -+ } -+ return Time_t(tv.Sec), nil -+} -+ -+func Utime(path string, buf *Utimbuf) error { -+ tv := []Timeval{ -+ {Sec: buf.Actime}, -+ {Sec: buf.Modtime}, -+ } -+ return Utimes(path, tv) -+} -+ -+func utimes(path string, tv *[2]Timeval) (err error) { -+ if tv == nil { -+ return utimensat(AT_FDCWD, path, nil, 0) -+ } -+ -+ ts := []Timespec{ -+ NsecToTimespec(TimevalToNsec(tv[0])), -+ NsecToTimespec(TimevalToNsec(tv[1])), -+ } -+ return utimensat(AT_FDCWD, path, (*[2]Timespec)(unsafe.Pointer(&ts[0])), 0) -+} -+ -+func Pipe(p []int) (err error) { -+ if len(p) != 2 { -+ return EINVAL -+ } -+ var pp [2]_C_int -+ err = pipe2(&pp, 0) -+ p[0] = int(pp[0]) -+ p[1] = int(pp[1]) -+ return -+} -+ -+//sysnb pipe2(p *[2]_C_int, flags int) (err error) -+ -+func Pipe2(p []int, flags int) (err error) { -+ if len(p) != 2 { -+ return EINVAL -+ } -+ var pp [2]_C_int -+ err = pipe2(&pp, flags) -+ p[0] = int(pp[0]) -+ p[1] = int(pp[1]) -+ return -+} -+ -+func (r *PtraceRegs) PC() uint64 { return r.Pc } -+ -+func (r *PtraceRegs) SetPC(pc uint64) { r.Pc = pc } -+ -+func (iov *Iovec) SetLen(length int) { -+ iov.Len = uint64(length) -+} -+ -+func (msghdr *Msghdr) SetControllen(length int) { -+ msghdr.Controllen = uint64(length) -+} -+ -+func (cmsg *Cmsghdr) SetLen(length int) { -+ cmsg.Len = uint64(length) -+} -+ -+func InotifyInit() (fd int, err error) { -+ return InotifyInit1(0) -+} -+ -+func Dup2(oldfd int, newfd int) (err error) { -+ return Dup3(oldfd, newfd, 0) -+} -+ -+func Pause() error { -+ _, err := ppoll(nil, 0, nil, nil) -+ return err -+} -+ -+func Poll(fds []PollFd, timeout int) (n int, err error) { -+ var ts *Timespec -+ if timeout >= 0 { -+ ts = new(Timespec) -+ *ts = NsecToTimespec(int64(timeout) * 1e6) -+ } -+ if len(fds) == 0 { -+ return ppoll(nil, 0, ts, nil) -+ } -+ return ppoll(&fds[0], len(fds), ts, nil) -+} -+ -+func Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err error) { -+ return Renameat2(olddirfd, oldpath, newdirfd, newpath, 0) -+} -+ -+//sys kexecFileLoad(kernelFd int, initrdFd int, cmdlineLen int, cmdline string, flags int) (err error) -+ -+func KexecFileLoad(kernelFd int, initrdFd int, cmdline string, flags int) error { -+ cmdlineLen := len(cmdline) -+ if cmdlineLen > 0 { -+ // Account for the additional NULL byte added by -+ // BytePtrFromString in kexecFileLoad. The kexec_file_load -+ // syscall expects a NULL-terminated string. -+ cmdlineLen++ -+ } -+ return kexecFileLoad(kernelFd, initrdFd, cmdlineLen, cmdline, flags) -+} -diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go -new file mode 100644 -index 0000000..0465451 ---- /dev/null -+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go -@@ -0,0 +1,2826 @@ -+// mkerrors.sh -Wall -Werror -static -I/tmp/include -+// Code generated by the command above; see README.md. DO NOT EDIT. -+ -+// +build riscv64,linux -+ -+// Code generated by cmd/cgo -godefs; DO NOT EDIT. -+// cgo -godefs -- -Wall -Werror -static -I/tmp/include _const.go -+ -+package unix -+ -+import "syscall" -+ -+const ( -+ AAFS_MAGIC = 0x5a3c69f0 -+ ADFS_SUPER_MAGIC = 0xadf5 -+ AFFS_SUPER_MAGIC = 0xadff -+ AFS_FS_MAGIC = 0x6b414653 -+ AFS_SUPER_MAGIC = 0x5346414f -+ AF_ALG = 0x26 -+ AF_APPLETALK = 0x5 -+ AF_ASH = 0x12 -+ AF_ATMPVC = 0x8 -+ AF_ATMSVC = 0x14 -+ AF_AX25 = 0x3 -+ AF_BLUETOOTH = 0x1f -+ AF_BRIDGE = 0x7 -+ AF_CAIF = 0x25 -+ AF_CAN = 0x1d -+ AF_DECnet = 0xc -+ AF_ECONET = 0x13 -+ AF_FILE = 0x1 -+ AF_IB = 0x1b -+ AF_IEEE802154 = 0x24 -+ AF_INET = 0x2 -+ AF_INET6 = 0xa -+ AF_IPX = 0x4 -+ AF_IRDA = 0x17 -+ AF_ISDN = 0x22 -+ AF_IUCV = 0x20 -+ AF_KCM = 0x29 -+ AF_KEY = 0xf -+ AF_LLC = 0x1a -+ AF_LOCAL = 0x1 -+ AF_MAX = 0x2d -+ AF_MPLS = 0x1c -+ AF_NETBEUI = 0xd -+ AF_NETLINK = 0x10 -+ AF_NETROM = 0x6 -+ AF_NFC = 0x27 -+ AF_PACKET = 0x11 -+ AF_PHONET = 0x23 -+ AF_PPPOX = 0x18 -+ AF_QIPCRTR = 0x2a -+ AF_RDS = 0x15 -+ AF_ROSE = 0xb -+ AF_ROUTE = 0x10 -+ AF_RXRPC = 0x21 -+ AF_SECURITY = 0xe -+ AF_SMC = 0x2b -+ AF_SNA = 0x16 -+ AF_TIPC = 0x1e -+ AF_UNIX = 0x1 -+ AF_UNSPEC = 0x0 -+ AF_VSOCK = 0x28 -+ AF_WANPIPE = 0x19 -+ AF_X25 = 0x9 -+ AF_XDP = 0x2c -+ ALG_OP_DECRYPT = 0x0 -+ ALG_OP_ENCRYPT = 0x1 -+ ALG_SET_AEAD_ASSOCLEN = 0x4 -+ ALG_SET_AEAD_AUTHSIZE = 0x5 -+ ALG_SET_IV = 0x2 -+ ALG_SET_KEY = 0x1 -+ ALG_SET_OP = 0x3 -+ ANON_INODE_FS_MAGIC = 0x9041934 -+ ARPHRD_6LOWPAN = 0x339 -+ ARPHRD_ADAPT = 0x108 -+ ARPHRD_APPLETLK = 0x8 -+ ARPHRD_ARCNET = 0x7 -+ ARPHRD_ASH = 0x30d -+ ARPHRD_ATM = 0x13 -+ ARPHRD_AX25 = 0x3 -+ ARPHRD_BIF = 0x307 -+ ARPHRD_CAIF = 0x336 -+ ARPHRD_CAN = 0x118 -+ ARPHRD_CHAOS = 0x5 -+ ARPHRD_CISCO = 0x201 -+ ARPHRD_CSLIP = 0x101 -+ ARPHRD_CSLIP6 = 0x103 -+ ARPHRD_DDCMP = 0x205 -+ ARPHRD_DLCI = 0xf -+ ARPHRD_ECONET = 0x30e -+ ARPHRD_EETHER = 0x2 -+ ARPHRD_ETHER = 0x1 -+ ARPHRD_EUI64 = 0x1b -+ ARPHRD_FCAL = 0x311 -+ ARPHRD_FCFABRIC = 0x313 -+ ARPHRD_FCPL = 0x312 -+ ARPHRD_FCPP = 0x310 -+ ARPHRD_FDDI = 0x306 -+ ARPHRD_FRAD = 0x302 -+ ARPHRD_HDLC = 0x201 -+ ARPHRD_HIPPI = 0x30c -+ ARPHRD_HWX25 = 0x110 -+ ARPHRD_IEEE1394 = 0x18 -+ ARPHRD_IEEE802 = 0x6 -+ ARPHRD_IEEE80211 = 0x321 -+ ARPHRD_IEEE80211_PRISM = 0x322 -+ ARPHRD_IEEE80211_RADIOTAP = 0x323 -+ ARPHRD_IEEE802154 = 0x324 -+ ARPHRD_IEEE802154_MONITOR = 0x325 -+ ARPHRD_IEEE802_TR = 0x320 -+ ARPHRD_INFINIBAND = 0x20 -+ ARPHRD_IP6GRE = 0x337 -+ ARPHRD_IPDDP = 0x309 -+ ARPHRD_IPGRE = 0x30a -+ ARPHRD_IRDA = 0x30f -+ ARPHRD_LAPB = 0x204 -+ ARPHRD_LOCALTLK = 0x305 -+ ARPHRD_LOOPBACK = 0x304 -+ ARPHRD_METRICOM = 0x17 -+ ARPHRD_NETLINK = 0x338 -+ ARPHRD_NETROM = 0x0 -+ ARPHRD_NONE = 0xfffe -+ ARPHRD_PHONET = 0x334 -+ ARPHRD_PHONET_PIPE = 0x335 -+ ARPHRD_PIMREG = 0x30b -+ ARPHRD_PPP = 0x200 -+ ARPHRD_PRONET = 0x4 -+ ARPHRD_RAWHDLC = 0x206 -+ ARPHRD_RAWIP = 0x207 -+ ARPHRD_ROSE = 0x10e -+ ARPHRD_RSRVD = 0x104 -+ ARPHRD_SIT = 0x308 -+ ARPHRD_SKIP = 0x303 -+ ARPHRD_SLIP = 0x100 -+ ARPHRD_SLIP6 = 0x102 -+ ARPHRD_TUNNEL = 0x300 -+ ARPHRD_TUNNEL6 = 0x301 -+ ARPHRD_VOID = 0xffff -+ ARPHRD_VSOCKMON = 0x33a -+ ARPHRD_X25 = 0x10f -+ AUTOFS_SUPER_MAGIC = 0x187 -+ B0 = 0x0 -+ B1000000 = 0x1008 -+ B110 = 0x3 -+ B115200 = 0x1002 -+ B1152000 = 0x1009 -+ B1200 = 0x9 -+ B134 = 0x4 -+ B150 = 0x5 -+ B1500000 = 0x100a -+ B1800 = 0xa -+ B19200 = 0xe -+ B200 = 0x6 -+ B2000000 = 0x100b -+ B230400 = 0x1003 -+ B2400 = 0xb -+ B2500000 = 0x100c -+ B300 = 0x7 -+ B3000000 = 0x100d -+ B3500000 = 0x100e -+ B38400 = 0xf -+ B4000000 = 0x100f -+ B460800 = 0x1004 -+ B4800 = 0xc -+ B50 = 0x1 -+ B500000 = 0x1005 -+ B57600 = 0x1001 -+ B576000 = 0x1006 -+ B600 = 0x8 -+ B75 = 0x2 -+ B921600 = 0x1007 -+ B9600 = 0xd -+ BALLOON_KVM_MAGIC = 0x13661366 -+ BDEVFS_MAGIC = 0x62646576 -+ BINDERFS_SUPER_MAGIC = 0x6c6f6f70 -+ BINFMTFS_MAGIC = 0x42494e4d -+ BLKBSZGET = 0x80081270 -+ BLKBSZSET = 0x40081271 -+ BLKFLSBUF = 0x1261 -+ BLKFRAGET = 0x1265 -+ BLKFRASET = 0x1264 -+ BLKGETSIZE = 0x1260 -+ BLKGETSIZE64 = 0x80081272 -+ BLKPBSZGET = 0x127b -+ BLKRAGET = 0x1263 -+ BLKRASET = 0x1262 -+ BLKROGET = 0x125e -+ BLKROSET = 0x125d -+ BLKRRPART = 0x125f -+ BLKSECTGET = 0x1267 -+ BLKSECTSET = 0x1266 -+ BLKSSZGET = 0x1268 -+ BOTHER = 0x1000 -+ BPF_A = 0x10 -+ BPF_ABS = 0x20 -+ BPF_ADD = 0x0 -+ BPF_ALU = 0x4 -+ BPF_AND = 0x50 -+ BPF_B = 0x10 -+ BPF_DIV = 0x30 -+ BPF_FS_MAGIC = 0xcafe4a11 -+ BPF_H = 0x8 -+ BPF_IMM = 0x0 -+ BPF_IND = 0x40 -+ BPF_JA = 0x0 -+ BPF_JEQ = 0x10 -+ BPF_JGE = 0x30 -+ BPF_JGT = 0x20 -+ BPF_JMP = 0x5 -+ BPF_JSET = 0x40 -+ BPF_K = 0x0 -+ BPF_LD = 0x0 -+ BPF_LDX = 0x1 -+ BPF_LEN = 0x80 -+ BPF_LL_OFF = -0x200000 -+ BPF_LSH = 0x60 -+ BPF_MAJOR_VERSION = 0x1 -+ BPF_MAXINSNS = 0x1000 -+ BPF_MEM = 0x60 -+ BPF_MEMWORDS = 0x10 -+ BPF_MINOR_VERSION = 0x1 -+ BPF_MISC = 0x7 -+ BPF_MOD = 0x90 -+ BPF_MSH = 0xa0 -+ BPF_MUL = 0x20 -+ BPF_NEG = 0x80 -+ BPF_NET_OFF = -0x100000 -+ BPF_OR = 0x40 -+ BPF_RET = 0x6 -+ BPF_RSH = 0x70 -+ BPF_ST = 0x2 -+ BPF_STX = 0x3 -+ BPF_SUB = 0x10 -+ BPF_TAX = 0x0 -+ BPF_TXA = 0x80 -+ BPF_W = 0x0 -+ BPF_X = 0x8 -+ BPF_XOR = 0xa0 -+ BRKINT = 0x2 -+ BS0 = 0x0 -+ BS1 = 0x2000 -+ BSDLY = 0x2000 -+ BTRFS_SUPER_MAGIC = 0x9123683e -+ BTRFS_TEST_MAGIC = 0x73727279 -+ CAN_BCM = 0x2 -+ CAN_EFF_FLAG = 0x80000000 -+ CAN_EFF_ID_BITS = 0x1d -+ CAN_EFF_MASK = 0x1fffffff -+ CAN_ERR_FLAG = 0x20000000 -+ CAN_ERR_MASK = 0x1fffffff -+ CAN_INV_FILTER = 0x20000000 -+ CAN_ISOTP = 0x6 -+ CAN_MAX_DLC = 0x8 -+ CAN_MAX_DLEN = 0x8 -+ CAN_MCNET = 0x5 -+ CAN_MTU = 0x10 -+ CAN_NPROTO = 0x7 -+ CAN_RAW = 0x1 -+ CAN_RAW_FILTER_MAX = 0x200 -+ CAN_RTR_FLAG = 0x40000000 -+ CAN_SFF_ID_BITS = 0xb -+ CAN_SFF_MASK = 0x7ff -+ CAN_TP16 = 0x3 -+ CAN_TP20 = 0x4 -+ CBAUD = 0x100f -+ CBAUDEX = 0x1000 -+ CFLUSH = 0xf -+ CGROUP2_SUPER_MAGIC = 0x63677270 -+ CGROUP_SUPER_MAGIC = 0x27e0eb -+ CIBAUD = 0x100f0000 -+ CLOCAL = 0x800 -+ CLOCK_BOOTTIME = 0x7 -+ CLOCK_BOOTTIME_ALARM = 0x9 -+ CLOCK_DEFAULT = 0x0 -+ CLOCK_EXT = 0x1 -+ CLOCK_INT = 0x2 -+ CLOCK_MONOTONIC = 0x1 -+ CLOCK_MONOTONIC_COARSE = 0x6 -+ CLOCK_MONOTONIC_RAW = 0x4 -+ CLOCK_PROCESS_CPUTIME_ID = 0x2 -+ CLOCK_REALTIME = 0x0 -+ CLOCK_REALTIME_ALARM = 0x8 -+ CLOCK_REALTIME_COARSE = 0x5 -+ CLOCK_TAI = 0xb -+ CLOCK_THREAD_CPUTIME_ID = 0x3 -+ CLOCK_TXFROMRX = 0x4 -+ CLOCK_TXINT = 0x3 -+ CLONE_CHILD_CLEARTID = 0x200000 -+ CLONE_CHILD_SETTID = 0x1000000 -+ CLONE_DETACHED = 0x400000 -+ CLONE_FILES = 0x400 -+ CLONE_FS = 0x200 -+ CLONE_IO = 0x80000000 -+ CLONE_NEWCGROUP = 0x2000000 -+ CLONE_NEWIPC = 0x8000000 -+ CLONE_NEWNET = 0x40000000 -+ CLONE_NEWNS = 0x20000 -+ CLONE_NEWPID = 0x20000000 -+ CLONE_NEWUSER = 0x10000000 -+ CLONE_NEWUTS = 0x4000000 -+ CLONE_PARENT = 0x8000 -+ CLONE_PARENT_SETTID = 0x100000 -+ CLONE_PTRACE = 0x2000 -+ CLONE_SETTLS = 0x80000 -+ CLONE_SIGHAND = 0x800 -+ CLONE_SYSVSEM = 0x40000 -+ CLONE_THREAD = 0x10000 -+ CLONE_UNTRACED = 0x800000 -+ CLONE_VFORK = 0x4000 -+ CLONE_VM = 0x100 -+ CMSPAR = 0x40000000 -+ CODA_SUPER_MAGIC = 0x73757245 -+ CR0 = 0x0 -+ CR1 = 0x200 -+ CR2 = 0x400 -+ CR3 = 0x600 -+ CRAMFS_MAGIC = 0x28cd3d45 -+ CRDLY = 0x600 -+ CREAD = 0x80 -+ CRTSCTS = 0x80000000 -+ CRYPTO_MAX_NAME = 0x40 -+ CRYPTO_MSG_MAX = 0x15 -+ CRYPTO_NR_MSGTYPES = 0x6 -+ CRYPTO_REPORT_MAXSIZE = 0x160 -+ CS5 = 0x0 -+ CS6 = 0x10 -+ CS7 = 0x20 -+ CS8 = 0x30 -+ CSIGNAL = 0xff -+ CSIZE = 0x30 -+ CSTART = 0x11 -+ CSTATUS = 0x0 -+ CSTOP = 0x13 -+ CSTOPB = 0x40 -+ CSUSP = 0x1a -+ DAXFS_MAGIC = 0x64646178 -+ DEBUGFS_MAGIC = 0x64626720 -+ DEVPTS_SUPER_MAGIC = 0x1cd1 -+ DT_BLK = 0x6 -+ DT_CHR = 0x2 -+ DT_DIR = 0x4 -+ DT_FIFO = 0x1 -+ DT_LNK = 0xa -+ DT_REG = 0x8 -+ DT_SOCK = 0xc -+ DT_UNKNOWN = 0x0 -+ DT_WHT = 0xe -+ ECHO = 0x8 -+ ECHOCTL = 0x200 -+ ECHOE = 0x10 -+ ECHOK = 0x20 -+ ECHOKE = 0x800 -+ ECHONL = 0x40 -+ ECHOPRT = 0x400 -+ ECRYPTFS_SUPER_MAGIC = 0xf15f -+ EFD_CLOEXEC = 0x80000 -+ EFD_NONBLOCK = 0x800 -+ EFD_SEMAPHORE = 0x1 -+ EFIVARFS_MAGIC = 0xde5e81e4 -+ EFS_SUPER_MAGIC = 0x414a53 -+ ENCODING_DEFAULT = 0x0 -+ ENCODING_FM_MARK = 0x3 -+ ENCODING_FM_SPACE = 0x4 -+ ENCODING_MANCHESTER = 0x5 -+ ENCODING_NRZ = 0x1 -+ ENCODING_NRZI = 0x2 -+ EPOLLERR = 0x8 -+ EPOLLET = 0x80000000 -+ EPOLLEXCLUSIVE = 0x10000000 -+ EPOLLHUP = 0x10 -+ EPOLLIN = 0x1 -+ EPOLLMSG = 0x400 -+ EPOLLONESHOT = 0x40000000 -+ EPOLLOUT = 0x4 -+ EPOLLPRI = 0x2 -+ EPOLLRDBAND = 0x80 -+ EPOLLRDHUP = 0x2000 -+ EPOLLRDNORM = 0x40 -+ EPOLLWAKEUP = 0x20000000 -+ EPOLLWRBAND = 0x200 -+ EPOLLWRNORM = 0x100 -+ EPOLL_CLOEXEC = 0x80000 -+ EPOLL_CTL_ADD = 0x1 -+ EPOLL_CTL_DEL = 0x2 -+ EPOLL_CTL_MOD = 0x3 -+ ETH_P_1588 = 0x88f7 -+ ETH_P_8021AD = 0x88a8 -+ ETH_P_8021AH = 0x88e7 -+ ETH_P_8021Q = 0x8100 -+ ETH_P_80221 = 0x8917 -+ ETH_P_802_2 = 0x4 -+ ETH_P_802_3 = 0x1 -+ ETH_P_802_3_MIN = 0x600 -+ ETH_P_802_EX1 = 0x88b5 -+ ETH_P_AARP = 0x80f3 -+ ETH_P_AF_IUCV = 0xfbfb -+ ETH_P_ALL = 0x3 -+ ETH_P_AOE = 0x88a2 -+ ETH_P_ARCNET = 0x1a -+ ETH_P_ARP = 0x806 -+ ETH_P_ATALK = 0x809b -+ ETH_P_ATMFATE = 0x8884 -+ ETH_P_ATMMPOA = 0x884c -+ ETH_P_AX25 = 0x2 -+ ETH_P_BATMAN = 0x4305 -+ ETH_P_BPQ = 0x8ff -+ ETH_P_CAIF = 0xf7 -+ ETH_P_CAN = 0xc -+ ETH_P_CANFD = 0xd -+ ETH_P_CONTROL = 0x16 -+ ETH_P_CUST = 0x6006 -+ ETH_P_DDCMP = 0x6 -+ ETH_P_DEC = 0x6000 -+ ETH_P_DIAG = 0x6005 -+ ETH_P_DNA_DL = 0x6001 -+ ETH_P_DNA_RC = 0x6002 -+ ETH_P_DNA_RT = 0x6003 -+ ETH_P_DSA = 0x1b -+ ETH_P_ECONET = 0x18 -+ ETH_P_EDSA = 0xdada -+ ETH_P_ERSPAN = 0x88be -+ ETH_P_ERSPAN2 = 0x22eb -+ ETH_P_FCOE = 0x8906 -+ ETH_P_FIP = 0x8914 -+ ETH_P_HDLC = 0x19 -+ ETH_P_HSR = 0x892f -+ ETH_P_IBOE = 0x8915 -+ ETH_P_IEEE802154 = 0xf6 -+ ETH_P_IEEEPUP = 0xa00 -+ ETH_P_IEEEPUPAT = 0xa01 -+ ETH_P_IFE = 0xed3e -+ ETH_P_IP = 0x800 -+ ETH_P_IPV6 = 0x86dd -+ ETH_P_IPX = 0x8137 -+ ETH_P_IRDA = 0x17 -+ ETH_P_LAT = 0x6004 -+ ETH_P_LINK_CTL = 0x886c -+ ETH_P_LOCALTALK = 0x9 -+ ETH_P_LOOP = 0x60 -+ ETH_P_LOOPBACK = 0x9000 -+ ETH_P_MACSEC = 0x88e5 -+ ETH_P_MAP = 0xf9 -+ ETH_P_MOBITEX = 0x15 -+ ETH_P_MPLS_MC = 0x8848 -+ ETH_P_MPLS_UC = 0x8847 -+ ETH_P_MVRP = 0x88f5 -+ ETH_P_NCSI = 0x88f8 -+ ETH_P_NSH = 0x894f -+ ETH_P_PAE = 0x888e -+ ETH_P_PAUSE = 0x8808 -+ ETH_P_PHONET = 0xf5 -+ ETH_P_PPPTALK = 0x10 -+ ETH_P_PPP_DISC = 0x8863 -+ ETH_P_PPP_MP = 0x8 -+ ETH_P_PPP_SES = 0x8864 -+ ETH_P_PREAUTH = 0x88c7 -+ ETH_P_PRP = 0x88fb -+ ETH_P_PUP = 0x200 -+ ETH_P_PUPAT = 0x201 -+ ETH_P_QINQ1 = 0x9100 -+ ETH_P_QINQ2 = 0x9200 -+ ETH_P_QINQ3 = 0x9300 -+ ETH_P_RARP = 0x8035 -+ ETH_P_SCA = 0x6007 -+ ETH_P_SLOW = 0x8809 -+ ETH_P_SNAP = 0x5 -+ ETH_P_TDLS = 0x890d -+ ETH_P_TEB = 0x6558 -+ ETH_P_TIPC = 0x88ca -+ ETH_P_TRAILER = 0x1c -+ ETH_P_TR_802_2 = 0x11 -+ ETH_P_TSN = 0x22f0 -+ ETH_P_WAN_PPP = 0x7 -+ ETH_P_WCCP = 0x883e -+ ETH_P_X25 = 0x805 -+ ETH_P_XDSA = 0xf8 -+ EXABYTE_ENABLE_NEST = 0xf0 -+ EXT2_SUPER_MAGIC = 0xef53 -+ EXT3_SUPER_MAGIC = 0xef53 -+ EXT4_SUPER_MAGIC = 0xef53 -+ EXTA = 0xe -+ EXTB = 0xf -+ EXTPROC = 0x10000 -+ F2FS_SUPER_MAGIC = 0xf2f52010 -+ FALLOC_FL_COLLAPSE_RANGE = 0x8 -+ FALLOC_FL_INSERT_RANGE = 0x20 -+ FALLOC_FL_KEEP_SIZE = 0x1 -+ FALLOC_FL_NO_HIDE_STALE = 0x4 -+ FALLOC_FL_PUNCH_HOLE = 0x2 -+ FALLOC_FL_UNSHARE_RANGE = 0x40 -+ FALLOC_FL_ZERO_RANGE = 0x10 -+ FANOTIFY_METADATA_VERSION = 0x3 -+ FAN_ACCESS = 0x1 -+ FAN_ACCESS_PERM = 0x20000 -+ FAN_ALLOW = 0x1 -+ FAN_ALL_CLASS_BITS = 0xc -+ FAN_ALL_EVENTS = 0x3b -+ FAN_ALL_INIT_FLAGS = 0x3f -+ FAN_ALL_MARK_FLAGS = 0xff -+ FAN_ALL_OUTGOING_EVENTS = 0x3403b -+ FAN_ALL_PERM_EVENTS = 0x30000 -+ FAN_AUDIT = 0x10 -+ FAN_CLASS_CONTENT = 0x4 -+ FAN_CLASS_NOTIF = 0x0 -+ FAN_CLASS_PRE_CONTENT = 0x8 -+ FAN_CLOEXEC = 0x1 -+ FAN_CLOSE = 0x18 -+ FAN_CLOSE_NOWRITE = 0x10 -+ FAN_CLOSE_WRITE = 0x8 -+ FAN_DENY = 0x2 -+ FAN_ENABLE_AUDIT = 0x40 -+ FAN_EVENT_METADATA_LEN = 0x18 -+ FAN_EVENT_ON_CHILD = 0x8000000 -+ FAN_MARK_ADD = 0x1 -+ FAN_MARK_DONT_FOLLOW = 0x4 -+ FAN_MARK_FILESYSTEM = 0x100 -+ FAN_MARK_FLUSH = 0x80 -+ FAN_MARK_IGNORED_MASK = 0x20 -+ FAN_MARK_IGNORED_SURV_MODIFY = 0x40 -+ FAN_MARK_INODE = 0x0 -+ FAN_MARK_MOUNT = 0x10 -+ FAN_MARK_ONLYDIR = 0x8 -+ FAN_MARK_REMOVE = 0x2 -+ FAN_MODIFY = 0x2 -+ FAN_NOFD = -0x1 -+ FAN_NONBLOCK = 0x2 -+ FAN_ONDIR = 0x40000000 -+ FAN_OPEN = 0x20 -+ FAN_OPEN_EXEC = 0x1000 -+ FAN_OPEN_EXEC_PERM = 0x40000 -+ FAN_OPEN_PERM = 0x10000 -+ FAN_Q_OVERFLOW = 0x4000 -+ FAN_REPORT_TID = 0x100 -+ FAN_UNLIMITED_MARKS = 0x20 -+ FAN_UNLIMITED_QUEUE = 0x10 -+ FD_CLOEXEC = 0x1 -+ FD_SETSIZE = 0x400 -+ FF0 = 0x0 -+ FF1 = 0x8000 -+ FFDLY = 0x8000 -+ FLUSHO = 0x1000 -+ FS_ENCRYPTION_MODE_ADIANTUM = 0x9 -+ FS_ENCRYPTION_MODE_AES_128_CBC = 0x5 -+ FS_ENCRYPTION_MODE_AES_128_CTS = 0x6 -+ FS_ENCRYPTION_MODE_AES_256_CBC = 0x3 -+ FS_ENCRYPTION_MODE_AES_256_CTS = 0x4 -+ FS_ENCRYPTION_MODE_AES_256_GCM = 0x2 -+ FS_ENCRYPTION_MODE_AES_256_XTS = 0x1 -+ FS_ENCRYPTION_MODE_INVALID = 0x0 -+ FS_ENCRYPTION_MODE_SPECK128_256_CTS = 0x8 -+ FS_ENCRYPTION_MODE_SPECK128_256_XTS = 0x7 -+ FS_IOC_GET_ENCRYPTION_POLICY = 0x400c6615 -+ FS_IOC_GET_ENCRYPTION_PWSALT = 0x40106614 -+ FS_IOC_SET_ENCRYPTION_POLICY = 0x800c6613 -+ FS_KEY_DESCRIPTOR_SIZE = 0x8 -+ FS_KEY_DESC_PREFIX = "fscrypt:" -+ FS_KEY_DESC_PREFIX_SIZE = 0x8 -+ FS_MAX_KEY_SIZE = 0x40 -+ FS_POLICY_FLAGS_PAD_16 = 0x2 -+ FS_POLICY_FLAGS_PAD_32 = 0x3 -+ FS_POLICY_FLAGS_PAD_4 = 0x0 -+ FS_POLICY_FLAGS_PAD_8 = 0x1 -+ FS_POLICY_FLAGS_PAD_MASK = 0x3 -+ FS_POLICY_FLAGS_VALID = 0x7 -+ FUTEXFS_SUPER_MAGIC = 0xbad1dea -+ F_ADD_SEALS = 0x409 -+ F_DUPFD = 0x0 -+ F_DUPFD_CLOEXEC = 0x406 -+ F_EXLCK = 0x4 -+ F_GETFD = 0x1 -+ F_GETFL = 0x3 -+ F_GETLEASE = 0x401 -+ F_GETLK = 0x5 -+ F_GETLK64 = 0x5 -+ F_GETOWN = 0x9 -+ F_GETOWN_EX = 0x10 -+ F_GETPIPE_SZ = 0x408 -+ F_GETSIG = 0xb -+ F_GET_FILE_RW_HINT = 0x40d -+ F_GET_RW_HINT = 0x40b -+ F_GET_SEALS = 0x40a -+ F_LOCK = 0x1 -+ F_NOTIFY = 0x402 -+ F_OFD_GETLK = 0x24 -+ F_OFD_SETLK = 0x25 -+ F_OFD_SETLKW = 0x26 -+ F_OK = 0x0 -+ F_RDLCK = 0x0 -+ F_SEAL_GROW = 0x4 -+ F_SEAL_SEAL = 0x1 -+ F_SEAL_SHRINK = 0x2 -+ F_SEAL_WRITE = 0x8 -+ F_SETFD = 0x2 -+ F_SETFL = 0x4 -+ F_SETLEASE = 0x400 -+ F_SETLK = 0x6 -+ F_SETLK64 = 0x6 -+ F_SETLKW = 0x7 -+ F_SETLKW64 = 0x7 -+ F_SETOWN = 0x8 -+ F_SETOWN_EX = 0xf -+ F_SETPIPE_SZ = 0x407 -+ F_SETSIG = 0xa -+ F_SET_FILE_RW_HINT = 0x40e -+ F_SET_RW_HINT = 0x40c -+ F_SHLCK = 0x8 -+ F_TEST = 0x3 -+ F_TLOCK = 0x2 -+ F_ULOCK = 0x0 -+ F_UNLCK = 0x2 -+ F_WRLCK = 0x1 -+ GENL_ADMIN_PERM = 0x1 -+ GENL_CMD_CAP_DO = 0x2 -+ GENL_CMD_CAP_DUMP = 0x4 -+ GENL_CMD_CAP_HASPOL = 0x8 -+ GENL_HDRLEN = 0x4 -+ GENL_ID_CTRL = 0x10 -+ GENL_ID_PMCRAID = 0x12 -+ GENL_ID_VFS_DQUOT = 0x11 -+ GENL_MAX_ID = 0x3ff -+ GENL_MIN_ID = 0x10 -+ GENL_NAMSIZ = 0x10 -+ GENL_START_ALLOC = 0x13 -+ GENL_UNS_ADMIN_PERM = 0x10 -+ GRND_NONBLOCK = 0x1 -+ GRND_RANDOM = 0x2 -+ HDIO_DRIVE_CMD = 0x31f -+ HDIO_DRIVE_CMD_AEB = 0x31e -+ HDIO_DRIVE_CMD_HDR_SIZE = 0x4 -+ HDIO_DRIVE_HOB_HDR_SIZE = 0x8 -+ HDIO_DRIVE_RESET = 0x31c -+ HDIO_DRIVE_TASK = 0x31e -+ HDIO_DRIVE_TASKFILE = 0x31d -+ HDIO_DRIVE_TASK_HDR_SIZE = 0x8 -+ HDIO_GETGEO = 0x301 -+ HDIO_GET_32BIT = 0x309 -+ HDIO_GET_ACOUSTIC = 0x30f -+ HDIO_GET_ADDRESS = 0x310 -+ HDIO_GET_BUSSTATE = 0x31a -+ HDIO_GET_DMA = 0x30b -+ HDIO_GET_IDENTITY = 0x30d -+ HDIO_GET_KEEPSETTINGS = 0x308 -+ HDIO_GET_MULTCOUNT = 0x304 -+ HDIO_GET_NICE = 0x30c -+ HDIO_GET_NOWERR = 0x30a -+ HDIO_GET_QDMA = 0x305 -+ HDIO_GET_UNMASKINTR = 0x302 -+ HDIO_GET_WCACHE = 0x30e -+ HDIO_OBSOLETE_IDENTITY = 0x307 -+ HDIO_SCAN_HWIF = 0x328 -+ HDIO_SET_32BIT = 0x324 -+ HDIO_SET_ACOUSTIC = 0x32c -+ HDIO_SET_ADDRESS = 0x32f -+ HDIO_SET_BUSSTATE = 0x32d -+ HDIO_SET_DMA = 0x326 -+ HDIO_SET_KEEPSETTINGS = 0x323 -+ HDIO_SET_MULTCOUNT = 0x321 -+ HDIO_SET_NICE = 0x329 -+ HDIO_SET_NOWERR = 0x325 -+ HDIO_SET_PIO_MODE = 0x327 -+ HDIO_SET_QDMA = 0x32e -+ HDIO_SET_UNMASKINTR = 0x322 -+ HDIO_SET_WCACHE = 0x32b -+ HDIO_SET_XFER = 0x306 -+ HDIO_TRISTATE_HWIF = 0x31b -+ HDIO_UNREGISTER_HWIF = 0x32a -+ HOSTFS_SUPER_MAGIC = 0xc0ffee -+ HPFS_SUPER_MAGIC = 0xf995e849 -+ HUGETLBFS_MAGIC = 0x958458f6 -+ HUPCL = 0x400 -+ IBSHIFT = 0x10 -+ ICANON = 0x2 -+ ICMPV6_FILTER = 0x1 -+ ICRNL = 0x100 -+ IEXTEN = 0x8000 -+ IFA_F_DADFAILED = 0x8 -+ IFA_F_DEPRECATED = 0x20 -+ IFA_F_HOMEADDRESS = 0x10 -+ IFA_F_MANAGETEMPADDR = 0x100 -+ IFA_F_MCAUTOJOIN = 0x400 -+ IFA_F_NODAD = 0x2 -+ IFA_F_NOPREFIXROUTE = 0x200 -+ IFA_F_OPTIMISTIC = 0x4 -+ IFA_F_PERMANENT = 0x80 -+ IFA_F_SECONDARY = 0x1 -+ IFA_F_STABLE_PRIVACY = 0x800 -+ IFA_F_TEMPORARY = 0x1 -+ IFA_F_TENTATIVE = 0x40 -+ IFA_MAX = 0xa -+ IFF_ALLMULTI = 0x200 -+ IFF_ATTACH_QUEUE = 0x200 -+ IFF_AUTOMEDIA = 0x4000 -+ IFF_BROADCAST = 0x2 -+ IFF_DEBUG = 0x4 -+ IFF_DETACH_QUEUE = 0x400 -+ IFF_DORMANT = 0x20000 -+ IFF_DYNAMIC = 0x8000 -+ IFF_ECHO = 0x40000 -+ IFF_LOOPBACK = 0x8 -+ IFF_LOWER_UP = 0x10000 -+ IFF_MASTER = 0x400 -+ IFF_MULTICAST = 0x1000 -+ IFF_MULTI_QUEUE = 0x100 -+ IFF_NAPI = 0x10 -+ IFF_NAPI_FRAGS = 0x20 -+ IFF_NOARP = 0x80 -+ IFF_NOFILTER = 0x1000 -+ IFF_NOTRAILERS = 0x20 -+ IFF_NO_PI = 0x1000 -+ IFF_ONE_QUEUE = 0x2000 -+ IFF_PERSIST = 0x800 -+ IFF_POINTOPOINT = 0x10 -+ IFF_PORTSEL = 0x2000 -+ IFF_PROMISC = 0x100 -+ IFF_RUNNING = 0x40 -+ IFF_SLAVE = 0x800 -+ IFF_TAP = 0x2 -+ IFF_TUN = 0x1 -+ IFF_TUN_EXCL = 0x8000 -+ IFF_UP = 0x1 -+ IFF_VNET_HDR = 0x4000 -+ IFF_VOLATILE = 0x70c5a -+ IFNAMSIZ = 0x10 -+ IGNBRK = 0x1 -+ IGNCR = 0x80 -+ IGNPAR = 0x4 -+ IMAXBEL = 0x2000 -+ INLCR = 0x40 -+ INPCK = 0x10 -+ IN_ACCESS = 0x1 -+ IN_ALL_EVENTS = 0xfff -+ IN_ATTRIB = 0x4 -+ IN_CLASSA_HOST = 0xffffff -+ IN_CLASSA_MAX = 0x80 -+ IN_CLASSA_NET = 0xff000000 -+ IN_CLASSA_NSHIFT = 0x18 -+ IN_CLASSB_HOST = 0xffff -+ IN_CLASSB_MAX = 0x10000 -+ IN_CLASSB_NET = 0xffff0000 -+ IN_CLASSB_NSHIFT = 0x10 -+ IN_CLASSC_HOST = 0xff -+ IN_CLASSC_NET = 0xffffff00 -+ IN_CLASSC_NSHIFT = 0x8 -+ IN_CLOEXEC = 0x80000 -+ IN_CLOSE = 0x18 -+ IN_CLOSE_NOWRITE = 0x10 -+ IN_CLOSE_WRITE = 0x8 -+ IN_CREATE = 0x100 -+ IN_DELETE = 0x200 -+ IN_DELETE_SELF = 0x400 -+ IN_DONT_FOLLOW = 0x2000000 -+ IN_EXCL_UNLINK = 0x4000000 -+ IN_IGNORED = 0x8000 -+ IN_ISDIR = 0x40000000 -+ IN_LOOPBACKNET = 0x7f -+ IN_MASK_ADD = 0x20000000 -+ IN_MASK_CREATE = 0x10000000 -+ IN_MODIFY = 0x2 -+ IN_MOVE = 0xc0 -+ IN_MOVED_FROM = 0x40 -+ IN_MOVED_TO = 0x80 -+ IN_MOVE_SELF = 0x800 -+ IN_NONBLOCK = 0x800 -+ IN_ONESHOT = 0x80000000 -+ IN_ONLYDIR = 0x1000000 -+ IN_OPEN = 0x20 -+ IN_Q_OVERFLOW = 0x4000 -+ IN_UNMOUNT = 0x2000 -+ IOCTL_VM_SOCKETS_GET_LOCAL_CID = 0x7b9 -+ IPPROTO_AH = 0x33 -+ IPPROTO_BEETPH = 0x5e -+ IPPROTO_COMP = 0x6c -+ IPPROTO_DCCP = 0x21 -+ IPPROTO_DSTOPTS = 0x3c -+ IPPROTO_EGP = 0x8 -+ IPPROTO_ENCAP = 0x62 -+ IPPROTO_ESP = 0x32 -+ IPPROTO_FRAGMENT = 0x2c -+ IPPROTO_GRE = 0x2f -+ IPPROTO_HOPOPTS = 0x0 -+ IPPROTO_ICMP = 0x1 -+ IPPROTO_ICMPV6 = 0x3a -+ IPPROTO_IDP = 0x16 -+ IPPROTO_IGMP = 0x2 -+ IPPROTO_IP = 0x0 -+ IPPROTO_IPIP = 0x4 -+ IPPROTO_IPV6 = 0x29 -+ IPPROTO_MH = 0x87 -+ IPPROTO_MPLS = 0x89 -+ IPPROTO_MTP = 0x5c -+ IPPROTO_NONE = 0x3b -+ IPPROTO_PIM = 0x67 -+ IPPROTO_PUP = 0xc -+ IPPROTO_RAW = 0xff -+ IPPROTO_ROUTING = 0x2b -+ IPPROTO_RSVP = 0x2e -+ IPPROTO_SCTP = 0x84 -+ IPPROTO_TCP = 0x6 -+ IPPROTO_TP = 0x1d -+ IPPROTO_UDP = 0x11 -+ IPPROTO_UDPLITE = 0x88 -+ IPV6_2292DSTOPTS = 0x4 -+ IPV6_2292HOPLIMIT = 0x8 -+ IPV6_2292HOPOPTS = 0x3 -+ IPV6_2292PKTINFO = 0x2 -+ IPV6_2292PKTOPTIONS = 0x6 -+ IPV6_2292RTHDR = 0x5 -+ IPV6_ADDRFORM = 0x1 -+ IPV6_ADDR_PREFERENCES = 0x48 -+ IPV6_ADD_MEMBERSHIP = 0x14 -+ IPV6_AUTHHDR = 0xa -+ IPV6_AUTOFLOWLABEL = 0x46 -+ IPV6_CHECKSUM = 0x7 -+ IPV6_DONTFRAG = 0x3e -+ IPV6_DROP_MEMBERSHIP = 0x15 -+ IPV6_DSTOPTS = 0x3b -+ IPV6_FREEBIND = 0x4e -+ IPV6_HDRINCL = 0x24 -+ IPV6_HOPLIMIT = 0x34 -+ IPV6_HOPOPTS = 0x36 -+ IPV6_IPSEC_POLICY = 0x22 -+ IPV6_JOIN_ANYCAST = 0x1b -+ IPV6_JOIN_GROUP = 0x14 -+ IPV6_LEAVE_ANYCAST = 0x1c -+ IPV6_LEAVE_GROUP = 0x15 -+ IPV6_MINHOPCOUNT = 0x49 -+ IPV6_MTU = 0x18 -+ IPV6_MTU_DISCOVER = 0x17 -+ IPV6_MULTICAST_ALL = 0x1d -+ IPV6_MULTICAST_HOPS = 0x12 -+ IPV6_MULTICAST_IF = 0x11 -+ IPV6_MULTICAST_LOOP = 0x13 -+ IPV6_NEXTHOP = 0x9 -+ IPV6_ORIGDSTADDR = 0x4a -+ IPV6_PATHMTU = 0x3d -+ IPV6_PKTINFO = 0x32 -+ IPV6_PMTUDISC_DO = 0x2 -+ IPV6_PMTUDISC_DONT = 0x0 -+ IPV6_PMTUDISC_INTERFACE = 0x4 -+ IPV6_PMTUDISC_OMIT = 0x5 -+ IPV6_PMTUDISC_PROBE = 0x3 -+ IPV6_PMTUDISC_WANT = 0x1 -+ IPV6_RECVDSTOPTS = 0x3a -+ IPV6_RECVERR = 0x19 -+ IPV6_RECVFRAGSIZE = 0x4d -+ IPV6_RECVHOPLIMIT = 0x33 -+ IPV6_RECVHOPOPTS = 0x35 -+ IPV6_RECVORIGDSTADDR = 0x4a -+ IPV6_RECVPATHMTU = 0x3c -+ IPV6_RECVPKTINFO = 0x31 -+ IPV6_RECVRTHDR = 0x38 -+ IPV6_RECVTCLASS = 0x42 -+ IPV6_ROUTER_ALERT = 0x16 -+ IPV6_RTHDR = 0x39 -+ IPV6_RTHDRDSTOPTS = 0x37 -+ IPV6_RTHDR_LOOSE = 0x0 -+ IPV6_RTHDR_STRICT = 0x1 -+ IPV6_RTHDR_TYPE_0 = 0x0 -+ IPV6_RXDSTOPTS = 0x3b -+ IPV6_RXHOPOPTS = 0x36 -+ IPV6_TCLASS = 0x43 -+ IPV6_TRANSPARENT = 0x4b -+ IPV6_UNICAST_HOPS = 0x10 -+ IPV6_UNICAST_IF = 0x4c -+ IPV6_V6ONLY = 0x1a -+ IPV6_XFRM_POLICY = 0x23 -+ IP_ADD_MEMBERSHIP = 0x23 -+ IP_ADD_SOURCE_MEMBERSHIP = 0x27 -+ IP_BIND_ADDRESS_NO_PORT = 0x18 -+ IP_BLOCK_SOURCE = 0x26 -+ IP_CHECKSUM = 0x17 -+ IP_DEFAULT_MULTICAST_LOOP = 0x1 -+ IP_DEFAULT_MULTICAST_TTL = 0x1 -+ IP_DF = 0x4000 -+ IP_DROP_MEMBERSHIP = 0x24 -+ IP_DROP_SOURCE_MEMBERSHIP = 0x28 -+ IP_FREEBIND = 0xf -+ IP_HDRINCL = 0x3 -+ IP_IPSEC_POLICY = 0x10 -+ IP_MAXPACKET = 0xffff -+ IP_MAX_MEMBERSHIPS = 0x14 -+ IP_MF = 0x2000 -+ IP_MINTTL = 0x15 -+ IP_MSFILTER = 0x29 -+ IP_MSS = 0x240 -+ IP_MTU = 0xe -+ IP_MTU_DISCOVER = 0xa -+ IP_MULTICAST_ALL = 0x31 -+ IP_MULTICAST_IF = 0x20 -+ IP_MULTICAST_LOOP = 0x22 -+ IP_MULTICAST_TTL = 0x21 -+ IP_NODEFRAG = 0x16 -+ IP_OFFMASK = 0x1fff -+ IP_OPTIONS = 0x4 -+ IP_ORIGDSTADDR = 0x14 -+ IP_PASSSEC = 0x12 -+ IP_PKTINFO = 0x8 -+ IP_PKTOPTIONS = 0x9 -+ IP_PMTUDISC = 0xa -+ IP_PMTUDISC_DO = 0x2 -+ IP_PMTUDISC_DONT = 0x0 -+ IP_PMTUDISC_INTERFACE = 0x4 -+ IP_PMTUDISC_OMIT = 0x5 -+ IP_PMTUDISC_PROBE = 0x3 -+ IP_PMTUDISC_WANT = 0x1 -+ IP_RECVERR = 0xb -+ IP_RECVFRAGSIZE = 0x19 -+ IP_RECVOPTS = 0x6 -+ IP_RECVORIGDSTADDR = 0x14 -+ IP_RECVRETOPTS = 0x7 -+ IP_RECVTOS = 0xd -+ IP_RECVTTL = 0xc -+ IP_RETOPTS = 0x7 -+ IP_RF = 0x8000 -+ IP_ROUTER_ALERT = 0x5 -+ IP_TOS = 0x1 -+ IP_TRANSPARENT = 0x13 -+ IP_TTL = 0x2 -+ IP_UNBLOCK_SOURCE = 0x25 -+ IP_UNICAST_IF = 0x32 -+ IP_XFRM_POLICY = 0x11 -+ ISIG = 0x1 -+ ISOFS_SUPER_MAGIC = 0x9660 -+ ISTRIP = 0x20 -+ IUCLC = 0x200 -+ IUTF8 = 0x4000 -+ IXANY = 0x800 -+ IXOFF = 0x1000 -+ IXON = 0x400 -+ JFFS2_SUPER_MAGIC = 0x72b6 -+ KEXEC_ARCH_386 = 0x30000 -+ KEXEC_ARCH_68K = 0x40000 -+ KEXEC_ARCH_AARCH64 = 0xb70000 -+ KEXEC_ARCH_ARM = 0x280000 -+ KEXEC_ARCH_DEFAULT = 0x0 -+ KEXEC_ARCH_IA_64 = 0x320000 -+ KEXEC_ARCH_MASK = 0xffff0000 -+ KEXEC_ARCH_MIPS = 0x80000 -+ KEXEC_ARCH_MIPS_LE = 0xa0000 -+ KEXEC_ARCH_PPC = 0x140000 -+ KEXEC_ARCH_PPC64 = 0x150000 -+ KEXEC_ARCH_S390 = 0x160000 -+ KEXEC_ARCH_SH = 0x2a0000 -+ KEXEC_ARCH_X86_64 = 0x3e0000 -+ KEXEC_FILE_NO_INITRAMFS = 0x4 -+ KEXEC_FILE_ON_CRASH = 0x2 -+ KEXEC_FILE_UNLOAD = 0x1 -+ KEXEC_ON_CRASH = 0x1 -+ KEXEC_PRESERVE_CONTEXT = 0x2 -+ KEXEC_SEGMENT_MAX = 0x10 -+ KEYCTL_ASSUME_AUTHORITY = 0x10 -+ KEYCTL_CHOWN = 0x4 -+ KEYCTL_CLEAR = 0x7 -+ KEYCTL_DESCRIBE = 0x6 -+ KEYCTL_DH_COMPUTE = 0x17 -+ KEYCTL_GET_KEYRING_ID = 0x0 -+ KEYCTL_GET_PERSISTENT = 0x16 -+ KEYCTL_GET_SECURITY = 0x11 -+ KEYCTL_INSTANTIATE = 0xc -+ KEYCTL_INSTANTIATE_IOV = 0x14 -+ KEYCTL_INVALIDATE = 0x15 -+ KEYCTL_JOIN_SESSION_KEYRING = 0x1 -+ KEYCTL_LINK = 0x8 -+ KEYCTL_NEGATE = 0xd -+ KEYCTL_PKEY_DECRYPT = 0x1a -+ KEYCTL_PKEY_ENCRYPT = 0x19 -+ KEYCTL_PKEY_QUERY = 0x18 -+ KEYCTL_PKEY_SIGN = 0x1b -+ KEYCTL_PKEY_VERIFY = 0x1c -+ KEYCTL_READ = 0xb -+ KEYCTL_REJECT = 0x13 -+ KEYCTL_RESTRICT_KEYRING = 0x1d -+ KEYCTL_REVOKE = 0x3 -+ KEYCTL_SEARCH = 0xa -+ KEYCTL_SESSION_TO_PARENT = 0x12 -+ KEYCTL_SETPERM = 0x5 -+ KEYCTL_SET_REQKEY_KEYRING = 0xe -+ KEYCTL_SET_TIMEOUT = 0xf -+ KEYCTL_SUPPORTS_DECRYPT = 0x2 -+ KEYCTL_SUPPORTS_ENCRYPT = 0x1 -+ KEYCTL_SUPPORTS_SIGN = 0x4 -+ KEYCTL_SUPPORTS_VERIFY = 0x8 -+ KEYCTL_UNLINK = 0x9 -+ KEYCTL_UPDATE = 0x2 -+ KEY_REQKEY_DEFL_DEFAULT = 0x0 -+ KEY_REQKEY_DEFL_GROUP_KEYRING = 0x6 -+ KEY_REQKEY_DEFL_NO_CHANGE = -0x1 -+ KEY_REQKEY_DEFL_PROCESS_KEYRING = 0x2 -+ KEY_REQKEY_DEFL_REQUESTOR_KEYRING = 0x7 -+ KEY_REQKEY_DEFL_SESSION_KEYRING = 0x3 -+ KEY_REQKEY_DEFL_THREAD_KEYRING = 0x1 -+ KEY_REQKEY_DEFL_USER_KEYRING = 0x4 -+ KEY_REQKEY_DEFL_USER_SESSION_KEYRING = 0x5 -+ KEY_SPEC_GROUP_KEYRING = -0x6 -+ KEY_SPEC_PROCESS_KEYRING = -0x2 -+ KEY_SPEC_REQKEY_AUTH_KEY = -0x7 -+ KEY_SPEC_REQUESTOR_KEYRING = -0x8 -+ KEY_SPEC_SESSION_KEYRING = -0x3 -+ KEY_SPEC_THREAD_KEYRING = -0x1 -+ KEY_SPEC_USER_KEYRING = -0x4 -+ KEY_SPEC_USER_SESSION_KEYRING = -0x5 -+ LINUX_REBOOT_CMD_CAD_OFF = 0x0 -+ LINUX_REBOOT_CMD_CAD_ON = 0x89abcdef -+ LINUX_REBOOT_CMD_HALT = 0xcdef0123 -+ LINUX_REBOOT_CMD_KEXEC = 0x45584543 -+ LINUX_REBOOT_CMD_POWER_OFF = 0x4321fedc -+ LINUX_REBOOT_CMD_RESTART = 0x1234567 -+ LINUX_REBOOT_CMD_RESTART2 = 0xa1b2c3d4 -+ LINUX_REBOOT_CMD_SW_SUSPEND = 0xd000fce2 -+ LINUX_REBOOT_MAGIC1 = 0xfee1dead -+ LINUX_REBOOT_MAGIC2 = 0x28121969 -+ LOCK_EX = 0x2 -+ LOCK_NB = 0x4 -+ LOCK_SH = 0x1 -+ LOCK_UN = 0x8 -+ MADV_DODUMP = 0x11 -+ MADV_DOFORK = 0xb -+ MADV_DONTDUMP = 0x10 -+ MADV_DONTFORK = 0xa -+ MADV_DONTNEED = 0x4 -+ MADV_FREE = 0x8 -+ MADV_HUGEPAGE = 0xe -+ MADV_HWPOISON = 0x64 -+ MADV_KEEPONFORK = 0x13 -+ MADV_MERGEABLE = 0xc -+ MADV_NOHUGEPAGE = 0xf -+ MADV_NORMAL = 0x0 -+ MADV_RANDOM = 0x1 -+ MADV_REMOVE = 0x9 -+ MADV_SEQUENTIAL = 0x2 -+ MADV_UNMERGEABLE = 0xd -+ MADV_WILLNEED = 0x3 -+ MADV_WIPEONFORK = 0x12 -+ MAP_ANON = 0x20 -+ MAP_ANONYMOUS = 0x20 -+ MAP_DENYWRITE = 0x800 -+ MAP_EXECUTABLE = 0x1000 -+ MAP_FILE = 0x0 -+ MAP_FIXED = 0x10 -+ MAP_FIXED_NOREPLACE = 0x100000 -+ MAP_GROWSDOWN = 0x100 -+ MAP_HUGETLB = 0x40000 -+ MAP_HUGE_MASK = 0x3f -+ MAP_HUGE_SHIFT = 0x1a -+ MAP_LOCKED = 0x2000 -+ MAP_NONBLOCK = 0x10000 -+ MAP_NORESERVE = 0x4000 -+ MAP_POPULATE = 0x8000 -+ MAP_PRIVATE = 0x2 -+ MAP_SHARED = 0x1 -+ MAP_SHARED_VALIDATE = 0x3 -+ MAP_STACK = 0x20000 -+ MAP_SYNC = 0x80000 -+ MAP_TYPE = 0xf -+ MCL_CURRENT = 0x1 -+ MCL_FUTURE = 0x2 -+ MCL_ONFAULT = 0x4 -+ MFD_ALLOW_SEALING = 0x2 -+ MFD_CLOEXEC = 0x1 -+ MFD_HUGETLB = 0x4 -+ MFD_HUGE_16GB = -0x78000000 -+ MFD_HUGE_16MB = 0x60000000 -+ MFD_HUGE_1GB = 0x78000000 -+ MFD_HUGE_1MB = 0x50000000 -+ MFD_HUGE_256MB = 0x70000000 -+ MFD_HUGE_2GB = 0x7c000000 -+ MFD_HUGE_2MB = 0x54000000 -+ MFD_HUGE_32MB = 0x64000000 -+ MFD_HUGE_512KB = 0x4c000000 -+ MFD_HUGE_512MB = 0x74000000 -+ MFD_HUGE_64KB = 0x40000000 -+ MFD_HUGE_8MB = 0x5c000000 -+ MFD_HUGE_MASK = 0x3f -+ MFD_HUGE_SHIFT = 0x1a -+ MINIX2_SUPER_MAGIC = 0x2468 -+ MINIX2_SUPER_MAGIC2 = 0x2478 -+ MINIX3_SUPER_MAGIC = 0x4d5a -+ MINIX_SUPER_MAGIC = 0x137f -+ MINIX_SUPER_MAGIC2 = 0x138f -+ MNT_DETACH = 0x2 -+ MNT_EXPIRE = 0x4 -+ MNT_FORCE = 0x1 -+ MODULE_INIT_IGNORE_MODVERSIONS = 0x1 -+ MODULE_INIT_IGNORE_VERMAGIC = 0x2 -+ MSDOS_SUPER_MAGIC = 0x4d44 -+ MSG_BATCH = 0x40000 -+ MSG_CMSG_CLOEXEC = 0x40000000 -+ MSG_CONFIRM = 0x800 -+ MSG_CTRUNC = 0x8 -+ MSG_DONTROUTE = 0x4 -+ MSG_DONTWAIT = 0x40 -+ MSG_EOR = 0x80 -+ MSG_ERRQUEUE = 0x2000 -+ MSG_FASTOPEN = 0x20000000 -+ MSG_FIN = 0x200 -+ MSG_MORE = 0x8000 -+ MSG_NOSIGNAL = 0x4000 -+ MSG_OOB = 0x1 -+ MSG_PEEK = 0x2 -+ MSG_PROXY = 0x10 -+ MSG_RST = 0x1000 -+ MSG_SYN = 0x400 -+ MSG_TRUNC = 0x20 -+ MSG_TRYHARD = 0x4 -+ MSG_WAITALL = 0x100 -+ MSG_WAITFORONE = 0x10000 -+ MSG_ZEROCOPY = 0x4000000 -+ MS_ACTIVE = 0x40000000 -+ MS_ASYNC = 0x1 -+ MS_BIND = 0x1000 -+ MS_BORN = 0x20000000 -+ MS_DIRSYNC = 0x80 -+ MS_INVALIDATE = 0x2 -+ MS_I_VERSION = 0x800000 -+ MS_KERNMOUNT = 0x400000 -+ MS_LAZYTIME = 0x2000000 -+ MS_MANDLOCK = 0x40 -+ MS_MGC_MSK = 0xffff0000 -+ MS_MGC_VAL = 0xc0ed0000 -+ MS_MOVE = 0x2000 -+ MS_NOATIME = 0x400 -+ MS_NODEV = 0x4 -+ MS_NODIRATIME = 0x800 -+ MS_NOEXEC = 0x8 -+ MS_NOREMOTELOCK = 0x8000000 -+ MS_NOSEC = 0x10000000 -+ MS_NOSUID = 0x2 -+ MS_NOUSER = -0x80000000 -+ MS_POSIXACL = 0x10000 -+ MS_PRIVATE = 0x40000 -+ MS_RDONLY = 0x1 -+ MS_REC = 0x4000 -+ MS_RELATIME = 0x200000 -+ MS_REMOUNT = 0x20 -+ MS_RMT_MASK = 0x2800051 -+ MS_SHARED = 0x100000 -+ MS_SILENT = 0x8000 -+ MS_SLAVE = 0x80000 -+ MS_STRICTATIME = 0x1000000 -+ MS_SUBMOUNT = 0x4000000 -+ MS_SYNC = 0x4 -+ MS_SYNCHRONOUS = 0x10 -+ MS_UNBINDABLE = 0x20000 -+ MS_VERBOSE = 0x8000 -+ MTD_INODE_FS_MAGIC = 0x11307854 -+ NAME_MAX = 0xff -+ NCP_SUPER_MAGIC = 0x564c -+ NETLINK_ADD_MEMBERSHIP = 0x1 -+ NETLINK_AUDIT = 0x9 -+ NETLINK_BROADCAST_ERROR = 0x4 -+ NETLINK_CAP_ACK = 0xa -+ NETLINK_CONNECTOR = 0xb -+ NETLINK_CRYPTO = 0x15 -+ NETLINK_DNRTMSG = 0xe -+ NETLINK_DROP_MEMBERSHIP = 0x2 -+ NETLINK_ECRYPTFS = 0x13 -+ NETLINK_EXT_ACK = 0xb -+ NETLINK_FIB_LOOKUP = 0xa -+ NETLINK_FIREWALL = 0x3 -+ NETLINK_GENERIC = 0x10 -+ NETLINK_GET_STRICT_CHK = 0xc -+ NETLINK_INET_DIAG = 0x4 -+ NETLINK_IP6_FW = 0xd -+ NETLINK_ISCSI = 0x8 -+ NETLINK_KOBJECT_UEVENT = 0xf -+ NETLINK_LISTEN_ALL_NSID = 0x8 -+ NETLINK_LIST_MEMBERSHIPS = 0x9 -+ NETLINK_NETFILTER = 0xc -+ NETLINK_NFLOG = 0x5 -+ NETLINK_NO_ENOBUFS = 0x5 -+ NETLINK_PKTINFO = 0x3 -+ NETLINK_RDMA = 0x14 -+ NETLINK_ROUTE = 0x0 -+ NETLINK_RX_RING = 0x6 -+ NETLINK_SCSITRANSPORT = 0x12 -+ NETLINK_SELINUX = 0x7 -+ NETLINK_SMC = 0x16 -+ NETLINK_SOCK_DIAG = 0x4 -+ NETLINK_TX_RING = 0x7 -+ NETLINK_UNUSED = 0x1 -+ NETLINK_USERSOCK = 0x2 -+ NETLINK_XFRM = 0x6 -+ NETNSA_MAX = 0x5 -+ NETNSA_NSID_NOT_ASSIGNED = -0x1 -+ NFNETLINK_V0 = 0x0 -+ NFNLGRP_ACCT_QUOTA = 0x8 -+ NFNLGRP_CONNTRACK_DESTROY = 0x3 -+ NFNLGRP_CONNTRACK_EXP_DESTROY = 0x6 -+ NFNLGRP_CONNTRACK_EXP_NEW = 0x4 -+ NFNLGRP_CONNTRACK_EXP_UPDATE = 0x5 -+ NFNLGRP_CONNTRACK_NEW = 0x1 -+ NFNLGRP_CONNTRACK_UPDATE = 0x2 -+ NFNLGRP_MAX = 0x9 -+ NFNLGRP_NFTABLES = 0x7 -+ NFNLGRP_NFTRACE = 0x9 -+ NFNLGRP_NONE = 0x0 -+ NFNL_BATCH_MAX = 0x1 -+ NFNL_MSG_BATCH_BEGIN = 0x10 -+ NFNL_MSG_BATCH_END = 0x11 -+ NFNL_NFA_NEST = 0x8000 -+ NFNL_SUBSYS_ACCT = 0x7 -+ NFNL_SUBSYS_COUNT = 0xc -+ NFNL_SUBSYS_CTHELPER = 0x9 -+ NFNL_SUBSYS_CTNETLINK = 0x1 -+ NFNL_SUBSYS_CTNETLINK_EXP = 0x2 -+ NFNL_SUBSYS_CTNETLINK_TIMEOUT = 0x8 -+ NFNL_SUBSYS_IPSET = 0x6 -+ NFNL_SUBSYS_NFTABLES = 0xa -+ NFNL_SUBSYS_NFT_COMPAT = 0xb -+ NFNL_SUBSYS_NONE = 0x0 -+ NFNL_SUBSYS_OSF = 0x5 -+ NFNL_SUBSYS_QUEUE = 0x3 -+ NFNL_SUBSYS_ULOG = 0x4 -+ NFS_SUPER_MAGIC = 0x6969 -+ NILFS_SUPER_MAGIC = 0x3434 -+ NL0 = 0x0 -+ NL1 = 0x100 -+ NLA_ALIGNTO = 0x4 -+ NLA_F_NESTED = 0x8000 -+ NLA_F_NET_BYTEORDER = 0x4000 -+ NLA_HDRLEN = 0x4 -+ NLDLY = 0x100 -+ NLMSG_ALIGNTO = 0x4 -+ NLMSG_DONE = 0x3 -+ NLMSG_ERROR = 0x2 -+ NLMSG_HDRLEN = 0x10 -+ NLMSG_MIN_TYPE = 0x10 -+ NLMSG_NOOP = 0x1 -+ NLMSG_OVERRUN = 0x4 -+ NLM_F_ACK = 0x4 -+ NLM_F_ACK_TLVS = 0x200 -+ NLM_F_APPEND = 0x800 -+ NLM_F_ATOMIC = 0x400 -+ NLM_F_CAPPED = 0x100 -+ NLM_F_CREATE = 0x400 -+ NLM_F_DUMP = 0x300 -+ NLM_F_DUMP_FILTERED = 0x20 -+ NLM_F_DUMP_INTR = 0x10 -+ NLM_F_ECHO = 0x8 -+ NLM_F_EXCL = 0x200 -+ NLM_F_MATCH = 0x200 -+ NLM_F_MULTI = 0x2 -+ NLM_F_NONREC = 0x100 -+ NLM_F_REPLACE = 0x100 -+ NLM_F_REQUEST = 0x1 -+ NLM_F_ROOT = 0x100 -+ NOFLSH = 0x80 -+ NSFS_MAGIC = 0x6e736673 -+ OCFS2_SUPER_MAGIC = 0x7461636f -+ OCRNL = 0x8 -+ OFDEL = 0x80 -+ OFILL = 0x40 -+ OLCUC = 0x2 -+ ONLCR = 0x4 -+ ONLRET = 0x20 -+ ONOCR = 0x10 -+ OPENPROM_SUPER_MAGIC = 0x9fa1 -+ OPOST = 0x1 -+ OVERLAYFS_SUPER_MAGIC = 0x794c7630 -+ O_ACCMODE = 0x3 -+ O_APPEND = 0x400 -+ O_ASYNC = 0x2000 -+ O_CLOEXEC = 0x80000 -+ O_CREAT = 0x40 -+ O_DIRECT = 0x4000 -+ O_DIRECTORY = 0x10000 -+ O_DSYNC = 0x1000 -+ O_EXCL = 0x80 -+ O_FSYNC = 0x101000 -+ O_LARGEFILE = 0x0 -+ O_NDELAY = 0x800 -+ O_NOATIME = 0x40000 -+ O_NOCTTY = 0x100 -+ O_NOFOLLOW = 0x20000 -+ O_NONBLOCK = 0x800 -+ O_PATH = 0x200000 -+ O_RDONLY = 0x0 -+ O_RDWR = 0x2 -+ O_RSYNC = 0x101000 -+ O_SYNC = 0x101000 -+ O_TMPFILE = 0x410000 -+ O_TRUNC = 0x200 -+ O_WRONLY = 0x1 -+ PACKET_ADD_MEMBERSHIP = 0x1 -+ PACKET_AUXDATA = 0x8 -+ PACKET_BROADCAST = 0x1 -+ PACKET_COPY_THRESH = 0x7 -+ PACKET_DROP_MEMBERSHIP = 0x2 -+ PACKET_FANOUT = 0x12 -+ PACKET_FANOUT_CBPF = 0x6 -+ PACKET_FANOUT_CPU = 0x2 -+ PACKET_FANOUT_DATA = 0x16 -+ PACKET_FANOUT_EBPF = 0x7 -+ PACKET_FANOUT_FLAG_DEFRAG = 0x8000 -+ PACKET_FANOUT_FLAG_ROLLOVER = 0x1000 -+ PACKET_FANOUT_FLAG_UNIQUEID = 0x2000 -+ PACKET_FANOUT_HASH = 0x0 -+ PACKET_FANOUT_LB = 0x1 -+ PACKET_FANOUT_QM = 0x5 -+ PACKET_FANOUT_RND = 0x4 -+ PACKET_FANOUT_ROLLOVER = 0x3 -+ PACKET_FASTROUTE = 0x6 -+ PACKET_HDRLEN = 0xb -+ PACKET_HOST = 0x0 -+ PACKET_IGNORE_OUTGOING = 0x17 -+ PACKET_KERNEL = 0x7 -+ PACKET_LOOPBACK = 0x5 -+ PACKET_LOSS = 0xe -+ PACKET_MR_ALLMULTI = 0x2 -+ PACKET_MR_MULTICAST = 0x0 -+ PACKET_MR_PROMISC = 0x1 -+ PACKET_MR_UNICAST = 0x3 -+ PACKET_MULTICAST = 0x2 -+ PACKET_ORIGDEV = 0x9 -+ PACKET_OTHERHOST = 0x3 -+ PACKET_OUTGOING = 0x4 -+ PACKET_QDISC_BYPASS = 0x14 -+ PACKET_RECV_OUTPUT = 0x3 -+ PACKET_RESERVE = 0xc -+ PACKET_ROLLOVER_STATS = 0x15 -+ PACKET_RX_RING = 0x5 -+ PACKET_STATISTICS = 0x6 -+ PACKET_TIMESTAMP = 0x11 -+ PACKET_TX_HAS_OFF = 0x13 -+ PACKET_TX_RING = 0xd -+ PACKET_TX_TIMESTAMP = 0x10 -+ PACKET_USER = 0x6 -+ PACKET_VERSION = 0xa -+ PACKET_VNET_HDR = 0xf -+ PARENB = 0x100 -+ PARITY_CRC16_PR0 = 0x2 -+ PARITY_CRC16_PR0_CCITT = 0x4 -+ PARITY_CRC16_PR1 = 0x3 -+ PARITY_CRC16_PR1_CCITT = 0x5 -+ PARITY_CRC32_PR0_CCITT = 0x6 -+ PARITY_CRC32_PR1_CCITT = 0x7 -+ PARITY_DEFAULT = 0x0 -+ PARITY_NONE = 0x1 -+ PARMRK = 0x8 -+ PARODD = 0x200 -+ PENDIN = 0x4000 -+ PERF_EVENT_IOC_DISABLE = 0x2401 -+ PERF_EVENT_IOC_ENABLE = 0x2400 -+ PERF_EVENT_IOC_ID = 0x80082407 -+ PERF_EVENT_IOC_MODIFY_ATTRIBUTES = 0x4008240b -+ PERF_EVENT_IOC_PAUSE_OUTPUT = 0x40042409 -+ PERF_EVENT_IOC_PERIOD = 0x40082404 -+ PERF_EVENT_IOC_QUERY_BPF = 0xc008240a -+ PERF_EVENT_IOC_REFRESH = 0x2402 -+ PERF_EVENT_IOC_RESET = 0x2403 -+ PERF_EVENT_IOC_SET_BPF = 0x40042408 -+ PERF_EVENT_IOC_SET_FILTER = 0x40082406 -+ PERF_EVENT_IOC_SET_OUTPUT = 0x2405 -+ PIPEFS_MAGIC = 0x50495045 -+ PPPIOCATTACH = 0x4004743d -+ PPPIOCATTCHAN = 0x40047438 -+ PPPIOCCONNECT = 0x4004743a -+ PPPIOCDETACH = 0x4004743c -+ PPPIOCDISCONN = 0x7439 -+ PPPIOCGASYNCMAP = 0x80047458 -+ PPPIOCGCHAN = 0x80047437 -+ PPPIOCGDEBUG = 0x80047441 -+ PPPIOCGFLAGS = 0x8004745a -+ PPPIOCGIDLE = 0x8010743f -+ PPPIOCGL2TPSTATS = 0x80487436 -+ PPPIOCGMRU = 0x80047453 -+ PPPIOCGNPMODE = 0xc008744c -+ PPPIOCGRASYNCMAP = 0x80047455 -+ PPPIOCGUNIT = 0x80047456 -+ PPPIOCGXASYNCMAP = 0x80207450 -+ PPPIOCNEWUNIT = 0xc004743e -+ PPPIOCSACTIVE = 0x40107446 -+ PPPIOCSASYNCMAP = 0x40047457 -+ PPPIOCSCOMPRESS = 0x4010744d -+ PPPIOCSDEBUG = 0x40047440 -+ PPPIOCSFLAGS = 0x40047459 -+ PPPIOCSMAXCID = 0x40047451 -+ PPPIOCSMRRU = 0x4004743b -+ PPPIOCSMRU = 0x40047452 -+ PPPIOCSNPMODE = 0x4008744b -+ PPPIOCSPASS = 0x40107447 -+ PPPIOCSRASYNCMAP = 0x40047454 -+ PPPIOCSXASYNCMAP = 0x4020744f -+ PPPIOCXFERUNIT = 0x744e -+ PRIO_PGRP = 0x1 -+ PRIO_PROCESS = 0x0 -+ PRIO_USER = 0x2 -+ PROC_SUPER_MAGIC = 0x9fa0 -+ PROT_EXEC = 0x4 -+ PROT_GROWSDOWN = 0x1000000 -+ PROT_GROWSUP = 0x2000000 -+ PROT_NONE = 0x0 -+ PROT_READ = 0x1 -+ PROT_WRITE = 0x2 -+ PR_CAPBSET_DROP = 0x18 -+ PR_CAPBSET_READ = 0x17 -+ PR_CAP_AMBIENT = 0x2f -+ PR_CAP_AMBIENT_CLEAR_ALL = 0x4 -+ PR_CAP_AMBIENT_IS_SET = 0x1 -+ PR_CAP_AMBIENT_LOWER = 0x3 -+ PR_CAP_AMBIENT_RAISE = 0x2 -+ PR_ENDIAN_BIG = 0x0 -+ PR_ENDIAN_LITTLE = 0x1 -+ PR_ENDIAN_PPC_LITTLE = 0x2 -+ PR_FPEMU_NOPRINT = 0x1 -+ PR_FPEMU_SIGFPE = 0x2 -+ PR_FP_EXC_ASYNC = 0x2 -+ PR_FP_EXC_DISABLED = 0x0 -+ PR_FP_EXC_DIV = 0x10000 -+ PR_FP_EXC_INV = 0x100000 -+ PR_FP_EXC_NONRECOV = 0x1 -+ PR_FP_EXC_OVF = 0x20000 -+ PR_FP_EXC_PRECISE = 0x3 -+ PR_FP_EXC_RES = 0x80000 -+ PR_FP_EXC_SW_ENABLE = 0x80 -+ PR_FP_EXC_UND = 0x40000 -+ PR_FP_MODE_FR = 0x1 -+ PR_FP_MODE_FRE = 0x2 -+ PR_GET_CHILD_SUBREAPER = 0x25 -+ PR_GET_DUMPABLE = 0x3 -+ PR_GET_ENDIAN = 0x13 -+ PR_GET_FPEMU = 0x9 -+ PR_GET_FPEXC = 0xb -+ PR_GET_FP_MODE = 0x2e -+ PR_GET_KEEPCAPS = 0x7 -+ PR_GET_NAME = 0x10 -+ PR_GET_NO_NEW_PRIVS = 0x27 -+ PR_GET_PDEATHSIG = 0x2 -+ PR_GET_SECCOMP = 0x15 -+ PR_GET_SECUREBITS = 0x1b -+ PR_GET_SPECULATION_CTRL = 0x34 -+ PR_GET_THP_DISABLE = 0x2a -+ PR_GET_TID_ADDRESS = 0x28 -+ PR_GET_TIMERSLACK = 0x1e -+ PR_GET_TIMING = 0xd -+ PR_GET_TSC = 0x19 -+ PR_GET_UNALIGN = 0x5 -+ PR_MCE_KILL = 0x21 -+ PR_MCE_KILL_CLEAR = 0x0 -+ PR_MCE_KILL_DEFAULT = 0x2 -+ PR_MCE_KILL_EARLY = 0x1 -+ PR_MCE_KILL_GET = 0x22 -+ PR_MCE_KILL_LATE = 0x0 -+ PR_MCE_KILL_SET = 0x1 -+ PR_MPX_DISABLE_MANAGEMENT = 0x2c -+ PR_MPX_ENABLE_MANAGEMENT = 0x2b -+ PR_PAC_APDAKEY = 0x4 -+ PR_PAC_APDBKEY = 0x8 -+ PR_PAC_APGAKEY = 0x10 -+ PR_PAC_APIAKEY = 0x1 -+ PR_PAC_APIBKEY = 0x2 -+ PR_PAC_RESET_KEYS = 0x36 -+ PR_SET_CHILD_SUBREAPER = 0x24 -+ PR_SET_DUMPABLE = 0x4 -+ PR_SET_ENDIAN = 0x14 -+ PR_SET_FPEMU = 0xa -+ PR_SET_FPEXC = 0xc -+ PR_SET_FP_MODE = 0x2d -+ PR_SET_KEEPCAPS = 0x8 -+ PR_SET_MM = 0x23 -+ PR_SET_MM_ARG_END = 0x9 -+ PR_SET_MM_ARG_START = 0x8 -+ PR_SET_MM_AUXV = 0xc -+ PR_SET_MM_BRK = 0x7 -+ PR_SET_MM_END_CODE = 0x2 -+ PR_SET_MM_END_DATA = 0x4 -+ PR_SET_MM_ENV_END = 0xb -+ PR_SET_MM_ENV_START = 0xa -+ PR_SET_MM_EXE_FILE = 0xd -+ PR_SET_MM_MAP = 0xe -+ PR_SET_MM_MAP_SIZE = 0xf -+ PR_SET_MM_START_BRK = 0x6 -+ PR_SET_MM_START_CODE = 0x1 -+ PR_SET_MM_START_DATA = 0x3 -+ PR_SET_MM_START_STACK = 0x5 -+ PR_SET_NAME = 0xf -+ PR_SET_NO_NEW_PRIVS = 0x26 -+ PR_SET_PDEATHSIG = 0x1 -+ PR_SET_PTRACER = 0x59616d61 -+ PR_SET_PTRACER_ANY = 0xffffffffffffffff -+ PR_SET_SECCOMP = 0x16 -+ PR_SET_SECUREBITS = 0x1c -+ PR_SET_SPECULATION_CTRL = 0x35 -+ PR_SET_THP_DISABLE = 0x29 -+ PR_SET_TIMERSLACK = 0x1d -+ PR_SET_TIMING = 0xe -+ PR_SET_TSC = 0x1a -+ PR_SET_UNALIGN = 0x6 -+ PR_SPEC_DISABLE = 0x4 -+ PR_SPEC_ENABLE = 0x2 -+ PR_SPEC_FORCE_DISABLE = 0x8 -+ PR_SPEC_INDIRECT_BRANCH = 0x1 -+ PR_SPEC_NOT_AFFECTED = 0x0 -+ PR_SPEC_PRCTL = 0x1 -+ PR_SPEC_STORE_BYPASS = 0x0 -+ PR_SVE_GET_VL = 0x33 -+ PR_SVE_SET_VL = 0x32 -+ PR_SVE_SET_VL_ONEXEC = 0x40000 -+ PR_SVE_VL_INHERIT = 0x20000 -+ PR_SVE_VL_LEN_MASK = 0xffff -+ PR_TASK_PERF_EVENTS_DISABLE = 0x1f -+ PR_TASK_PERF_EVENTS_ENABLE = 0x20 -+ PR_TIMING_STATISTICAL = 0x0 -+ PR_TIMING_TIMESTAMP = 0x1 -+ PR_TSC_ENABLE = 0x1 -+ PR_TSC_SIGSEGV = 0x2 -+ PR_UNALIGN_NOPRINT = 0x1 -+ PR_UNALIGN_SIGBUS = 0x2 -+ PSTOREFS_MAGIC = 0x6165676c -+ PTRACE_ATTACH = 0x10 -+ PTRACE_CONT = 0x7 -+ PTRACE_DETACH = 0x11 -+ PTRACE_EVENT_CLONE = 0x3 -+ PTRACE_EVENT_EXEC = 0x4 -+ PTRACE_EVENT_EXIT = 0x6 -+ PTRACE_EVENT_FORK = 0x1 -+ PTRACE_EVENT_SECCOMP = 0x7 -+ PTRACE_EVENT_STOP = 0x80 -+ PTRACE_EVENT_VFORK = 0x2 -+ PTRACE_EVENT_VFORK_DONE = 0x5 -+ PTRACE_GETEVENTMSG = 0x4201 -+ PTRACE_GETREGS = 0xc -+ PTRACE_GETREGSET = 0x4204 -+ PTRACE_GETSIGINFO = 0x4202 -+ PTRACE_GETSIGMASK = 0x420a -+ PTRACE_INTERRUPT = 0x4207 -+ PTRACE_KILL = 0x8 -+ PTRACE_LISTEN = 0x4208 -+ PTRACE_O_EXITKILL = 0x100000 -+ PTRACE_O_MASK = 0x3000ff -+ PTRACE_O_SUSPEND_SECCOMP = 0x200000 -+ PTRACE_O_TRACECLONE = 0x8 -+ PTRACE_O_TRACEEXEC = 0x10 -+ PTRACE_O_TRACEEXIT = 0x40 -+ PTRACE_O_TRACEFORK = 0x2 -+ PTRACE_O_TRACESECCOMP = 0x80 -+ PTRACE_O_TRACESYSGOOD = 0x1 -+ PTRACE_O_TRACEVFORK = 0x4 -+ PTRACE_O_TRACEVFORKDONE = 0x20 -+ PTRACE_PEEKDATA = 0x2 -+ PTRACE_PEEKSIGINFO = 0x4209 -+ PTRACE_PEEKSIGINFO_SHARED = 0x1 -+ PTRACE_PEEKTEXT = 0x1 -+ PTRACE_PEEKUSR = 0x3 -+ PTRACE_POKEDATA = 0x5 -+ PTRACE_POKETEXT = 0x4 -+ PTRACE_POKEUSR = 0x6 -+ PTRACE_SECCOMP_GET_FILTER = 0x420c -+ PTRACE_SECCOMP_GET_METADATA = 0x420d -+ PTRACE_SEIZE = 0x4206 -+ PTRACE_SETOPTIONS = 0x4200 -+ PTRACE_SETREGS = 0xd -+ PTRACE_SETREGSET = 0x4205 -+ PTRACE_SETSIGINFO = 0x4203 -+ PTRACE_SETSIGMASK = 0x420b -+ PTRACE_SINGLESTEP = 0x9 -+ PTRACE_SYSCALL = 0x18 -+ PTRACE_TRACEME = 0x0 -+ QNX4_SUPER_MAGIC = 0x2f -+ QNX6_SUPER_MAGIC = 0x68191122 -+ RAMFS_MAGIC = 0x858458f6 -+ RDTGROUP_SUPER_MAGIC = 0x7655821 -+ REISERFS_SUPER_MAGIC = 0x52654973 -+ RENAME_EXCHANGE = 0x2 -+ RENAME_NOREPLACE = 0x1 -+ RENAME_WHITEOUT = 0x4 -+ RLIMIT_AS = 0x9 -+ RLIMIT_CORE = 0x4 -+ RLIMIT_CPU = 0x0 -+ RLIMIT_DATA = 0x2 -+ RLIMIT_FSIZE = 0x1 -+ RLIMIT_LOCKS = 0xa -+ RLIMIT_MEMLOCK = 0x8 -+ RLIMIT_MSGQUEUE = 0xc -+ RLIMIT_NICE = 0xd -+ RLIMIT_NOFILE = 0x7 -+ RLIMIT_NPROC = 0x6 -+ RLIMIT_RSS = 0x5 -+ RLIMIT_RTPRIO = 0xe -+ RLIMIT_RTTIME = 0xf -+ RLIMIT_SIGPENDING = 0xb -+ RLIMIT_STACK = 0x3 -+ RLIM_INFINITY = 0xffffffffffffffff -+ RNDADDENTROPY = 0x40085203 -+ RNDADDTOENTCNT = 0x40045201 -+ RNDCLEARPOOL = 0x5206 -+ RNDGETENTCNT = 0x80045200 -+ RNDGETPOOL = 0x80085202 -+ RNDRESEEDCRNG = 0x5207 -+ RNDZAPENTCNT = 0x5204 -+ RTAX_ADVMSS = 0x8 -+ RTAX_CC_ALGO = 0x10 -+ RTAX_CWND = 0x7 -+ RTAX_FASTOPEN_NO_COOKIE = 0x11 -+ RTAX_FEATURES = 0xc -+ RTAX_FEATURE_ALLFRAG = 0x8 -+ RTAX_FEATURE_ECN = 0x1 -+ RTAX_FEATURE_MASK = 0xf -+ RTAX_FEATURE_SACK = 0x2 -+ RTAX_FEATURE_TIMESTAMP = 0x4 -+ RTAX_HOPLIMIT = 0xa -+ RTAX_INITCWND = 0xb -+ RTAX_INITRWND = 0xe -+ RTAX_LOCK = 0x1 -+ RTAX_MAX = 0x11 -+ RTAX_MTU = 0x2 -+ RTAX_QUICKACK = 0xf -+ RTAX_REORDERING = 0x9 -+ RTAX_RTO_MIN = 0xd -+ RTAX_RTT = 0x4 -+ RTAX_RTTVAR = 0x5 -+ RTAX_SSTHRESH = 0x6 -+ RTAX_UNSPEC = 0x0 -+ RTAX_WINDOW = 0x3 -+ RTA_ALIGNTO = 0x4 -+ RTA_MAX = 0x1d -+ RTCF_DIRECTSRC = 0x4000000 -+ RTCF_DOREDIRECT = 0x1000000 -+ RTCF_LOG = 0x2000000 -+ RTCF_MASQ = 0x400000 -+ RTCF_NAT = 0x800000 -+ RTCF_VALVE = 0x200000 -+ RTC_AF = 0x20 -+ RTC_AIE_OFF = 0x7002 -+ RTC_AIE_ON = 0x7001 -+ RTC_ALM_READ = 0x80247008 -+ RTC_ALM_SET = 0x40247007 -+ RTC_EPOCH_READ = 0x8008700d -+ RTC_EPOCH_SET = 0x4008700e -+ RTC_IRQF = 0x80 -+ RTC_IRQP_READ = 0x8008700b -+ RTC_IRQP_SET = 0x4008700c -+ RTC_MAX_FREQ = 0x2000 -+ RTC_PF = 0x40 -+ RTC_PIE_OFF = 0x7006 -+ RTC_PIE_ON = 0x7005 -+ RTC_PLL_GET = 0x80207011 -+ RTC_PLL_SET = 0x40207012 -+ RTC_RD_TIME = 0x80247009 -+ RTC_SET_TIME = 0x4024700a -+ RTC_UF = 0x10 -+ RTC_UIE_OFF = 0x7004 -+ RTC_UIE_ON = 0x7003 -+ RTC_VL_CLR = 0x7014 -+ RTC_VL_READ = 0x80047013 -+ RTC_WIE_OFF = 0x7010 -+ RTC_WIE_ON = 0x700f -+ RTC_WKALM_RD = 0x80287010 -+ RTC_WKALM_SET = 0x4028700f -+ RTF_ADDRCLASSMASK = 0xf8000000 -+ RTF_ADDRCONF = 0x40000 -+ RTF_ALLONLINK = 0x20000 -+ RTF_BROADCAST = 0x10000000 -+ RTF_CACHE = 0x1000000 -+ RTF_DEFAULT = 0x10000 -+ RTF_DYNAMIC = 0x10 -+ RTF_FLOW = 0x2000000 -+ RTF_GATEWAY = 0x2 -+ RTF_HOST = 0x4 -+ RTF_INTERFACE = 0x40000000 -+ RTF_IRTT = 0x100 -+ RTF_LINKRT = 0x100000 -+ RTF_LOCAL = 0x80000000 -+ RTF_MODIFIED = 0x20 -+ RTF_MSS = 0x40 -+ RTF_MTU = 0x40 -+ RTF_MULTICAST = 0x20000000 -+ RTF_NAT = 0x8000000 -+ RTF_NOFORWARD = 0x1000 -+ RTF_NONEXTHOP = 0x200000 -+ RTF_NOPMTUDISC = 0x4000 -+ RTF_POLICY = 0x4000000 -+ RTF_REINSTATE = 0x8 -+ RTF_REJECT = 0x200 -+ RTF_STATIC = 0x400 -+ RTF_THROW = 0x2000 -+ RTF_UP = 0x1 -+ RTF_WINDOW = 0x80 -+ RTF_XRESOLVE = 0x800 -+ RTM_BASE = 0x10 -+ RTM_DELACTION = 0x31 -+ RTM_DELADDR = 0x15 -+ RTM_DELADDRLABEL = 0x49 -+ RTM_DELCHAIN = 0x65 -+ RTM_DELLINK = 0x11 -+ RTM_DELMDB = 0x55 -+ RTM_DELNEIGH = 0x1d -+ RTM_DELNETCONF = 0x51 -+ RTM_DELNSID = 0x59 -+ RTM_DELQDISC = 0x25 -+ RTM_DELROUTE = 0x19 -+ RTM_DELRULE = 0x21 -+ RTM_DELTCLASS = 0x29 -+ RTM_DELTFILTER = 0x2d -+ RTM_F_CLONED = 0x200 -+ RTM_F_EQUALIZE = 0x400 -+ RTM_F_FIB_MATCH = 0x2000 -+ RTM_F_LOOKUP_TABLE = 0x1000 -+ RTM_F_NOTIFY = 0x100 -+ RTM_F_PREFIX = 0x800 -+ RTM_GETACTION = 0x32 -+ RTM_GETADDR = 0x16 -+ RTM_GETADDRLABEL = 0x4a -+ RTM_GETANYCAST = 0x3e -+ RTM_GETCHAIN = 0x66 -+ RTM_GETDCB = 0x4e -+ RTM_GETLINK = 0x12 -+ RTM_GETMDB = 0x56 -+ RTM_GETMULTICAST = 0x3a -+ RTM_GETNEIGH = 0x1e -+ RTM_GETNEIGHTBL = 0x42 -+ RTM_GETNETCONF = 0x52 -+ RTM_GETNSID = 0x5a -+ RTM_GETQDISC = 0x26 -+ RTM_GETROUTE = 0x1a -+ RTM_GETRULE = 0x22 -+ RTM_GETSTATS = 0x5e -+ RTM_GETTCLASS = 0x2a -+ RTM_GETTFILTER = 0x2e -+ RTM_MAX = 0x67 -+ RTM_NEWACTION = 0x30 -+ RTM_NEWADDR = 0x14 -+ RTM_NEWADDRLABEL = 0x48 -+ RTM_NEWCACHEREPORT = 0x60 -+ RTM_NEWCHAIN = 0x64 -+ RTM_NEWLINK = 0x10 -+ RTM_NEWMDB = 0x54 -+ RTM_NEWNDUSEROPT = 0x44 -+ RTM_NEWNEIGH = 0x1c -+ RTM_NEWNEIGHTBL = 0x40 -+ RTM_NEWNETCONF = 0x50 -+ RTM_NEWNSID = 0x58 -+ RTM_NEWPREFIX = 0x34 -+ RTM_NEWQDISC = 0x24 -+ RTM_NEWROUTE = 0x18 -+ RTM_NEWRULE = 0x20 -+ RTM_NEWSTATS = 0x5c -+ RTM_NEWTCLASS = 0x28 -+ RTM_NEWTFILTER = 0x2c -+ RTM_NR_FAMILIES = 0x16 -+ RTM_NR_MSGTYPES = 0x58 -+ RTM_SETDCB = 0x4f -+ RTM_SETLINK = 0x13 -+ RTM_SETNEIGHTBL = 0x43 -+ RTNH_ALIGNTO = 0x4 -+ RTNH_COMPARE_MASK = 0x19 -+ RTNH_F_DEAD = 0x1 -+ RTNH_F_LINKDOWN = 0x10 -+ RTNH_F_OFFLOAD = 0x8 -+ RTNH_F_ONLINK = 0x4 -+ RTNH_F_PERVASIVE = 0x2 -+ RTNH_F_UNRESOLVED = 0x20 -+ RTN_MAX = 0xb -+ RTPROT_BABEL = 0x2a -+ RTPROT_BGP = 0xba -+ RTPROT_BIRD = 0xc -+ RTPROT_BOOT = 0x3 -+ RTPROT_DHCP = 0x10 -+ RTPROT_DNROUTED = 0xd -+ RTPROT_EIGRP = 0xc0 -+ RTPROT_GATED = 0x8 -+ RTPROT_ISIS = 0xbb -+ RTPROT_KERNEL = 0x2 -+ RTPROT_MROUTED = 0x11 -+ RTPROT_MRT = 0xa -+ RTPROT_NTK = 0xf -+ RTPROT_OSPF = 0xbc -+ RTPROT_RA = 0x9 -+ RTPROT_REDIRECT = 0x1 -+ RTPROT_RIP = 0xbd -+ RTPROT_STATIC = 0x4 -+ RTPROT_UNSPEC = 0x0 -+ RTPROT_XORP = 0xe -+ RTPROT_ZEBRA = 0xb -+ RT_CLASS_DEFAULT = 0xfd -+ RT_CLASS_LOCAL = 0xff -+ RT_CLASS_MAIN = 0xfe -+ RT_CLASS_MAX = 0xff -+ RT_CLASS_UNSPEC = 0x0 -+ RUSAGE_CHILDREN = -0x1 -+ RUSAGE_SELF = 0x0 -+ RUSAGE_THREAD = 0x1 -+ SCM_CREDENTIALS = 0x2 -+ SCM_RIGHTS = 0x1 -+ SCM_TIMESTAMP = 0x1d -+ SCM_TIMESTAMPING = 0x25 -+ SCM_TIMESTAMPING_OPT_STATS = 0x36 -+ SCM_TIMESTAMPING_PKTINFO = 0x3a -+ SCM_TIMESTAMPNS = 0x23 -+ SCM_TXTIME = 0x3d -+ SCM_WIFI_STATUS = 0x29 -+ SC_LOG_FLUSH = 0x100000 -+ SECCOMP_MODE_DISABLED = 0x0 -+ SECCOMP_MODE_FILTER = 0x2 -+ SECCOMP_MODE_STRICT = 0x1 -+ SECURITYFS_MAGIC = 0x73636673 -+ SELINUX_MAGIC = 0xf97cff8c -+ SFD_CLOEXEC = 0x80000 -+ SFD_NONBLOCK = 0x800 -+ SHUT_RD = 0x0 -+ SHUT_RDWR = 0x2 -+ SHUT_WR = 0x1 -+ SIOCADDDLCI = 0x8980 -+ SIOCADDMULTI = 0x8931 -+ SIOCADDRT = 0x890b -+ SIOCATMARK = 0x8905 -+ SIOCBONDCHANGEACTIVE = 0x8995 -+ SIOCBONDENSLAVE = 0x8990 -+ SIOCBONDINFOQUERY = 0x8994 -+ SIOCBONDRELEASE = 0x8991 -+ SIOCBONDSETHWADDR = 0x8992 -+ SIOCBONDSLAVEINFOQUERY = 0x8993 -+ SIOCBRADDBR = 0x89a0 -+ SIOCBRADDIF = 0x89a2 -+ SIOCBRDELBR = 0x89a1 -+ SIOCBRDELIF = 0x89a3 -+ SIOCDARP = 0x8953 -+ SIOCDELDLCI = 0x8981 -+ SIOCDELMULTI = 0x8932 -+ SIOCDELRT = 0x890c -+ SIOCDEVPRIVATE = 0x89f0 -+ SIOCDIFADDR = 0x8936 -+ SIOCDRARP = 0x8960 -+ SIOCETHTOOL = 0x8946 -+ SIOCGARP = 0x8954 -+ SIOCGHWTSTAMP = 0x89b1 -+ SIOCGIFADDR = 0x8915 -+ SIOCGIFBR = 0x8940 -+ SIOCGIFBRDADDR = 0x8919 -+ SIOCGIFCONF = 0x8912 -+ SIOCGIFCOUNT = 0x8938 -+ SIOCGIFDSTADDR = 0x8917 -+ SIOCGIFENCAP = 0x8925 -+ SIOCGIFFLAGS = 0x8913 -+ SIOCGIFHWADDR = 0x8927 -+ SIOCGIFINDEX = 0x8933 -+ SIOCGIFMAP = 0x8970 -+ SIOCGIFMEM = 0x891f -+ SIOCGIFMETRIC = 0x891d -+ SIOCGIFMTU = 0x8921 -+ SIOCGIFNAME = 0x8910 -+ SIOCGIFNETMASK = 0x891b -+ SIOCGIFPFLAGS = 0x8935 -+ SIOCGIFSLAVE = 0x8929 -+ SIOCGIFTXQLEN = 0x8942 -+ SIOCGIFVLAN = 0x8982 -+ SIOCGMIIPHY = 0x8947 -+ SIOCGMIIREG = 0x8948 -+ SIOCGPGRP = 0x8904 -+ SIOCGPPPCSTATS = 0x89f2 -+ SIOCGPPPSTATS = 0x89f0 -+ SIOCGPPPVER = 0x89f1 -+ SIOCGRARP = 0x8961 -+ SIOCGSKNS = 0x894c -+ SIOCGSTAMP = 0x8906 -+ SIOCGSTAMPNS = 0x8907 -+ SIOCINQ = 0x541b -+ SIOCOUTQ = 0x5411 -+ SIOCOUTQNSD = 0x894b -+ SIOCPROTOPRIVATE = 0x89e0 -+ SIOCRTMSG = 0x890d -+ SIOCSARP = 0x8955 -+ SIOCSHWTSTAMP = 0x89b0 -+ SIOCSIFADDR = 0x8916 -+ SIOCSIFBR = 0x8941 -+ SIOCSIFBRDADDR = 0x891a -+ SIOCSIFDSTADDR = 0x8918 -+ SIOCSIFENCAP = 0x8926 -+ SIOCSIFFLAGS = 0x8914 -+ SIOCSIFHWADDR = 0x8924 -+ SIOCSIFHWBROADCAST = 0x8937 -+ SIOCSIFLINK = 0x8911 -+ SIOCSIFMAP = 0x8971 -+ SIOCSIFMEM = 0x8920 -+ SIOCSIFMETRIC = 0x891e -+ SIOCSIFMTU = 0x8922 -+ SIOCSIFNAME = 0x8923 -+ SIOCSIFNETMASK = 0x891c -+ SIOCSIFPFLAGS = 0x8934 -+ SIOCSIFSLAVE = 0x8930 -+ SIOCSIFTXQLEN = 0x8943 -+ SIOCSIFVLAN = 0x8983 -+ SIOCSMIIREG = 0x8949 -+ SIOCSPGRP = 0x8902 -+ SIOCSRARP = 0x8962 -+ SIOCWANDEV = 0x894a -+ SMACK_MAGIC = 0x43415d53 -+ SMART_AUTOSAVE = 0xd2 -+ SMART_AUTO_OFFLINE = 0xdb -+ SMART_DISABLE = 0xd9 -+ SMART_ENABLE = 0xd8 -+ SMART_HCYL_PASS = 0xc2 -+ SMART_IMMEDIATE_OFFLINE = 0xd4 -+ SMART_LCYL_PASS = 0x4f -+ SMART_READ_LOG_SECTOR = 0xd5 -+ SMART_READ_THRESHOLDS = 0xd1 -+ SMART_READ_VALUES = 0xd0 -+ SMART_SAVE = 0xd3 -+ SMART_STATUS = 0xda -+ SMART_WRITE_LOG_SECTOR = 0xd6 -+ SMART_WRITE_THRESHOLDS = 0xd7 -+ SMB_SUPER_MAGIC = 0x517b -+ SOCKFS_MAGIC = 0x534f434b -+ SOCK_CLOEXEC = 0x80000 -+ SOCK_DCCP = 0x6 -+ SOCK_DGRAM = 0x2 -+ SOCK_IOC_TYPE = 0x89 -+ SOCK_NONBLOCK = 0x800 -+ SOCK_PACKET = 0xa -+ SOCK_RAW = 0x3 -+ SOCK_RDM = 0x4 -+ SOCK_SEQPACKET = 0x5 -+ SOCK_STREAM = 0x1 -+ SOL_AAL = 0x109 -+ SOL_ALG = 0x117 -+ SOL_ATM = 0x108 -+ SOL_CAIF = 0x116 -+ SOL_CAN_BASE = 0x64 -+ SOL_DCCP = 0x10d -+ SOL_DECNET = 0x105 -+ SOL_ICMPV6 = 0x3a -+ SOL_IP = 0x0 -+ SOL_IPV6 = 0x29 -+ SOL_IRDA = 0x10a -+ SOL_IUCV = 0x115 -+ SOL_KCM = 0x119 -+ SOL_LLC = 0x10c -+ SOL_NETBEUI = 0x10b -+ SOL_NETLINK = 0x10e -+ SOL_NFC = 0x118 -+ SOL_PACKET = 0x107 -+ SOL_PNPIPE = 0x113 -+ SOL_PPPOL2TP = 0x111 -+ SOL_RAW = 0xff -+ SOL_RDS = 0x114 -+ SOL_RXRPC = 0x110 -+ SOL_SOCKET = 0x1 -+ SOL_TCP = 0x6 -+ SOL_TIPC = 0x10f -+ SOL_TLS = 0x11a -+ SOL_X25 = 0x106 -+ SOL_XDP = 0x11b -+ SOMAXCONN = 0x80 -+ SO_ACCEPTCONN = 0x1e -+ SO_ATTACH_BPF = 0x32 -+ SO_ATTACH_FILTER = 0x1a -+ SO_ATTACH_REUSEPORT_CBPF = 0x33 -+ SO_ATTACH_REUSEPORT_EBPF = 0x34 -+ SO_BINDTODEVICE = 0x19 -+ SO_BPF_EXTENSIONS = 0x30 -+ SO_BROADCAST = 0x6 -+ SO_BSDCOMPAT = 0xe -+ SO_BUSY_POLL = 0x2e -+ SO_CNX_ADVICE = 0x35 -+ SO_COOKIE = 0x39 -+ SO_DEBUG = 0x1 -+ SO_DETACH_BPF = 0x1b -+ SO_DETACH_FILTER = 0x1b -+ SO_DOMAIN = 0x27 -+ SO_DONTROUTE = 0x5 -+ SO_EE_CODE_TXTIME_INVALID_PARAM = 0x1 -+ SO_EE_CODE_TXTIME_MISSED = 0x2 -+ SO_EE_CODE_ZEROCOPY_COPIED = 0x1 -+ SO_EE_ORIGIN_ICMP = 0x2 -+ SO_EE_ORIGIN_ICMP6 = 0x3 -+ SO_EE_ORIGIN_LOCAL = 0x1 -+ SO_EE_ORIGIN_NONE = 0x0 -+ SO_EE_ORIGIN_TIMESTAMPING = 0x4 -+ SO_EE_ORIGIN_TXSTATUS = 0x4 -+ SO_EE_ORIGIN_TXTIME = 0x6 -+ SO_EE_ORIGIN_ZEROCOPY = 0x5 -+ SO_ERROR = 0x4 -+ SO_GET_FILTER = 0x1a -+ SO_INCOMING_CPU = 0x31 -+ SO_INCOMING_NAPI_ID = 0x38 -+ SO_KEEPALIVE = 0x9 -+ SO_LINGER = 0xd -+ SO_LOCK_FILTER = 0x2c -+ SO_MARK = 0x24 -+ SO_MAX_PACING_RATE = 0x2f -+ SO_MEMINFO = 0x37 -+ SO_NOFCS = 0x2b -+ SO_NO_CHECK = 0xb -+ SO_OOBINLINE = 0xa -+ SO_PASSCRED = 0x10 -+ SO_PASSSEC = 0x22 -+ SO_PEEK_OFF = 0x2a -+ SO_PEERCRED = 0x11 -+ SO_PEERGROUPS = 0x3b -+ SO_PEERNAME = 0x1c -+ SO_PEERSEC = 0x1f -+ SO_PRIORITY = 0xc -+ SO_PROTOCOL = 0x26 -+ SO_RCVBUF = 0x8 -+ SO_RCVBUFFORCE = 0x21 -+ SO_RCVLOWAT = 0x12 -+ SO_RCVTIMEO = 0x14 -+ SO_REUSEADDR = 0x2 -+ SO_REUSEPORT = 0xf -+ SO_RXQ_OVFL = 0x28 -+ SO_SECURITY_AUTHENTICATION = 0x16 -+ SO_SECURITY_ENCRYPTION_NETWORK = 0x18 -+ SO_SECURITY_ENCRYPTION_TRANSPORT = 0x17 -+ SO_SELECT_ERR_QUEUE = 0x2d -+ SO_SNDBUF = 0x7 -+ SO_SNDBUFFORCE = 0x20 -+ SO_SNDLOWAT = 0x13 -+ SO_SNDTIMEO = 0x15 -+ SO_TIMESTAMP = 0x1d -+ SO_TIMESTAMPING = 0x25 -+ SO_TIMESTAMPNS = 0x23 -+ SO_TXTIME = 0x3d -+ SO_TYPE = 0x3 -+ SO_VM_SOCKETS_BUFFER_MAX_SIZE = 0x2 -+ SO_VM_SOCKETS_BUFFER_MIN_SIZE = 0x1 -+ SO_VM_SOCKETS_BUFFER_SIZE = 0x0 -+ SO_VM_SOCKETS_CONNECT_TIMEOUT = 0x6 -+ SO_VM_SOCKETS_NONBLOCK_TXRX = 0x7 -+ SO_VM_SOCKETS_PEER_HOST_VM_ID = 0x3 -+ SO_VM_SOCKETS_TRUSTED = 0x5 -+ SO_WIFI_STATUS = 0x29 -+ SO_ZEROCOPY = 0x3c -+ SPLICE_F_GIFT = 0x8 -+ SPLICE_F_MORE = 0x4 -+ SPLICE_F_MOVE = 0x1 -+ SPLICE_F_NONBLOCK = 0x2 -+ SQUASHFS_MAGIC = 0x73717368 -+ STACK_END_MAGIC = 0x57ac6e9d -+ STATX_ALL = 0xfff -+ STATX_ATIME = 0x20 -+ STATX_ATTR_APPEND = 0x20 -+ STATX_ATTR_AUTOMOUNT = 0x1000 -+ STATX_ATTR_COMPRESSED = 0x4 -+ STATX_ATTR_ENCRYPTED = 0x800 -+ STATX_ATTR_IMMUTABLE = 0x10 -+ STATX_ATTR_NODUMP = 0x40 -+ STATX_BASIC_STATS = 0x7ff -+ STATX_BLOCKS = 0x400 -+ STATX_BTIME = 0x800 -+ STATX_CTIME = 0x80 -+ STATX_GID = 0x10 -+ STATX_INO = 0x100 -+ STATX_MODE = 0x2 -+ STATX_MTIME = 0x40 -+ STATX_NLINK = 0x4 -+ STATX_SIZE = 0x200 -+ STATX_TYPE = 0x1 -+ STATX_UID = 0x8 -+ STATX__RESERVED = 0x80000000 -+ SYNC_FILE_RANGE_WAIT_AFTER = 0x4 -+ SYNC_FILE_RANGE_WAIT_BEFORE = 0x1 -+ SYNC_FILE_RANGE_WRITE = 0x2 -+ SYSFS_MAGIC = 0x62656572 -+ S_BLKSIZE = 0x200 -+ S_IEXEC = 0x40 -+ S_IFBLK = 0x6000 -+ S_IFCHR = 0x2000 -+ S_IFDIR = 0x4000 -+ S_IFIFO = 0x1000 -+ S_IFLNK = 0xa000 -+ S_IFMT = 0xf000 -+ S_IFREG = 0x8000 -+ S_IFSOCK = 0xc000 -+ S_IREAD = 0x100 -+ S_IRGRP = 0x20 -+ S_IROTH = 0x4 -+ S_IRUSR = 0x100 -+ S_IRWXG = 0x38 -+ S_IRWXO = 0x7 -+ S_IRWXU = 0x1c0 -+ S_ISGID = 0x400 -+ S_ISUID = 0x800 -+ S_ISVTX = 0x200 -+ S_IWGRP = 0x10 -+ S_IWOTH = 0x2 -+ S_IWRITE = 0x80 -+ S_IWUSR = 0x80 -+ S_IXGRP = 0x8 -+ S_IXOTH = 0x1 -+ S_IXUSR = 0x40 -+ TAB0 = 0x0 -+ TAB1 = 0x800 -+ TAB2 = 0x1000 -+ TAB3 = 0x1800 -+ TABDLY = 0x1800 -+ TASKSTATS_CMD_ATTR_MAX = 0x4 -+ TASKSTATS_CMD_MAX = 0x2 -+ TASKSTATS_GENL_NAME = "TASKSTATS" -+ TASKSTATS_GENL_VERSION = 0x1 -+ TASKSTATS_TYPE_MAX = 0x6 -+ TASKSTATS_VERSION = 0x9 -+ TCFLSH = 0x540b -+ TCGETA = 0x5405 -+ TCGETS = 0x5401 -+ TCGETS2 = 0x802c542a -+ TCGETX = 0x5432 -+ TCIFLUSH = 0x0 -+ TCIOFF = 0x2 -+ TCIOFLUSH = 0x2 -+ TCION = 0x3 -+ TCOFLUSH = 0x1 -+ TCOOFF = 0x0 -+ TCOON = 0x1 -+ TCP_CC_INFO = 0x1a -+ TCP_CM_INQ = 0x24 -+ TCP_CONGESTION = 0xd -+ TCP_COOKIE_IN_ALWAYS = 0x1 -+ TCP_COOKIE_MAX = 0x10 -+ TCP_COOKIE_MIN = 0x8 -+ TCP_COOKIE_OUT_NEVER = 0x2 -+ TCP_COOKIE_PAIR_SIZE = 0x20 -+ TCP_COOKIE_TRANSACTIONS = 0xf -+ TCP_CORK = 0x3 -+ TCP_DEFER_ACCEPT = 0x9 -+ TCP_FASTOPEN = 0x17 -+ TCP_FASTOPEN_CONNECT = 0x1e -+ TCP_FASTOPEN_KEY = 0x21 -+ TCP_FASTOPEN_NO_COOKIE = 0x22 -+ TCP_INFO = 0xb -+ TCP_INQ = 0x24 -+ TCP_KEEPCNT = 0x6 -+ TCP_KEEPIDLE = 0x4 -+ TCP_KEEPINTVL = 0x5 -+ TCP_LINGER2 = 0x8 -+ TCP_MAXSEG = 0x2 -+ TCP_MAXWIN = 0xffff -+ TCP_MAX_WINSHIFT = 0xe -+ TCP_MD5SIG = 0xe -+ TCP_MD5SIG_EXT = 0x20 -+ TCP_MD5SIG_FLAG_PREFIX = 0x1 -+ TCP_MD5SIG_MAXKEYLEN = 0x50 -+ TCP_MSS = 0x200 -+ TCP_MSS_DEFAULT = 0x218 -+ TCP_MSS_DESIRED = 0x4c4 -+ TCP_NODELAY = 0x1 -+ TCP_NOTSENT_LOWAT = 0x19 -+ TCP_QUEUE_SEQ = 0x15 -+ TCP_QUICKACK = 0xc -+ TCP_REPAIR = 0x13 -+ TCP_REPAIR_OFF = 0x0 -+ TCP_REPAIR_OFF_NO_WP = -0x1 -+ TCP_REPAIR_ON = 0x1 -+ TCP_REPAIR_OPTIONS = 0x16 -+ TCP_REPAIR_QUEUE = 0x14 -+ TCP_REPAIR_WINDOW = 0x1d -+ TCP_SAVED_SYN = 0x1c -+ TCP_SAVE_SYN = 0x1b -+ TCP_SYNCNT = 0x7 -+ TCP_S_DATA_IN = 0x4 -+ TCP_S_DATA_OUT = 0x8 -+ TCP_THIN_DUPACK = 0x11 -+ TCP_THIN_LINEAR_TIMEOUTS = 0x10 -+ TCP_TIMESTAMP = 0x18 -+ TCP_ULP = 0x1f -+ TCP_USER_TIMEOUT = 0x12 -+ TCP_WINDOW_CLAMP = 0xa -+ TCP_ZEROCOPY_RECEIVE = 0x23 -+ TCSAFLUSH = 0x2 -+ TCSBRK = 0x5409 -+ TCSBRKP = 0x5425 -+ TCSETA = 0x5406 -+ TCSETAF = 0x5408 -+ TCSETAW = 0x5407 -+ TCSETS = 0x5402 -+ TCSETS2 = 0x402c542b -+ TCSETSF = 0x5404 -+ TCSETSF2 = 0x402c542d -+ TCSETSW = 0x5403 -+ TCSETSW2 = 0x402c542c -+ TCSETX = 0x5433 -+ TCSETXF = 0x5434 -+ TCSETXW = 0x5435 -+ TCXONC = 0x540a -+ TIMER_ABSTIME = 0x1 -+ TIOCCBRK = 0x5428 -+ TIOCCONS = 0x541d -+ TIOCEXCL = 0x540c -+ TIOCGDEV = 0x80045432 -+ TIOCGETD = 0x5424 -+ TIOCGEXCL = 0x80045440 -+ TIOCGICOUNT = 0x545d -+ TIOCGISO7816 = 0x80285442 -+ TIOCGLCKTRMIOS = 0x5456 -+ TIOCGPGRP = 0x540f -+ TIOCGPKT = 0x80045438 -+ TIOCGPTLCK = 0x80045439 -+ TIOCGPTN = 0x80045430 -+ TIOCGPTPEER = 0x5441 -+ TIOCGRS485 = 0x542e -+ TIOCGSERIAL = 0x541e -+ TIOCGSID = 0x5429 -+ TIOCGSOFTCAR = 0x5419 -+ TIOCGWINSZ = 0x5413 -+ TIOCINQ = 0x541b -+ TIOCLINUX = 0x541c -+ TIOCMBIC = 0x5417 -+ TIOCMBIS = 0x5416 -+ TIOCMGET = 0x5415 -+ TIOCMIWAIT = 0x545c -+ TIOCMSET = 0x5418 -+ TIOCM_CAR = 0x40 -+ TIOCM_CD = 0x40 -+ TIOCM_CTS = 0x20 -+ TIOCM_DSR = 0x100 -+ TIOCM_DTR = 0x2 -+ TIOCM_LE = 0x1 -+ TIOCM_RI = 0x80 -+ TIOCM_RNG = 0x80 -+ TIOCM_RTS = 0x4 -+ TIOCM_SR = 0x10 -+ TIOCM_ST = 0x8 -+ TIOCNOTTY = 0x5422 -+ TIOCNXCL = 0x540d -+ TIOCOUTQ = 0x5411 -+ TIOCPKT = 0x5420 -+ TIOCPKT_DATA = 0x0 -+ TIOCPKT_DOSTOP = 0x20 -+ TIOCPKT_FLUSHREAD = 0x1 -+ TIOCPKT_FLUSHWRITE = 0x2 -+ TIOCPKT_IOCTL = 0x40 -+ TIOCPKT_NOSTOP = 0x10 -+ TIOCPKT_START = 0x8 -+ TIOCPKT_STOP = 0x4 -+ TIOCSBRK = 0x5427 -+ TIOCSCTTY = 0x540e -+ TIOCSERCONFIG = 0x5453 -+ TIOCSERGETLSR = 0x5459 -+ TIOCSERGETMULTI = 0x545a -+ TIOCSERGSTRUCT = 0x5458 -+ TIOCSERGWILD = 0x5454 -+ TIOCSERSETMULTI = 0x545b -+ TIOCSERSWILD = 0x5455 -+ TIOCSER_TEMT = 0x1 -+ TIOCSETD = 0x5423 -+ TIOCSIG = 0x40045436 -+ TIOCSISO7816 = 0xc0285443 -+ TIOCSLCKTRMIOS = 0x5457 -+ TIOCSPGRP = 0x5410 -+ TIOCSPTLCK = 0x40045431 -+ TIOCSRS485 = 0x542f -+ TIOCSSERIAL = 0x541f -+ TIOCSSOFTCAR = 0x541a -+ TIOCSTI = 0x5412 -+ TIOCSWINSZ = 0x5414 -+ TIOCVHANGUP = 0x5437 -+ TMPFS_MAGIC = 0x1021994 -+ TOSTOP = 0x100 -+ TPACKET_ALIGNMENT = 0x10 -+ TPACKET_HDRLEN = 0x34 -+ TP_STATUS_AVAILABLE = 0x0 -+ TP_STATUS_BLK_TMO = 0x20 -+ TP_STATUS_COPY = 0x2 -+ TP_STATUS_CSUMNOTREADY = 0x8 -+ TP_STATUS_CSUM_VALID = 0x80 -+ TP_STATUS_KERNEL = 0x0 -+ TP_STATUS_LOSING = 0x4 -+ TP_STATUS_SENDING = 0x2 -+ TP_STATUS_SEND_REQUEST = 0x1 -+ TP_STATUS_TS_RAW_HARDWARE = -0x80000000 -+ TP_STATUS_TS_SOFTWARE = 0x20000000 -+ TP_STATUS_TS_SYS_HARDWARE = 0x40000000 -+ TP_STATUS_USER = 0x1 -+ TP_STATUS_VLAN_TPID_VALID = 0x40 -+ TP_STATUS_VLAN_VALID = 0x10 -+ TP_STATUS_WRONG_FORMAT = 0x4 -+ TRACEFS_MAGIC = 0x74726163 -+ TS_COMM_LEN = 0x20 -+ TUNATTACHFILTER = 0x401054d5 -+ TUNDETACHFILTER = 0x401054d6 -+ TUNGETFEATURES = 0x800454cf -+ TUNGETFILTER = 0x801054db -+ TUNGETIFF = 0x800454d2 -+ TUNGETSNDBUF = 0x800454d3 -+ TUNGETVNETBE = 0x800454df -+ TUNGETVNETHDRSZ = 0x800454d7 -+ TUNGETVNETLE = 0x800454dd -+ TUNSETCARRIER = 0x400454e2 -+ TUNSETDEBUG = 0x400454c9 -+ TUNSETFILTEREBPF = 0x800454e1 -+ TUNSETGROUP = 0x400454ce -+ TUNSETIFF = 0x400454ca -+ TUNSETIFINDEX = 0x400454da -+ TUNSETLINK = 0x400454cd -+ TUNSETNOCSUM = 0x400454c8 -+ TUNSETOFFLOAD = 0x400454d0 -+ TUNSETOWNER = 0x400454cc -+ TUNSETPERSIST = 0x400454cb -+ TUNSETQUEUE = 0x400454d9 -+ TUNSETSNDBUF = 0x400454d4 -+ TUNSETSTEERINGEBPF = 0x800454e0 -+ TUNSETTXFILTER = 0x400454d1 -+ TUNSETVNETBE = 0x400454de -+ TUNSETVNETHDRSZ = 0x400454d8 -+ TUNSETVNETLE = 0x400454dc -+ UBI_IOCATT = 0x40186f40 -+ UBI_IOCDET = 0x40046f41 -+ UBI_IOCEBCH = 0x40044f02 -+ UBI_IOCEBER = 0x40044f01 -+ UBI_IOCEBISMAP = 0x80044f05 -+ UBI_IOCEBMAP = 0x40084f03 -+ UBI_IOCEBUNMAP = 0x40044f04 -+ UBI_IOCMKVOL = 0x40986f00 -+ UBI_IOCRMVOL = 0x40046f01 -+ UBI_IOCRNVOL = 0x51106f03 -+ UBI_IOCRSVOL = 0x400c6f02 -+ UBI_IOCSETVOLPROP = 0x40104f06 -+ UBI_IOCVOLCRBLK = 0x40804f07 -+ UBI_IOCVOLRMBLK = 0x4f08 -+ UBI_IOCVOLUP = 0x40084f00 -+ UDF_SUPER_MAGIC = 0x15013346 -+ UMOUNT_NOFOLLOW = 0x8 -+ USBDEVICE_SUPER_MAGIC = 0x9fa2 -+ UTIME_NOW = 0x3fffffff -+ UTIME_OMIT = 0x3ffffffe -+ V9FS_MAGIC = 0x1021997 -+ VDISCARD = 0xd -+ VEOF = 0x4 -+ VEOL = 0xb -+ VEOL2 = 0x10 -+ VERASE = 0x2 -+ VINTR = 0x0 -+ VKILL = 0x3 -+ VLNEXT = 0xf -+ VMADDR_CID_ANY = 0xffffffff -+ VMADDR_CID_HOST = 0x2 -+ VMADDR_CID_HYPERVISOR = 0x0 -+ VMADDR_CID_RESERVED = 0x1 -+ VMADDR_PORT_ANY = 0xffffffff -+ VMIN = 0x6 -+ VM_SOCKETS_INVALID_VERSION = 0xffffffff -+ VQUIT = 0x1 -+ VREPRINT = 0xc -+ VSTART = 0x8 -+ VSTOP = 0x9 -+ VSUSP = 0xa -+ VSWTC = 0x7 -+ VT0 = 0x0 -+ VT1 = 0x4000 -+ VTDLY = 0x4000 -+ VTIME = 0x5 -+ VWERASE = 0xe -+ WALL = 0x40000000 -+ WCLONE = 0x80000000 -+ WCONTINUED = 0x8 -+ WDIOC_GETBOOTSTATUS = 0x80045702 -+ WDIOC_GETPRETIMEOUT = 0x80045709 -+ WDIOC_GETSTATUS = 0x80045701 -+ WDIOC_GETSUPPORT = 0x80285700 -+ WDIOC_GETTEMP = 0x80045703 -+ WDIOC_GETTIMELEFT = 0x8004570a -+ WDIOC_GETTIMEOUT = 0x80045707 -+ WDIOC_KEEPALIVE = 0x80045705 -+ WDIOC_SETOPTIONS = 0x80045704 -+ WDIOC_SETPRETIMEOUT = 0xc0045708 -+ WDIOC_SETTIMEOUT = 0xc0045706 -+ WEXITED = 0x4 -+ WIN_ACKMEDIACHANGE = 0xdb -+ WIN_CHECKPOWERMODE1 = 0xe5 -+ WIN_CHECKPOWERMODE2 = 0x98 -+ WIN_DEVICE_RESET = 0x8 -+ WIN_DIAGNOSE = 0x90 -+ WIN_DOORLOCK = 0xde -+ WIN_DOORUNLOCK = 0xdf -+ WIN_DOWNLOAD_MICROCODE = 0x92 -+ WIN_FLUSH_CACHE = 0xe7 -+ WIN_FLUSH_CACHE_EXT = 0xea -+ WIN_FORMAT = 0x50 -+ WIN_GETMEDIASTATUS = 0xda -+ WIN_IDENTIFY = 0xec -+ WIN_IDENTIFY_DMA = 0xee -+ WIN_IDLEIMMEDIATE = 0xe1 -+ WIN_INIT = 0x60 -+ WIN_MEDIAEJECT = 0xed -+ WIN_MULTREAD = 0xc4 -+ WIN_MULTREAD_EXT = 0x29 -+ WIN_MULTWRITE = 0xc5 -+ WIN_MULTWRITE_EXT = 0x39 -+ WIN_NOP = 0x0 -+ WIN_PACKETCMD = 0xa0 -+ WIN_PIDENTIFY = 0xa1 -+ WIN_POSTBOOT = 0xdc -+ WIN_PREBOOT = 0xdd -+ WIN_QUEUED_SERVICE = 0xa2 -+ WIN_READ = 0x20 -+ WIN_READDMA = 0xc8 -+ WIN_READDMA_EXT = 0x25 -+ WIN_READDMA_ONCE = 0xc9 -+ WIN_READDMA_QUEUED = 0xc7 -+ WIN_READDMA_QUEUED_EXT = 0x26 -+ WIN_READ_BUFFER = 0xe4 -+ WIN_READ_EXT = 0x24 -+ WIN_READ_LONG = 0x22 -+ WIN_READ_LONG_ONCE = 0x23 -+ WIN_READ_NATIVE_MAX = 0xf8 -+ WIN_READ_NATIVE_MAX_EXT = 0x27 -+ WIN_READ_ONCE = 0x21 -+ WIN_RECAL = 0x10 -+ WIN_RESTORE = 0x10 -+ WIN_SECURITY_DISABLE = 0xf6 -+ WIN_SECURITY_ERASE_PREPARE = 0xf3 -+ WIN_SECURITY_ERASE_UNIT = 0xf4 -+ WIN_SECURITY_FREEZE_LOCK = 0xf5 -+ WIN_SECURITY_SET_PASS = 0xf1 -+ WIN_SECURITY_UNLOCK = 0xf2 -+ WIN_SEEK = 0x70 -+ WIN_SETFEATURES = 0xef -+ WIN_SETIDLE1 = 0xe3 -+ WIN_SETIDLE2 = 0x97 -+ WIN_SETMULT = 0xc6 -+ WIN_SET_MAX = 0xf9 -+ WIN_SET_MAX_EXT = 0x37 -+ WIN_SLEEPNOW1 = 0xe6 -+ WIN_SLEEPNOW2 = 0x99 -+ WIN_SMART = 0xb0 -+ WIN_SPECIFY = 0x91 -+ WIN_SRST = 0x8 -+ WIN_STANDBY = 0xe2 -+ WIN_STANDBY2 = 0x96 -+ WIN_STANDBYNOW1 = 0xe0 -+ WIN_STANDBYNOW2 = 0x94 -+ WIN_VERIFY = 0x40 -+ WIN_VERIFY_EXT = 0x42 -+ WIN_VERIFY_ONCE = 0x41 -+ WIN_WRITE = 0x30 -+ WIN_WRITEDMA = 0xca -+ WIN_WRITEDMA_EXT = 0x35 -+ WIN_WRITEDMA_ONCE = 0xcb -+ WIN_WRITEDMA_QUEUED = 0xcc -+ WIN_WRITEDMA_QUEUED_EXT = 0x36 -+ WIN_WRITE_BUFFER = 0xe8 -+ WIN_WRITE_EXT = 0x34 -+ WIN_WRITE_LONG = 0x32 -+ WIN_WRITE_LONG_ONCE = 0x33 -+ WIN_WRITE_ONCE = 0x31 -+ WIN_WRITE_SAME = 0xe9 -+ WIN_WRITE_VERIFY = 0x3c -+ WNOHANG = 0x1 -+ WNOTHREAD = 0x20000000 -+ WNOWAIT = 0x1000000 -+ WORDSIZE = 0x40 -+ WSTOPPED = 0x2 -+ WUNTRACED = 0x2 -+ XATTR_CREATE = 0x1 -+ XATTR_REPLACE = 0x2 -+ XCASE = 0x4 -+ XDP_COPY = 0x2 -+ XDP_FLAGS_DRV_MODE = 0x4 -+ XDP_FLAGS_HW_MODE = 0x8 -+ XDP_FLAGS_MASK = 0xf -+ XDP_FLAGS_MODES = 0xe -+ XDP_FLAGS_SKB_MODE = 0x2 -+ XDP_FLAGS_UPDATE_IF_NOEXIST = 0x1 -+ XDP_MMAP_OFFSETS = 0x1 -+ XDP_PGOFF_RX_RING = 0x0 -+ XDP_PGOFF_TX_RING = 0x80000000 -+ XDP_RX_RING = 0x2 -+ XDP_SHARED_UMEM = 0x1 -+ XDP_STATISTICS = 0x7 -+ XDP_TX_RING = 0x3 -+ XDP_UMEM_COMPLETION_RING = 0x6 -+ XDP_UMEM_FILL_RING = 0x5 -+ XDP_UMEM_PGOFF_COMPLETION_RING = 0x180000000 -+ XDP_UMEM_PGOFF_FILL_RING = 0x100000000 -+ XDP_UMEM_REG = 0x4 -+ XDP_ZEROCOPY = 0x4 -+ XENFS_SUPER_MAGIC = 0xabba1974 -+ XFS_SUPER_MAGIC = 0x58465342 -+ XTABS = 0x1800 -+ ZSMALLOC_MAGIC = 0x58295829 -+) -+ -+// Errors -+const ( -+ E2BIG = syscall.Errno(0x7) -+ EACCES = syscall.Errno(0xd) -+ EADDRINUSE = syscall.Errno(0x62) -+ EADDRNOTAVAIL = syscall.Errno(0x63) -+ EADV = syscall.Errno(0x44) -+ EAFNOSUPPORT = syscall.Errno(0x61) -+ EAGAIN = syscall.Errno(0xb) -+ EALREADY = syscall.Errno(0x72) -+ EBADE = syscall.Errno(0x34) -+ EBADF = syscall.Errno(0x9) -+ EBADFD = syscall.Errno(0x4d) -+ EBADMSG = syscall.Errno(0x4a) -+ EBADR = syscall.Errno(0x35) -+ EBADRQC = syscall.Errno(0x38) -+ EBADSLT = syscall.Errno(0x39) -+ EBFONT = syscall.Errno(0x3b) -+ EBUSY = syscall.Errno(0x10) -+ ECANCELED = syscall.Errno(0x7d) -+ ECHILD = syscall.Errno(0xa) -+ ECHRNG = syscall.Errno(0x2c) -+ ECOMM = syscall.Errno(0x46) -+ ECONNABORTED = syscall.Errno(0x67) -+ ECONNREFUSED = syscall.Errno(0x6f) -+ ECONNRESET = syscall.Errno(0x68) -+ EDEADLK = syscall.Errno(0x23) -+ EDEADLOCK = syscall.Errno(0x23) -+ EDESTADDRREQ = syscall.Errno(0x59) -+ EDOM = syscall.Errno(0x21) -+ EDOTDOT = syscall.Errno(0x49) -+ EDQUOT = syscall.Errno(0x7a) -+ EEXIST = syscall.Errno(0x11) -+ EFAULT = syscall.Errno(0xe) -+ EFBIG = syscall.Errno(0x1b) -+ EHOSTDOWN = syscall.Errno(0x70) -+ EHOSTUNREACH = syscall.Errno(0x71) -+ EHWPOISON = syscall.Errno(0x85) -+ EIDRM = syscall.Errno(0x2b) -+ EILSEQ = syscall.Errno(0x54) -+ EINPROGRESS = syscall.Errno(0x73) -+ EINTR = syscall.Errno(0x4) -+ EINVAL = syscall.Errno(0x16) -+ EIO = syscall.Errno(0x5) -+ EISCONN = syscall.Errno(0x6a) -+ EISDIR = syscall.Errno(0x15) -+ EISNAM = syscall.Errno(0x78) -+ EKEYEXPIRED = syscall.Errno(0x7f) -+ EKEYREJECTED = syscall.Errno(0x81) -+ EKEYREVOKED = syscall.Errno(0x80) -+ EL2HLT = syscall.Errno(0x33) -+ EL2NSYNC = syscall.Errno(0x2d) -+ EL3HLT = syscall.Errno(0x2e) -+ EL3RST = syscall.Errno(0x2f) -+ ELIBACC = syscall.Errno(0x4f) -+ ELIBBAD = syscall.Errno(0x50) -+ ELIBEXEC = syscall.Errno(0x53) -+ ELIBMAX = syscall.Errno(0x52) -+ ELIBSCN = syscall.Errno(0x51) -+ ELNRNG = syscall.Errno(0x30) -+ ELOOP = syscall.Errno(0x28) -+ EMEDIUMTYPE = syscall.Errno(0x7c) -+ EMFILE = syscall.Errno(0x18) -+ EMLINK = syscall.Errno(0x1f) -+ EMSGSIZE = syscall.Errno(0x5a) -+ EMULTIHOP = syscall.Errno(0x48) -+ ENAMETOOLONG = syscall.Errno(0x24) -+ ENAVAIL = syscall.Errno(0x77) -+ ENETDOWN = syscall.Errno(0x64) -+ ENETRESET = syscall.Errno(0x66) -+ ENETUNREACH = syscall.Errno(0x65) -+ ENFILE = syscall.Errno(0x17) -+ ENOANO = syscall.Errno(0x37) -+ ENOBUFS = syscall.Errno(0x69) -+ ENOCSI = syscall.Errno(0x32) -+ ENODATA = syscall.Errno(0x3d) -+ ENODEV = syscall.Errno(0x13) -+ ENOENT = syscall.Errno(0x2) -+ ENOEXEC = syscall.Errno(0x8) -+ ENOKEY = syscall.Errno(0x7e) -+ ENOLCK = syscall.Errno(0x25) -+ ENOLINK = syscall.Errno(0x43) -+ ENOMEDIUM = syscall.Errno(0x7b) -+ ENOMEM = syscall.Errno(0xc) -+ ENOMSG = syscall.Errno(0x2a) -+ ENONET = syscall.Errno(0x40) -+ ENOPKG = syscall.Errno(0x41) -+ ENOPROTOOPT = syscall.Errno(0x5c) -+ ENOSPC = syscall.Errno(0x1c) -+ ENOSR = syscall.Errno(0x3f) -+ ENOSTR = syscall.Errno(0x3c) -+ ENOSYS = syscall.Errno(0x26) -+ ENOTBLK = syscall.Errno(0xf) -+ ENOTCONN = syscall.Errno(0x6b) -+ ENOTDIR = syscall.Errno(0x14) -+ ENOTEMPTY = syscall.Errno(0x27) -+ ENOTNAM = syscall.Errno(0x76) -+ ENOTRECOVERABLE = syscall.Errno(0x83) -+ ENOTSOCK = syscall.Errno(0x58) -+ ENOTSUP = syscall.Errno(0x5f) -+ ENOTTY = syscall.Errno(0x19) -+ ENOTUNIQ = syscall.Errno(0x4c) -+ ENXIO = syscall.Errno(0x6) -+ EOPNOTSUPP = syscall.Errno(0x5f) -+ EOVERFLOW = syscall.Errno(0x4b) -+ EOWNERDEAD = syscall.Errno(0x82) -+ EPERM = syscall.Errno(0x1) -+ EPFNOSUPPORT = syscall.Errno(0x60) -+ EPIPE = syscall.Errno(0x20) -+ EPROTO = syscall.Errno(0x47) -+ EPROTONOSUPPORT = syscall.Errno(0x5d) -+ EPROTOTYPE = syscall.Errno(0x5b) -+ ERANGE = syscall.Errno(0x22) -+ EREMCHG = syscall.Errno(0x4e) -+ EREMOTE = syscall.Errno(0x42) -+ EREMOTEIO = syscall.Errno(0x79) -+ ERESTART = syscall.Errno(0x55) -+ ERFKILL = syscall.Errno(0x84) -+ EROFS = syscall.Errno(0x1e) -+ ESHUTDOWN = syscall.Errno(0x6c) -+ ESOCKTNOSUPPORT = syscall.Errno(0x5e) -+ ESPIPE = syscall.Errno(0x1d) -+ ESRCH = syscall.Errno(0x3) -+ ESRMNT = syscall.Errno(0x45) -+ ESTALE = syscall.Errno(0x74) -+ ESTRPIPE = syscall.Errno(0x56) -+ ETIME = syscall.Errno(0x3e) -+ ETIMEDOUT = syscall.Errno(0x6e) -+ ETOOMANYREFS = syscall.Errno(0x6d) -+ ETXTBSY = syscall.Errno(0x1a) -+ EUCLEAN = syscall.Errno(0x75) -+ EUNATCH = syscall.Errno(0x31) -+ EUSERS = syscall.Errno(0x57) -+ EWOULDBLOCK = syscall.Errno(0xb) -+ EXDEV = syscall.Errno(0x12) -+ EXFULL = syscall.Errno(0x36) -+) -+ -+// Signals -+const ( -+ SIGABRT = syscall.Signal(0x6) -+ SIGALRM = syscall.Signal(0xe) -+ SIGBUS = syscall.Signal(0x7) -+ SIGCHLD = syscall.Signal(0x11) -+ SIGCLD = syscall.Signal(0x11) -+ SIGCONT = syscall.Signal(0x12) -+ SIGFPE = syscall.Signal(0x8) -+ SIGHUP = syscall.Signal(0x1) -+ SIGILL = syscall.Signal(0x4) -+ SIGINT = syscall.Signal(0x2) -+ SIGIO = syscall.Signal(0x1d) -+ SIGIOT = syscall.Signal(0x6) -+ SIGKILL = syscall.Signal(0x9) -+ SIGPIPE = syscall.Signal(0xd) -+ SIGPOLL = syscall.Signal(0x1d) -+ SIGPROF = syscall.Signal(0x1b) -+ SIGPWR = syscall.Signal(0x1e) -+ SIGQUIT = syscall.Signal(0x3) -+ SIGSEGV = syscall.Signal(0xb) -+ SIGSTKFLT = syscall.Signal(0x10) -+ SIGSTOP = syscall.Signal(0x13) -+ SIGSYS = syscall.Signal(0x1f) -+ SIGTERM = syscall.Signal(0xf) -+ SIGTRAP = syscall.Signal(0x5) -+ SIGTSTP = syscall.Signal(0x14) -+ SIGTTIN = syscall.Signal(0x15) -+ SIGTTOU = syscall.Signal(0x16) -+ SIGURG = syscall.Signal(0x17) -+ SIGUSR1 = syscall.Signal(0xa) -+ SIGUSR2 = syscall.Signal(0xc) -+ SIGVTALRM = syscall.Signal(0x1a) -+ SIGWINCH = syscall.Signal(0x1c) -+ SIGXCPU = syscall.Signal(0x18) -+ SIGXFSZ = syscall.Signal(0x19) -+) -+ -+// Error table -+var errorList = [...]struct { -+ num syscall.Errno -+ name string -+ desc string -+}{ -+ {1, "EPERM", "operation not permitted"}, -+ {2, "ENOENT", "no such file or directory"}, -+ {3, "ESRCH", "no such process"}, -+ {4, "EINTR", "interrupted system call"}, -+ {5, "EIO", "input/output error"}, -+ {6, "ENXIO", "no such device or address"}, -+ {7, "E2BIG", "argument list too long"}, -+ {8, "ENOEXEC", "exec format error"}, -+ {9, "EBADF", "bad file descriptor"}, -+ {10, "ECHILD", "no child processes"}, -+ {11, "EAGAIN", "resource temporarily unavailable"}, -+ {12, "ENOMEM", "cannot allocate memory"}, -+ {13, "EACCES", "permission denied"}, -+ {14, "EFAULT", "bad address"}, -+ {15, "ENOTBLK", "block device required"}, -+ {16, "EBUSY", "device or resource busy"}, -+ {17, "EEXIST", "file exists"}, -+ {18, "EXDEV", "invalid cross-device link"}, -+ {19, "ENODEV", "no such device"}, -+ {20, "ENOTDIR", "not a directory"}, -+ {21, "EISDIR", "is a directory"}, -+ {22, "EINVAL", "invalid argument"}, -+ {23, "ENFILE", "too many open files in system"}, -+ {24, "EMFILE", "too many open files"}, -+ {25, "ENOTTY", "inappropriate ioctl for device"}, -+ {26, "ETXTBSY", "text file busy"}, -+ {27, "EFBIG", "file too large"}, -+ {28, "ENOSPC", "no space left on device"}, -+ {29, "ESPIPE", "illegal seek"}, -+ {30, "EROFS", "read-only file system"}, -+ {31, "EMLINK", "too many links"}, -+ {32, "EPIPE", "broken pipe"}, -+ {33, "EDOM", "numerical argument out of domain"}, -+ {34, "ERANGE", "numerical result out of range"}, -+ {35, "EDEADLK", "resource deadlock avoided"}, -+ {36, "ENAMETOOLONG", "file name too long"}, -+ {37, "ENOLCK", "no locks available"}, -+ {38, "ENOSYS", "function not implemented"}, -+ {39, "ENOTEMPTY", "directory not empty"}, -+ {40, "ELOOP", "too many levels of symbolic links"}, -+ {42, "ENOMSG", "no message of desired type"}, -+ {43, "EIDRM", "identifier removed"}, -+ {44, "ECHRNG", "channel number out of range"}, -+ {45, "EL2NSYNC", "level 2 not synchronized"}, -+ {46, "EL3HLT", "level 3 halted"}, -+ {47, "EL3RST", "level 3 reset"}, -+ {48, "ELNRNG", "link number out of range"}, -+ {49, "EUNATCH", "protocol driver not attached"}, -+ {50, "ENOCSI", "no CSI structure available"}, -+ {51, "EL2HLT", "level 2 halted"}, -+ {52, "EBADE", "invalid exchange"}, -+ {53, "EBADR", "invalid request descriptor"}, -+ {54, "EXFULL", "exchange full"}, -+ {55, "ENOANO", "no anode"}, -+ {56, "EBADRQC", "invalid request code"}, -+ {57, "EBADSLT", "invalid slot"}, -+ {59, "EBFONT", "bad font file format"}, -+ {60, "ENOSTR", "device not a stream"}, -+ {61, "ENODATA", "no data available"}, -+ {62, "ETIME", "timer expired"}, -+ {63, "ENOSR", "out of streams resources"}, -+ {64, "ENONET", "machine is not on the network"}, -+ {65, "ENOPKG", "package not installed"}, -+ {66, "EREMOTE", "object is remote"}, -+ {67, "ENOLINK", "link has been severed"}, -+ {68, "EADV", "advertise error"}, -+ {69, "ESRMNT", "srmount error"}, -+ {70, "ECOMM", "communication error on send"}, -+ {71, "EPROTO", "protocol error"}, -+ {72, "EMULTIHOP", "multihop attempted"}, -+ {73, "EDOTDOT", "RFS specific error"}, -+ {74, "EBADMSG", "bad message"}, -+ {75, "EOVERFLOW", "value too large for defined data type"}, -+ {76, "ENOTUNIQ", "name not unique on network"}, -+ {77, "EBADFD", "file descriptor in bad state"}, -+ {78, "EREMCHG", "remote address changed"}, -+ {79, "ELIBACC", "can not access a needed shared library"}, -+ {80, "ELIBBAD", "accessing a corrupted shared library"}, -+ {81, "ELIBSCN", ".lib section in a.out corrupted"}, -+ {82, "ELIBMAX", "attempting to link in too many shared libraries"}, -+ {83, "ELIBEXEC", "cannot exec a shared library directly"}, -+ {84, "EILSEQ", "invalid or incomplete multibyte or wide character"}, -+ {85, "ERESTART", "interrupted system call should be restarted"}, -+ {86, "ESTRPIPE", "streams pipe error"}, -+ {87, "EUSERS", "too many users"}, -+ {88, "ENOTSOCK", "socket operation on non-socket"}, -+ {89, "EDESTADDRREQ", "destination address required"}, -+ {90, "EMSGSIZE", "message too long"}, -+ {91, "EPROTOTYPE", "protocol wrong type for socket"}, -+ {92, "ENOPROTOOPT", "protocol not available"}, -+ {93, "EPROTONOSUPPORT", "protocol not supported"}, -+ {94, "ESOCKTNOSUPPORT", "socket type not supported"}, -+ {95, "ENOTSUP", "operation not supported"}, -+ {96, "EPFNOSUPPORT", "protocol family not supported"}, -+ {97, "EAFNOSUPPORT", "address family not supported by protocol"}, -+ {98, "EADDRINUSE", "address already in use"}, -+ {99, "EADDRNOTAVAIL", "cannot assign requested address"}, -+ {100, "ENETDOWN", "network is down"}, -+ {101, "ENETUNREACH", "network is unreachable"}, -+ {102, "ENETRESET", "network dropped connection on reset"}, -+ {103, "ECONNABORTED", "software caused connection abort"}, -+ {104, "ECONNRESET", "connection reset by peer"}, -+ {105, "ENOBUFS", "no buffer space available"}, -+ {106, "EISCONN", "transport endpoint is already connected"}, -+ {107, "ENOTCONN", "transport endpoint is not connected"}, -+ {108, "ESHUTDOWN", "cannot send after transport endpoint shutdown"}, -+ {109, "ETOOMANYREFS", "too many references: cannot splice"}, -+ {110, "ETIMEDOUT", "connection timed out"}, -+ {111, "ECONNREFUSED", "connection refused"}, -+ {112, "EHOSTDOWN", "host is down"}, -+ {113, "EHOSTUNREACH", "no route to host"}, -+ {114, "EALREADY", "operation already in progress"}, -+ {115, "EINPROGRESS", "operation now in progress"}, -+ {116, "ESTALE", "stale file handle"}, -+ {117, "EUCLEAN", "structure needs cleaning"}, -+ {118, "ENOTNAM", "not a XENIX named type file"}, -+ {119, "ENAVAIL", "no XENIX semaphores available"}, -+ {120, "EISNAM", "is a named type file"}, -+ {121, "EREMOTEIO", "remote I/O error"}, -+ {122, "EDQUOT", "disk quota exceeded"}, -+ {123, "ENOMEDIUM", "no medium found"}, -+ {124, "EMEDIUMTYPE", "wrong medium type"}, -+ {125, "ECANCELED", "operation canceled"}, -+ {126, "ENOKEY", "required key not available"}, -+ {127, "EKEYEXPIRED", "key has expired"}, -+ {128, "EKEYREVOKED", "key has been revoked"}, -+ {129, "EKEYREJECTED", "key was rejected by service"}, -+ {130, "EOWNERDEAD", "owner died"}, -+ {131, "ENOTRECOVERABLE", "state not recoverable"}, -+ {132, "ERFKILL", "operation not possible due to RF-kill"}, -+ {133, "EHWPOISON", "memory page has hardware error"}, -+} -+ -+// Signal table -+var signalList = [...]struct { -+ num syscall.Signal -+ name string -+ desc string -+}{ -+ {1, "SIGHUP", "hangup"}, -+ {2, "SIGINT", "interrupt"}, -+ {3, "SIGQUIT", "quit"}, -+ {4, "SIGILL", "illegal instruction"}, -+ {5, "SIGTRAP", "trace/breakpoint trap"}, -+ {6, "SIGABRT", "aborted"}, -+ {7, "SIGBUS", "bus error"}, -+ {8, "SIGFPE", "floating point exception"}, -+ {9, "SIGKILL", "killed"}, -+ {10, "SIGUSR1", "user defined signal 1"}, -+ {11, "SIGSEGV", "segmentation fault"}, -+ {12, "SIGUSR2", "user defined signal 2"}, -+ {13, "SIGPIPE", "broken pipe"}, -+ {14, "SIGALRM", "alarm clock"}, -+ {15, "SIGTERM", "terminated"}, -+ {16, "SIGSTKFLT", "stack fault"}, -+ {17, "SIGCHLD", "child exited"}, -+ {18, "SIGCONT", "continued"}, -+ {19, "SIGSTOP", "stopped (signal)"}, -+ {20, "SIGTSTP", "stopped"}, -+ {21, "SIGTTIN", "stopped (tty input)"}, -+ {22, "SIGTTOU", "stopped (tty output)"}, -+ {23, "SIGURG", "urgent I/O condition"}, -+ {24, "SIGXCPU", "CPU time limit exceeded"}, -+ {25, "SIGXFSZ", "file size limit exceeded"}, -+ {26, "SIGVTALRM", "virtual timer expired"}, -+ {27, "SIGPROF", "profiling timer expired"}, -+ {28, "SIGWINCH", "window changed"}, -+ {29, "SIGIO", "I/O possible"}, -+ {30, "SIGPWR", "power failure"}, -+ {31, "SIGSYS", "bad system call"}, -+} -diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go -new file mode 100644 -index 0000000..03143b2 ---- /dev/null -+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go -@@ -0,0 +1,2217 @@ -+// go run mksyscall.go -tags linux,riscv64 syscall_linux.go syscall_linux_riscv64.go -+// Code generated by the command above; see README.md. DO NOT EDIT. -+ -+// +build linux,riscv64 -+ -+package unix -+ -+import ( -+ "syscall" -+ "unsafe" -+) -+ -+var _ syscall.Errno -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func FanotifyInit(flags uint, event_f_flags uint) (fd int, err error) { -+ r0, _, e1 := Syscall(SYS_FANOTIFY_INIT, uintptr(flags), uintptr(event_f_flags), 0) -+ fd = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func fanotifyMark(fd int, flags uint, mask uint64, dirFd int, pathname *byte) (err error) { -+ _, _, e1 := Syscall6(SYS_FANOTIFY_MARK, uintptr(fd), uintptr(flags), uintptr(mask), uintptr(dirFd), uintptr(unsafe.Pointer(pathname)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func fchmodat(dirfd int, path string, mode uint32) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func ioctl(fd int, req uint, arg uintptr) (err error) { -+ _, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Linkat(olddirfd int, oldpath string, newdirfd int, newpath string, flags int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(oldpath) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(newpath) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall6(SYS_LINKAT, uintptr(olddirfd), uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func openat(dirfd int, path string, flags int, mode uint32) (fd int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ r0, _, e1 := Syscall6(SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags), uintptr(mode), 0, 0) -+ fd = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int, err error) { -+ r0, _, e1 := Syscall6(SYS_PPOLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ var _p1 unsafe.Pointer -+ if len(buf) > 0 { -+ _p1 = unsafe.Pointer(&buf[0]) -+ } else { -+ _p1 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall6(SYS_READLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(oldpath) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(newpath) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_SYMLINKAT, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1))) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Unlinkat(dirfd int, path string, flags int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_UNLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getcwd(buf []byte) (n int, err error) { -+ var _p0 unsafe.Pointer -+ if len(buf) > 0 { -+ _p0 = unsafe.Pointer(&buf[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall(SYS_GETCWD, uintptr(_p0), uintptr(len(buf)), 0) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err error) { -+ r0, _, e1 := Syscall6(SYS_WAIT4, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0) -+ wpid = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func KeyctlInt(cmd int, arg2 int, arg3 int, arg4 int, arg5 int) (ret int, err error) { -+ r0, _, e1 := Syscall6(SYS_KEYCTL, uintptr(cmd), uintptr(arg2), uintptr(arg3), uintptr(arg4), uintptr(arg5), 0) -+ ret = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func KeyctlBuffer(cmd int, arg2 int, buf []byte, arg5 int) (ret int, err error) { -+ var _p0 unsafe.Pointer -+ if len(buf) > 0 { -+ _p0 = unsafe.Pointer(&buf[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall6(SYS_KEYCTL, uintptr(cmd), uintptr(arg2), uintptr(_p0), uintptr(len(buf)), uintptr(arg5), 0) -+ ret = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func keyctlJoin(cmd int, arg2 string) (ret int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(arg2) -+ if err != nil { -+ return -+ } -+ r0, _, e1 := Syscall(SYS_KEYCTL, uintptr(cmd), uintptr(unsafe.Pointer(_p0)), 0) -+ ret = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func keyctlSearch(cmd int, arg2 int, arg3 string, arg4 string, arg5 int) (ret int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(arg3) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(arg4) -+ if err != nil { -+ return -+ } -+ r0, _, e1 := Syscall6(SYS_KEYCTL, uintptr(cmd), uintptr(arg2), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(arg5), 0) -+ ret = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func keyctlIOV(cmd int, arg2 int, payload []Iovec, arg5 int) (err error) { -+ var _p0 unsafe.Pointer -+ if len(payload) > 0 { -+ _p0 = unsafe.Pointer(&payload[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ _, _, e1 := Syscall6(SYS_KEYCTL, uintptr(cmd), uintptr(arg2), uintptr(_p0), uintptr(len(payload)), uintptr(arg5), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func keyctlDH(cmd int, arg2 *KeyctlDHParams, buf []byte) (ret int, err error) { -+ var _p0 unsafe.Pointer -+ if len(buf) > 0 { -+ _p0 = unsafe.Pointer(&buf[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall6(SYS_KEYCTL, uintptr(cmd), uintptr(unsafe.Pointer(arg2)), uintptr(_p0), uintptr(len(buf)), 0, 0) -+ ret = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func ptrace(request int, pid int, addr uintptr, data uintptr) (err error) { -+ _, _, e1 := Syscall6(SYS_PTRACE, uintptr(request), uintptr(pid), uintptr(addr), uintptr(data), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func reboot(magic1 uint, magic2 uint, cmd int, arg string) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(arg) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall6(SYS_REBOOT, uintptr(magic1), uintptr(magic2), uintptr(cmd), uintptr(unsafe.Pointer(_p0)), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func mount(source string, target string, fstype string, flags uintptr, data *byte) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(source) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(target) -+ if err != nil { -+ return -+ } -+ var _p2 *byte -+ _p2, err = BytePtrFromString(fstype) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall6(SYS_MOUNT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(unsafe.Pointer(_p2)), uintptr(flags), uintptr(unsafe.Pointer(data)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Acct(path string) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_ACCT, uintptr(unsafe.Pointer(_p0)), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func AddKey(keyType string, description string, payload []byte, ringid int) (id int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(keyType) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(description) -+ if err != nil { -+ return -+ } -+ var _p2 unsafe.Pointer -+ if len(payload) > 0 { -+ _p2 = unsafe.Pointer(&payload[0]) -+ } else { -+ _p2 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall6(SYS_ADD_KEY, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(payload)), uintptr(ringid), 0) -+ id = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Adjtimex(buf *Timex) (state int, err error) { -+ r0, _, e1 := Syscall(SYS_ADJTIMEX, uintptr(unsafe.Pointer(buf)), 0, 0) -+ state = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Chdir(path string) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_CHDIR, uintptr(unsafe.Pointer(_p0)), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Chroot(path string) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_CHROOT, uintptr(unsafe.Pointer(_p0)), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func ClockGetres(clockid int32, res *Timespec) (err error) { -+ _, _, e1 := Syscall(SYS_CLOCK_GETRES, uintptr(clockid), uintptr(unsafe.Pointer(res)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func ClockGettime(clockid int32, time *Timespec) (err error) { -+ _, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func ClockNanosleep(clockid int32, flags int, request *Timespec, remain *Timespec) (err error) { -+ _, _, e1 := Syscall6(SYS_CLOCK_NANOSLEEP, uintptr(clockid), uintptr(flags), uintptr(unsafe.Pointer(request)), uintptr(unsafe.Pointer(remain)), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Close(fd int) (err error) { -+ _, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func CopyFileRange(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int, err error) { -+ r0, _, e1 := Syscall6(SYS_COPY_FILE_RANGE, uintptr(rfd), uintptr(unsafe.Pointer(roff)), uintptr(wfd), uintptr(unsafe.Pointer(woff)), uintptr(len), uintptr(flags)) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func DeleteModule(name string, flags int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(name) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_DELETE_MODULE, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Dup(oldfd int) (fd int, err error) { -+ r0, _, e1 := Syscall(SYS_DUP, uintptr(oldfd), 0, 0) -+ fd = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Dup3(oldfd int, newfd int, flags int) (err error) { -+ _, _, e1 := Syscall(SYS_DUP3, uintptr(oldfd), uintptr(newfd), uintptr(flags)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func EpollCreate1(flag int) (fd int, err error) { -+ r0, _, e1 := RawSyscall(SYS_EPOLL_CREATE1, uintptr(flag), 0, 0) -+ fd = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func EpollCtl(epfd int, op int, fd int, event *EpollEvent) (err error) { -+ _, _, e1 := RawSyscall6(SYS_EPOLL_CTL, uintptr(epfd), uintptr(op), uintptr(fd), uintptr(unsafe.Pointer(event)), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Eventfd(initval uint, flags int) (fd int, err error) { -+ r0, _, e1 := Syscall(SYS_EVENTFD2, uintptr(initval), uintptr(flags), 0) -+ fd = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Exit(code int) { -+ Syscall(SYS_EXIT_GROUP, uintptr(code), 0, 0) -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fallocate(fd int, mode uint32, off int64, len int64) (err error) { -+ _, _, e1 := Syscall6(SYS_FALLOCATE, uintptr(fd), uintptr(mode), uintptr(off), uintptr(len), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fchdir(fd int) (err error) { -+ _, _, e1 := Syscall(SYS_FCHDIR, uintptr(fd), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fchmod(fd int, mode uint32) (err error) { -+ _, _, e1 := Syscall(SYS_FCHMOD, uintptr(fd), uintptr(mode), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall6(SYS_FCHOWNAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func fcntl(fd int, cmd int, arg int) (val int, err error) { -+ r0, _, e1 := Syscall(SYS_FCNTL, uintptr(fd), uintptr(cmd), uintptr(arg)) -+ val = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fdatasync(fd int) (err error) { -+ _, _, e1 := Syscall(SYS_FDATASYNC, uintptr(fd), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fgetxattr(fd int, attr string, dest []byte) (sz int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(attr) -+ if err != nil { -+ return -+ } -+ var _p1 unsafe.Pointer -+ if len(dest) > 0 { -+ _p1 = unsafe.Pointer(&dest[0]) -+ } else { -+ _p1 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall6(SYS_FGETXATTR, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)), 0, 0) -+ sz = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func FinitModule(fd int, params string, flags int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(params) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_FINIT_MODULE, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(flags)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Flistxattr(fd int, dest []byte) (sz int, err error) { -+ var _p0 unsafe.Pointer -+ if len(dest) > 0 { -+ _p0 = unsafe.Pointer(&dest[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall(SYS_FLISTXATTR, uintptr(fd), uintptr(_p0), uintptr(len(dest))) -+ sz = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Flock(fd int, how int) (err error) { -+ _, _, e1 := Syscall(SYS_FLOCK, uintptr(fd), uintptr(how), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fremovexattr(fd int, attr string) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(attr) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_FREMOVEXATTR, uintptr(fd), uintptr(unsafe.Pointer(_p0)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fsetxattr(fd int, attr string, dest []byte, flags int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(attr) -+ if err != nil { -+ return -+ } -+ var _p1 unsafe.Pointer -+ if len(dest) > 0 { -+ _p1 = unsafe.Pointer(&dest[0]) -+ } else { -+ _p1 = unsafe.Pointer(&_zero) -+ } -+ _, _, e1 := Syscall6(SYS_FSETXATTR, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)), uintptr(flags), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fsync(fd int) (err error) { -+ _, _, e1 := Syscall(SYS_FSYNC, uintptr(fd), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getdents(fd int, buf []byte) (n int, err error) { -+ var _p0 unsafe.Pointer -+ if len(buf) > 0 { -+ _p0 = unsafe.Pointer(&buf[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall(SYS_GETDENTS64, uintptr(fd), uintptr(_p0), uintptr(len(buf))) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getpgid(pid int) (pgid int, err error) { -+ r0, _, e1 := RawSyscall(SYS_GETPGID, uintptr(pid), 0, 0) -+ pgid = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getpid() (pid int) { -+ r0, _, _ := RawSyscall(SYS_GETPID, 0, 0, 0) -+ pid = int(r0) -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getppid() (ppid int) { -+ r0,_,_:=RawSyscall(SYS_GETPPID, 0, 0, 0) -+ ppid=int(r0) -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getpriority(which int, who int) (prio int, err error) { -+ r0, _, e1 := Syscall(SYS_GETPRIORITY, uintptr(which), uintptr(who), 0) -+ prio = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getrandom(buf []byte, flags int) (n int, err error) { -+ var _p0 unsafe.Pointer -+ if len(buf) > 0 { -+ _p0 = unsafe.Pointer(&buf[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall(SYS_GETRANDOM, uintptr(_p0), uintptr(len(buf)), uintptr(flags)) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getrusage(who int, rusage *Rusage) (err error) { -+ _, _, e1 := RawSyscall(SYS_GETRUSAGE, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getsid(pid int) (sid int, err error) { -+ r0, _, e1 := RawSyscall(SYS_GETSID, uintptr(pid), 0, 0) -+ sid = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Gettid() (tid int) { -+ r0, _, _ := RawSyscall(SYS_GETTID, 0, 0, 0) -+ tid = int(r0) -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getxattr(path string, attr string, dest []byte) (sz int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(attr) -+ if err != nil { -+ return -+ } -+ var _p2 unsafe.Pointer -+ if len(dest) > 0 { -+ _p2 = unsafe.Pointer(&dest[0]) -+ } else { -+ _p2 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall6(SYS_GETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0) -+ sz = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func InitModule(moduleImage []byte, params string) (err error) { -+ var _p0 unsafe.Pointer -+ if len(moduleImage) > 0 { -+ _p0 = unsafe.Pointer(&moduleImage[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(params) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_INIT_MODULE, uintptr(_p0), uintptr(len(moduleImage)), uintptr(unsafe.Pointer(_p1))) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func InotifyAddWatch(fd int, pathname string, mask uint32) (watchdesc int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(pathname) -+ if err != nil { -+ return -+ } -+ r0, _, e1 := Syscall(SYS_INOTIFY_ADD_WATCH, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(mask)) -+ watchdesc = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func InotifyInit1(flags int) (fd int, err error) { -+ r0, _, e1 := RawSyscall(SYS_INOTIFY_INIT1, uintptr(flags), 0, 0) -+ fd = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func InotifyRmWatch(fd int, watchdesc uint32) (success int, err error) { -+ r0, _, e1 := RawSyscall(SYS_INOTIFY_RM_WATCH, uintptr(fd), uintptr(watchdesc), 0) -+ success = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Kill(pid int, sig syscall.Signal) (err error) { -+ _, _, e1 := RawSyscall(SYS_KILL, uintptr(pid), uintptr(sig), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Klogctl(typ int, buf []byte) (n int, err error) { -+ var _p0 unsafe.Pointer -+ if len(buf) > 0 { -+ _p0 = unsafe.Pointer(&buf[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall(SYS_SYSLOG, uintptr(typ), uintptr(_p0), uintptr(len(buf))) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Lgetxattr(path string, attr string, dest []byte) (sz int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(attr) -+ if err != nil { -+ return -+ } -+ var _p2 unsafe.Pointer -+ if len(dest) > 0 { -+ _p2 = unsafe.Pointer(&dest[0]) -+ } else { -+ _p2 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall6(SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0) -+ sz = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Listxattr(path string, dest []byte) (sz int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ var _p1 unsafe.Pointer -+ if len(dest) > 0 { -+ _p1 = unsafe.Pointer(&dest[0]) -+ } else { -+ _p1 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall(SYS_LISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest))) -+ sz = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Llistxattr(path string, dest []byte) (sz int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ var _p1 unsafe.Pointer -+ if len(dest) > 0 { -+ _p1 = unsafe.Pointer(&dest[0]) -+ } else { -+ _p1 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall(SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest))) -+ sz = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Lremovexattr(path string, attr string) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(attr) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Lsetxattr(path string, attr string, data []byte, flags int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(attr) -+ if err != nil { -+ return -+ } -+ var _p2 unsafe.Pointer -+ if len(data) > 0 { -+ _p2 = unsafe.Pointer(&data[0]) -+ } else { -+ _p2 = unsafe.Pointer(&_zero) -+ } -+ _, _, e1 := Syscall6(SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func MemfdCreate(name string, flags int) (fd int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(name) -+ if err != nil { -+ return -+ } -+ r0, _, e1 := Syscall(SYS_MEMFD_CREATE, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0) -+ fd = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Mkdirat(dirfd int, path string, mode uint32) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_MKDIRAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall6(SYS_MKNODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Nanosleep(time *Timespec, leftover *Timespec) (err error) { -+ _, _, e1 := Syscall(SYS_NANOSLEEP, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func PerfEventOpen(attr *PerfEventAttr, pid int, cpu int, groupFd int, flags int) (fd int, err error) { -+ r0, _, e1 := Syscall6(SYS_PERF_EVENT_OPEN, uintptr(unsafe.Pointer(attr)), uintptr(pid), uintptr(cpu), uintptr(groupFd), uintptr(flags), 0) -+ fd = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func PivotRoot(newroot string, putold string) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(newroot) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(putold) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_PIVOT_ROOT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func prlimit(pid int, resource int, newlimit *Rlimit, old *Rlimit) (err error) { -+ _, _, e1 := RawSyscall6(SYS_PRLIMIT64, uintptr(pid), uintptr(resource), uintptr(unsafe.Pointer(newlimit)), uintptr(unsafe.Pointer(old)), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Prctl(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 uintptr) (err error) { -+ _, _, e1 := Syscall6(SYS_PRCTL, uintptr(option), uintptr(arg2), uintptr(arg3), uintptr(arg4), uintptr(arg5), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Pselect(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timespec, sigmask *Sigset_t) (n int, err error) { -+ r0, _, e1 := Syscall6(SYS_PSELECT6, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask))) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func read(fd int, p []byte) (n int, err error) { -+ var _p0 unsafe.Pointer -+ if len(p) > 0 { -+ _p0 = unsafe.Pointer(&p[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(_p0), uintptr(len(p))) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Removexattr(path string, attr string) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(attr) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_REMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Renameat2(olddirfd int, oldpath string, newdirfd int, newpath string, flags uint) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(oldpath) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(newpath) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall6(SYS_RENAMEAT2, uintptr(olddirfd), uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func RequestKey(keyType string, description string, callback string, destRingid int) (id int, err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(keyType) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(description) -+ if err != nil { -+ return -+ } -+ var _p2 *byte -+ _p2, err = BytePtrFromString(callback) -+ if err != nil { -+ return -+ } -+ r0, _, e1 := Syscall6(SYS_REQUEST_KEY, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(unsafe.Pointer(_p2)), uintptr(destRingid), 0, 0) -+ id = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setdomainname(p []byte) (err error) { -+ var _p0 unsafe.Pointer -+ if len(p) > 0 { -+ _p0 = unsafe.Pointer(&p[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ _, _, e1 := Syscall(SYS_SETDOMAINNAME, uintptr(_p0), uintptr(len(p)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Sethostname(p []byte) (err error) { -+ var _p0 unsafe.Pointer -+ if len(p) > 0 { -+ _p0 = unsafe.Pointer(&p[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ _, _, e1 := Syscall(SYS_SETHOSTNAME, uintptr(_p0), uintptr(len(p)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setpgid(pid int, pgid int) (err error) { -+ _, _, e1 := RawSyscall(SYS_SETPGID, uintptr(pid), uintptr(pgid), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setsid() (pid int, err error) { -+ r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0) -+ pid = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Settimeofday(tv *Timeval) (err error) { -+ _, _, e1 := RawSyscall(SYS_SETTIMEOFDAY, uintptr(unsafe.Pointer(tv)), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setns(fd int, nstype int) (err error) { -+ _, _, e1 := Syscall(SYS_SETNS, uintptr(fd), uintptr(nstype), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setpriority(which int, who int, prio int) (err error) { -+ _, _, e1 := Syscall(SYS_SETPRIORITY, uintptr(which), uintptr(who), uintptr(prio)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setxattr(path string, attr string, data []byte, flags int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ var _p1 *byte -+ _p1, err = BytePtrFromString(attr) -+ if err != nil { -+ return -+ } -+ var _p2 unsafe.Pointer -+ if len(data) > 0 { -+ _p2 = unsafe.Pointer(&data[0]) -+ } else { -+ _p2 = unsafe.Pointer(&_zero) -+ } -+ _, _, e1 := Syscall6(SYS_SETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Statx(dirfd int, path string, flags int, mask int, stat *Statx_t) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall6(SYS_STATX, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags), uintptr(mask), uintptr(unsafe.Pointer(stat)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Syncfs(fd int) (err error) { -+ _, _, e1 := Syscall(SYS_SYNCFS, uintptr(fd), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Sync() { -+ Syscall(SYS_SYNC, 0, 0, 0) -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Sysinfo(info *Sysinfo_t) (err error) { -+ _, _, e1 := RawSyscall(SYS_SYSINFO, uintptr(unsafe.Pointer(info)), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) { -+ r0, _, e1 := Syscall6(SYS_TEE, uintptr(rfd), uintptr(wfd), uintptr(len), uintptr(flags), 0, 0) -+ n = int64(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Tgkill(tgid int, tid int, sig syscall.Signal) (err error) { -+ _, _, e1 := RawSyscall(SYS_TGKILL, uintptr(tgid), uintptr(tid), uintptr(sig)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Times(tms *Tms) (ticks uintptr, err error) { -+ r0, _, e1 := RawSyscall(SYS_TIMES, uintptr(unsafe.Pointer(tms)), 0, 0) -+ ticks = uintptr(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Umask(mask int) (oldmask int) { -+ r0, _, _ := RawSyscall(SYS_UMASK, uintptr(mask), 0, 0) -+ oldmask = int(r0) -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Uname(buf *Utsname) (err error) { -+ _, _, e1 := RawSyscall(SYS_UNAME, uintptr(unsafe.Pointer(buf)), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Unmount(target string, flags int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(target) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_UMOUNT2, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Unshare(flags int) (err error) { -+ _, _, e1 := Syscall(SYS_UNSHARE, uintptr(flags), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func write(fd int, p []byte) (n int, err error) { -+ var _p0 unsafe.Pointer -+ if len(p) > 0 { -+ _p0 = unsafe.Pointer(&p[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(_p0), uintptr(len(p))) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func exitThread(code int) (err error) { -+ _, _, e1 := Syscall(SYS_EXIT, uintptr(code), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func readlen(fd int, p *byte, np int) (n int, err error) { -+ r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(p)), uintptr(np)) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func writelen(fd int, p *byte, np int) (n int, err error) { -+ r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(p)), uintptr(np)) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func munmap(addr uintptr, length uintptr) (err error) { -+ _, _, e1 := Syscall(SYS_MUNMAP, uintptr(addr), uintptr(length), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Madvise(b []byte, advice int) (err error) { -+ var _p0 unsafe.Pointer -+ if len(b) > 0 { -+ _p0 = unsafe.Pointer(&b[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ _, _, e1 := Syscall(SYS_MADVISE, uintptr(_p0), uintptr(len(b)), uintptr(advice)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Mprotect(b []byte, prot int) (err error) { -+ var _p0 unsafe.Pointer -+ if len(b) > 0 { -+ _p0 = unsafe.Pointer(&b[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ _, _, e1 := Syscall(SYS_MPROTECT, uintptr(_p0), uintptr(len(b)), uintptr(prot)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Mlock(b []byte) (err error) { -+ var _p0 unsafe.Pointer -+ if len(b) > 0 { -+ _p0 = unsafe.Pointer(&b[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ _, _, e1 := Syscall(SYS_MLOCK, uintptr(_p0), uintptr(len(b)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Mlockall(flags int) (err error) { -+ _, _, e1 := Syscall(SYS_MLOCKALL, uintptr(flags), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Msync(b []byte, flags int) (err error) { -+ var _p0 unsafe.Pointer -+ if len(b) > 0 { -+ _p0 = unsafe.Pointer(&b[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ _, _, e1 := Syscall(SYS_MSYNC, uintptr(_p0), uintptr(len(b)), uintptr(flags)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Munlock(b []byte) (err error) { -+ var _p0 unsafe.Pointer -+ if len(b) > 0 { -+ _p0 = unsafe.Pointer(&b[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ _, _, e1 := Syscall(SYS_MUNLOCK, uintptr(_p0), uintptr(len(b)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Munlockall() (err error) { -+ _, _, e1 := Syscall(SYS_MUNLOCKALL, 0, 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func faccessat(dirfd int, path string, mode uint32) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_FACCESSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) { -+ var _p0 unsafe.Pointer -+ if len(events) > 0 { -+ _p0 = unsafe.Pointer(&events[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall6(SYS_EPOLL_PWAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fadvise(fd int, offset int64, length int64, advice int) (err error) { -+ _, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fchown(fd int, uid int, gid int) (err error) { -+ _, _, e1 := Syscall(SYS_FCHOWN, uintptr(fd), uintptr(uid), uintptr(gid)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fstat(fd int, stat *Stat_t) (err error) { -+ _, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall6(SYS_FSTATAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Fstatfs(fd int, buf *Statfs_t) (err error) { -+ _, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(buf)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Ftruncate(fd int, length int64) (err error) { -+ _, _, e1 := Syscall(SYS_FTRUNCATE, uintptr(fd), uintptr(length), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getegid() (egid int) { -+ r0, _, _ := RawSyscall(SYS_GETEGID, 0, 0, 0) -+ egid = int(r0) -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Geteuid() (euid int) { -+ r0, _, _ := RawSyscall(SYS_GETEUID, 0, 0, 0) -+ euid = int(r0) -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getgid() (gid int) { -+ r0, _, _ := RawSyscall(SYS_GETGID, 0, 0, 0) -+ gid = int(r0) -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getrlimit(resource int, rlim *Rlimit) (err error) { -+ _, _, e1 := RawSyscall(SYS_GETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Getuid() (uid int) { -+ r0, _, _ := RawSyscall(SYS_GETUID, 0, 0, 0) -+ uid = int(r0) -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Listen(s int, n int) (err error) { -+ _, _, e1 := Syscall(SYS_LISTEN, uintptr(s), uintptr(n), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Pread(fd int, p []byte, offset int64) (n int, err error) { -+ var _p0 unsafe.Pointer -+ if len(p) > 0 { -+ _p0 = unsafe.Pointer(&p[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall6(SYS_PREAD64, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Pwrite(fd int, p []byte, offset int64) (n int, err error) { -+ var _p0 unsafe.Pointer -+ if len(p) > 0 { -+ _p0 = unsafe.Pointer(&p[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall6(SYS_PWRITE64, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Seek(fd int, offset int64, whence int) (off int64, err error) { -+ r0, _, e1 := Syscall(SYS_LSEEK, uintptr(fd), uintptr(offset), uintptr(whence)) -+ off = int64(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) { -+ r0, _, e1 := Syscall6(SYS_SENDFILE, uintptr(outfd), uintptr(infd), uintptr(unsafe.Pointer(offset)), uintptr(count), 0, 0) -+ written = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setfsgid(gid int) (err error) { -+ _, _, e1 := Syscall(SYS_SETFSGID, uintptr(gid), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setfsuid(uid int) (err error) { -+ _, _, e1 := Syscall(SYS_SETFSUID, uintptr(uid), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setregid(rgid int, egid int) (err error) { -+ _, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setresgid(rgid int, egid int, sgid int) (err error) { -+ _, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setresuid(ruid int, euid int, suid int) (err error) { -+ _, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setrlimit(resource int, rlim *Rlimit) (err error) { -+ _, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Setreuid(ruid int, euid int) (err error) { -+ _, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Shutdown(fd int, how int) (err error) { -+ _, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error) { -+ r0, _, e1 := Syscall6(SYS_SPLICE, uintptr(rfd), uintptr(unsafe.Pointer(roff)), uintptr(wfd), uintptr(unsafe.Pointer(woff)), uintptr(len), uintptr(flags)) -+ n = int64(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Statfs(path string, buf *Statfs_t) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_STATFS, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(buf)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func SyncFileRange(fd int, off int64, n int64, flags int) (err error) { -+ _, _, e1 := Syscall6(SYS_SYNC_FILE_RANGE, uintptr(fd), uintptr(off), uintptr(n), uintptr(flags), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Truncate(path string, length int64) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(path) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall(SYS_TRUNCATE, uintptr(unsafe.Pointer(_p0)), uintptr(length), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) { -+ r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen))) -+ fd = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) { -+ r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0) -+ fd = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) { -+ _, _, e1 := Syscall(SYS_BIND, uintptr(s), uintptr(addr), uintptr(addrlen)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) { -+ _, _, e1 := Syscall(SYS_CONNECT, uintptr(s), uintptr(addr), uintptr(addrlen)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func getgroups(n int, list *_Gid_t) (nn int, err error) { -+ r0, _, e1 := RawSyscall(SYS_GETGROUPS, uintptr(n), uintptr(unsafe.Pointer(list)), 0) -+ nn = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func setgroups(n int, list *_Gid_t) (err error) { -+ _, _, e1 := RawSyscall(SYS_SETGROUPS, uintptr(n), uintptr(unsafe.Pointer(list)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) { -+ _, _, e1 := Syscall6(SYS_GETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) { -+ _, _, e1 := Syscall6(SYS_SETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func socket(domain int, typ int, proto int) (fd int, err error) { -+ r0, _, e1 := RawSyscall(SYS_SOCKET, uintptr(domain), uintptr(typ), uintptr(proto)) -+ fd = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) { -+ _, _, e1 := RawSyscall6(SYS_SOCKETPAIR, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) { -+ _, _, e1 := RawSyscall(SYS_GETPEERNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen))) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) { -+ _, _, e1 := RawSyscall(SYS_GETSOCKNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen))) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) { -+ var _p0 unsafe.Pointer -+ if len(p) > 0 { -+ _p0 = unsafe.Pointer(&p[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ r0, _, e1 := Syscall6(SYS_RECVFROM, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen))) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error) { -+ var _p0 unsafe.Pointer -+ if len(buf) > 0 { -+ _p0 = unsafe.Pointer(&buf[0]) -+ } else { -+ _p0 = unsafe.Pointer(&_zero) -+ } -+ _, _, e1 := Syscall6(SYS_SENDTO, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen)) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) { -+ r0, _, e1 := Syscall(SYS_RECVMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags)) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) { -+ r0, _, e1 := Syscall(SYS_SENDMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags)) -+ n = int(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func mmap(addr uintptr, length uintptr, prot int, flags int, fd int, offset int64) (xaddr uintptr, err error) { -+ r0, _, e1 := Syscall6(SYS_MMAP, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flags), uintptr(fd), uintptr(offset)) -+ xaddr = uintptr(r0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func Gettimeofday(tv *Timeval) (err error) { -+ _, _, e1 := RawSyscall(SYS_GETTIMEOFDAY, uintptr(unsafe.Pointer(tv)), 0, 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func pipe2(p *[2]_C_int, flags int) (err error) { -+ _, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -+ -+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT -+ -+func kexecFileLoad(kernelFd int, initrdFd int, cmdlineLen int, cmdline string, flags int) (err error) { -+ var _p0 *byte -+ _p0, err = BytePtrFromString(cmdline) -+ if err != nil { -+ return -+ } -+ _, _, e1 := Syscall6(SYS_KEXEC_FILE_LOAD, uintptr(kernelFd), uintptr(initrdFd), uintptr(cmdlineLen), uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0) -+ if e1 != 0 { -+ err = errnoErr(e1) -+ } -+ return -+} -diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go -new file mode 100644 -index 0000000..38868fe ---- /dev/null -+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go -@@ -0,0 +1,289 @@ -+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include /tmp/include/asm/unistd.h -+// Code generated by the command above; see README.md. DO NOT EDIT. -+ -+// +build riscv64,linux -+ -+package unix -+ -+const ( -+ SYS_IO_SETUP = 0 -+ SYS_IO_DESTROY = 1 -+ SYS_IO_SUBMIT = 2 -+ SYS_IO_CANCEL = 3 -+ SYS_IO_GETEVENTS = 4 -+ SYS_SETXATTR = 5 -+ SYS_LSETXATTR = 6 -+ SYS_FSETXATTR = 7 -+ SYS_GETXATTR = 8 -+ SYS_LGETXATTR = 9 -+ SYS_FGETXATTR = 10 -+ SYS_LISTXATTR = 11 -+ SYS_LLISTXATTR = 12 -+ SYS_FLISTXATTR = 13 -+ SYS_REMOVEXATTR = 14 -+ SYS_LREMOVEXATTR = 15 -+ SYS_FREMOVEXATTR = 16 -+ SYS_GETCWD = 17 -+ SYS_LOOKUP_DCOOKIE = 18 -+ SYS_EVENTFD2 = 19 -+ SYS_EPOLL_CREATE1 = 20 -+ SYS_EPOLL_CTL = 21 -+ SYS_EPOLL_PWAIT = 22 -+ SYS_DUP = 23 -+ SYS_DUP3 = 24 -+ SYS_FCNTL = 25 -+ SYS_INOTIFY_INIT1 = 26 -+ SYS_INOTIFY_ADD_WATCH = 27 -+ SYS_INOTIFY_RM_WATCH = 28 -+ SYS_IOCTL = 29 -+ SYS_IOPRIO_SET = 30 -+ SYS_IOPRIO_GET = 31 -+ SYS_FLOCK = 32 -+ SYS_MKNODAT = 33 -+ SYS_MKDIRAT = 34 -+ SYS_UNLINKAT = 35 -+ SYS_SYMLINKAT = 36 -+ SYS_LINKAT = 37 -+ SYS_UMOUNT2 = 39 -+ SYS_MOUNT = 40 -+ SYS_PIVOT_ROOT = 41 -+ SYS_NFSSERVCTL = 42 -+ SYS_STATFS = 43 -+ SYS_FSTATFS = 44 -+ SYS_TRUNCATE = 45 -+ SYS_FTRUNCATE = 46 -+ SYS_FALLOCATE = 47 -+ SYS_FACCESSAT = 48 -+ SYS_CHDIR = 49 -+ SYS_FCHDIR = 50 -+ SYS_CHROOT = 51 -+ SYS_FCHMOD = 52 -+ SYS_FCHMODAT = 53 -+ SYS_FCHOWNAT = 54 -+ SYS_FCHOWN = 55 -+ SYS_OPENAT = 56 -+ SYS_CLOSE = 57 -+ SYS_VHANGUP = 58 -+ SYS_PIPE2 = 59 -+ SYS_QUOTACTL = 60 -+ SYS_GETDENTS64 = 61 -+ SYS_LSEEK = 62 -+ SYS_READ = 63 -+ SYS_WRITE = 64 -+ SYS_READV = 65 -+ SYS_WRITEV = 66 -+ SYS_PREAD64 = 67 -+ SYS_PWRITE64 = 68 -+ SYS_PREADV = 69 -+ SYS_PWRITEV = 70 -+ SYS_SENDFILE = 71 -+ SYS_PSELECT6 = 72 -+ SYS_PPOLL = 73 -+ SYS_SIGNALFD4 = 74 -+ SYS_VMSPLICE = 75 -+ SYS_SPLICE = 76 -+ SYS_TEE = 77 -+ SYS_READLINKAT = 78 -+ SYS_FSTATAT = 79 -+ SYS_FSTAT = 80 -+ SYS_SYNC = 81 -+ SYS_FSYNC = 82 -+ SYS_FDATASYNC = 83 -+ SYS_SYNC_FILE_RANGE = 84 -+ SYS_TIMERFD_CREATE = 85 -+ SYS_TIMERFD_SETTIME = 86 -+ SYS_TIMERFD_GETTIME = 87 -+ SYS_UTIMENSAT = 88 -+ SYS_ACCT = 89 -+ SYS_CAPGET = 90 -+ SYS_CAPSET = 91 -+ SYS_PERSONALITY = 92 -+ SYS_EXIT = 93 -+ SYS_EXIT_GROUP = 94 -+ SYS_WAITID = 95 -+ SYS_SET_TID_ADDRESS = 96 -+ SYS_UNSHARE = 97 -+ SYS_FUTEX = 98 -+ SYS_SET_ROBUST_LIST = 99 -+ SYS_GET_ROBUST_LIST = 100 -+ SYS_NANOSLEEP = 101 -+ SYS_GETITIMER = 102 -+ SYS_SETITIMER = 103 -+ SYS_KEXEC_LOAD = 104 -+ SYS_INIT_MODULE = 105 -+ SYS_DELETE_MODULE = 106 -+ SYS_TIMER_CREATE = 107 -+ SYS_TIMER_GETTIME = 108 -+ SYS_TIMER_GETOVERRUN = 109 -+ SYS_TIMER_SETTIME = 110 -+ SYS_TIMER_DELETE = 111 -+ SYS_CLOCK_SETTIME = 112 -+ SYS_CLOCK_GETTIME = 113 -+ SYS_CLOCK_GETRES = 114 -+ SYS_CLOCK_NANOSLEEP = 115 -+ SYS_SYSLOG = 116 -+ SYS_PTRACE = 117 -+ SYS_SCHED_SETPARAM = 118 -+ SYS_SCHED_SETSCHEDULER = 119 -+ SYS_SCHED_GETSCHEDULER = 120 -+ SYS_SCHED_GETPARAM = 121 -+ SYS_SCHED_SETAFFINITY = 122 -+ SYS_SCHED_GETAFFINITY = 123 -+ SYS_SCHED_YIELD = 124 -+ SYS_SCHED_GET_PRIORITY_MAX = 125 -+ SYS_SCHED_GET_PRIORITY_MIN = 126 -+ SYS_SCHED_RR_GET_INTERVAL = 127 -+ SYS_RESTART_SYSCALL = 128 -+ SYS_KILL = 129 -+ SYS_TKILL = 130 -+ SYS_TGKILL = 131 -+ SYS_SIGALTSTACK = 132 -+ SYS_RT_SIGSUSPEND = 133 -+ SYS_RT_SIGACTION = 134 -+ SYS_RT_SIGPROCMASK = 135 -+ SYS_RT_SIGPENDING = 136 -+ SYS_RT_SIGTIMEDWAIT = 137 -+ SYS_RT_SIGQUEUEINFO = 138 -+ SYS_RT_SIGRETURN = 139 -+ SYS_SETPRIORITY = 140 -+ SYS_GETPRIORITY = 141 -+ SYS_REBOOT = 142 -+ SYS_SETREGID = 143 -+ SYS_SETGID = 144 -+ SYS_SETREUID = 145 -+ SYS_SETUID = 146 -+ SYS_SETRESUID = 147 -+ SYS_GETRESUID = 148 -+ SYS_SETRESGID = 149 -+ SYS_GETRESGID = 150 -+ SYS_SETFSUID = 151 -+ SYS_SETFSGID = 152 -+ SYS_TIMES = 153 -+ SYS_SETPGID = 154 -+ SYS_GETPGID = 155 -+ SYS_GETSID = 156 -+ SYS_SETSID = 157 -+ SYS_GETGROUPS = 158 -+ SYS_SETGROUPS = 159 -+ SYS_UNAME = 160 -+ SYS_SETHOSTNAME = 161 -+ SYS_SETDOMAINNAME = 162 -+ SYS_GETRLIMIT = 163 -+ SYS_SETRLIMIT = 164 -+ SYS_GETRUSAGE = 165 -+ SYS_UMASK = 166 -+ SYS_PRCTL = 167 -+ SYS_GETCPU = 168 -+ SYS_GETTIMEOFDAY = 169 -+ SYS_SETTIMEOFDAY = 170 -+ SYS_ADJTIMEX = 171 -+ SYS_GETPID = 172 -+ SYS_GETPPID = 173 -+ SYS_GETUID = 174 -+ SYS_GETEUID = 175 -+ SYS_GETGID = 176 -+ SYS_GETEGID = 177 -+ SYS_GETTID = 178 -+ SYS_SYSINFO = 179 -+ SYS_MQ_OPEN = 180 -+ SYS_MQ_UNLINK = 181 -+ SYS_MQ_TIMEDSEND = 182 -+ SYS_MQ_TIMEDRECEIVE = 183 -+ SYS_MQ_NOTIFY = 184 -+ SYS_MQ_GETSETATTR = 185 -+ SYS_MSGGET = 186 -+ SYS_MSGCTL = 187 -+ SYS_MSGRCV = 188 -+ SYS_MSGSND = 189 -+ SYS_SEMGET = 190 -+ SYS_SEMCTL = 191 -+ SYS_SEMTIMEDOP = 192 -+ SYS_SEMOP = 193 -+ SYS_SHMGET = 194 -+ SYS_SHMCTL = 195 -+ SYS_SHMAT = 196 -+ SYS_SHMDT = 197 -+ SYS_SOCKET = 198 -+ SYS_SOCKETPAIR = 199 -+ SYS_BIND = 200 -+ SYS_LISTEN = 201 -+ SYS_ACCEPT = 202 -+ SYS_CONNECT = 203 -+ SYS_GETSOCKNAME = 204 -+ SYS_GETPEERNAME = 205 -+ SYS_SENDTO = 206 -+ SYS_RECVFROM = 207 -+ SYS_SETSOCKOPT = 208 -+ SYS_GETSOCKOPT = 209 -+ SYS_SHUTDOWN = 210 -+ SYS_SENDMSG = 211 -+ SYS_RECVMSG = 212 -+ SYS_READAHEAD = 213 -+ SYS_BRK = 214 -+ SYS_MUNMAP = 215 -+ SYS_MREMAP = 216 -+ SYS_ADD_KEY = 217 -+ SYS_REQUEST_KEY = 218 -+ SYS_KEYCTL = 219 -+ SYS_CLONE = 220 -+ SYS_EXECVE = 221 -+ SYS_MMAP = 222 -+ SYS_FADVISE64 = 223 -+ SYS_SWAPON = 224 -+ SYS_SWAPOFF = 225 -+ SYS_MPROTECT = 226 -+ SYS_MSYNC = 227 -+ SYS_MLOCK = 228 -+ SYS_MUNLOCK = 229 -+ SYS_MLOCKALL = 230 -+ SYS_MUNLOCKALL = 231 -+ SYS_MINCORE = 232 -+ SYS_MADVISE = 233 -+ SYS_REMAP_FILE_PAGES = 234 -+ SYS_MBIND = 235 -+ SYS_GET_MEMPOLICY = 236 -+ SYS_SET_MEMPOLICY = 237 -+ SYS_MIGRATE_PAGES = 238 -+ SYS_MOVE_PAGES = 239 -+ SYS_RT_TGSIGQUEUEINFO = 240 -+ SYS_PERF_EVENT_OPEN = 241 -+ SYS_ACCEPT4 = 242 -+ SYS_RECVMMSG = 243 -+ SYS_ARCH_SPECIFIC_SYSCALL = 244 -+ SYS_WAIT4 = 260 -+ SYS_PRLIMIT64 = 261 -+ SYS_FANOTIFY_INIT = 262 -+ SYS_FANOTIFY_MARK = 263 -+ SYS_NAME_TO_HANDLE_AT = 264 -+ SYS_OPEN_BY_HANDLE_AT = 265 -+ SYS_CLOCK_ADJTIME = 266 -+ SYS_SYNCFS = 267 -+ SYS_SETNS = 268 -+ SYS_SENDMMSG = 269 -+ SYS_PROCESS_VM_READV = 270 -+ SYS_PROCESS_VM_WRITEV = 271 -+ SYS_KCMP = 272 -+ SYS_FINIT_MODULE = 273 -+ SYS_SCHED_SETATTR = 274 -+ SYS_SCHED_GETATTR = 275 -+ SYS_RENAMEAT2 = 276 -+ SYS_SECCOMP = 277 -+ SYS_GETRANDOM = 278 -+ SYS_MEMFD_CREATE = 279 -+ SYS_BPF = 280 -+ SYS_EXECVEAT = 281 -+ SYS_USERFAULTFD = 282 -+ SYS_MEMBARRIER = 283 -+ SYS_MLOCK2 = 284 -+ SYS_COPY_FILE_RANGE = 285 -+ SYS_PREADV2 = 286 -+ SYS_PWRITEV2 = 287 -+ SYS_PKEY_MPROTECT = 288 -+ SYS_PKEY_ALLOC = 289 -+ SYS_PKEY_FREE = 290 -+ SYS_STATX = 291 -+ SYS_IO_PGETEVENTS = 292 -+ SYS_RSEQ = 293 -+ SYS_KEXEC_FILE_LOAD = 294 -+ SYS_FUTIMESAT = 295 -+) -diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go -new file mode 100644 -index 0000000..c37e476 ---- /dev/null -+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go -@@ -0,0 +1,2334 @@ -+// cgo -godefs -- -Wall -Werror -static -I/tmp/include linux/types.go | go run mkpost.go -+// Code generated by the command above; see README.md. DO NOT EDIT. -+ -+// +build riscv64,linux -+ -+package unix -+ -+const ( -+ sizeofPtr = 0x8 -+ sizeofShort = 0x2 -+ sizeofInt = 0x4 -+ sizeofLong = 0x8 -+ sizeofLongLong = 0x8 -+ PathMax = 0x1000 -+) -+ -+type ( -+ _C_short int16 -+ _C_int int32 -+ _C_long int64 -+ _C_long_long int64 -+) -+ -+type Timespec struct { -+ Sec int64 -+ Nsec int64 -+} -+ -+type Timeval struct { -+ Sec int64 -+ Usec int64 -+} -+ -+type Timex struct { -+ Modes uint32 -+ Offset int64 -+ Freq int64 -+ Maxerror int64 -+ Esterror int64 -+ Status int32 -+ Constant int64 -+ Precision int64 -+ Tolerance int64 -+ Time Timeval -+ Tick int64 -+ Ppsfreq int64 -+ Jitter int64 -+ Shift int32 -+ Stabil int64 -+ Jitcnt int64 -+ Calcnt int64 -+ Errcnt int64 -+ Stbcnt int64 -+ Tai int32 -+ _ [44]byte -+} -+ -+type Time_t int64 -+ -+type Tms struct { -+ Utime int64 -+ Stime int64 -+ Cutime int64 -+ Cstime int64 -+} -+ -+type Utimbuf struct { -+ Actime int64 -+ Modtime int64 -+} -+ -+type Rusage struct { -+ Utime Timeval -+ Stime Timeval -+ Maxrss int64 -+ Ixrss int64 -+ Idrss int64 -+ Isrss int64 -+ Minflt int64 -+ Majflt int64 -+ Nswap int64 -+ Inblock int64 -+ Oublock int64 -+ Msgsnd int64 -+ Msgrcv int64 -+ Nsignals int64 -+ Nvcsw int64 -+ Nivcsw int64 -+} -+ -+type Rlimit struct { -+ Cur uint64 -+ Max uint64 -+} -+ -+type _Gid_t uint32 -+ -+type Stat_t struct { -+ Dev uint64 -+ Ino uint64 -+ Mode uint32 -+ Nlink uint32 -+ Uid uint32 -+ Gid uint32 -+ Rdev uint64 -+ _ uint64 -+ Size int64 -+ Blksize int32 -+ _ int32 -+ Blocks int64 -+ Atim Timespec -+ Mtim Timespec -+ Ctim Timespec -+ _ [2]int32 -+} -+ -+type StatxTimestamp struct { -+ Sec int64 -+ Nsec uint32 -+ _ int32 -+} -+ -+type Statx_t struct { -+ Mask uint32 -+ Blksize uint32 -+ Attributes uint64 -+ Nlink uint32 -+ Uid uint32 -+ Gid uint32 -+ Mode uint16 -+ _ [1]uint16 -+ Ino uint64 -+ Size uint64 -+ Blocks uint64 -+ Attributes_mask uint64 -+ Atime StatxTimestamp -+ Btime StatxTimestamp -+ Ctime StatxTimestamp -+ Mtime StatxTimestamp -+ Rdev_major uint32 -+ Rdev_minor uint32 -+ Dev_major uint32 -+ Dev_minor uint32 -+ _ [14]uint64 -+} -+ -+type Dirent struct { -+ Ino uint64 -+ Off int64 -+ Reclen uint16 -+ Type uint8 -+ Name [256]uint8 -+ _ [5]byte -+} -+ -+type Fsid struct { -+ Val [2]int32 -+} -+ -+type Flock_t struct { -+ Type int16 -+ Whence int16 -+ Start int64 -+ Len int64 -+ Pid int32 -+ _ [4]byte -+} -+ -+type FscryptPolicy struct { -+ Version uint8 -+ Contents_encryption_mode uint8 -+ Filenames_encryption_mode uint8 -+ Flags uint8 -+ Master_key_descriptor [8]uint8 -+} -+ -+type FscryptKey struct { -+ Mode uint32 -+ Raw [64]uint8 -+ Size uint32 -+} -+ -+type KeyctlDHParams struct { -+ Private int32 -+ Prime int32 -+ Base int32 -+} -+ -+const ( -+ FADV_NORMAL = 0x0 -+ FADV_RANDOM = 0x1 -+ FADV_SEQUENTIAL = 0x2 -+ FADV_WILLNEED = 0x3 -+ FADV_DONTNEED = 0x4 -+ FADV_NOREUSE = 0x5 -+) -+ -+type RawSockaddrInet4 struct { -+ Family uint16 -+ Port uint16 -+ Addr [4]byte /* in_addr */ -+ Zero [8]uint8 -+} -+ -+type RawSockaddrInet6 struct { -+ Family uint16 -+ Port uint16 -+ Flowinfo uint32 -+ Addr [16]byte /* in6_addr */ -+ Scope_id uint32 -+} -+ -+type RawSockaddrUnix struct { -+ Family uint16 -+ Path [108]int8 -+} -+ -+type RawSockaddrLinklayer struct { -+ Family uint16 -+ Protocol uint16 -+ Ifindex int32 -+ Hatype uint16 -+ Pkttype uint8 -+ Halen uint8 -+ Addr [8]uint8 -+} -+ -+type RawSockaddrNetlink struct { -+ Family uint16 -+ Pad uint16 -+ Pid uint32 -+ Groups uint32 -+} -+ -+type RawSockaddrHCI struct { -+ Family uint16 -+ Dev uint16 -+ Channel uint16 -+} -+ -+type RawSockaddrL2 struct { -+ Family uint16 -+ Psm uint16 -+ Bdaddr [6]uint8 -+ Cid uint16 -+ Bdaddr_type uint8 -+ _ [1]byte -+} -+ -+type RawSockaddrRFCOMM struct { -+ Family uint16 -+ Bdaddr [6]uint8 -+ Channel uint8 -+ _ [1]byte -+} -+ -+type RawSockaddrCAN struct { -+ Family uint16 -+ Ifindex int32 -+ Addr [8]byte -+} -+ -+type RawSockaddrALG struct { -+ Family uint16 -+ Type [14]uint8 -+ Feat uint32 -+ Mask uint32 -+ Name [64]uint8 -+} -+ -+type RawSockaddrVM struct { -+ Family uint16 -+ Reserved1 uint16 -+ Port uint32 -+ Cid uint32 -+ Zero [4]uint8 -+} -+ -+type RawSockaddrXDP struct { -+ Family uint16 -+ Flags uint16 -+ Ifindex uint32 -+ Queue_id uint32 -+ Shared_umem_fd uint32 -+} -+ -+type RawSockaddrPPPoX [0x1e]byte -+ -+type RawSockaddr struct { -+ Family uint16 -+ Data [14]uint8 -+} -+ -+type RawSockaddrAny struct { -+ Addr RawSockaddr -+ Pad [96]uint8 -+} -+ -+type _Socklen uint32 -+ -+type Linger struct { -+ Onoff int32 -+ Linger int32 -+} -+ -+type Iovec struct { -+ Base *byte -+ Len uint64 -+} -+ -+type IPMreq struct { -+ Multiaddr [4]byte /* in_addr */ -+ Interface [4]byte /* in_addr */ -+} -+ -+type IPMreqn struct { -+ Multiaddr [4]byte /* in_addr */ -+ Address [4]byte /* in_addr */ -+ Ifindex int32 -+} -+ -+type IPv6Mreq struct { -+ Multiaddr [16]byte /* in6_addr */ -+ Interface uint32 -+} -+ -+type PacketMreq struct { -+ Ifindex int32 -+ Type uint16 -+ Alen uint16 -+ Address [8]uint8 -+} -+ -+type Msghdr struct { -+ Name *byte -+ Namelen uint32 -+ Iov *Iovec -+ Iovlen uint64 -+ Control *byte -+ Controllen uint64 -+ Flags int32 -+ _ [4]byte -+} -+ -+type Cmsghdr struct { -+ Len uint64 -+ Level int32 -+ Type int32 -+} -+ -+type Inet4Pktinfo struct { -+ Ifindex int32 -+ Spec_dst [4]byte /* in_addr */ -+ Addr [4]byte /* in_addr */ -+} -+ -+type Inet6Pktinfo struct { -+ Addr [16]byte /* in6_addr */ -+ Ifindex uint32 -+} -+ -+type IPv6MTUInfo struct { -+ Addr RawSockaddrInet6 -+ Mtu uint32 -+} -+ -+type ICMPv6Filter struct { -+ Data [8]uint32 -+} -+ -+type Ucred struct { -+ Pid int32 -+ Uid uint32 -+ Gid uint32 -+} -+ -+type TCPInfo struct { -+ State uint8 -+ Ca_state uint8 -+ Retransmits uint8 -+ Probes uint8 -+ Backoff uint8 -+ Options uint8 -+ Rto uint32 -+ Ato uint32 -+ Snd_mss uint32 -+ Rcv_mss uint32 -+ Unacked uint32 -+ Sacked uint32 -+ Lost uint32 -+ Retrans uint32 -+ Fackets uint32 -+ Last_data_sent uint32 -+ Last_ack_sent uint32 -+ Last_data_recv uint32 -+ Last_ack_recv uint32 -+ Pmtu uint32 -+ Rcv_ssthresh uint32 -+ Rtt uint32 -+ Rttvar uint32 -+ Snd_ssthresh uint32 -+ Snd_cwnd uint32 -+ Advmss uint32 -+ Reordering uint32 -+ Rcv_rtt uint32 -+ Rcv_space uint32 -+ Total_retrans uint32 -+} -+ -+type CanFilter struct { -+ Id uint32 -+ Mask uint32 -+} -+ -+const ( -+ SizeofSockaddrInet4 = 0x10 -+ SizeofSockaddrInet6 = 0x1c -+ SizeofSockaddrAny = 0x70 -+ SizeofSockaddrUnix = 0x6e -+ SizeofSockaddrLinklayer = 0x14 -+ SizeofSockaddrNetlink = 0xc -+ SizeofSockaddrHCI = 0x6 -+ SizeofSockaddrL2 = 0xe -+ SizeofSockaddrRFCOMM = 0xa -+ SizeofSockaddrCAN = 0x10 -+ SizeofSockaddrALG = 0x58 -+ SizeofSockaddrVM = 0x10 -+ SizeofSockaddrXDP = 0x10 -+ SizeofSockaddrPPPoX = 0x1e -+ SizeofLinger = 0x8 -+ SizeofIovec = 0x10 -+ SizeofIPMreq = 0x8 -+ SizeofIPMreqn = 0xc -+ SizeofIPv6Mreq = 0x14 -+ SizeofPacketMreq = 0x10 -+ SizeofMsghdr = 0x38 -+ SizeofCmsghdr = 0x10 -+ SizeofInet4Pktinfo = 0xc -+ SizeofInet6Pktinfo = 0x14 -+ SizeofIPv6MTUInfo = 0x20 -+ SizeofICMPv6Filter = 0x20 -+ SizeofUcred = 0xc -+ SizeofTCPInfo = 0x68 -+ SizeofCanFilter = 0x8 -+) -+ -+const ( -+ NDA_UNSPEC = 0x0 -+ NDA_DST = 0x1 -+ NDA_LLADDR = 0x2 -+ NDA_CACHEINFO = 0x3 -+ NDA_PROBES = 0x4 -+ NDA_VLAN = 0x5 -+ NDA_PORT = 0x6 -+ NDA_VNI = 0x7 -+ NDA_IFINDEX = 0x8 -+ NDA_MASTER = 0x9 -+ NDA_LINK_NETNSID = 0xa -+ NDA_SRC_VNI = 0xb -+ NTF_USE = 0x1 -+ NTF_SELF = 0x2 -+ NTF_MASTER = 0x4 -+ NTF_PROXY = 0x8 -+ NTF_EXT_LEARNED = 0x10 -+ NTF_OFFLOADED = 0x20 -+ NTF_ROUTER = 0x80 -+ NUD_INCOMPLETE = 0x1 -+ NUD_REACHABLE = 0x2 -+ NUD_STALE = 0x4 -+ NUD_DELAY = 0x8 -+ NUD_PROBE = 0x10 -+ NUD_FAILED = 0x20 -+ NUD_NOARP = 0x40 -+ NUD_PERMANENT = 0x80 -+ NUD_NONE = 0x0 -+ IFA_UNSPEC = 0x0 -+ IFA_ADDRESS = 0x1 -+ IFA_LOCAL = 0x2 -+ IFA_LABEL = 0x3 -+ IFA_BROADCAST = 0x4 -+ IFA_ANYCAST = 0x5 -+ IFA_CACHEINFO = 0x6 -+ IFA_MULTICAST = 0x7 -+ IFA_FLAGS = 0x8 -+ IFA_RT_PRIORITY = 0x9 -+ IFA_TARGET_NETNSID = 0xa -+ IFLA_UNSPEC = 0x0 -+ IFLA_ADDRESS = 0x1 -+ IFLA_BROADCAST = 0x2 -+ IFLA_IFNAME = 0x3 -+ IFLA_MTU = 0x4 -+ IFLA_LINK = 0x5 -+ IFLA_QDISC = 0x6 -+ IFLA_STATS = 0x7 -+ IFLA_COST = 0x8 -+ IFLA_PRIORITY = 0x9 -+ IFLA_MASTER = 0xa -+ IFLA_WIRELESS = 0xb -+ IFLA_PROTINFO = 0xc -+ IFLA_TXQLEN = 0xd -+ IFLA_MAP = 0xe -+ IFLA_WEIGHT = 0xf -+ IFLA_OPERSTATE = 0x10 -+ IFLA_LINKMODE = 0x11 -+ IFLA_LINKINFO = 0x12 -+ IFLA_NET_NS_PID = 0x13 -+ IFLA_IFALIAS = 0x14 -+ IFLA_NUM_VF = 0x15 -+ IFLA_VFINFO_LIST = 0x16 -+ IFLA_STATS64 = 0x17 -+ IFLA_VF_PORTS = 0x18 -+ IFLA_PORT_SELF = 0x19 -+ IFLA_AF_SPEC = 0x1a -+ IFLA_GROUP = 0x1b -+ IFLA_NET_NS_FD = 0x1c -+ IFLA_EXT_MASK = 0x1d -+ IFLA_PROMISCUITY = 0x1e -+ IFLA_NUM_TX_QUEUES = 0x1f -+ IFLA_NUM_RX_QUEUES = 0x20 -+ IFLA_CARRIER = 0x21 -+ IFLA_PHYS_PORT_ID = 0x22 -+ IFLA_CARRIER_CHANGES = 0x23 -+ IFLA_PHYS_SWITCH_ID = 0x24 -+ IFLA_LINK_NETNSID = 0x25 -+ IFLA_PHYS_PORT_NAME = 0x26 -+ IFLA_PROTO_DOWN = 0x27 -+ IFLA_GSO_MAX_SEGS = 0x28 -+ IFLA_GSO_MAX_SIZE = 0x29 -+ IFLA_PAD = 0x2a -+ IFLA_XDP = 0x2b -+ IFLA_EVENT = 0x2c -+ IFLA_NEW_NETNSID = 0x2d -+ IFLA_IF_NETNSID = 0x2e -+ IFLA_TARGET_NETNSID = 0x2e -+ IFLA_CARRIER_UP_COUNT = 0x2f -+ IFLA_CARRIER_DOWN_COUNT = 0x30 -+ IFLA_NEW_IFINDEX = 0x31 -+ IFLA_MIN_MTU = 0x32 -+ IFLA_MAX_MTU = 0x33 -+ IFLA_MAX = 0x33 -+ IFLA_INFO_KIND = 0x1 -+ IFLA_INFO_DATA = 0x2 -+ IFLA_INFO_XSTATS = 0x3 -+ IFLA_INFO_SLAVE_KIND = 0x4 -+ IFLA_INFO_SLAVE_DATA = 0x5 -+ RT_SCOPE_UNIVERSE = 0x0 -+ RT_SCOPE_SITE = 0xc8 -+ RT_SCOPE_LINK = 0xfd -+ RT_SCOPE_HOST = 0xfe -+ RT_SCOPE_NOWHERE = 0xff -+ RT_TABLE_UNSPEC = 0x0 -+ RT_TABLE_COMPAT = 0xfc -+ RT_TABLE_DEFAULT = 0xfd -+ RT_TABLE_MAIN = 0xfe -+ RT_TABLE_LOCAL = 0xff -+ RT_TABLE_MAX = 0xffffffff -+ RTA_UNSPEC = 0x0 -+ RTA_DST = 0x1 -+ RTA_SRC = 0x2 -+ RTA_IIF = 0x3 -+ RTA_OIF = 0x4 -+ RTA_GATEWAY = 0x5 -+ RTA_PRIORITY = 0x6 -+ RTA_PREFSRC = 0x7 -+ RTA_METRICS = 0x8 -+ RTA_MULTIPATH = 0x9 -+ RTA_FLOW = 0xb -+ RTA_CACHEINFO = 0xc -+ RTA_TABLE = 0xf -+ RTA_MARK = 0x10 -+ RTA_MFC_STATS = 0x11 -+ RTA_VIA = 0x12 -+ RTA_NEWDST = 0x13 -+ RTA_PREF = 0x14 -+ RTA_ENCAP_TYPE = 0x15 -+ RTA_ENCAP = 0x16 -+ RTA_EXPIRES = 0x17 -+ RTA_PAD = 0x18 -+ RTA_UID = 0x19 -+ RTA_TTL_PROPAGATE = 0x1a -+ RTA_IP_PROTO = 0x1b -+ RTA_SPORT = 0x1c -+ RTA_DPORT = 0x1d -+ RTN_UNSPEC = 0x0 -+ RTN_UNICAST = 0x1 -+ RTN_LOCAL = 0x2 -+ RTN_BROADCAST = 0x3 -+ RTN_ANYCAST = 0x4 -+ RTN_MULTICAST = 0x5 -+ RTN_BLACKHOLE = 0x6 -+ RTN_UNREACHABLE = 0x7 -+ RTN_PROHIBIT = 0x8 -+ RTN_THROW = 0x9 -+ RTN_NAT = 0xa -+ RTN_XRESOLVE = 0xb -+ RTNLGRP_NONE = 0x0 -+ RTNLGRP_LINK = 0x1 -+ RTNLGRP_NOTIFY = 0x2 -+ RTNLGRP_NEIGH = 0x3 -+ RTNLGRP_TC = 0x4 -+ RTNLGRP_IPV4_IFADDR = 0x5 -+ RTNLGRP_IPV4_MROUTE = 0x6 -+ RTNLGRP_IPV4_ROUTE = 0x7 -+ RTNLGRP_IPV4_RULE = 0x8 -+ RTNLGRP_IPV6_IFADDR = 0x9 -+ RTNLGRP_IPV6_MROUTE = 0xa -+ RTNLGRP_IPV6_ROUTE = 0xb -+ RTNLGRP_IPV6_IFINFO = 0xc -+ RTNLGRP_IPV6_PREFIX = 0x12 -+ RTNLGRP_IPV6_RULE = 0x13 -+ RTNLGRP_ND_USEROPT = 0x14 -+ SizeofNlMsghdr = 0x10 -+ SizeofNlMsgerr = 0x14 -+ SizeofRtGenmsg = 0x1 -+ SizeofNlAttr = 0x4 -+ SizeofRtAttr = 0x4 -+ SizeofIfInfomsg = 0x10 -+ SizeofIfAddrmsg = 0x8 -+ SizeofRtMsg = 0xc -+ SizeofRtNexthop = 0x8 -+ SizeofNdUseroptmsg = 0x10 -+ SizeofNdMsg = 0xc -+) -+ -+type NlMsghdr struct { -+ Len uint32 -+ Type uint16 -+ Flags uint16 -+ Seq uint32 -+ Pid uint32 -+} -+ -+type NlMsgerr struct { -+ Error int32 -+ Msg NlMsghdr -+} -+ -+type RtGenmsg struct { -+ Family uint8 -+} -+ -+type NlAttr struct { -+ Len uint16 -+ Type uint16 -+} -+ -+type RtAttr struct { -+ Len uint16 -+ Type uint16 -+} -+ -+type IfInfomsg struct { -+ Family uint8 -+ _ uint8 -+ Type uint16 -+ Index int32 -+ Flags uint32 -+ Change uint32 -+} -+ -+type IfAddrmsg struct { -+ Family uint8 -+ Prefixlen uint8 -+ Flags uint8 -+ Scope uint8 -+ Index uint32 -+} -+ -+type RtMsg struct { -+ Family uint8 -+ Dst_len uint8 -+ Src_len uint8 -+ Tos uint8 -+ Table uint8 -+ Protocol uint8 -+ Scope uint8 -+ Type uint8 -+ Flags uint32 -+} -+ -+type RtNexthop struct { -+ Len uint16 -+ Flags uint8 -+ Hops uint8 -+ Ifindex int32 -+} -+ -+type NdUseroptmsg struct { -+ Family uint8 -+ Pad1 uint8 -+ Opts_len uint16 -+ Ifindex int32 -+ Icmp_type uint8 -+ Icmp_code uint8 -+ Pad2 uint16 -+ Pad3 uint32 -+} -+ -+type NdMsg struct { -+ Family uint8 -+ Pad1 uint8 -+ Pad2 uint16 -+ Ifindex int32 -+ State uint16 -+ Flags uint8 -+ Type uint8 -+} -+ -+const ( -+ SizeofSockFilter = 0x8 -+ SizeofSockFprog = 0x10 -+) -+ -+type SockFilter struct { -+ Code uint16 -+ Jt uint8 -+ Jf uint8 -+ K uint32 -+} -+ -+type SockFprog struct { -+ Len uint16 -+ Filter *SockFilter -+} -+ -+type InotifyEvent struct { -+ Wd int32 -+ Mask uint32 -+ Cookie uint32 -+ Len uint32 -+} -+ -+const SizeofInotifyEvent = 0x10 -+ -+type PtraceRegs struct { -+ Pc uint64 -+ Ra uint64 -+ Sp uint64 -+ Gp uint64 -+ Tp uint64 -+ T0 uint64 -+ T1 uint64 -+ T2 uint64 -+ S0 uint64 -+ S1 uint64 -+ A0 uint64 -+ A1 uint64 -+ A2 uint64 -+ A3 uint64 -+ A4 uint64 -+ A5 uint64 -+ A6 uint64 -+ A7 uint64 -+ S2 uint64 -+ S3 uint64 -+ S4 uint64 -+ S5 uint64 -+ S6 uint64 -+ S7 uint64 -+ S8 uint64 -+ S9 uint64 -+ S10 uint64 -+ S11 uint64 -+ T3 uint64 -+ T4 uint64 -+ T5 uint64 -+ T6 uint64 -+} -+ -+type FdSet struct { -+ Bits [16]int64 -+} -+ -+type Sysinfo_t struct { -+ Uptime int64 -+ Loads [3]uint64 -+ Totalram uint64 -+ Freeram uint64 -+ Sharedram uint64 -+ Bufferram uint64 -+ Totalswap uint64 -+ Freeswap uint64 -+ Procs uint16 -+ Pad uint16 -+ Totalhigh uint64 -+ Freehigh uint64 -+ Unit uint32 -+ _ [0]uint8 -+ _ [4]byte -+} -+ -+type Utsname struct { -+ Sysname [65]byte -+ Nodename [65]byte -+ Release [65]byte -+ Version [65]byte -+ Machine [65]byte -+ Domainname [65]byte -+} -+ -+type Ustat_t struct { -+ Tfree int32 -+ Tinode uint64 -+ Fname [6]uint8 -+ Fpack [6]uint8 -+ _ [4]byte -+} -+ -+type EpollEvent struct { -+ Events uint32 -+ Fd int32 -+ Pad int32 -+} -+ -+const ( -+ AT_EMPTY_PATH = 0x1000 -+ AT_FDCWD = -0x64 -+ AT_NO_AUTOMOUNT = 0x800 -+ AT_REMOVEDIR = 0x200 -+ -+ AT_STATX_SYNC_AS_STAT = 0x0 -+ AT_STATX_FORCE_SYNC = 0x2000 -+ AT_STATX_DONT_SYNC = 0x4000 -+ -+ AT_SYMLINK_FOLLOW = 0x400 -+ AT_SYMLINK_NOFOLLOW = 0x100 -+ -+ AT_EACCESS = 0x200 -+) -+ -+type PollFd struct { -+ Fd int32 -+ Events int16 -+ Revents int16 -+} -+ -+const ( -+ POLLIN = 0x1 -+ POLLPRI = 0x2 -+ POLLOUT = 0x4 -+ POLLRDHUP = 0x2000 -+ POLLERR = 0x8 -+ POLLHUP = 0x10 -+ POLLNVAL = 0x20 -+) -+ -+type Sigset_t struct { -+ Val [16]uint64 -+} -+ -+type SignalfdSiginfo struct { -+ Signo uint32 -+ Errno int32 -+ Code int32 -+ Pid uint32 -+ Uid uint32 -+ Fd int32 -+ Tid uint32 -+ Band uint32 -+ Overrun uint32 -+ Trapno uint32 -+ Status int32 -+ Int int32 -+ Ptr uint64 -+ Utime uint64 -+ Stime uint64 -+ Addr uint64 -+ Addr_lsb uint16 -+ _ uint16 -+ Syscall int32 -+ Call_addr uint64 -+ Arch uint32 -+ _ [28]uint8 -+} -+ -+const PERF_IOC_FLAG_GROUP = 0x1 -+ -+type Termios struct { -+ Iflag uint32 -+ Oflag uint32 -+ Cflag uint32 -+ Lflag uint32 -+ Line uint8 -+ Cc [19]uint8 -+ Ispeed uint32 -+ Ospeed uint32 -+} -+ -+type Winsize struct { -+ Row uint16 -+ Col uint16 -+ Xpixel uint16 -+ Ypixel uint16 -+} -+ -+type Taskstats struct { -+ Version uint16 -+ Ac_exitcode uint32 -+ Ac_flag uint8 -+ Ac_nice uint8 -+ Cpu_count uint64 -+ Cpu_delay_total uint64 -+ Blkio_count uint64 -+ Blkio_delay_total uint64 -+ Swapin_count uint64 -+ Swapin_delay_total uint64 -+ Cpu_run_real_total uint64 -+ Cpu_run_virtual_total uint64 -+ Ac_comm [32]uint8 -+ Ac_sched uint8 -+ Ac_pad [3]uint8 -+ _ [4]byte -+ Ac_uid uint32 -+ Ac_gid uint32 -+ Ac_pid uint32 -+ Ac_ppid uint32 -+ Ac_btime uint32 -+ Ac_etime uint64 -+ Ac_utime uint64 -+ Ac_stime uint64 -+ Ac_minflt uint64 -+ Ac_majflt uint64 -+ Coremem uint64 -+ Virtmem uint64 -+ Hiwater_rss uint64 -+ Hiwater_vm uint64 -+ Read_char uint64 -+ Write_char uint64 -+ Read_syscalls uint64 -+ Write_syscalls uint64 -+ Read_bytes uint64 -+ Write_bytes uint64 -+ Cancelled_write_bytes uint64 -+ Nvcsw uint64 -+ Nivcsw uint64 -+ Ac_utimescaled uint64 -+ Ac_stimescaled uint64 -+ Cpu_scaled_run_real_total uint64 -+ Freepages_count uint64 -+ Freepages_delay_total uint64 -+ Thrashing_count uint64 -+ Thrashing_delay_total uint64 -+} -+ -+const ( -+ TASKSTATS_CMD_UNSPEC = 0x0 -+ TASKSTATS_CMD_GET = 0x1 -+ TASKSTATS_CMD_NEW = 0x2 -+ TASKSTATS_TYPE_UNSPEC = 0x0 -+ TASKSTATS_TYPE_PID = 0x1 -+ TASKSTATS_TYPE_TGID = 0x2 -+ TASKSTATS_TYPE_STATS = 0x3 -+ TASKSTATS_TYPE_AGGR_PID = 0x4 -+ TASKSTATS_TYPE_AGGR_TGID = 0x5 -+ TASKSTATS_TYPE_NULL = 0x6 -+ TASKSTATS_CMD_ATTR_UNSPEC = 0x0 -+ TASKSTATS_CMD_ATTR_PID = 0x1 -+ TASKSTATS_CMD_ATTR_TGID = 0x2 -+ TASKSTATS_CMD_ATTR_REGISTER_CPUMASK = 0x3 -+ TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK = 0x4 -+) -+ -+type CGroupStats struct { -+ Sleeping uint64 -+ Running uint64 -+ Stopped uint64 -+ Uninterruptible uint64 -+ Io_wait uint64 -+} -+ -+const ( -+ CGROUPSTATS_CMD_UNSPEC = 0x3 -+ CGROUPSTATS_CMD_GET = 0x4 -+ CGROUPSTATS_CMD_NEW = 0x5 -+ CGROUPSTATS_TYPE_UNSPEC = 0x0 -+ CGROUPSTATS_TYPE_CGROUP_STATS = 0x1 -+ CGROUPSTATS_CMD_ATTR_UNSPEC = 0x0 -+ CGROUPSTATS_CMD_ATTR_FD = 0x1 -+) -+ -+type Genlmsghdr struct { -+ Cmd uint8 -+ Version uint8 -+ Reserved uint16 -+} -+ -+const ( -+ CTRL_CMD_UNSPEC = 0x0 -+ CTRL_CMD_NEWFAMILY = 0x1 -+ CTRL_CMD_DELFAMILY = 0x2 -+ CTRL_CMD_GETFAMILY = 0x3 -+ CTRL_CMD_NEWOPS = 0x4 -+ CTRL_CMD_DELOPS = 0x5 -+ CTRL_CMD_GETOPS = 0x6 -+ CTRL_CMD_NEWMCAST_GRP = 0x7 -+ CTRL_CMD_DELMCAST_GRP = 0x8 -+ CTRL_CMD_GETMCAST_GRP = 0x9 -+ CTRL_ATTR_UNSPEC = 0x0 -+ CTRL_ATTR_FAMILY_ID = 0x1 -+ CTRL_ATTR_FAMILY_NAME = 0x2 -+ CTRL_ATTR_VERSION = 0x3 -+ CTRL_ATTR_HDRSIZE = 0x4 -+ CTRL_ATTR_MAXATTR = 0x5 -+ CTRL_ATTR_OPS = 0x6 -+ CTRL_ATTR_MCAST_GROUPS = 0x7 -+ CTRL_ATTR_OP_UNSPEC = 0x0 -+ CTRL_ATTR_OP_ID = 0x1 -+ CTRL_ATTR_OP_FLAGS = 0x2 -+ CTRL_ATTR_MCAST_GRP_UNSPEC = 0x0 -+ CTRL_ATTR_MCAST_GRP_NAME = 0x1 -+ CTRL_ATTR_MCAST_GRP_ID = 0x2 -+) -+ -+type cpuMask uint64 -+ -+const ( -+ _CPU_SETSIZE = 0x400 -+ _NCPUBITS = 0x40 -+) -+ -+const ( -+ BDADDR_BREDR = 0x0 -+ BDADDR_LE_PUBLIC = 0x1 -+ BDADDR_LE_RANDOM = 0x2 -+) -+ -+type PerfEventAttr struct { -+ Type uint32 -+ Size uint32 -+ Config uint64 -+ Sample uint64 -+ Sample_type uint64 -+ Read_format uint64 -+ Bits uint64 -+ Wakeup uint32 -+ Bp_type uint32 -+ Ext1 uint64 -+ Ext2 uint64 -+ Branch_sample_type uint64 -+ Sample_regs_user uint64 -+ Sample_stack_user uint32 -+ Clockid int32 -+ Sample_regs_intr uint64 -+ Aux_watermark uint32 -+ Sample_max_stack uint16 -+ _ uint16 -+} -+ -+type PerfEventMmapPage struct { -+ Version uint32 -+ Compat_version uint32 -+ Lock uint32 -+ Index uint32 -+ Offset int64 -+ Time_enabled uint64 -+ Time_running uint64 -+ Capabilities uint64 -+ Pmc_width uint16 -+ Time_shift uint16 -+ Time_mult uint32 -+ Time_offset uint64 -+ Time_zero uint64 -+ Size uint32 -+ _ [948]uint8 -+ Data_head uint64 -+ Data_tail uint64 -+ Data_offset uint64 -+ Data_size uint64 -+ Aux_head uint64 -+ Aux_tail uint64 -+ Aux_offset uint64 -+ Aux_size uint64 -+} -+ -+const ( -+ PerfBitDisabled uint64 = CBitFieldMaskBit0 -+ PerfBitInherit = CBitFieldMaskBit1 -+ PerfBitPinned = CBitFieldMaskBit2 -+ PerfBitExclusive = CBitFieldMaskBit3 -+ PerfBitExcludeUser = CBitFieldMaskBit4 -+ PerfBitExcludeKernel = CBitFieldMaskBit5 -+ PerfBitExcludeHv = CBitFieldMaskBit6 -+ PerfBitExcludeIdle = CBitFieldMaskBit7 -+ PerfBitMmap = CBitFieldMaskBit8 -+ PerfBitComm = CBitFieldMaskBit9 -+ PerfBitFreq = CBitFieldMaskBit10 -+ PerfBitInheritStat = CBitFieldMaskBit11 -+ PerfBitEnableOnExec = CBitFieldMaskBit12 -+ PerfBitTask = CBitFieldMaskBit13 -+ PerfBitWatermark = CBitFieldMaskBit14 -+ PerfBitPreciseIPBit1 = CBitFieldMaskBit15 -+ PerfBitPreciseIPBit2 = CBitFieldMaskBit16 -+ PerfBitMmapData = CBitFieldMaskBit17 -+ PerfBitSampleIDAll = CBitFieldMaskBit18 -+ PerfBitExcludeHost = CBitFieldMaskBit19 -+ PerfBitExcludeGuest = CBitFieldMaskBit20 -+ PerfBitExcludeCallchainKernel = CBitFieldMaskBit21 -+ PerfBitExcludeCallchainUser = CBitFieldMaskBit22 -+ PerfBitMmap2 = CBitFieldMaskBit23 -+ PerfBitCommExec = CBitFieldMaskBit24 -+ PerfBitUseClockID = CBitFieldMaskBit25 -+ PerfBitContextSwitch = CBitFieldMaskBit26 -+) -+ -+const ( -+ PERF_TYPE_HARDWARE = 0x0 -+ PERF_TYPE_SOFTWARE = 0x1 -+ PERF_TYPE_TRACEPOINT = 0x2 -+ PERF_TYPE_HW_CACHE = 0x3 -+ PERF_TYPE_RAW = 0x4 -+ PERF_TYPE_BREAKPOINT = 0x5 -+ -+ PERF_COUNT_HW_CPU_CYCLES = 0x0 -+ PERF_COUNT_HW_INSTRUCTIONS = 0x1 -+ PERF_COUNT_HW_CACHE_REFERENCES = 0x2 -+ PERF_COUNT_HW_CACHE_MISSES = 0x3 -+ PERF_COUNT_HW_BRANCH_INSTRUCTIONS = 0x4 -+ PERF_COUNT_HW_BRANCH_MISSES = 0x5 -+ PERF_COUNT_HW_BUS_CYCLES = 0x6 -+ PERF_COUNT_HW_STALLED_CYCLES_FRONTEND = 0x7 -+ PERF_COUNT_HW_STALLED_CYCLES_BACKEND = 0x8 -+ PERF_COUNT_HW_REF_CPU_CYCLES = 0x9 -+ -+ PERF_COUNT_HW_CACHE_L1D = 0x0 -+ PERF_COUNT_HW_CACHE_L1I = 0x1 -+ PERF_COUNT_HW_CACHE_LL = 0x2 -+ PERF_COUNT_HW_CACHE_DTLB = 0x3 -+ PERF_COUNT_HW_CACHE_ITLB = 0x4 -+ PERF_COUNT_HW_CACHE_BPU = 0x5 -+ PERF_COUNT_HW_CACHE_NODE = 0x6 -+ -+ PERF_COUNT_HW_CACHE_OP_READ = 0x0 -+ PERF_COUNT_HW_CACHE_OP_WRITE = 0x1 -+ PERF_COUNT_HW_CACHE_OP_PREFETCH = 0x2 -+ -+ PERF_COUNT_HW_CACHE_RESULT_ACCESS = 0x0 -+ PERF_COUNT_HW_CACHE_RESULT_MISS = 0x1 -+ -+ PERF_COUNT_SW_CPU_CLOCK = 0x0 -+ PERF_COUNT_SW_TASK_CLOCK = 0x1 -+ PERF_COUNT_SW_PAGE_FAULTS = 0x2 -+ PERF_COUNT_SW_CONTEXT_SWITCHES = 0x3 -+ PERF_COUNT_SW_CPU_MIGRATIONS = 0x4 -+ PERF_COUNT_SW_PAGE_FAULTS_MIN = 0x5 -+ PERF_COUNT_SW_PAGE_FAULTS_MAJ = 0x6 -+ PERF_COUNT_SW_ALIGNMENT_FAULTS = 0x7 -+ PERF_COUNT_SW_EMULATION_FAULTS = 0x8 -+ PERF_COUNT_SW_DUMMY = 0x9 -+ PERF_COUNT_SW_BPF_OUTPUT = 0xa -+ -+ PERF_SAMPLE_IP = 0x1 -+ PERF_SAMPLE_TID = 0x2 -+ PERF_SAMPLE_TIME = 0x4 -+ PERF_SAMPLE_ADDR = 0x8 -+ PERF_SAMPLE_READ = 0x10 -+ PERF_SAMPLE_CALLCHAIN = 0x20 -+ PERF_SAMPLE_ID = 0x40 -+ PERF_SAMPLE_CPU = 0x80 -+ PERF_SAMPLE_PERIOD = 0x100 -+ PERF_SAMPLE_STREAM_ID = 0x200 -+ PERF_SAMPLE_RAW = 0x400 -+ PERF_SAMPLE_BRANCH_STACK = 0x800 -+ -+ PERF_SAMPLE_BRANCH_USER = 0x1 -+ PERF_SAMPLE_BRANCH_KERNEL = 0x2 -+ PERF_SAMPLE_BRANCH_HV = 0x4 -+ PERF_SAMPLE_BRANCH_ANY = 0x8 -+ PERF_SAMPLE_BRANCH_ANY_CALL = 0x10 -+ PERF_SAMPLE_BRANCH_ANY_RETURN = 0x20 -+ PERF_SAMPLE_BRANCH_IND_CALL = 0x40 -+ PERF_SAMPLE_BRANCH_ABORT_TX = 0x80 -+ PERF_SAMPLE_BRANCH_IN_TX = 0x100 -+ PERF_SAMPLE_BRANCH_NO_TX = 0x200 -+ PERF_SAMPLE_BRANCH_COND = 0x400 -+ PERF_SAMPLE_BRANCH_CALL_STACK = 0x800 -+ PERF_SAMPLE_BRANCH_IND_JUMP = 0x1000 -+ PERF_SAMPLE_BRANCH_CALL = 0x2000 -+ PERF_SAMPLE_BRANCH_NO_FLAGS = 0x4000 -+ PERF_SAMPLE_BRANCH_NO_CYCLES = 0x8000 -+ PERF_SAMPLE_BRANCH_TYPE_SAVE = 0x10000 -+ -+ PERF_FORMAT_TOTAL_TIME_ENABLED = 0x1 -+ PERF_FORMAT_TOTAL_TIME_RUNNING = 0x2 -+ PERF_FORMAT_ID = 0x4 -+ PERF_FORMAT_GROUP = 0x8 -+ -+ PERF_RECORD_MMAP = 0x1 -+ PERF_RECORD_LOST = 0x2 -+ PERF_RECORD_COMM = 0x3 -+ PERF_RECORD_EXIT = 0x4 -+ PERF_RECORD_THROTTLE = 0x5 -+ PERF_RECORD_UNTHROTTLE = 0x6 -+ PERF_RECORD_FORK = 0x7 -+ PERF_RECORD_READ = 0x8 -+ PERF_RECORD_SAMPLE = 0x9 -+ PERF_RECORD_MMAP2 = 0xa -+ PERF_RECORD_AUX = 0xb -+ PERF_RECORD_ITRACE_START = 0xc -+ PERF_RECORD_LOST_SAMPLES = 0xd -+ PERF_RECORD_SWITCH = 0xe -+ PERF_RECORD_SWITCH_CPU_WIDE = 0xf -+ PERF_RECORD_NAMESPACES = 0x10 -+ -+ PERF_CONTEXT_HV = -0x20 -+ PERF_CONTEXT_KERNEL = -0x80 -+ PERF_CONTEXT_USER = -0x200 -+ -+ PERF_CONTEXT_GUEST = -0x800 -+ PERF_CONTEXT_GUEST_KERNEL = -0x880 -+ PERF_CONTEXT_GUEST_USER = -0xa00 -+ -+ PERF_FLAG_FD_NO_GROUP = 0x1 -+ PERF_FLAG_FD_OUTPUT = 0x2 -+ PERF_FLAG_PID_CGROUP = 0x4 -+ PERF_FLAG_FD_CLOEXEC = 0x8 -+) -+ -+const ( -+ CBitFieldMaskBit0 = 0x1 -+ CBitFieldMaskBit1 = 0x2 -+ CBitFieldMaskBit2 = 0x4 -+ CBitFieldMaskBit3 = 0x8 -+ CBitFieldMaskBit4 = 0x10 -+ CBitFieldMaskBit5 = 0x20 -+ CBitFieldMaskBit6 = 0x40 -+ CBitFieldMaskBit7 = 0x80 -+ CBitFieldMaskBit8 = 0x100 -+ CBitFieldMaskBit9 = 0x200 -+ CBitFieldMaskBit10 = 0x400 -+ CBitFieldMaskBit11 = 0x800 -+ CBitFieldMaskBit12 = 0x1000 -+ CBitFieldMaskBit13 = 0x2000 -+ CBitFieldMaskBit14 = 0x4000 -+ CBitFieldMaskBit15 = 0x8000 -+ CBitFieldMaskBit16 = 0x10000 -+ CBitFieldMaskBit17 = 0x20000 -+ CBitFieldMaskBit18 = 0x40000 -+ CBitFieldMaskBit19 = 0x80000 -+ CBitFieldMaskBit20 = 0x100000 -+ CBitFieldMaskBit21 = 0x200000 -+ CBitFieldMaskBit22 = 0x400000 -+ CBitFieldMaskBit23 = 0x800000 -+ CBitFieldMaskBit24 = 0x1000000 -+ CBitFieldMaskBit25 = 0x2000000 -+ CBitFieldMaskBit26 = 0x4000000 -+ CBitFieldMaskBit27 = 0x8000000 -+ CBitFieldMaskBit28 = 0x10000000 -+ CBitFieldMaskBit29 = 0x20000000 -+ CBitFieldMaskBit30 = 0x40000000 -+ CBitFieldMaskBit31 = 0x80000000 -+ CBitFieldMaskBit32 = 0x100000000 -+ CBitFieldMaskBit33 = 0x200000000 -+ CBitFieldMaskBit34 = 0x400000000 -+ CBitFieldMaskBit35 = 0x800000000 -+ CBitFieldMaskBit36 = 0x1000000000 -+ CBitFieldMaskBit37 = 0x2000000000 -+ CBitFieldMaskBit38 = 0x4000000000 -+ CBitFieldMaskBit39 = 0x8000000000 -+ CBitFieldMaskBit40 = 0x10000000000 -+ CBitFieldMaskBit41 = 0x20000000000 -+ CBitFieldMaskBit42 = 0x40000000000 -+ CBitFieldMaskBit43 = 0x80000000000 -+ CBitFieldMaskBit44 = 0x100000000000 -+ CBitFieldMaskBit45 = 0x200000000000 -+ CBitFieldMaskBit46 = 0x400000000000 -+ CBitFieldMaskBit47 = 0x800000000000 -+ CBitFieldMaskBit48 = 0x1000000000000 -+ CBitFieldMaskBit49 = 0x2000000000000 -+ CBitFieldMaskBit50 = 0x4000000000000 -+ CBitFieldMaskBit51 = 0x8000000000000 -+ CBitFieldMaskBit52 = 0x10000000000000 -+ CBitFieldMaskBit53 = 0x20000000000000 -+ CBitFieldMaskBit54 = 0x40000000000000 -+ CBitFieldMaskBit55 = 0x80000000000000 -+ CBitFieldMaskBit56 = 0x100000000000000 -+ CBitFieldMaskBit57 = 0x200000000000000 -+ CBitFieldMaskBit58 = 0x400000000000000 -+ CBitFieldMaskBit59 = 0x800000000000000 -+ CBitFieldMaskBit60 = 0x1000000000000000 -+ CBitFieldMaskBit61 = 0x2000000000000000 -+ CBitFieldMaskBit62 = 0x4000000000000000 -+ CBitFieldMaskBit63 = 0x8000000000000000 -+) -+ -+type SockaddrStorage struct { -+ Family uint16 -+ _ [118]uint8 -+ _ uint64 -+} -+ -+type TCPMD5Sig struct { -+ Addr SockaddrStorage -+ Flags uint8 -+ Prefixlen uint8 -+ Keylen uint16 -+ _ uint32 -+ Key [80]uint8 -+} -+ -+type HDDriveCmdHdr struct { -+ Command uint8 -+ Number uint8 -+ Feature uint8 -+ Count uint8 -+} -+ -+type HDGeometry struct { -+ Heads uint8 -+ Sectors uint8 -+ Cylinders uint16 -+ Start uint64 -+} -+ -+type HDDriveID struct { -+ Config uint16 -+ Cyls uint16 -+ Reserved2 uint16 -+ Heads uint16 -+ Track_bytes uint16 -+ Sector_bytes uint16 -+ Sectors uint16 -+ Vendor0 uint16 -+ Vendor1 uint16 -+ Vendor2 uint16 -+ Serial_no [20]uint8 -+ Buf_type uint16 -+ Buf_size uint16 -+ Ecc_bytes uint16 -+ Fw_rev [8]uint8 -+ Model [40]uint8 -+ Max_multsect uint8 -+ Vendor3 uint8 -+ Dword_io uint16 -+ Vendor4 uint8 -+ Capability uint8 -+ Reserved50 uint16 -+ Vendor5 uint8 -+ TPIO uint8 -+ Vendor6 uint8 -+ TDMA uint8 -+ Field_valid uint16 -+ Cur_cyls uint16 -+ Cur_heads uint16 -+ Cur_sectors uint16 -+ Cur_capacity0 uint16 -+ Cur_capacity1 uint16 -+ Multsect uint8 -+ Multsect_valid uint8 -+ Lba_capacity uint32 -+ Dma_1word uint16 -+ Dma_mword uint16 -+ Eide_pio_modes uint16 -+ Eide_dma_min uint16 -+ Eide_dma_time uint16 -+ Eide_pio uint16 -+ Eide_pio_iordy uint16 -+ Words69_70 [2]uint16 -+ Words71_74 [4]uint16 -+ Queue_depth uint16 -+ Words76_79 [4]uint16 -+ Major_rev_num uint16 -+ Minor_rev_num uint16 -+ Command_set_1 uint16 -+ Command_set_2 uint16 -+ Cfsse uint16 -+ Cfs_enable_1 uint16 -+ Cfs_enable_2 uint16 -+ Csf_default uint16 -+ Dma_ultra uint16 -+ Trseuc uint16 -+ TrsEuc uint16 -+ CurAPMvalues uint16 -+ Mprc uint16 -+ Hw_config uint16 -+ Acoustic uint16 -+ Msrqs uint16 -+ Sxfert uint16 -+ Sal uint16 -+ Spg uint32 -+ Lba_capacity_2 uint64 -+ Words104_125 [22]uint16 -+ Last_lun uint16 -+ Word127 uint16 -+ Dlf uint16 -+ Csfo uint16 -+ Words130_155 [26]uint16 -+ Word156 uint16 -+ Words157_159 [3]uint16 -+ Cfa_power uint16 -+ Words161_175 [15]uint16 -+ Words176_205 [30]uint16 -+ Words206_254 [49]uint16 -+ Integrity_word uint16 -+} -+ -+type Statfs_t struct { -+ Type int64 -+ Bsize int64 -+ Blocks uint64 -+ Bfree uint64 -+ Bavail uint64 -+ Files uint64 -+ Ffree uint64 -+ Fsid Fsid -+ Namelen int64 -+ Frsize int64 -+ Flags int64 -+ Spare [4]int64 -+} -+ -+const ( -+ ST_MANDLOCK = 0x40 -+ ST_NOATIME = 0x400 -+ ST_NODEV = 0x4 -+ ST_NODIRATIME = 0x800 -+ ST_NOEXEC = 0x8 -+ ST_NOSUID = 0x2 -+ ST_RDONLY = 0x1 -+ ST_RELATIME = 0x1000 -+ ST_SYNCHRONOUS = 0x10 -+) -+ -+type TpacketHdr struct { -+ Status uint64 -+ Len uint32 -+ Snaplen uint32 -+ Mac uint16 -+ Net uint16 -+ Sec uint32 -+ Usec uint32 -+ _ [4]byte -+} -+ -+type Tpacket2Hdr struct { -+ Status uint32 -+ Len uint32 -+ Snaplen uint32 -+ Mac uint16 -+ Net uint16 -+ Sec uint32 -+ Nsec uint32 -+ Vlan_tci uint16 -+ Vlan_tpid uint16 -+ _ [4]uint8 -+} -+ -+type Tpacket3Hdr struct { -+ Next_offset uint32 -+ Sec uint32 -+ Nsec uint32 -+ Snaplen uint32 -+ Len uint32 -+ Status uint32 -+ Mac uint16 -+ Net uint16 -+ Hv1 TpacketHdrVariant1 -+ _ [8]uint8 -+} -+ -+type TpacketHdrVariant1 struct { -+ Rxhash uint32 -+ Vlan_tci uint32 -+ Vlan_tpid uint16 -+ _ uint16 -+} -+ -+type TpacketBlockDesc struct { -+ Version uint32 -+ To_priv uint32 -+ Hdr [40]byte -+} -+ -+type TpacketBDTS struct { -+ Sec uint32 -+ Usec uint32 -+} -+ -+type TpacketHdrV1 struct { -+ Block_status uint32 -+ Num_pkts uint32 -+ Offset_to_first_pkt uint32 -+ Blk_len uint32 -+ Seq_num uint64 -+ Ts_first_pkt TpacketBDTS -+ Ts_last_pkt TpacketBDTS -+} -+ -+type TpacketReq struct { -+ Block_size uint32 -+ Block_nr uint32 -+ Frame_size uint32 -+ Frame_nr uint32 -+} -+ -+type TpacketReq3 struct { -+ Block_size uint32 -+ Block_nr uint32 -+ Frame_size uint32 -+ Frame_nr uint32 -+ Retire_blk_tov uint32 -+ Sizeof_priv uint32 -+ Feature_req_word uint32 -+} -+ -+type TpacketStats struct { -+ Packets uint32 -+ Drops uint32 -+} -+ -+type TpacketStatsV3 struct { -+ Packets uint32 -+ Drops uint32 -+ Freeze_q_cnt uint32 -+} -+ -+type TpacketAuxdata struct { -+ Status uint32 -+ Len uint32 -+ Snaplen uint32 -+ Mac uint16 -+ Net uint16 -+ Vlan_tci uint16 -+ Vlan_tpid uint16 -+} -+ -+const ( -+ TPACKET_V1 = 0x0 -+ TPACKET_V2 = 0x1 -+ TPACKET_V3 = 0x2 -+) -+ -+const ( -+ SizeofTpacketHdr = 0x20 -+ SizeofTpacket2Hdr = 0x20 -+ SizeofTpacket3Hdr = 0x30 -+ -+ SizeofTpacketStats = 0x8 -+ SizeofTpacketStatsV3 = 0xc -+) -+ -+const ( -+ NF_INET_PRE_ROUTING = 0x0 -+ NF_INET_LOCAL_IN = 0x1 -+ NF_INET_FORWARD = 0x2 -+ NF_INET_LOCAL_OUT = 0x3 -+ NF_INET_POST_ROUTING = 0x4 -+ NF_INET_NUMHOOKS = 0x5 -+) -+ -+const ( -+ NF_NETDEV_INGRESS = 0x0 -+ NF_NETDEV_NUMHOOKS = 0x1 -+) -+ -+const ( -+ NFPROTO_UNSPEC = 0x0 -+ NFPROTO_INET = 0x1 -+ NFPROTO_IPV4 = 0x2 -+ NFPROTO_ARP = 0x3 -+ NFPROTO_NETDEV = 0x5 -+ NFPROTO_BRIDGE = 0x7 -+ NFPROTO_IPV6 = 0xa -+ NFPROTO_DECNET = 0xc -+ NFPROTO_NUMPROTO = 0xd -+) -+ -+type Nfgenmsg struct { -+ Nfgen_family uint8 -+ Version uint8 -+ Res_id uint16 -+} -+ -+const ( -+ NFNL_BATCH_UNSPEC = 0x0 -+ NFNL_BATCH_GENID = 0x1 -+) -+ -+const ( -+ NFT_REG_VERDICT = 0x0 -+ NFT_REG_1 = 0x1 -+ NFT_REG_2 = 0x2 -+ NFT_REG_3 = 0x3 -+ NFT_REG_4 = 0x4 -+ NFT_REG32_00 = 0x8 -+ NFT_REG32_01 = 0x9 -+ NFT_REG32_02 = 0xa -+ NFT_REG32_03 = 0xb -+ NFT_REG32_04 = 0xc -+ NFT_REG32_05 = 0xd -+ NFT_REG32_06 = 0xe -+ NFT_REG32_07 = 0xf -+ NFT_REG32_08 = 0x10 -+ NFT_REG32_09 = 0x11 -+ NFT_REG32_10 = 0x12 -+ NFT_REG32_11 = 0x13 -+ NFT_REG32_12 = 0x14 -+ NFT_REG32_13 = 0x15 -+ NFT_REG32_14 = 0x16 -+ NFT_REG32_15 = 0x17 -+ NFT_CONTINUE = -0x1 -+ NFT_BREAK = -0x2 -+ NFT_JUMP = -0x3 -+ NFT_GOTO = -0x4 -+ NFT_RETURN = -0x5 -+ NFT_MSG_NEWTABLE = 0x0 -+ NFT_MSG_GETTABLE = 0x1 -+ NFT_MSG_DELTABLE = 0x2 -+ NFT_MSG_NEWCHAIN = 0x3 -+ NFT_MSG_GETCHAIN = 0x4 -+ NFT_MSG_DELCHAIN = 0x5 -+ NFT_MSG_NEWRULE = 0x6 -+ NFT_MSG_GETRULE = 0x7 -+ NFT_MSG_DELRULE = 0x8 -+ NFT_MSG_NEWSET = 0x9 -+ NFT_MSG_GETSET = 0xa -+ NFT_MSG_DELSET = 0xb -+ NFT_MSG_NEWSETELEM = 0xc -+ NFT_MSG_GETSETELEM = 0xd -+ NFT_MSG_DELSETELEM = 0xe -+ NFT_MSG_NEWGEN = 0xf -+ NFT_MSG_GETGEN = 0x10 -+ NFT_MSG_TRACE = 0x11 -+ NFT_MSG_NEWOBJ = 0x12 -+ NFT_MSG_GETOBJ = 0x13 -+ NFT_MSG_DELOBJ = 0x14 -+ NFT_MSG_GETOBJ_RESET = 0x15 -+ NFT_MSG_MAX = 0x19 -+ NFTA_LIST_UNPEC = 0x0 -+ NFTA_LIST_ELEM = 0x1 -+ NFTA_HOOK_UNSPEC = 0x0 -+ NFTA_HOOK_HOOKNUM = 0x1 -+ NFTA_HOOK_PRIORITY = 0x2 -+ NFTA_HOOK_DEV = 0x3 -+ NFT_TABLE_F_DORMANT = 0x1 -+ NFTA_TABLE_UNSPEC = 0x0 -+ NFTA_TABLE_NAME = 0x1 -+ NFTA_TABLE_FLAGS = 0x2 -+ NFTA_TABLE_USE = 0x3 -+ NFTA_CHAIN_UNSPEC = 0x0 -+ NFTA_CHAIN_TABLE = 0x1 -+ NFTA_CHAIN_HANDLE = 0x2 -+ NFTA_CHAIN_NAME = 0x3 -+ NFTA_CHAIN_HOOK = 0x4 -+ NFTA_CHAIN_POLICY = 0x5 -+ NFTA_CHAIN_USE = 0x6 -+ NFTA_CHAIN_TYPE = 0x7 -+ NFTA_CHAIN_COUNTERS = 0x8 -+ NFTA_CHAIN_PAD = 0x9 -+ NFTA_RULE_UNSPEC = 0x0 -+ NFTA_RULE_TABLE = 0x1 -+ NFTA_RULE_CHAIN = 0x2 -+ NFTA_RULE_HANDLE = 0x3 -+ NFTA_RULE_EXPRESSIONS = 0x4 -+ NFTA_RULE_COMPAT = 0x5 -+ NFTA_RULE_POSITION = 0x6 -+ NFTA_RULE_USERDATA = 0x7 -+ NFTA_RULE_PAD = 0x8 -+ NFTA_RULE_ID = 0x9 -+ NFT_RULE_COMPAT_F_INV = 0x2 -+ NFT_RULE_COMPAT_F_MASK = 0x2 -+ NFTA_RULE_COMPAT_UNSPEC = 0x0 -+ NFTA_RULE_COMPAT_PROTO = 0x1 -+ NFTA_RULE_COMPAT_FLAGS = 0x2 -+ NFT_SET_ANONYMOUS = 0x1 -+ NFT_SET_CONSTANT = 0x2 -+ NFT_SET_INTERVAL = 0x4 -+ NFT_SET_MAP = 0x8 -+ NFT_SET_TIMEOUT = 0x10 -+ NFT_SET_EVAL = 0x20 -+ NFT_SET_OBJECT = 0x40 -+ NFT_SET_POL_PERFORMANCE = 0x0 -+ NFT_SET_POL_MEMORY = 0x1 -+ NFTA_SET_DESC_UNSPEC = 0x0 -+ NFTA_SET_DESC_SIZE = 0x1 -+ NFTA_SET_UNSPEC = 0x0 -+ NFTA_SET_TABLE = 0x1 -+ NFTA_SET_NAME = 0x2 -+ NFTA_SET_FLAGS = 0x3 -+ NFTA_SET_KEY_TYPE = 0x4 -+ NFTA_SET_KEY_LEN = 0x5 -+ NFTA_SET_DATA_TYPE = 0x6 -+ NFTA_SET_DATA_LEN = 0x7 -+ NFTA_SET_POLICY = 0x8 -+ NFTA_SET_DESC = 0x9 -+ NFTA_SET_ID = 0xa -+ NFTA_SET_TIMEOUT = 0xb -+ NFTA_SET_GC_INTERVAL = 0xc -+ NFTA_SET_USERDATA = 0xd -+ NFTA_SET_PAD = 0xe -+ NFTA_SET_OBJ_TYPE = 0xf -+ NFT_SET_ELEM_INTERVAL_END = 0x1 -+ NFTA_SET_ELEM_UNSPEC = 0x0 -+ NFTA_SET_ELEM_KEY = 0x1 -+ NFTA_SET_ELEM_DATA = 0x2 -+ NFTA_SET_ELEM_FLAGS = 0x3 -+ NFTA_SET_ELEM_TIMEOUT = 0x4 -+ NFTA_SET_ELEM_EXPIRATION = 0x5 -+ NFTA_SET_ELEM_USERDATA = 0x6 -+ NFTA_SET_ELEM_EXPR = 0x7 -+ NFTA_SET_ELEM_PAD = 0x8 -+ NFTA_SET_ELEM_OBJREF = 0x9 -+ NFTA_SET_ELEM_LIST_UNSPEC = 0x0 -+ NFTA_SET_ELEM_LIST_TABLE = 0x1 -+ NFTA_SET_ELEM_LIST_SET = 0x2 -+ NFTA_SET_ELEM_LIST_ELEMENTS = 0x3 -+ NFTA_SET_ELEM_LIST_SET_ID = 0x4 -+ NFT_DATA_VALUE = 0x0 -+ NFT_DATA_VERDICT = 0xffffff00 -+ NFTA_DATA_UNSPEC = 0x0 -+ NFTA_DATA_VALUE = 0x1 -+ NFTA_DATA_VERDICT = 0x2 -+ NFTA_VERDICT_UNSPEC = 0x0 -+ NFTA_VERDICT_CODE = 0x1 -+ NFTA_VERDICT_CHAIN = 0x2 -+ NFTA_EXPR_UNSPEC = 0x0 -+ NFTA_EXPR_NAME = 0x1 -+ NFTA_EXPR_DATA = 0x2 -+ NFTA_IMMEDIATE_UNSPEC = 0x0 -+ NFTA_IMMEDIATE_DREG = 0x1 -+ NFTA_IMMEDIATE_DATA = 0x2 -+ NFTA_BITWISE_UNSPEC = 0x0 -+ NFTA_BITWISE_SREG = 0x1 -+ NFTA_BITWISE_DREG = 0x2 -+ NFTA_BITWISE_LEN = 0x3 -+ NFTA_BITWISE_MASK = 0x4 -+ NFTA_BITWISE_XOR = 0x5 -+ NFT_BYTEORDER_NTOH = 0x0 -+ NFT_BYTEORDER_HTON = 0x1 -+ NFTA_BYTEORDER_UNSPEC = 0x0 -+ NFTA_BYTEORDER_SREG = 0x1 -+ NFTA_BYTEORDER_DREG = 0x2 -+ NFTA_BYTEORDER_OP = 0x3 -+ NFTA_BYTEORDER_LEN = 0x4 -+ NFTA_BYTEORDER_SIZE = 0x5 -+ NFT_CMP_EQ = 0x0 -+ NFT_CMP_NEQ = 0x1 -+ NFT_CMP_LT = 0x2 -+ NFT_CMP_LTE = 0x3 -+ NFT_CMP_GT = 0x4 -+ NFT_CMP_GTE = 0x5 -+ NFTA_CMP_UNSPEC = 0x0 -+ NFTA_CMP_SREG = 0x1 -+ NFTA_CMP_OP = 0x2 -+ NFTA_CMP_DATA = 0x3 -+ NFT_RANGE_EQ = 0x0 -+ NFT_RANGE_NEQ = 0x1 -+ NFTA_RANGE_UNSPEC = 0x0 -+ NFTA_RANGE_SREG = 0x1 -+ NFTA_RANGE_OP = 0x2 -+ NFTA_RANGE_FROM_DATA = 0x3 -+ NFTA_RANGE_TO_DATA = 0x4 -+ NFT_LOOKUP_F_INV = 0x1 -+ NFTA_LOOKUP_UNSPEC = 0x0 -+ NFTA_LOOKUP_SET = 0x1 -+ NFTA_LOOKUP_SREG = 0x2 -+ NFTA_LOOKUP_DREG = 0x3 -+ NFTA_LOOKUP_SET_ID = 0x4 -+ NFTA_LOOKUP_FLAGS = 0x5 -+ NFT_DYNSET_OP_ADD = 0x0 -+ NFT_DYNSET_OP_UPDATE = 0x1 -+ NFT_DYNSET_F_INV = 0x1 -+ NFTA_DYNSET_UNSPEC = 0x0 -+ NFTA_DYNSET_SET_NAME = 0x1 -+ NFTA_DYNSET_SET_ID = 0x2 -+ NFTA_DYNSET_OP = 0x3 -+ NFTA_DYNSET_SREG_KEY = 0x4 -+ NFTA_DYNSET_SREG_DATA = 0x5 -+ NFTA_DYNSET_TIMEOUT = 0x6 -+ NFTA_DYNSET_EXPR = 0x7 -+ NFTA_DYNSET_PAD = 0x8 -+ NFTA_DYNSET_FLAGS = 0x9 -+ NFT_PAYLOAD_LL_HEADER = 0x0 -+ NFT_PAYLOAD_NETWORK_HEADER = 0x1 -+ NFT_PAYLOAD_TRANSPORT_HEADER = 0x2 -+ NFT_PAYLOAD_CSUM_NONE = 0x0 -+ NFT_PAYLOAD_CSUM_INET = 0x1 -+ NFT_PAYLOAD_L4CSUM_PSEUDOHDR = 0x1 -+ NFTA_PAYLOAD_UNSPEC = 0x0 -+ NFTA_PAYLOAD_DREG = 0x1 -+ NFTA_PAYLOAD_BASE = 0x2 -+ NFTA_PAYLOAD_OFFSET = 0x3 -+ NFTA_PAYLOAD_LEN = 0x4 -+ NFTA_PAYLOAD_SREG = 0x5 -+ NFTA_PAYLOAD_CSUM_TYPE = 0x6 -+ NFTA_PAYLOAD_CSUM_OFFSET = 0x7 -+ NFTA_PAYLOAD_CSUM_FLAGS = 0x8 -+ NFT_EXTHDR_F_PRESENT = 0x1 -+ NFT_EXTHDR_OP_IPV6 = 0x0 -+ NFT_EXTHDR_OP_TCPOPT = 0x1 -+ NFTA_EXTHDR_UNSPEC = 0x0 -+ NFTA_EXTHDR_DREG = 0x1 -+ NFTA_EXTHDR_TYPE = 0x2 -+ NFTA_EXTHDR_OFFSET = 0x3 -+ NFTA_EXTHDR_LEN = 0x4 -+ NFTA_EXTHDR_FLAGS = 0x5 -+ NFTA_EXTHDR_OP = 0x6 -+ NFTA_EXTHDR_SREG = 0x7 -+ NFT_META_LEN = 0x0 -+ NFT_META_PROTOCOL = 0x1 -+ NFT_META_PRIORITY = 0x2 -+ NFT_META_MARK = 0x3 -+ NFT_META_IIF = 0x4 -+ NFT_META_OIF = 0x5 -+ NFT_META_IIFNAME = 0x6 -+ NFT_META_OIFNAME = 0x7 -+ NFT_META_IIFTYPE = 0x8 -+ NFT_META_OIFTYPE = 0x9 -+ NFT_META_SKUID = 0xa -+ NFT_META_SKGID = 0xb -+ NFT_META_NFTRACE = 0xc -+ NFT_META_RTCLASSID = 0xd -+ NFT_META_SECMARK = 0xe -+ NFT_META_NFPROTO = 0xf -+ NFT_META_L4PROTO = 0x10 -+ NFT_META_BRI_IIFNAME = 0x11 -+ NFT_META_BRI_OIFNAME = 0x12 -+ NFT_META_PKTTYPE = 0x13 -+ NFT_META_CPU = 0x14 -+ NFT_META_IIFGROUP = 0x15 -+ NFT_META_OIFGROUP = 0x16 -+ NFT_META_CGROUP = 0x17 -+ NFT_META_PRANDOM = 0x18 -+ NFT_RT_CLASSID = 0x0 -+ NFT_RT_NEXTHOP4 = 0x1 -+ NFT_RT_NEXTHOP6 = 0x2 -+ NFT_RT_TCPMSS = 0x3 -+ NFT_HASH_JENKINS = 0x0 -+ NFT_HASH_SYM = 0x1 -+ NFTA_HASH_UNSPEC = 0x0 -+ NFTA_HASH_SREG = 0x1 -+ NFTA_HASH_DREG = 0x2 -+ NFTA_HASH_LEN = 0x3 -+ NFTA_HASH_MODULUS = 0x4 -+ NFTA_HASH_SEED = 0x5 -+ NFTA_HASH_OFFSET = 0x6 -+ NFTA_HASH_TYPE = 0x7 -+ NFTA_META_UNSPEC = 0x0 -+ NFTA_META_DREG = 0x1 -+ NFTA_META_KEY = 0x2 -+ NFTA_META_SREG = 0x3 -+ NFTA_RT_UNSPEC = 0x0 -+ NFTA_RT_DREG = 0x1 -+ NFTA_RT_KEY = 0x2 -+ NFT_CT_STATE = 0x0 -+ NFT_CT_DIRECTION = 0x1 -+ NFT_CT_STATUS = 0x2 -+ NFT_CT_MARK = 0x3 -+ NFT_CT_SECMARK = 0x4 -+ NFT_CT_EXPIRATION = 0x5 -+ NFT_CT_HELPER = 0x6 -+ NFT_CT_L3PROTOCOL = 0x7 -+ NFT_CT_SRC = 0x8 -+ NFT_CT_DST = 0x9 -+ NFT_CT_PROTOCOL = 0xa -+ NFT_CT_PROTO_SRC = 0xb -+ NFT_CT_PROTO_DST = 0xc -+ NFT_CT_LABELS = 0xd -+ NFT_CT_PKTS = 0xe -+ NFT_CT_BYTES = 0xf -+ NFT_CT_AVGPKT = 0x10 -+ NFT_CT_ZONE = 0x11 -+ NFT_CT_EVENTMASK = 0x12 -+ NFTA_CT_UNSPEC = 0x0 -+ NFTA_CT_DREG = 0x1 -+ NFTA_CT_KEY = 0x2 -+ NFTA_CT_DIRECTION = 0x3 -+ NFTA_CT_SREG = 0x4 -+ NFT_LIMIT_PKTS = 0x0 -+ NFT_LIMIT_PKT_BYTES = 0x1 -+ NFT_LIMIT_F_INV = 0x1 -+ NFTA_LIMIT_UNSPEC = 0x0 -+ NFTA_LIMIT_RATE = 0x1 -+ NFTA_LIMIT_UNIT = 0x2 -+ NFTA_LIMIT_BURST = 0x3 -+ NFTA_LIMIT_TYPE = 0x4 -+ NFTA_LIMIT_FLAGS = 0x5 -+ NFTA_LIMIT_PAD = 0x6 -+ NFTA_COUNTER_UNSPEC = 0x0 -+ NFTA_COUNTER_BYTES = 0x1 -+ NFTA_COUNTER_PACKETS = 0x2 -+ NFTA_COUNTER_PAD = 0x3 -+ NFTA_LOG_UNSPEC = 0x0 -+ NFTA_LOG_GROUP = 0x1 -+ NFTA_LOG_PREFIX = 0x2 -+ NFTA_LOG_SNAPLEN = 0x3 -+ NFTA_LOG_QTHRESHOLD = 0x4 -+ NFTA_LOG_LEVEL = 0x5 -+ NFTA_LOG_FLAGS = 0x6 -+ NFTA_QUEUE_UNSPEC = 0x0 -+ NFTA_QUEUE_NUM = 0x1 -+ NFTA_QUEUE_TOTAL = 0x2 -+ NFTA_QUEUE_FLAGS = 0x3 -+ NFTA_QUEUE_SREG_QNUM = 0x4 -+ NFT_QUOTA_F_INV = 0x1 -+ NFT_QUOTA_F_DEPLETED = 0x2 -+ NFTA_QUOTA_UNSPEC = 0x0 -+ NFTA_QUOTA_BYTES = 0x1 -+ NFTA_QUOTA_FLAGS = 0x2 -+ NFTA_QUOTA_PAD = 0x3 -+ NFTA_QUOTA_CONSUMED = 0x4 -+ NFT_REJECT_ICMP_UNREACH = 0x0 -+ NFT_REJECT_TCP_RST = 0x1 -+ NFT_REJECT_ICMPX_UNREACH = 0x2 -+ NFT_REJECT_ICMPX_NO_ROUTE = 0x0 -+ NFT_REJECT_ICMPX_PORT_UNREACH = 0x1 -+ NFT_REJECT_ICMPX_HOST_UNREACH = 0x2 -+ NFT_REJECT_ICMPX_ADMIN_PROHIBITED = 0x3 -+ NFTA_REJECT_UNSPEC = 0x0 -+ NFTA_REJECT_TYPE = 0x1 -+ NFTA_REJECT_ICMP_CODE = 0x2 -+ NFT_NAT_SNAT = 0x0 -+ NFT_NAT_DNAT = 0x1 -+ NFTA_NAT_UNSPEC = 0x0 -+ NFTA_NAT_TYPE = 0x1 -+ NFTA_NAT_FAMILY = 0x2 -+ NFTA_NAT_REG_ADDR_MIN = 0x3 -+ NFTA_NAT_REG_ADDR_MAX = 0x4 -+ NFTA_NAT_REG_PROTO_MIN = 0x5 -+ NFTA_NAT_REG_PROTO_MAX = 0x6 -+ NFTA_NAT_FLAGS = 0x7 -+ NFTA_MASQ_UNSPEC = 0x0 -+ NFTA_MASQ_FLAGS = 0x1 -+ NFTA_MASQ_REG_PROTO_MIN = 0x2 -+ NFTA_MASQ_REG_PROTO_MAX = 0x3 -+ NFTA_REDIR_UNSPEC = 0x0 -+ NFTA_REDIR_REG_PROTO_MIN = 0x1 -+ NFTA_REDIR_REG_PROTO_MAX = 0x2 -+ NFTA_REDIR_FLAGS = 0x3 -+ NFTA_DUP_UNSPEC = 0x0 -+ NFTA_DUP_SREG_ADDR = 0x1 -+ NFTA_DUP_SREG_DEV = 0x2 -+ NFTA_FWD_UNSPEC = 0x0 -+ NFTA_FWD_SREG_DEV = 0x1 -+ NFTA_OBJREF_UNSPEC = 0x0 -+ NFTA_OBJREF_IMM_TYPE = 0x1 -+ NFTA_OBJREF_IMM_NAME = 0x2 -+ NFTA_OBJREF_SET_SREG = 0x3 -+ NFTA_OBJREF_SET_NAME = 0x4 -+ NFTA_OBJREF_SET_ID = 0x5 -+ NFTA_GEN_UNSPEC = 0x0 -+ NFTA_GEN_ID = 0x1 -+ NFTA_GEN_PROC_PID = 0x2 -+ NFTA_GEN_PROC_NAME = 0x3 -+ NFTA_FIB_UNSPEC = 0x0 -+ NFTA_FIB_DREG = 0x1 -+ NFTA_FIB_RESULT = 0x2 -+ NFTA_FIB_FLAGS = 0x3 -+ NFT_FIB_RESULT_UNSPEC = 0x0 -+ NFT_FIB_RESULT_OIF = 0x1 -+ NFT_FIB_RESULT_OIFNAME = 0x2 -+ NFT_FIB_RESULT_ADDRTYPE = 0x3 -+ NFTA_FIB_F_SADDR = 0x1 -+ NFTA_FIB_F_DADDR = 0x2 -+ NFTA_FIB_F_MARK = 0x4 -+ NFTA_FIB_F_IIF = 0x8 -+ NFTA_FIB_F_OIF = 0x10 -+ NFTA_FIB_F_PRESENT = 0x20 -+ NFTA_CT_HELPER_UNSPEC = 0x0 -+ NFTA_CT_HELPER_NAME = 0x1 -+ NFTA_CT_HELPER_L3PROTO = 0x2 -+ NFTA_CT_HELPER_L4PROTO = 0x3 -+ NFTA_OBJ_UNSPEC = 0x0 -+ NFTA_OBJ_TABLE = 0x1 -+ NFTA_OBJ_NAME = 0x2 -+ NFTA_OBJ_TYPE = 0x3 -+ NFTA_OBJ_DATA = 0x4 -+ NFTA_OBJ_USE = 0x5 -+ NFTA_TRACE_UNSPEC = 0x0 -+ NFTA_TRACE_TABLE = 0x1 -+ NFTA_TRACE_CHAIN = 0x2 -+ NFTA_TRACE_RULE_HANDLE = 0x3 -+ NFTA_TRACE_TYPE = 0x4 -+ NFTA_TRACE_VERDICT = 0x5 -+ NFTA_TRACE_ID = 0x6 -+ NFTA_TRACE_LL_HEADER = 0x7 -+ NFTA_TRACE_NETWORK_HEADER = 0x8 -+ NFTA_TRACE_TRANSPORT_HEADER = 0x9 -+ NFTA_TRACE_IIF = 0xa -+ NFTA_TRACE_IIFTYPE = 0xb -+ NFTA_TRACE_OIF = 0xc -+ NFTA_TRACE_OIFTYPE = 0xd -+ NFTA_TRACE_MARK = 0xe -+ NFTA_TRACE_NFPROTO = 0xf -+ NFTA_TRACE_POLICY = 0x10 -+ NFTA_TRACE_PAD = 0x11 -+ NFT_TRACETYPE_UNSPEC = 0x0 -+ NFT_TRACETYPE_POLICY = 0x1 -+ NFT_TRACETYPE_RETURN = 0x2 -+ NFT_TRACETYPE_RULE = 0x3 -+ NFTA_NG_UNSPEC = 0x0 -+ NFTA_NG_DREG = 0x1 -+ NFTA_NG_MODULUS = 0x2 -+ NFTA_NG_TYPE = 0x3 -+ NFTA_NG_OFFSET = 0x4 -+ NFT_NG_INCREMENTAL = 0x0 -+ NFT_NG_RANDOM = 0x1 -+) -+ -+type RTCTime struct { -+ Sec int32 -+ Min int32 -+ Hour int32 -+ Mday int32 -+ Mon int32 -+ Year int32 -+ Wday int32 -+ Yday int32 -+ Isdst int32 -+} -+ -+type RTCWkAlrm struct { -+ Enabled uint8 -+ Pending uint8 -+ Time RTCTime -+} -+ -+type RTCPLLInfo struct { -+ Ctrl int32 -+ Value int32 -+ Max int32 -+ Min int32 -+ Posmult int32 -+ Negmult int32 -+ Clock int64 -+} -+ -+type BlkpgIoctlArg struct { -+ Op int32 -+ Flags int32 -+ Datalen int32 -+ Data *byte -+} -+ -+type BlkpgPartition struct { -+ Start int64 -+ Length int64 -+ Pno int32 -+ Devname [64]uint8 -+ Volname [64]uint8 -+ _ [4]byte -+} -+ -+const ( -+ BLKPG = 0x1269 -+ BLKPG_ADD_PARTITION = 0x1 -+ BLKPG_DEL_PARTITION = 0x2 -+ BLKPG_RESIZE_PARTITION = 0x3 -+) -+ -+const ( -+ NETNSA_NONE = 0x0 -+ NETNSA_NSID = 0x1 -+ NETNSA_PID = 0x2 -+ NETNSA_FD = 0x3 -+) -+ -+type XDPRingOffset struct { -+ Producer uint64 -+ Consumer uint64 -+ Desc uint64 -+} -+ -+type XDPMmapOffsets struct { -+ Rx XDPRingOffset -+ Tx XDPRingOffset -+ Fr XDPRingOffset -+ Cr XDPRingOffset -+} -+ -+type XDPUmemReg struct { -+ Addr uint64 -+ Len uint64 -+ Size uint32 -+ Headroom uint32 -+} -+ -+type XDPStatistics struct { -+ Rx_dropped uint64 -+ Rx_invalid_descs uint64 -+ Tx_invalid_descs uint64 -+} -+ -+type XDPDesc struct { -+ Addr uint64 -+ Len uint32 -+ Options uint32 -+} -+ -+const ( -+ NCSI_CMD_UNSPEC = 0x0 -+ NCSI_CMD_PKG_INFO = 0x1 -+ NCSI_CMD_SET_INTERFACE = 0x2 -+ NCSI_CMD_CLEAR_INTERFACE = 0x3 -+ NCSI_ATTR_UNSPEC = 0x0 -+ NCSI_ATTR_IFINDEX = 0x1 -+ NCSI_ATTR_PACKAGE_LIST = 0x2 -+ NCSI_ATTR_PACKAGE_ID = 0x3 -+ NCSI_ATTR_CHANNEL_ID = 0x4 -+ NCSI_PKG_ATTR_UNSPEC = 0x0 -+ NCSI_PKG_ATTR = 0x1 -+ NCSI_PKG_ATTR_ID = 0x2 -+ NCSI_PKG_ATTR_FORCED = 0x3 -+ NCSI_PKG_ATTR_CHANNEL_LIST = 0x4 -+ NCSI_CHANNEL_ATTR_UNSPEC = 0x0 -+ NCSI_CHANNEL_ATTR = 0x1 -+ NCSI_CHANNEL_ATTR_ID = 0x2 -+ NCSI_CHANNEL_ATTR_VERSION_MAJOR = 0x3 -+ NCSI_CHANNEL_ATTR_VERSION_MINOR = 0x4 -+ NCSI_CHANNEL_ATTR_VERSION_STR = 0x5 -+ NCSI_CHANNEL_ATTR_LINK_STATE = 0x6 -+ NCSI_CHANNEL_ATTR_ACTIVE = 0x7 -+ NCSI_CHANNEL_ATTR_FORCED = 0x8 -+ NCSI_CHANNEL_ATTR_VLAN_LIST = 0x9 -+ NCSI_CHANNEL_ATTR_VLAN_ID = 0xa -+) -+ -+type ScmTimestamping struct { -+ Ts [3]Timespec -+} -+ -+const ( -+ SOF_TIMESTAMPING_TX_HARDWARE = 0x1 -+ SOF_TIMESTAMPING_TX_SOFTWARE = 0x2 -+ SOF_TIMESTAMPING_RX_HARDWARE = 0x4 -+ SOF_TIMESTAMPING_RX_SOFTWARE = 0x8 -+ SOF_TIMESTAMPING_SOFTWARE = 0x10 -+ SOF_TIMESTAMPING_SYS_HARDWARE = 0x20 -+ SOF_TIMESTAMPING_RAW_HARDWARE = 0x40 -+ SOF_TIMESTAMPING_OPT_ID = 0x80 -+ SOF_TIMESTAMPING_TX_SCHED = 0x100 -+ SOF_TIMESTAMPING_TX_ACK = 0x200 -+ SOF_TIMESTAMPING_OPT_CMSG = 0x400 -+ SOF_TIMESTAMPING_OPT_TSONLY = 0x800 -+ SOF_TIMESTAMPING_OPT_STATS = 0x1000 -+ SOF_TIMESTAMPING_OPT_PKTINFO = 0x2000 -+ SOF_TIMESTAMPING_OPT_TX_SWHW = 0x4000 -+ -+ SOF_TIMESTAMPING_LAST = 0x4000 -+ SOF_TIMESTAMPING_MASK = 0x7fff -+ -+ SCM_TSTAMP_SND = 0x0 -+ SCM_TSTAMP_SCHED = 0x1 -+ SCM_TSTAMP_ACK = 0x2 -+) -+ -+type SockExtendedErr struct { -+ Errno uint32 -+ Origin uint8 -+ Type uint8 -+ Code uint8 -+ Pad uint8 -+ Info uint32 -+ Data uint32 -+} -+ -+type FanotifyEventMetadata struct { -+ Event_len uint32 -+ Vers uint8 -+ Reserved uint8 -+ Metadata_len uint16 -+ Mask uint64 -+ Fd int32 -+ Pid int32 -+} -+ -+type FanotifyResponse struct { -+ Fd int32 -+ Response uint32 -+} -+ -+const ( -+ CRYPTO_MSG_BASE = 0x10 -+ CRYPTO_MSG_NEWALG = 0x10 -+ CRYPTO_MSG_DELALG = 0x11 -+ CRYPTO_MSG_UPDATEALG = 0x12 -+ CRYPTO_MSG_GETALG = 0x13 -+ CRYPTO_MSG_DELRNG = 0x14 -+ CRYPTO_MSG_GETSTAT = 0x15 -+) -+ -+const ( -+ CRYPTOCFGA_UNSPEC = 0x0 -+ CRYPTOCFGA_PRIORITY_VAL = 0x1 -+ CRYPTOCFGA_REPORT_LARVAL = 0x2 -+ CRYPTOCFGA_REPORT_HASH = 0x3 -+ CRYPTOCFGA_REPORT_BLKCIPHER = 0x4 -+ CRYPTOCFGA_REPORT_AEAD = 0x5 -+ CRYPTOCFGA_REPORT_COMPRESS = 0x6 -+ CRYPTOCFGA_REPORT_RNG = 0x7 -+ CRYPTOCFGA_REPORT_CIPHER = 0x8 -+ CRYPTOCFGA_REPORT_AKCIPHER = 0x9 -+ CRYPTOCFGA_REPORT_KPP = 0xa -+ CRYPTOCFGA_REPORT_ACOMP = 0xb -+ CRYPTOCFGA_STAT_LARVAL = 0xc -+ CRYPTOCFGA_STAT_HASH = 0xd -+ CRYPTOCFGA_STAT_BLKCIPHER = 0xe -+ CRYPTOCFGA_STAT_AEAD = 0xf -+ CRYPTOCFGA_STAT_COMPRESS = 0x10 -+ CRYPTOCFGA_STAT_RNG = 0x11 -+ CRYPTOCFGA_STAT_CIPHER = 0x12 -+ CRYPTOCFGA_STAT_AKCIPHER = 0x13 -+ CRYPTOCFGA_STAT_KPP = 0x14 -+ CRYPTOCFGA_STAT_ACOMP = 0x15 -+) -+ -+type CryptoUserAlg struct { -+ Name [64]uint8 -+ Driver_name [64]uint8 -+ Module_name [64]uint8 -+ Type uint32 -+ Mask uint32 -+ Refcnt uint32 -+ Flags uint32 -+} -+ -+type CryptoStatAEAD struct { -+ Type [64]uint8 -+ Encrypt_cnt uint64 -+ Encrypt_tlen uint64 -+ Decrypt_cnt uint64 -+ Decrypt_tlen uint64 -+ Err_cnt uint64 -+} -+ -+type CryptoStatAKCipher struct { -+ Type [64]uint8 -+ Encrypt_cnt uint64 -+ Encrypt_tlen uint64 -+ Decrypt_cnt uint64 -+ Decrypt_tlen uint64 -+ Verify_cnt uint64 -+ Sign_cnt uint64 -+ Err_cnt uint64 -+} -+ -+type CryptoStatCipher struct { -+ Type [64]uint8 -+ Encrypt_cnt uint64 -+ Encrypt_tlen uint64 -+ Decrypt_cnt uint64 -+ Decrypt_tlen uint64 -+ Err_cnt uint64 -+} -+ -+type CryptoStatCompress struct { -+ Type [64]uint8 -+ Compress_cnt uint64 -+ Compress_tlen uint64 -+ Decompress_cnt uint64 -+ Decompress_tlen uint64 -+ Err_cnt uint64 -+} -+ -+type CryptoStatHash struct { -+ Type [64]uint8 -+ Hash_cnt uint64 -+ Hash_tlen uint64 -+ Err_cnt uint64 -+} -+ -+type CryptoStatKPP struct { -+ Type [64]uint8 -+ Setsecret_cnt uint64 -+ Generate_public_key_cnt uint64 -+ Compute_shared_secret_cnt uint64 -+ Err_cnt uint64 -+} -+ -+type CryptoStatRNG struct { -+ Type [64]uint8 -+ Generate_cnt uint64 -+ Generate_tlen uint64 -+ Seed_cnt uint64 -+ Err_cnt uint64 -+} -+ -+type CryptoStatLarval struct { -+ Type [64]uint8 -+} -+ -+type CryptoReportLarval struct { -+ Type [64]uint8 -+} -+ -+type CryptoReportHash struct { -+ Type [64]uint8 -+ Blocksize uint32 -+ Digestsize uint32 -+} -+ -+type CryptoReportCipher struct { -+ Type [64]uint8 -+ Blocksize uint32 -+ Min_keysize uint32 -+ Max_keysize uint32 -+} -+ -+type CryptoReportBlkCipher struct { -+ Type [64]uint8 -+ Geniv [64]uint8 -+ Blocksize uint32 -+ Min_keysize uint32 -+ Max_keysize uint32 -+ Ivsize uint32 -+} -+ -+type CryptoReportAEAD struct { -+ Type [64]uint8 -+ Geniv [64]uint8 -+ Blocksize uint32 -+ Maxauthsize uint32 -+ Ivsize uint32 -+} -+ -+type CryptoReportComp struct { -+ Type [64]uint8 -+} -+ -+type CryptoReportRNG struct { -+ Type [64]uint8 -+ Seedsize uint32 -+} -+ -+type CryptoReportAKCipher struct { -+ Type [64]uint8 -+} -+ -+type CryptoReportKPP struct { -+ Type [64]uint8 -+} -+ -+type CryptoReportAcomp struct { -+ Type [64]uint8 -+} --- -2.23.0 - diff --git a/patch/0064-containerd-check-task-list-to-avoid-unnecessary-clea.patch b/patch/0064-containerd-check-task-list-to-avoid-unnecessary-clea.patch deleted file mode 100644 index caea572..0000000 --- a/patch/0064-containerd-check-task-list-to-avoid-unnecessary-clea.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 53111d2f094b738a4b3a35bcec85f78324ca8509 Mon Sep 17 00:00:00 2001 -From: xiadanni1 -Date: Tue, 24 Nov 2020 11:00:32 +0800 -Subject: [PATCH] containerd: check task list to avoid unnecessary cleanup - -Signed-off-by: Lantao Liu -Signed-off-by: xiadanni1 ---- - runtime/v1/linux/runtime.go | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 5be785d..0feb587 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -374,6 +374,11 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - shimExit := make(chan struct{}) - s, err := bundle.NewShimClient(ctx, ns, ShimConnect(r.config, func() { - close(shimExit) -+ if _, err := r.tasks.Get(ctx, id); err != nil { -+ // Task was never started or was already successfully deleted -+ return -+ } -+ - err := r.cleanupAfterDeadShim(ctx, bundle, ns, id, pid) - if err != nil { - log.G(ctx).WithError(err).WithField("bundle", bundle.path). --- -1.8.3.1 - diff --git a/patch/0065-containerd-add-blot-symbol-to-support-riscv.patch b/patch/0065-containerd-add-blot-symbol-to-support-riscv.patch deleted file mode 100644 index d59f2d2..0000000 --- a/patch/0065-containerd-add-blot-symbol-to-support-riscv.patch +++ /dev/null @@ -1,31 +0,0 @@ -From d03e4a480ba9f954ebe077981202c811e21640e9 Mon Sep 17 00:00:00 2001 -From: yangyanchao -Date: Tue, 15 Dec 2020 03:24:47 +0000 -Subject: [PATCH 2/2] containerd-add-sys-symbol-to-support-riscv - ---- - vendor/go.etcd.io/bbolt/bolt_riscv64.go | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - create mode 100644 vendor/go.etcd.io/bbolt/bolt_riscv64.go - -diff --git a/vendor/go.etcd.io/bbolt/bolt_riscv64.go b/vendor/go.etcd.io/bbolt/bolt_riscv64.go -new file mode 100644 -index 0000000..5f1c364 ---- /dev/null -+++ b/vendor/go.etcd.io/bbolt/bolt_riscv64.go -@@ -0,0 +1,12 @@ -+// +build riscv64 -+ -+package bbolt -+ -+// maxMapSize represents the latgest mmap size supported by Bolt. -+const maxMapSize = 0xFFFFFFFFFFFF // 256TB -+ -+// maxAllocSize is the size used when creating array pointers. -+const maxAllocSize = 0x7FFFFFFF -+ -+// Are unaligned load/stores broken on this arch? -+var brokenUnaligned = false --- -2.23.0 - diff --git a/patch/0065-containerd-fix-dead-loop.patch b/patch/0065-containerd-fix-dead-loop.patch deleted file mode 100644 index e7311d2..0000000 --- a/patch/0065-containerd-fix-dead-loop.patch +++ /dev/null @@ -1,37 +0,0 @@ -From b315a85a6695dfbe67767f21713c3ccfc7cae73e Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Mon, 1 Feb 2021 09:48:07 +0800 -Subject: [PATCH] containerd: fix dead loop - -Change-Id: I6b2ce4456ca8fe197683692721d150f4e5d7e3fe -Signed-off-by: jingrui ---- - runtime/v1/shim/client/client.go | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/runtime/v1/shim/client/client.go b/runtime/v1/shim/client/client.go -index 06453b35a..9e63af4ea 100644 ---- a/runtime/v1/shim/client/client.go -+++ b/runtime/v1/shim/client/client.go -@@ -393,15 +393,15 @@ func (c *Client) signalShim(ctx context.Context, sig syscall.Signal) error { - - func (c *Client) waitForExit(pid int) <-chan struct{} { - c.exitOnce.Do(func() { -- for { -+ for i := 0; i < 1000; i++ { - // use kill(pid, 0) here because the shim could have been reparented - // and we are no longer able to waitpid(pid, ...) on the shim - if err := unix.Kill(pid, 0); err == unix.ESRCH { -- close(c.exitCh) -- return -+ break - } - time.Sleep(10 * time.Millisecond) - } -+ close(c.exitCh) - }) - return c.exitCh - } --- -2.17.1 - diff --git a/patch/0066-containerd-cleanup-dangling-shim-by-brand-new-context.patch b/patch/0066-containerd-cleanup-dangling-shim-by-brand-new-context.patch deleted file mode 100644 index ecfe407..0000000 --- a/patch/0066-containerd-cleanup-dangling-shim-by-brand-new-context.patch +++ /dev/null @@ -1,41 +0,0 @@ -From a530cb668134335d4e5d6595d5d5a9cb74e16428 Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Tue, 19 Jan 2021 15:01:00 +0800 -Subject: [PATCH] containerd: cleanup dangling shim by brand new context - -Upstream:https://github.com/containerd/containerd/pull/4048 - -Signed-off-by: xiadanni ---- - runtime/v1/linux/runtime.go | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 0feb587..66f959d 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -66,6 +66,9 @@ const ( - configFilename = "config.json" - defaultRuntime = "runc" - defaultShim = "containerd-shim" -+ -+ // cleanupTimeout is default timeout for cleanup operations -+ cleanupTimeout = 1 * time.Minute - ) - - func init() { -@@ -226,7 +229,10 @@ func (r *Runtime) Create(ctx context.Context, id string, opts runtime.CreateOpts - } - defer func() { - if err != nil { -- kerr := s.KillShim(ctx) -+ deferCtx, deferCancel := context.WithTimeout( -+ namespaces.WithNamespace(context.TODO(), namespace), cleanupTimeout) -+ defer deferCancel() -+ kerr := s.KillShim(deferCtx) - log.G(ctx).WithError(err).Errorf("revert: kill shim error=%v", kerr) - } - }() --- -1.8.3.1 - diff --git a/patch/0067-containerd-fix-potential-panic-for-task-in-unknown-state.patch b/patch/0067-containerd-fix-potential-panic-for-task-in-unknown-state.patch deleted file mode 100644 index 5197dca..0000000 --- a/patch/0067-containerd-fix-potential-panic-for-task-in-unknown-state.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 4c9ec5f1eece90929eb3b525c28f3713b7153d7d Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Tue, 19 Jan 2021 20:34:45 +0800 -Subject: [PATCH] containerd:fix potential panic for task in unknown state - -Upstream:https://github.com/containerd/containerd/pull/3611 - -Signed-off-by: xiadanni ---- - cio/io_unix.go | 22 ++++++++++++---------- - container.go | 13 +++++++++++-- - 2 files changed, 23 insertions(+), 12 deletions(-) - -diff --git a/cio/io_unix.go b/cio/io_unix.go -index 3ab2a30..53b6b2d 100644 ---- a/cio/io_unix.go -+++ b/cio/io_unix.go -@@ -72,17 +72,19 @@ func copyIO(fifos *FIFOSet, ioset *Streams) (*cio, error) { - } - - var wg = &sync.WaitGroup{} -- wg.Add(1) -- go func() { -- p := bufPool.Get().(*[]byte) -- defer bufPool.Put(p) -- -- io.CopyBuffer(ioset.Stdout, pipes.Stdout, *p) -- pipes.Stdout.Close() -- wg.Done() -- }() -+ if fifos.Stdout != "" { -+ wg.Add(1) -+ go func() { -+ p := bufPool.Get().(*[]byte) -+ defer bufPool.Put(p) -+ -+ io.CopyBuffer(ioset.Stdout, pipes.Stdout, *p) -+ pipes.Stdout.Close() -+ wg.Done() -+ }() -+ } - -- if !fifos.Terminal { -+ if !fifos.Terminal && fifos.Stderr != "" { - wg.Add(1) - go func() { - p := bufPool.Get().(*[]byte) -diff --git a/container.go b/container.go -index 3c09b2d..63b074a 100644 ---- a/container.go -+++ b/container.go -@@ -25,6 +25,7 @@ import ( - - "github.com/containerd/containerd/api/services/tasks/v1" - "github.com/containerd/containerd/api/types" -+ tasktypes "github.com/containerd/containerd/api/types/task" - "github.com/containerd/containerd/cio" - "github.com/containerd/containerd/containers" - "github.com/containerd/containerd/errdefs" -@@ -32,6 +33,7 @@ import ( - "github.com/containerd/typeurl" - prototypes "github.com/gogo/protobuf/types" - "github.com/pkg/errors" -+ "github.com/sirupsen/logrus" - ) - - // Container is a metadata object for container resources and task creation -@@ -284,9 +286,16 @@ func (c *container) loadTask(ctx context.Context, ioAttach cio.Attach) (Task, er - return nil, err - } - var i cio.IO -+ - if ioAttach != nil { -- if i, err = attachExistingIO(response, ioAttach); err != nil { -- return nil, err -+ if response.Process.Status == tasktypes.StatusUnknown { -+ logrus.Warnf("container %v loadTask: task get returns process status unknown", c.id) -+ } else { -+ // Do not attach IO for task in unknown state, because there -+ // are no fifo paths anyway. -+ if i, err = attachExistingIO(response, ioAttach); err != nil { -+ return nil, err -+ } - } - } - t := &task{ --- -1.8.3.1 - diff --git a/patch/0068-containerd-compile-option-compliance.patch b/patch/0068-containerd-compile-option-compliance.patch deleted file mode 100644 index 8f26e10..0000000 --- a/patch/0068-containerd-compile-option-compliance.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 0cda15b8d0241f9c15c0efe12d19877761f7b387 Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Thu, 18 Mar 2021 10:29:02 +0800 -Subject: [PATCH] containerd: compile option compliance - -Signed-off-by: xiadanni ---- - Makefile | 14 ++++++++++++-- - 1 file changed, 12 insertions(+), 2 deletions(-) - -diff --git a/Makefile b/Makefile -index f69559b..102db9f 100644 ---- a/Makefile -+++ b/Makefile -@@ -82,7 +82,7 @@ BEP_DIR=/tmp/containerd-build-bep - BEP_FLAGS=-tmpdir=/tmp/containerd-build-bep - - GO_LDFLAGS=-ldflags ' -buildid=IdByIsula -extldflags=-zrelro -extldflags=-znow $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) $(EXTRA_LDFLAGS)' --SHIM_GO_LDFLAGS=-ldflags ' -buildid=IdByIsula $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -extldflags "-static"' -+SHIM_GO_LDFLAGS=-ldflags '-extldflags=-static' -ldflags '-buildid=IdByIsula $(BEP_FLAGS) -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -linkmode=external -extldflags=-Wl,-z,relro,-z,now' - - #Replaces ":" (*nix), ";" (windows) with newline for easy parsing - GOPATHS=$(shell echo ${GOPATH} | tr ":" "\n" | tr ";" "\n") -@@ -171,11 +171,21 @@ FORCE: - bin/%: cmd/% FORCE - mkdir -p $(BEP_DIR) - @echo "$(WHALE) $@${BINARY_SUFFIX}" -+ CGO_ENABLED=1 \ -+ CGO_CFLAGS="-fstack-protector-strong -fPIE" \ -+ CGO_CPPFLAGS="-fstack-protector-strong -fPIE" \ -+ CGO_LDFLAGS_ALLOW='-Wl,-z,relro,-z,now' \ -+ CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack" \ - go build ${GO_GCFLAGS} ${GO_BUILD_FLAGS} -o $@${BINARY_SUFFIX} ${GO_LDFLAGS} ${GO_TAGS} ./$< - - bin/containerd-shim: cmd/containerd-shim FORCE # set !cgo and omit pie for a static shim build: https://github.com/golang/go/issues/17789#issuecomment-258542220 - @echo "$(WHALE) bin/containerd-shim" -- go build ${GO_BUILD_FLAGS} -o bin/containerd-shim ${SHIM_GO_LDFLAGS} ${GO_TAGS} ./cmd/containerd-shim -+ CGO_ENABLED=1 \ -+ CGO_CFLAGS="-fstack-protector-strong -fPIE" \ -+ CGO_CPPFLAGS="-fstack-protector-strong -fPIE" \ -+ CGO_LDFLAGS_ALLOW='-Wl,-z,relro,-z,now' \ -+ CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack" \ -+ go build -buildmode=pie ${GO_BUILD_FLAGS} -o bin/containerd-shim ${SHIM_GO_LDFLAGS} ${GO_TAGS} ./cmd/containerd-shim - - bin/containerd-shim-runc-v1: cmd/containerd-shim-runc-v1 FORCE # set !cgo and omit pie for a static shim build: https://github.com/golang/go/issues/17789#issuecomment-258542220 - @echo "$(WHALE) bin/containerd-shim-runc-v1" --- -1.8.3.1 - diff --git a/patch/0069-containerd-add-check-in-spec.patch b/patch/0069-containerd-add-check-in-spec.patch deleted file mode 100644 index 2e96fe0..0000000 --- a/patch/0069-containerd-add-check-in-spec.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 27be5a04fc8b28e14ff296f5b9356ace8feb39ce Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Thu, 18 Feb 2021 20:28:52 +0800 -Subject: [PATCH] containerd: add check in spec - -Change-Id: I8ddf63ec1c4da479e90838678136237b5822d463 -Signed-off-by: xiadanni ---- - Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index 96c2370..511b6f2 100644 ---- a/Makefile -+++ b/Makefile -@@ -151,7 +151,7 @@ build: ## build the go packages - - test: ## run tests, except integration tests and tests that require root - @echo "$(WHALE) $@" -- @go test ${TESTFLAGS} $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES}) -+ @go test ${TESTFLAGS} ./gc - - root-test: ## run tests, except integration tests - @echo "$(WHALE) $@" --- -1.8.3.1 - diff --git a/patch/0070-containerd-kill-container-init-process-if-runc-start.patch b/patch/0070-containerd-kill-container-init-process-if-runc-start.patch deleted file mode 100644 index 5418555..0000000 --- a/patch/0070-containerd-kill-container-init-process-if-runc-start.patch +++ /dev/null @@ -1,105 +0,0 @@ -From 52d42e0b850cde3600028b00e19f5325a61ddad3 Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Mon, 1 Feb 2021 19:36:53 +0800 -Subject: [PATCH] containerd: kill container init process if runc start returns - error - -Signed-off-by: xiadanni ---- - runtime/v1/linux/proc/init.go | 4 +++ - utils/utils.go | 61 +++++++++++++++++++++++++++++++++++++++++++ - 2 files changed, 65 insertions(+) - create mode 100644 utils/utils.go - -diff --git a/runtime/v1/linux/proc/init.go b/runtime/v1/linux/proc/init.go -index de76682..669c108 100644 ---- a/runtime/v1/linux/proc/init.go -+++ b/runtime/v1/linux/proc/init.go -@@ -35,6 +35,7 @@ import ( - "github.com/containerd/containerd/log" - "github.com/containerd/containerd/mount" - "github.com/containerd/containerd/runtime/proc" -+ "github.com/containerd/containerd/utils" - "github.com/containerd/fifo" - runc "github.com/containerd/go-runc" - google_protobuf "github.com/gogo/protobuf/types" -@@ -277,6 +278,9 @@ func (p *Init) Status(ctx context.Context) (string, error) { - - func (p *Init) start(context context.Context) error { - err := p.runtime.Start(context, p.id) -+ if err != nil { -+ utils.KillInitProcess(p.id, p.pid) -+ } - return p.runtimeError(err, "OCI runtime start failed") - } - -diff --git a/utils/utils.go b/utils/utils.go -new file mode 100644 -index 0000000..c57c6ca ---- /dev/null -+++ b/utils/utils.go -@@ -0,0 +1,61 @@ -+/* -+Copyright (c) Huawei Technologies Co., Ltd. 2021. All rights reserved. -+Use of this source code is governed by Apache-2.0 -+license that can be found in the LICENSE file. -+Description: common functions -+Author: Danni Xia -+Create: 2021-01-30 -+*/ -+ -+package utils -+ -+import ( -+ "encoding/json" -+ "io/ioutil" -+ "path/filepath" -+ "strconv" -+ "strings" -+ "syscall" -+ -+ "github.com/sirupsen/logrus" -+) -+ -+type baseState struct { -+ InitProcessStartTime string `json:"init_process_start"` -+} -+ -+func KillInitProcess(cid string, pid int) { -+ if IsInitProcess(cid, pid) { -+ syscall.Kill(pid, syscall.SIGKILL) -+ } -+} -+ -+func IsInitProcess(cid string, pid int) bool { -+ stateBytes, err1 := ioutil.ReadFile(filepath.Join("/var/run/docker/runtime-runc/moby", cid, "state.json")) -+ statBytes, err2 := ioutil.ReadFile(filepath.Join("/proc", strconv.Itoa(pid), "stat")) -+ if err1 != nil || err2 != nil { -+ return true -+ } -+ -+ s := strings.Split(string(statBytes), ")") -+ if len(s) < 1 { -+ return true -+ } -+ -+ statFields := strings.Split(strings.TrimSpace(s[len(s)-1]), " ") -+ if len(statFields) < 20 { -+ return true -+ } -+ -+ var baseState baseState -+ if err := json.Unmarshal(stateBytes, &baseState); err != nil { -+ return true -+ } -+ -+ if baseState.InitProcessStartTime == statFields[19] { -+ return true -+ } -+ -+ logrus.Warnf("process(pid:%d, start time:%s) is not container %s init process", pid, statFields[19], cid) -+ return false -+} --- -1.8.3.1 - diff --git a/patch/0071-containerd-fix-containerd-shim-residual-when-kill-co.patch b/patch/0071-containerd-fix-containerd-shim-residual-when-kill-co.patch deleted file mode 100644 index c6c4b6c..0000000 --- a/patch/0071-containerd-fix-containerd-shim-residual-when-kill-co.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 5d72fe2c0d6774e94cad6feacec87db703104fe7 Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Fri, 19 Feb 2021 16:37:48 +0800 -Subject: [PATCH] containerd: fix containerd-shim residual when kill containerd - during starting container - -after shim process started, containerd will write shim socket address -to address file, but if containerd is killed before write file, new -containerd process could not get shim socket address, and will not -kill it even if that shim could not work. -so we write address file ahead of starting shim process. - -Signed-off-by: xiadanni ---- - runtime/v1/shim/client/client.go | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/runtime/v1/shim/client/client.go b/runtime/v1/shim/client/client.go -index 9e63af4..bc9ac92 100644 ---- a/runtime/v1/shim/client/client.go -+++ b/runtime/v1/shim/client/client.go -@@ -92,6 +92,10 @@ func WithStart(binary, address, daemonAddress, cgroup string, debug bool, exitHa - go io.Copy(os.Stderr, stderrLog) - } - -+ if err := writeFile(filepath.Join(config.Path, "address"), address); err != nil { -+ return nil, nil, err -+ } -+ - cmd, err := newCommand(binary, daemonAddress, debug, config, f, stdoutLog, stderrLog) - if err != nil { - return nil, nil, err -@@ -122,9 +126,6 @@ func WithStart(binary, address, daemonAddress, cgroup string, debug bool, exitHa - "debug": debug, - }).Infof("shim %s started", binary) - -- if err := writeFile(filepath.Join(config.Path, "address"), address); err != nil { -- return nil, nil, err -- } - if err := writeFile(filepath.Join(config.Path, "shim.pid"), strconv.Itoa(cmd.Process.Pid)); err != nil { - return nil, nil, err - } --- -1.8.3.1 - diff --git a/patch/0072-containerd-fix-deadlock-on-commit-error.patch b/patch/0072-containerd-fix-deadlock-on-commit-error.patch deleted file mode 100644 index 4dbb496..0000000 --- a/patch/0072-containerd-fix-deadlock-on-commit-error.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 39183d7937d408afceb9456972ad3e42beb336c6 Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Sat, 27 Feb 2021 11:19:22 +0800 -Subject: [PATCH] containerd:fix deadlock on commit error - -upstream:https://github.com/containerd/containerd/commit/5b9bd993a87008e06a34258f0672a78564adab13 -Signed-off-by: xiadanni ---- - content/local/writer.go | 5 +++-- - diff/walking/differ.go | 5 +++-- - 2 files changed, 6 insertions(+), 4 deletions(-) - -diff --git a/content/local/writer.go b/content/local/writer.go -index 223b145..3a94744 100644 ---- a/content/local/writer.go -+++ b/content/local/writer.go -@@ -74,6 +74,9 @@ func (w *writer) Write(p []byte) (n int, err error) { - } - - func (w *writer) Commit(ctx context.Context, size int64, expected digest.Digest, opts ...content.Opt) error { -+ // Ensure even on error the writer is fully closed -+ defer unlock(w.ref) -+ - var base content.Info - for _, opt := range opts { - if err := opt(&base); err != nil { -@@ -81,8 +84,6 @@ func (w *writer) Commit(ctx context.Context, size int64, expected digest.Digest, - } - } - -- // Ensure even on error the writer is fully closed -- defer unlock(w.ref) - fp := w.fp - w.fp = nil - -diff --git a/diff/walking/differ.go b/diff/walking/differ.go -index a45a563..1c82860 100644 ---- a/diff/walking/differ.go -+++ b/diff/walking/differ.go -@@ -106,14 +106,15 @@ func (s *walkingDiff) Compare(ctx context.Context, lower, upper []mount.Mount, o - } - }() - if !newReference { -- if err := cw.Truncate(0); err != nil { -+ if err = cw.Truncate(0); err != nil { - return err - } - } - - if isCompressed { - dgstr := digest.SHA256.Digester() -- compressed, err := compression.CompressStream(cw, compression.Gzip) -+ var compressed io.WriteCloser -+ compressed, err = compression.CompressStream(cw, compression.Gzip) - if err != nil { - return errors.Wrap(err, "failed to get compressed stream") - } --- -1.8.3.1 - diff --git a/patch/0073-containerd-backport-upstream-patches.patch b/patch/0073-containerd-backport-upstream-patches.patch deleted file mode 100644 index 9bc3a8d..0000000 --- a/patch/0073-containerd-backport-upstream-patches.patch +++ /dev/null @@ -1,1212 +0,0 @@ -From 470a207ed468b5473d7833987791f01b467141a3 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Fri, 5 Feb 2021 15:10:27 +0800 -Subject: [PATCH] containerd: backport upstream patches - -2019-11-27 15:29:44 -0800 b97098762 Fix container pid. Lantao Liu lantaol@google.com -2019-06-21 15:28:16 -0400 f71f6d39b Robust pid locking for shim processes Michael Crosby crosbymichael.. -2019-06-20 16:13:51 -0400 42aba6e0f Add timeout for I/O waitgroups Michael Crosby crosbymichael.. -2019-02-01 02:08:49 -0800 5730c5003 Add a separate lock for pid. Lantao Liu lantaol@google.com -2019-01-31 18:59:29 -0800 b9b7ef32b Revert "use state machine management for exec.Pid()" Lantao Liu lantaol@google.com -2019-01-22 16:19:09 -0800 ab2cf0136 Use context.Background for `O_NONBLOCK` `OpenFifo`. Lantao Liu lantaol@google.com -2018-11-23 17:46:32 +0800 c42c8952b use state machine management for exec.Pid() Lifubang lifubang@acmcoder.com -2018-11-09 11:12:55 -0500 4c72befe0 Fix process locking and state management Michael Crosby crosbymichael.. - -Conflict:NA -Reference:https://github.com/containerd/containerd/pull/3755 - -Change-Id: Ic7f768e72a38383c1b89680333c9ee234ea217aa -Signed-off-by: jingrui ---- - runtime/proc/proc.go | 5 - - runtime/v1/linux/proc/exec.go | 77 +++++++++--- - runtime/v1/linux/proc/exec_state.go | 59 +++------ - runtime/v1/linux/proc/init.go | 155 +++++++++++++++++------ - runtime/v1/linux/proc/init_state.go | 182 +++++----------------------- - runtime/v1/linux/proc/io.go | 2 +- - runtime/v1/linux/proc/utils.go | 12 ++ - runtime/v2/runc/service_linux.go | 2 +- - runtime/v2/shim_unix.go | 2 +- - 9 files changed, 235 insertions(+), 261 deletions(-) - -diff --git a/runtime/proc/proc.go b/runtime/proc/proc.go -index 02bc9bda8..91ca59bb1 100644 ---- a/runtime/proc/proc.go -+++ b/runtime/proc/proc.go -@@ -40,7 +40,6 @@ func (s Stdio) IsNull() bool { - - // Process on a system - type Process interface { -- State - // ID returns the id for the process - ID() string - // Pid returns the pid for the process -@@ -57,10 +56,6 @@ type Process interface { - Status(context.Context) (string, error) - // Wait blocks until the process has exited - Wait() --} -- --// State of a process --type State interface { - // Resize resizes the process console - Resize(ws console.WinSize) error - // Start execution of the process -diff --git a/runtime/v1/linux/proc/exec.go b/runtime/v1/linux/proc/exec.go -index 08c581fbf..ea40cb5b8 100644 ---- a/runtime/v1/linux/proc/exec.go -+++ b/runtime/v1/linux/proc/exec.go -@@ -31,6 +31,7 @@ import ( - "golang.org/x/sys/unix" - - "github.com/containerd/console" -+ "github.com/containerd/containerd/errdefs" - "github.com/containerd/containerd/runtime/proc" - "github.com/containerd/fifo" - runc "github.com/containerd/go-runc" -@@ -41,7 +42,7 @@ import ( - type execProcess struct { - wg sync.WaitGroup - -- proc.State -+ execState execState - - mu sync.Mutex - id string -@@ -49,7 +50,7 @@ type execProcess struct { - io runc.IO - status int - exited time.Time -- pid int -+ pid safePid - closers []io.Closer - stdin io.Closer - stdio proc.Stdio -@@ -69,9 +70,7 @@ func (e *execProcess) ID() string { - } - - func (e *execProcess) Pid() int { -- e.mu.Lock() -- defer e.mu.Unlock() -- return e.pid -+ return e.pid.get() - } - - func (e *execProcess) ExitStatus() int { -@@ -86,6 +85,13 @@ func (e *execProcess) ExitedAt() time.Time { - return e.exited - } - -+func (e *execProcess) SetExited(status int) { -+ e.mu.Lock() -+ defer e.mu.Unlock() -+ -+ e.execState.SetExited(status) -+} -+ - func (e *execProcess) setExited(status int) { - e.status = status - e.exited = time.Now() -@@ -93,6 +99,13 @@ func (e *execProcess) setExited(status int) { - close(e.waitBlock) - } - -+func (e *execProcess) Delete(ctx context.Context) error { -+ e.mu.Lock() -+ defer e.mu.Unlock() -+ -+ return e.execState.Delete(ctx) -+} -+ - func (e *execProcess) delete(ctx context.Context) error { - waitTimeout(ctx, &e.wg, 2*time.Second) - if e.io != nil { -@@ -107,6 +120,13 @@ func (e *execProcess) delete(ctx context.Context) error { - return nil - } - -+func (e *execProcess) Resize(ws console.WinSize) error { -+ e.mu.Lock() -+ defer e.mu.Unlock() -+ -+ return e.execState.Resize(ws) -+} -+ - func (e *execProcess) resize(ws console.WinSize) error { - if e.console == nil { - return nil -@@ -114,9 +134,21 @@ func (e *execProcess) resize(ws console.WinSize) error { - return e.console.Resize(ws) - } - -+func (e *execProcess) Kill(ctx context.Context, sig uint32, _ bool) error { -+ e.mu.Lock() -+ defer e.mu.Unlock() -+ -+ return e.execState.Kill(ctx, sig, false) -+} -+ - func (e *execProcess) kill(ctx context.Context, sig uint32, _ bool) error { -- pid := e.pid -- if pid != 0 { -+ pid := e.pid.get() -+ switch { -+ case pid == 0: -+ return errors.Wrap(errdefs.ErrFailedPrecondition, "process not created") -+ case !e.exited.IsZero(): -+ return errors.Wrapf(errdefs.ErrNotFound, "process already finished") -+ default: - if err := unix.Kill(pid, syscall.Signal(sig)); err != nil { - return errors.Wrapf(checkKillError(err), "exec kill error") - } -@@ -132,7 +164,20 @@ func (e *execProcess) Stdio() proc.Stdio { - return e.stdio - } - -+func (e *execProcess) Start(ctx context.Context) error { -+ e.mu.Lock() -+ defer e.mu.Unlock() -+ -+ return e.execState.Start(ctx) -+} -+ - func (e *execProcess) start(ctx context.Context) (err error) { -+ // The reaper may receive exit signal right after -+ // the container is started, before the e.pid is updated. -+ // In that case, we want to block the signal handler to -+ // access e.pid until it is updated. -+ e.pid.Lock() -+ defer e.pid.Unlock() - var ( - socket *runc.Socket - pidfile = filepath.Join(e.path, fmt.Sprintf("%s.pid", e.id)) -@@ -164,7 +209,7 @@ func (e *execProcess) start(ctx context.Context) (err error) { - return e.parent.runtimeError(err, "OCI runtime exec failed") - } - if e.stdio.Stdin != "" { -- sc, err := fifo.OpenFifo(ctx, e.stdio.Stdin, syscall.O_WRONLY|syscall.O_NONBLOCK, 0) -+ sc, err := fifo.OpenFifo(context.Background(), e.stdio.Stdin, syscall.O_WRONLY|syscall.O_NONBLOCK, 0) - if err != nil { - return errors.Wrapf(err, "failed to open stdin fifo %s", e.stdio.Stdin) - } -@@ -173,29 +218,26 @@ func (e *execProcess) start(ctx context.Context) (err error) { - } - var copyWaitGroup sync.WaitGroup - ctx, cancel := context.WithTimeout(ctx, 30*time.Second) -+ defer cancel() - if socket != nil { - console, err := socket.ReceiveMaster() - if err != nil { -- cancel() - return errors.Wrap(err, "failed to retrieve console master") - } - if e.console, err = e.parent.Platform.CopyConsole(ctx, console, e.stdio.Stdin, e.stdio.Stdout, e.stdio.Stderr, &e.wg, ©WaitGroup); err != nil { -- cancel() - return errors.Wrap(err, "failed to start console copy") - } - } else if !e.stdio.IsNull() { - if err := copyPipes(ctx, e.io, e.stdio.Stdin, e.stdio.Stdout, e.stdio.Stderr, &e.wg, ©WaitGroup); err != nil { -- cancel() - return errors.Wrap(err, "failed to start io pipe copy") - } - } - copyWaitGroup.Wait() - pid, err := runc.ReadPidFile(opts.PidFile) - if err != nil { -- cancel() - return errors.Wrap(err, "failed to retrieve OCI runtime exec pid") - } -- e.pid = pid -+ e.pid.pid = pid - return nil - } - -@@ -212,12 +254,15 @@ func (e *execProcess) Status(ctx context.Context) (string, error) { - } - e.mu.Lock() - defer e.mu.Unlock() -- // if we don't have a pid then the exec process has just been created -- if e.pid == 0 { -+ // if we don't have a pid(pid=0) then the exec process has just been created -+ if e.pid.get() == 0 { - return "created", nil - } -+ if e.pid.get() == -1 { -+ return "stopped", nil -+ } - // if we have a pid and it can be signaled, the process is running -- if err := unix.Kill(e.pid, 0); err == nil { -+ if err := unix.Kill(e.pid.get(), 0); err == nil { - return "running", nil - } - // else if we have a pid but it can nolonger be signaled, it has stopped -diff --git a/runtime/v1/linux/proc/exec_state.go b/runtime/v1/linux/proc/exec_state.go -index ac5467552..12489501b 100644 ---- a/runtime/v1/linux/proc/exec_state.go -+++ b/runtime/v1/linux/proc/exec_state.go -@@ -25,6 +25,14 @@ import ( - "github.com/pkg/errors" - ) - -+type execState interface { -+ Resize(console.WinSize) error -+ Start(context.Context) error -+ Delete(context.Context) error -+ Kill(context.Context, uint32, bool) error -+ SetExited(int) -+} -+ - type execCreatedState struct { - p *execProcess - } -@@ -32,11 +40,11 @@ type execCreatedState struct { - func (s *execCreatedState) transition(name string) error { - switch name { - case "running": -- s.p.State = &execRunningState{p: s.p} -+ s.p.execState = &execRunningState{p: s.p} - case "stopped": -- s.p.State = &execStoppedState{p: s.p} -+ s.p.execState = &execStoppedState{p: s.p} - case "deleted": -- s.p.State = &deletedState{} -+ s.p.execState = &deletedState{} - default: - return errors.Errorf("invalid state transition %q to %q", stateName(s), name) - } -@@ -44,15 +52,10 @@ func (s *execCreatedState) transition(name string) error { - } - - func (s *execCreatedState) Resize(ws console.WinSize) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.resize(ws) - } - - func (s *execCreatedState) Start(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() - if err := s.p.start(ctx); err != nil { - return err - } -@@ -63,22 +66,15 @@ func (s *execCreatedState) Delete(ctx context.Context) error { - if err := s.p.delete(ctx); err != nil { - return err - } -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -+ - return s.transition("deleted") - } - - func (s *execCreatedState) Kill(ctx context.Context, sig uint32, all bool) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.kill(ctx, sig, all) - } - - func (s *execCreatedState) SetExited(status int) { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - s.p.setExited(status) - - if err := s.transition("stopped"); err != nil { -@@ -93,7 +89,7 @@ type execRunningState struct { - func (s *execRunningState) transition(name string) error { - switch name { - case "stopped": -- s.p.State = &execStoppedState{p: s.p} -+ s.p.execState = &execStoppedState{p: s.p} - default: - return errors.Errorf("invalid state transition %q to %q", stateName(s), name) - } -@@ -101,37 +97,22 @@ func (s *execRunningState) transition(name string) error { - } - - func (s *execRunningState) Resize(ws console.WinSize) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.resize(ws) - } - - func (s *execRunningState) Start(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot start a running process") - } - - func (s *execRunningState) Delete(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot delete a running process") - } - - func (s *execRunningState) Kill(ctx context.Context, sig uint32, all bool) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.kill(ctx, sig, all) - } - - func (s *execRunningState) SetExited(status int) { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - s.p.setExited(status) - - if err := s.transition("stopped"); err != nil { -@@ -146,7 +127,7 @@ type execStoppedState struct { - func (s *execStoppedState) transition(name string) error { - switch name { - case "deleted": -- s.p.State = &deletedState{} -+ s.p.execState = &deletedState{} - default: - return errors.Errorf("invalid state transition %q to %q", stateName(s), name) - } -@@ -154,16 +135,10 @@ func (s *execStoppedState) transition(name string) error { - } - - func (s *execStoppedState) Resize(ws console.WinSize) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot resize a stopped container") - } - - func (s *execStoppedState) Start(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot start a stopped process") - } - -@@ -171,15 +146,11 @@ func (s *execStoppedState) Delete(ctx context.Context) error { - if err := s.p.delete(ctx); err != nil { - return err - } -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -+ - return s.transition("deleted") - } - - func (s *execStoppedState) Kill(ctx context.Context, sig uint32, all bool) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.kill(ctx, sig, all) - } - -diff --git a/runtime/v1/linux/proc/init.go b/runtime/v1/linux/proc/init.go -index 669c1085d..108234904 100644 ---- a/runtime/v1/linux/proc/init.go -+++ b/runtime/v1/linux/proc/init.go -@@ -52,8 +52,8 @@ const DefaultRunvRoot = "/run/runv" - - // Init represents an initial process for a container - type Init struct { -- wg sync.WaitGroup -- initState -+ wg sync.WaitGroup -+ initState initState - - // mu is used to ensure that `Start()` and `Exited()` calls return in - // the right order when invoked in separate go routines. -@@ -65,12 +65,12 @@ type Init struct { - - WorkDir string - -- id string -- Bundle string -- console console.Console -- Platform proc.Platform -- io runc.IO -- runtime *runc.Runc -+ id string -+ Bundle string -+ console console.Console -+ Platform proc.Platform -+ io runc.IO -+ runtime *runc.Runc - status int - exited time.Time - pid int -@@ -138,6 +138,7 @@ func (p *Init) Create(ctx context.Context, r *CreateConfig) error { - err error - socket *runc.Socket - ) -+ - pidFile := filepath.Join(p.Bundle, InitPidFile) - - if legacy.IsLegacy(r.ID) { -@@ -195,7 +196,7 @@ func (p *Init) Create(ctx context.Context, r *CreateConfig) error { - return p.runtimeError(err, "OCI runtime create failed") - } - if r.Stdin != "" { -- sc, err := fifo.OpenFifo(ctx, r.Stdin, syscall.O_WRONLY|syscall.O_NONBLOCK, 0) -+ sc, err := fifo.OpenFifo(context.Background(), r.Stdin, syscall.O_WRONLY|syscall.O_NONBLOCK, 0) - if err != nil { - return errors.Wrapf(err, "failed to open stdin fifo %s", r.Stdin) - } -@@ -204,21 +205,19 @@ func (p *Init) Create(ctx context.Context, r *CreateConfig) error { - } - var copyWaitGroup sync.WaitGroup - ctx, cancel := context.WithTimeout(ctx, 30*time.Second) -+ defer cancel() - if socket != nil { - console, err := socket.ReceiveMaster() - if err != nil { -- cancel() - return errors.Wrap(err, "failed to retrieve console master") - } - console, err = p.Platform.CopyConsole(ctx, console, r.Stdin, r.Stdout, r.Stderr, &p.wg, ©WaitGroup) - if err != nil { -- cancel() - return errors.Wrap(err, "failed to start console copy") - } - p.console = console - } else if !hasNoIO(r) { - if err := copyPipes(ctx, p.io, r.Stdin, r.Stdout, r.Stderr, &p.wg, ©WaitGroup); err != nil { -- cancel() - return errors.Wrap(err, "failed to start io pipe copy") - } - } -@@ -226,7 +225,6 @@ func (p *Init) Create(ctx context.Context, r *CreateConfig) error { - copyWaitGroup.Wait() - pid, err := runc.ReadPidFile(pidFile) - if err != nil { -- cancel() - return errors.Wrap(err, "failed to retrieve OCI runtime container pid") - } - p.pid = pid -@@ -266,6 +264,7 @@ func (p *Init) ExitedAt() time.Time { - func (p *Init) Status(ctx context.Context) (string, error) { - p.mu.Lock() - defer p.mu.Unlock() -+ - c, err := p.runtime.State(ctx, p.id) - if err != nil { - if strings.Contains(err.Error(), "does not exist") { -@@ -276,14 +275,30 @@ func (p *Init) Status(ctx context.Context) (string, error) { - return c.Status, nil - } - --func (p *Init) start(context context.Context) error { -- err := p.runtime.Start(context, p.id) -+// Start the init process -+func (p *Init) Start(ctx context.Context) error { -+ p.mu.Lock() -+ defer p.mu.Unlock() -+ -+ return p.initState.Start(ctx) -+} -+ -+func (p *Init) start(ctx context.Context) error { -+ err := p.runtime.Start(ctx, p.id) - if err != nil { - utils.KillInitProcess(p.id, p.pid) - } - return p.runtimeError(err, "OCI runtime start failed") - } - -+// SetExited of the init process with the next status -+func (p *Init) SetExited(status int) { -+ p.mu.Lock() -+ defer p.mu.Unlock() -+ -+ p.initState.SetExited(status) -+} -+ - func (p *Init) setExited(status int) { - p.exited = time.Now() - p.status = status -@@ -291,9 +306,17 @@ func (p *Init) setExited(status int) { - close(p.waitBlock) - } - --func (p *Init) delete(context context.Context) error { -- waitTimeout(context, &p.wg, 2*time.Second) -- err := p.runtime.Delete(context, p.id, nil) -+// Delete the init process -+func (p *Init) Delete(ctx context.Context) error { -+ p.mu.Lock() -+ defer p.mu.Unlock() -+ -+ return p.initState.Delete(ctx) -+} -+ -+func (p *Init) delete(ctx context.Context) error { -+ waitTimeout(ctx, &p.wg, 2*time.Second) -+ err := p.runtime.Delete(ctx, p.id, nil) - // ignore errors if a runtime has already deleted the process - // but we still hold metadata and pipes - // -@@ -312,15 +335,28 @@ func (p *Init) delete(context context.Context) error { - } - p.io.Close() - } -- if err2 := mount.UnmountAll(p.Rootfs, 0); err2 != nil { -- log.G(context).WithError(err2).Warn("failed to cleanup rootfs mount") -- if err == nil { -- err = errors.Wrap(err2, "failed rootfs umount") -+ if p.Rootfs != "" { -+ if err2 := mount.UnmountAll(p.Rootfs, 0); err2 != nil { -+ log.G(ctx).WithError(err2).Warn("failed to cleanup rootfs mount") -+ if err == nil { -+ err = errors.Wrap(err2, "failed rootfs umount") -+ } - } - } - return err - } - -+// Resize the init processes console -+func (p *Init) Resize(ws console.WinSize) error { -+ p.mu.Lock() -+ defer p.mu.Unlock() -+ -+ if p.console == nil { -+ return nil -+ } -+ return p.console.Resize(ws) -+} -+ - func (p *Init) resize(ws console.WinSize) error { - if p.console == nil { - return nil -@@ -328,26 +364,43 @@ func (p *Init) resize(ws console.WinSize) error { - return p.console.Resize(ws) - } - --func (p *Init) pause(context context.Context) error { -- err := p.runtime.Pause(context, p.id) -- return p.runtimeError(err, "OCI runtime pause failed") -+// Pause the init process and all its child processes -+func (p *Init) Pause(ctx context.Context) error { -+ p.mu.Lock() -+ defer p.mu.Unlock() -+ -+ return p.initState.Pause(ctx) -+} -+ -+// Resume the init process and all its child processes -+func (p *Init) Resume(ctx context.Context) error { -+ p.mu.Lock() -+ defer p.mu.Unlock() -+ -+ return p.initState.Resume(ctx) - } - --func (p *Init) resume(context context.Context) error { -- err := p.runtime.Resume(context, p.id) -- return p.runtimeError(err, "OCI runtime resume failed") -+// Kill the init process -+func (p *Init) Kill(ctx context.Context, signal uint32, all bool) error { -+ p.mu.Lock() -+ defer p.mu.Unlock() -+ -+ return p.initState.Kill(ctx, signal, all) - } - --func (p *Init) kill(context context.Context, signal uint32, all bool) error { -- err := p.runtime.Kill(context, p.id, int(signal), &runc.KillOpts{ -+func (p *Init) kill(ctx context.Context, signal uint32, all bool) error { -+ err := p.runtime.Kill(ctx, p.id, int(signal), &runc.KillOpts{ - All: all, - }) - return checkKillError(err) - } - - // KillAll processes belonging to the init process --func (p *Init) KillAll(context context.Context) error { -- err := p.runtime.Kill(context, p.id, int(syscall.SIGKILL), &runc.KillOpts{ -+func (p *Init) KillAll(ctx context.Context) error { -+ p.mu.Lock() -+ defer p.mu.Unlock() -+ -+ err := p.runtime.Kill(ctx, p.id, int(syscall.SIGKILL), &runc.KillOpts{ - All: true, - }) - return p.runtimeError(err, "OCI runtime killall failed") -@@ -363,8 +416,16 @@ func (p *Init) Runtime() *runc.Runc { - return p.runtime - } - -+// Exec returns a new child process -+func (p *Init) Exec(ctx context.Context, path string, r *ExecConfig) (proc.Process, error) { -+ p.mu.Lock() -+ defer p.mu.Unlock() -+ -+ return p.initState.Exec(ctx, path, r) -+} -+ - // exec returns a new exec'd process --func (p *Init) exec(context context.Context, path string, r *ExecConfig) (proc.Process, error) { -+func (p *Init) exec(ctx context.Context, path string, r *ExecConfig) (proc.Process, error) { - // process exec request - var spec specs.Process - if err := json.Unmarshal(r.Spec.Value, &spec); err != nil { -@@ -385,18 +446,26 @@ func (p *Init) exec(context context.Context, path string, r *ExecConfig) (proc.P - }, - waitBlock: make(chan struct{}), - } -- e.State = &execCreatedState{p: e} -+ e.execState = &execCreatedState{p: e} - return e, nil - } - --func (p *Init) checkpoint(context context.Context, r *CheckpointConfig) error { -+// Checkpoint the init process -+func (p *Init) Checkpoint(ctx context.Context, r *CheckpointConfig) error { -+ p.mu.Lock() -+ defer p.mu.Unlock() -+ -+ return p.initState.Checkpoint(ctx, r) -+} -+ -+func (p *Init) checkpoint(ctx context.Context, r *CheckpointConfig) error { - var actions []runc.CheckpointAction - if !r.Exit { - actions = append(actions, runc.LeaveRunning) - } - work := filepath.Join(p.WorkDir, "criu-work") - defer os.RemoveAll(work) -- if err := p.runtime.Checkpoint(context, p.id, &runc.CheckpointOpts{ -+ if err := p.runtime.Checkpoint(ctx, p.id, &runc.CheckpointOpts{ - WorkDir: work, - ImagePath: r.Path, - AllowOpenTCP: r.AllowOpenTCP, -@@ -407,19 +476,27 @@ func (p *Init) checkpoint(context context.Context, r *CheckpointConfig) error { - }, actions...); err != nil { - dumpLog := filepath.Join(p.Bundle, "criu-dump.log") - if cerr := copyFile(dumpLog, filepath.Join(work, "dump.log")); cerr != nil { -- log.G(context).Error(err) -+ log.G(ctx).Error(err) - } - return fmt.Errorf("%s path= %s", criuError(err), dumpLog) - } - return nil - } - --func (p *Init) update(context context.Context, r *google_protobuf.Any) error { -+// Update the processes resource configuration -+func (p *Init) Update(ctx context.Context, r *google_protobuf.Any) error { -+ p.mu.Lock() -+ defer p.mu.Unlock() -+ -+ return p.initState.Update(ctx, r) -+} -+ -+func (p *Init) update(ctx context.Context, r *google_protobuf.Any) error { - var resources specs.LinuxResources - if err := json.Unmarshal(r.Value, &resources); err != nil { - return err - } -- return p.runtime.Update(context, p.id, &resources) -+ return p.runtime.Update(ctx, p.id, &resources) - } - - // Stdio of the process -diff --git a/runtime/v1/linux/proc/init_state.go b/runtime/v1/linux/proc/init_state.go -index 6a6b448d3..e83934e9c 100644 ---- a/runtime/v1/linux/proc/init_state.go -+++ b/runtime/v1/linux/proc/init_state.go -@@ -30,16 +30,20 @@ import ( - runc "github.com/containerd/go-runc" - google_protobuf "github.com/gogo/protobuf/types" - "github.com/pkg/errors" -+ "github.com/sirupsen/logrus" - ) - - type initState interface { -- proc.State -- -+ Resize(console.WinSize) error -+ Start(context.Context) error -+ Delete(context.Context) error - Pause(context.Context) error - Resume(context.Context) error - Update(context.Context, *google_protobuf.Any) error - Checkpoint(context.Context, *CheckpointConfig) error - Exec(context.Context, string, *ExecConfig) (proc.Process, error) -+ Kill(context.Context, uint32, bool) error -+ SetExited(int) - } - - type createdState struct { -@@ -61,43 +65,26 @@ func (s *createdState) transition(name string) error { - } - - func (s *createdState) Pause(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot pause task in created state") - } - - func (s *createdState) Resume(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot resume task in created state") - } - --func (s *createdState) Update(context context.Context, r *google_protobuf.Any) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- -- return s.p.update(context, r) -+func (s *createdState) Update(ctx context.Context, r *google_protobuf.Any) error { -+ return s.p.update(ctx, r) - } - --func (s *createdState) Checkpoint(context context.Context, r *CheckpointConfig) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- -+func (s *createdState) Checkpoint(ctx context.Context, r *CheckpointConfig) error { - return errors.Errorf("cannot checkpoint a task in created state") - } - - func (s *createdState) Resize(ws console.WinSize) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.resize(ws) - } - - func (s *createdState) Start(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() - if err := s.p.start(ctx); err != nil { - return err - } -@@ -105,8 +92,6 @@ func (s *createdState) Start(ctx context.Context) error { - } - - func (s *createdState) Delete(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() - if err := s.p.delete(ctx); err != nil { - return err - } -@@ -114,16 +99,10 @@ func (s *createdState) Delete(ctx context.Context) error { - } - - func (s *createdState) Kill(ctx context.Context, sig uint32, all bool) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.kill(ctx, sig, all) - } - - func (s *createdState) SetExited(status int) { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - s.p.setExited(status) - - if err := s.transition("stopped"); err != nil { -@@ -132,8 +111,6 @@ func (s *createdState) SetExited(status int) { - } - - func (s *createdState) Exec(ctx context.Context, path string, r *ExecConfig) (proc.Process, error) { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() - return s.p.exec(ctx, path, r) - } - -@@ -157,43 +134,26 @@ func (s *createdCheckpointState) transition(name string) error { - } - - func (s *createdCheckpointState) Pause(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot pause task in created state") - } - - func (s *createdCheckpointState) Resume(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot resume task in created state") - } - --func (s *createdCheckpointState) Update(context context.Context, r *google_protobuf.Any) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- -- return s.p.update(context, r) -+func (s *createdCheckpointState) Update(ctx context.Context, r *google_protobuf.Any) error { -+ return s.p.update(ctx, r) - } - --func (s *createdCheckpointState) Checkpoint(context context.Context, r *CheckpointConfig) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- -+func (s *createdCheckpointState) Checkpoint(ctx context.Context, r *CheckpointConfig) error { - return errors.Errorf("cannot checkpoint a task in created state") - } - - func (s *createdCheckpointState) Resize(ws console.WinSize) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.resize(ws) - } - - func (s *createdCheckpointState) Start(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() - p := s.p - sio := p.stdio - -@@ -213,7 +173,7 @@ func (s *createdCheckpointState) Start(ctx context.Context) error { - return p.runtimeError(err, "OCI runtime restore failed") - } - if sio.Stdin != "" { -- sc, err := fifo.OpenFifo(ctx, sio.Stdin, syscall.O_WRONLY|syscall.O_NONBLOCK, 0) -+ sc, err := fifo.OpenFifo(context.Background(), sio.Stdin, syscall.O_WRONLY|syscall.O_NONBLOCK, 0) - if err != nil { - return errors.Wrapf(err, "failed to open stdin fifo %s", sio.Stdin) - } -@@ -247,8 +207,6 @@ func (s *createdCheckpointState) Start(ctx context.Context) error { - } - - func (s *createdCheckpointState) Delete(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() - if err := s.p.delete(ctx); err != nil { - return err - } -@@ -256,16 +214,10 @@ func (s *createdCheckpointState) Delete(ctx context.Context) error { - } - - func (s *createdCheckpointState) Kill(ctx context.Context, sig uint32, all bool) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.kill(ctx, sig, all) - } - - func (s *createdCheckpointState) SetExited(status int) { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - s.p.setExited(status) - - if err := s.transition("stopped"); err != nil { -@@ -274,9 +226,6 @@ func (s *createdCheckpointState) SetExited(status int) { - } - - func (s *createdCheckpointState) Exec(ctx context.Context, path string, r *ExecConfig) (proc.Process, error) { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return nil, errors.Errorf("cannot exec in a created state") - } - -@@ -297,67 +246,42 @@ func (s *runningState) transition(name string) error { - } - - func (s *runningState) Pause(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- if err := s.p.pause(ctx); err != nil { -- return err -+ if err := s.p.runtime.Pause(ctx, s.p.id); err != nil { -+ return s.p.runtimeError(err, "OCI runtime pause failed") - } -+ - return s.transition("paused") - } - - func (s *runningState) Resume(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot resume a running process") - } - --func (s *runningState) Update(context context.Context, r *google_protobuf.Any) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- -- return s.p.update(context, r) -+func (s *runningState) Update(ctx context.Context, r *google_protobuf.Any) error { -+ return s.p.update(ctx, r) - } - - func (s *runningState) Checkpoint(ctx context.Context, r *CheckpointConfig) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.checkpoint(ctx, r) - } - - func (s *runningState) Resize(ws console.WinSize) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.resize(ws) - } - - func (s *runningState) Start(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot start a running process") - } - - func (s *runningState) Delete(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot delete a running process") - } - - func (s *runningState) Kill(ctx context.Context, sig uint32, all bool) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.kill(ctx, sig, all) - } - - func (s *runningState) SetExited(status int) { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - s.p.setExited(status) - - if err := s.transition("stopped"); err != nil { -@@ -366,8 +290,6 @@ func (s *runningState) SetExited(status int) { - } - - func (s *runningState) Exec(ctx context.Context, path string, r *ExecConfig) (proc.Process, error) { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() - return s.p.exec(ctx, path, r) - } - -@@ -388,79 +310,54 @@ func (s *pausedState) transition(name string) error { - } - - func (s *pausedState) Pause(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot pause a paused container") - } - - func (s *pausedState) Resume(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- -- if err := s.p.resume(ctx); err != nil { -- return err -+ if err := s.p.runtime.Resume(ctx, s.p.id); err != nil { -+ return s.p.runtimeError(err, "OCI runtime resume failed") - } -+ - return s.transition("running") - } - --func (s *pausedState) Update(context context.Context, r *google_protobuf.Any) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- -- return s.p.update(context, r) -+func (s *pausedState) Update(ctx context.Context, r *google_protobuf.Any) error { -+ return s.p.update(ctx, r) - } - - func (s *pausedState) Checkpoint(ctx context.Context, r *CheckpointConfig) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.checkpoint(ctx, r) - } - - func (s *pausedState) Resize(ws console.WinSize) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.resize(ws) - } - - func (s *pausedState) Start(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot start a paused process") - } - - func (s *pausedState) Delete(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot delete a paused process") - } - - func (s *pausedState) Kill(ctx context.Context, sig uint32, all bool) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return s.p.kill(ctx, sig, all) - } - - func (s *pausedState) SetExited(status int) { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - s.p.setExited(status) - -+ if err := s.p.runtime.Resume(context.Background(), s.p.id); err != nil { -+ logrus.WithError(err).Error("resuming exited container from paused state") -+ } -+ - if err := s.transition("stopped"); err != nil { - panic(err) - } - } - - func (s *pausedState) Exec(ctx context.Context, path string, r *ExecConfig) (proc.Process, error) { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return nil, errors.Errorf("cannot exec in a paused state") - } - -@@ -479,50 +376,30 @@ func (s *stoppedState) transition(name string) error { - } - - func (s *stoppedState) Pause(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot pause a stopped container") - } - - func (s *stoppedState) Resume(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot resume a stopped container") - } - --func (s *stoppedState) Update(context context.Context, r *google_protobuf.Any) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- -+func (s *stoppedState) Update(ctx context.Context, r *google_protobuf.Any) error { - return errors.Errorf("cannot update a stopped container") - } - - func (s *stoppedState) Checkpoint(ctx context.Context, r *CheckpointConfig) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot checkpoint a stopped container") - } - - func (s *stoppedState) Resize(ws console.WinSize) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot resize a stopped container") - } - - func (s *stoppedState) Start(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return errors.Errorf("cannot start a stopped process") - } - - func (s *stoppedState) Delete(ctx context.Context) error { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() - if err := s.p.delete(ctx); err != nil { - return err - } -@@ -538,8 +415,5 @@ func (s *stoppedState) SetExited(status int) { - } - - func (s *stoppedState) Exec(ctx context.Context, path string, r *ExecConfig) (proc.Process, error) { -- s.p.mu.Lock() -- defer s.p.mu.Unlock() -- - return nil, errors.Errorf("cannot exec in a stopped state") - } -diff --git a/runtime/v1/linux/proc/io.go b/runtime/v1/linux/proc/io.go -index 360662701..e620f5840 100644 ---- a/runtime/v1/linux/proc/io.go -+++ b/runtime/v1/linux/proc/io.go -@@ -114,7 +114,7 @@ func copyPipes(ctx context.Context, rio runc.IO, stdin, stdout, stderr string, w - if stdin == "" { - return nil - } -- f, err := fifo.OpenFifo(ctx, stdin, syscall.O_RDONLY|syscall.O_NONBLOCK, 0) -+ f, err := fifo.OpenFifo(context.Background(), stdin, syscall.O_RDONLY|syscall.O_NONBLOCK, 0) - if err != nil { - return fmt.Errorf("containerd-shim syscall.O_RDONLY|syscall.O_NONBLOCK: opening %s failed: %s", stdin, err) - } -diff --git a/runtime/v1/linux/proc/utils.go b/runtime/v1/linux/proc/utils.go -index d6f047cee..7312dec68 100644 ---- a/runtime/v1/linux/proc/utils.go -+++ b/runtime/v1/linux/proc/utils.go -@@ -33,6 +33,18 @@ import ( - "golang.org/x/sys/unix" - ) - -+// safePid is a thread safe wrapper for pid. -+type safePid struct { -+ sync.Mutex -+ pid int -+} -+ -+func (s *safePid) get() int { -+ s.Lock() -+ defer s.Unlock() -+ return s.pid -+} -+ - // TODO(mlaventure): move to runc package? - func getLastRuntimeError(r *runc.Runc) (string, error) { - if r.Log == "" { -diff --git a/runtime/v2/runc/service_linux.go b/runtime/v2/runc/service_linux.go -index 116167352..195c23014 100644 ---- a/runtime/v2/runc/service_linux.go -+++ b/runtime/v2/runc/service_linux.go -@@ -42,7 +42,7 @@ func (p *linuxPlatform) CopyConsole(ctx context.Context, console console.Console - } - - if stdin != "" { -- in, err := fifo.OpenFifo(ctx, stdin, syscall.O_RDONLY|syscall.O_NONBLOCK, 0) -+ in, err := fifo.OpenFifo(context.Background(), stdin, syscall.O_RDONLY|syscall.O_NONBLOCK, 0) - if err != nil { - return nil, err - } -diff --git a/runtime/v2/shim_unix.go b/runtime/v2/shim_unix.go -index 1a08be5d1..6738a7787 100644 ---- a/runtime/v2/shim_unix.go -+++ b/runtime/v2/shim_unix.go -@@ -28,5 +28,5 @@ import ( - ) - - func openShimLog(ctx context.Context, bundle *Bundle) (io.ReadCloser, error) { -- return fifo.OpenFifo(ctx, filepath.Join(bundle.Path, "log"), unix.O_RDONLY|unix.O_CREAT|unix.O_NONBLOCK, 0700) -+ return fifo.OpenFifo(ctx, filepath.Join(bundle.Path, "log"), unix.O_RDWR|unix.O_CREAT, 0700) - } --- -2.17.1 - diff --git a/patch/0074-containerd-fix-exec-event-missing-due-to-pid-reuse.patch b/patch/0074-containerd-fix-exec-event-missing-due-to-pid-reuse.patch deleted file mode 100644 index fe6a5a9..0000000 --- a/patch/0074-containerd-fix-exec-event-missing-due-to-pid-reuse.patch +++ /dev/null @@ -1,71 +0,0 @@ -From dded5a0253fbfd3c75c6d73a890049c832374545 Mon Sep 17 00:00:00 2001 -From: jingrui -Date: Sat, 20 Feb 2021 09:06:22 +0800 -Subject: [PATCH] containerd: fix exec event missing due to pid reuse - -When many exec request exit at nearly sametime, the Exit can match with -wrong process and return directly, the event for right process will lost -in this case. - -time="2021-02-19T21:10:12.250841280+08:00" level=info msg=event Pid=11623 containerID=a32a1b7923db55ebdc7483e2b9cd986e5efc750b989ad3507eb866835e8e37f4 execID=0b412ecaed98f9ea71168599a9363b8aa3b047187eadaa74973bb6c63a66118d module=libcontainerd namespace=moby topic=/tasks/exec-started -time="2021-02-19T21:10:12+08:00" level=info msg="try publish event(1) /tasks/exit &TaskExit{ContainerID:a32a1b7923db55ebdc7483e2b9cd986e5efc750b989ad3507eb866835e8e37f4,ID:0b412ecaed98f9ea71168599a9363b8aa3b047187eadaa74973bb6c63a66118d,Pid:11623,ExitStatus:0,ExitedAt:2021-02-19 21:10:12.27697416 +0800 CST m=+1893.164673481,} " -time="2021-02-19T21:11:02.944643980+08:00" level=debug msg="starting exec command 64cd335311e9b3c1c11e7360a374e3218efeb02e6578d7bc0811bad3f1820e16 in container a32a1b7923db55ebdc7483e2b9cd986e5efc750b989ad3507eb866835e8e37f4" -time="2021-02-19T21:11:06.201162360+08:00" level=debug msg="event published" ns=moby topic="/tasks/exec-started" type=containerd.events.TaskExecStarted -time="2021-02-19T21:11:57.961615320+08:00" level=warning msg="Ignoring Exit Event, no such exec command found" container=a32a1b7923db55ebdc7483e2b9cd986e5efc750b989ad3507eb866835e8e37f4 exec-id=0b412ecaed98f9ea71168599a9363b8aa3b047187eadaa74973bb6c63a66118d exec-pid=11623 - -From logs above, execID=0b412ecae with Pid=11623 exit and event -published, but new exec execID=64cd335 command reuse the Pid, but Exit -event still match previous execID=0b412ecae. so exit event for -execID=64cd335 will lost. - -Change-Id: If591a282a1cc0305758130a936ee8b92c88acc6c -Signed-off-by: jingrui ---- - runtime/v1/linux/proc/exec.go | 4 ++++ - runtime/v1/shim/service.go | 6 +++++- - 2 files changed, 9 insertions(+), 1 deletion(-) - -diff --git a/runtime/v1/linux/proc/exec.go b/runtime/v1/linux/proc/exec.go -index ea40cb5b8..a5f40bd63 100644 ---- a/runtime/v1/linux/proc/exec.go -+++ b/runtime/v1/linux/proc/exec.go -@@ -86,6 +86,10 @@ func (e *execProcess) ExitedAt() time.Time { - } - - func (e *execProcess) SetExited(status int) { -+ e.pid.Lock() -+ e.pid.pid = -1 -+ e.pid.Unlock() -+ - e.mu.Lock() - defer e.mu.Unlock() - -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index 7e07ab011..7d7327cd8 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -548,8 +548,13 @@ func (s *Service) checkProcesses(e runc.Exit) { - log.G(s.context).WithError(err).Error("failed to check shouldKillAll") - } - -+ match := 0 - for _, p := range s.processes { - if p.Pid() == e.Pid { -+ match++ -+ if match > 1 { -+ logrus.Warnf("exit for pid=%d match %d processes", e.Pid, match) -+ } - if ip, ok := p.(*proc.Init); ok { - ns := filepath.Base(filepath.Dir(ip.Bundle)) - events.ExitAddFile(ns, events.ExitFile(s.id, uint32(e.Pid), uint32(e.Status)), "init exited") -@@ -591,7 +596,6 @@ func (s *Service) checkProcesses(e runc.Exit) { - ExitStatus: uint32(e.Status), - ExitedAt: p.ExitedAt(), - } -- return - } - } - } --- -2.17.1 - diff --git a/patch/0075-containerd-fix-dm-left-when-pause-contaienr-and-kill-shim.patch b/patch/0075-containerd-fix-dm-left-when-pause-contaienr-and-kill-shim.patch deleted file mode 100644 index 0e47373..0000000 --- a/patch/0075-containerd-fix-dm-left-when-pause-contaienr-and-kill-shim.patch +++ /dev/null @@ -1,36 +0,0 @@ -From c10041fa37568bca00a25c055ee844d38e91fa95 Mon Sep 17 00:00:00 2001 -From: chenjiankun -Date: Mon, 19 Apr 2021 17:08:09 +0800 -Subject: [PATCH] docker: fix dm left when pause contaienr and kill shim - -when shim process be killed, we will delete the runtime, but if the -status is paused, it can't be delete. So we need to resume the shim -process before delete it. ---- - runtime/v1/linux/runtime.go | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index 66f959d..ca36748 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -541,6 +541,16 @@ func (r *Runtime) terminate(ctx context.Context, bundle *bundle, ns, id string) - } - - if !legacy.IsLegacy(id) || legacy.IsSamePid(id) { -+ -+ state, err := rt.State(ctx, id) -+ if err == nil && state.Status == "paused" { -+ logrus.Warnf("container %s status is paused, try to resume before delete", id) -+ err := rt.Resume(ctx, id) -+ if err != nil { -+ log.G(ctx).WithError(err).Errorf("runtime resume %s error", id) -+ } -+ } -+ - if err := rt.Delete(ctx, id, &runc.DeleteOpts{ - Force: true, - }); err != nil { --- -2.23.0 - diff --git a/patch/0076-containerd-fix-start-container-failed-with-id-exists.patch b/patch/0076-containerd-fix-start-container-failed-with-id-exists.patch deleted file mode 100644 index c53b218..0000000 --- a/patch/0076-containerd-fix-start-container-failed-with-id-exists.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 6936dda1f72b328cacfc29b52da780a29ef45385 Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Thu, 8 Jul 2021 14:37:56 +0800 -Subject: [PATCH] containerd: fix start container failed with id exists - -reason: If container root path already exists when call runtime.Create, -we try to call runtime.Delete to cleanup it. But in case runtime.Delete -failed, root path will still exists which causes Create failed with error -"container with id exists". So remove path directly if Delete failed. - -Signed-off-by: xiadanni ---- - vendor/github.com/containerd/go-runc/runc.go | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/vendor/github.com/containerd/go-runc/runc.go b/vendor/github.com/containerd/go-runc/runc.go -index 1c96317..c089381 100644 ---- a/vendor/github.com/containerd/go-runc/runc.go -+++ b/vendor/github.com/containerd/go-runc/runc.go -@@ -159,7 +159,10 @@ func (o *CreateOpts) args() (out []string, err error) { - func (r *Runc) Create(context context.Context, id, bundle string, opts *CreateOpts) error { - if _, err := os.Stat(filepath.Join(r.Root, id)); err == nil { - logrus.Warnf("cleanup residue runtime with bundle %s root=%s", bundle, r.Root) -- r.Delete(context, id, &DeleteOpts{Force: true}) -+ if dErr := r.Delete(context, id, &DeleteOpts{Force: true}); dErr != nil { -+ logrus.Errorf("runtime force delete return err: %v, remove container root err: %v", -+ dErr, os.RemoveAll(filepath.Join(r.Root, id))) -+ } - } - - args := []string{"create", "--bundle", bundle} --- -2.27.0 - diff --git a/patch/0077-containerd-drop-opt-package.patch b/patch/0077-containerd-drop-opt-package.patch deleted file mode 100644 index 807f49e..0000000 --- a/patch/0077-containerd-drop-opt-package.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 81d14714bb90455964eac557f9b2172d7bc3e522 Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Thu, 5 Aug 2021 15:24:21 +0800 -Subject: [PATCH] [Huawei]containerd: drop opt package - -Signed-off-by: xiadanni ---- - cmd/containerd/builtins.go | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/cmd/containerd/builtins.go b/cmd/containerd/builtins.go -index b120b60..17fa9f6 100644 ---- a/cmd/containerd/builtins.go -+++ b/cmd/containerd/builtins.go -@@ -30,7 +30,6 @@ import ( - _ "github.com/containerd/containerd/services/introspection" - _ "github.com/containerd/containerd/services/leases" - _ "github.com/containerd/containerd/services/namespaces" -- _ "github.com/containerd/containerd/services/opt" - _ "github.com/containerd/containerd/services/snapshots" - _ "github.com/containerd/containerd/services/tasks" - _ "github.com/containerd/containerd/services/version" --- -2.27.0 - diff --git a/patch/0078-containerd-bump-containerd-ttrpc-699c4e40d1.patch b/patch/0078-containerd-bump-containerd-ttrpc-699c4e40d1.patch deleted file mode 100644 index f686be5..0000000 --- a/patch/0078-containerd-bump-containerd-ttrpc-699c4e40d1.patch +++ /dev/null @@ -1,149 +0,0 @@ -From 1c8a3bb488eb68523a3ae112854fcdd7326686cb Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Wed, 1 Sep 2021 07:23:17 +0800 -Subject: [PATCH] [backport]containerd:bump containerd/ttrpc - 699c4e40d1e7416e08bf7019c7ce2e9beced4636 - -full diff: https://github.com/containerd/ttrpc/compare/f02858b1457c5ca3aaec3a0803eb0d59f96e41d6...699c4e40d1e7416e08bf7019c7ce2e9beced4636 - -- containerd/ttrpc#33 Fix returns error message -- containerd/ttrpc#35 Make onclose an option - -Conflict:vendor.conf -Reference:https://github.com/containerd/containerd/commit/8c5779c32b70a0c55e1c94eb45b305897f7cf3f1 - -Signed-off-by: Sebastiaan van Stijn -Signed-off-by: xiadanni ---- - runtime/v1/shim/client/client.go | 3 +-- - runtime/v2/binary.go | 3 +-- - runtime/v2/shim.go | 3 +-- - vendor.conf | 2 +- - vendor/github.com/containerd/ttrpc/client.go | 21 ++++++++++++------- - .../github.com/containerd/ttrpc/services.go | 2 +- - 6 files changed, 19 insertions(+), 15 deletions(-) - -diff --git a/runtime/v1/shim/client/client.go b/runtime/v1/shim/client/client.go -index 48d62e537..6861df081 100644 ---- a/runtime/v1/shim/client/client.go -+++ b/runtime/v1/shim/client/client.go -@@ -299,8 +299,7 @@ func WithConnect(address string, onClose func()) Opt { - if err != nil { - return nil, nil, err - } -- client := ttrpc.NewClient(conn) -- client.OnClose(onClose) -+ client := ttrpc.NewClient(conn, ttrpc.WithOnClose(onClose)) - return shimapi.NewShimClient(client), conn, nil - } - } -diff --git a/runtime/v2/binary.go b/runtime/v2/binary.go -index 41de0d3e0..223b85300 100644 ---- a/runtime/v2/binary.go -+++ b/runtime/v2/binary.go -@@ -97,8 +97,7 @@ func (b *binary) Start(ctx context.Context) (_ *shim, err error) { - if err != nil { - return nil, err - } -- client := ttrpc.NewClient(conn) -- client.OnClose(func() { conn.Close() }) -+ client := ttrpc.NewClient(conn, ttrpc.WithOnClose(func() { _ = conn.Close() })) - return &shim{ - bundle: b.bundle, - client: client, -diff --git a/runtime/v2/shim.go b/runtime/v2/shim.go -index 982d1bb34..8e746712b 100644 ---- a/runtime/v2/shim.go -+++ b/runtime/v2/shim.go -@@ -75,8 +75,7 @@ func loadShim(ctx context.Context, bundle *Bundle, events *exchange.Exchange, rt - } - }() - -- client := ttrpc.NewClient(conn) -- client.OnClose(func() { conn.Close() }) -+ client := ttrpc.NewClient(conn, ttrpc.WithOnClose(func() { _ = conn.Close() })) - s := &shim{ - client: client, - task: task.NewTaskClient(client), -diff --git a/vendor.conf b/vendor.conf -index dbc3eecd9..0f76be3b0 100644 ---- a/vendor.conf -+++ b/vendor.conf -@@ -36,7 +36,7 @@ github.com/Microsoft/go-winio v0.4.11 - github.com/Microsoft/hcsshim v0.7.12 - google.golang.org/genproto d80a6e20e776b0b17a324d0ba1ab50a39c8e8944 - golang.org/x/text 19e51611da83d6be54ddafce4a4af510cb3e9ea4 --github.com/containerd/ttrpc 2a805f71863501300ae1976d29f0454ae003e85a -+github.com/containerd/ttrpc 699c4e40d1e7416e08bf7019c7ce2e9beced4636 - github.com/syndtr/gocapability db04d3cc01c8b54962a58ec7e491717d06cfcc16 - gotest.tools v2.1.0 - github.com/google/go-cmp v0.1.0 -diff --git a/vendor/github.com/containerd/ttrpc/client.go b/vendor/github.com/containerd/ttrpc/client.go -index e40592dd7..bc2bbde1b 100644 ---- a/vendor/github.com/containerd/ttrpc/client.go -+++ b/vendor/github.com/containerd/ttrpc/client.go -@@ -48,7 +48,15 @@ type Client struct { - err error - } - --func NewClient(conn net.Conn) *Client { -+type ClientOpts func(c *Client) -+ -+func WithOnClose(onClose func()) ClientOpts { -+ return func(c *Client) { -+ c.closeFunc = onClose -+ } -+} -+ -+func NewClient(conn net.Conn, opts ...ClientOpts) *Client { - c := &Client{ - codec: codec{}, - conn: conn, -@@ -59,6 +67,10 @@ func NewClient(conn net.Conn) *Client { - closeFunc: func() {}, - } - -+ for _, o := range opts { -+ o(c) -+ } -+ - go c.run() - return c - } -@@ -135,11 +147,6 @@ func (c *Client) Close() error { - return nil - } - --// OnClose allows a close func to be called when the server is closed --func (c *Client) OnClose(closer func()) { -- c.closeFunc = closer --} -- - type message struct { - messageHeader - p []byte -@@ -249,7 +256,7 @@ func (c *Client) recv(resp *Response, msg *message) error { - } - - if msg.Type != messageTypeResponse { -- return errors.New("unkown message type received") -+ return errors.New("unknown message type received") - } - - defer c.channel.putmbuf(msg.p) -diff --git a/vendor/github.com/containerd/ttrpc/services.go b/vendor/github.com/containerd/ttrpc/services.go -index e90963825..fe1cade5a 100644 ---- a/vendor/github.com/containerd/ttrpc/services.go -+++ b/vendor/github.com/containerd/ttrpc/services.go -@@ -76,7 +76,7 @@ func (s *serviceSet) dispatch(ctx context.Context, serviceName, methodName strin - switch v := obj.(type) { - case proto.Message: - if err := proto.Unmarshal(p, v); err != nil { -- return status.Errorf(codes.Internal, "ttrpc: error unmarshaling payload: %v", err.Error()) -+ return status.Errorf(codes.Internal, "ttrpc: error unmarshalling payload: %v", err.Error()) - } - default: - return status.Errorf(codes.Internal, "ttrpc: error unsupported request type: %T", v) --- -2.27.0 - diff --git a/patch/0079-containerd-fix-race-access-for-mobySubcribed.patch b/patch/0079-containerd-fix-race-access-for-mobySubcribed.patch deleted file mode 100644 index 00d1d80..0000000 --- a/patch/0079-containerd-fix-race-access-for-mobySubcribed.patch +++ /dev/null @@ -1,47 +0,0 @@ -From fe8f7f5acac4f0fcf75218e26c1f3f874a77bf44 Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Wed, 1 Sep 2021 07:29:43 +0800 -Subject: [PATCH] [Huawei]containerd:fix race access for mobySubcribed - -Signed-off-by: xiadanni ---- - events/exchange/exchange.go | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/events/exchange/exchange.go b/events/exchange/exchange.go -index 540f18054..ad642563a 100644 ---- a/events/exchange/exchange.go -+++ b/events/exchange/exchange.go -@@ -19,6 +19,7 @@ package exchange - import ( - "context" - "strings" -+ "sync/atomic" - "time" - - "github.com/containerd/containerd/errdefs" -@@ -49,10 +50,10 @@ func NewExchange() *Exchange { - var _ events.Publisher = &Exchange{} - var _ events.Forwarder = &Exchange{} - var _ events.Subscriber = &Exchange{} --var mobySubcribed = false -+var mobySubcribed = int32(0) - - func MobySubscribed() bool { -- return mobySubcribed -+ return atomic.LoadInt32(&mobySubcribed) == 1 - } - - // Forward accepts an envelope to be direcly distributed on the exchange. -@@ -170,7 +171,7 @@ func (e *Exchange) Subscribe(ctx context.Context, fs ...string) (ch <-chan *even - for _, s := range fs { - if !MobySubscribed() && s == "namespace==moby,topic~=|^/tasks/|" { - queue.Namespace = "moby" -- mobySubcribed = true -+ atomic.StoreInt32(&mobySubcribed, 1) - } - } - --- -2.27.0 - diff --git a/patch/0080-containerd-improve-log-for-debugging.patch b/patch/0080-containerd-improve-log-for-debugging.patch deleted file mode 100644 index d4708ad..0000000 --- a/patch/0080-containerd-improve-log-for-debugging.patch +++ /dev/null @@ -1,137 +0,0 @@ -From 003a26f92ccfd6f296910874ed9ad55d652413cc Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Fri, 29 Oct 2021 16:37:28 +0800 -Subject: [PATCH] containerd: improve log for debugging - -add following logs for debugging -1. return event publish errors -2. redirect is used to make sure that containerd still can read the log - of shim after restart - -Conflict:NA -Reference: -https://github.com/containerd/containerd/pull/3179/commits/74eb0dc81221bffc192a349cf8b14fe7947b7a73 -https://github.com/containerd/containerd/pull/5293/commits/45df696bf3fe3eda15bbf0f2c00ddc2cfeddcdcc -https://github.com/containerd/containerd/commit/fbb80b9510db14a95b8ffa6c7842666ecf520489 - -Signed-off-by: xiadanni ---- - cmd/containerd-shim/main_unix.go | 23 ++++++++++++++++++++--- - runtime/v1/linux/runtime.go | 1 + - runtime/v1/shim/client/client.go | 22 ++++++++++------------ - 3 files changed, 31 insertions(+), 15 deletions(-) - -diff --git a/cmd/containerd-shim/main_unix.go b/cmd/containerd-shim/main_unix.go -index 3a5bb6170..a07932cef 100644 ---- a/cmd/containerd-shim/main_unix.go -+++ b/cmd/containerd-shim/main_unix.go -@@ -61,6 +61,12 @@ var ( - criuFlag string - systemdCgroupFlag bool - containerdBinaryFlag string -+ -+ bufPool = sync.Pool{ -+ New: func() interface{} { -+ return bytes.NewBuffer(nil) -+ }, -+ } - ) - - func init() { -@@ -101,6 +107,10 @@ func main() { - stderr.Close() - }() - -+ // redirect the following output into fifo to make sure that containerd -+ // still can read the log after restart -+ logrus.SetOutput(stdout) -+ - if err := executeShim(); err != nil { - fmt.Fprintf(os.Stderr, "containerd-shim: %s\n", err) - os.Exit(1) -@@ -110,7 +120,7 @@ func main() { - // If containerd server process dies, we need the shim to keep stdout/err reader - // FDs so that Linux does not SIGPIPE the shim process if it tries to use its end of - // these pipes. --func openStdioKeepAlivePipes(dir string) (io.ReadCloser, io.ReadCloser, error) { -+func openStdioKeepAlivePipes(dir string) (io.ReadWriteCloser, io.ReadWriteCloser, error) { - background := context.Background() - keepStdoutAlive, err := shimlog.OpenShimStdoutLog(background, dir) - if err != nil { -@@ -287,16 +297,23 @@ func (l *remoteEventsPublisher) doPublish(ctx context.Context, topic string, eve - } - cmd := exec.CommandContext(ctx, containerdBinaryFlag, "--address", l.address, "publish", "--topic", topic, "--namespace", ns) - cmd.Stdin = bytes.NewReader(data) -+ b := bufPool.Get().(*bytes.Buffer) -+ defer func() { -+ b.Reset() -+ bufPool.Put(b) -+ }() -+ cmd.Stdout = b -+ cmd.Stderr = b - c, err := shim.Default.Start(cmd) - if err != nil { - return err - } - status, err := shim.Default.Wait(cmd, c) - if err != nil { -- return err -+ return errors.Wrapf(err, "failed to publish event: %s", b.String()) - } - if status != 0 { -- return errors.New("failed to publish event") -+ return errors.Errorf("failed to publish event: %s", b.String()) - } - return nil - } -diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go -index ca3674808..eb3927305 100644 ---- a/runtime/v1/linux/runtime.go -+++ b/runtime/v1/linux/runtime.go -@@ -379,6 +379,7 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) { - log.G(ctx).Infof("load-task %s/%s/%s Pid=%d", r.state, ns, id, pid) - shimExit := make(chan struct{}) - s, err := bundle.NewShimClient(ctx, ns, ShimConnect(r.config, func() { -+ log.G(ctx).WithField("id", id).Info("shim reaped") - close(shimExit) - if _, err := r.tasks.Get(ctx, id); err != nil { - // Task was never started or was already successfully deleted -diff --git a/runtime/v1/shim/client/client.go b/runtime/v1/shim/client/client.go -index eafb0d712..6861df081 100644 ---- a/runtime/v1/shim/client/client.go -+++ b/runtime/v1/shim/client/client.go -@@ -77,21 +77,19 @@ func WithStart(binary, address, daemonAddress, cgroup string, debug bool, exitHa - - var stdoutLog io.ReadWriteCloser - var stderrLog io.ReadWriteCloser -- if debug { -- stdoutLog, err = v1.OpenShimStdoutLog(ctx, config.WorkDir) -- if err != nil { -- return nil, nil, errors.Wrapf(err, "failed to create stdout log") -- } -- -- stderrLog, err = v1.OpenShimStderrLog(ctx, config.WorkDir) -- if err != nil { -- return nil, nil, errors.Wrapf(err, "failed to create stderr log") -- } -+ stdoutLog, err = v1.OpenShimStdoutLog(ctx, config.WorkDir) -+ if err != nil { -+ return nil, nil, errors.Wrapf(err, "failed to create stdout log") -+ } - -- go io.Copy(os.Stdout, stdoutLog) -- go io.Copy(os.Stderr, stderrLog) -+ stderrLog, err = v1.OpenShimStderrLog(ctx, config.WorkDir) -+ if err != nil { -+ return nil, nil, errors.Wrapf(err, "failed to create stderr log") - } - -+ go io.Copy(os.Stdout, stdoutLog) -+ go io.Copy(os.Stderr, stderrLog) -+ - if err := writeFile(filepath.Join(config.Path, "address"), address); err != nil { - return nil, nil, err - } --- -2.27.0 - diff --git a/patch/0081-containerd-reduce-permissions-for-bundle-di.patch b/patch/0081-containerd-reduce-permissions-for-bundle-di.patch deleted file mode 100644 index fbac4f8..0000000 --- a/patch/0081-containerd-reduce-permissions-for-bundle-di.patch +++ /dev/null @@ -1,138 +0,0 @@ -From fe70d9e0048502addcbeea5399f2da554a14bd78 Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Tue, 9 Nov 2021 16:25:09 +0800 -Subject: [PATCH] [Backport]containerd:reduce permissions for bundle dir to fix - CVE-2021-41103 - -reduce permissions for bundle dir -reduce permissions on plugin directories -fix CVE-2021-41103 - -Conflict:NA -Reference:https://github.com/containerd/containerd/commit/6886c6a2ec0c70dde1aa64e77b64a5ad47b983c3 -https://github.com/containerd/containerd/commit/7c621e1fcc08bcf5a1a48b837342cc22eada1685 ---- - runtime/v1/linux/bundle.go | 56 +++++++++++++++++++++++++++++++++++++- - snapshots/btrfs/btrfs.go | 8 ++++-- - 2 files changed, 61 insertions(+), 3 deletions(-) - -diff --git a/runtime/v1/linux/bundle.go b/runtime/v1/linux/bundle.go -index 0442246f9..90a10862e 100644 ---- a/runtime/v1/linux/bundle.go -+++ b/runtime/v1/linux/bundle.go -@@ -20,6 +20,7 @@ package linux - - import ( - "context" -+ "encoding/json" - "fmt" - "io/ioutil" - "os" -@@ -30,6 +31,7 @@ import ( - "github.com/containerd/containerd/runtime/linux/runctypes" - "github.com/containerd/containerd/runtime/v1/shim" - "github.com/containerd/containerd/runtime/v1/shim/client" -+ "github.com/opencontainers/runtime-spec/specs-go" - "github.com/pkg/errors" - "github.com/sirupsen/logrus" - ) -@@ -63,7 +65,7 @@ func newBundle(id, path, workDir string, spec []byte) (b *bundle, err error) { - time.Sleep(waitTime) - } - -- if err := os.Mkdir(path, 0711); err != nil { -+ if err := os.Mkdir(path, 0700); err != nil { - return nil, err - } - defer func() { -@@ -71,6 +73,9 @@ func newBundle(id, path, workDir string, spec []byte) (b *bundle, err error) { - os.RemoveAll(path) - } - }() -+ if err := prepareBundleDirectoryPermissions(path, spec); err != nil { -+ return nil, err -+ } - if err := os.MkdirAll(workDir, 0711); err != nil { - return nil, err - } -@@ -90,6 +95,55 @@ func newBundle(id, path, workDir string, spec []byte) (b *bundle, err error) { - }, err - } - -+// prepareBundleDirectoryPermissions prepares the permissions of the bundle -+// directory. When user namespaces are enabled, the permissions are modified -+// to allow the remapped root GID to access the bundle. -+func prepareBundleDirectoryPermissions(path string, spec []byte) error { -+ gid, err := remappedGID(spec) -+ if err != nil { -+ return err -+ } -+ if gid == 0 { -+ return nil -+ } -+ if err := os.Chown(path, -1, int(gid)); err != nil { -+ return err -+ } -+ return os.Chmod(path, 0710) -+} -+ -+// ociSpecUserNS is a subset of specs.Spec used to reduce garbage during -+// unmarshal. -+type ociSpecUserNS struct { -+ Linux *linuxSpecUserNS -+} -+ -+// linuxSpecUserNS is a subset of specs.Linux used to reduce garbage during -+// unmarshal. -+type linuxSpecUserNS struct { -+ GIDMappings []specs.LinuxIDMapping -+} -+ -+// remappedGID reads the remapped GID 0 from the OCI spec, if it exists. If -+// there is no remapping, remappedGID returns 0. If the spec cannot be parsed, -+// remappedGID returns an error. -+func remappedGID(spec []byte) (uint32, error) { -+ var ociSpec ociSpecUserNS -+ err := json.Unmarshal(spec, &ociSpec) -+ if err != nil { -+ return 0, err -+ } -+ if ociSpec.Linux == nil || len(ociSpec.Linux.GIDMappings) == 0 { -+ return 0, nil -+ } -+ for _, mapping := range ociSpec.Linux.GIDMappings { -+ if mapping.ContainerID == 0 { -+ return mapping.HostID, nil -+ } -+ } -+ return 0, nil -+} -+ - type bundle struct { - id string - path string -diff --git a/snapshots/btrfs/btrfs.go b/snapshots/btrfs/btrfs.go -index a89b55129..da6f8220e 100644 ---- a/snapshots/btrfs/btrfs.go -+++ b/snapshots/btrfs/btrfs.go -@@ -63,11 +63,15 @@ type snapshotter struct { - // root needs to be a mount point of btrfs. - func NewSnapshotter(root string) (snapshots.Snapshotter, error) { - // If directory does not exist, create it -- if _, err := os.Stat(root); err != nil { -+ if st, err := os.Stat(root); err != nil { - if !os.IsNotExist(err) { - return nil, err - } -- if err := os.Mkdir(root, 0755); err != nil { -+ if err := os.Mkdir(root, 0700); err != nil { -+ return nil, err -+ } -+ } else if st.Mode()&os.ModePerm != 0700 { -+ if err := os.Chmod(root, 0700); err != nil { - return nil, err - } - } --- -2.27.0 - diff --git a/patch/0082-containerd-fix-publish-command-wait-block-for.patch b/patch/0082-containerd-fix-publish-command-wait-block-for.patch deleted file mode 100644 index ec9f783..0000000 --- a/patch/0082-containerd-fix-publish-command-wait-block-for.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 31cd7bb5147c42384ffd28e9a64f0c5d5c4f7500 Mon Sep 17 00:00:00 2001 -From: chenjiankun -Date: Wed, 10 Nov 2021 16:10:37 +0800 -Subject: [PATCH] containerd: fix publish command wait block forever - ---- - cmd/containerd-shim/main_unix.go | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/cmd/containerd-shim/main_unix.go b/cmd/containerd-shim/main_unix.go -index a07932c..37b621e 100644 ---- a/cmd/containerd-shim/main_unix.go -+++ b/cmd/containerd-shim/main_unix.go -@@ -308,7 +308,7 @@ func (l *remoteEventsPublisher) doPublish(ctx context.Context, topic string, eve - if err != nil { - return err - } -- status, err := shim.Default.Wait(cmd, c) -+ status, err := shim.Default.WaitTimeout(cmd, c, 30) - if err != nil { - return errors.Wrapf(err, "failed to publish event: %s", b.String()) - } --- -2.27.0 - diff --git a/patch/0083-containerd-optimize-cgo-compile-options.patch b/patch/0083-containerd-optimize-cgo-compile-options.patch deleted file mode 100644 index fbe2c3c..0000000 --- a/patch/0083-containerd-optimize-cgo-compile-options.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 4ae41b01ba2dfd05e8eae0adac6dc3d54c461117 Mon Sep 17 00:00:00 2001 -From: songyanting -Date: Mon, 24 Jan 2022 11:08:44 +0800 -Subject: [PATCH] [Huawei]containerd:optimize cgo compile options - -offering:EulerOS Server -Type:bugfix -CVE: -DTS/AR: -reason:optimize cgo compile options - -Signed-off-by: songyanting songyanting@huawei.com ---- - Makefile | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/Makefile b/Makefile -index a7d0888..49a90e6 100644 ---- a/Makefile -+++ b/Makefile -@@ -172,8 +172,8 @@ bin/%: cmd/% FORCE - mkdir -p $(BEP_DIR) - @echo "$(WHALE) $@${BINARY_SUFFIX}" - CGO_ENABLED=1 \ -- CGO_CFLAGS="-fstack-protector-strong -fPIE" \ -- CGO_CPPFLAGS="-fstack-protector-strong -fPIE" \ -+ CGO_CFLAGS="-fstack-protector-strong" \ -+ CGO_CPPFLAGS="-fstack-protector-strong" \ - CGO_LDFLAGS_ALLOW='-Wl,-z,relro,-z,now' \ - CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack" \ - go build ${GO_GCFLAGS} ${GO_BUILD_FLAGS} -o $@${BINARY_SUFFIX} ${GO_LDFLAGS} ${GO_TAGS} ./$< --- -2.23.0 - diff --git a/patch/0084-containerd-Use-fs.RootPath-when-mounting-vo.patch b/patch/0084-containerd-Use-fs.RootPath-when-mounting-vo.patch deleted file mode 100644 index 130d407..0000000 --- a/patch/0084-containerd-Use-fs.RootPath-when-mounting-vo.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 53c45a7abaea09e60e0175f192742c74d1be60e2 Mon Sep 17 00:00:00 2001 -From: Vanient -Date: Thu, 31 Mar 2022 21:30:15 +0800 -Subject: [PATCH] containerd:Use fs.RootPath when mounting volumes - -fix CVE-2022-23648 -upstream:https://github.com/containerd/containerd/commit/3406af86394c2426ce7f55d5f52be2b79f456211 - -Signed-off-by: Vanient ---- - .../containerd/cri/pkg/containerd/opts/container.go | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/vendor/github.com/containerd/cri/pkg/containerd/opts/container.go b/vendor/github.com/containerd/cri/pkg/containerd/opts/container.go -index 7647c373c..2ea49b594 100644 ---- a/vendor/github.com/containerd/cri/pkg/containerd/opts/container.go -+++ b/vendor/github.com/containerd/cri/pkg/containerd/opts/container.go -@@ -20,7 +20,6 @@ import ( - "context" - "io/ioutil" - "os" -- "path/filepath" - - "github.com/containerd/containerd" - "github.com/containerd/containerd/containers" -@@ -88,7 +87,10 @@ func WithVolumes(volumeMounts map[string]string) containerd.NewContainerOpts { - }() - - for host, volume := range volumeMounts { -- src := filepath.Join(root, volume) -+ src, err := fs.RootPath(root, volume) -+ if err != nil { -+ return errors.Wrapf(err, "rootpath on root %s, volume %s", root, volume) -+ } - if _, err := os.Stat(src); err != nil { - if os.IsNotExist(err) { - // Skip copying directory if it does not exist. --- -2.27.0 - diff --git a/patch/0085-containerd-put-get-pid-lock-after-set-process-exited-to-.patch b/patch/0085-containerd-put-get-pid-lock-after-set-process-exited-to-.patch deleted file mode 100644 index 4ab36bb..0000000 --- a/patch/0085-containerd-put-get-pid-lock-after-set-process-exited-to-.patch +++ /dev/null @@ -1,37 +0,0 @@ -From a6c7265aa68fca3a5023ad2b399799db583fffeb Mon Sep 17 00:00:00 2001 -From: zhangsong234 -Date: Tue, 14 Jun 2022 10:25:47 +0800 -Subject: [PATCH] containerd: put get pid lock after set process exited to avoid - deadlock. - -Signed-off-by: zhangsong234 ---- - runtime/v1/linux/proc/exec.go | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/runtime/v1/linux/proc/exec.go b/runtime/v1/linux/proc/exec.go -index a5f40bd..ff967b5 100644 ---- a/runtime/v1/linux/proc/exec.go -+++ b/runtime/v1/linux/proc/exec.go -@@ -86,14 +86,14 @@ func (e *execProcess) ExitedAt() time.Time { - } - - func (e *execProcess) SetExited(status int) { -- e.pid.Lock() -- e.pid.pid = -1 -- e.pid.Unlock() -- - e.mu.Lock() - defer e.mu.Unlock() - - e.execState.SetExited(status) -+ -+ e.pid.Lock() -+ e.pid.pid = -1 -+ e.pid.Unlock() - } - - func (e *execProcess) setExited(status int) { --- -2.27.0 - diff --git a/patch/0086-containerd-Limit-the-response-size-of-ExecSync.patch b/patch/0086-containerd-Limit-the-response-size-of-ExecSync.patch deleted file mode 100644 index e17da50..0000000 --- a/patch/0086-containerd-Limit-the-response-size-of-ExecSync.patch +++ /dev/null @@ -1,133 +0,0 @@ -From cf3bde2b5a78d7ba8773eadcc3b28dfb0001aee0 Mon Sep 17 00:00:00 2001 -From: zhongjiawei -Date: Mon, 4 Jul 2022 14:34:23 +0800 -Subject: [PATCH] containerd: Limit the response size of ExecSync - -fix CVE-2022-31030 -upstream:https://github.com/containerd/containerd/commit/c1bcabb4541930f643aa36a2b38655e131346382 ---- - .../cri/pkg/server/container_execsync.go | 45 ++++++++++++++++- - .../cri/pkg/server/container_execsync_test.go | 49 +++++++++++++++++++ - 2 files changed, 92 insertions(+), 2 deletions(-) - create mode 100644 vendor/github.com/containerd/cri/pkg/server/container_execsync_test.go - -diff --git a/vendor/github.com/containerd/cri/pkg/server/container_execsync.go b/vendor/github.com/containerd/cri/pkg/server/container_execsync.go -index fd54120..1ef93e5 100644 ---- a/vendor/github.com/containerd/cri/pkg/server/container_execsync.go -+++ b/vendor/github.com/containerd/cri/pkg/server/container_execsync.go -@@ -37,14 +37,55 @@ import ( - "github.com/containerd/cri/pkg/util" - ) - -+type cappedWriter struct { -+ w io.WriteCloser -+ remain int -+} -+ -+func (cw *cappedWriter) Write(p []byte) (int, error) { -+ if cw.remain <= 0 { -+ return len(p), nil -+ } -+ -+ end := cw.remain -+ if end > len(p) { -+ end = len(p) -+ } -+ written, err := cw.w.Write(p[0:end]) -+ cw.remain -= written -+ -+ if err != nil { -+ return written, err -+ } -+ return len(p), nil -+} -+ -+func (cw *cappedWriter) Close() error { -+ return cw.w.Close() -+} -+ -+func (cw *cappedWriter) isFull() bool { -+ return cw.remain <= 0 -+} -+ - // ExecSync executes a command in the container, and returns the stdout output. - // If command exits with a non-zero exit code, an error is returned. - func (c *criService) ExecSync(ctx context.Context, r *runtime.ExecSyncRequest) (*runtime.ExecSyncResponse, error) { -+ const maxStreamSize = 1024 * 1024 * 16 -+ - var stdout, stderr bytes.Buffer -+ -+ // cappedWriter truncates the output. In that case, the size of -+ // the ExecSyncResponse will hit the CRI plugin's gRPC response limit. -+ // Thus the callers outside of the containerd process (e.g. Kubelet) never see -+ // the truncated output. -+ cout := &cappedWriter{w: cioutil.NewNopWriteCloser(&stdout), remain: maxStreamSize} -+ cerr := &cappedWriter{w: cioutil.NewNopWriteCloser(&stderr), remain: maxStreamSize} -+ - exitCode, err := c.execInContainer(ctx, r.GetContainerId(), execOptions{ - cmd: r.GetCmd(), -- stdout: cioutil.NewNopWriteCloser(&stdout), -- stderr: cioutil.NewNopWriteCloser(&stderr), -+ stdout: cout, -+ stderr: cerr, - timeout: time.Duration(r.GetTimeout()) * time.Second, - }) - if err != nil { -diff --git a/vendor/github.com/containerd/cri/pkg/server/container_execsync_test.go b/vendor/github.com/containerd/cri/pkg/server/container_execsync_test.go -new file mode 100644 -index 0000000..c8641d0 ---- /dev/null -+++ b/vendor/github.com/containerd/cri/pkg/server/container_execsync_test.go -@@ -0,0 +1,49 @@ -+/* -+ Copyright The containerd Authors. -+ Licensed under the Apache License, Version 2.0 (the "License"); -+ you may not use this file except in compliance with the License. -+ You may obtain a copy of the License at -+ http://www.apache.org/licenses/LICENSE-2.0 -+ Unless required by applicable law or agreed to in writing, software -+ distributed under the License is distributed on an "AS IS" BASIS, -+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+ See the License for the specific language governing permissions and -+ limitations under the License. -+*/ -+ -+package server -+ -+import ( -+ "bytes" -+ "testing" -+ -+ cioutil "github.com/containerd/containerd/pkg/ioutil" -+ "github.com/stretchr/testify/assert" -+) -+ -+func TestCWWrite(t *testing.T) { -+ var buf bytes.Buffer -+ cw := &cappedWriter{w: cioutil.NewNopWriteCloser(&buf), remain: 10} -+ -+ n, err := cw.Write([]byte("hello")) -+ assert.NoError(t, err) -+ assert.Equal(t, 5, n) -+ -+ n, err = cw.Write([]byte("helloworld")) -+ assert.NoError(t, err, "no errors even it hits the cap") -+ assert.Equal(t, 10, n, "no indication of partial write") -+ assert.True(t, cw.isFull()) -+ assert.Equal(t, []byte("hellohello"), buf.Bytes(), "the underlying writer is capped") -+ -+ _, err = cw.Write([]byte("world")) -+ assert.NoError(t, err) -+ assert.True(t, cw.isFull()) -+ assert.Equal(t, []byte("hellohello"), buf.Bytes(), "the underlying writer is capped") -+} -+ -+func TestCWClose(t *testing.T) { -+ var buf bytes.Buffer -+ cw := &cappedWriter{w: cioutil.NewNopWriteCloser(&buf), remain: 5} -+ err := cw.Close() -+ assert.NoError(t, err) -+} --- -2.30.0 - diff --git a/patch/0087-containerd-treat-manifest-provided-URLs-differently.patch b/patch/0087-containerd-treat-manifest-provided-URLs-differently.patch deleted file mode 100644 index 717e4a1..0000000 --- a/patch/0087-containerd-treat-manifest-provided-URLs-differently.patch +++ /dev/null @@ -1,65 +0,0 @@ -From eb6ab2e84ab184321bd649b4def182f93e62b6df Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Mon, 24 Jan 2022 19:03:30 +0800 -Subject: [PATCH] [Backport]treat manifest provided URLs differently - -fix CVE-2020-15157 - -Conflict:NA -Reference:https://github.com/containerd/containerd/commit/1ead8d9deb3b175bf40413b8c47b3d19c2262726 -https://github.com/containerd/containerd/commit/abbb17959f55bbb9b7eb37f965d7dad2f4ea8744 - -Signed-off-by: xiadanni ---- - remotes/docker/fetcher.go | 28 ++++++++++++++++++++-------- - 1 file changed, 20 insertions(+), 8 deletions(-) - -diff --git a/remotes/docker/fetcher.go b/remotes/docker/fetcher.go -index 4a2ce3c39..00e7a47c6 100644 ---- a/remotes/docker/fetcher.go -+++ b/remotes/docker/fetcher.go -@@ -56,6 +56,26 @@ func (r dockerFetcher) Fetch(ctx context.Context, desc ocispec.Descriptor) (io.R - } - - return newHTTPReadSeeker(desc.Size, func(offset int64) (io.ReadCloser, error) { -+ if len(desc.URLs) > 0 { -+ db := *r.dockerBase -+ // Remove authorizer to avoid authentication when -+ // connecting to manifest provided URLs. -+ // Prevents https://github.com/containerd/containerd/security/advisories/GHSA-742w-89gc-8m9c -+ db.auth = nil -+ nr := dockerFetcher{ -+ dockerBase: &db, -+ } -+ for _, u := range desc.URLs { -+ log.G(ctx).WithField("url", u).Debug("trying alternative url") -+ rc, err := nr.open(ctx, u, desc.MediaType, offset) -+ if err != nil { -+ log.G(ctx).WithField("error", err).Debug("error trying url") -+ continue // try one of the other urls. -+ } -+ -+ return rc, nil -+ } -+ } - for _, u := range urls { - rc, err := r.open(ctx, u, desc.MediaType, offset) - if err != nil { -@@ -142,14 +162,6 @@ func (r dockerFetcher) open(ctx context.Context, u, mediatype string, offset int - func (r *dockerFetcher) getV2URLPaths(ctx context.Context, desc ocispec.Descriptor) ([]string, error) { - var urls []string - -- if len(desc.URLs) > 0 { -- // handle fetch via external urls. -- for _, u := range desc.URLs { -- log.G(ctx).WithField("url", u).Debug("adding alternative url") -- urls = append(urls, u) -- } -- } -- - switch desc.MediaType { - case images.MediaTypeDockerSchema2Manifest, images.MediaTypeDockerSchema2ManifestList, - images.MediaTypeDockerSchema1Manifest, --- -2.27.0 - diff --git a/patch/0088-containerd-Use-chmod-path-for-checking-symlink.patch b/patch/0088-containerd-Use-chmod-path-for-checking-symlink.patch deleted file mode 100644 index bc4cf4f..0000000 --- a/patch/0088-containerd-Use-chmod-path-for-checking-symlink.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 90a3fd55136fb18641c8221792b013ee1dbc17f5 Mon Sep 17 00:00:00 2001 -From: xiadanni -Date: Mon, 24 Jan 2022 19:15:14 +0800 -Subject: [PATCH] [Backport]Use chmod path for checking symlink - -fix CVE-2021-32760 -Conflict:NA -Reference:https://github.com/containerd/containerd/commit/03aa748c11663e87a72fab92b7ab7c88c28bf13e - -Signed-off-by: xiadanni ---- - archive/tar_unix.go | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/archive/tar_unix.go b/archive/tar_unix.go -index 022dd6d4f..7f3857c7d 100644 ---- a/archive/tar_unix.go -+++ b/archive/tar_unix.go -@@ -127,7 +127,7 @@ func handleTarTypeBlockCharFifo(hdr *tar.Header, path string) error { - - func handleLChmod(hdr *tar.Header, path string, hdrInfo os.FileInfo) error { - if hdr.Typeflag == tar.TypeLink { -- if fi, err := os.Lstat(hdr.Linkname); err == nil && (fi.Mode()&os.ModeSymlink == 0) { -+ if fi, err := os.Lstat(path); err == nil && (fi.Mode()&os.ModeSymlink == 0) { - if err := os.Chmod(path, hdrInfo.Mode()); err != nil { - return err - } --- -2.27.0 - diff --git a/patch/0089-containerd-Add-lock-for-ListPids.patch b/patch/0089-containerd-Add-lock-for-ListPids.patch deleted file mode 100644 index 9bfc877..0000000 --- a/patch/0089-containerd-Add-lock-for-ListPids.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 9a92dd95046003cd661f8cd76429b2e424907a2a Mon Sep 17 00:00:00 2001 -From: Vanient -Date: Mon, 21 Mar 2022 06:57:02 +0800 -Subject: [PATCH] [Backport]containerd: Add lock for ListPids - -Add the missing locks in ListPids -Conflict:NA -Reference:https://github.com/containerd/containerd/commit/fcf3b275fcd404ddf5fe75d5629d2168742ec0d3 - -Signed-off-by: Vanient ---- - runtime/v1/shim/service.go | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go -index 7d7327cd8..435f02e3c 100644 ---- a/runtime/v1/shim/service.go -+++ b/runtime/v1/shim/service.go -@@ -434,6 +434,9 @@ func (s *Service) ListPids(ctx context.Context, r *shimapi.ListPidsRequest) (*sh - return nil, errdefs.ToGRPC(err) - } - var processes []*task.ProcessInfo -+ -+ s.mu.Lock() -+ defer s.mu.Unlock() - for _, pid := range pids { - pInfo := task.ProcessInfo{ - Pid: pid, --- -2.27.0 - diff --git a/patch/0090-images-validate-document-type-before-unmarshal.patch b/patch/0090-images-validate-document-type-before-unmarshal.patch deleted file mode 100644 index f4998f6..0000000 --- a/patch/0090-images-validate-document-type-before-unmarshal.patch +++ /dev/null @@ -1,117 +0,0 @@ -From e3e70b398ff362182797e2d73372f8f654ba9383 Mon Sep 17 00:00:00 2001 -From: Vanient -Date: Thu, 9 Jun 2022 10:45:47 +0800 -Subject: [PATCH 1/2] images: validate document type before unmarshal - -Conflict:NA -Reference:https://github.com/containerd/containerd/commit/eb9ba7ed8d46d48fb22362f9d91fff6fb837e37e - -Signed-off-by: Vanient ---- - images/image.go | 55 +++++++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 55 insertions(+) - -diff --git a/images/image.go b/images/image.go -index f72684d82..ad12fe971 100644 ---- a/images/image.go -+++ b/images/image.go -@@ -19,6 +19,7 @@ package images - import ( - "context" - "encoding/json" -+ "fmt" - "sort" - "strings" - "time" -@@ -154,6 +155,10 @@ func Manifest(ctx context.Context, provider content.Provider, image ocispec.Desc - return nil, err - } - -+ if err := validateMediaType(p, desc.MediaType); err != nil { -+ return nil, errors.Wrapf(err, "manifest: invalid desc %s", desc.Digest) -+ } -+ - var manifest ocispec.Manifest - if err := json.Unmarshal(p, &manifest); err != nil { - return nil, err -@@ -194,6 +199,10 @@ func Manifest(ctx context.Context, provider content.Provider, image ocispec.Desc - return nil, err - } - -+ if err := validateMediaType(p, desc.MediaType); err != nil { -+ return nil, errors.Wrapf(err, "manifest: invalid desc %s", desc.Digest) -+ } -+ - var idx ocispec.Index - if err := json.Unmarshal(p, &idx); err != nil { - return nil, err -@@ -335,6 +344,10 @@ func Children(ctx context.Context, provider content.Provider, desc ocispec.Descr - return nil, err - } - -+ if err := validateMediaType(p, desc.MediaType); err != nil { -+ return nil, errors.Wrapf(err, "children: invalid desc %s", desc.Digest) -+ } -+ - // TODO(stevvooe): We just assume oci manifest, for now. There may be - // subtle differences from the docker version. - var manifest ocispec.Manifest -@@ -350,6 +363,10 @@ func Children(ctx context.Context, provider content.Provider, desc ocispec.Descr - return nil, err - } - -+ if err := validateMediaType(p, desc.MediaType); err != nil { -+ return nil, errors.Wrapf(err, "children: invalid desc %s", desc.Digest) -+ } -+ - var index ocispec.Index - if err := json.Unmarshal(p, &index); err != nil { - return nil, err -@@ -371,6 +388,44 @@ func Children(ctx context.Context, provider content.Provider, desc ocispec.Descr - return descs, nil - } - -+// unknownDocument represents a manifest, manifest list, or index that has not -+// yet been validated. -+type unknownDocument struct { -+ MediaType string `json:"mediaType,omitempty"` -+ Config json.RawMessage `json:"config,omitempty"` -+ Layers json.RawMessage `json:"layers,omitempty"` -+ Manifests json.RawMessage `json:"manifests,omitempty"` -+ FSLayers json.RawMessage `json:"fsLayers,omitempty"` // schema 1 -+} -+ -+// validateMediaType returns an error if the byte slice is invalid JSON or if -+// the media type identifies the blob as one format but it contains elements of -+// another format. -+func validateMediaType(b []byte, mt string) error { -+ var doc unknownDocument -+ if err := json.Unmarshal(b, &doc); err != nil { -+ return err -+ } -+ if len(doc.FSLayers) != 0 { -+ return fmt.Errorf("media-type: schema 1 not supported") -+ } -+ switch mt { -+ case MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest: -+ if len(doc.Manifests) != 0 || -+ doc.MediaType == MediaTypeDockerSchema2ManifestList || -+ doc.MediaType == ocispec.MediaTypeImageIndex { -+ return fmt.Errorf("media-type: expected manifest but found index (%s)", mt) -+ } -+ case MediaTypeDockerSchema2ManifestList, ocispec.MediaTypeImageIndex: -+ if len(doc.Config) != 0 || len(doc.Layers) != 0 || -+ doc.MediaType == MediaTypeDockerSchema2Manifest || -+ doc.MediaType == ocispec.MediaTypeImageManifest { -+ return fmt.Errorf("media-type: expected index but found manifest (%s)", mt) -+ } -+ } -+ return nil -+} -+ - // RootFS returns the unpacked diffids that make up and images rootfs. - // - // These are used to verify that a set of layers unpacked to the expected --- -2.27.0 - diff --git a/patch/0091-schema1-reject-ambiguous-documents.patch b/patch/0091-schema1-reject-ambiguous-documents.patch deleted file mode 100644 index d03ec24..0000000 --- a/patch/0091-schema1-reject-ambiguous-documents.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 7a294fa5d943401ed3cb9149f69f1d12f372c374 Mon Sep 17 00:00:00 2001 -From: Vanient -Date: Thu, 9 Jun 2022 10:48:09 +0800 -Subject: [PATCH 2/2] schema1: reject ambiguous documents - -Conflict:NA -Reference:https://github.com/containerd/containerd/commit/70c88f507579277ab7af23b06666e3b57d4b4f2d - -Signed-off-by: Vanient ---- - remotes/docker/schema1/converter.go | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/remotes/docker/schema1/converter.go b/remotes/docker/schema1/converter.go -index 766c24a26..c618a33d5 100644 ---- a/remotes/docker/schema1/converter.go -+++ b/remotes/docker/schema1/converter.go -@@ -250,6 +250,9 @@ func (c *Converter) fetchManifest(ctx context.Context, desc ocispec.Descriptor) - if err := json.Unmarshal(b, &m); err != nil { - return err - } -+ if len(m.Manifests) != 0 || len(m.Layers) != 0 { -+ return errors.New("converter: expected schema1 document but found extra keys") -+ } - c.pulledManifest = &m - - return nil -@@ -466,8 +469,10 @@ type history struct { - } - - type manifest struct { -- FSLayers []fsLayer `json:"fsLayers"` -- History []history `json:"history"` -+ FSLayers []fsLayer `json:"fsLayers"` -+ History []history `json:"history"` -+ Layers json.RawMessage `json:"layers,omitempty"` // OCI manifest -+ Manifests json.RawMessage `json:"manifests,omitempty"` // OCI index - } - - type v1History struct { --- -2.27.0 - diff --git a/patch/0092-containerd-add-CGO-sercurity-build-options.patch b/patch/0092-containerd-add-CGO-sercurity-build-options.patch deleted file mode 100644 index 29ec5ab..0000000 --- a/patch/0092-containerd-add-CGO-sercurity-build-options.patch +++ /dev/null @@ -1,38 +0,0 @@ -From f7d5384097fde1e448649fcacde0dd05b7f2e967 Mon Sep 17 00:00:00 2001 -From: zjw -Date: Mon, 20 Jun 2022 20:08:24 +0800 -Subject: [PATCH] containerd: containerd and containerd-shim add CGO security build options - ---- - Makefile | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/Makefile b/Makefile -index 49a90e6..2bc5dd5 100644 ---- a/Makefile -+++ b/Makefile -@@ -172,8 +172,8 @@ bin/%: cmd/% FORCE - mkdir -p $(BEP_DIR) - @echo "$(WHALE) $@${BINARY_SUFFIX}" - CGO_ENABLED=1 \ -- CGO_CFLAGS="-fstack-protector-strong" \ -- CGO_CPPFLAGS="-fstack-protector-strong" \ -+ CGO_CFLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2 -O2" \ -+ CGO_CPPFLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2 -O2" \ - CGO_LDFLAGS_ALLOW='-Wl,-z,relro,-z,now' \ - CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack" \ - go build ${GO_GCFLAGS} ${GO_BUILD_FLAGS} -o $@${BINARY_SUFFIX} ${GO_LDFLAGS} ${GO_TAGS} ./$< -@@ -181,8 +181,8 @@ bin/%: cmd/% FORCE - bin/containerd-shim: cmd/containerd-shim FORCE # set !cgo and omit pie for a static shim build: https://github.com/golang/go/issues/17789#issuecomment-258542220 - @echo "$(WHALE) bin/containerd-shim" - CGO_ENABLED=1 \ -- CGO_CFLAGS="-fstack-protector-strong -fPIE" \ -- CGO_CPPFLAGS="-fstack-protector-strong -fPIE" \ -+ CGO_CFLAGS="-fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -O2" \ -+ CGO_CPPFLAGS="-fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -O2" \ - CGO_LDFLAGS_ALLOW='-Wl,-z,relro,-z,now' \ - CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack" \ - go build -buildmode=pie ${GO_BUILD_FLAGS} -o bin/containerd-shim ${SHIM_GO_LDFLAGS} ${GO_TAGS} ./cmd/containerd-shim --- -2.30.0 - diff --git a/patch/0093-containerd-fix-version-number-wrong.patch b/patch/0093-containerd-fix-version-number-wrong.patch deleted file mode 100644 index f2a41d7..0000000 --- a/patch/0093-containerd-fix-version-number-wrong.patch +++ /dev/null @@ -1,36 +0,0 @@ -From aca59a554842337e5e03b300a5f358a3fa9c80e4 Mon Sep 17 00:00:00 2001 -From: zhongjiawei -Date: Wed, 16 Nov 2022 12:28:54 +0800 -Subject: [PATCH] containerd: fix version number wrong - ---- - Makefile | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/Makefile b/Makefile -index 2bc5dd5..44eeefc 100644 ---- a/Makefile -+++ b/Makefile -@@ -20,7 +20,7 @@ ROOTDIR=$(dir $(abspath $(lastword $(MAKEFILE_LIST)))) - DESTDIR=/usr/local - - # Used to populate variables in version package. --VERSION=$(shell echo version:)$(shell grep '^Version' ${ROOTDIR}/containerd.spec | sed 's/[^0-9.]*\([0-9.]*\).*/\1/').$(shell grep '^Release:' ${ROOTDIR}/containerd.spec | sed 's/[^0-9.]*\([0-9.]*\).*/\1/') -+VERSION=$(shell echo version:)$(shell cat ./containerd_version) - REVISION=$(shell cat ./git-commit | head -c 40) - - ifneq "$(strip $(shell command -v go 2>/dev/null))" "" -@@ -181,8 +181,8 @@ bin/%: cmd/% FORCE - bin/containerd-shim: cmd/containerd-shim FORCE # set !cgo and omit pie for a static shim build: https://github.com/golang/go/issues/17789#issuecomment-258542220 - @echo "$(WHALE) bin/containerd-shim" - CGO_ENABLED=1 \ -- CGO_CFLAGS="-fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -O2" \ -- CGO_CPPFLAGS="-fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -O2" \ -+ CGO_CFLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2 -O2" \ -+ CGO_CPPFLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2 -O2" \ - CGO_LDFLAGS_ALLOW='-Wl,-z,relro,-z,now' \ - CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack" \ - go build -buildmode=pie ${GO_BUILD_FLAGS} -o bin/containerd-shim ${SHIM_GO_LDFLAGS} ${GO_TAGS} ./cmd/containerd-shim --- -2.30.0 - diff --git a/patch/0094-containerd-Fix-goroutine-leak-in-Exec.patch b/patch/0094-containerd-Fix-goroutine-leak-in-Exec.patch deleted file mode 100644 index d47d1c4..0000000 --- a/patch/0094-containerd-Fix-goroutine-leak-in-Exec.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 13c66a426dcbb0ecef601c386b116ad7a960896a Mon Sep 17 00:00:00 2001 -From: Danny Canter -Date: Mon, 28 Nov 2022 14:45:34 -0800 -Subject: [PATCH] CRI stream server: Fix goroutine leak in Exec - -In the CRI streaming server, a goroutine (`handleResizeEvents`) is launched -to handle terminal resize events if a TTY is asked for with an exec; this -is the sender of terminal resize events. Another goroutine is launched -shortly after successful process startup to actually do something with -these events, however the issue arises if the exec process fails to start -for any reason that would have `process.Start` return non-nil. The receiver -goroutine never gets launched so the sender is stuck blocked on a channel send -infinitely. - -This could be used in a malicious manner by repeatedly launching execs -with a command that doesn't exist in the image, as a single goroutine -will get leaked on every invocation which will slowly grow containerd's -memory usage. - -Signed-off-by: Danny Canter -(cherry picked from commit f012617edfd887a29345888d65640a7ccd7c72ce) ---- - .../kubelet/server/remotecommand/httpstream.go | 15 ++++++++++++--- - 1 file changed, 12 insertions(+), 3 deletions(-) - -diff --git a/vendor/k8s.io/kubernetes/pkg/kubelet/server/remotecommand/httpstream.go b/vendor/k8s.io/kubernetes/pkg/kubelet/server/remotecommand/httpstream.go -index 387ad3d5a..9591a5426 100644 ---- a/vendor/k8s.io/kubernetes/pkg/kubelet/server/remotecommand/httpstream.go -+++ b/vendor/k8s.io/kubernetes/pkg/kubelet/server/remotecommand/httpstream.go -@@ -17,6 +17,7 @@ limitations under the License. - package remotecommand - - import ( -+ gocontext "context" - "encoding/json" - "errors" - "fmt" -@@ -116,7 +117,7 @@ func createStreams(req *http.Request, w http.ResponseWriter, opts *Options, supp - - if ctx.resizeStream != nil { - ctx.resizeChan = make(chan remotecommand.TerminalSize) -- go handleResizeEvents(ctx.resizeStream, ctx.resizeChan) -+ go handleResizeEvents(req.Context(), ctx.resizeStream, ctx.resizeChan) - } - - return ctx, true -@@ -410,7 +411,7 @@ WaitForStreams: - // supportsTerminalResizing returns false because v1ProtocolHandler doesn't support it. - func (*v1ProtocolHandler) supportsTerminalResizing() bool { return false } - --func handleResizeEvents(stream io.Reader, channel chan<- remotecommand.TerminalSize) { -+func handleResizeEvents(ctx gocontext.Context, stream io.Reader, channel chan<- remotecommand.TerminalSize) { - defer runtime.HandleCrash() - - decoder := json.NewDecoder(stream) -@@ -419,7 +420,15 @@ func handleResizeEvents(stream io.Reader, channel chan<- remotecommand.TerminalS - if err := decoder.Decode(&size); err != nil { - break - } -- channel <- size -+ -+ select { -+ case channel <- size: -+ case <-ctx.Done(): -+ // To avoid leaking this routine, exit if the http request finishes. This path -+ // would generally be hit if starting the process fails and nothing is started to -+ // ingest these resize events. -+ return -+ } - } - } - --- -2.30.0 - diff --git a/v1.6.18.zip b/v1.6.20.zip similarity index 88% rename from v1.6.18.zip rename to v1.6.20.zip index a94987a7c7dafa592a7aba2da9ec08a25a67d924..6b8e556d698c07c83c1157a671803adf88faced1 100644 GIT binary patch delta 1002574 zcmZ^~V|Zp=*CiUWV%w_Nwr$(CdBn}ez1`Q@f9IHE?Y;I~ zm~xGx=|!7$FD~L#qE}H7eLY z!UTV8&_6nA z>Uw|RSkQmS6OsOx5@w<_IKsa&J#b#&zp@;Nze+t2jQ-03;HNq=6QKPwxFZxT;2+?jrmZ_RJNoBTbxYWqwKopqirhL} zWj%S?$}jyLAUXN=&1^Jg5R=eZkvRd0jL#=MNzhQnCP%p?0=I6%7#ICq??)ZZVq>*{ zz04$WA{mjSSS*WTmK#Pq234By7A2rG7|t_sqq8s_G8IVSdZ?a#(#5e42ni+Dhep5+ z3YDEk-tjmPk#fL6#1ZAUNZMzt2LBw@a}`1Tk-fcelWS!%cyh5KSU!|k z6K0MUOIT{d`P20}`+5O zxlgaWuq0H4$$r2LnX!_ID0s{u{KMbmTP zz+86P=a%^X(4!7u-`(%cta45_tJUr|SBo)SK7_qB>LmxXHW2_WS0s@LXhdJ2!$vqg zW)xyI#;6!&v;l(L`nOLy5RCS58 zvdkOP0tZT|bXP0oN1Lb)7~ZzA{d%JZY;N9nf4rUNe!g7t^P}%ls8^MVR8b6RTtw{) zld7#i@9Z4L!N+iOdk^~DQ0y0t6l78~9Wn6(v{z#kiCA#&)6%e6Z#4_8ctM$OyQx8l z2yXpvf=d-)>`V80J0p?HQT5!3P^r-_;7nu|OO;kL#4B2k@(LyZ2%x0=yuVmoZYUA2 zzq3EQBW+^cx=*m?!kCPmG{j?@j{dp|uZR<`2waIiP?pGQ2?BLzg+7R4UZKC{uej?c z=+ajO#8=m+m_X}Aw)UD^4EkJZy_v~{F9_)pPy-c}W3WMu$-w$Qf=%Ht=>3Am++qd0 z4z67t-H*VmWsM&Jupx?Qa>r;JjhPH1R>wA8UIoCF-$cb*E>dyi=(A|>A7`sIsy(w2 z_2qD1pR}d6*wCJh=q_|gt5YeywR&V)-pw-asO<2ppn%XWdPuBt!dVcQv$$aX{>DV| zMwZ)}HKc5!)WfO(70NO+4tuOl(PA=(h{MQ&PAOSc=-5{V0L3Kii6@FeEuj)_=}oE& z!Gg!I0G_s1K{6hN&01uQ?PMsb^##dC35Z~apa3y%!H<&xJ|RK|Zm^Rv7vp}=(9atq zi>oJ0QcKc6bI_QwtjcVu0XO@-f}U+%A4+H&y77f_qJ_vvK(&G!f$nWxMfJUwndl1j z!oWhCE$i3@;Kt%^5V4lO$?a}gJ~baIChdEv_jEPKU*=vB69tcqovICXiR#%;UaObL zn3Z6c6#lH%z(E%^rN?6BR}fNuF}76cc7Vq|564UNI>$%s0Ln`os9on7cdLL`j_l$N6NOKj&qtYLs9_jEMr2LGI|Ywvx@L#ATeK(=M%hiEbwR1T4Wd)ig5)xNA1v{p<^&w@S{6o z{zNxlBieC^P=QU+Bd}rCu>;@$6Y|p?ZOP<>#}7N1>!Bt$udu2ggL7cj-Il|x?$u`o zBI%j~WSZVLjtqpBH4-b2@(s<+oZ)hvd{dtC*yx3Dtsr$QImaLOWwNqMBfOP-N}0!H zq`>RG)M-HEOU-w0U-bT-U5a2&+S6( zkgcqX9}x&BMIv>V2;zSo_9&^`(-p9PPy9QxHUs4C*L`*k zmR>)Ekpw~%ax@I2R@PMWAPl=15|xLzD)fLE?MoNaaL9 zkUfdlq(&qpa>+QDVt6SG50*jkIe#!eQY%77HAfUc$-_iOk{Uz!kpI|5WSlcm#U2(S zpJ4V-=9r&dJ#63F=>WK`5dpMqD?T>7Abt$UgzB8i;T;U!@?d6s$Nz1TMOu5d(lnju z$km{Ov^D~!`VH)Gw6YSw;6;0|NQt-%VzJM|iff6~Cp?TKP%wz7q z)hC1y7J*B3Ry!&-N^yaT*q|Xd_=Bam>&5b}u+RhUXqoZkE%3-Ky9}4DfR)v5;SF~$ zq*5jVgBM+^pIA>yjNJD8GS39CJ1AP_RL4U-%N! zS~HlSnan<{X*^uh^K;v9mR@_>r&eQULh*&up4HPGz*9_5$!`da!pT$`9f(ZW75M6c7Y zN$e_8%%9^)KO+DwMy*plk5Va==cRz#*UR3+!Bu{5)k#w|5U-;G?HLZ}kW`3oLh=WK z)E)?uQpIW;r$c(5m+l41Cpxu0w?ei1+v~Y2Ze%4 z8LZ#;q@iy48?>!bT;U;reZy%oh-4e3T735%M>0|R~tM5xq4dP}5PAN`M1KF?VsJj-HPVEH58hePx zpe`MfYsLofOK7BlgcdEhVMC?FYdO+(0k;R}#)4R3v1={U!pjAf9PYY7*W63}cMys* zVd^9?P>OAya-__c!=6a(KC`R%*A2zRp4pmgnrH=xj@NG7WF=0CpV!+aiUu{dS9>0q zcir2($#RAfigNOeUb~h80uL3?y-6AcE-5<-Ei@7!-a-NyQVwK?b3uRr1uJ_y&5Dmk zTQZ^5#2)J&ar(#r!2P@fWm$l5UM1;Wf+P@!i$9Y93XS*vO$E5+tc9!D%-NCB0%e!Y zA$1G$vc)FWrB|4XX=7X4eL%*0g{acJl3wWO)XQXVWpf*LMa!5}{i;y$EWyO4w8Jb^ z*!}~+=-iNL&Ut?JOubo~d;&6?$RuRX7A*#4qJC1)M$4?qgweL*ulp^~^DMMH@Wh-g zFO)DI8}xU02L%gprByRx|7F;9Z8V~4gQm=bZL_Jo*>KuSdM0s8tPzJKBmRhUVqFs( zPWVbi(?nAJR?5*pJS~!IkYdC8NC7t7}=&)+of*AZ_Ju zyk}9Gsx(#U6E813hECJ%#SFho=}BeeE~^3$s@feBC+-^RxeSYOmmfGn&8b;fhD!jf zDwQMb+Y_>ma9*nJ>hD=)HL?LVPiH_Fr58EN(NO?#bMs@a8kG%?qW-Af-E*tdiP~kZ z?1i^rvDEaD0>|x|KFwJTpeCl@e5I+?VahULypiH4z-k8DuSJTo7DO601AgvwIT`Zp z?F3RFW)FaEEA2~jwKqxY%!ax#&vSq<%E-&xf{wH`bq0==JfIP#H&>Il*XO+c$zpWw z7=7inX4q#%rX^GZhX?mT@<*rnoNLNIVs&S|q-hv2bA#cyc=%czhH{^4ivFF2QVpyp_qHa*%E;Cnzoy{t zcj787DZT9h$G`8_?z&NzkvIT!aRHX1;{4SZl?JXGmU!?T=>Xo!0FbO&w@N$<|J1z< zuR$4CSe{buM{E_AcqW5Fa75rJn7|Fv7AUg=fv%hjrD#I*cFS;L?6CmASrZ$<(DD`u za~KC;lfRXRhnw?M--VsvHP5e(wZ3cwodX;8d>DXu{2FQF8%_4&PzPvzvm6KesuHIe z5B);FG}h>Qf61O3xJ5(y@unl}6O=B61`?K}4vhZ5&1K!ZPGL^JjsM(MBjo2O8U%8_ z`K}RthL=ipkZ3!=zYfQt(OKI{=_F@JBml)_S>U8SP`5dgxow%;sUF&pQKXZ!jHt$* zNUV_4&D;7uygvUqSONHSlphXklLn3poS$RagH9GAU6RFAnY0~BascY>LIq6XH_P;j zzHR+x%a1fdcHY}oNI@H52$kF1B%JigxJCA73u~C|y;ldefDVWTCj#@qKNv6TY7Nx0 zFH;|iB6E9Nop0l2Vr}AP<(`!zFl*t%yATZ~`!TIBGtf#iOqfa!fAy zTJyS*rqQ=&Zo!JG01IJ5_T83}pzsBpm9fB=SReEteGP>R{Y;u4WBQ~SeT0n55 zRV7U%ywnnD!r`6^ML@^I)f)0K==n|6x*xlEi1xsC>=X)Q!dhEpscqQ>h|eq8CZ<2r zb=cUk{jjhB+5^0pXSUp!zeaAdWc4Mzv&gAy=0vm1=_Ck==6M#XNii~o0N`qT0 zS6G$^t+q^Vo*r(HaR=M$1<7=UJL5%*3Oz+3`OTbEXn8S%GWPI1lzHrQmf$$GmWE?E zMh&IP!otZskS3YFyb7BMy`I4Tad(k7xoBtY6|=P9>H zMA*|pzyKZVWV9}Ow0FScuLRV5ekodTB(9dE4%Q{K_cgooQf?f&A(L_QRD4(rwl{k< z%SBwYZ`OI^)ssdkz~kMqlM_bIcHR+0i_g3%7L&;x3?C!rG)K|o2-9-(dJpp6L8;&o zSH+SH-Em}`wj;SPcDIf2X)n~R^lAutPmmg&P=IP=^r2uODT2gFcK&Xk1txh|af4(n zbGx1_$`}H^a@sb%+LuUm!vzAsLbb!bDkRW10>>?RvpNJJt$-Wzh(Iifo;d&LJ4I(3 zh!kGBl^~fafZ-j1o~Mr0>|Hv)k;_UbLn=ce6w`CT=vMff8gZZh`;GARg=$FqPn|_p z9RSFucdjv6g(~=bS2R+rHlbw&unBeNBfpBoVKrUidRi|}4Z`GLm5N3AhUH|y=?aab zt-l+a0Oz=NN52&YU5shrlnPl2@)cUoZyENO@}FE;snrjlMOw?I#!n(tG@NiN!MnBF z43DGi{B#WPcavVoq;&z0d&P%BQomD#6#*`*s0c(Zysf>bN51v3w75SivB4#Z18gvS zu4RXtF0shauUg+WS-S9ovM{$5gvBeb()@c!(Jy0|IRL zC(o>_?09S-O5bk73>os%!4P7r&(AnoK5~6V?B`^o6zb!XV;9BkQFgUn)XvcYUDWPr z?ku|@+~g=HwU&scFR?a!SMO5Y1b=Ke_>|Se8N*J2p(lqYj48ciTxkC#*~|kpuIRzX zvdbiy?f*qBEV<(?5=^0nA~BI|*aNuH`M%)Bg>Id3vQ<93=uR`iOBi+tjkBk0g0BR0 zuqOO`y1UHpv3OS_4@9CDK(F#jGHvuS4K$twbs-8{F3G{yBI64bmRoN0c^ywA?eAFF zSCHUBGmjlPwh0+@K@Bn58nm&)o@7D!l3jW(4Giy4r`<TW*-HzLvG`KZgf@(8mo zS#t*i9d%VJ>_w8`ceCxGn}sKv!^naQ^`eF0*J0R6Jy;B#`bCrS3h&?tuiL^48bX>^ zOY-_BR1Us9uT@J}qI-`3%`qVGI;dX%dm0XhMtJjMWBU^MH*2E23L2sPOKx8;84&UQ z1P~{_Mz>#h;mtHECidoWJT5E>9KGIl2cuJLz1|p&<3a400rA^?;O^Sq62)#*t682s z$evL&`@O^$0;2ePhBU8C)XWv{6@1bXxe^W&Ok z<+rodd(Z0@z$-d>8AdOklOX~vESMYeP<{GC7T8*R#9lKiN>v>W|7c5vh8v7Qiea-k z$g-Pnd2xfQ;^%XS3*$*ACytH|h`^+(LIB+}39AevNhOfL1vxfIH}|Si;TJ?j3o>q_ zTQI%hu>ZMlHhl99vmXEoSJFRL5p+#TMKns5tb$}I(7os;3%A+?jLgQ(sH@xjHZ9I> zw(ye6S)686-mX#U3M^i;KX!y^sIErG<|K&(e;7?WYXSY9N7*NTy2Eh1Z!6|7C_dn>@XQ`2SOr)&U2ve5TuyEIrccGl-#ac)rYI6XK?q{q`8+Y)C9Bm`;t z!9Q!1(r`^wbzz=@Ba4~gNQ{nMTsXz<^0Px&SRkaS3r}iXtYqXV2hS)i0_FYv5ylnM zZ_eSXzkvS}jrbdk_{n`pt_}hO1P2ZTLV+4V+uG5@4flQQob9aVdJDHZ7Q%dXAA?rzwnVXxN$*Bis z%FZ@wySvAiWKvU6Lm3T-PARtw*ot0uo@5fu-(T>1J-T)rHkqNPUstw+*4M)eYC_-F zK5Uqug2)(lIRJ=_a2;Jcyif+x7b>>A?n33nxYPPVK}moDD)U4YbNtkQ&*EcWZ=J+3 zZYaZ_oFQF&6@4(Ml7i@dWKUV8Ejy&l7d(BnpuRBhkwizgm(8)p=)v~4(}rB$veUgt z9d!Nc0z*tqGam|b#~=mm5p@yMcY&H2Lw`}`h7mXxQ$U^aZ&+reY+98B6%B7nK5;ZNq5s9QF4{Wg3xLc8{p zzn3jCBM0MSpaeE%kZ(t9r|mLa%O!R9FztyvXYRK0b&O-M-z1}XE)rW0?~tNU zK)dtJ-NOd2Gf_>H9_(?P4-yl*|1VSgW+gCf3JL_I{3j7c2LugdY@c{a3irRw5ta-A z^PhZJvg*3sx)`GGvAT?9z9lRTG&@veJrkKWDEvRMwf3Lz`_F$kj*wFWtg-$RTQi%f zK>Rnhrfw_0E`j)&qtEzLqJe@90?o0!NDZ70q%cyY=+f6h-r`dCf|t#DyNfhN>g(;Y z>TYaFB=X3KZ;ZR(C@l0#~LN&EiS$Aq0sYX5rLZI1XrGH z$^n#h2*)UX444Xxt|#NSo5!*u#Ivc5b#eys0{e(B1bhElaMrHC|eGEig&s3_2d zTF2kN1rmQUOpyo7v4}?wi81jayn~BI4X{aPLCc0T^^y*nFuX8F@u*J)|5l3!pmzyf zXZ3#3$0&@T4Ty+Y1aT~>o%aC5Pk7mM=nu4PT%mXFv~t23B#pC2J)xwAT-##d%mSs9 z+G&Wn$r`_7i_)6oTB}1-%Vgq`t*)Pro3i1!rQ;Be#&?=lIT2j|zTlfC`b}eYhvNjr z9oE0y3Y$Gl2ex}}h{ud8Ej*?Gti(-`q>Ga75s81zg-og<;ai_tWSP~tbNT_EZqFJ~ zl+9ex)Hq|ylItPuw|YJgABQXCkKGG0r>(E>`~(LEBCDm9YW>uF`&tdNXnw&dE(=*s zwAzMc!3c>?l%A;-d>hpvA<42PwalS9Y6E?OirIlpaeT!dA3Yt-_xgPXI9WH$87`qn zB9JQHJ3SpG=(@IDKTcn;(qJj72CU|8;rDzxR}pikXBmkCm%V_?)Fi&XKxtvW(h~;D z$ZasNhO?$8yb}Qj^9YWISaQp{RrNZrpQ{l-P&g1Zgofwn}N z^>3K97g&p67syT`p}k(5hFS)?bV>Dxuag#_SR^Z)m0gUzg@xi746*-x^2?8Icz?ad zBdJnjnomb31a7&plBE{`^@47ouB+ph@7b@b>#FdXDQi>ow_B@d!0lj2W9x4&UcoI$ zvc5dh*mKM`Qk>1K>~5S7^uAkul*9SvNUcq*P7&5+S;$?XN=SE$O);f}4%Hvm{Bq4G zi!OdbYB`goG&*jSRm8L3t244I4_LEvIuT4sOTo z#{Oo1mXiOh%*>Aha9VP!)pUt?S)FJA>3$!}U#pFL)SXopwOuloL40%50=&I~*kS*Y4IEg#616v+LAG^Hkc=rj z@F;s;b*DT#UC~^B)B_bHJ-gxYJC=mGY6jX9nVbLs$rg|C0dv%(US0RX>+G55Q5|Xp zpfgZ#r7`k_xO@SnN$X0q+Z_YV=?!1vw`~ICDh5ZhUT>rvWHC#af~m0;e_B+CdRo2Y z>P7ou>FDO_X1&!cySDSU(LZZdrj2nbM?zQm2=tPEvxJIZ>NC?C9((Sfny)vxfH1nE zk~J2eB}|Z^@4N`$f+e!2NYJ26Le2vbvnC)VGpu;b#57+5XU5*pVs@6D1ktId688iM zGfnc122+bW5d3iLbKT4H%sxgZV=Ez^oyxiuQ8odj(e5i{ogniUk$ulmI_bwmb~Yh;4zagt7dDL&PP?1zYn!0_U8RKdt{^6yX2+5GO;F zLMB&7%!>o7jF}QtqcmrkQCcj@lJ%)_hn&*2o|!T^(&2>weIQ4 z_pvD`X^gq{ta6R@b@%qPqB%&N|Jgm4SQ=$wr%++LHE?S-kq+0BNR~H8WY+zrtO^s( z3`9Y#*K#pbo*|h9;@I6nnJUDlKas*ge_i?V{v*2YIp&~Pqu3u7j#L;j=o=M4$3s}d z#E6?BSR>N^`(e{^>vlft=Gq=i4Y2wvDyuG*oT(Cs1zk)1mhEa$*?l{o|R2 zF|t@JNH)7QAYsp3Fa0$Fi6lONkn7xCY5#~*Fo%;K#n{fE&*HJ{ux;#l>mPGWCQL-y z<$}oKfx++z8L|$SwLc9w)tRzGk@Qt@J0Lj-GadVW*64Z4PY7X=Q$(YTIt8qs)0eP_ zaPylSUhNk4{swByhO$TdS>nZ7`o<8M)NJdm?TpQ#n1GNz9fLN*n0B%g{ku8p} z3?xOP3AP*<0wzzBIw^)|#7d3U@uc?-3u7&V4<>FYa_S>K(}?mt`BX^LdAAaA6nPLC zX+_Ww`N17G(T_3RO)Jj%HH5p*;c?6J6Rv?wS@3m_vv1^?rIa)_WI=;?cpT)~6$$6@ z_kX2TeA$EtoVv)yIhx@=}Y+{s%JU{|3R6?RaDq=zXO zNmxkPm<=87kN2MA>?AEXUDK$o8*R>kC9YA#AroC`7xbCo=NZ6t@%|FD8{%{a;a9R5 zsto(Md^9>&-iY~yiUwmC@clB6M223d7>Zj;*}ptJGz5*7OvyAHVjw54CSk?a8lqGDnJ=Rj z0eRM;@S|zp1Yt@f(o>(_cuo8RUWM@H)X+UFP$#OJqUx9;vnLF}Os>nvoyW)7@e$v- z{EMRDUT7sWj^N9*FO=Qt7`{Vr9ni?aR?bmx2Z|e2%;w!u9|blT3V3VQ9kGoeMr(-dmxTh;zyblNHS$_F&17n&O?Fz+ z`3GtHgtqLVQ}Xe6&{8}nHo4^L!9W}v+okefzkH`o877{6Q{-tn)cRgqOccw7m7$f5 ze%1yLao`;5I;lM*4zE?AYZ%{KGh<6!{Itu70`y1aLLN`H8U`NUB5dnf4o~U@KnJv#{akjo^ut5 zi56T)|Dt`l@<9Hgm!()?CgFg9eCbmeqbdF;8tbp~u!;TVye9VQ{)MJ3B;|7%DV~8* z#@vg!t}|hbNGf{!7e0TYo7Fuc zfSmxhMef5tURA`>#_<$uEX!OkBh+>uR)~}tT$#y-u<+K9#Ukc$_O`_rxtm0!hTn%S zO_f6Gg{Hod(<1vsf5mg@BJOc%$F_YHn>}N4tCYI~bl^|geNwdA5hSajt^eufqlN#Z zGbF56ZwK^<#*xwFve0!6Q}^32MyHuEVCBm7+yorksLO%ZEgo6b9)8Vt!=EW}uSC99 zsiA>w^CMrCqKyf69C7KTkbHQ2xTbb{#x))Y@d=Jf9nFyS7r6TfXw7LK ziLyG_(BagDc->x;EP3<O~l-2RHXk%I#iD+CDd1?0#QdXF!O99`3z2*{dl4Sq)t3G%9=#ramY~}o^D*( zuD+mdFvWDZ`4VIXvw^GA5SEM=g6}nEms5fHJT(<3uCpV{0rD9??%{d3Q-7#Gh0n%) zdgxMa{}(HMgB-9(4OXhuuf~dFfYQEQ`XZ(%xI!0$nM?{rmyZ0#xtD51XI^7`-4+g9 zk7-6{72jC{gno!R!|7|E3F=GoXCQQ*LM7p+d!@0j51>)`Oc(MC&!WXnIhwqZfqwMADsRkT>aeXCTNy}i;N)*ux1KBK-SV? zh==RrLLnGk)shJFn*k9&o-Pea$Y83c+NQ@}MHv@KxQ0|^#6;FFxAkhmjO8F4o18e& zv|s&xTR6+o^QXmnjfzl?)U36g;-MZRq+YcEHhLH2VgSkX65~xD5JATl7+nnqgnebA zzAf3LR?+L8IPz!tqMx)Iz;U?2H_Eo>1cD({dTDRR#(k>C56=!py-gX-bc})PY?UIo zgd&tlCKO3nJr7|m8c$oP)t?6%`k`FU_vzx)xbk)H7Nt_HlBbNPnx}$~_P~OI&ztQe z=GE2cyWy;gPzmEQ>b%SWV*JAXViZTdmALeaXQT7=(4Eog9&2p~PxgD*tDZ0FfAD=ke(SHCk!x!AGw{j!AauZqA9Pt2tPgsZ}bW3&P0&C~Hg85CGV&AZR zp6fdw$UNg+zp!W8n$s-z{4m93ui|aTvSo6VW&8r0*_5u*$euJm+DL_Zp~n(_j&P%m z>-LcVyUU(_vp-E04IR{@L|v;5>0I%X?|YC!n1WR}mZMG-AY_o$N6iO#iDiegpOOkK zF&XEO>(i)jV6x;uSNE+pyp%6>qyp8m0Yb&>vcM(V);mkoHB*9j{#x#2+jJSO^Vij?hKOue`%U$^vC0t9#3XYv~6_{yYo0T?{DZj7%yjj3TmDM%e5m{Y(O9{G~);9Cv7C|;Z0kcn}*PU$=h(I~0xAa5!w1O%K;tzE(l0ms+sMY380=CbV^VHE1ZsJ5JPvXMa5A#pi1y_Z^xD*2=rKi zXlK|SAao4FwS!qJ?-?1}ihpVYfm%B@k+bS6s5vz>o+#2-xJx4@jdID zX=jB_sGZ=MX&bMsN}{Dhq#&r@cbS1(ndfo=(W+i8i2({YgW_>UyMBbKPHEfLt?=U= zS$9F*lca`X+1LjD20wC{FdImqp$x`Bb(}@Z*WV8m1Ko$PW3k$KNt$tujp~QOn(=Pl zy+>jUj7yCfL}<|wacjJxdHLhxwiPU)n!hc&DOpAEyow!qxa%rCH00u_7(jB zTlOs4hYrx>qWT_1zE8^`T=SIS)lFeRtEg|T;JDDUSUthH=(iG8@_jt2!dOrjLW08aHa zjwdzdjBhL@@iPHW+`PDOJzMh=vCJ+lgcZg+fzWuwr;gy<1k1IgnPTSU=)*wiy!DJk#)K%&t6 zYyD)T`ue+q$Omo71x0Wuq&LH-Kaen@t|e|~eOoVye$!sIt}l{JI1~`NDf%%-*9o9W z7`IZI&3A#3Lydabg8t;XX4*F)J!eYobu}{L9}K^YPqI10Fa`}j!Ny|MZ(x#h zXRYL`HeXKPpmo@)Mzz0tg7wlfrcr`X&OIl_;)u|XvYt}kF?dz%?%o&=pjY9bFXV=3 zk%@Q<R$5EZy?Bly3S8mHXCj+l5FGSJesl%BLS2o3Q8c(hXy0#j+)7vunW7M zQHXppn3n}vlsVa@l(kG->(CWaFgBrVvO67)A zv=m6xit(kw>*M=SpAY=#9=IPZJ&g!!c}RL?AzT;cX<580#C zIN_^-Y7+8)$!K-XN8|U>m@=bPYF{#@z|Fmya#(<2@RVT0Fn^Q^6f|9ys%e@W*Awo{ zrB<_xFou%S-F)M0{JDBX1Dq+Ch}DDi|hDkL)d|$g$|B zF8#$^*B%?t2rS(qz;8WpEFeN%@It7+h~<#(LN_IX?jCAlu2#qU8bWaD7v5ffmzj%U z>X1_ycP}oViCq|?g4sNV*V@_&ZPZ|Ks6DmITcJfGQlZ=xu{OkVq-OfP-LCX1v zEemJFr_yvn;}!-sbiLlx#g|td_v44@S$mHgY3Wg(?=!9|AWqV1-CII|`-zO|r|Ej< z$x~Pce2F4tBP(}^CLAxRQ(RONA5Yt&l%bI@?@=NS5CpW5wJUY6?eIXegd;b{TIP`v z)lU|6xH;U>Lrx2s3=d)2MZ!%VpYa^$b7ubvlbfGE#D%Dr8_6Pg2?(45agD_hBkp3T z8MUZr+Mz490f1Z&Os1r2dd!^dq}7l9!dME>26`P7Ga;c{=hUwJqr!B{>%4P0-cXJ< zI+@JfS(F@lO&td1L3VIjq8o4g-F~t64Ra0*J~n$9Mf#tv!lW6jo4b(1s4QHjVdfW% z#+7;yy80uMrS0)>HuE(>`7_X7bYLU1roFc&@x^xHvd%hsWd;$r( z>O=4{wf7(3sQr9c$ySQ_K{7Ys(ewCx(z{6{H)oh(ulZmOcdU5{DjR=8C$^k33P1|u zQpw%Q0X!i)_X;A2G(8H~HoFEiXs&@kzt&64wAHu{;ZyGcZHXUElKLgEU)Z?pD3TPnvz*>~{pU05>n+J&ry_d7gOI)g;+%h)l`GZki}+ zRhZR4ms29xeg7)+qz>^55pyqEY(MA3nzuFM=t`YUF|3Ym^l@n^`s}_Y!HW{yGMFA|x3hOL{f|4EXeVv;*L_sN6mHf0<7}3Kr81zS z{^LHT3feNG{B<2wRiy3L8NPKLt0PVlrIO1Lthed3=cfYmx`Y9r`+rByhDsn4F1&kr zE-)FCM1XktQ)Zl${TQ8~h640pb;%$Nlx)GJ`)P%i}}Mph}05e z3b(YYX?T9^6+m&wrj>I-PJLeltt0<{Ov%Iu7MC+Fvz56gt=V-1BVV<*sy=tlJp-Cmhdg}Pte*VmK$ zYL3(s#x!fcz|2fQr%i$&rFRrb5+W%OKT;n7rykTBfI2s+?yg0bA(HByBd$HAYcnRS z(tJ*$`U$<8WUP_{ z_WL;knD688v& zX8-A-bi@Gy!v2#+Of#bZ4E7LYz-a$W4QJ2G9@s7TNjJf2{Ha41V!W(R791O z>1<8@4`@?e;a?Dg(O-~|s-%pFq@4JFfy|9k5&tp)I}@V(VUm#)7L`*L{SQkstuu21 z{9nXK0O3DxBWq}FYG!Hkf0j}Gd%!KqU&Ku^ALB`2n6AuymFwLixDp{5D+8?P%0u5Dk}0HW;uD4KcD#@#%3x{PVs+- zp3eIlle*1A`!~V_lTZ3@|0rW2A=)2JB~d{US<(NRL9@br^uJ#()Bbmwl|*Gk1(ikr z`(FgLZ=?U+YN#6ilzjeqXA$t!**rqDe|9D%`9GY33jal#Ip+=XmlSL9@1!dW%Pai% zu(FHHkbfCD`71}N{#XqhRbs6=8sHD1nxVOqp`FWr{iH=L+kaY9KCkp^#l45zrVIBt zWU-sivW%!>t0E5)Oq#P73WP`{c4d%wfRYNhy0-mbZ&Z_#S0dId-+PJu2aRgqE{re^ z*jBbz820gbArfTJ+gcmpoZY_t_tO8|^!}X;G5JdF zOEx(&4hImEnTZpI8G%O^D3+!)Cf4jccLlf3CY3$a8ZPvm4C-||72u8^wpOS9Zi(FW0}y5TH;kXx z#`(|wflQThXGLu|N^PXU)5`fKGP+01815M0(9o1%K60YLnSp7MScz*j$f6J5a^ok{ zh{ql(Z6;@}Iz+$|B(V0+RP~hOV1Hr>w6`b6a6z%>f=A?eFDY9S@W2zyRUv2tohCBp za-wj5;%CfU>2}rYJpyX0cKRV}eEMr0ANt&cb3C4c31`mchwi^69zNWfdNYVjYN|`{ z6fo1FbG%-Rjvv>rZK;9)e2#bk8mKTWQ!)6+K}usW;(5`RYcI-nG;uu1IV`4qA6+hb z8UVj{MxueI!y4EWxo)zfZM_q)EJ&ikU-re0C^y;bN(0;!F(4*KynrK0;;bD6SUw=W z-qAPy?>S!dO0)1>%Pt)dS0nMJ{=DZnBcD&}Q<5-7AbS9)?S!2b)v5CTfV?&B)eog*tj^c-?8TD z!TKn8egj**kmi^zmzviY&xFsKwOUK;vdyr~n;6}wpjQnRG6+G5Iq7K}5!IhZ;~V8~ z2+yKl4Q*~Q=$=0Sf}*xYUtF7AR|yXE^e?40`I4F)fP|s}d|tCc70{;>fP|*@p~-vF zyjzQf#YeHM2-O%%2Xs(QJ~yi&OsbwadwXg+5$sF90tqMMIpz%P3r75uFt0Y$DjiEU zl_P@r@I?YwBkvvVL*zz1dGjE$Z%enY;m@Im&-|eU+QX*x@$tJne$#R~#l?1UbKQ-i zocXyQAUz`j#%BupG2}mv>ASrpncveyr(R3R;Fb>;?#=^N$oDXxu(WB0nJ!#aO980K zMKhZ1=qvak zHBq%J#X{_#H$~trj>MQtW$8~=NBX)=PPSj^!)tYbR8~9bSjfWy+7g?mN!{L6O)=X@ z+BaCHQh#f(ag(OV?nWRV5#VHI`r{8@#+Ha1#fuglCc(wlMIJ5tn!JjB!pvr+XoPiL zP;;7r^@Qn=3TFQ?I48Z@bG)Mlk(AWQS6fJ(u0f@olPFARQq&|5*fa%fRV#1$>a_&P z68Bqxbp6gv?GIk(CRU*=^K0g#2VkQ@rG?;92ahyN>oYFqj#lc^tlc$d?nHk6%6l^{ zQdGAFe6OA(*lirJu}OaamwlxDM2DbGP7*RJ2M7MnKH=B#X1T+&kq*U)R!^*yE-+)r zHAjX%%E-d+F>TiL;b#r{cCTo$IMk?%B|J_9b)BL&Q{&nVb^=aL&6rE z62=0UM1fTY(B8zB2?W_sMPRT702Z8^GL4f*7cRn?kkZmiUsFRb<(mjj&Euc;`08}fQ9ce z310Wfhj)q$Luod>%A6_lXD6|rvaDr==-u!~?N#I;DnYIFdoLVS#19YqZp`m+d0(GF z+L02ahqa02i2Q-IMuP-G_%yPM%d@$FpH%MDXmQulhu7b&m>F!ZF2Ge3_qiKTGk@P) z;awbrh}LU5R##M9Kf?a9@H`EK=AnA*yJ7^3`R?Xng0HpOUMRFpVJouN|3<17IM6D{ zIO8g2I-?4rHkS93CpMzzA}w?>+nw7R31s>IqwAf+>wLEN;p{kRY}*YQ+qP|^vAtv4 zw(T@c6xo6GV`@yfzJ{^+yNcCBO<4viH-#d490)L5TnU zRL;LXGC++u^&%SxV^uEizQiyhIMC&&!<~Gk-4*6J6cv&xY0~N4+Y#Wad1IRvqi?eZ z%8sc*-$hSXNS4pcGXy^Oz2>AjvE#RVj{@8w1K?^B zTFL8a4-S<^Rm;@pm(@{@@Si`)T0>tCEGxfSsLvt|76w#}D-POLxF?-^L2GLHoU!fFOc z?UBPm`xmMF`vRu_?$mmM4cPosdg>(8pBy5omrMZcKP0dfff>O0hXtleu>t-hHu+a6 z|C0)~2C@O(0e?uDfa_N=&kxpV0QwKj`B{w>qo?JpMo@%z`W+6{1v^rtlik?`g} ze~@N+@YHxNz#pb>z5bv2{tg4M{#_414Do^we(VC@Dy2FEf&VdM+^EDz)sFm6^(-O* z)9`<)$CLi|bsq+Ve_!XH4xs!SN@eC>Y&;Wy`xiUO1k~dH@yluZi(PJ1{u|q91BCw_ z9bY^CV)C1nf0qxfB^>}T+&_N)aYRHE|L##IQ%6@zW7GeoPyha13_oN3SsuNEgJS>B z&GWxDdgGw~vB4wyXF&aD6#e;6snt^>Yi-kjfXJujF99(Awcz?FkqX}EzYM{%CBP93 zP)Es?$glJC2iW?@X_+^x)|ID$i@Hopw9a3I8&csAj1!B5avJXGI)Yx#$f>9RQ@gAy zI?FAkgo>e;j%GgY^9oKKf7Vpr-MPue8MfsTP8jUWW6dGZ(Tot<)7H$;r}Q{;L63J4 z6%cpI^r0{yP)RZVVSY#ygL*MR5imakTq*+*OLsOY`R2^WRGQ*~n$Q6o%gk6;halgV zHv-lo#6y2OWLZrq`<2K!Sajib{_fyK85npT%ZTOK^Lr?oqpYm%W@6y*DAE(Wws zUZd>_*beCPpNbA^G;2aPKOO2#isilnvDLU6LtsGB(EBb(~^~*EVv^ukJpM&08$74_Qmsdske~JE^9G|LU9J zgt_>7fAkLNacK)p?|!my(h6}+DpxOSeW)_~+Z5<*q&+D2^DIW^JMAh=4Y0&UdAm-6 zl6fy%Geyj+*&e-p^pr0DRFToP_!7I+QSMnou|`1bdq^5tPWGDbtq%RXe*ZT?zrll+ zoT`?zd?jsncwC&TOvl~jW->i+x&O->!z{ex!&KkXe~uw8{sn=o7<{$ zs%)mJ+Lq@H+smKG65*^l&U4EniO$IsGe7!?N0+Lbb*4!cp@mjAsMR@v9#n}!Tsw?D zyMXS;> zPZ;e8uov(<7Z2BY*iy2NeJ3cY>O|gA=CLz_4G_ZjTRcUY1REhmv_nsS_BBQgF4?d1 z<6#J{OR}(_*75h$DfoTu7s|x5&aZ>EJCe`Sc%3%nAJ?Ao_PftrHgA_azEbjZSVK=V{QxXkySK4akxw2e(Js}?-; zu9p@b=(_3@*XG*x(3Q1=r}~i2@nf z(ase71pZlU)Wpyu$P8rfvU)rpA^^Rxc$O}93N9}zdL*eKKRDv-)=cYUY5QGTPm1+; zg$J=^T}w3=Se$Mn%B`27U?~!dBJYLItYE_9By_y{g&_6boXKU26`N(@?4zW3o&4JffRA%#RkSmYP3}=x3ssJS;m0nj1qH9wwp_L*X}I$R}E>hi@0vo}m!Z zPe=AYLOaX+jGmICB8fxKj!&w$98@<##*notJ*ONoD;vl5CERqutc}Y}q`Z|JE?Vcq zrkY_Dz@c_`W_`D>U%`&pPNMdYgF=Gph?)5XbCf5a%`N3Z>E6Dg*dmXYb&JLkVX!+4 zJdtq_E?E`t=e;u7N<=IAnGtWv#lfp=M3#IvY!Bs;j~pJPM|22}PG>&zBahlQ#%sh! zB8~TZC5)^HSxJrZ6dwiobH9JB1tw!c`GlUlWf&KtVACDV)K<2-7R4dle73V5ln(F-Rtr z@5D-S;eo{Iq>l$09$@t{Y{G!_m#kjyX^E#i6Uh-m1BP>zMPi~n5b;ha_8~LKAhAy< zK?&P)WtG^VoKE-2<*u|x^(a=}ry;xLT`C;}_KV`YFyreoQAC~$`cJhsK`z45jnuKzu zZ-c02+IQ1T&~zh8=-1CkEUp9^kYcUNOLwIUNMnnS{i|wzsXLZV3E2k~DoP5e+_1dh z7nO0NjFrsBw<^b7H0Q}CgG&a)0pTS@L>NrX61XjcO=LqP+^EG8n4YyrNbsG*`u%67 z7*$=--mx@0D8!|HzoL@kr3QdM9t%8z!vxVTPP|h1MVv8N3gRk|Zx2lB*K19kjyT38y`snnkD?n4fLoQO z_(YaZeh&xc@gqN8(goF;aqF~#qHNAm>YSq$Ga5>W$<*?L-!b?0vvrlYa)k(Qv3&!Q z5@~V_K9f`lPhTn+yto!=IuJ}XfKS!6p8`NaTo*5fIkzZ-9YA&OB^8ARZkZ+g7#N0& z0@_nmq9+xn@;R=3dNUlh!B9WH)G8UziA60)>FE5v$y*@Zpe#AEAL@||0+BGBsP;^$ zUUaDJ=~sw?G4`(Fu*wC&r#{D`&)JgF5*{QbN#0a`_i{;dsDiU!Wq_Ay1=MY6m5K$WJ~}E?h#Y8W(#+(3Nre!)=Dx#->Lj8nJPv))5xn=jiKpy!@%v> z3oHr?XOknbIb`$#6X5(0B2aLdSRt@td%Ln#@u=cq+%y#YIsVxkmW64Z*mz21PFAw# zIob?x(LERl#ENq&`f%_$#ns68Y>Fm?IZ-lJU>WtbhJVS8V-mZevqW(sBMWp`wI5X(=;Zc;Kplabf{!GUe>PiU-Iq zF%-0Q>L_K~JR`rv;9yLTs{OOsq{SjmxPo{RxL?OGQp&q?yTS$ZBy$-s8fbb zPrO*kfi@k-CVNPqpTzGo6QP3_HoC!#Ve^A#ur$cl9VR|jntn6ii^Ku(ghdjyxd)*h z${w1rn||QWn7J3|@;J>=VWQx~ocu+H48miy?IxZSMUErJ2>jAVMrmR>PqbH1w_OPy zH>2{n)K-&bnW5{f+G|4zKK(6(_^MJm-u?LtAL;&1h2qAjZRg>B z%cZ1buNGhRch>C|X#};yV{>w9<;d8{CV&823%sK&pm&usq}3VnH)mKx8=jAa0?AFF zVi8tmp<{|xB)VriIy;^1{FKH|uU~vfO3swre>_G*Qi4HGw|) ztHT4~@>oXz38T|W?L+9G(jz1D;9bn;-|Khjw|kl+-n3rGG(rSAf+T{ijop|wao7B= zi45RPV4gq*W)DZM0KWd+05A*N?1vPz);< z?hT+oHWCT9f?OdD99~^u%x4!h62U-S5&0slh)t|_EbI~2kaoR3_AO(H)Nuz3z3fHf z&U;i9W&L!j(UH%4V73??g{p>b8$EyoIQ41Q`MDnNaZ$bQth#~EAq}p5Y&@bwAIEkg zLaQR*Peb0ozc|TQhP*p3I7S)Wq#uB!h0LpPSVn&Lg2R}Zk-5vw=k6je&@cDWS;rPx z{#iW5BPe1u10|dlPlHdbu(K_dPnYHRA+h|wt3|4;l7nP@GXIK}1+kAJJbp&5C z+X=jQN!QBdTsd2QGm*TofRtziwzmolaHQvH;%hStRUn^~NHki+V5F9Zs%52_J4B_R zre=2zN1wr(kRMlBj`Cnj$nF763>w`V##!e3EO|#uL>V=-P~^5mv^&??-59bg63dY+ z8*R(S)MMGP$&OAAX07p5%zR21N0i*oxFpJ-9;SPfvc^_?@@CRY6-=i`)Qr&Q26M|f zwIJcz*~D4vJXoBPnDg7&#j`z_#3R*OjAB@Z9%aU-nPyg+IV+Hl3e$mwS$gXooX2B{ zoLWr{;hftI^w)muy5hz3hRA_ko2NSmUv27R1zmeb3>#0|-o(BR)1Ed}|K|9r(08^@l7&PkA4(_Ju*}(o`JD%&ujP0FS9)KuI8&B zn1|1Icv@ZB_Z}E7$xvNr*EixtjUvRAszWNCJfl_(>iH9HO-jf>5ExVpqt9|+w2yFB zP)MT`NDqf2;Cn1K4EUQx;dJ&0Ff)$K90r4tX083g_7i*N)*_bC24&ZZ853@DP>S7s zJ%|DqtMClzh3o~SUNw?=$5$(e_TW=JL(xm0zhQPWSVvsR%NAeGxim_g0MbVMFVpg7 z4Y;n-h`6XEB*3SDVfvGJ7`qF~Jgs^e36k_fW}RhhDjbITqpv%}#;9z+2lFQBBB}`b9|S<xN~WeJ^#Ft=uJo>elub?nFEwg?7?yIGofk;abAnpD;%b>%EE zmNcw2Mr?IYbDPG39E`x@eQ&=Qtj`h)vqXs%M+uCwrB%9_4J)@4OQ*{@YdJz%t5q}78a=*Jml7vvqK}lSo-eB(B27Zt%a&({0RJE#0tT6tCIcot z^jpzJpRlJjo!L-MkV3*8_{49!(ak>C+_pWL(b8)>)hFWWrESM@2{cS|km1J@Uo6~4Jwr{aFA^PMjow`M z2`h(yi`r0<%)O%q3HI|1#$%h9?*q|A8eg3bo!_Z#eFw)?z4>{_2&bt~dDpjJ-Adwf z>&KVNDWD4Nb=+IUuIf8l-iDtRjLGwoolm+#sqbL3W$e^W%tK1)Jl(e7o^LKpb?=)_ z2i=*@+5&pk#_g*LjP2I0ht;#P4TgXlmcQ?s- zA9wbJ-Rw=KT^zTQx#_;29`LfV#mf(`*K#w4@^N{+-0-U=6eFGXVgIm*D0H^v5L~t$ zN8|+i%M3eb`4IHtn5fQF-DJEhC;H98%TL^=)TZkQx4`~*`I-_kmb@XloYtxG7i~2HbNtFcs9pytgwAM>s>TibdJeF<#a$1 z2POxZ?kChqipQiZpGM^eN%V;;;N-vs|L zX1dHh99|dWxMPtckjmzOY5sgY;r&Itm5FEeaj&)C-(Xj{gF+h1=Grnvf@lRKHgnEB zqiJKzVB2oB?0x5H^>NUp61WZuV`1I(dJ*%Dv9D}nPTBIS@S#!oS7XQaStqb7Q#_BO zO6|T?fcS;v%|4p@Tvj9Ov4zDN!IRnbxE>q1Rr)20+Wq)??y*w7S@$ z7dN)dZvSs*Tc+XnbrK}g%riRj0}F`3iQ-oJ&f zr5r_vN|dc1on*z=Cqz|H^G#653=M>HXH)0gO6#ugzp9@<4nAjL%~1b%jw{#)oC`-> z#gnhhtx?+KPPU6iXaGm1akAR)-LI0AYbzgld6udOmoyB%#ArlIc#cUoZ=3#;2A z$QjdHVm89)O?Avu1K8zzdHoLI!`Q+)VktA64{tUbh-HL0j&7AM13^=1#vrOa3Ca$9 z7k38eO>HtidxIF_D#BPs4)>DC{gND<6jr!r8Rg70Op#{xX9L1O->$E?RVXQ$u5+k2 z?3*D(`uSd4yP&L2+5WDc<4LAL7-yQ`CexH8ZWxp-Zo!@j9V!*m(N{Zcke@yi+SE5{ zsFOqC_v;@2MxeiL)#;Hq|IONIOKJ-`Ae>&1L%q0B-y9 zHa!-C*69RMHwOqSQyk?$y0g;EQM)!A@QRG=@Ki8-GJP(U|>cg+|59i`jRyfDu^eWF%~f0K+d`q3rv9qF)Xt_Rz!OU%}ML3UJVguky`<7>9& zt&WXz z#=G+yb(GWY!i@JM8@co}SgkZ`K1}6dx6uvf|&4gI2jfTL?R(9a_)9U+Q9rqI+1^@sa0led5f+Df4Ae9bSw9 zlVR#vzvQa)0b!?bKj{qcLDn_`#r9KqJoHYi;5JZ~y2x)baBgtTiTGF2!Mo@FO~Vrl z(v1Uw!=SPwsFI(m$mS1EJ-cG|%<{7yrD0Q`Sw7Rk%$*h6A``}E#DFi0C$NR+ys~DM zE2sY3m5ZM6`;{lDaq(VTm9r2MhNaX9Z9#m$4z(@Cu>CJ2a2{UnOdU<_w>8lym;8E3 zn-GAiL`tV@Jqdt|HLht;f+B7v7`CLBNo987RSNOoRu5VXx|2JIh6Nizz#$C(E2#b|(1hv<)woMQOvD zMm;U_Bq);L<~iTZ%Ftw*dvPGG>Zg<_XlQ}s)!9rzW;1Ws6>Y7R|k5|HS|KHIQeplEqLZxaL#1UPf$6 z26%+GZPBQ#sqLt)iUk!mp3=*v6*zphG-*#9_mQnsSlju2lZK#gYo~d5PK!)?&`vfm zsW!ze6(=5-ljnhv@_>RjGgBe!xdAWO-Pb^!m<-aq2UpE4-*&|rOEhfB^upIacq6p{ zG%u4A;g;@zYtgm&nhG2G{xRt^e)z)q^BdBbS?iIl&O`ZlriDm{@^?KxLHP!{$;n?q z^F(k&k0sal8*+hg88vL@rEwum5HP2}_Tqw)CNc0bb5OOKH<=A4;%%%HQ>pcN2a$Kd zkm0(zN*ro+(mgsjfquR%FZdKFM8jPxUPD%`8nMx33(YghN%+)XqcMiqdSWa`J*bYT zUamDhOAo1fC7F|MZoy{`FGy#A-zJ|o%DhQ`K#abDz4T9_V2He0PO_|at!k{KUGO>^Q1Ow`rTKe-mhNRbKTD08x=Q6|sp^`|>PG6Da?ens zCaT7ob2MYwp!-G}1QX5;sYUEYY3=nDKV^w~?bW!+xO8gs=`p?|+VC%G`FEmF8IRJ? z-{;gLNm^Q{gt*zn>7pJy=SHA&qt^z=I44&Z(CSJaWP91+73YzjwFW8#ftz1tJLs~N zQ*yeSycw9Kew70kY+IYtIdx6l>NLwsAe1Q^9mXV9v$+89h|LUK`QMf+Zf09)h64); zYzvhl3<+DPdmMP@0#lEBA_=J2d@n$M-aOibE z1t7N07F96Zw|24+V5zI70p&Y-S;}4km9nHQK4ms9kB7Lsl{Zf+GnG6K6(hC! zYQE$h=d?Xi&d+g%x7U>w`F5-~x&&Pn%u^M}*2zYx%2j(+M>KYwglvk3O*=2Dol<=s3zM`L1lS`%MB6(F{sS139qH_HBorK?RYcf3=cTrwNy-_1Y7 z2=Yp9tW44^w(c-z<<%u$9!IfZ{W#;vd>V)tTa8tzqrJCGv!K>?XL+Etl1Wyn@;s|t zt$B@@W@!UmDWXljOaq)wk!(V2O_%GyXl1$>>1Ot}td*ItEB|#qr0a6@oJi;OTP3%G zq?%@i3Eh(Q`FbFw2$ApEct8WaSao83B};ewO{J|xrN-xDt1{#D5#^ua?}?|?yp}6% zK<0ApXeMp5%$dK|={It?GE@RiG2={SJvZi*-qF^8d?t%lRNC;SbiXF4`(I8PU4^~! zOH7yBaA4H2ms9fLBP0?Xz=RQw;82~MRL$;|XxkdhjzWirvgbPzn9e(cf2_uZw@Jb{ zy{_tHd5elk;TB_uuWvMFC)EihkT(SArZqICfN>C!FZP|a&-Lg{_RNsWeN8v-GcZPV zJ~=G`j^YoQna-ej`?nd+v#c!Rge!ySM8qd7p&Key_;pM0-Y6ns!Ni@Na1T)n@pzeu zm4{Q@0P)|U(enY!pqxBarW>2I!`Qns@x2CA<0k%Tp7Z=KI@lBuir6C!!G|=G;S(M; zrfHCAbZ~o8qj&0CsqT)Ci7^&+e~t!cO#u?LZAzD7X2E-3 zqYC}boiI!O-X|d6$|y>L`CZZYbvh_3z$C@lQf+Bw@(IIC?Wx)Mv`QrSwy_VF=lD|I zE_y9Z`8&tu<=uIb?R$x{GbTe|x*a=?{o8Url>SwRmDn4=j|BIm?%Z75R-#BdpKjY> z{JP2iNoCY|V=OHJ)(7YiW^qo*7qUK!?~=pK#G*Cuets&be?{6H9%?L96P0q-SN4Dq zDy$+XrFM2%Qtk(@JI;O>;imjkOj8^u1M?;zHa6gqfK84uPy@JGuw^$=w1bI8Sj#$S zYxuFx{{=7exANikhKL1q{#UX>j@%#}s8F%3efLUWICCoA*K~ zsS0T8Zo$fnT&8px8ooycNcfiL_#Ecr44N9ku8^U4f_(>B=40y`JSsJL z77jo?YcV{frlYX8gWn3m8xE-4D6mUY3Os9|05Dp5IV)5x^*JGGhHweY|CXPmc}t zGbN*E*^aAr;g_Un+J<)Bt&5EEE-eR0v7N&m!Sh~cu5lSeei(RP=W8^?;#9w#aIv|t z&p7|cnB4FFx#Q0iFAuD6;OnDxbbWEiH9kA=XaCYVlOJKsV~cV#L&A?GCtkN9K>Slp zbDCZjbIE}foN){}FvaXdcVJ1PixcA>g90(^B|ZJeZP2t^rnQr$AhAas2K>hr1~2v= zeEchoZJ}l1d;~MUsP9w4xYa<3f3Yd}7G#anY#PQrz(ljdp#K7%70odAK&?W^x5t-) zN3OLgvpW_THaSD@VB3F=_J<9H20=7-G5#^$D&cwH-7ei;>!fRagTWI1Ye{NUgLHZA zXkexF;JU-_1u3~yt0YZQy(kM;lq;7=q9pPm5;~+73TT4lJ(#$DkuNEu zE0fFj6;rFHUSn$@wsrl-Ub#pK6x|k|f&_o*E7=slE^OvTDkSHAY5xmu$4(*jHcKml zqQjWz2|V-n0ay23prH)H7;TMxXdag?=DK1su+F9MWegDJ8&Yu8-s3gtP7g<25?QoRw}s+t-GRk(nl7 zz{C0^H?X1xZw&R1!3aNcRl5lbb8vWnwqM2j<^V^zr(qoEQ!-z5L1!cu89PF*d#Q@3 z5iUOP9Mz3fASl-;yzRmhM?Qf`WM^E;2@gBVsY=6=AYoU@K>#b}3(09TnW4c^4&=T- zbS0B3d+d~(gWrIHcAzj~sXO<jR+@KI zu&Flfv`a5fitVR)OAVq5Jwfls=#tlo47u2l?#R_avw@Bwav=sV&zxLzm(^N+je#gX zny4gJXgwjd+t45X#nki?r&V-vnzKXfX93+t|7vx=T0`z;XZ3pKKCKi-zKU`A!5Mjx5hC6bt{qxfu7BjOXq|X z2Ebf)lrqZqw9#`dN+0rAGNcy}!o%Jlyl0Ze^W%#-lQi3K8R}Mf!Um+EJngXVd=hp8 zwAVD9#OWR@5>jb!G>B^@=<=&-8MMTMLWJCHD51LSN4h`!J+%!$IiH%z4BW8$|wp6uFA%|AAT zj2@UpvPhDdPJJYP>Ih3~9iR_*@XWw!%JB`Qt~4QqVVVBL?JU997Fl?wt-@=~HC2WL z#B)1x?V4=UK21xyq|V#Iijgd!WO?D*Yl)OAj}3%}_uiVg72~~0$a$Fcm6THmG*G{J zuXGPpk|}k|L15YP>IIzs67F~eC!D*SUpO+sd#z{r~3#(%9)gEs_ z)O}zn-qtp)iX-!9y?QEoL3#tcSmWwB-obl(bUzlvvz-H;E$Q2TJ+YXYs`Jm>hW$UL z(k-3;Or`(6M={k92#T7Trw97KO{M>tZXNb2asQWl7DH#3_4z-}Mfz8#0^D%_%#>UcJiMHw+jF72v73=UHpd)(gzuG z`Y+;OwgS))z#lFBp?dfm5eW#$CIKK-@f`#0Uj*u--2a4B1R4kpL{V-o2I<`374F>8 z$A6l$Z5T^a5cuXcrc=#B>WO@~DvQm#xQ_lGcqQm;(W znRj#dBrqljH}020TiJ<-Cfzy!CRc{u>!JZ?#K_J$hF=n5fc%+Z7ffl?q2qnvLsR;NAhszkq@vp+TsOd*= zabKL9Iol%9Odg5~Lenkw+vm^9u5V?;Z32}J%WRU*7ZeFgc>>`#*6>}BXPY^Wd9DU` z%05A~`W3cZ0`+&xA}>^3XGK9OIIKS9C*wB{{7&JpBEjV1F%tT=Pk05&A|SWnk7?IG z$b&OQIgUZ-xAz$4>YdXvUT*UI{a4BNTQiKAujaiUpEesY{8#qD^cXG#R0u)~*xD^y zab9F9VW(6tbkTU&KL^<@-7CQhcN((deX2LK)C?PF5Cba0Oa6J_VD#~ToZr1Fgmj?> zB_w!ph@H0I@KSuveiwH>Q<6zxmrGA*$VP=5iT^;ww}X|zm$JrQjyKEzkKZHY&fq;w zKIV$?S7g_ZVQ`eS1WBi*aYzrOAB_Y#l^nk!P6kRptsCd*$gz68NN(O~r0L316}pi-3Cv1X zkilFtPP@o#AU-4>ra-2GhO zt50Yp&J2GE3R_={W}=5t@csn93JtKZIm}Y=s(8?PMMiq?3*#?0m)ItH2L^<8t+jSA zwkH3dKiFqK690_un$dnO$sXn+ny%NxN5;ETUqxN(+@itir&lkKXY+B>w`>Zl_RRJA zEfDCcVc~^ybD?lcPIAaN2R>w&Cu1k?^waOb>Co!4V#ZGuT>98k5Hx?J6Dx3_mx#1o z9<`BY+htEqONg%c_2B#_(v)%GKH#~ak9Uo3SR+x_I}A$^A}XcF@0#BF}cG_XC*p7L>!MpYfD3fCgt=iFQ>`Ia28_+ zUO)^BVb%PraP`?>4K+z0&Qc?=K||woalxr+6RW#-m#Wvhk&!DX?O9c{X+ofJSgdO@ zdn~4^R5WrB-X2HJL20+8BlRg0xR7Z|koG~r#Cm;cKXV^7I3g2&y$sqt| zv5A92F8oqv!vQzb_Y7Vjd1frntU$Un!hID^){hJ2{j_V8Vb&!~{L`=YSt~b1XE4d; z_P*kIh>pkIosrGI!*+(h{+M1YYvc|&Ssa8lrb6gwTcQ-ltIjYK-dFn?0giFlI`SziG*GFK&<43Cndrgvl zs&at}$#BG4ibSPAZr4#0+(TJJXO13okpHBxw_AmPhq##8Ag%BuJigd?4+s9tyC$4v zUYB@y3qQf(SO;H^eaCTW6po7^XPT}u(ME8mVLho?0*9U$@us`Z&u8K)WEnw&nsWsU$F|Q ziJ!p2HjQgOmzOm2L*~icpd{DJ@!52O1H_Gkf;mhVbi`N$A-5);5D(8XdGBE?Umsqc z!}K6;lGmZi8Up!?Xcd1IB`wmzoX}2IA0C|(C(!Z11a}_`IAObCiok(H5$$jS>{4$k z$9-GozkIJitIhuU&T>^m*c0fo+9h^>sM_u;s~;(5(h1Qi2)V>PeHUhtLvJLv-JS^f z@_TSYf7%khd0IerZ1dE1@q(NOW^eJ5)DDD4J`lU6Tr^j~-O7iq`_-Cz#w~sfsa6no zrlK(@9Ihq%8qq0=Q}_8_9iUd@tXPakkZ`}UAcl{W*^{n z2v@Wma32{pi=!7NF7?17^&Wzd)AUvQ;+y}j`BQsv=6OTo5FN6NKw8^JK#BN=}H?!Fvuz&gU}pBbWfg#799-tWE(+V{hBL=)1b&vhP$w?)M`P1AGR9U zqZvTk15#Q`Q!AOr=}m=~q$O!Lhn%NFmZ+aYfnD0nlm1lhH7G36WTSP-wCtPvWH~A0 zoeLGH-Ej=3FcvCX@AxeGJwP)^I;-<#aft49wq+LdFpn3jN&j)72mMw`de)7m$}E^0 zq&{XB)P-4;L}9T?Q%%+>vZOV9tc;F64I|Qu7dSyi$}n2+Gn+i*%K~Y`?PGP+qIIQ{ zTM90iZtU*-!58L)#%joQO-DFq-URJHMxT4yN-|TQPwvD{D%4+xx+0X+ zNV%g{=;HCsxQT(Ji&BkUc%Gwd`=Rk`dsNM98<*sbt$6+|q)GP~*?V7>*}&1w^{L{Zl;MTPq5-QzaI)5;PefHgX7C1CYz!K$~pe%m-W%s zXd{El904+z(1{^PAow%5tE(5VAF4gLMj+Tr<+Z2!ONT@idh8hLp7+xfc5={>Twyk~ zaMuag8gUYgT%m0n8A|^EBOF&^+e2X_)i%_3 z^YnYU$ZX^0<5XSBuVQ-8&8z}M4I3s8=%7}AGIwgS^Qa?ZxlJh;N7L5;?mXZ0W6ooc za0TQ+uMbvI>PE(r!TgDE#8jJ)S_a0U63%!jN8WF;kKj?CrTD=BrAXM^7OyYRvA}1t zVXaNhDG-p14fSE8ykyBa%Nn-2HQS=1Wwji%M@uFoAQsWKxkpI|pm$rJvS|$mq$Tfg z&zi+kwgcEOg_VS)=a@?*hvJ(5RN|R0QK6~>ve!FXi`+#MDAFzDOKX6^t z$TW?YFI+sWBm@C+zb4;h zK=GOs9Q6AoEdPz*DvXXmw*9D&h*JtB`o=eod%y5g2+7MHi8_?~!9#JwtRF12!Rtz5 zKyjiuKsQ}Q6vKIY!my=m6-4ZQPFjDT9B0R^uu1!e)@R5u_=U7kpPB-^$9m*{jcawjlTFFw}_~jIA5z zUE)G7-KZ~Uw@H`wkne&)mv;7RP4a7wGHF-HvP~L&mvikH-jBws!pZji9&-{5pyJfM z)J+1v;;>lCVT`bnQS-rdgY2cw2@2qwl54Pz3_fA1lL`dIS;o>%!M(csPp?my8hVCp zp_FJf89^O3NvyJn$!pRNBWO zw4|8}i&Ot8EW5$Obk&X4)+GwK5tYdMo0l=RSljBxsUV#a zpCj7mQ_w_&miC(5B3_^J2jEAPJFQe^)w6lqG<$db>4kJA15*0L*v)2zkIqTg)6PQQ z?Zqk*mfJJ)PK$aI8GBIn=gk6&S$ND)!G||(9&!`w6~B*7jUXHsby}{@E^PPAofYbO z(g>uaDSpA*_OdSztwn#@?RB_C@)5SL*4pXirk5&2xVXk?`~KD06qrru%R!coRQ`f> zB>GJ}`nS3JK2*%zUfJa`taAUmDg_VcjMUdGk8Ve3C$bWYz4SCHVBA+Yq-`CF{3 zch|=%e@mD=A#?K_ndy5&!9|?s9dZj3IK;9tZ*_mi1vS;FBL=nn7SW}%lUmQ5KRUQU z^P6(Dsj*wiZ`lcCavK=25RASvj?}LVi`Y8B%JjRx5vi57-XvD)B$Eajc7?8k-CPyx zX1`PlYoCifK=E+3>Go+)`VLXFT7A?y3u!%F`?-PoGfnKX@rMwlY9(d!thln#+Lu$c zrKX&Rk-+BHu6~l}^Ddh(OGzVP2(m^gUT#{5#(w-+-*B?bP8P6FVo-*8dm%w72U$E& zff8iTXuAEAI$id26kx#EF)oIsxX-1@J__V=Z@?J0jyEfa2wPt<^Q;0qKl~vnN&)Un z)n`btaP+zpGx$`$7_rFrsXY+pLQwgn8*7Ix?74v`<)@4o92sk-Og2XxPq z9>G&~tZau7MihhpVNv$)Sd13lRRX8Zogd#A%$sPeJ zILv;#UaS!#mT96n02duv5$CMjo&xo#Jz9m)&JB_Tmih2Yn%H8|_-gRc-4qri+zZu! zFz>xs$>gn;b@ETWOO|+v76^i}X?wW77?>EF(C8=j1xny{=5Mu*V3aS5zCf3stBZ!S zcK+Z6G1Rat@A&S%BuA5kIf~-GZ+@jAd{Z8Uh6K~?W-h49M)XawBE^k1XeY!XS^Y-p0gv1`E`c0qovGtQT z*rSTYxg!Y_k}kDLLI0HyHFzczNie$>o>EmxqwJrh&b+zmn`dlZpttY~+wiB|uDIW* zN1Rgj1d*mvdsmc30*_&_qhjroDQNjvMQDHK2rD{oHx&A8G=siOX4TFZIy8N(dCg%8 z#-4DU((|V4TtIbMQmj_PJn=0oc;;ZEZ`(0)8@fKwQlU>R?5vnloc`@gL5Akt7cR$S z3M0XrCfR0Hdi;*n}gn~Q%`lC!@y7_>l(uGs?ExYxy>84K}30D7) zuy+owtn2zkW7|$A>Daby+a25P^p0)YX2-T|+qQl4KF@hio$uB?byw|Lf9yFX#;jGf zR*m_?`=}f54|YqL>h$+da}l$1R|&>fS_iHcTP-!ehqr0vH!S1#-Frn-P~loxvnEsP zwHLv^wlYO167ed&S=*xx%;vv_E|VkCn8)cCY64n>p!bx~zANF%?UZo&>R)&8w#$iAX!b7`MBKig3Fo27eOs zpSs|JJpo>vX8I_V-hDB5N`~IAu{)Q=ZR%vHd?YUmT~~i)cWu9kpRv3-_hJTQDd4v1 zX}nf7r$E#}Z%kZ3ezJX(vG0B03CB)9^_8X_WFT(gM(zhPqr^H9bvl5f%0hKHq(7*E z)QKka5BEmvu{6&^Auj-8ta+R!* zO2&~^vyz(lCj^~>6z)1T3pScQZ!BU(4kRRx@(K9QazIJUv1j-%3D!TIA$Hr~K**4- zK}mpjNf5=0Y0_SK);x{MwsHllEPPs(a|d_e$@F9vf-Wg)+fUPjwsacw^bf(u`nX3IrCCB_26#V>UxQ{erF-nK0xvM0Z?j%^6oCI(! zPIcNu*A;Z9EYrcr%GOk+NvaoLRepGI)n&l5lUz|u)M9ZnQYlaoaoVY(@HVVOyTtyT z3Bg#Uz^T(fR(%sJAMHyeP1Buc&nmnrfB&)30;6AyP;8`+&iZ^=l3m`0Ab4=hw%DB# zC>#p~Xa}j#?OXtq*V@4`1=!PX2P-Ao@H`8IAx#=}lEy=-nv?542N4#|;WGXot4jbQ zyz#5B3IA9PxBvpQG${5qdXgED<%xi-Wb;Se5=!9aj2inj%R?cTBix9?t@Yh%?SecG zewga^Z$(B{3}TfGar$c^wn=Iu+>-c zPr97WruoM|AJ&KQFo$ua=^&&OYXmwqTGVM$cZE>$D z7g^QVMdV7bwQ9Q&yt~e`4bSK6rbO42^kAl~UV+knoHFSHJ&;(&?BV{1W)AkKe1uNV z5l!PZyGKjN{4HHeC;~<*(L{cOxHRk}^MSpGbGW&K>{7D|(CEKzO9rfrY*;Zth2Y&j0-cz$7=7{ z=ui=xaWqjk(?ojBi8>#f>}G&Tvpt;!bVJt$oI3fScB%N`SYso%S-Ro{+2v+ZSHCr? zTejo+#CHyRRq%inqmZ`ryOrf24#`G5oF(OoK;x`~^l3&vL{ep)^ep#AC7m@>4lBqCS8QlA7X;?KB&>InD<0D` z9B8uE6U^wTD##P#{&spf0;)(%HSa#;?bmSMM8wMEe~9IFF4eKMHV_md9hnISdItCkwSh%lpH4&?vibiSEB!;;NnSAZFKaYM9cFZy-JG|x=a`tnbfp-R6FPKbCWb`9B5XSO9vO0bSQ z;+k*UA@qr%DInPN^zF&1brmHK^kf~;V3RE-Kw}S*W zege{bCbHF9HI#r~{$E-OsZM(EyjVJII7zGVAU14wXIO%{{g(t}wQ zpt(+CXF9Myba1h?>D{c#Pq*2nud_v0Z9Cugbh^9oaB%DTa*4CGSu*e-e|j}`HkL{Z z2BmhKdlx}~1P>W)DRLTgJp8^&%8{EtS|JNwd|m`t!d1d`li%#cT!^)k-3Ej3DG!%4 z(n57fAe7^w3b#8HMSi46gmkGY%5D0@1t`&Vm#%iR>lT78YJ1iw84Imm+2@(UV3 zPh||Syg;2<;qS2=&|Kki3u(o^exi%HS}d3!m;+tm&@7*cF(_dj$x)Lx;1F_n61{Hd z;Tb#fRUMErEIr|UnKP2dK0X3_dC#^1?Lbact<#}IiA3^cs8f{Y*~kGRI9#X`X>umz?aZQ@~8Ge3{8Rc1Yt__Baq zoZaD0<8Z>(Y2T5>kU8iAe!71DT@xo!hbK|j{tF{0^9v1pnfb3$OX}EFn)ejI)*-b( zp*RK()WV+S=yccNAq4LzCQUFHk2vJ5!;h~XV;Mh_e!I{>wX9&HgJa8|L5&A zx=UDzgn1N9A?nJ)`n`(w?a7vQmBtmXoJ(;W1dri@6-bO_rZa0 zSTG2``c`T76oPU`z4zQT+XD!>)dtw>_j%X@G1Cp~fYUW$xpT3H^LO`fIaw$$QV!gVa$aR-&XGv)LMjW2x1iY1H5h%BeTsb9c~Vpp_fjt?g@I8i}x zbOKeF#LYAd1GtdZDx4T_b@P{5p*c?`Htwt1#aPAcOW+HUn#;~oTiFKHr<)l}JCXrQ zU9T55j%vZN(ilH0l#I_gCZU73V=!j@a3{l=SFynESzw%epq7Qa$enKbD|tTi9GKI| zPR2ix6>d#f%M|$vBR+Er``|j3@6Jj>){1Dn9w{Vmrp>yQE#?8>P!{~YLv%08vyX1q zMP#>788r;S>}A@Q@0-b(czT-K*Zren+5;6w7o*6n-GJ%ZTDS`Fv5QbawzfB0-`lt= z*sl6OTQg~o@M3I9TwJ?)b2{)_EL_YJ{f`AB8 zH#@%nWOUGjXPv+tUE+BahErD}%b4Tl(bSImCm}sN7ecJO9ZW6A&5vrF*~Y8C$87}O z@NQNKN$Xj@C3{}J;qC`Sut%U~!lu(>3SjqCw>-L`xa_9dQo)eq~A%_H{RpJNUcwfPRFLk}%f74%9 z{da8nAaP%~invxH8A~RdXL05VJqg!zAe=ev`b(Us*Q}xr& zW@zJH4pV>Mv2-#8TSe<6jK?rE4AQ6EvF=pUK4GFY zy1+9yR#ySQJ-D%#(VHDR%(7IIXvr4Ei} z(mX;7_2W~pN|=~WUe1)`gWA{DSxOM#WX}=e<0Eg!Ov#Jh(Tj>RMs4G>>-Vit6J#yk z;7q1AsYEG18>bYhPAa68>`dAd97Ll$pDyoPC_Vwoya^gDOKlnnuG$vI)hql5=n9!d zw+yaHRFhS*N}}Cu6N+yw#}u=#?`W!lH{r%5JUi9of~r*3;qNL5ZFIb6%RhwMkLE{R)3tKmU4!jx@A6v8?Q-1ip2m_t=%y?h z!zlm&$HRz*`ZI6bcio2IPY^o&4I%h?U~^zo5s3v z9WyVDwXsFhVDv^Vv6=G<>4sGGYG42UKFVnJz#vF@Fja}p1Ev?=l&RdHj&Y*gvYF)* z-G`5;V_p2nn>sgdDN!r28 z0w_-G_-O1bBnn3X^dxGYq)tT08L})^lmvp92-r_aN=!Jj6qw{;ycaRr zPAe!p%`$EdCN3-~;%;GYp(S!rUc)Lx8YY%M634G#U0ck9=QFCw5=?D06XpV7KVb*% zp-+f(2{ewE+d3<0`M)wD9v0HNfD0~POlM<_!-^-6x z43U<3mXEOVA(imUWxNehsFT_2ydhLuovwu;F)74rO z3Ri<9V_8+}GJSYkk!6R zF5!sr^D-y{NP|c`h&y`@G}nn^taXqrn1%12cI|m|j$$P;;&QnIVZ|A*FDf<^-}fU} z8FtNQC^&eqMSRs%Wk$ycLvDOhX7PEw=G21He8=SWz#9q)2^c&w4vHJp?z3d_0NCp$vS9den62#*3@+tG< zie}}o!IwvG67IK3CUgbBeE+_iZM(kbXDZJU933m(ud;qeM*?jB=+uZl2LXy^dqQLi zavNJi4v&&!UZ$#XQYY&Mm~(`6M~4qAM&L*I#ph{D84Vn|0}?ip;<{W$)+QZm%PN1o ztc-oH3gXY58J0`*0uxKNoW8=DGPN?;9moEy7GL8Q@zL!9;__C2qvN54bqS-{yYSu> zZ(Crl=ByOaIRc(Gf;0mj)PM}%s6tNOQ6%= z{kRi}J<#=JMkP8xAx~<2k3_IMTW_MlIj*u(*gnXDve@CS8LKKDst&HkRhHfF3bWKS zehYB*z11jgNvwg77;y1$o?5_MeHn;*Vk)nYfsu1}C$JK&hT^!6dCQE7Ir zK`R-wWNcfvoRhmfyP&^b=kvl^3gd?_uJ#X$r!hAi79K|yemnRJh4&Ys9KS%;UvZ6u`yM>z8Ox&D{=9Zk$ z8g)DK3)$rt6z$fTMgkCoc&tXvL|%YOxh_lPV}62dE$?_doZmR1Zead4cLR5N;Z2Wd z!gUcQD*2nyQoh}~yY}n-gqQHz7pAU>s;Hj&qtDtEz*lCl8-KQ$5(((m1fIjt?+zO# zUp;vi3Ai;XZx&x#R(zYc{kHoq-eGD@7?u-fd16~t9xFAK&$T0d>b?-Ffx~OUMPJ(} z+_+4aDP_TQYh9wc$F)j9!#|6z*{XRBYtbI4AKk#KIdgR5l(nSM7f++%5<6iT z`Y7rFpm?lNsuy$eRN_OpkN<&qjnzy1Rthts+_$FT{jCHtMob_JLC4S49koDeoD%XT zqUlN-NKKr|At8`)u^%7O}zbbZ^S6$hNncpyCL zn1HwE3zWbif(sPB-hBn-WD?^Fut{TO+j8Y8WoJ2q|FY7|Iel~pE^b4)GP0j~rE}i3 zGX0v@0Y%-1(tPsoQ=&CK8e^i-fxs~M^VTNIL^ocW%0(&YKfj@t*x07#lVfZ%2sr`{ z@Niebn2JWC{o*<#LAgP};NqsooI8=xcVNYd@b} zK_gIt(}Xq>pCcmI&;>zyFH#Pj!SW{U{S9XI`Beq_76wQGeM*RU_i#Sa&*=^Iw6oOz==@|?MJjrKL}kUg4Vu=jSCj-@0HWbiV@=Y} z+oU|Yvw>4YM`QZ(VZF_`a}!=oGp~q(l8qdUgKkP(3NI!=;gps_IewB+4bt+8^??ws zh`UKhvQdUV58*)*yi+0r)x6ry(yI#^b%Uu7Ta+WOiAjJu@CI3HxcjMaPOpPpHtq^7 zut9Sf*Y&kcNOLl zktY%CtyfkB{G+-h^%vgh&069Jx&I2sQwcV;vOM^>jbE{ksR?p>i!8&*-6NpOoJ!*H zps%#Qdx=n9s*#m8#;-*cRK%%k^3iM!i-zy^wh6iir>9c`Y;pDr@Cu5Q9Z+GtaV&%` z^l(4+YR)Tb8bNwM^l?3u=^3QH&170+g!|np%=fRw4!uW`V_((6}m$Ie460dgO|1 zwhYztmZuPzm6oDBz;sGJuJIt^fKiMBPf+fVNryRi8NP*oSo_Xn$Rf@8B+yQx z6eY729m;5a`rL*+Ekb{x?0UNleLh{?`Yq>uIlI-g!`Y+NbYAl77)sZ81}AU)lbQ+d zuK-srHHZ90As~@H`lX&Td|VWE@x<8qi3Y*)1ck0>b!WeIK>6O~FftXpG;-w%!30f5 zrGNG0aX=+oetHI0m5#ButD{E8AZ40BSMc#NoF-lvIBLbJm!s2fwFb$CB;n_OlUVFsWnRaZ^4qrMvmf zE)T#SC~EaZWxt8!eScG~%l%km|BQTw1$O`+9C|OiXmUDVeOJ3nC*@0s7`1j?tObov zX9o(T7Yv4NMIbPfM#E_LKV!a!_$8Y>?<$NrcL#C@aOI`V;X|JMO($HPNO-gc&yL$Z z*)jI(CpehRZ`xNL)S0*fO;3(3r8bwfqHc;?y}+7^E2EoI*cb!P+KolzSk0AQ+)9n@=A+QW_PsT)Rt^ zSq9YtaA*=Gf~x+a$tFtaL#9GS=3lQJs~T~Tjw=nku05?%xs!eH`?R@MwHQ6i?}}(! zy|p*6$fJk){d5g2EY$%$xsb+kr{zTel2D}1LXAq&M5;C|ZmqBg{+-rqi;%f^HCDCO z#AYJ9BCTR}Q*-r@O_kWsUrp-U?uPB>+;y7kKN{lNzL{G5a5 zC|WdCVw+|=uD#$KF=wtDK>ZE~+mXg!pwoVyMON)+QLbCr{<}p2fMUd2?9DX0 z!+xAR9_``%Gfd}x<{#DtA$VwGI6huQKzSBC z6xdv828VJi7wSzUd5TTmbL3JH<}<@ALQP)j4eTep=+DF5Lz6EJ3+8x?Bw7DAL&<5K3{ljrOt2;^jY9@OSVTw_c%lw)^AsH`Ro*q*e+a z$o1CCn<|Vl%(9`7h?^?sfEtyHTI-#1*2&h=CaU7{$0Zkpa&q-n>q#^A6^~M9?J+xa z)=!-}$oMS?&K~Yg7{jW3m7s?E&cNL>madx9hF8mkF15Fncgv3>_`k|%o|%kPm4@lU z@k<28E`TtR8qkBC#+&9_w0KgsDO7A&EGJKW%)Ig4ygcE9a%}nqfD?asrdGvNBO)Vf zo$Z5Ko)9i||UTOAhh@`IxByupVDoRwJB`CZ{YQ_56zozeL-GXQsV_iP-i<6TA| z_p9+?@fUH)SL5>@0CDEm)ZxsdS$bh%rVz<*wNp2?#&98*JbQF4l{|#$fn}4Sic+S;%&($|BK=|ECmbLcQ_Ocu7T-@oOD4!Xo`*7Y3;q~eumWEbgt*)&# zc$mzF_zqZwhI>*<&RfQB%x4plKKeDB6ur5mjw zm=q&zALc)qW~zn7{s-{X3Zj?iilk2LkGSCKA04y7dyHQxdyK2cPk&?vkzR44#!5ho z5i?JPi#?k%%l-N1A6|j-&_oep z455p2J-5WH1AGy1PAQg3c?Nsz5=Qu;es_s;5RBd}>1Bl@0`saI0R&toaX$#conoh# z6w+@_>VgYz`evVPrMWy8Y!FxYRaUB7M%B{$+GA+<)qO|S+pg3SHRUJg!dK(G_zxPE zUe;k?u`Y9lPnY5%)^t7^>Fdj>OQ~3~71S&}huo4+0ZY_Q{?_`{^1Lgf7e2$s7)fAf zb4|MXF4lOgj);vj)UFi6SKokElli(v0;-wm6Y~zO3kPi)P4r%+(fQk|skBw3h|*ZE z_pn-!nk)cDVBNroB&(`4cka{b7pAM%LO(QO2ks1CQ#B_SMFOR8LEhJ_t^tP0mV023 z^g|jKpzh#p9R9xW5YuF-1$XAQ4OcZwe~%sT_%V3Byu`w~xPl@1U8|AfZxnExxG(fjV-+Vy{8lHV@MVgFD1B+moLzdkSW z5C1#re-Q+;9zdjs|Djf%VS@fsA^#rXM=~uIDD=N0aAARBf&UZmU-uKDt8#+>Q9b{k z1^Dk~Y;0G?|C=w)EB?RJ{3k5=>*{}TK$CwLkq|do5P+Kg%W5R2ajC2(00P2508Vx& zru&E0_)iZ)eo%yD+#mm49mNmO7J`4u@{YK!Ycb!?z$AQfEIi>qW%>Vh_+M5yT>PME z|7P+Z{w2h}o-fHiCM&W3KeFk$r~79&GDJaf|8FExPtku<`Hms`-`nj5oXjf@iu?~Z zb4%o$MVSEzC{_$4d4`YvpDg|}VDi;%Iqd(-?xjc^R1FqTvWg7EKVQYMHPXc8U9MJs z+PD2T%K}YjWJQ8K5hI=S{Q|zPFAHDNuC{EzR{!PDKVViT9Aa<`W$X51cUGFG8H4iQ zZwED&l)`bSG!K%QRIXHK7a|K?G6K)q-wc0e5pYLU@hQ5vR#J5S;OkQ;X^h{={H%d1+mwwRZi?S4B9^5Jg#hcROpcYbYRwJu!( zVGTu*jfaqt97U&rPn%GYArbDp4ju|Y?l(niq3Q~7V0A`+R_I~ zs>Bm9vu3SOj!PlME=*l5R{|>A!$CCJwnLHS9#l2UOIq+?jm*@7fGUb{>M zFClgq_d!eb@bZ>#<1Qt9okNQjl!t}QNI3?C0Eot#_=&20WYBSsg9!iB?jbW&Cx z1q^CP)YChuTZ284?oAqqIehph+F{ZtBBa1qO2`SoFb?0y%j^}bM;-?>yV zT)`D;T2#6Wh%bBE-8n?8i6jw_CvDuoKy|;)OA3aBpdqY`Nd?6whC}P-H7?=`D<% zm_!XZtqcY-5J;SXdOTT*W(~R9sxXiCde-8Y!-dZo5%Y=dZHtm)E1U;tSCCow=1+n7 z!|m|}CMpH9@mhdJQV#)voC~C6i2y0{^2Lf|_=1+4P%7>t*FCTE#ztiOiA4;R&S$IX zY6(kYpQ5TeuJ~X;d(3Q^in~ILGK1`7jR^+bbN`HCyFb!6MF*qKfY$+cZWN7hGYGy8 z3A3}H%DSzm8*pDuDi8q3(kB@52Zw0sa{evODIrQ<)G4j#m7FhJ4|EhxJh=+YgTh3b z;mklQ`C$y7vK)w}4!^fQ;(%hgk#xV9(?8#dU}fHo*+6Rgmy!pX^}@3jSIgCMR_c_M zvK6+3qvA;Cx*wS(G)YbPR}eAGULGR{cYGL-A`9boPCaEP5(E^$3>1ukn1YzY$5@{0 zRuZ%7SwjnG5PA`mFv33IuP5BqnUDyUhI$m(@1O0zkAy5?RdU2^xc**O?H}sgfcTJc z02RiprtS{^*rNM|ClHe(XQkvFXxVr$+>=H0*ow8!T#8scI?bAB?>-x2L;~`Yr|Q=l z<~0Z{<-XI8V+u|YKqgL)XB*Ug*i0tnO8^#Vz;kN>&Z1Kqm^!I3N*Ws@6g9djI6LGg zQd$UL?rF5A|Up9O6>s#`iz~}D2fbayc5h5LD_0d-_Xftig z8IN6pjD8;ZZP^_ZhIV_FN287v+=enML``~yXGSHh%sVAbATFIax zu_gW($4bIw0E0c1GNzb?sf45HLMKTDSPx_wP<|FIB@v0PRjC4SDIVm|Ki=ma(yK!w zscD$V$_ko>BVlfST_}y7W#*XcdA~-kp<*COV&_#-3G27vkQ7T5@d--lD5OpX;DCHT zMWCO2_Q(uVIIj1*dzXaUHehq1ODkf@giUfq?Ol;10DD4Vm{orfSOd3w%8179D+Ti_D9;`tcx7A}|HoBMHO|_IeJC0}1L&227zj38$TBN?ZBt!U#L1 z$AR|mR57XhYFJKJF-wBQfyoFPT<9)O)Zj(4!NC)Ov_{0}4hfXTa}6AIHyCaLW#v>5 z^P0n~0t^`wFc%8ux3MM@v0+Uob8rNUstVYyI~n8+`})OsCCNr~v!xLXd~IGcOwCI5 zdSHRU1`l;o^Lsu;abm`whgAhQ!d`yJixxpt`hW%(qs6Zj)q_I8FhfL;q7_7~qfv6` z=;hP$hX+I)TlO@bq43_?$6iu%mZyYf!R!uC1GeRJ$d8oT)<)xln7qs>Q}LSxX#`co zgM6Wuec5>hrM&2Z(TKoR!Xv85kPT#kMu^C|hLafxknsHw(-Gn^dJq!Odku?YUI9Nf*=hUNl3q2#*>;iUo8io4JUGX=YQ^wndzmHLgEVa$00g3yYHUND%OlN3;ea@hRv(8GQxS0D(QAcr8mif$EI zBW5u;>WZ-Z^ir5MGHEC*>^DS2hKUbv1=RZ+nJ9rLBaCs#uk%F$->Yj9qt5p466W=m z7Qp5p?*clA`$RX>d zf8&~DtaJSs*i%p%N_#A*jX>oC;b5S+Qhb0Y+9Ca9v{TQ0xnvA>l4^d1QTWCB1H6!^ zMQu3Gvosb(nuih)XJk`_h@QmWQC30BAg`inN~mAD%l15&p2%1`Vj@)(SrSGn6cpg9 zQPQ?G8Ha53B;W%inLf>c`^trjiJ;3~(TWkV^ZA z`D0YHcdHF}#@1egiVBp0G|i~q1Ipqnx?(U~3T+Kif%?|e90`8d<{Z?B&=CJn0s+G_ zk@A332krv4;Z$^#t!XZ;0P$Ty9cbRh8qDsCZh=Y-$zyQ%dqOGgbDgP6y4TOsk}G0L zWXvJhj9tP9fj!e)N^@xB&WJ)R?q{R`LInh!uk4CxK)PXEB->J2TjE^w7XUp{l=)&h zG820jyz~&HH+`rM2H$HaqYf{c-(zqricD2SJXFj){N&t%*u@rKh4{KFp2ZyYJfqur z;wW33-O<+kiuZ*sZx`h6`rtA3?Sdw%y8-1*Fi!0Qw-(qlCg?NOIBB#i`K8@0E2 zZM5m&k{pXS5HW1_;|_l>ePrA1-W&bn0G>o_k`X!c65bCRA<4*UZ*8ip%dvGwq0zCw zN-go>U_-x_kfizwqGs!GDK#iRXRm&bn@(uxAlr+G|JR>=aC|vyGyo!R(-i;5&D&kc zE}Ul;?#6uxa-@{MyFpAE9zVB`kTnh zWzCihQz-NWr>!(sDhA)b{}^iW_IY*V<^)<_|l-O~z8XMK$@NEcdD zp4HZ5?Ca|?2xbgfP6;9e-N=CcKrT>bHk$=uB0lc}zy4uZpz&wtLMYMW*+%C81c)Mg z@q-T2!vrqhUs?0A0MVPj+WI*jsTc1jsyl)Se&U>n#8y3PHh`nH_A7Zyh)sz)H2f#l z3BfBgr=t$6KVu8AbS`1a9!A>G>{dHwkZ#5Keg{gE-$6(`N!CSf1Gvo6c)f@$d z_W!Dr^_W2BWB}G38&YB8uyU$oOv|B5IY&xmF-X~wTA5lZ$wW1L*9DG8_ZwRi$jP~F zK2H3MhYhP`{L1C_9UWQb+vp_Xd^(vltLQ`z?tj6gWqA@y7Ai|Xovm3xiwuV?$*9c) z=~J*33UHEo%}L)xp;E*PjZCRC+{A$Vy0{dHqde@rS_VYCxj5HdK|=B;^q7F%XH0DK zBG`1{k1MnyV>wl9AxGt)Y2o; zn@H?-zl9o}jy1sck2zdBoXV4K{K3X-7+=xYBs3{&!#oJ$m|i$Akj~PrB7Or2gvCg0 zm3od++y=nMtM)=|!KgvkHD=#0(hVPo+HyH*{OPfQ%e$=CJppfEG+!YxBgGgW{DGw> z&S@cN4HvcJJvjiYXQWVH?MU60!wNBB@8B{5PAxn?C5BuQ&ry|G#TTg@*J5mPdpi5f za1aHWt{(l&jSAAmf9&CXsN626ceiHST@Cs0N(-o-yWy(ez1Y0Pl?~QkHx$=>md~B0 zMkO|s3Y?zPNPca(3R{)e;KlL$Vh)CN0NF#Fqeq;dV zZVE6fFt72&N*#rt>Vdi*pA7MMl(!y7f;=<`^3Tjn%(LKNWH!P|^Ctqz$|MZ~h_vxR zi1n@Iag-?VfzRNL#3+%?0F1or}OEtOcS0VQtNd!ixF?9 zfAnTmNeg$^@qsY99#ZHJBI=gmIVFC#^-n1Et-*NRJIWv6_X9CG!WzQo?{b`xTC0- z1V&ir<=K(Kr+N4Lt;)PtD0{*lG_EB)Q&i9@bP!c1bAw-jH3JB4 z2mHSeI5wz8!(13Nk34?Di|`JPKFB-5U(CVx6FVcG@qEwzYEu0@yiSJKPk5PA4YewN zs-tP44<8yK#FyDjO;|;WT?%QD5^e=GSlI^HJucKlTFv1Lva>)D*vt=rR8=>47a2Gm zWDp3-h8)vENs1l~$s^Rzehxjsh+WCa+ex_itg5SA)Qc?p%fM7OLt(r7B16(1l=_n zA5wL$h`+UGs^EY3trwuE+YS|gs8ijrh)U}QK{%MaScFC=fx`>{q`p0HQt&6DO36jG z7+#B-udgU?xtMm!)~k9LRyV;;_$5tb-YvJ1vRhDM&Wl6oXSTih zb#52c=aPQqS>3V$A}O(c6PCUA^r*vd%IJqOrUsWD4+}HK?K^pT>Iqb03BJR%b+z^N z2}Tbg@SMbgy)D$RZ&QFgWC{!5*bQ!(%_2ZP84PzB$1Si42?1d>YkzdVjFcj~>s`L4 zqH;U?<4#H9Y)?=$#ZVD=KaX$K*3LPST%iLl@9ZdDnle%VJgn}=%yJz*>hSNPS6tGO zky^DSnhs+3ruE)HTmsd7!k>gdZNGjzgNI-zWV=xCPx;)|VHa}av!G1o+JP;ZZ(lH- zhP+R*L?zphljOlQKTEQY-xi;^%X*gGghK!BO>m+o*<6ssp6cz`r_!JOKx=$BbIorsg;Q~?AvI& zZzUmt4^ea`Hb~Ff_C6_W4-ghHNZA-ZEMgfWyHPU(27eK=Z6VoYncUH&n^nqZ6?P;V zYkR*MnP{MvEdQ>yohuhDP;bfC(>4n5>{K)LCi}K|ab@G6W9K-m%39?M|6So@-rx1Y zW+A*oER?%baIuJGzzCqO>ytFL?&MrWYFS6J;8^Qo4bmFl8ijK~!A`d;aW%Bxz<^ll zb~(fVfO?FCCH;IA6j#3Os~1u1B0rgKNcOjmX4_FeZZGctW!T+RFxvpyM|>&t(mj_CAB_9J+15_s38)q1h>h+(fEVXs zGk|f%6`lsUZ2=3~k2oKdHT<;N%j{dL=WJ(jW-+Pin>Lx8e5=1_eE!74$3aqj zK1Q#&dQC4G8?lB4gdcmd;mt4j?EX&koLUc8Y8<43i>R#XoeKcOU;J9@^}`0(lsy|Z z;dKLve2Fb1r><;oAi@p#W7EZG%Jn2AVNWu07JuB3uHz-$eWr1KTr`V}Few2+=calTC!NpMK4IYw%|ckG4$by_ zUf$Ge1ssm!~Ax*76!9IT09>dmw;X|5(-;e@oB@2ovFn z1ry8CQ@AlstV?OQYn`QWs=8$Kzad*>G#9y-meZGGkDZAPZhJi;F`$xX+8EXtrSakY%wXwVB44mLWH7r2~UR$8=q2mxC9+WR$~ zZ9$zTRIH(O%%(RAy}V(D@?giVcjcF8`J>9ZJb+0~FSEJiiRA%^86-zEE3V3U;9kFPrV(wImqqUd;qV`@2|IWn zy`%Tlwsnvwo1)S$%cf)%b0W3t~Rx<*}^bpl$>55Jp~1Rv;sk2=Tux+S(H_ z46*CX!6*B~JCMc3`A8!}4657ISH&(tmi< zH|!zWO*^e^el}aTLZaV{ay*(K-aYJ7dz5rYF?Q5hkOYv=BgdFuM`#e3j6b}UEwbA- z+s(t3yF>tBnNZHq$Gk){_ZK%v58Z0aa1VuQj1_qN4EcgMDpwNN(<{aoHw-p^99{1japCX^;MDM>ho?p-(?{jzH5tC~hnD$gq_JgoOf;s;=O^A5{knH` zN_A!4Ar!E3(S{g_#yp4E20|_4K(P@o2V;8g>ZKihv~rc~%1C0Gx&Hg+#-(967i#I4 z3IxEMkc`ZHDcXa~neL*{aJb%kE)yEfhk}-o-m@gE+C2kHIG<6LF;yg6)z{BsGIC3; zm4k~Jpf87Z)y8vEY(A-;zXx-bzey)=3sM#TAHLo)u8wEf_r~4b-GjRm+#$HTySpqL zf)m`G;O_1c++BmayIgj%|K~pYJm=h344YDDgX7$Xs>qlGKNsUI9cwoH4Th&B; zOhV&GV6{%GS5^lmY3e{L!lFi!r`5!9y%CD^-BB!CZQH$%9^mAqN2n|aui$&`;-$+| z`99#)bv85YNzuD)bEk4Uc<^9kPR=>(?2GQ~E#}ZJ(9Wl?2gbdp_#Lil6S*!>OJhOF z-u7cMhr#xEc#T-FN!)(Mvt^WYCZf%gwb zk7>#-+#A!^BY^MO7UTisRpgV`npO8+khlP!lU&Rd?e^n9tjERU86B!9gUrKd-umrA zMP<7rt=nA{p{mA(0O*BnxAC!yZu_Uek(I*_dr&YP8nK*5N?)Dc352Vw$-3J;#Md9e z$&l^6;ZW#dS~3K$E8zZ(0~AZysBo_zI$88x*msgrf`B#aQ`EI=U&plewRnKXB#PA) zi|=caAn)%k=0^)q(?B8GaDw(N;h{M{Rcm_uw{ATYq^wRJ-6;p#kZtp=O9$xQt=P`9 z@4u9y8Oa}q3M%a(f_$qE)|>e#UF|aLxDl2}U^Dm+~2W*WSsfw}w|= zr6QjTV*#!-Q6KL6thJ;Sx#y#d#{1Od!;;(Hs37833|@)#^Ma)W+Q|mnT^|0*hch@8 zYDXyC@VA;3Svd=NKjmsv#y8@u(NCJhdJ028vEdlQHVcV@DSmPyprESYzNH+hiV=*R zJ>%cs$i7;v{em<=Gs8!?*{AvDFW#6AELrp+KMQb=mkBP759;^ff=i~>cTl6Qxs=(F zuJ5RUvoXU?pLZ5k1wDb5^W^jSN!|!Fr@ID zleY$ag%0Z((vve;*A4ZER!R@}+<`3-p^gl<{g`~{n%Xsf$koUx{5JwWOLla2LMSVw zDgmI3x(q#Tw5v5U{{>Ex=3Fbwppt~GIUvPt3=lPLX)EJnxZPKD*An! z(5Qo_cxTuG4`e{5AemUoqWelv>tuI|hVmk2NUtIzKi}?ZCt(1Tla~elQ_(@(Xwc6h zUJ2b~-*!Ps2?!-@a4$&Sgt#VS^A0|>YK;LJFyLw3-}RKZZ+*-t2B5Bf9*s-gvIZ|P z;i-LhPW0nhfMVZe96I3Q!nH`T2ID`M)PPpkt<41bKB#yInO~8!3Q{3DliP&(-0`*R zfUFp3-&!@WbMG`{MXnK#8pMD{ua1v77hga$`>kh-zauvlkZ83FBdg|^Gql+sYo7^d z4;74C=0~z`A>{mc{e3E&es!x~xxFNhMhtvEt4^=v$@@nNiT+4NubfsJ%fv`=rL{$P z=%h7Y*E{t|C+^kRaZ!@*%MDo+E!~Aht!7lg&$N&z{8_mOtRX-d6~Uz<`Fp8m1&tD$ zOZj15u+G2-cPczRox?9+`&J~+YXDt?>*!vIO^g1nTFb!?{k0%jOuYV@2rO4*(yN;t z^Q4{itAZWxGCabU=bS;-c8q{DpW(F~PxY=+Q=Rk2U+ai_y?IfST4>n~LytDr8`n$a z*mvZECUlLmVIz%5z2`a0LQrLUs-rfsK@PElmn9q4-MG?Y8^3G``LA$lDrfq$gR=6tXWSF0qqxbP0rBGX(5d-4Z8cUL zu4jV~+vt!6eJA+X|N@(^RtPT8h$_(yAQ3(&K8*m|o>x$9&NO|~XW{;o79S1 zX~Vj7S_%{02sXGj-iKXwjZ>2P`RicwmWt(N56|zrWjVMjV-6=Q;{0RMGU&j*sE)!~ zKlJb2nY^0ihPOgI|2Twc`#4$avz_Nq@QLuYE%Yy6_6#wSwdD z-nxCz(#=W~zt%uwc!l+e)WERaS!q{TGWuK@Lks(rnI6lGB)o`gtr8v2JRps8zV;+p z-np{j7F`ClS2o3F`E@qLqAkP%^aRcSjzd6-!}?S@BU?uOvu`MYr3C8~LCS4@7MP6L z6CnH2T|Zev7M@EnLU zc3LiXM4Y`S`zmGV|9~GfK9Lfeos_Vl9YmhyZ0HoJ9SqBjL{yIY* zG{jsyThgCWn;PklQ3cB(Lo4w0qVNNprf^(Z)}N|S0Ic2~Kqxe(wNnN+k zm3EGF=?faif5#j({eikm_Pp;Q_sRmPK`cP){RAd!Fp>4;LHGSU8o7k@oo|*2mr>Q| zV?jEk12B^CI#`3))NXta)H1j~p>fQPKvyG@;P6{8t)0HNFCcmEa$5)hA@w z?>*-qApd}NfAPR12N-&U&jKk>$w=;?82_T}{(-R2{$g8N?x1<#0D6rEnC?kPwfghx zlPRBI19kj_Nkl85YfIdMo2Vv6_fGqYEJ|(q(;vHq65d$Qqe^ueP9x;yYfa(fG&Qal zB2oAXXTA5gD2hh~S)L|k4LV>X1wJmjqa|whph7g<%;)QmmQl<6D0+ci{{smKlzdQx ziSw_{0pFIPB@02N+R5F4lc)SZ5&nRD+kXG$ zfSK%bTZZ)4i{2kpi~o;9WY>Q>KqjBxmi?OtT)BcK4 ztZx17-yesy3sAUZ!tH-JNZM^s7X0b&c)W5-rn#(1T;u6!G8a342tY;V}h^$ z)Nha^1H1X#m;mKpn*k*l!QV~|Jx+7X8~jX+koIc$)79?-pbJb zW0L%>IB~`Hw~dy!e_}JUgZ+EBCprGwt~kI5|Hek+1am?C6FXA+zib%EG4KC;Hm9Y* zIQ~vf-(kYPSHaQ9+``r5|39#QncaVMO6)bk{s%dgzkN)V{~PPmhY0RJuHk_^m@&+s zNgz5yF69UX1ays=?7;FDzWsEk`%``DOx;TUw*zgU2=ne){t0{YKHXyHfDjxk3?#EwL!q|#dEl_a1w1{s3k z*i64rgY=>3Ib_C?7|HHuw=j*q*}64o2FI~+D0?o*;u$QwdHZ^MGV%IA#?y^1vLb7U zX})Gj!T_K#>h0|X3)m#yR#ImFQq=ION~%w^mLU1@QBo3W9D2FvY=HB z9+$0hK>c|MuYJUsh(6rhcv*-%w7aWMhd)QFNS|HZU0mFmxCQWM_R#V5bTcwyCKwnl zUBp5$yQcIe805Ig{4j3ARtrrL^^1(j2IhL%(eez0$}=RF6=jS8w3POAnS0YRQ!?vN znZ2Z%Fdebj;;e!GN*M9O!K`sL((gxLU8qxHMwa@fAx;F&+g=)t;}^Nz-T2!cZnJhUe@ zqoZD%h2z)Pbe)+3+%%Gt^O?d{voH^ig2eQnu&L2$&42160&HgmI#ipa&7??)O=!k3 zx!MkfW3~+v$P9n^Q<@G_u^?yA&ay{fM2m|-Utn)HEG?qexbjhHBg6o$$b9*VQ%^j_ zg`yiapBU!nxb!!A`UgdCK{uE3o{zae0-g^7)L87+f@fAH+qR*U*pbE zrZ`m`4Kh=g2cZr8$YngzAb)e+Uavz7OdiK-pMj&3sZ=_5BB|h-Dyh0%m!f8e>tp|L zgjsoX9Uttu=pVjT*U6x}=IR z%I#RtjGZC>YNaBaFIo?^5s90`$=L;oDKVp{Ur72I68II&+6?tZ;5{c{v*HGqd?83Z zG|;snL@FrF!M(roDg;`fOat$cE#R!=CgVl%iNHEE(A}%;%q@o*xumXK_*L`DFn9AL zxFeHO0T8#04;It7y8ax3KJCiLq)-5RLwi1CJD{l2EHq3Bb9}|m+0CTI@-dz+g=K%- z0E}&IduiR#?WFH4j4)cpT&UPLB$6ve zqm>&fi843t?s9I!RVN3Stl7?~Jn?`C_Az~HK>&QI9hc6 z-ggCyV0zEO(ABPbCkMIv5(!6>pe_kyYkA5+&PQ~R4s5hN>4H14-}8d+>l_9jocv|n zXRLO9AgCvro@b0h9MqCk$>no5sn%ftq9uQ81OsL{9nwO#nCw3FAOq8OZl!5ei&nVL z3V`4#Q(VXfN*5x1DC(y^M;gC8^C9$c+La+L77svalTeq`k>73=S-S{J>alrM8RO$i zf&ziwuHtKxLnTM@PxmgEu+}hF;q~u~jIK^pOzwD~#4>zL(QeOxO;^fcADg z$1itkNJXltc1#S*Qk6&;PxN{_ypjtm3oIUwX2IB=HsYZRAWI>6J^ncH<$Uy$)wtyY z&f!lnKi3iNp5NXdLNWOfLxD&;puGnXYV=O%Sr@z%!L@*jcRwT^3Dn{daHToZMp|dW8I;BdZ-Qdb##6j`0&A?^^!JZFi! zF1j}ADu%LpvV@4%hr{SnY2pg)n2x{rzz3!sXQ@sYYGy>s%loY<8!1SdwxL>@`A?$_ zP2q%49G{6Hr*CpxTb4<7Qn*k|%)5E(&#=$XZOu>z}W=>W)0C)QY^A$?*2n4E-yH(8^zvCIIaK5-n#33$i_?G(XNdQ&3UamaBLOmXSPiCykd#f6z zHMDb(Em9u8v(799C8<%k9|sV{1DiT}w9GK4E?BW~wnh4Ud-ez_0Ldg^1lKxM9cJn% zWYLLbMD~rThpV4uMv2miFu{y6ur41lFebQo!^`yI?y+UHYU2soKMDS6bjYKp#*FK} ze5FI@1#k5y+d-)RUfl;6Hl?Mb>^qu#?pr`dm)QWURhtUuas%x>fEhsj!;_w3QKM7; z8M0F(aq7HIKuNduWHa<`v*$L@#S7``<}D%nEe4m#hs&fACk zjCqzl#NV-xePhM;Cp|$d8-FvzEyI5<2fK*1x^_WCLZ?xwuYQ#su2tXhpF zUUoEXr)@#(g!4%3vCwS;P_caw$K9co=B{ShoB3A4We6qveVFr#WE$@^u! zI^Q~oJadTN!%>aNC$H9~7T&k0ih*@}O z)+Q*?#Axpohrv`L0EAXC=Yg8*4455|LQ*wvvs=9nDD3fApW>tXl-n`I&pG{w6Nx8} znpf+#SHO)zBh?0LYcbHqPCCL`QHrq}9jqN=WKt&{ zNcCA71zJ@fa^*Od901Z@QTED8DYBtvo^5`0&i?g|h2Q@IBp2dfjq)O=xPSGra}Bp% zKYqQa^E`T_O>><*{`I6VVUUHY3RK3GgEfhCfbm%kepsISMI zISRr6Ei~S@AMj$$jO}e#)|FV;B3n4i#jN7CzifNU_x2v@V>`L7{AR2q+n7$1!ODtf z`>6}BB)TQ8G%Pf=UWB8?Wj6u!e3df|zm2OUlwsapf@SPRiZmg)v?N24k<-}_Dhu_2 z+)kvs;ZV9`%9MDybDQ ze~||fGcayFp41)l48IUdOkjPU*J%0;YMO`2St>?D1MTt+F>} z7wY+&|D;YFR-S2V%T!q8`MvZh(^PU+lOfAPAfH4+{M{;CS(33f?c~FE5)`N>)SA-9 z%+>UUI0-CwFl2StzW}x?}wJfa3SjLNtSe*!}LT$bZgNxY6T1w{r=#T zq3>wd>xse}9QWccH zuT1N%K!p}3uLn4{zYhQ&*GIOmj&9u%zZH>R%!*(H5AQLUWb_%BX(5*b=Q5@Mr%6^L zYtRRX(i_N_gk4g^sASNKxg(x>^X=X`an z@5zi$9E(VqY&W@~7mf&ti3#~LnQ}>usoM>606XV?z4_SsC~V&0t75I#xiBT_4t;4?p7UkmO=RM<3%)AAqB1)p}1JAfA`i!JmLS^NL5bf(cEs z0t>c(K7|wXW4~turt@8Ll8h2iU;PlTnN_Z&cErhyT5~K0*x{e-kRc=k2t6>o)qz}o zr6SI-Rf4U(9p*G90B2ZVrl?3Zy3e)WjT^$DWd9s^oBdrMIq%9FYSHKWp%fdT!6h(R zD{>m~)19BN%lrI6ZqJlt-vq}~7)gly#slfsq#HE+c<7OY65&YZer`Gk|E;QJ$l z(2N>Ei<$Ed0>}?MFcNcFR};Xcj+eKgt((E&$*pQ(u5lSf$#&yp$VSQ-qA&9!kzjIx zAt)sEjh5sqO~P?C<3VHguPU$}(+dSIdl&;It`QvkflPtZdf}pdF5mBzt&?hgXp}(7 zDzew}fMXGaE@E37KIugMMlT*ApxJUyGOoLV$%={B2Yhh?px?zciKsCsHwjsV1BLG-x3?c%UK1hIj$c7hP~+Y6S#F_`qx z;@qRXG3Dz@V^Tvyq; z9~h)$1)Ko+K8AM)0R^^;Q>*t8|0dN1)HLA z*NVXqm_b)I#32rF2Kw{_Ia>u@DwidT)9UrUQcg$cfe-?TFE&$ztGN@LivEj}QcDBfnSf7Em0x zsRAg3ZOZw6aB}(x8sLRz6+Lm)NjX`Q2P#9}GQoUL-HV9lf_%ZcFq8aY<7_V5Z7+yZ z?#$o)b&mNPoCP)-5hYP^i?*OS46#U7g@oKU1TdDUtyhHdk9hPV-ztYeAG+8#9AMuB znnRKRY|2|ugu1{W2n7qjPzhLxpcD`yOlJTu0jglJR7%vr!+=Fn6;a0ePAY84JmfW; zOxh1-W;Fk9!d~ldOkl-*EZ@HCLKeNqzVq4f7H3~s9=vOdgIO%o@>%DZa^s4G zz+=~5>lZ3L3Vo3XDF<4rdR%6xZLE3V!uM`<|&B+NGxwu zQYla;f%baItMaauu#$36^tb#~G@`xkJWav}5V13jREeCQJ75;nyeF(4l|qhh@NE#$ zp2(c;dN{*p<#~Zx@z!11ULeHb7D&m6w)`9QMHGg{d4XqJ%var(kJXn%89chef19K(9@rC(T_dVTCS2z_f+DlY+D_7E-G%n9gwBlG zbu|=hEWDHtpOwMi91PCeosYJZu?HU9*cw+NXU}Phi;nkL$b2uGG)6E2Wc3jQvBWae zg4NXlyF0O?pvFn=412yQP5{!l($jnV)O=E>R^!C}n{%Bb8G z^wX*qzyHQA7B$sBg@lqIngKELh0d4r0cJ;{ipj@OCp|i}V&wOSslzYkEg>>^8xn2O z09bqVOyMdZ(NJ*jR~}b1K=%Qvy#SU^nMqb6teh)nMnubHVIO<;It@WRkOvgH58PD& zU=`Hrn9zh8Y%jj`pda`$gTN4V#N!)<<;lv=LPf(1G>ZfEl{GDFLhmP$kTk!Ch82)acEB)H!M zW@{Y|7#2lFqA^4)u7s)@rBzFRW#{}W*$FFg8t+|b;FX^RfM+g&X+Q1WJUpz#y3x3Q zrv&;E%EB*bb$7dDk1J@(+oF$lR(YnrEI^7K=oIo2r({YcaCk8^M~T-#zK1c=p%5DW zgCEPh?@VSL9b@h8OH+6g7Ds!C@UdkFbXAmL_N;`O=d_~5O7E0Z@}vw=0VruWG!kQ| zFL$RSvsdF9fJL?{GdD?ZH1O~q%-o`vp8wVdTEQf+m?RiuFs)t;?jSDp13uh5T9=13 zEN?-Q)Y(F*n7$W0%m}*6O^#(+L(l`Skh_W;&0n#ccAptQ|fw}0C3Zo^}TToj- z;(=3AARG?UFxRGfmda3O6Vk{VQl&sxxXOFfD+a~O0x_!&<$a!%36uezH&}+^%Hg^0 z&k0a~7M)QK6k2=w!GlM9iWK)@$p)<&%}}9wwt$9-W6`)!ad*5<(V6e@B$a(rt6_~G z?aypi08?QH?A=|chECPAUtf+GKmZAAEDbTGL2wt&ur)&0lLe}y5@6wB(GIZt!`Zc1 z0b$HTv?;`~a7eynY}71h%jtry<1&%QZI{#M#QeWyJSbHl^xY!KVHMHyiSQlR$Jkr8 z%r2e|ksbM% z97gCei;)}xsxc@?$Tfy=kxGu(3b3CjRA2&*8kPDUeW0PpiJ3X=HnnM_288Blp`3cW zBA^UP6AG+~jy7E@Q+KBm4xAP_0MeLok1PlXt#QWsZvOLI<1Ls0CI@Hu5e|;#Qiow$ z%A!uS6^xF(MhJ5M7t@ANj+twaN3W-&xh+&AO~M)q=)KAinBe-@vAI_0j6u9MWb1aeYL^5c>#M)hl zIt6LVt`6{1T?`@pgxu!aE8zC&a_4dDIz>QFw_SkG+Q7A{k$e9l|9flA{1JMC^>A3! z7o+|>ogOcXUL_}=SyyH_qyzqx36+#Ns#}_o-t=&>(9v!Qq|I;3u!OY6au3$|$NdQ5@eIPv87>5OwBAH79OdKL119M+NZpX=?QhbLUFr3NtGMWrM& zBtP?T`R06_I$R&M!-2cq5v9b24D%|Uk(bRNbDoe?hCRif4k~D-f$+r9njcSkJ!(|a z%fu@_8M?;4iTO37)Vw>_T6oJk!G*MmbgWNGLsZk|m>Z7{c2alYO2bTtsuAAq02Udd_mw)|)z$?|HZ%uYij zGeARGq}HOHAQ_uJx?jJ65nwRI{20VBrHSZ(cx+neoa|;_m8>fG++o`u+zr!pUJ)2f zYpy@$R=fEk-5}-sI}C)Hy_z7CADFnE5{bMT0Pd)B$;A1+G^*J^#iw^|9oNLpFKbgzpu;Ko^!6~-NzCcxbj-ch95 zEcMS=r&bVvu6zM+v%uEoaAAByeKVWXLijH4rrY=x^i6{P>#0!q)vZ+q?qrUK_4)qP zxA!^*TjwZE6;rIP7`9%}^HgQ3-aX^E&IeKGh)dx(BJ?HLEc>0`%vz3yB8$s{vlt%}N-QDc6A5ZbtloU-TcfQK=uj zSa--(j&SfoSV#&DPaN#)&BQ1!K;zZQcB$WPsqIRjfz@yoxaY;XumLWT6Tq$STd7fr$8b%#B+5pyTU|PmDz8S()9WPJC)5sFQpv|Iqk{Ni=_?5KU3>*vNfh|>-%>S?`%SGfR_>!23zG#lPD8!Wz~t=j`09?%xP zBSVhK8rp2}HNFMC6Cbp zk@=_<5_gdfm#~)jbai2Ievbay9!nE4m)#mbpMvlZcqn)Gs8UfXn+a=Iv7m|Iij;9w zdulK;d4;OIl%Fr|C6NDJmr+^*4WK9g&8 zh`!OUHsdT=f({%_Ku01X=Vvr=X=Q{jhC5*jiRogU(kbXQCuZ4Y^-4D3*lR65Cm{yF zX+cK#3Bl5~+K&Xo4S=i-Xabs=hDIZqgEfCAd9clI)}(U~PWKSt*Q{z)`J9*EQC)Px zUH?|z)0%9_W~OG`?JDxXD0jzE;mPq1$#?2sT%G2ES(mGTt0uf5 zRTt3>=W}*`UIz*O!uhn_z^m?Dx_iuC)QaIj5GJ%2I-531z z$j8D3v>YLkX#IL}y4KaD>g>q)aJRW1s@)?lDf#d~n{4Ul5Obz0f@K+RJz$m|C7nA1 z7=xNCavV)10rm*1V%1v}ogOm)bidEx)BcrqkoGY_HjC-mE66U$bird>uVVCcz zm7)|`Tpgbhz@EKmxNX``{Tov-*p z2ZiXy?nnki$OwE+MPEZ3)WfZxZu>UfyJm=mfCz(~#Fh4DdA}vC0*!lc>ez0R!-sQh zj2PikYFU^2*ye6vB^@P=-*i1^70q^y`b*zhrI`Pz)VJlP{bsIp05YmAFiUvyW7s}c zulW=X{N>?ZNU+=Hc}@ZVONXmThf2}=OfwV$6zTO;z{J|C*7g!XcK3^u4rwkkn>#b! z_DgW(x?UE3rr`4^+TMP6RUc}uTeCJ;0twb>uaX^LzJ1ULO~rQbc-qrJ6zGq?5v-#%mUVtjlq6T9%fzqMe4Ryk!Fvgh)d zc+-sFYCVwOHn$RMh0W>?6&2M*)}lTp zFVTfTx5)Y8I_0*f0 zyyKbHGSrS`(?VLPt$1-LPF{6t`w8Ey2G>uH@kh*5M#K9MK<7gwK+j@nQEmt>JNZ}O zWZyex``AEg$_q&{ze(4dl$um9@Ju#u0jm3?xqvH+$6lb)rO6LpM-aJ5@dx+w`3T80 zJzQ!@j`_5#+ojyVYKhK^Iz zhfKEBY4au*fUas;fhb`FPi#Z3?furW7UUa_xS`f68T*kvJR~f~98tGkF?;!DL+v7b z)C->zqO+%~2QM<@trn!IT^$5KB-%>J+_TvepA1B#AG7M}e4D-7@Gea7PFYo`kyEwo z?r~8MFhD6ua}VB74_rk7_9;xK*3EqKxsZ!+XCLpnO0G+WyQvN z?bDWPa7R%?ZK(F_^3i54ISuKh%9q ztBOW$1@7&t6kz8MWnC@J@r-kedEif&X~Hlg!}%mts@!2gCbI(>eHqU4#6g*Tgg<4*Ne# zN2VerI|PCKK^Q%N%L)Iy5#CeNv0G(F^J(-Q$n--{%$Zpy(An*gRh&DqM66lOp$ZR3 zqDl`VvqVE5g1X*xV~|{S{B0~4!AECK^1Ypx_uM z(1iY4TEh%H?C`OCYIrF!cD)J(D;6vMBJV(Gw&Yg)RFpFMD_}xbPy`}38|L>SSd9u@ zf;Vg;^AtM>lQC!uEm+v9@*IS5@M^LPu}31zl0;qOi#wVaRyJRVCW`b{bIxE@yB*Y; z`mftM_96oK(Dd;T2kB($4jhb$YV3C|uC|m323-=9wp}BYup(f(ciTcSvt+F;HWaBR z6blS*P$^J73xL0q81i;hl9*~47*1k3{9=GU^D-7)@+X8;mLID70RN3iSCBKS&zPV$ z{mPqJ9%|RJ)}7;}*{|$sZ_m9oMSIM^722%s=*gHVRrczHF7jvg_M5S1mfzO~dqM{- zt7{+&DMdwN)y5ViNHoViDz*j*6M7}*3e5&@a{WTvAVB35X>l;Ui7@2~QBR~kjD}QS z6u##cCaheDpdX1ID#GHC=0+INR~#waumHj4HJs_7M7jMQNgs zsFxxK+@()2L8EjCGV>aw#Ye-pFVBT++fJv_^Qx0|mw#kw+t$YEDZ^_N~X z7d+6|AB(ArlSuXwUI;=Q{eKD00{29uGZLq8Vgc45K@V`ec(U{BNSGy?F17c$xF~}g zaTD*L{3OU86SsGvDj8Y8m#1T~71$UbJqaNnVxZVm00tmxMNeH+u2fhSD24kN-k!BA z4>J0oicDoc<@_kC!IJZ#y+H?;6K4D$l!gYU5la8dMW*v+iU8G4CDaKXaXS$}I# zFazewfy;oSJeRLST2$a299Jp)q&EzhXoAw~72Vr)40wR*d48mXTS#cP`lDY^KhT~@) zJnLHXE$AeRDY*7OEtw{7zNsq@Tu%9Xk;>p)+~Hd`PL_s$vCov0O~o*QGm#~7W;ejY z`yO--L>*vH>p?~$t~CgEY>;3Hn>uKe4|FvHACmILz)LrS8!Y%3R*DwVDBmg#@L z^wqGOS8BhUKDB)FF34@8IdA%UZ%$iEdz`j`-=aTS!O`P-B79vlcVF;aa(1*F0cWFr zZgc?pR%iliUF3`n?}HC_#Lc9yRw3u`sE^df`zCKye=^42I{e@fl?{>E#PeG)v(voy zymYEsAmLPDup2AbA>*-Z)Bv9fzs5)6qxeyWanpT%R9BKO%)Ff^%m?w4!I5iy+4|4A z(aAr<|K1c-9OG5;l~38Vko1f#*Q|K2ckqrtv{{lTwufBdy2gOvXp&EEe3 zru+9i@ua^tizG1Ozvo3Kf$4z#xzUJA^UTp>0RbgOBr`oi|GCj1rGsJr#iaS(KEZ-o z0WAP{DaVLJl+1GN>;%>CbO-!{hxez_OhYi4YzAhIlSMRMv<&(zloJ2&81AZW#e z@_xC^mJ&LYZr_U?D`1zl-_-)@k4iCb)wiGw+JmP@O80>WVwX#YuFEWS_4(mA>x8(G zHFfr#;jdR@28*Z@fDnV&X5Vhom`wT~l2`+BpjI9Cp}b)&Lm2);q)A`rXIprJ1ZoTV zd=C^(LxE4YAj^Z%(`t*Cef^14w*$u4&|!On=nN4UUsIx9sm)$(hYz4{K)(v4%lmL( zIX2$LLvP1@!wb4%fF{KwN*oJ@aB{~vLQhRc8hK=q{Nd5H3ecfXj+Wl#HefxM6CG%N zdEPmFy*~CPlqjOO2&9fN!nhK^^aUG3P#wzz6%=*@GL~B>hb7&QCPgrj3a`S2L=k$a_(Ctr$8c5TMd)^y z-F@di>m#U;H@q9>YSui&CCxXiOW2dmEnX7S21;NH7U=tPPRx5G2kxZ-T&)HiUUh}7 z>Bh5o6r=TK`K+lg%emp6=#G3D?qg4{yz07wb{)=Zyz(Uvzwx+3*a~r9$H`z>b41lT zu%8tN4q%E|4hzYb{bmW;>WB6838d|q{Isi}bYEB-5Xu_(MnI#2J`mM5%QxO;lK}YP zP16XAoynes_<1}WKO+SlW~^xp$-or*6ETQzRElEP%K?~rI>Je)J81z+wl-dD*K~Z> z%bS~nGr7vaFJDQ^WQ4kb?)be$U@h1Xy##n5F9Dmx=^?^y;RECBeose_>Yz6(h_;SE z^^`-Ia(yOseyT`~VfpkuA;XO7!nq2VAEEZ_z!6S6jD=4(J?lNde*T+!FjJMPb=1>o zc3RM@M~TP+&^=?)<`b6AJz7uj^E{k>p8DMRqKw9i-=2K@bXTR8VrINDPS{`8mf{UA zR{&9(&~uwN;&2&pck;tfL3#1fwh(8S%D+QVF&>q`YLYpt*7`G}HD&unrkw}G=!a)c z>L@2apG})j+n)MZcuz|_gX?$Ris#FI|FvQxhPe=2%!@OhbB3QS1lPW&80Qc-2n_WB zu?AzqEH=aMJ=YF;CDUfc9@dbQ`Ey#v50$I(wDU-aWhxzjqi!5^>%@g(;6Yr~l7 zB3xC~ID#vZ7-TxZ*QPJz@n=DTcwA=}2MTB(eYYVmat@}`A*vg+=4BQPWMR1h(bXwP zR4q6RO9}E81LGAR+)Z}3lMw3)lqdd#jFwm*8y`Xk9W1!P^z3mc5E1c#wVq^%PdPe+z6==Qnt21o+$voylyEn>I8Va4Ij2e7wVO8t zX?;?mfx>*lrHzbvRk?vh1Zidi!)GOt&o@6OM~t0KC^kglj_(_E`W44r0MP*Y_wdqJ znDFVHY#temb7!r%1I-KV1+BCzpL&2&xdIMe7pdB7D^7NWK2UWq$gQi1%y({X*%J4; z!@-Mc3-;#J1?)K)0X*;i%}~Nc1Y3UID}GH#&iA^$YXyWclXt(72SA%7%BT2(WgKw7 zAWQb64i<&sd7zV%rHk)D-!M#=cuEEGR%_ql$L^P>BR99!EjY}~00*r(MMOY-r_h)P zuZD;}RTL2P7uDr9(XS5T&{kup0h@|ej1vMv0yzu#?A+F7K|}{qzgmINRo!D^^o-e} zEQ{%&ETDI7>bA|3I1eO<4*gV7ODrO#4ZKsfnAiR4D8JS+ihqMgf@er;HRqP;m9vPQ z@|P=Q&V}JR1PjLi!l#B_!!`r_5OHtc{!+xZVfiCe+&CNBA7sqAAe`|zl1+&xY;%b7 zsh1fDO0>Mij{|`>tO=}XGVQj>Ld@SbdBD3l?A3UHB%{JnUXr}KP+HNpu``reXrVkv z+rj?FK&E7PzvusVVe4J~G*37Wu@&*&K#2avReSyiKWpMh6ue|R?$H;xfI2g*V@=SMI z`G#$`otEQ-O|NBh@OGC+) zvY_KJuQnb70T=9UR?;?zyWt*PJ1&F4Q)8QE>VX4>Uiw7@W9L3)eOeM@hRWYA8K@yi zgi}Ba^{wl7rMO{}Xl_x)RZ)rrbdrQ|1SMMkw7^%*<|Kx%UzPO$ICZLEltyzoQD2n^ zMu}!;j3Mlh3+P0;yZsV7^YqzcZ6_7mwrxALW818XZQEAGw(X>XO7i9Y>Ynr6^X_~9?bha8 zWA3)vT4Rkq&^vrnW2wSa*IAQIIWg{mq^RmVOF4B?^K5&I()j_?bsd`|9X6+}DTGvw zz{%DyMk=0hQ=x_t^QT)BuPNNe_^AJ+ba}EwHD?z6MN#bBamJ1W5k8>w5hFM;!aK-m zwNnGUyal>+g(-{{4(dL}GQvj;2v-Sc@q2Ho@*RC4)s-3?LzFd!oOOj4BUDnwC0fi= zfLwCUsJR=y0St@|Y{}w*t8to2^|>QyT@c><3h8A=t%OxGe8zY)rW33{Mm@DgsF-HB zhAa?^lGGMYa&d2vC<377>X7hJ0wrsZoEmOz-+lTsI6}fEK2gueG?IB%ZN$$G$#Ffe z`T}~I(u^GoT@?q<*$JD1tvNc%xif7;VDVy3E^o1pV+Z>*#eL`*Er}wyMSt*X1gZKJ zLTt`|%zy&)8J%^+DH5f1TT)`uRD4xb+z=($T<@f`@qW^YbOk_t$+hq#yV{t1>M~2N z^3B?@Mvf>~w^DZ}t}V}4Ry(p^s-&sX*LppfG<9AGPaZQOz3z(s?FAaG4z7VpdjXl$ z!!86GX6eFI37;EWh5VF@SB6GXVor-7Ks#2N`;yf}+*rO&u6pa20_ZjT)uP=PI=W}n zs;ycdQ;N-7TO1(Ze%rKvwChn@2E>|FN3!3PpRuG#Sh~WGm%3~rK!S+;7&-FPmqS6l z#uD6A<^?J}(5@mP{T;xveJ4V}$eD+6OYLizEjIqy|%sYkD{ zVP)Ky*r2_q=?>Ry;*wPdlqUQV-A}F8^hZNZ#cJ(WRC%)7)qCVEfCAxEb5F6(H6){)lq0~s+l4aVIiTM_bsA+~hjUMeq~8du zia>EvvU48|+$T=3O`XHWV*B|u!0e8TjO60L$i$E)(e(t45n}U^BMH8#IbN-Ml|r~9 zv;Fpf@5a&YK<5{m${s8cVOsRo#vK(1hcj{b()Qa+lB>^>@5qKxyKhm9n5B@B^t@zQ zCi`$O;8wwD zKg6x$Lb~vZ{+-*R7f(mNpZdo|ih8yYunpj9pJ7-`u$~`X14vc+tRoR6kTzwZYtSF! zJ_jlQtk&k^7e<2F>+^|O0?r_)=d_6HR{CX-1jSy>Jir1Xm7}vn*KUH$3MG5S06i&^ zpZ~DJ>~Nfm%K821FiW6gxWhAEF6E6cTk%dgobz_{TH&JM77eU=Ej0oty+ivFo3D4|!XFOnpEB4o^lgeXC+|0r2kO^#cM*@Fi5qzF^VjS0H z(GIf&fhV)h^6nHw(aoEAx1>Ga=~k2Ka(ooH3ckIwK6 zQ_oX8TW|XdR&V=+=0|T(sExsb3z>ffU(e(-@%nQtbsBrAwxvwm?U_AqTHyh%qEs*Z zCcOikjs+<4)KCZM(cWEkvq)Y^lZI^7b8F0iDFo6mQW-LcKFq&Tb6J%SQ=|#9TQp$5 z5_PZJt?P1Zvub{gu_kuZQ3%s>k3L~U>W9Ms!7l0~?EEIfU>|y(GAW?Sj^L0Q{eg$K zFJ?kST&Y6J?=Y1kc<0NIBZChJMn6{0bBrLuixhc~;?0LqSRyT7qyF;;Sq)oJUr&!7 z2=&L@Z&S0*&tsW&e-WmW{#pm$IW_n@KY}dEhdh4-!izo2BE`5gt1y2V+-k0xLp!6Q zpOF^T<*`f$tO}UOm==)KSNWn`(~R*UlxMOjX$m5nXKWt@+)wccL1p)VV0}x-cc-pL z$u>2pB}L8nNsSZqWx6OebE83-^4S=&O(Hbbp7(((qprv<`(MKu7&-R@WS+KXorl{G zbTwqRdtEWwHqi0QY+)VRd~|IUhVR&ZRJwC@zSyus$e-o=uh0q(Itw6J3sb8V7?_dA z9l!Y)KoqZLJl3K*=HO5PH79c^83%XWsNcF&R3G^35>(|8V9jx2Sks1ZF*4a)*1iR8 zM}$d`3E8hclB5?RB=4cIi1*{9IyMPR@ax&+HHGu(QEO3-LPsO(+=)r3hB3ti;!H~x zdj2kV!I(C$F7@OH@+Zd~&1}_8bOxFtQrx?^tNM0aHN}nO(IU(Q5W%uV5QK4FL@-C? z2#2YHcf&Fv?exQbsV5#K>8VBWvZ%R_;_bwi*d@uGMz*UIITzDeMM4Tt%IatUfi7=? zi~E}7$y39t8SKN}bHM#>(k1!u=7Nt#ZA_wmQSXolTgAF~q<7{Ztm!i+{0@W17Vy$4UYPQsh2XDcsKB;ON1i>)!KlZ3Zt z$LN%8`k6Qi(fvj6_Sx z-uxMcVoq9_h+oW{pH?V`ELEp8LW#UT$vYZI&MUux^sa3J6Yats`0VYXpBOk*`{^_l z_;MULKnye)kd?shdO=P31ba744>gnmA%x{PmK1vumF#34;2xzoR78=tap9qaoCY%g zF{b)mWD`B!AhfoIpfbZBC#^RE_&c1NP{6SeO4WA_Mkkm|d8H_q86hvNT@db9D`g7C z#7(wi6(j)t$u|J9%G{fr1Z3OM6S{RBp(8R}NfcKO0IsGWjtV%gXt}D`BR#7cN9+d` z9~TwIle1MG7D|16LUSzsRyyoTmQ<-=Zk2p2RtFL-lP5)1Gx;mK>?(WVQoToh*`NME z>f0~+V0^uC_6ZC3J|rkleEhi~-tYMwX-=qX5_5cTl%6!=w(R%hdZ!u9DJJAy(e#^@ zc92mE0Lc(~r(+%VA&0Vz))qX&8~GS54ts`TP?ci`;lDUfJ3g>d1;9u>C??V4w{($#H?g9F5hpz zgG~n=Z|%IT&br#Ge*!)}7u|M4sf0M&0O>#EN*Cr;P~A(1H{HB!Ub!w1)Ie8h<#TOZ zN?MQFq&b1=_6N=E&Y;!anR+7zMRomSI)XjVQ$rp0w=TFSk#f%W;e8r>eHTx;lwI*G z0Iq*Z&YANF?O@+qr(3^+_Ee)!sbGzyFvTikWgb;D7%~JikMz&(Z%(q`i4g7C`Js(+ zo?A^h*L9Yhevy|;v^R)nbqXEa;-&0x(~PLt1Y5oSJ~5=P78dq9S&ue37uhz)vkB=I0H~UY2yB|bhIAPl;p7%ZMl#dbd^ffFp&@F= zZebX=98h%_2%)K~F0s25S$KxW#^zdrJ2)#`OLzbLgFN^M?(ICrE+3C-~8`LOh#sQMGu=Jo}D?q8$ z4QXkR_`IW*;P*xZFFl=jo{bO?Ie*+x>ppt6=vkR%SMc-I9u1yI-6{1lstmL6Y_wN? z$$Nzx8$+!={RNIVT<)H^&@>WFGx3O_`-KcEDP6ryxLLF#98YLxWPAG-%RRBlUKXa? zQai2EV_ndqf->IXi8Z}jIDM0gF~C_G#@?%bDpsH`M-!uqV0gNlunzQdi>-|Zc1WM5 zs@Gjfx7!`1rIHYG1{wEF`dY+}5ZX8V7Dbv%c1=lV1z~&{syZSjV(m8%k<$0*$tk#; zLZA@Op0dQPTc@H#OZ(U5`M5*(n+J|XWv@bu;1Jch6UDN7+Yh>YAUUW-0l<}p#`XEb z1c&s4%mJVO_k>!({Pd#;y8K)kcQlwpB)cY-$%MG0VDj?ZSBDd>l!UlgP>`|Y^1w2A zaeUu|8r84PF(y~#yDf3wgKhqKp%z?&de;W#iN;O3K@ks!Uu$Y6`rq zLzCB=T_wqA^`*!ARbk^}@0@5KrNyOV69XLveb$MsVX0cc68C|{b@$ya$)cU^Yjgu$ zc9Xlv#UwQCQ_7MB`2y65^AAsp?8d1Rj%Bq64q~a3lCRe)Q+(zVEJk@~CSXcOzaC`v-)y>-inFo?E>TuBmIELieOQZ?wi%Gs84MDt ziggWf9CC=ZT67+6UXRier4VtZuEJI)rLgIYkDqWxUPca`#Q{E$s(;|37Sq{75z;+u zr#aXi4ee21qFT#!OpR`SqqUNoJCQQ4hIzxF&TkTJ63|fHp%iQn!nUA2I;CnXiZwrx zXT3Ao#NUc2b_LATsm2G#??bb=Rf6j5drFA}FcbP0h#$1v$NFAYxcuRgD;rRpmanhb zofnDYV>5P^Fi5qTT4$Z(pqBY?!W?^`rzoGC>Jyk5H2PV5IGQZ8pks<65)T&JQ}#!TY3J^!N->04PfYC01;Xc z-_orDOs#%abE|S!Xc>tQ!VmXcnWjJ<$D7ny0YQBIPQJkcqGO2ZV>JI0rn!))+8T&* z;4S94*NdEmVW^o_uwngWOg5DWN0Yl!GnF$nnYvZ5i2X5|i}UZ-Q!hTE*W7P^umiV9 z9q+E@V2P-pUL#>+yL^xn4V(jH0LT!iBe;QssOy2PjVNRXOA*#wa1}mD0zV8rzozg%H!{4NZ#XY40O_7jubn!I(EH_~(Sc!>K_P`G@u| zdL5c3IT5r*)4H^*?#&exxmL(*YOb?r5|fm5kcSY{;cW!c(M9jGbTdo$08EDL&lmai zJiyJm?V5IeqeX7#YypV3$y9}bLByyind$zrl@N-83lu!7UOP8Kaqbo)Fm(OCJ4Ed;G0W;Sc^$U5e(#FtFq0f1Jq-u@B>>WytrzCUZn-Pd2>yH%h(Ry z!L{rQBfI)3NB8x;7)|#-zV%ryc#iBT)VBTo^^%IM84Q-Y7Z02X2ly?7(NqU|qBQG5 zd{!e_2>pH(+#>H{3r8<_$3Ihe)Uo&-swK8;S=I6CMxxv;U;#0ntm58I-HdEM1H(yz zZ3PT05Uxi`=5`bb?S4HYJ_0>lv>X>c1~~qhdJqP;$c@~oPtqOZ)93FD3ENZwaqT_o zey`nofFk3IOiv8paA9f}C8;v|As_I0J1o?q&bM;99t7^x59XzDYJpR&;?Jx*bWBp3 zw?2fT%+~VI6##JKA_nLCC6KMBPbMWSN`emO#)XV%=vxv1Lr*4zsB1(g-;QTtJbSxT zMA+_`jw*$*F;yi}T1te7o9t*z7SD$krnwD|!Q{n_0>?`zzJ+@Or4rUE@(P7oC(*7o z7^nXT%%0?c`TQ~m1L%Gx+mM;)hGA%>d;g7}Z2hznDhzn!9%=OQlN9nf!eoR14^hRr zEDLd184R$hk!uX|fZ{uv*{kVM3X2{X=3x+PrnUemK~-Le)c6$p!J`e|2@*BJAuTfb$u+zuz6X z9;_9QK?InzT7XHcwU&QB1^KlCHC{ikL(o2fE-HFGG`B_i$HfX%s;{|=_3n4l=Tb`S z`0onlv>gyqLOT6C^}ZmH^A*I}`x;(-giTJ}J~?-E3~YTuqz5w-y-R+wr=KW=R==~k zpbTgukff&Z0Vk7WVb}c`Z8c_}5Xo6j{N%pqGF&_#prUb~8z8K~Edi$#HG*_zF4{RW z>8CQ(7yY>&urKF7RvbKqUt6%PD%w90|HJF1ad-W#4C{3Ls|CrY3rr01pNjGiLMkGT z|Mb9?W=5uF&i|Xa>o2Dvl0IB2#aGYLBWzk77S#VavHsuJe$B4`{q;W`d6jyf^Ew9- zf0jX=8l$p!apFpneA1YZTcWs%#+9fvE4MHiRemuL2GCF~_NUJ_NFm+O7%}Ut5DJvx z@5}C%j%w?8}h3xg!9ZgRfPk461-z6-!ypWZ7(6)kXVPC@qhZqXR6;TVEwTRfp+XXIY+;OEm8mT)K3L6FKf%od_1P%_4#pw)_QXpl%tACO9KsoYs2}_;yK{( z?2(%&jP}}%JcpF_(=J)8HY-*XUNBG%-s2~ zQ!Q)w=YfrXSZN$0k%{oUWq1CNwP??jM$}?*jIU?~1Lm zBj0+49A*zk%If5k0^{7sX_A&-M-FsWiZx@{wyVwe?rz_^^OwiNh6$Cf*ct%E!?>|<1^%Cv2=2m51=<#*{#}<^)zyp2BFIXLE;5ezkKcuj1^3&oXk}LQ|RvT0q zL~5+bf#(~z$-Tmuq0%Wbm|myZX&v{vODH$&X%J6787&x@qNZU!Teb8^J;w!(i3mCl zpsAyQb6YqR*^koWtYxaWal8O&RW%9h?t#=;h?bN!Q|gb~y{R~|yS>D@L64?CB*0XW z6!#C@+^knfBF<@KVg;-?m}d`vg4J_y6|ia>Lq-pddAng7UAFSNN^!93hpP#kj9-Iu z!E&f(sPQNRHJEp$36+09h-{$rq$=(h1-QH^@mqu>s$B^`^{+{9YtjSm4Jji@9@yqR ztLc+>VjJjPB{*rzqucDPEq}|RN1IC@rT*v%UJSZs6U~Z^1Ig&zF$sU6^ZrtATh(Ks zYbxjR1M-hSm-dims)-R8`AQWp%aQYeP~Gd3BPK70h0uYFBVr5;v0@A`A`R%T02@m( zxcC(YSOIzBaY@<4e2uo|I5)5@Gp8hLVH=~W!s4=j7ZA;!Prwo0`8}&=1Obi9%ZKWv z+O<8`*GOm{L+MEOhR+(z%71f$>5`cSH<)ar%&R!-RD%D$F@T@1)qQvDp)j{pf`Iv`oN8v&2lo{> zw+9L*h&Q>ijAq^$LuZ!QL-+E!X=Q8%7l8QbO+W;7M46oU5dG0@Ny;zz_8tXV=wgWS z!+rLN&t!a=h6f6uP0Q?Q=IMMEUO%io19`TxolfZXJfNa?RZHwbR=($6f4EGBoLhI5 zIrZ)2Hkt@_SfxD>giB0GCMft1HPMVKVyNAtry*p(J7txSW;I;G9zE!_Xk_25czAqk z&7;?QAaygwSRiv9Ck>)r-1Z|;R7`pDHP9w|y!5w!Y#hOh>>Q%#?gZQvzoF(nVu2?!` zW`&agzb=$%4vHCp%OUlToS(8;MTVS;svG1Nz_TBPG0HiGkN`g+ftXY-^`op!jJkwI zQyO(87rqY=xT9y)?n zDiCnGAt0n@-C+|hB6a4FoWy=8etEq9Gb zt&ho@4kmU!_<#|=ZPu$(mZFMQ0vI_y1#^$6hpRxUw^T~40_NOX6-u^g*&<&voTN4K!(XMHc#_d^B#UB()LRVChRm8D%i~GjS|VB@r-KNR=pYO?$r+Ts=Cj zxH#U&usIR6GPV6MLrWNRrwbNw)>zz>%P<-B3c4-5E~B)IlGaUi=H(ahiyKeCRiUR* z%B#`G1YmLKPs_wIE$%c)tJ({O+n>^n##r9BP12G(Cl+*WW9;E+OXc#)j%`q}5_DJn1tp zmJ&k|aW6bpJHL|JO^9#Yr&ox2lin0P&I+10766!C%a#GgHeoV8wVSsRcE3AY`B_2E zZ7C+3qag2;myh9ht!$pU^?H*jb;#A{r<1pv#2ImdQt0OVPhk=n_FItYG1jLY`WT?5 z;!QUWSwXwq*U;w%SBL)akYmVi8TZGl;(e0Ij^b*n0&|wU^g@w5SP2HC!sZJ3M7SZ1 zc_vQ3W|90nQ2dVb2}Wuq)OO;2e1FZ}=*j5`Yrt&{{`C|3eS39vzGx>Q2j1(P1SU)evGGcIuO6BhCB5+X`90y!**&%#%ReZ-;Qx97|5BDJjZ+X&|L2S5 zYUbkl|A>>);D-JNT?|A23cBQnz!3fhT?UhX*8(QLkgeJ+xoJ!0Bv{zrp70-KFz;Sp zw6;QEX^x-J=tTeXL@PV9|Mf1nnEnC_`pfxxHv8A?F8IH?3hC#-_W!OS98(eDf7vpz za`=D!W5q=V&(8ZBe#~2MKI&PgsXGvz2PH}KtM!TUvx$PMH;;WQHl0XAK{Ru zUEF#r@`vp^jCe2l-BLp0IVa|D-Di*<*X($L}m+YOVS% z2e|+UDLR$=yU9sbkvXZviQW1=G4URfG=Y;0gkwUY0roM}VN&(0w#L@G!^($JyI^k4?EiGKZ-JOr+)1GUWNq?S2+=i=E}Ug7 zq5YNH!P3Duk;JQ|anvB7|ZXhiaJF&SDyPmu`X4KKEKNYkEs3@OS~1LEeS zlNUB9Mqzz>!PTG#mf;AQ?MPaTy(?6-HTjuh#Gt;avc$-MMHUDWa$bg@wiLG|?<|=N zOgMq9;&YbUPgASPTiyJr6-lj=gDVH<#Y}22_#vMI^71gDZ&2zfk`X#@f{zkI>VE`S z4h9RNF$GhBsV{k)fFH-=axL}{EBz}a{2Uud9DFNprzH!_4~2FUakMM*k;bQ$$>tex zyvpE18rLDxa`wO=0mPm+NSOW>;~Z&86RX)75nRXRpz}PyL;~-(*A1)L(c)wepkxn3 zN84W5AwH?2^kSJc>axs6qlueyybQD7IQ{r#;u<5a{gvDi;7R7TE*0v?fm$qkDYtkbLj?Nk5@ zDcrP=F=@U;g$3^Zl&af%iEmZVJ=Ka5$rgy|07x>B*h~w3uTY}6KG7%2kQLq9^0E07UQfHCMa&*0SbX^jIQhU&htS?qT8zZR zdp<={a3)57BO{_`+R(&UwDmmkz_qc3yWsjZtDKoJ4)R=Ts$NvvwbtbV>*(0p!0wv5 zF35wwD00H&f;+7(i~>d6sKfB5sbO2WmKFk!mn3xZ95CLNd_6(DD=5$F@%R(DuHjo~ zbhbJd;*oo`7{04tN!W*ncc2|f$vIjV5)VKb>NIHJ8ZB+Jym=FGD8jIurG4qZ^on4E zioYyPVzB1(#?H0?JHA~CU-E79DR)xrVr=`G z@TUl5J5q0N(#2wXI;Tf?xOUq`$BTJ0`T8R0A)tK0kn!1Sm(@;0EnvIQ@exA4v$82V zWmTtI0c+%BjvG?T{>z~wns?G^J1%`>i4BE6Vd&HqgOR~ zIsoMlkG;}+X-XLBVz9dIOrEPpr;^}~{H9EuYsok+ov;lDIa-fbOq~H1s@FU860ZZg z2ZP#}76ZH$Teq_o9t(WpiweIH%MS~@f~jGrw?;phFs7!Q$zhu1uw#%#9@)i2B})h4 zTa@NA;0@miMus$l&5<~yr*LBE?Jz{Y6#$1m&>B26A1`ASY%3lo!T0^u6aH3UqA9fB z5r4QrG5Tgj>6++vF#aG<*D@+ds-Z=6k+oMs=?mUC{D>4dA&+pAl`h};=m;hTh7b9r zwGYCOcPpVA`9rohN(FW%JIoV7XCxCpi4SVn#!xu6`1ehR1j_GA$u+>9 zM8je%1d);fYGCP(=MYP3h#s8=OHXiOPp7wjo(i7~jtgR1rbVPjI=gC9CokKR@l*Hs z@Mn-H)Nu-$wb&O&u`jj0L_zWQ+XAz<8qJ4O?>k;pStZiAKTrNW%D@mwBw%7<)1zrM z9YN9x>)E|m*P+A&h%?w$HHuhG?uP(F_hx%G-rFO4r5e6mQlBc1t(ztMHG`y!DIEN@ ziti-|tv#Mhk1z_U5eD!iW9r~@szg<2E%{ikzu0Pz) zTnP}E1(vXTykHA*UXgnrAAI2Ib3}d>xbf<|&u=-ER?(N*5&X_;-b0R0d1kOV5WmO^ zCU0eVaedp?B-nMnr;RK!F7oWqYVVXcImRf%D}aCVpWTm1t*PA0LXI`Jx$u+;h|EHB zJPK)Gz(f~;61p}d%Qd~vf+t$n!`t`;0Q?_v7SM1(Q<7isqYL5d+mG|_Na25nB=RR< z%HaPD9#|L(9S47*7C7jC4<5uqR{kA4m{Prt`a&V^mG86^fq{N*g>$|xt%$MLvYQaN z^3t(L!dfz6FBsS!DO7gG6!n4=smbXatmqh)H5RJqm^|K=X%t_CKc6 zU~#4l>z}~@lb9Z)g33`(eRg(jAo*pQQj@%^D1#PgFfO?V){}s*{1A;?S_~bs^nI|p zikM=-Ce;Y#S-9aeQ_30@qaWv^o?b$0L;3H zjEhJ$G3ZEZ5hC+=CADS&;PAsBq|$V3tPlU<<73Z@W(*uL;VPl z)2|P9asBO7{>k2uRnwWPf0a-+Qkd$e#?+W{mr{X;=>cF4r~bvzQyfQmsV{N1&NrSBIT|kA(gd*AI!eer{hTh z?eDLS*|&~cGJ4bRyn)egHsCFel_~edn+J<`WvO_u?U!MLz?(yY*ju;qZf7r4LvnIK z_SCe}KllJY-ydP!gj?Mssr$7g{G-30d>se_$SY{8n!XT>0UWkNJYDJggcmX@P? zmFa6Qbw>TiahxC~kY^II6}s+~cM38d>S-X13d-P3hNp4@MHJOc zN-;Zz-Gc!EEhD7W9igKC3pQ9e7u*7{0BC;y9ImyJ7v_K%FAT_1zk`e(so19 z(V_qCA<_(+EB_nlu>A&e{EJ9RUj7?y*jkx=$z)hKsHuVj0sn)BHeSHmu>VO*nJ6f6HF~1LD-7q$p<)fPjDy(tu|P zF);tf1r{b||NaAMa(Lia|Cs$ZY_c=`->~T~F6`4m|3_(qc##GxZ5t09=KmtM@rnoj zAA7*ldSNQz{z5+~eDL$XIxGLv60QloJInt*@~<*RG~xd+7Y$p9{MXVtAvoIKdrL%= z_E-Ib1pNOguknrKuMr~>aEiazN0ET<{*@+iVEnt5zz9zDcdd&N9QyB^*%-^;HDvfo z>c4APtl*HK|7gIh=>DET{BrmEX-c@{|1eyCS-?rt=KzQQyVZdM9Q&`Ce+dc!bipx+ z|9$8G^FbW*Im(azDi>p7rYV^c`~x@tYkQg=LM7rqn6pUJ$K?xiey+cw=}Z@rqh@%& zAfHd?IN2VTcZfb|PMg{D{a_UhWU-Fi0nRmRNxRe&Qe@!ACO zH_;NHVeVje^qL?}2r$fHrN?j<@^8bkSW=&^P~tD!v# z0(f=86efZCqmJ}0NJ3x+?(zf`!lq~y%Mu(adw};W(k}y=FZg)Rf>|laMHk%Gm#1n2TLAJWo|da!U|i=6(JSEAuUVW zfKju?_s}lok8A=CCV`422jc0$hAp>7c5r`kM`-brVfTJ^XlVA?*_9`t0hUVu_h&SN zgoTN(52D2W_D#V;Iv~p_ zeaxpC<^f8&`bbzsoE;}U@oVxr#Auj-|CZLi>#9*3>wq_rb>yK@+cHQMqJK%9sfvXd z)R!pu7E&axQ_?iDo#%6*J~zbHe!0l~8?W{xOzOPM*rZ)puP|bxKd`9O?+@ed=T40^8l&r+3iBwm24Z=ALrL3X%Q>A^TKLHM`Dy|tZH`B zWvathUX)`A^wv#R8G&d)43qnH*}s_i9idvW-&z1I&BK;6NJKZLLLE(yQYPl1g102m zSk*DrLyGY9mjf`RFt8vXl!l7%Ka+xgb7!3r>*^&jcngW?Jn+%TzPB%Aj{?e>2Ai4| zbXD)E^Ud`zF;L1~f_v&ah5Pl>wz_u^UjfNT2chw5Vkr5|CSgRLmwe5P$c{xwi%UdW zrp6EhB9016K88AC+#>-PS@_76RH zGaUYlL@Z09Lx{~)Dc`R`!=mn#VaLblZT2{QCGKuU1QDz#4sxfIme!pplMZBYNm7=M z_cReIQG3*`qSi81p$UEYan`}KBn-l1WtWM}bV!sAnz?7zrKQ&I@O}V=$ZezFnbd=J zIO3OTmtS3%PTUq^YN1q(muh0)eAn4DmNls}Ci`WF)%WtPF^E7L7%5 zcMNcC@0BL;{8;JU3MBxXy2uF-$dJ~LD7N%*-g>gUp58s|?XUG)`dXPOL&A+UDi`9^ zl712X1PN5Fbnm|!#RwX>EW}BYe*7w;3wxGKQjGW8B)s_@XBe^daC10?d)#rvtq|=a zkA?7yu!Y^p-cAnP!b33e1U+x0e4~{_hI*79ICmR80EdsKbYK+hUH3{Z$iQ)!OLC}8v%|7a6>h1)O7lYwQ z^>;rA9J#PSz}N#I=NN;9z+@$4jWFDo}){ z()mK~VM$!*800NI<#TA6J_R0uYp@K04?>l__7^3p<%iH{KYUD(k>Va#Cvj#}nw6?t zkn?n#Hi@T*yo(L>J-PQI+8GoA&4!%#Lsxo0I%1lqzFy zum4t;VR_$rp!_&Iy|^&$nZO(VGlq!pE?xNf2&r! zjQG{@Q2q$8+#ly&MiQyi3`Y&~O=K|CCZ=A+_^b3=gpV8AYo0mx#J03$>TB2GXp*aY zYgVyqpa4S)|A$DMb6TD_>QtomHyTVYnGrbqE}X|LVIG1=KvbTaF?#?@pNo#)2LVb? z3v6C2qtnwfNFjm6A@5nmRa2J8ftoyW?F6!XZZ{!-J)K!eb)%$5b9mCgcaM}b#G>O& zuZO9XvyjU$fqpr-p0HC$Qmx zf9taUH4yWYPHZ>9AE;E10DH_9x#bjPz%d;FkFl9jM{7r}l4%meo;RUx8S|pg{XN7R zdTAZ-azduvzI6%|F?5!X%N6Tv$2bC_AZcyy0C}Z*@FgRtuj?@y#=#^vNxd9_q9V@> znh)(k`Wt@mhqlppy-d1W51Gy%vnBBm78eZZ1b4CXu~jmFI%9{8C+Ccf0OYY8h}7NN!EI_InxX*3 zD3V?EVMwrZ(1-mlDE3OQL@yuSX;|@=VtB+N@eOSJ|B0T$k+zw~d%|Ue}KdlLX z>5mC;{6ug+Mc|L#BeUtS)Sb(|tt+5@Ewyk_noh@Q>|x44=u5cv@7wPe{qBhF-jKW< zK6)pF7hU}RA37WTF~AS*PlhvL@BAmb&X~*If~s#_Exf$7>y*%~++4l<+H33EtEX3p zPaTjQ9bH{p42h^B?=3AYpUs>nk9nK`!T$H49HFkd9`Tl2%!;uVnsuaaxvT{whlm`w znw?5JFbE18VOX=@J_k#B2-n0V(U5sos01}A*huB64Y)`|oqjpnGIHb$G6!n_3=3)} z>3w7c!LT;jjFpf2qpSW@
^3Ll*CibysbhL-|Ad^%hA z@fQ;=6jxrmrVElk?}BGBwHZ|hdRi0LJ2^~sxzP?}fiI1jk?s327P#zpJ41Tcz zRQ(@JIO+$+aLGnr>4R$cwA*orf1gi4yffg!jkxXs^`L5#U}?mFz3q#IFMfDQKl zAM{m9fy4b1^u=K7eGwMiY5hT`vdGNC3z2pvM3jCf;&sorA+ew#8`F>c!$^tmsNytup6q2_!emYoiO6UhSN1DJtIw z$`cqBMQf7OQYjQ>hR?l^q`WcnptzvSv)0160J!~06oW!qt8)AUp>#13YWMO3y~tdS z9w@AGRs1M0!XcuREeSk+TfOZ-jATXrOef!@ZZLe`BC0@_G%b1{0A`CrfM`EcbNE-) z(xNTT=A}C`rTf0J+5863(mZ0+ebnLE9(b*+gaBq+sZH_V&lpw5)yE&VFkdQ7I4hGc zv4E7wTUqFpd2*Ic73B$%tlIXC6MPMj*~0oI>1y1~q%;#m`%6&&LC?Pamq>bbV&1G8 zj0$Lym-<#Oz~f7(UxtCfuQbl6DD;kY^J9&PmZ+?uMU*XuRo@rZH>WyZUL%k~aM!^W z>0Nk#xrjtG>Ige>(YO#fE6sA+gwYt;9e}mi(v56wWhZL6KW?3LX;r0C0XtJVNv5uS z(NSh9!WB9s}vFpR{G}U*jF6Z1J{FWV`f;< zK|8UuXcqZe*Cxy(gwNUsBwfHprG{kP5y1q6VajKnV5>Z}z{#7i;x<~2O$KA15gwgF z=)ZR@k+nA1#6YTv-Pp_l;H0%Fs{kw5&aY2Wk{wzgrhii?Dn`En@x2pMrhLYRV&%%M zaD!c0uddKIoeI^(f|2k%EffRrZ>f|?m(u z!hMd|Z3;7Ggyc*M)BbSu;&}nDRS-;k-^FX-3=)XM4Z=r|emm;HEJUkptP)uEBR{~k zD_XFFD!XG}6`~y=7P<&2z~TRV@&}V_bZlWZ7fd5@I91xgFgzvsSGi1 ziEr@t6cH*z5I1CZM6iQ*uK`%GY5|W$86Z5yJ8409^~ugu`tI z1HHEy(xMd-X+R|D2R8s4*$u;OpKkokpL_QAbvn2OaUL`PQ9Mmv5OIK~jJWl%E^JN9 zAG~Ex^n?@yOPDf@hydRJ199e7=;i=Cv^xL@0uu#cun#fB5$vNLHIUVSjwkw;V6^{a zo~GJW@GHXP=mNrRM@8KI=lAw*9s@CZt5w@y-~3{Sv9xnnL|_5Irct-H`f8SewOA(8 zAdnZqN!_(=6Bj+`ZuzDmMaY3(z%kYf9NUGuwq-|sB5B;etbslcHORspEVrM1)l=Ji z2#M`#kC@QUDPU(AB!1eI)|m@J?h(yZ#elUl~6nL>_S{C z@Hrq|qXoNkE<^xqO3hzoRq;^mrGmRENOEWV7%)Nv41r_GVwCe|k_tzLDuODsVIcUd z&c7?H`8hk_iY=byQC$v`U8{c=!=eqAn~NwF5S zuIy#s1{B(0Orhqda0`Q{+IA`qOy+(gKTsiJm9s(9O5UMw&uQiU)?gBAU7z(!vJq3X z?ZA+He3}d3p2b`>N$GnkuDQ^jhgaJX_Zd5hSSXr^1nGRdU{3D0aNY!or*~KlaQf(k zkAYIzUT?f*o#0dA25dr@<|pH0#Y1OVX9o2(aM5hxYwE|XYS;dBN)D`VQdqS;3D`s5 zy-8A!hbLvpXM1vI?GEUe@sdJyJ2UVJ9Ceg%eJ(Np_Y6O#AS{Tq#q~WKA({A_ho+e8 zRHB({qv$i1m^D2>@BCmtel9NFDJ=|hK|K{XwTuMsuj#q;@{F5&B>*!)E2a@c6P+M^ z4e~{D*aJ~aCP)7Ci59(V?!qoBpB443bHJy#n5K3Q+xb3c6F7{+n z^b?b^W#qi|=oa+(RJY|SM4P|`S}So{9@7K|v}`n1|45-ANv~C{;8nd~#p4yS4P-5M zdl!mJ;Bq0^_eJcZz~skTu3oDe&FtDa^?62x`HG+-Sf6TyGWv40;kUcIAH9bKQgBR3 z^VIbZ4;dI!f`g0M6}s!GX!Cjr!W=C9$BC<)GX=ZD0@l{LHy|@0$zt8_Zlh9K`k|iev9KN~Mvp+pldmErI_cfag{z$fchO(6)a< z27}}Ui`9to;KW=e^nr~!g#YofD;6^>Y@6pk!@)m+BhP)Kzf?xdA*lX(P9Qg=0Xxmm zMnZU>#qS@pk41lOUyA*952gP}ojAx%-rCABRArKo#M^;fqRQ6CnS>S5sNWrMO(@u| zj}TCF{3~LRVIW@m)IwAx%L0NCz}+U>Wk^Boe#zo+y2?->cDjr<4B@o8F;}gVmhYCS zxc1obti2(H270;J1$T{`HF0>gmF(k0Vvb2+Ymvx$79Uzj`TQBBMwkl3TqHC;F3%%U z2S@(+2e|DKOrk)yF)Eg*PxI^9OgdF66ChfKB!8>5B}}{89$RjvA+vA=2z4q%e@2H{ zo0OuBUoN22Z$n;D9L+=}#8rlM`bg;`9CKZqzA2G(~cs zDO=~+yA5984uDx49PD_E!OcTRe@u&oLyF73k?==_$ti@Q;r={BCt6W5Z1M=`fe!rt z=(_5#D4VZMZP2lFBPG%yAt5EANDETZA>AE|w3H&k(jX}82o zMH}Br>zfwF7mlXzZ?TySe&^-vLR>v5HDsTEB42(p)aum0Jc7RjDP^(Qyo+T-aW~70 zZTVx&c8m_Tb^snszF0~8N}`rxoOtYU_NAl$E>FY5LcTPPkkJEnpv}lCm=SrT6{Nrt z;;tTu3)udCdgC_$85w4$9clnF!a?m*ugvf+r6C_bzk_fekwNWKBW3XeVxAg-@`3&M zn(CaWG+K?49boIx*u zC+>06o=KnRFA)bJj8B7FqalR>M+FUTNd2J>e?`rIE{!8mZ*fnz?@?LKx?_$5cHBYp zK$fGPzh!wuiD|MkUZ4>GuX1KoJR2 z0@~Cd`ZvHbO$GID5>N^xbQ8qoAjQHG;YGz-oY3tQXe&5SFvR;iAZhsbcx9ZpE=%8< zL-U7254j^~KX)}>Tk=&gnc*Q{Oi#K}+-s0^eMvyjdzt+GC5qB(kFF zKU1fAN6&K8kNFiR2Xng=@||J+D?A)vO215R{75lAk>e>kUB(2J^7rQ+@VTTRzGyq( ze_OT`2?>x2KA=7G56)ek9{6O(?AOYeoP6m#Ui=;P3_c2WVhQI;-mfH= zb0D1U+;Tz-VJiM)?1Bl~@V0P&jkiT|w8CzrxLf8z#@jdU58D;*agKiXEKK(2(hcA# zY+^{N8^k^TK+pDmWd7yDglMS;T2oPJfg=a*KZNx~4U3}2;r9(vIG0&eGM79D+hDoH zCT9)g-r)+<|$!q7ua$oD+O(}u7U$qNxBOILz7nz;8%XKfv zO58q*6SuiXuA^%Gf>6;XJ>iDe>|lhPj>OBEu2;@N`5GH4FXW8YwoQaRt~e%2LmeNtAXueg0MYU=`CH0 zj}l&A^J#8A!(H|QPSvU--geQeOTV|EbnlID4YcH}W(g{mTB01O4hfqd*xg1KsetZ;cv;sj;zM z1KQnh3#QVFmUc4?-nHFcl4fhhs^OG~`YLksbv<>&R3C>vaXCEWHiKjxO?nVd(PKnQ zMnRlf)t%sGxl#U@DOXRaf;fq~#+(M>iNuGN4Yob2y###?725~SpSKZ1m-20^&)AU# zQF>MXQ0^#x`}EOF6MM|vm|d2svc%7uc+I#M5Ln0L*OT?6qs2(-WFOJsPK^bcg7lWY zQ%50?z2Q?p)1n)kt~=s5Yt7%}yXL5%j{S0R-RFS9R~lHie2-F-F3wyTJ_ci<~@H5PqP1S$5w!Q^Dmp+R=$; zsJE|O#VGWP0KuzJI@9cg_Wh;IEkT>qTuv5BGe)K?wo0*)g{m>*4|UN@h9T*4?LldL z{EK#dilWU2V@ZvolQ+f><4HniS#1+1*$Lj(J=9w;wQ3H1!Ms)|ArfapH_2kfDq&$q zk+K!?c|PP3Hu7EVfC+X{k}63X`?zXf^}w9$R^@1JKdz~-X&JwZxfBG|0 zspk_#TUJyxen<#Y%;sCgo$X09k+9Nqu(U2+689q>bt zz6B%s|FZdRq=NYLtRpKq!7rd(|m` z8z>A>HHZ^9NU(acu5cGw7%UKiP3SzzNkx^${syyfbNd&| z$GI2C?QSm!eGzm;FUSa}H~t`y#ybdN2I`_d2$}=@PT_YT)^opQVdd)VY~f<<`LBEe zk@%Ck%QIK70%_!R{YGU-3~Yxi$MI0Q?sNs-FeL1Hmo! z?KT5nkShWX+|wfXE19ohCNUl2}(0)Uj4=VJS$#OR=z_x$3%jdHde``{58{kt_9*o9KZNP0n6*1ico40}qF~Cy+Vm#qZ{z;xY z-xTt27c=Zl>?U>E>^!~+0#L1Z;#;xPct zcyI|Y`e5{g1W^CWgf6F?3c=j#p8^gAdJ}oxX&N13QxMZxZsviz$xx;a(e$l61Y=>z zB5JhlQKpW}iVkr@2s4#>*MO1a&68a<3?Vc3DVXsu>VESS$O@TEgJ2cLj1aU<;9$U< z(^`K6+!4m~%ehvt3lz1RQSxMph7m~)y$D9sFaZWBBZ4eULKjBu>0MwhTom@|4H=SN zq@8`hIUQ1vSoFw4`WlSh6k6&9@Fwh}>fc^uJxcw>SA{gQgJF)N7~ z0CgxJE`UT|%kS(b5+jIC9TQX~kRN~%SEMk;45Pw`Rj2<`ESlb)M-Sl!W{zHF0I<#s zK|j?&$^!WgSS4n73u1%(bLKE&1HMOM&@)FV8{_~`V=)JWmEkuJ&l$P7{0D)4jstQ7 zfSx#mC(hkH=?WT#|D7bN>%8i{kam!W(08Xs1rE6^V0Yi>vg&>$EOqKy~wPY)uK z7bq_hgYHF}ypT@-E!_Q1fo2}k6TgHYUt~n(av}*qA_PI(FtZS(3@C4(2p~o-qKp+Y=ub8AWh`)z-qv(}v)WnGi99{E!y) zA$lAB4_(oSL8M4fgO1MoYn|lC!SW+4d5!~RRXaUY)QB88O!H?dLKuL#rAZYi=7t<* zbNst1gdPZyt{+X@=Rn%hePUD?#F^i7Mny3E?-EN-7a{=oQeV$sp7uk2>5JO|4DP#vwDmeiItKjeGf2{@d7ZysDOp)2Q zArczU^d*!-?xM6DgSS z&p4QUV<@Rc2~@DId5%?YMH9jI6`Y@kW6v&0$YUc)#Z<=9nl)!F6y&i`u3~Q(+MJq%{-O1 z`~0xDJlnH^Ny<%(;_K;Z7g&LvF4T|(Mw-mORz=t@|7rLHW?^mNhOF7|6>Gfc0%->{ zjO`BC1G6F~^j_H=0tI@HrWcUr?gar%x-r2EVhD_wD?xwea?8fa&Bo);fss2HB1wcY zP(>EO_wh)zUqu=RB_0(!x=BxphyKv))Or3&;q_tiZJ4p5sn$v|y3lOcdRQUZGb0S3`xJG_`5NC{WLr?y+A zjCrWYI2D2o%FZgG^*b ziC?7Uz*jHOsC!IZ;xJ!(?jvUb5DAu(6z7?@K#5T$s2?wp*EUGTz1R&ATot9cZg!jZC1Dgq>88agx^ zpWnR%If!{Ey6t<3QIF!SmbKft4U3Nxkrs*eS2$c2;Zf%~mPwkdV zZOTYOLVJX(HKBy}Oy1X*XpPJ*RC<9>nK8jD(h}!-m^%Br#BGADYc(%~S;-h>jX`wy zgVK4iF@!`_LZ#zAB#@h`=Jrp+5(d2$Vr}&7^a2ceq2{3^;4D%9m=+w>J#4K(NmcEw@uEZaksWBupQmy(k$hTYaznDyTd5j<95CIT8&t{x^+QlAMxHPM2UJ?e2N4@I0&VS~;l;&5h2D2ah1S*f^W32+cBxB^>hE=kqz- zXVQ1pa9+I&6f=-e6(KM%2oa(Ifw66)d9E0D6M3_TN{>Qr?v4fN#h$tSgt;P#-T z&5Q~v!;XJ3%kyJYx{73cykRlydgR{m+q)xrYcZ=atPL*RDoL^Zp7T*Pt9DthXCX}hh7TcX3Lc7A#8v)+hC@{{Dp*1b(z$?MXF zw9TO2s+D`gKl7@_=3Y5OJ6_q{bz#=kdFY)*=&nn+WsYx|Lg3%@D!dJ*yQ zEUTo$O}BW`B&I>^i}G``@%o-ouLE#K1mtIK=3lc4QdFsA;390Q zd)BbftslxDlCmqV)m@713x+56_}*QWM)LIUsCPMpDo1L&5J>3cU8}7frX9$gd3=Xm zs@_n8Z95ZZY^n__!{hlaUh-bECxdXW>bIeTYMwo}hb(21&X?IGYeeY6tF6q8pNKw8 zsJ&&U(SBev@S4cjt5#_NmEUrStUNAGC&J#b!cxKkN}tn^^LTQYHr}z3yr* zyjuLhAxEdUlPZZ=$XKu_!^3Rx{^Qnm-Isbi&ef(REY@~?(pAg#i9f!!9y+}rS7PnBLXgA<`$w4KI0an4(D zA_;po7LkTOLFStGw(C^aD&5Bt@d~qYv_(1!A{EWVi$dSKAeKDq72}=Yp~7P>-JQ%b z#x7j8)0%QO`o70lznu0ALb`-k=x5TJ1==q^fu$%^5b|nV^V!qd_Ko%ndzVzW!n?rp zXn*$>CqL(v^E-C+tQ3@Mw|hJV(h+$Ik`~og>e@_(P}aPCWxrQl7k=FIx+=WUE}+SH zuZ+6wU@njErOyi8#{6LFG<=?EzJWt_cZ_}-LF-1D$ln;tVw&qxebhkorQXmn`MSVa zJ1zE$0$U>z>W;BHtE#xVb|lIkXyjfV z{l#XbLCMcKFyOiD#y1U%Sa*$TvuEw!Z|a6TYYOr8@4h>nD>y(K2Z3L)vy}97oP0fL z=H$X}Q8Kl(bH95(Xi%I>WO<^7&{ZKnBKCo1kXcxBb|ojMl`y35{hrw$izj_UyexMb zq*LdFi%7bF4ea<`uAoBrKZc-rLotsbY=9SBQ49En*e8I`moR%o-)kYHfQQ%>rs(fR zgoWk7dAbFJ!d|S00I?nYhK{b2D%8h($FZfM&abaO%(~oSAo0`ul}7p0h=7xCcojJ% zrPO`=WJVv`TZWE%?ORR0QIy{v7ZkR1fMdE|y$Qbf)+90KTO^sQUj5+s`b2D>BM*h% zgd}f~Mwf+ib&9xlu72A9g&}=|U1+-csdXlr?5Z*O*TC>A zvi&2W0@V8S&3OjNzSM~JIE8$g6g_rNruL)F!`rk8siv&!@nuHUQZX9uA zrgy~(3mLjz@&>?_hc3~4mG83`fK3;!y|axhRI57+JBUaW$~2-Fw?7bLSzhGll29IEK;l~!JqCd z8e(T&EYV{>u*w-2S^f?pEQ+zRPU-Dm{{H@~xQc@o@nLWa{88aq>xW-I1IJ$+*Ivw~*fq5i4je{XwEr0NAR&l3aLTql8}dM0wTqyVEN--v&8A-e z0tdDNPjA7Gb4_sk7as@?Az`^+rt}VK45R25sT*ROIF+<*_qmH&#vZtwz2IY(Bx>UB2(oT~9~!&6v4U}*Z4`+h21_kMa1{bbaYkL5;GccGmBd?%eBXTXtZeE3 zg?Kz=e8U5WH)nsB`ev>D1U=u}kK$@qQjW7AdjWD#%U>-NP=2o8k1;f=!lMgm87ooO(2Y+hMG@WCa8 z!@Sa&A@`ftU!}|O&U6`?I{GBCYbHihg}CxRB3fsf%(M3yn$gn-C-C9+s7A^W!ShnA zJj>Q!Ga>n}8*drJ1862CNsn|m@~D@L-b-PTkv&X>Zo$1ejuZ*BZb`c~adYj8yMw=z zZ)5i_m}rD6)X2{>-P;nsIV$7=l~9XWmkG$^#YJ9GReJN7IUKZVh}Zd&Q3O{zi3i^* zRkV(Bubo%WQ{WTBlk-oZZ!9^Y@m^EzrZrL7=CbK& zQyUic(UNycgc1}5%M|cOQWcfqA^~g75JZQWzdSvYnql^lwo*}*O_iKL9FJin-kfFR z-Wd1nf|a%Ez}sS7_Kjy_3?A48pWfF~;gkuui(yINDfV63&T0R6rXG>irrzYHeG77f z1^+Q=*BV^H)pRq`u|8VJ*Gpht?2%mdqc(lK^{+R7X6tv6GePA;3Hs` z@uNE2B-M}R%$0kcK`}9dqA}dH(Jt4!QWPOUkC$6tRt?_h)6mlfkq8UC_&_W6X+y{3 z*<+mz)96nFd`d+)D`Q56vm6O8i^EH$zoyfUho&XC!#zNGzjA5!)trMKm%h(SxG#Bm z?F!9U_=LF$+o$GvGRnn!7g-)wGBtO7oOomFYCI8Z#L;&}U$Xc80*wr-n$TJMmyXR> zvucUQgJ6tu(b)mH3Xi%w@{GNuMGQYP(R;|R`+Pmav+!oE7aOYo-YBj+i81|90NbwHY_#m%dzwjW0JG zca{?TYDTwickr)@@_%=<_bw{CaG9TTh4H25*D$w+GJz#) z>}oDU_F?+P=?}|Ji0EUz!Gp(EuP5Gl(u3GU?mU^6FiI{l>`j(Vlxs{4fYdCIywGgM zUr6j#&1W~{8ogBE+WpZwzE1{m!SKo#oYhMo>+JV9$ao0p<&$7|P1DM(N)NDZ%J#-e zCzz^d@-WK6hh@x%%W`ghCJfCUja+eK1COez=c~BbUA|1Bi2c-@p8`KmqLQ-Lt$OSX|?4%U#OleR5&va>+0@Yyph&2}Y@zQk@&nTVn(lI`90F=g!e*md)rX4cwKPU^f;GLa0$ zy!tlNLUI6{o?C{%t%-guom`u;zIszSdQdNOJnF5=L$BCq(`p1&m`ZG$YH5!KTh3vj88>Jl~}W)M<=$JsopH@V^VHr(h;DZG#$kh>{ajG>~U$} z#+8uK3=hZoaYi36r>wMZlHgt^Log|7!J%a$Ff_|ov7m7EYCw&!v* zwv%?rdRYLz|4s#Q|1&iSTg5g1tcRI&-5Q}iY*q*K4;sC<-&!m*9z99<4jptVE(PtR zJ(AvCA+b4HjwW7)MocBSKxhSTwtp3P6Ss#;@6*9l?WNdAf-gE=>!jCB$dz*c@?#HQ zGK1775&Q6}1UrhN^AnCG+)W;cN9U4P%yrW_!FAhzVsnodoJ3k zG=-=9af*W)2&s>7*8%%aBSb(Cia*4RlZuT&7~&(GDnnk)Z|%YNm6rj)RG zD)8H?p6b^h`ULAw7;a>{hM2xfH6M#FnOr{;tY1)Bc{$fmO(OhmSq^X3+$!PyHr%F6 zT~Xm;132jfkDzqW%CCMaUTo%H8-#9S92d%2`;S5IT;RtetA1OeL)niTB*-hxWaHfz zpGNe-B7QYpgWjWeu%5r)9<0WjO(j9Ytsc5Fr zm00yVIKk>n+jRHV;mUWjTEejJz88UPWs(-=SyRFJp5Vc(Cu}8z70E{5HxoB!6BD_s zE33vgRd=)yKdg~332yfC+rC94R2N-B+_IPe<97%m8dD~md|eISpmO5dro4MuThs0b z!N%rZWQyDPHeNE9GRv124M8EzxmsCbJ)(5e}sn# zc`KU9-iopBB3hbPY2||5Rh&2;8oNiKu-DWYM4z-pTV=CG*KjB!a`^vVP`LTxzl9Ci z|2$Ar_yW0$i8`Ws_VN@5u=E?DU67Z+q2E9^khaqeVFLIP6t5ua0E_BmYo7bJ-F!C> zS3m!MolKMt0)kjnD>wl`Uk4$tf!+Czk<&C9M2;%v1eV}EPiJK%uz);#DkMc6Zy+;Iaf8w#^7bJhRN#N*4QE{j39_G?W;IqK z>4R?E48vqH-gZ!}ZrEcwTzkpRnAUrgS%KubR;@2d9UU#D+BOPo_3rP{ivp z@6V3B&xXIrf_1nrzUgl;LFDajDjF8yFecV&I19;c zJY$(++_jvXuFm`<2X?D8;i4u=R@}_cM%>%iJDv@}CGU)p7*&p}^SqgG>2sFql^&a{ z3H22n(9HkL_u|pz(em_3JokAwFM^WJy3XhJMIU@7A)6t`g>d9r@ExIz@};p`N5b?u zopD>=>JDA%1u8yv&T&4VHy#w6ePX`^-WBCd*|3<8NH@si?vW!Y-NR=^a%kaJ7rkU+#>%nMaddeJYC22yPV@E&|)#-}^zN5!=^W~kxeWtoSnH5r4?dI$+ z#jd0|$eA1Tk)XFW#-cqUYDqW!BGo7T@RVL1&J82)5F9xdPs;HOMwpx~|dqoe( zhxtmw_4@FfdK+~Gj*RnOL{Fv>x@^oekLwCqn(12O5f{7&P*`11JP@XON!=@|{S)fX z=An)Que-S|{Oq2QDz!giCxyx!NVLeIk=) z)rM>IB5O`GD%)KCv5b|bu$od6QT&#C@zuIp-Cw^q%T@UH4CITpDtg7gmI;4QtI?>% zBV*vNdNY?V@^ada3pLHF5MsaOPm*M}WsTVicj4>p`#sS(5w9M#D0^6#$lgAx`_9+6 zDS7+8yI^1n!5ooo7^ObVN1!W7dK@O$+PMv?RZ<4glW$38~Lfbr~Z&Mvv9EmwyEI@cVjpe$esd4D~60KM{2(m{9P=YMpnoei>wT zw|G9nM+31JLNY3CxCP_vaQ2$hUT0zuJ%j};*3d0-O9JOXeM(RnhHS-5!GTRPeNV@5;pLjY0c>X>72 z4+swjM5Rpz zD9vBk3BjArlDkNv(kpxnHwVrNr6>BscQIvz9s&Bh$qEz}i9vG)%UGd>K$+Q6rh_S4uzp_P_@8lVqFBv z@D~y#ttjyM1yLxPWMv`>y$>jHM+`_if4zbi$X4+@)E!7WjT*q1o$tRGJcvVaKn#-v z6iqf%lYm|YT)H%w(=-;uxC|7{&R&y&o&f;2@3FE9|K_OKdItpj!?yL;Y`E36kS$^k zIraT`^)bF*o+8u;Q1|gAAWs$*C_1`8Nd<}xX!^1$kY;)VX~LnZP&9!ySru9a@aE-j zoB{*@ojkY!-2!MNW{J_Q)JQUnIN53b12-`F4;n*R!6?p5dam@I3-bJeAMf=1Lfilo z=pbbY^#e{O#3vVS(;_+HA0VfK2PoR1OhM01%dO~G@G@d{pO)U^(!ajje zJV0;%-yD#4*ZyxSq2o=^Vay%I6|}6UbUDm$iyA2PrJN(hej)4big@k{(DP2v2xnsq zpVmACiVqlwQ#ep6BmjMB?9*`QD4?55eBkqk$Zo!deaao z#dLu)vCwP8sNUm_fC9Wmw3(mO%f`j$wAhUm2&g`wg3}-uG!#WzceMW}ol7$VD7ZWF zKgyC2DH+f;RIVqH`pBsy)wF`@FI~1T6Zmi=6H{K&ET|CBM*n{{@U*c)5)uCr&;zuE z`=JGDMRl(f%JQ!(Zy)iyNSr*cXG?e*w1kB7A_NPeXl}Z6Ayf!x43|=%Xh?u0&^z9g zLe+sZ#%dr<4*4HQv#f^70zGFIzf2>F7|HaKIgQ>&!e|j%78Ov$hB<~EyIl*tM~t$1 z>$hrwc*s8FiHlGu6-J!_Vm?6Awx&9uBtXMpxS|%F(0_78FLnZjLt@ZT6$zctY+!+^ z5XH)R1~~*-+t^xoJ9+(coOA63WF+-M(Sh~Vy-*dP40~^YH2QuhnlgW}9~uRu^$Y-M ziB^~?nRpP2jsh!v2c&IVRiH=yop;bq;Je26fNh?Z%i7iIkJ)GUJ+v3F@b*zC>&d%4 z);6B@b}s+hGl44~ej!mvvqP|rLD5Q77=xOi2Zou`G%CbJ4|Iz}&(A;`=V$QcfxD@> z_V7^xT5T%O@nJT5_{V@2ZGPeZUIc3kFAIKKCs$tqHy6AAx>M0Fd_p@^3$Jns6%ip@ z_y`YmPyflAyy((9+1uJ!`CB>J2sm5+_vNlF0X3i(LVE&KDTZt@5g3>433h=r87Cmk z)QJGifxhiTP;-FF(cF|x%m-ua+;WvfZg`euDmn_&ON5!aG8K2<3qZEy3{<;9yua>_l9 z1B-+xC~nEQ2fTI|%+u+9Mlm&KUB)Lp_~?_!>TyaT?lnrDD>=QTfDt>UrI(#&R-^k^1*a*tH;zi*ioh>rW9Gslo`VBZtiJJATM^j zZqxhTj(5i5uwKn1Qo`(LpF(_p+v08`|6>h2tmc|fiVfML^~q6Y+Dx3!+{O%`Z*tl6 zD>Ox(ZaE!a?H2rYzkPkxeoUGBMbNE3b1M+OWm_tq6U!(znHKn%N`#mJ6yD%ieIru& zXtZ?_c_G{=spzdLlgS{ziUp58&UZB4FY27*A?wp0E5y4s4cs?6d@=$?evM-z?@2c{ zg9MN4G4?tsFt$IGUM;R_U|ejCY47zQSJ9pdd30$cJDj;7FHR%6)Ad5Ypk|e-v*w*E z@WZ38JX5{RYEqZpJi_)CsS@Q*t$q4~fAcv!*tPS0(lghYCg#TVEIAo3uFD zhQQirG?TM-xea;RbuX<^dgbuZF>PJ*Z_Mzz0Xc36KdD=^AEEHMvi{dj*K=%V)taB> z@mkV}Z?_Vfv`=PsG)PAE8+VE4rf1LhLBpr%b{F8%L|UAzi*RG4QSlX2TOUd}eCmfktoeWkEk=WX-xm#%SFj`XMLo;`MIlAA}p)->5S z6zqpCdua$8iJcA{-WhM*sznSOq3A)`NJIcc7iJRiQwZ6o6&g*fiCM{ zS-ln^b6MKY5}?ZApx}qB&To7J#_8_%$HJF2-rqX6`D<6`ru0XmduHr#^I}Gd2Rl@u zjK~N6%9aeBpEF1cuPWlkj5O$M~*`?vvlCk=LySy zxQ}?Uv+-^5(($zT62#kT_1)WZ?0(-|G43pCtk*}npr=1v2mw|E#mO{F-a`1#rx3Q9 zf#C>=L3{j?EriR!0DCeVabX5d^u0s>7>*G3&j2}b&j`_5{1wj#y?~|6=`7`H^-rJ1 zq8~kzonQoPtnHBj2gscUTl@d!Y(#E9;ce6enriEWCx+xwfw&Ph91xUKR_%&;X2bL? zp&am(L+%86f;f?>qo<+t$2>kdL8uL^(|D(Wva3&{%O34AO^Ey@YIK<LTqx-ib;x!;TBqY3yJ&g_v3)kZG2}7i_)^97R;RZ{wZ*>6EP_d$$-d=`Zh9AI#gBd0z~6J_aGN~Z%;!l zfI1+{bh7yaT<7(tJ0(s}w$p=JQkD)r83V6aHa|`o&g9Nhenta3RPk zAgIl)Okd1OU&jV^3|xg)!t-Kc7}>xhOsDaMNEjpHo*j$?u-|+;*c6~aU7YZpXUNTi zJLIRm%*_we%bt6{dI0|_J^*O6ssI?;Pj5xErh%F1=U_ub5y@6&JEwRI~{{c00kJ5T1eS#=g~^2;01fmS~s zKNwbrGL1BQU47(xdbSU}1f_!+;~hbtu>*jcgDSkLMNSl)-gU3RC@NPxTi=WkPR)hG@<>OxXcL~#E-fr2JkI!dq zZd%CvB7(nJ^2L=eqwab>`oay&q3gjZ>~3Rx=2;T_-l~d@p*f!}ovy>Va^idbXSQ z(^cZC-z5Z^*DPF!!oF!|WGAJPZmU;ikYa<_o&1i(D{Ia{(+#G7xzRf|P zm&x7@z=!JVy$QCfO~mF>u6~nAn6`KH{H_wyRwLamk^Fou>!~f^Xa-I(A4<^duyyOq1Tl3Lcz;m{;I|~cXe?%V{nv>*i!5H8yUV{)wn|xJ03q| z))$;ge>{^2m_H&-{Sfy9%w$v5v7T`u)KQ0kdHpc7B$}~I^6&x4({yOA#M58 zxskNP%e61YO{TXJDO+V0ME^>qu}7&;_NKPt;p|0>V+kychw5Oc2a;`kkY3E6F`D2f zFgP#_VK#pN&_8AkM9)(g%0WP*{vr{t2{wm5us}aNjlud^-Li18`^%0mP)gx8V2msZ zu0U^o`L)4_0G>&7H;`7^4MT6=4tK+NfdL=GK|yEZ=HzW>|F2mOp^A9qg zm;|u-4YHd`yM&w_HgFMx)-bA*C#7xt++02Wj7vQjf@uOCHfHR%wRb|YQT{phCyW4P zuO7k7cYPx;^kq_Jqd?m2QOvxMH40k+c0OXJ(P^QWje*{282S#+;w2z$HWU-aJ--AC z2Cl1USz}3)Lq0xsk0zNsjq1dk!xYfn+turj2BwO#|YOaQ|17=7sIDSnS-6xzYN9=iJ(N50g15tb6P9Jr<4Sw%#Z^aU{g?{ z54C71Cec%rcOL0& zN}h)lA4aS^*FF#JtY$VdHDY>*d(O->e$P`!MH%kDzj$@kEbC{LahKD(RRaw;3(JnS zmOy;M+ZF7e-I85r`Lz?tpBpmM#E)<|>X>|SC|aJ0rE{+LG9AjKfAF1t7k65LDZT#k z`#`N=gYxDJ_}Lr=VXd5j_qx+dXg|=)CJ>&RytMM%!OcNF339e1>Pk~wWA?i1xs(yj zb(|YD3jSmlC`sjQ>BnGtWv=N>$fv{g8v?tZpLG?VxUrB$H(mkSuoNgryC#tt@k5J6 zbJK=wQ#~`8eqy1IP}e@Tp zhUv^MrLW)TvzEGKJH&W47k7McV;&m_$r(F@OM`Pua$ouQCYJpe}0FA@;SfI=YorE<69#`uM;OO z#B_z=%`%p3y9VpExd>dL5rAuud$kZjBBNj5U}&No{wmj7=9Bk4$CAclMf!Z!=6JY0gW|1c{sehU!N#zib7{yu> zi}Hm^*Hjc=f1!>Nd;Wg_O+d20n~Xjydpy&D4xA=X zYv)i2Ir8OMlA=6I5s78aMVZ%mO}Y1kK7hIW0GZP?x^r{t7Gc4=8d6610(kKV?{}jb z$Rs%B)Wa&6s)was9A?KIv}r@OCmMv?(2c-|D)``zQjhvB7(0MOypP&Af8*M9WB71} ze=_mEOMXAKOUL|w^&FiWpX;&w^c=K3+m~bC{rz5%JDiq~t9gz|8B>&399JBnyx9oZ z%fMEY5CkFH>Kp=u6cxe^78PMPQuf|fc^Ox%mQ^83n&;9B-MjzLo958JS-);ipP}Is z=HRsM?9w0ui#t`;dj*aSnph@hkZCRfp&vd^<-C&iQz<{wI&T^CoN@i&Z2V$f5iho z5V0fl`Q-iGcj)Ep4+T`GCLlx2D7`}O-(4gd3BTk3!>h8Bs62eRKZ5a{2V zq2oeVb_M>hdWaPiYwEP`{!265KT1y>6mM`MU!3sz>4aDD?!;iB&3(?F`%08Jf%i_# zBDC!I02|nW@?<^^lU7Ke(5`_3WiYP8A5_P(tTJ5GjmSv-v%s85RC>U0{!sVOsy5e^?45r}_~5l@9Ev&FesW@ys1|l!zpw>}Wef^L?ljk`4`w zQ!{~{<9eE3Kr9s|g(;yzWmb?hE-OwL6@=E+{{9=HI;`6xg1E1sMZ#Cnq?I5dFLSw3 zrVqXTP+do7A^}#F*A_vj0-XVFL*k48ts!|KShMx#%)6lT*~z!+e-IAj#&18Qf_|_x zFu_5gBPd5jTBb!zPzFp4(=xxw%WEB)PVR_T z9aR zFjtOz7k;6Aw}7(SNLzsx^1abyRcj9mv-RU2bCVG~_U~Inf2hWLyzyGlZ*Y$(00V}v z|2c{wnnn%{4hC=|#?DVcX6l6fd(_jDh%D?GfoExF^^AnC#{~oGBA<(`na9$(;3uJC z@Ca&71nhnJ`tqrLO}MwO*M9qF^k8*)xAyW2*nTyk_mg!|Bcgx&whZei;?rz49IExN zmB74TBR?}V-VEiqfU+#|6c|96 zX0jk~Xa5CIO9KQ7000080LE*6R@QejasA-Le=;yHXKyZZb!}Bt1pon6 z@g-!uy;rxRR<|wsetyM%SCh%a~mW_(=iOFf~Yct10U%#i>0|JZMcU=Tz>0)|i! zLADr4A|7U;HU_~jL_6EL<1+x?rZ(Skq3L&7NM0Lq9uGWTmB$O#95mGfdF%Lp|BsUv zo%=^n6hZ3!;S|||^JIhZKfo7AOVN$wG2fcbKW?~Te+OCo1{{4y-(a{nu$CM-3CO0| zQ5)VuBIv&lNvfU`rJ?DV;E1;Ol2J0=Lt?8@swHD(k{Vd$U9?GJjCNNyK?8_A@`PdrNH=KS zywR>&?7WA>|3F@+2e&23&J4n}^PTB^@lErjQi5w7wK~*{c-$G*GYI@5m!ujw}_``AM`(@ZY4(FqJoSgEce_|f474IS86=eCa;$A%fc!6woRLmXB zyMkTpeVA_wa-gcH16bd;ZtfX<4~eWG{SwfNPUjmnIpOuhNvAuYmpvddQr_ctt_@=q z-}JMGzxN(&ZR${6!Dl|XA;!_ibAU4Y{arxz_W`^W)d7G;ICn{*0qo2B>A}_x8P`Nx zf0^Sboo_}oPj=W+8yGi%K(B~4Qs-_%vp4!^OSj}bB(Z`l9+85pbA_mMk{HAZZxPMm z@tEJR0>juef~SK5iPLO0Zz1vZ^u!r!Xs*gCodaDCf*=B!B@6j6ED%rw4Dh%_L07wm zXXE{YJyskt?71Xe{jq@LY>_kXoz7*;n%0b*?#Xm#Cnv+4R(wB z)PaY*#M^l0ArR&Ukj(ejP-`50nI7}l`Df`OyoX%R`0WObS9|V@4W)?ZQRXbs*WwZL zHb?Kmmh64#{r2oB+5P?W5bNNk#BMF`!LHgELl_sgv)o*vmeB5`-ynD*H|XPxf2kPH z9)kCf)Cv-@=fL4TC7tb#r;QHH>U$_v_c$xdI?9be66HWTj#*l3D`K z`ivuvd{II1a?h~7B#4qXvw7qdhWAw|hi@L%UTU5tkX_9K){XR4*cIk zudV7zx^s|gQ84*hCNqBB*5PD?gF5aBxHiVcrY?*GbN&3aJFTGCZq?-ce?iSF#hxLE zxCy(EC+(~q1kNDAldPNi(MC@_?lQvH*0q9O#}xo5l8ZL8#_4fQZ5Tb8%_3W1uGoZ| z+oN^RKrV#hA<%E4-wJx|6CxH?NsFApj^5?MDZ<6a%}Vcr4fSA9c;=BHLUR^RfUkTF z?OLtXv_~3?#M39X*I9lyW_UrHf_)+b>!%k_o*dMgAudte| z$GwQUu4po5WhJ^&v8kkL*wq}E>00?( z3BCY-NYkv;@*sovB@aeb`{f#=*=!53C1gzYsy0;Xo(NW&2CtU;=} zyuVcpmzBj757AV|O|a3`H}B#FdF|nCDcM7T;lx2dl{Y8Vv1ZT9gK}p$lMF)8^om9V z)z&S(PVcYCYb|mjbdV*>n*wZ3f^=q-$;w2*lN2d2H`!Pge_^U?lh1|B8;g5EUi1ef}75Vkb)@~K|vVVy10kf z2m+HffARW|ayFOT1H&UN>S4;ZRZVF0Q)=z}Zn0g3xyOoon`o~W$X}&h-YpK2FpOX@ zv4s(Wa46jO2nzfCv=9Nq7>t5j7a}p&cOVA z=BXHw02nJ6{aYgRnIV2V5%3?zC51w()FJMIGD@nQ2pm&S)5gIo`B9Vdoi0hue7Tak z)!T}pAG_fnlDwLtdyT})1j7!}f#>!tai_LD1yy<48NlAVTg3hVTxJYcRQeZL0L!&L ze`4Lbga8~6h84DJbNE7Z#s(;q`~Bodl%a2q2MRw0(kABX(ssUb?7ty;wQ`1#c0?=* z9!nja7Hi6EVi|xY**(zkGt>`)y6*wo9*Fec zmNf9DDTrUSHy|sV9hu6fCYJH**EI656CtNPK=8)DDcRi0+YjQWq zf58O(7N)ca0vFXG1!V(zzXe<~JIAWjfo7$C_Ql|;(&eGE5V%}Jo^VTwe z>FT__c1;)oZIPwlY-$yi4|n#oj~T3}BCaN9KQEBuq4VIw;xhu1G$n{s&g9>ZZ-K|a zUNyEc7=}oQM3F5__z(;e*dlUXe;b;@EwA=xe#(G*%A9YH!8_<1WdqzUU|LlInN}V* zQbNpB#ftM7Id#z#e*1i9LzG9wcYAt$pj)Vt_K;X0^YG$<7Yzb&Fz{Ai+6Qe(&eY#n zlt$HJ&gfqQM_<6JN5x(h z5TurWVQhI@Ti+o-+odcLw_oE~t99&=KW+5XJKlqUa&IGg=rGuZY_Zs2)IyF}aU13H z@N3lg2lYY@AX`><|d@`br-Ro?oOSRVIblvy|*Q4DT>0dD#*8y$c@a zi~1N`IY0K`FH-+baN^r@e?iMX%U>9Vl3U!f92Cbr%(q?xw|Lnz?h$fM{RzN@Yq816 z8y3-MPnOK=p3B)Egf5ODi$wn+^&)Ly7)2LZk6{q*LyKUiF!Hxj|2FXT%E7;l4S)0k zDIpAag<*9*!4=lcQi_eleMk?@#u$8`JMhO6x*hBCSKJC)t)AS=e=C&5OqLA?hQDV; z(9>`hlNgHYs>dYDz?I}Uig;-nZ?HqBS;E|h+9m&ZHQjTGgoma$T$Xr`r;cYHxYni4 ziRKLmIh=||E;eLj5Vaos3N-O&EI^h(fTK%H*pim*+BOM;n1}vG;#cT{OEgNQ?rOtD z)a)AAK^$$ImK_qie}V^_H%{02Y_txe{0j7IDU0D0+$VaKw=opCqtzK{SqP_-ehzEQH$`tNUVuy;hDx$do7XxyWmI_<`r8fe- zM&1!2Y1FU}wmXWg12#Ln5ax}#2lH~cvUH#0RAemHvplGVr(~dz;?e#{Ic?xGer_*zig-3~->DnCd;0aCffztKyyfur?UL4UmEx zw6nvjus@)}J6By}L%$LGH7ujE7qq(AhD1vDyUD?w103uXj6u#jCCWf3&vp1n#uE1n zb4jg&0a3~{f0=R#ir*#fp57Y%R8Vlhf{&d=*0$tNJC&(M-e#R&f&S=}q&_i@61))- zJEoeO4=ZL?1F3Gr5fRPR&c>2H@6Kolc?Adb?^ zdH`(#UC?5J!%qe=4Yzz9vrmQ=WnKdWb5w>_?xx?=`d=Lx97Z4t!(ecW;TVefsD-)c zt2-it4dNbBCRf__6b$C60~PHGrQ!Kue_CQPh2Aw*2=i9?d*Wx?`qgK0fW4`M&YuHe ztbJc}m=T+ik?_s;(E12B%E)r8;L)~{B5xVmL}j7{m9 zF%>-qSbvFOEmOJ7Pv&9cXfw^H_cRWj^;BItuTG-2V4`Q|y7toa$NsVdK?9(4Gt-Dy z&qJKcNY(VN!=X#R8@r3$UI%V34h`@Ce*t^_LjDcxu1>wiS=Ao|j6+L*$pK?q%y!|W z^nh{1e|=xw-c5=Mxef+pY#?O6%;!=vS$e*6|XWcbhy9=7!3SPM(7(|zUh($7BiywR5QhC9k`)VTs zDQLCP>c-~0F~c^k^qeDqH_~vroTo0}L;phgt}a;o+OnKIwhA^9?s3nv@|1NQtN9{}F8p58j3&fWQf^T7e&-XkMBRs54s07KC)uTn*r_vOb@cSmqaAEZRX_55*8?v1s&n zvr;g+l%&K`KlwQ35U>a1)XJu6#x%qPLl?1smFC0ckROoQj)cvUNdn0PouCYAj@V6M z@tJk>(fKCb&rrPVDW)760-KeBsEFx z?;PxM8taGDk(#WHK#8Tz5NERZin7R?F5OyX^uoG?)u%5&i!*FJ8+LFTvpvXuO{PIj zpTZsH7Sp|dL3FyQ5eXIWs-?43aZJu@b|?ODG3hxbzhGUaC-d4ma+(z@1wGe}5Cqx! zAOeCeM4;44wV{pfT|FrX#Pf2xJL)r(NK;B7RQc8GU07?&jm8z{ z^7q1u!;3NcuIoDpxrmq5l=^ySZstRbj;NN)H&ncT^W_AGNFhcV;~$Thdq3H z(#C2MuaBH?0qd(gS5An+CJ7qSeuZS}d1%lu!C*LBD zDSEj2aJN$wbuRaN_2K0v9ejG;C9f|3eyoyxtdK25&$^SA?YgUp5GG}u54OS&%zbXN z+gv?=YCh>~9Ba*jHMo}8X=@j=z1)tAFmIl=lNL_$%?Dlup1nW1$4ha!^^P&MP;lUU zRD>lS!Vtr!m@d*K<7kbk#vMOF7j;em<&uY+RT?5e6k77%5|>d2^hgw=Ae(x9P2AwQ z1#mBG7}c!mGG?RQcHRa%>2p*qRmznF4V4UkPClai3M07`>CjT76DYA=G%NwR6a`ZR z@~<;~jvmt8qmY@WIH;h|-BN*_hTU)rEJcED=SOrKvnt%Mo-5zTzd?mQx}~WtN%_gY zk+wK{RbipdS*p&sZPdtpiQ(g!G$DKwHs_yB#OIwKd)TaRcOAalca0i`3I)QYTCwwg z9)NiDDk@-Phaz65NxAM-+JTq1^#nAfXCqhw8OeS-=r!%49F-fvoa6Mu6 zk)Uuox%ptiaOhluEGsl?=%`Jnr+YWiA|||eG0tzjqLtWv9NNQxKJ-h|@2xS21v)1$ zA%EXfCqEB(i9T{7@67ib{TaO3F0y}rYo|q#H6OqC+8_6q1cED~Ly4mYtB_!$mLUZL zPJ{vBo@>}-w`enPCu-BgeZo(?)=L|2@uzw!zZX-;_x>&TvE;kt%B8AtY=?B5C2ixc z66`27otTNiHGs*aG`S0|3(=(oJ@7n(NhO{3lWN`hOaG~7XQx&k0F9UR&vFKTdCtVU zrO-rW8aN8c>0tsKT}|zmUTa7MLB6~TtY}C zlM;)Z?6C$Wn5k?WDIWOX=6PI-c5*~TrsrBu0>0^zf35QP-t>%))K-RhQbfk(weAO3<`_8>!I8NcjTJ z-hMvv{)Y8)?TD*}B(=l=bI5?y|^wIO%OMj#CN&a38y3yaLX*lffnj73Qq)qddawhN7>Fzn z`Wmb_fb5YZ2IrbIX(@nc1$XLtgWU${gn7a=sEHp=M_}Wwt5wH;%M&YYBfz$tr0{*9 zNB^fsKTTib*iAE&k-0B3WVCAtE&5bvX4uDmn^D_c$8=euJfrn(-_0Z=$Rssv+wOMReZQ#wfxhXud@WA$d4AJ z@4tE#lpo7t%Z~`P1t}DDVH9;-bhWd0Z*x0*KkOa3OiquBt|dpcn1<$L0YwU7<+$^3 zUiE{H{#Du~Nm0*&4qR%*E$kq+4dM>I{O(_&ZI&4E+8q0TbAvg4sFgfR&UQS>n|*_W z&K#wJzOU+8>RN@vA7&9Cm$N z&>ucwsE<&8@-@!tI@F4f0i<1m-5HDXl!Xthoym`*qwN>vV0?DtuQC6P;f9`*l*Lkn zZ@=$KehM?Ej=H}b@AZX`y28jMs>%*Fi|yUmY^L~J918|Zqj0G|d@I@zShlJ6!!Ofd z|I=fiJDp4M4f1>9aMZoLD49n0DVL& z@@uyq$2{zkvK>WU4YKLEgE)3(<8VRyxZ;wg*+qxZq5PLWOB5S_3RHn+fO*WB(~^W* z%-an^K~$0K&pR`VPuUnJk&=E2iBTGL8Q|HazluuFbdMk?h;7lOpj%QtX<6QD5qG4Q z=aXx)Ni#m6>=wM0<9M&c^o&MBhwK>lpwBmAP;S955fabv3qvTjg&cCx5R~T=#Oq=s z;iwpNByW)_3$7l2*V*-vN>rKD4VTIX`%K0WLq13`KRZ7o{ImtCfZ1IiRp+}59Kk?1 zHvRRORvzJHKnl@v@_;T=Tt8r?`5EYXj~Lpj*60M0On~?;KhKA=%cKS=@U-BL!l_Xh zM@L6de5gMK#aAKaUjik*r2r@aDumX8@%m8RI=lD>(j^Rk3EcbDt>Gn;eo(Gr_RXTR z{|4=K2V)_?8>k7zNZZrLAjJVS5NibI3n-pz)uHdU^Eks@!+uIsX|yDN3do{nsc+No zd$Cr#i()($SQb%;#gzNoy&xo+o>^oXu|1JY{gq1`3M|XZ^eNEgjt_Kh`RsSBay<+_ z8%T?u-NHD3_0HX!%+%?MpLLOFC%=i^RTrGjM&^n4LgIPn(z^Hw>xmgVo)VJ z?C_}$dB?bT)AA!mf$$bXG0KM>idua6_c1~sg@8+cV5DGZ3!)fG+Mr7b~`pj!hIGb8^AI&{E};mJSCE%$|2wU5+MmLXV(OU$R)LbknK2>jgqeK{Z7KAv?LI0 zsq!2fCS40bG02Dh4Z^}n>cVnD*Zw#`=GIZ~<*Od@Qlu{_2ZgCEx!5YPxTIrSug%dp zC-7#x2FP_TMeuSFEtzAx4by>gfHabJR&PRo3{kwWBmWWiGvPt#GYEmu*7k9ng5BrC zzb3p8k9YljWL)Jj#zn~;&FKK^H^&oHUnNo7o$aKM>gIkb-g0|&UDVCDe%q_n)Cxyo z!Hn-{HL;{bdFV;Q#~$EP7Ctay!PZz|u`(}z+OGMEy$G(>3f3!Q_;bY-dG0LqY!GvQ z92mu5>@}`Nz#@pScvvJ?IvpO0Jy4a3Y8S9N zzgbsMAh}E;w1igIvO&l8ED&EU0_I&3C^SR!MM)oe29F6Rzbuk@10dGT;fatns$LlA z!^Hn8>Eb5{45JW?Z3*1M$>%~kMZWfbu;^sJR~qVcg!|SwSc`PtoYMFPE~WIIr7yg^ z&)|wOALU*DMbc-y!xxQ2An5X2f%gMlUgEUiHl1|Oq-QhC8#)!rwA=l2fEcG z{$NsPijm;d!pu8UAKdwQ~1pKZCcP}THq}OkuFJ+zKs*F3x4y_c_3Bt(CCQT3mCWo4`;8tk+Kfg z6UzfPxZeXN6KT!o5cZk%uX!n6njG>*dv-gUlCf*iJX0#+xge$WSEX3ES8C zXAk}o^4}e-6Vydl{f*0jg$-q(b$Is6i!(;A#tRW;!fJ;ZN9isNHuwO{3n+o zQ4|+{2dDK%`owVk(Gx78=#vVjgbPY)5wc;(b;j#*eMYYiDT`q*W_Md>b*YL!Ymcw7(U16d0y6u~@YcN1pfbYF zyEadh4O!(GZ__n&E})&7VGQWL4I69F*EB1il(yLs*AzaCC(rH(B7#(~;L>oZ2sg=p z85Ol!p9@@gk6q+Vk*=F9B>Z&QMP_du2(}@QSUlQUoid7nVhM(OGKu)m1vh?p<>ux> z@A&IDGfeMJd@$A1!}o`O!28^31K}9@><8l*=)08X*%j+@o|fQ zsZ|amFFqO^@f&YzCsoj3oSr6~2uD|c(UD_M_v1|f8wUg*%zK0WllQYhKlJ8;8$6In z?Tp)_vk^!=k|gZ{qE)QOXysgyN1K^M*8niJ<|W<-#v&=Sgg&1P%a7pX8iSS* z1dUHx&JDWkCDxvmU&2N{c6kW(VsJEe8O`Z$Vq6XC1Yq|M^i zcsPfatwWd+4*s4PuuD`v+*^Bm?6kHG%1v@>C;ev*^Ma2oHe`FP_3UzeJ264RB!pqu zB27S;TB;it#+}tt>+cxD?}dkdzMlqxo=wpu1w0*;gnhz8EYHP=-%AevPIz=Zea~dR zxIVsUCSuXEHVk_{NT9#hgw~7WzX2Zkz3{))wy{4a==B|82fyD#H+a`bUc>Jdh)6I% zBW@H9YMIkzeU+0(XH&Aq&%)YQEGsoI)D(Sd`6Dq>&L#&pOD`+%7+3@@N;uFV8l5ywpRt?+)M`mA} zB`oSAz;D7UsGqc3PPk%!E}VzfP|@I5;a_7)F!epY>4M6DF)ezGj>#f2Hk~~q;0I7S zhK*C*N{Ch|=U3rh#j4@%u03XJJGtD$2f@hviYu>%p>dB*=3rHO?TisJbQ}1^mxHff z4wQ>CHnQfWYeqa4b#hnxPD_#G1fI$+6DsP=F<>IM#m}Te8|7Vp)J~taW8xtG+ylO~ zEYDh$nnn2j>t3t9jEt<#GTaSe%}BfQQqmmnw#?&r$WL8IRTFnUS4Wh1+emmry=1s& z!x90v{!;CbOKk~StIFfIQA5ykgYlvfq32F;mx5e`!aV!;Q-81Xa1>kWTF+=7+6heUA3pV>$)7upQ5;3K zi$Z>$WQ0*`wWFJVq_;GwPPRqWqKCx9fIO__|B71rC_nJ9DF z3++dsyvz>;oeF(D5xxz7F#myGhep*;LzowV&4!_2pf@n9KqUMw zsw!ZcQuA2ehIL6ciQc|d+po~b?}NramK9U%ewng8maD3)?4U*9QpE0F*r?_@q;LvI z)jV2{yP3XCk1NcV;WGEOxTjbU-llBq@FNok1a+rQX3eV8L2&gpK^?0*ddSaAqwaEl zXB82t#ZzJU87D9ccPSqsob|OG!i}g7NLcHEnoUOC2E4bwi~ijXoP$iUSGDeD_*OY( z_||2A1|1OF13t z>ei4uEu#A6H^XI!PW;}YS#H#T6Hv+nPJg_YELjv9ec1{Nb$f|9-$x7JNTq@i|&$?qU!8RN;u>L zRNkus*n#<;J9jEI2UK&ev9nNLL<{fZBYh;HUmWslTS6{sCBL+@3}~P*v7X;L zf6b9U6LdA|ob8^;7-+A08T@4FD6gYW>-WzE$whW;JsUzW@OefWf92f3!~V+ccZSbn zn`?m{v1YPb9Xx?PDBJh4tEOXw0t`>SE%eu%-{jA8hXl2CZOej42Z5Z`Wi4qo=8qj- z922{05Na2(E!2Q2e7GJ%NA^;xKgmdjGSZg!wr={)`F*Q5u0+K_O|>wULRd{yO+^zy zLoO2S)N+9Y!aa|ZBkC&I+iK`PfdB57bXyc46y;#d3N&DJPh`M0#oX!uUELYXMVF{s z6dr%GoXhRYpqdq7=I)SIhV@=<8ksXoc;8(&4~$EAks;q&-Pf$dlEld^1v}(Y*myqW zlfRjDNonL_fzLw*s1Mns@8Ot*tu7ETaj-m@~x@7Aj7{2 z`O`^;2Wo10aTZ+kkfb}*a|Z|IoT^E7X4gL$i0|hKlXgn^)@@#pKhBe$iX|WdGpR?1 zur#0n9G!Djh}_K%AMQ;hyeIC+Kqmj^qQURS3pwTZ(|wYey+r4)XifU@7?_>4?5LPtrJw0d)fgz$ zm)C4XXOfh73B#kfh!0n2bMkgzH0ysfYl(L_b02RNdgm&{D~_$wz(%|2}(Q)S>cK-A!21U?2b zX-j#72WeKBM(g!rU@`A~{Rd76TSyTQ+`8_<3Hq)@tr|?(Cc~gB#P#$AuaTXT8ElE6 zwt}GLbRM+GQ@E2VsE20v>zscu3O_fjU|Sb+Pz*(V5JiyR!1-5M;XGu~9yh2M6ZNUl zqUz>nc(hSZ@`&$tH0&QUF6I5rJ$oD2=dX5&{jUd_d+kuvNt6e`M-lxzO|ZJ9Wpu$W?26C4*zf7>c692al{MIM<9Ibz7sS6+W3FGIC zLnrOj`q$=xv==99Yev8oN4=f|8sUJ)Uh3`RdAI_*I<-$j%oml& z>$>4LGHQdFgT9HeUn0M52IERY%Jw(@v_l%a>yQ0DNL}vk?Me4IT1gCan}`Zqs(%wh zUI@yx3!=RF@fyl1AFzMy1W_F63qw-fiQ;fDxWg@-L$P!WTvNsz@b!t~-pIzUNvO3p zy#SG`!>OCjCp<$-OwRVvpmMP%*7#1A@V<-mp*RqiHxBj{$>*6?4y?Z~Ep0F~+dgb^ z^C8`|@x*YZGhWYSDr#8d6eO^Fw}AdF@|`j z{S2~@iwrj-J^WMjmq)nPn05d>rrFC62?z=3;K}|2q8js3BK3rIhif9B@@2fec~1>c zIMJIP#L*MEIe}F1(36xLHwW-qVv=Scrjf*tGr(?aiT3V0p?;%9*5GS3Xp{8W0}T}? zI-NXM{_W(A6E{H_&hB{z6rci~p`*{tW&)axTL#f4FCmVbZaoS|WwcaORs) zB22;wWx#?#+!%>>;~O9T3=aQJ@Q*E5-Eqv}L9@}EQ;B`GN9x?X`la}&?z-yFCXq{% zI}4svzUjLBfVygZxQTtEJL`blXPdWd-Nh!ZNvZ1~(pY~}EkcQ%S;O7C&{0et$aR!n&)0>%!JB@8_WvD z_Hr4`RNp{L;Ju(6S|hyYre_XTPhT453K{vgk*B8hGWYfBmS=7DJadPkTa+X~*aO|? zb?h&+J1n#wL?7R7doXbz#24;frQf2{W#YxL2hLfaGX-d5-sfQXo|Xg`rT+amGD0~P zWP^X0T}Un50e6;a06Lw z)#NJX1XQeBTD%vwxS2Q=Z#leq_Y+|_@X`s0xbox6gT zZ`aL(HYr1)Vz&b_6K)=X1_AIio$`MGz3kKJ_{+He#;|M8auT3yr*GotHHxJ%)_@Lj zgE^+Iv>TD8wNYcIJ$_v3u{lA&U5erc!4;bEQ_R;*u!UsuowrLcRyy=Tcv7*Wo zV0nF`;5Y6O}^|qVVA( zzvSmO4Cg6h2zKA>5_nJD}&_?v&M%ezx_Fet-UzNY(jRl<+mm>3LCejL^!@kfMK}| z(%KQ2QKLm#SaP97Euu4a$C|H!8?WxycbGjJWJ|UuA$Uu;s0CVtk5Q`w%6vf*8z}&U z2ORo$(I3X+EKl9loW^TGcLAL5EocubbVU9@y3CL}SkKE<-1W7d@W+4ckrV`NJ;J4Y z+XE4B^@#`jn4)SdI1vXI^e7Nqc2`F{u)V5I3c2c$;|=WRljUyKk>0g>&k4ehP+xk( zk7b@n7^LCc;ZqbgL3S&EtVdFMNP#9fpU_A?#MegHIM@Lp{~q|GuI^(h20F;D@}A{= z@jU2Zo1SU4YLHEx91MR0LSo~t=@jAo0^+|hR4-p<*^Tl7u+nJi^7XYCAOvGel6YQh zY!N5{VxVn9s|9!WMy9&}cdavH+8Pcp++LV*1G(?^ITL|9- z-U8yGU0*Fne7kU9(UjoU!k;%+QI@HsDzMDr^xW<4de*E^&rs2eDC?q!B>0kX%``P z z4T~HO@sT;!gBE|oDz!UsvtCouw0FoHT1RNNa1yV6-pR6FKzuHiBN&WsEzSk~ zHKM;HhM!I7Kfg8uFAe}=i+I|CF5>x?>n|z>eP=x)9B6RoHXMDTa6LvP-#Mz40RmI0 zZi>m!jV!jv!)DqHzc`NH#q{yhx6?B4UtigR(dUf@5VFiK4w5!zPvD|P z9)JKPeD8npGlbrdt-x#yuK&0oQEK4zZhyn*-n`RM4DQhMJX2O{usTiFzx$)M6f*-d5R$3|KKEL!_A!6Cty-uO@G{?&*4>SFWf zT}^+`^N_)}+J$rogj#(n2Arsp^j}{jK)+QwNEd>a;5IZ!F3_N|ISw34 zPBDM+sX11C)4V@SgL7I$`xV5Oq58ok)O7c};Q%oqag~$PvMr;BG6x57M+B40akeE$ zDEFn)r;**(-Rdek?77hUy!8g9w!Veo1c>4;wYtjAnf8|Jo%lqWDExd5`Pnzq&9r~a z#D$-wyb_1r@2+}fn_p(GrgWD|eo>a$s^UhT`3fbUCn-_NcYVi0UFy|}l#pZxGw4M< zk-H#l{ZQ;NchU@tf>Ovo>uepwRpvzg@iT2vw%>nROB?ceAqk8?1cGcm4|JcO0Kv)C zC$#Q^xv{T^X9tB%>Ey`;le6pYUGsk)PshDV-sh;_Xv}H2etOvDwMHM=KkSwYHJV?~ zkQ2{qP@Y?7VPtFDh>JiZj)AM2xDIXI+B?UDC>`6ggvc#Vre7J75Gss^F)6>|{?X8J z@6(RZuXsNfBmXV7ms+z`rwdY97vr>gkpzrAPx~U^5?~1jSrjM&VIQjzlkR`|!Q!KV zAP$6Is6yMd2SXRa)RAWA>SH}ux}ic#n)AP8dkr~ej1EQ;G-zaMT89*Xv`2)t2P&4e z$lL9h+DJs5Z{7TfG>e=h^**%X^G-~^OILa1c@$)sIhfq~KI&tb1%vo%e?ZaB_U6v+ z?PTH(NtG#?h8Y}uS5bx;bk~1Vid{jb0MXu>zbA&DUk3i+R`I6PT9ZjI&ft4{Jl?ui z@3bj|=mM_MXzFE`W~(Lz@sf#W&yVAxDiY#3vYu*}lzekQv_sMUXZ+MssW+vPn+ zvfBQHpZCS|VQ$}LN?RA{woI*W_lvGS2yJL7KxHS39TK(Aa2K**7MZf0;~4Zq>G}fFE#wOA*?P1tjmseSyM(RqCrZdFdRAP zpiD?rouo5t*NGPpbJ%|)MgB9ASNZA;9hmNki+=Pis>x5J{9vL0oAT4`Kve>17_#j` zz66)WKO>?3{8;R>Ai_`zB(}awJ#R<%Fn1*ZokxHhBR@W3F~2d&fsr4cP6uNS>xIiM zc8P$vD&!WUB>&YAo)=gXAc8FUb&KPq4Z%LPD5n2^hk!lz%`bmrfVMbdV=m%g2yVYx zb(lssphV%6^!H0PG$>mkz)l{7J`<-Kk0oeyl+utKSmhsDHTdTksE_Y%Eye2A@hQ;9 zG0Fm0-)N+F6_OQ{Ov+UiMJ{po%xma+ z_o)Zv^;TYn=skAP`6bgl>A^z4tu*kFsjlCn>Yc?yl@pV^r>}eKBVM5zECg2il*ng*2z#UL|Zt zwUBDlhf07;bj~e%Ch>TK!%c3QL0lo+~Xp>2~QTnoHHad zxnL(<k?q)zM{EZ%pF_Qiv)lZWV{>M~}U8Ig(fOWqr+i#tJuJ5-C-!wPXUZZ2N3WT{O zNQ2t8*Mm#=?Xqbp<7!R^G(HW!qei}G{UPeZlE+g3p8R@W`3;V?K$_?0TfE4WV&}yH z6=X=Di%xfrDe$u7^}}}eIfMWF@-2Ass9%yXY8T9*(GgVDQv=otY|VMlQyoPf3Z9co zZRpCRN?rzkEc^tTeixN(-oo14LrGYS%2k+b05m{#)9M5l90GzD;h<$7;q&v33jMDAHgu`6hgHOe<;Uy|sV~A^O4TR|*aCCY1;e~;8sr!- zTedxaVzhe2l!Z6&)O~)9VN`nSIh*Y~dwQ6AxD$m5oO~nE)fU5T8YQTw*5V$!>CHT> z6J&415|Q%uV8?&$pzoJpDE;QI zjuT|N9`W3(emIfQqFsAr5oek)n9vvNp$_+dw1#sG5KG(*3Foa*O(*>)eBeD%>H{-; zj}pOmFX|0OY>&om$_vQHE5%MjbjAt~xZn?`kxEZfSxRSB40eM^2cpK?&_!>r%jG33 z_G{+%QdI=P&~-Py5dmq_6y{-`i~SwuxQM~{TMjLPKUvP~%rU-jK&bvG2s>zts$zG4 zQ#S|7EcO*I@y9MqDgYJy_5)}dci{T>V^;LUPLgn>3GXVK<_yV&X>|FRGBgOIc0H-Z z&?LMiGl<>(0+armm{}Qqv}+b8@{5GI?H!oH>dQf9=v!ivm&iImdn8Xuji{6k8=RM- ziWPIk3-Wi^^*L;q$-Y(Vk$~H7$V0GSk377sB`8mUGRp_R>Df*6B`ZrQ<-Cx9x+e1iNwJfr!qn}~*gBU085)pD!1wPP$G{Hym0zsxWCd#LZZ zPjX%v2g`u^zA*_`%eeF;tEjMO_9I$Rh5 zCs65zTatB(E~v~)H`z(-@ON;J2D@B>L&qL*&vN|ev@QLaxa!gj`sY4>PdIMyH`S@} zF+=(w0q(=A>?-~?q3u5U<|(OyfXMge`t)k9V1ymOL_i1RlX3)5yhZaFIq;XcEmAp{ zT9IYseFAREx@76JSPedF2O25#hukpz^l+%1O2O7+$PEv-eR!-F*fX>}>-HN~m2SIj zx#vJ7jkVKs4SmXT z(w*fYz{$(y&)Hu-Q6eY)sX_Mpkti6$PA*pw^Y29@(fN{9HdK;-=t)1oj*tB8C(>2WYxt0qDngT|io?L1%2fi%M;s?{=R}_z*>Ez8$sEz96958*G z^i0z)5BmY|thwYH*Pf)_K``agY9ZRI~tu&3TTkKqXUM%b?J5qLo1Pff%{3P>!t zU}DZqfS`%*{!+Prg+bK!U3W(xEVf;}o8fRYfBNeFA$@scd^MgGIBhN1@BAXxb@B=+ zARCILjhO?>8w_K z@guP1dkus45og|l$i|biaoUj_`9WO1lD_OQ^;l?mCi#(n7dm(z8OOE|`8FPI-1Y_z ziA0AHLEPvrkUrQVpCIF3hWykYL9tzdDB`g^_hioag;^c|ELAoRD9Wh9^^VsBxSOnyVPYqv5!K>l*5f}R+-1iPzc^WEk8H~)iu?i74 z2_0mo9gO?e>otj+@aB@-p-x@9d6kHt0REMQhUNOB3^RWfBJKAousdRUh5Z)uR#&TO zH<3l!H%Xk=pLXlHEMA_E+bWWiGmE3ITH!N)#K%yybyBX#0+%u#UOgu5o4rkAh`b56 z;+#Urh#h@bvM3Vx1o%CE@ASdP{LY4|_u%fP<+w`}8}I~`cF@9hI++6uP1M=ZGKsW1 zulpe9USOa7j;I2XEdq6|dEu?Hz# zU*qEj^|(=x^o?ezGl^`dgEj9Dh^1P8O?5_Ef>v$@^$Pnw`aAp{Qu$$sz{o1X@?BHKg>43MC(=-n&k64%BV5~! zo{epM{R=@Pe(z3CA%u(iB>gm^&J{w;Z~9Afg*QM*QNeP$>iE%90$T=X!JS%v9me>@ zBKNQ7>*uuhY%&_gF#@IDa0f>bj|e>655An1yl0eR2u8e71RYSTZGcb?@zu02f{+l7 zQ0q%ZR@r=~MSYw6TH5;r(bWLLa2Q>m)};dowJHBue|`lme82xj5RAm}Hw<4Ay4_ zQC_TGn2ybD?9|xjfIZwZ`^r7=#dcUYJPi~zN2IRJlTDo`D(~x_?tr!(E9s5T=96|OdWM8$xSty;eBA{$Bu4I<0Ns0 zFe|jH?pg7y6wZMlf4do;WqDG1`XG&_W7*r*_BJWbkN0MOujC<+NP!Sq`dyYK6v~LjJ#nG zdaslW;NYojF;f_TzQPKN-U7-XB_F4Vj1Q9r@oq{#lxU`k=iLn#)mNYCk?}QKXhS_ zNWu#kD(v*?czl3`zXBHjn$_Z8wOZtBV9~FCfyKTC7XKR9_rNYIITBY7tJwrJIlu29 z;+D@^H?Y*iq^1|~a|7LU<>pSGikK(7zq`zTI*2uXc(0e8KkhTGgK-v{;|5g^M-@-n z8QLknW!S>41!V~o7u+spc;wAjbK*Nm&@anJsq3*B#8xIT7$A^as*b58TIG5&r39~k zshQXHf|r3Zfp1?gGhblguYpCrRRT_@8DoG`bhBeA5n)FSMvZEHk7EGqj94zWHwoV* zMLGV>(<6U#nYrC`v0eP8$rdeOZJAHj#S!*1u87k9l%eA_7Hn>vf*L-i+T;m}Tdd-T|RUh)oKAnW)Rb!1iEFtl0~@BQS!U&QzbimS<@AZ$ekA z!4f<*47gVf&=>`iZ>VomI6>No|1{Nd3C7G(WDz(DUFk!5U)e?ilrvoBs%33@J1ox& zLk)EP8c_O_@x8!)Wu$TJ4aX1?4oDxOk>Cp%VdS2&i{L2z=3xOwQ?~E;-lOS%bPJ7> zTIw|z1@*$z5!vqL+Cc^SRO1{@d%}X89d;Bk|5Ll+h4JpWt?w1V?zzbUyc%j=Kw%z? zd?_PxpFIAajOsfMiMj;jd+1j(V(8sLrS5a2Tm<(>4~1O9`$|RZKAWio)yZAOe?v3|!iMY6p?74oM0l+x*~<__|R;%OZCcR0S62_En0~ zp?Ty^r=vT3s$@PgA`trCnGJe_odCr>B0yHJ|LYjxl@ful^>~nP9!)`xPpsrmk@LUK zh#&++VF-l3xsGGwxI>|~hkqp_29YrRp2$OE_WgRm^L>>1dyLI}Cc7VhmmiZ_C6fz- zDWvCiOc*iUa&qDyDUoXI$nvj+5*>34(xb#mU!ClC;J%N&kLJNenAMw)$zeSNzO`X_ z-;>MTuG)^^p+5Td@d6alqyzK*_1f?W^f}1?*FcfK5BlBSs70&07UIdwE1%3k^qS34 z(;k|weyaB;8A+$5oUZkMtZzQm*$-%cZHf1bdN8!7x3K)tx9!mehs=6F2tBa%4P9V6 zBGq~))d0zjgmX9oL$x=it+;LJ4{2#XLw`Id8}m9hBO}sRh_A+R>y3b*ZY@^ewtSE0 zQRPW4*tdjpe2ujH2fZlUE_OdUe1}tHEor1;<;SjjV zw&TxN{vYgTvzb_Jx=y?9glz}j&+GG(ljEX=NanzinA0*8d>mYw+>G@s9${vyjCA@MTc{$xN!lO3JU3Q?$-7R+(Km=B z)<2}{tSbG1b`*nud7m2X@<+d)+#W)61LJBCs zBNI2pQF!&8zOm;0^sPAY@zBCq?-BZ_0z}zt_)~ug*sVc-`7~%BWzfX}!{BV$Mi!fS zJ!UVU=wAdKeW$&*+<0v7L9Uh~fvox&#ow^I^28~JdY&t}CF?zJ;W?~}6xE_;q12I- zsCx~Hd`21Ml95xyva=-p`~^MGzJ`+jGW1jb&l8p56jaQeuMLcF36bbVUyTTJa2(j` zpzSe900;7aK6+6{tEZZjh2Opxh`wIV->017t3|V#rf;-sdzg!282WTM&-<<;(7-?t zmpyYy&Zm8#gb^$lybsbTKRMSfF(9`S%EOtKco85SLJW9d$n(C{FQux>y18fclAau%v`*9BK4D*s0uk5N)(5X#Ba%A*j~$ICSg4A4Vm zuqF&4hLHVo+wMa>yA4bFORD=nL%UmF+IxZObII7C`2FfXuX=cFu`<+$#*H!x?ZBO7 z(B|%PJ{TSw9X0+nBlmYC_}7!b#J6t}=I#!EmTVCx532&x7Zcjgl#;7aA>SNKhJaM9 z4rOri*k6B>Pv9ROg54yImZFg}B!p6C;X>t%%scM3OD=E-j6BAjv(jzY;&~%Sb{oZR z*;Mzw{B56ss}lbhpfd7a01xR17aW9dEzMM<(cC#{2=LB^?ZTe99Wuj9H?;O^^wvv% zzuDrCD%y|&I=PPAWoyCOO-1D6YU4O~3<_Y|&WZsK<9^my9-641p!-cTHg@$OQ?dK7 zGYH2>75z z+l!}ki%m-#58m>x@YBvsl+c>@;0pAivwPN?*i=T zunIU|t?F%_1ZFP9^`NE$*p1$fj8#^KhdROOJ&@de7O!uO7JA}Pxm1lUV9aqI8eJ_M5+6LgeL9z`ZF7lct;ks%TW|n|;K8S=!Y=br~Ys-L6Uhl;C^!+x>k^VHXhG)#EEjfwnoW zbE8&WWi$0Dfq{T*gHiSwhNYb%Yup1D?=U_QsG@I~QVF^ZmDHxSvum2qX zZcu(}a{LNUUSp@BXNDFNt%k))VG&~_(`le4zq$Hh2b4?b4I6*+EBLv6&*gmuuhpP# zr1ZLrqnxW9QAYAxnBI1Sw1Yj~8`?vag>F}7%P$W0=dljr%-)7$1fGSBL4rt$ig|{g ztrWZryL#kB&{4<7R>;dxF7R*7P6mOu-yARRV^j+uqRN^Uft2AJjJyKUf>G5;3L( z+7nnGZu8Id*eg2xSJ5N)leQ0Ad=3sNK(=F?R}OLjnalxIF~7!tnFcn|XzNysT@c9J z{!F#6JFoBJ?31IT2~43RxnSmoAf)EzvV#|V0D!%gPqe9>j=-U@`OU>7ezyH`ulNMF zI{>``0OWov5@+q8Az%e8NVP{WQUl`VxV(?{;-!nXCB;9F0Hr_{gbcwj2KW_boyuJuV{ z+G(V+hH`B zXRZZ1({C_Dt&WpcJj;*RF4n!~`kg)B`?z?1zV5v2$t{I{?=#R*$OIBT_h5%V|>|u|bRoQs!xo0;vAL%AJwfX57izt=OAHG1vP@qnDrz{#y#W}ob`KL_=|Ag zQ@R}Dgs^RPafI!qWDb%_9wvQ=lS``z^o8*$s5+Pm5`r&!^i#mUvC!h~lSIwE>(>1W zIxqXy?>;r>)v2xoe~80*i|oiARj#6NK^SH3dXHTwpHSKR|p~D!|>mrR*)f zz_;xb){J)9F7j%jjQx6q3{P$@G|zF2ae5Yw$y@5XDQGuUTs#*A5$}Qk!{9f>4QS6L zXxhbpABDi2w@a!VL!vvLE(JjFL;{E|bvZV8**0@AC`3H)<_*~~zoLAdX={tl_7I(D z#5t#ASCKSh%3#n1E)8viZHzdY*f=bIY}IFvHp%_=KJnvjU;Oj?(*xaap6>PH*c;@) zh(|a$0(*}~Rf#%uQGHX=_mHx9_i-Ir)8KP|OBuVWfVeFSx!T@HIx_ut%+&iOB8kFp zj)y@uh9W-p)L#96%v}0G+%2Ks*qH}5c3e2+_}2JU+5FQy;knln1#?PR=f+;UEuP>g zIKuVSL7YotWMPQcKtaoRxbhCv3(pGNXX|NMRg#Q~HJhwL~J?u5+*ZgR|AQOF-Mm8f{qiJnvEaF$BTq zFi=v(*{Z~B&{_S)G6+5*iy#q75}izc+15RyOFV^}P-oh>zmaouE^Uy%;y$!xk(Z`| z@4XP?b+vX^-urWZ^L-wV9&q-2o*lY*n_gS;wB4#u>+AZVHakbOtHY5qHny#9_qqND z$d5Zw@-&?rNIC~`L>dB$F_A%n4a!dCK83YJ0{f%4zdB6$Cu@GvSbrHB{yOM?cfF+= zROJhp4b5%gE=>p=x@k@~)FF^8T0Rgxk`$A@Et*39Bg}{8`Y3cb*JD}U?A4SXv#oQw zSLp3LDoV6LEcf{ZyA+YKdkGCD_lRKrt!I03Z`%I-s6UrCu96$WD3pG)0|@qQGN2&j zspIZ|I5->$V6YcQ89~a038e#nW=I=fboY_SM;+@$`D(zwZl0gBKM%!an~dI>oaP^f zk}9sZQB@Qt8~6mgp05!PDdufkY|6-KU&Pt!k$No{-hB$}zYyr>*C%Mr{D0UsC^dkPN#ZDoVKKaS$dGxYZnO065^vDdv{$~0x)`Jc3ZDmq(pF1QIy zXkBja_Z!l-x+H1E9cf&+sn_+ml4~iYT5SAdhUbd`@kE&2-T{z?y9mS?|FlzaU1(tdJpTlk^fJ9;FE86W7#cEuj+MD%f9bXDVW^IHP5*1H4G##J$U#P!Ruy|VFyze5T~eEuAx3f4$H1AKk<{Ukz^kM zndeP+NQE=lY3?b7;2h?0;l#J&!PkIN+bgd7ycg5V?%S$tJMg}L0av@L{iLO+T^dj? z8f8<%642*0OwAWhvU!}`#)D_Ix&eSKQcJ96u?)S1~34#*^&iSa8 z*&f7VZ;X+OqMVXemI0E@_-m}cw7efv5uXH@W)%cs?wez!T1u9TN4YLx=#p9y9L%U| z#U+xV4%dEv*aJWC9zQbOAR|iF8S9gcM)+_L!e@}4Dsz7>>{{{m8`N}V&rvtbD_-YM z-6zJs=nTL{G*SHm9^zFs`j+Oyeo%M%1ja^W=O8u&9@8iv9{3-??_MmfOps+mx7tGH z&_D@7Te`m43ot6yG|p76VT){3odL%B1=6EIbnqL05SY@XfXEH3)#-XwI0o31Ut-QWBtTlAhUdQU@n3n2}o=EyyXYpIee4 ztJ9Cd5dP-j4oP8{gA?#$KLZXPJzk6z8as;oYDexJcGhm?!Q)I8w(2fKh!BgLGO64@ zB&F~6DvV$hLcP(L=VPQtU@n1vHR&p3X#~c9sW%64T^EOG3WEHvA${&OFEPu2cBpN^ zioG{WZGi!dhh2AO_5>lOYTI$jo)V|ii?a{H*L3?^*=I3pYEx!kcAgytfomQE<0kjYlf7XPKJ~laB>>A-VD}% z-Vc`O^^A1gyB>Y-xPOndeS7_nkz9J{_da!P@%mbvZ4-1shLveM>j0w!&KLX0MfPUu z1@@+Yjvcr5ciH}|k7Xb`T`z3C^LL7ONHVYwxH3LwEIxV1v_6TRGRfwJyv5k>fw8{{ z-1LP%uAag70MS!@_n7Y~uboK1r1WWjL500&?Q!iqhM~~b>{9g$z6U`a=6~`w+Q`qc zv246gEEII&hLQ73FWZQEGxTynn*B`sW{Xu@YN$g%Im&a0vB*z8<10AvmEcd_^7gh2 z<8`w=Z~YKLw^A+xr+iZ=M^)Nk*`d=~J-ggCrbbyG(BHi;@B97QfB#b+{NJm85?Xz< zZxaGvt+_vu+vLarum_`xIFC8iyh4UQ#0fT-sZ(^*ari25=fHW&#s-b#JmVyEW({HE7OW0-rj&-fjU82|1vDN)vv9c^{hq z!yk|5wNXqX!#{8%!HWKDgE-d;9t+_`rd7kwM8`x>N(6d_B< z{Z^oeKya(0MRyUlbl{Vp5D&CYfG%e^Uz`xDsvNWL=nz4()VRFiWs+niomTmc(d zfC;)4Z|Fe1VhlctO?p^_1yS7g%Wkw9`{bKHi3GiyPC89<38mLV~+;m*e~23KU2E6 zi_PtNVj(QmBRVjHt<8Ha2D|W|alh6P{qOP1_PZzeqkZjvJs}=Kp?hCGAMpqegE10% zEJQt~nsAC2?Z)_WRse8!9=-mykN^|lC7(%gV}SD6@>}HDBhE`_2D2Y?kH61&4UX6P zgu%<|@rPKzA2;y?z+8mo2^d}=WeZJd{}Bg#!#$mG!eq-Qogw6G*L1GE)p;F8!)o~XjeN5V$RfOOP$;M#d)zF z+MxV+sG4mjUFZBsF{AJkqx3`Q) zEd@42R#xp~#&nKTMK&h3e_r$}9mfZFNbs5k>7yh38R(;R?8qDR6aq_HuW$HdsWGX} z4kY+AscqTZo1CcN4%vA)>z`w{aah>zcmCf~%k52N(b%3cvgoq2=~l6Hp5t5jCg>49 z<`7GNTvMSG6EL>^0P$g|JB>Ix)-9-Q_c&g<>^iu4L^BBC8K*u2BjOxcKC9c(>aeH(KuS$AoXMLvSz(6u6zH)QxcLl%C^V-QIlJDqniqeun)0WOOOq z9A)5;R8Ya^!BJql%s`vVCNqyCe~OZ=&qOzW7AkH(*}%_`k3MgIGkCt=D`qZbcT7SS1Pg~I(Znx*OLxEhyH_of82(0knD4<9P9XH-74Hy# zs$8nc^K`k9!e*w<*Ha&CVG;=&3Xni?3zE^EpY|sDdVoB?xlh8nC-u91)A+@s0H+`X zq3*F9oPP5m8>MZ`b+D(&i-ad~P|m1WoLYi2%q|(kNn(ngr_G0g5<*mD*Y{kq^y?=0 z4KoV8H?hUAH^+88+9mw}_P#~tPY3&dM!Oquq*NoK(V|taHf%H+k!0fmFBK|-F)eeI z;B`m;k0}4@!!~}9`EG|i@sjURO>A`;F^9Bm40Q<-dsNNNgk(yQjt1A)tT6FOkeQ-s z7gxbSPg#~b+?>sFGlT>5Ti#do_P4R$FWM*84$DKww=~AFMK@)=(jSYbfmGv)9L)pY> zU&Nq&p9b-2*|Cl!#7ln8U0jyc`eZrN5xeQo83NSxzyqCL@Dr(C^Y%sZtiG$ARbUWj z{`b_`S7jl?W*439NQ@_|Xs%j+25xw*@BDMe!lU0$8$=V8{WWmTFT18M3cp!aB)jj* z!hg)=TBQL*-gCKDd(p-*GH?kvz^KQ~3KZmp$|Y*wYZsRvxBgP(;6|9_V|=1#!4o(o z=nh+WGyFL%eGkAx6pF#bn@xHy5RFqf z`R2MPMEjV%`go5HcYQKr059q-YvyURA8L}!&!X9I(illvQ7UU3J)!B|PxqtYxZ#ea>bm+!1WYIOx8|a31vtf?5KD&8AW8 z#sTrPOu-zM^uxfq64s%BtP(sE%k2o>p3iOJclR8xD(iD6zPDB`--_UqOQC&H$UtWe z*^X&tot#T+yl#!dA>NpD=*hW*@5`M#R=xJDg^SqF{n>xK`Fm)8%R=6-8ZhL|h9RGH zZ9nj+N5^T|!1?KTVD9a$VAVKrXQ)muWHlbrT`-Czwj{0s-iI?i>*8Xvz5GY2_H)DD z)Gvgn-5&j;m>X`SUBWP{nmt*IyJEjFsuVU<&b4KMVt$E9-N6dAA@HUnEL`Nzl6EBP zOL=X`%2&e;u^Z!m5yG?7neX|ZzXp3chHibhXv;OMF&j@XPZO5Bb zy1Uh)e%_L0nw25gXW#A(p1bLBaWlF`-rjmCRmu4BXoxM5>d zjEgIri`{OynzEY>-Jy&HiIIfok60FM42G*o_&jCw-e}-{MYVdSWI)*tj@x#CKK94Y z4t>G4pp_E`7QfMnbvcm)ANQAh+FUk$d))aKZ4a2{%Q)xH2}y`T==Z0D-{8AFWm6R4 zJq=d*D}=9q?VA4*DD@Sf@UtQE_fXLRB%j#lKrCp`J zM19V515VrIG#zs@*mFrR(3gwJ!pR2an+dzl9*Ww zqD!;vfGLt7nbK?%$f;_9Qr&^8fqeQ9%q)Fr$LLmZh9}D4jWC8{EPwjw z-#g8Jd>@hRgD5w4Wtc#F20-vaR^fz`H$p(2y44Wfjk{gX3jETgKV9a303T)Mh;wIQ zQeg4u#Gp=vt}_N5d7Dm%7uqKh63<%{RI3B_8E%>Tq5T}qTa8W>Cvf6EcLH(lv!D^` zIg_Av$kA(z-OkW~8xfx&j4@IM)d-y1-mW-*Engt*i1#t`2ZZl3b5-pSg1>pL?KlKv zVr^NcUKQ=!k@ekkbku-5lBkVDNHG`y8;5&hmlF zkz?W6*(;yv??=?f9d6Lmc8n(9#gCM}kxA0$OlmmH`BBcgwpI0-*@D=rW z1Gqvz9JYlI*`*ONVFVrt+l7u5Wtt;@y(fH&YhoVgw)@>@2mC*%Tfj*!EcVc?;;?QrOd;Y)>0YUfiXm2**LB5Yc9)>)By(0Nw z+%{Vo1$0EfjQk)F3YBPfp7VWHIO-b)Bnp!{#^8L6 zB3%DB&<~4;#3hr{1iG9S?G}iCsWB{$3hmhwDoD$=DF%d9c9@CDjQlHxIJZOp?b{H~ z4`G{bD*4&ma;IsF=^)uEoq?M$zQ~KoIkQ;uClzhU`Nly1h64V2if^~o2n^rTMeY}W z_!~i^*s4%T6btbGg9Usw1^m9(k#7Sj?(uRQrtnprzo9l6U^L>P0qop=*)6j_CpS)G zRGHFs_K;e73j08Fa|d%T=Db71L?dI^^=0b)|DOHvO6O?ANfnoZWSN&biFeQv@WeQj zA{H>$os)RCUO<$veW|v5Swzzp?o;pxhH(gk@%4zqNI=;1YSBROQ}F15Ul*rRmm)n` z#scQ%sM`js4@i^qIIS9g42kkdf7?O7Jcs`fKj(M+Rq%hr7xiD?6D?@uKJ9Ha2H#L0 zL-2rtY|5p-n*Qqvp0ezeV_P=Zh$1Y~anQ}lD5*#>Go-Myj0iag2NT=ZBDnwM(fAL; zQ(^4I-t+vZU3-Rvxp%kyOYK*=4JCo;LlEf>Lr0Aek6R}tiTdQ z`)L>8Gmo%Wd|r^%R<1g}>IcV>UNTUA3XZ?0G-8-^-BwZ_m>c&DA-2EEDNVWX*Gq|P z07|xYt9c9VHrronqzBZ8CBq_qjnBZ~-O!PnZ?n_()AeTVn(*9E0Wa^M7Ok^q3oeghM2ZVJJ+z;SLGg5b7f&^i+gD&dn~%mn=Dn1IUMq*V5?vp$$;Z>)68Oe|5MAqk|a136h5KT~o=eRhI)Bh(+_`e`Q-@cDI zq7fP*(Dkdn`2>uiu1$J4?EN1u0fz3KEmm0wQE#w|1{e%~2dls*-(^Qz>mL7JkoVfP6^3vOgYY-lBWTBi0@{7* z?a`nCIVQ?-ZV`X##zjXhfT*OPbQU!NQi&JQGEe}t2!1IrTK~N=FOdJz((m_p_q(Wv-{1Zz-F_N9nJSFt zp*z79b^&zujZm#l9)IpK#i_5E4Ku;nnp8b|$#k#m*0nRwPqXrV+w|N8mOxfDgCa2U zhLfv*)o1%S4Wm!d{>9`;Uf2%i(VWJORL?t03y7O;D}m&xtB$(t$lGy-UkW=aKg;}k z1GV=Q%QDYC7WCo^Ep0bYZo_A)vIrG!y}rXKFQ}Sk$2uNJV^K)PnH~QD^mBdE1p(Qd z^=8T&gi{UMAZ6Eyg2CfpW(t-yc6HFforzU{&L2S2PobP1E>7T9b+_lh7r=JWZ<5!E z&~#E9y<`+FEswo@oL~$1Bj|Tq1)EuIN%sRlvillQHT}k;@&pOiv?C9#iXcc!GNFeK zKJ`bKe`UFy-#BI8gk=GGahnd`T8_g%OHc0WI-(ZSbOw0O%F0nG>=W22PC1`YkiB_- zI3r25meo+nJ>I7Yt(Fz(VMgkB8l5?66;h{fz~G=Kf+g-nY<75M;6Q5VpZK?6}!N%5K(5cJCZC zOC8U;T5_^^!rAR2q+kGNH;2*WKLdRX(n@=hOiMnpri%nu?x{$nv<@z1*g7E@-W0>a z+SA6mfiEwiZ2eV|zn7@52gm3+L}m+rui4TO z!)B*vL0;9p-xN0Z-e>!+GMX}bj8xut9s;2hhQF2oF=`|h39bge;Ov=^ZQp7^55U8VV=|Dpw*qn2?%*}Q512A zfIwa7v5bm5o2-w_*oHVt=2_8yMBP4FI>^{pRhlEv+ZY9)+!jdU$3JF&-eh0H@FDm+Mu0S7>}GS zRC;={6L99#(sP^cdU(Kp+JA-pCCk632|kN~dk_^`{Sf$#rUM%eFvq9-M|~|j=Usnk zE7WtY90qw;LOor~S+ZE6x$G`mx~(-OL`2H@-4=T#r&dpU^~CVi4|>C0lp5dY=4$Tqv!Sxa0^2?>cMe z1-q`Rep?sy3@e8fQtReM zjSoY}Eeqo5Cjd0T-<`Kd zCpV{WOH%dRX11As9%`AJ(^ortY+0cSu2ZYh+|JK1u75B=hiU$VG=1HED+wP%yhxWmP?8Q7iK zP}-km@4`}0yMP7_H{2h*Y~*>}GTCqnW2*sEw!uUV{!Qfi@!oU>k5De~XoIgW5xfzG zKUg>V-RKmzsg-F(wKR*yPcab|eafqz2G}lzl&5HsUBT#f8oUPz650}i?~;hZcdVQ+2-Wp(JfhtWJ`+rgNls~*IsVi z1{J7u`%_`|87+d`lNn+B&2eFS{g)e%4*Yer$k#zXieQWZuLu>4DDUDldazGhxsl}h zC=EJObfdhn{WQe*%JsBAfyTcM`Z42|)EcU72o%GH5*F(lvHyRxeOa@sIMVH3x$h1) zpaDsLkDliNJp1Jf5Rym0#^CAKU&;GaxA8txci0tO`|Pf+&V@kATq&hiuDe`JSqw{U zt1b(TtKU4@vFNbBcp>>hvi;Onu_9d8c#pNV&Bm!ds9dkvvT(N+$I3ZDgA!VZ#Vqh9 ze>RI-Ml;=blvXwPHSRP5Vvh|DI2xn(VYIp}r}RtS|3Afl zfR7R(1{K@XSKyF`38S|6e6Bs8o$XOP1LUAsAwTw;`~7N!o2_0u@x-t)ukj93y0z!?<$dnnjNZt_+jX^KfTLYqb?=2JDcRjcrMj5)YcF?9{%u;z!928M zz5RC)#~$^or;v2OV4u_%gF`r&)lSBLaY3!Mi0dxjPw@@F{iNE?lZqreos#%;GW@;A zcQV-oU+sN<-0(WWTUJpZ5KIIBg#L?tI?vzvy@U%=*9kAU-m~{qQ({Ev2H+ z%$j|)hK@F=7T-&70TT{y5*< zoa(~8R;G81x1ku!#(5^M_-T~+k8P)Y7Dk(U{zARZ%4{`3S&{ir1c41qkh?&03a!+) zv!fIzBP#?bj_YxDtOqy!49sbNTsm;%+*TcPoF^V9Px7_5i43*sz62_tLLvkT89@k( z2#CODSinF$yXmEQ#FtIkX)O44-CNqL$*~#Phef}8JJd^OuL~#V)w1iF6ZDs;x_aA$ zYQzYGB2(<%wgOMETp<46QPVilRfzw3=@V*Zi#ZEUOK_`_BXHBMn+`{RL8CgmZ$%G| z{ayfLK%BpO$g*@*GGAu%PYpijAtiI|B#W{+J#^b~oUHb}WvN^b=KERFjI4fba1Yi_ zC)l0xn*=Am7w1hR3~v=@>E=hr@Lz4J`)D?2GuE|E(&@}aTUy~{++B9sh`QE@Gy!aH zNL(M_m%CH{M)~I`HvjN5)CNq9e~r%lObnm3X5F%h@v?9{Pb=)4nx$kH1LfNfg}kRd z2`?(DpW@lY67@|Vt&ssJ3VqZo0EZYnAFWoeN$Wl?T)i5(t!%u7nBEOf)Prl-H;2rb zuWR=JnCDZKzu9gpK?cfKF-(Y|z^f9>mN2r3@A zHvxLWSS55h7lPd2N{GS)` zb)5X4Ze;wlqdyG7xH7OWe`o(xAh)D_>kZr#8Rc++TZ>!!GBS39&Fo6Um+rWK1@K&4 z)4#88V?LQS&?u{=+ikoQQ+M7EZ(YM0T!s^~&}xfu`7B>%%O=SVClP5~(rKzyH_zdj4sVS#I$=HDpPUW{ z^SYW(9dAuR{U+vifA12svPBKNh;9DFaGq9>tRIbPfmK~ytGdmvYS#x#VS^d7VKgK1yJl^-LnPk;L6ZXqn=a!jke^w|hmw$W*`E$nq`B6hJ zNgrA*B0U-2>7-RZAKGb8`xFci^;6d``5+J`_mKql^M=778tpc-8r!e!OW9nM2{}1& z2&0Q|f>mjItQ=3VOx*r>#eajoig_HJ#VyZOp!p~u!bO_~+(e$|GyC~I&*^sFn1)9; z^+gjUhP%05f6g~iYHx$?h&fX-bBuIbAMf|w(qCcg*@fO=KVFN?etk3eqYtu9SD($c zda!#F(`jpvU3*P(s+V>(mlgar3dW>&vTI1u-PR+_BnSSlQExGPpmtW&T6{S*=#=Q@>_4jxX0jP6tl~9?myLf0!leKk#Kkm}+9GZsb!LqYyWf)M{Saeiksug%An*IG@n%2u1YR{?=} z997FZf4g*=m?z0n-{9V8HSzeeKqxM+Amz{ zf7`l;wt*;*e+F=ndvBGa$%?xH3jwW;Bc;u41|XNuiC%TFAieU=@`HPJs=(1=y&d=m z1$0Qz>dw!{V}IL?T2XC{?&;W8zK#$Q!3bAhu2F+p3pWg@Y z9EDe~ig(sno}lH>hI8z6IXzF0H|J=y-iG@$?9u?H=iz<2G&~jc?a6-9nVju}51m%D z5U{n2nsB>Vmpa)COH5;N`9fA?e?bKR@tusf%9~jkoI0%oyiBJKT$m6S3M*dNMaT8T z@m5yn(4*eEdwI2;h?K7rBlfq~m!lzO5iR0Xq#l&S!VD4i>@S-2-GW(mt6oShK~?rj zyD1r@m+V-c-jf<_xOSs{EnI5XUhVgg`SOi7nzcS*_Q%dn(_ex9COC9!fAlPBrE`r&w0IhCgABK11=8jomc zJc*mVUG4ab$9(9C%3JPJLKA8~Z0WWdOb9M9_wX}&_UIsT`Nl`ldTkCow=^v*(i0`S zPH;4bLvonQo4u>_6jK>&B{UV6|#388s@Gd4pqrDLegkDx0A- znNC*AsK9Eki}}0dywBSb(GYRgJa(@0DLzcHP7U4fB&cucOlHdhwT7eaLU0_SKU&Ur zw8b-Uty=EsP^;pYE>1INKCNUTFq8AhDTL!fOVKzU_ReYPkCyFxe+S|Ek;X1}F-(#h zGtGPN*xtG-RY)##*qJjM7;9s8*{0&vrGB^k<3e_H;jmg0%`ohiWW3Dy)TPwQN~4|G zliLfuF4~NxKCbY^-+|ZsH<5Dgiq7!o?dtW; zZIJn5T%YyZjRp7nZD;RwkEUE%w*<9OYV`ToNfY_H&-+_omG@eGo+2vWH( z_%yKYMQdTxhSUN@r1w*O1c?pt8-Uf!@E)D84_=yV_{P&Ge;wdo_BYk*_BpP0NqZEx zhM-xk(UM58Ft9S{T%^SWsh05-~2YBA(4!gJY(5CLl-i^{;<66FL901*+ z5eII0FrIEN2f(Yhjh*)+X~>OLa^S^_@O1+gkroe0e9ccB^%^azQdbp3nNI^`O2WP8 zi4*YyJLAj?fA5FNfb?Z$IG%5hUZvnKS8d^%r`|ZUgI;q;CjTwEZivT}-zOF+*K-k zQ11+*N;q9i`NZuUPS#u$;C;x<)kyg^>F&1ii*WyUYtN?>@d@q2UCEsWZM(LcnKQ3{ zHqvFOf7BCfO6Id$**5#>+|BY^GUv@{efATxJ4r7zYeBMgC*|Gv*jXG7ne50L?t;LIo&;N?~{^7pt>5{K) ze+kTrY6daPi3KQsUaZS4pM~}EJnVLs8S7uSaMoGWJh>SiMFNuOJWNaxu}S~X`fFJB z*pwhh4O}@z;4>d18|5Z#dk9mD94frA7vW_WZKBj(%UD#VPEzYlFITtgZs&(%p*;Cp zSQSupe<@~BtSJQKL|~xryFKqPRMEL)e^oE@or#(lm8`fqPcO@`WUi9kv=yRRgs_(1*tME-Kpuhyn#|9RfmdUO)KMb7nG_sc7xHUZ#;5l2A=5+xF z?b>0& zy~aMcU-zTirZW;)%&l}e-MCHcf0WGQW_zqvlf`l~td%xLc$xeLIuTMNy0ha?z-^WJ z`vDe`sGlg;g|Tr-w)L>h>leF}8jX{EN4M>!b-8D4%P34P-D}UOPM!H^?feG(#MdJ9 za>%;#I@H(Ii&lVvN?Vb|$n&uAO;UT@4NLqM+(i3`7w7A)F{}ZpLLdrne^s&TxN$c- zu1|k~{F**^(ZY?4_LL7gV7Y2c3axEzilWPY9e41_*=N_&qD^QkfcfBi-FVT8nYzZz z&o`6T!X~<*JTOTSK~FIvFR<00PoR_9xV5p#5yPGfN;5u}o9w7EVmFN%)$Vau9v>>r ztlhk(FJCfF0x$K%Rrlanf2q))+zvkkqToNL&Ni@tg|Vp;e?S%ggMsOh=ki`}(FqKr z3%ciMyS&dj>$+*iB9LfXQOu>w!*w@UhgJ!Y{Fl6C8{NKYAB0}=Bbz8Lug{n0M@j9mymVK+~_f8J&m=5~6+OH|&8 zW=DXTv8<&|fmqW`XF|Ic2&pCaa4@@6tmU55JgvH&z0>CAC9z%z#Zc({=s7qdEmdP_ zxdd9o#OFM))ZaNz>dkRHoL`$E^asttRg}_n99QV!$k$-RoxahI=ZoyHx38yPLnmUt zd6xe{7SJmMVn~V}fAf70`^@ukF0-GEhNH<``C@w{s=dkD_LGYl%@5aR#F;%_WzO0x zB*y7f`W0>@E)U@UJM6tw#!2{pIqg}b^&u?!&}i_1B?DiLJl}?;v2WC}W~+S>BP;YP z$3}siQxKhJ-FvqixlMn5$8EKs9AEES#Qzd05B{}@4d0LVe?JcGo+n+)pWfV-HL65i zp0%SX$mmo|%t~$1Bf_S3IV}0sywfdYlV6#G?=_cm^0?L;uP+|EQD@mGSN4f}#kECY zabdgCI@;c#KiZz6{dDa7%AEZ;eG}YkOY^j|_GoWUk#`AfdfT6iv@M*Bt5vF2 zTD@OB)^j<_e{p{Dyw)*XIZbn17z_iSv9c@-JF;AMrlsIkwZ{wApz|KenbUv%5S=f2 z`@`DPzx@zLc{Jc57!`xS@@>W>NA$UX>^5!gSmwjZsO+W3Mt?;bZg`4hcb3L8+q@uA zUC1>#H>;~}n1*-Q7-y&}?Ox;){b@&3?0rS<$=0CTfAYH2vAxz}z~+N(a7g3p#E7~M zAD&O&jegz9dR(jineA4)DS4&Vxh^tmaI)YsxKu8!$#^ntEXJc!4=zR*&WsYbe)7OS zY=70DLNjl9%?{Zbqvd#2>ZCP4OF=By5Ot0C*r`m*YT3{C_kei&h4X96KY8L(t23WZ z=SJ0;f2VR>JC>8%raPX@FN1!ek(~$jlI*)9BOX6!;fvj0y@tuX-SE<~W9{dab$RF1 z%~DoMcdpZ0M9s{n*s>ZCqsj#}q|5p^yB+OKyP&rilx$d5C8 zo8A@+X>|5g(;Phts$Q&~L~_@dD7dg}cvPQDt~kzBr^k}2g=A%Kc^03SeX3+_L*7)l1tX7@Tm)qQIf zgvQXRUu17LGu!h5Z*ga1j4s_$xE$i%|BUlAtWkf}TNP@nYW)(PM`70;_d69V#j3q6 zf0HwS$FXD1yNyY|xqHApR8K^7%1-K~Jq}3nX@59sg*!_mrPgwtgv)-RbZ)LKbWa_* z^&6KIjngca$8PY$&3(6*Cw+xoBNC+=xW=F*H+(RUyz;F#8#j7vOkmKsT*Zt}j;%wB z{?cBq@rL4>gRV_o-<$_l5OnZ)xHRHve}v8pw1~u>>{$JNOb4yYFYUoM+e2@*_Z%ni zVb*Ip{v6kab70uumb67_7hiZ`FHgq2N+#FC5guCh?pNOzew{b0j+KkqmEG%z-{~e9 zZK$|9oXDGF%8oNJj#0&!)56rSdcQXG^kDN=8t!lVw2bSdGD6ou#j5gSFRmXie`&=Y zG{Ch^!pfNpN$ubEQlWBw#fxrw!9Ii(Hjk?!;71W^=GUD`WKJtfb2YrQ;~!~&6`Oby10!$KyimT{PN6qj8oz&Y|I?$;ANN3RR&U@37NuUpU-@{j>PMGGR;yiF ztT%0OPLlG>zVC2p_mO9KdL8H5`k0s@5@TMd&aUz_kLQ^Hjq*xytjT41e~)&JR&!95aF!vmv+_8r8(XDU^qVg+N>e2hd4>Kh*q5L56=sFIPR~GtmlT#@z`FNZf)u> z>*vdEF(^@d_5DyPzp157lC;}SJk!rQf17@J5VE-=cf(qz zEV6anyOer=4P*RsH_J%$zxDJjTw_q)_2R}#-hk|`PrzC4DlO}Rn%$Z+XP{Bx?Xo=@ z1^r*FoxetV8shXYM26dosDGxbe$28CFAGag zJ6^TgsqW4#77UGgYkdeK5AS!!;lv4Q+j^--{|CJP{PyL2{yog8<4>A#`*=&6%~9JL zEaPC;@E{#`ga*%%8$O4SFXg6Ecy}e`PkF9omKZEV>=Tcs2AW zh_VTuPD=gy5wZ2Y_nYPX7wBJJ@85%71l~#*LsPoRXn0tP%Jh2Q9vi%6Z>FJ&*gk@V zmP`5e_+PA(-@`sv(e~$-x4%)bJ|5>*x8~W4XfvLW>4LRv7tW1%cwIMwF&Dpxdk^%l zeU+a$0nBI%f2WIm(>mYF+o(_;XY2d8GV%=;2w(OO3gbkEi6th#F|U85KeXUq0J_9q zbtGGsiK0?tHaU?91rWCQ1wHwX?SFr52nZEHem~1Da)cPx%Pmi0lVsy%y{k3x`w}va`UF&qpDkTDDcMx{!Rx0{QcA&TW@8X6s z{bMry`m3&qTkiKx)iyqaE$d#pb~gpT-6>QP+IK2z^VnF2R;L>E_rIGo8tIo1yXd+Z z(RqMse@4HsJa)p#P{P%CyhMgM-j3(lPF}b7(fH8(9mEg!_RYH8*j8rrzN&67jb_8M z8@rn*(}ID|+p%S@Cbf;(m)52ntbR9ZUcGb>-)QshTW-71g17oQt%jFACu!?;vC@8T z&^q0Q_k-0RG=Aqme&Le2F|Dqnn5w`0v$F{Oe?|8wkY#j(FflrvEb`B@9x`NY`wQQA zNa8g9cd*V^Ck>Bs8mE^eD<{3ipmK5pgR*24&DZg!-8zaze^p=9<60y7#jMO5*XmS{ zXYN*4t@2o+eRr_Gr@QsNR12I_8+EsZ4W4nfv-^?Rv8K0Qtp4w2pIz6Xww(`?zH?9N zf7RtG9><6UtES7`g*!@CuwUv#lg6Gc4qy8+`bO}B{Ca5|Zus}j$yF6JMa<{0aBCE9 ztL~B~cc<+g!`YUVS|N!{df6MtnK7*W%3!{#?hOX>-$~Z`DBIb)(yTnL2Yh$m^(d=! zcWf?a%j9~f#AY;XTIAB^d4r1j3-6ypfACygvPXvdQ*GLW!tjiSnp3#dN}Q|Rxbw&j zm$gh*C*vI|kEzymSy_YW>W_vBt`I83re-{_; z;vg*59dpv5&fdRl_oM#JT-tQiURT?b20m?FhK`2$Ym+Z(62WYEaH9q)tuMXHY1L|O z4ra$KJKOdR?-sSgV%xqR<_ET!CLB;e}ccBNTWpN8_?_zqWItplJLeI+*(u8Oa~b{;?d}l z^!z(Ryndao{Do#Rt&cw!)B3a$r?;Nf1e@iV`zYx z`UD6T5%#bo#AftUZ<3ktaT%9bw8#NPP?%Q0awoFEw!h-F#4;)-E>(6bYtxmR_5{}s zw&hHAjTt>2g43yG7A}8A!(TNK7A|t1`vj}8=5MFpHmmxCosZ4?VpF4&@Z1sH+tu3J zAewFAc8eI>M|HlFmDZope{6-P&&^>`GRA2jO(t>;BHxRq)&NBaX+=L|Vw-pXNct%> z-EWB@hCmSoLIRu0!1B8yTH^X3{Ud0)g5^<1X9HLy*aws(=P5tE)-+C(rdye=QPbNH<%7kXcgt zb|5~4X6e=^ME!z`MA|SARsgYYeg@6bS_NwQTZk61@N5eNmhf}Rfm;=!7USs*Ufpgo z8)mCoxz>S`1z6TjD>#`Th9iz^gG&Z_BRR zaD&URgKt5(>B;J>bnSJGL!-I$d*{y4UE)INAw2$DH06ygto30`yQp3#@i6cR{%S2h z=d-Xjy7jm7cCYKLISh|er_EQRarIiiu507zUhY`d;E?{We=yI7nb%6|)~s#d-CeL1213;f^n8i~UnmFpT&6j{H)-UY6l1@ve}r2a)?hCiu*Tw4;!*qDM(3z^ z=^OaCTl@h^w@kOeSL1T5)%qC5G}rIjZJieT`Otm)}oN|Pw;E$l+A+3M6)e%hNwVWmG_ulTJzw(1KO_WlF~6b%M8 zw2C(8I#32C37)3~+%9{!!Mb&79)^%)mELX=$J>l}r48mI%KH7s5QgRwulc$ZPz?OE9x(b_gG zqe*+YADS;<`%RR-5N_LIYJn+IY7>RZeQ5FLAUT-^QPpaM_OZ?WC+^;5!$)&PuNinEX7W0;SZww52-n|CMZ& zwEqE>-+MEi<}F!Fx_#4t$Ne_L<70#Rtq!D4kKXRR7>iwR3#)tn{j2;ifA>RYLtkmZ zk6c8#b7l%D)RW_!R*Q2Sj!Wm;@l^A{C1qlGFxI`>p$Fw2$>q_l&Dxh>QLP=RSDl{- zOqT6SI$77@16J~sLQ!CA%AlO5O3o}(5Z{J0_z0Bd{Sd1BNyR!9 zeh?ANk{^M3>?bLb0L>y|zE8OD0Ls-#z7b0CEya31C@4oAA$PXNz&Je)zk>oyVMO#_-CMWVAZntMFxmugxHAZ=<&Ot^c8KY){%`t z(GsTZVHl{%AwB{H^=>VM7#0IcDIpfIE&TkgQr2vwk~RnZD;8srq!BsVVti~>7RSjn z>YQM@ZpY9$>|Y)Ce=8JHK^v-Bh>OCMSij+%}eFzGw zG?yW}D3Kr}fOcT#ZkN9iO7AOTsxnWh@52R(ji?mh3931|7qU@pT$tA**QMR7iw}1= zkT6-mid>YZCv;sPjB7E_-}%|Jk<=?4Pm z6_W0_;!eloaad~GgpBXqZevm~{q1mIc6ZsJyFmtSr0vJ4tzt zfxi*zpFNNw^i5=2LU5YvA^c7#s&W{uZxDDEB%J6rO5`I@D&XssNkMT>``*9|#D~5W zRntO8Mpz^$f8Zz}%KwVbjEVxH6~Og{NRLS_IPwAe2$c3pnwV?P4kfdZ87R{9k!fLp zhfWN|W|5nL&n@CXjN$vC9=nQa{bKdCinb?}UuRfg&-)0J{-K;Lur)a&7SN6`-VH6y0?fyw@WvUMLcKy@cZlXIc6e<$_<$Mo2RuzqNE1B4I*f%G8x z%(sF7S^Bo5O4OkUIAa9nY0UAEd0A3v5+J&j)u9v`efxHswx&JC4_>u3ge6*Tv}+ao z+e}13>41+Pj!BqO>gi_%IZ>N;LfIC=LaKo2L+;PBZ`6no?2L_R%(?!pR2-uJz zNUe`R=}HxV^nGkj6|Gi`P%D>w0!qazl@2Isf5D0#QCXbUV)1f5@N}S|*=!bKdTg4P z%lxufCUiW4gN+@ViQVAB8jY^|>M?sgS@{N~cdIZ0tSB+X2$|4h1bqfdW%n2{y~8Y3 zwDN7PA~X01l#2G|LwTfVGmlVe65j{@N1${yfM&RMk!zJ*A4|#oPeCbu0rfG5r)VvZ zf4*YvIT4i5>>c{0%Uw?Jq5MDLhli4-Li43V5L#`~ajz$ZZGSHhw~eWphb)Q>>v?luhQ z%>=EU5^xn8iF{sHZrNEL(YBVk`^{Odf2ZBx<~9;c?0I>h{=G!F+bbHP0ldBLVZTBl zQ=iRzZX#41x7hsrNo8s!!PzV60WinOxV6wt1h-d>pn;;=vbevb`y{^nn7pZi7)L@ug})6$Nzta z@id&dyB_$J*?DKTZk=e>%~pk4Wpl7P<+E5!n(|Pfg6;ObHhXmwv6rQ5fAF%Muhm_2 ztFHhEy;q{hlK-3<^bJ$k^L?0!V`p1xT;o9|rzh$(8*Y+KoXEb-7SJmc#^!6R`i7=U zHWY-)Pf1bONJvhAk8+KYR)fR28P>-O54HAb5;SULU$>)H^L&w${%~+0oZjR4CGEZz z_x=P;ZzU+sq+F9J0fRQn zWqW?^80M{L?2)M=Ej$ze9C(&T^TI6a5t0*9pCr{!{rQp&Xk6f9G8N8__hk)}2xw zDn=^h3Lpf&mn$)QFPcs!^=@mC`M%0f7-0eX(08*Q^*t&jQt_DwNK(K7@pBD)--?DU zWZ6h9@1nGAN<1G>6Y)=>X?aMs-gLtipQ}to#nK;2jZPSVgMT;io!sqxXjYSzGo22z za>&5;m~G3QUb8pYe-E769~auMVBRvQ(=FmT*RQvAsaj`t(Ne2SsGMAJs%I?s+FOYW zp0=;|OkiW%9@lUtwukL>KM=;|o|K8%jwJ!!D@lCC(pt3oqJ?r-2>8$MT&>D;wnScwDJNbMgmJL)A0Ts(G+JXuKsTU~! z{}C+9d~|SC9$qEP(p1@sqH(!fBX7jgv=QpD6-}lV7iSE5@FVZ=#~lu!%NvXpr6>12KquZ%pnGAz1-!#^*`NKCT zt>vt1^i@^_DHgV{@|OYL2c-|hRX|j$O8CO^B@}@Vf8mFqbgpNrKoXd~P&3iuFn7H0 zHYi;ht=6yZ;={17Z$X5Wuk}0w*H(W!fPEhsP_HZ>jBp*6w*N-S~_DO1Oft~$yo3iD1~HWeVc+| z$OA9n9%bkwP*}Hw!$i$MC?o_>BAKs$dnc4Wc_+v!3dP+K64b`f{|uC_CcsP=WO&HO z(r1!b@-t8>iXcSPx>8PxC@%dY zHu51TTloupQ{O}qo627>$Un2L2(VQgCYDu{iv9)CSJ4rPk3c1$V}iAj+YpZYfSmG`wj0;MAsMg-eMg7oPO^o8et z##=B;@9IKCi#`fev=5-9-bcQbrR$HdMbu>XeTAa;RK5%w&p^2g6W=`V%#wa_94o{#jE{QME? z8=-V$#7xgXt=X<7r0<&_S;7hlJrZG5iyyccbZrLa)&IC=gIls+hdz%B|?J9t|Ll7bIGAx&@95@yo(F_Dx6;xnUqRJ0%h zKrygPl{D&W-oXcmw1)bsmsQ@v0-nu5z_}$p5JVnOx|W%$Q89}VlMwZ(><{?BM_sAj z<+LrcsG^naK>-wz`OLa{ToBe>e>;kpQy)la6AV5xDwUH0edS**Vaz?kvClC70FC() zjnR8dP;qt`=qd?a3i27KM+vLeyee8M`VwlJzW*T~h}EDVV2~7vKqmK;^AO-O>q>=t zlVOS(FV@R)mmn=3^UuCJJlSCyW)9DKbJWMFpWEf*;7QG?emz`q)-E zCZ;HpuQK8Mje++;=^a56f7xnU_*xN65gN~pbD(7bb2a~dGLb*t7R6Lf1dq`v>SY>7MkF3 zbCe>V=w?>J{zxjPa~=z+RcxwtMVY5)8t48;9Mhxp&4MbB6m4cRMb~YD;3sIzL#VIeS29tt>4z&4iDrpjZZ<8kMcaMN|+8EGDJ$P=eCWKxv^&HQyCyXM{+f z=t>Xs87dy`)(5NCPSzxvh(o2!ceoIi?sCA|iC;SO`zvo8G^(xf>rI?jD9r+Ofd|vI zF_@alvvXvAe+EjW-B4>V6>S>}s`Ew?SRaD2b>%45H%9}X2E>LkS6uWyD60AGBkc~T zO*{l8XHa|w3hG&?OQs|W5VQ#KCH@SQRzp-w5b0D-<*7bnjO0`)-U+4rpNd&3L6x=u zKqcNBqEA4nu!|oQ4J&fS11VLS4|4(-?}Pg4rVVu|f4wf`wABxkt4w$wl)m)yU^B&s zU^Np!`yFV@VMcIEfpV&J_npCZsA!uRoM4I{kUeN zC@1AwC{Pj)e-*T!QLCTQ>t5dOpQDROg3j(eF{e;y|aIM$1k06fu5_IS8nwlL_z7F;~Y|!>KYed=l zurGw!Yn}dgEburbQ?Xv3xM)>B1^0~QZ^=kj+_YSsH77nhMb%A7ROfn&l|C9e|>y!K}d==RbLC}B9a`7-uhLmGgpq^ zUifuKX7kVp7Y@&4sgm_4tLfV9MI9p@UgfJ+^*1c`Q18_hXQqlC5+SbZ_BBYmv2q8i z&YtyYHJbr5u8;8Q$_x9NO^iOQ^GjGB_5>*+V0v=9(%LGf!p06x~w-wYkRmfQ*ygym%(dw^gmd6t;BcO z`=J}DRbGj%%G1YgM5-^339$q4X0&H}el1}qIfo8i$`H#gyB6RkjaTlf0}F?=JL?=* zXRm;R((AS0|JZxZCGj%mhU2E4>Fn;Te+Ox~r<*@i4|RK!4A`B~Yn6-mlr=WLem?YO zd-%=v>^IvZ4FKWY8_Dl>uhPkQ%=)g~ZnegnioAb&uub?ZFiUk=uP(txq$qvge*``N z%*sv5)NS{Nn_I;(H<5c@T>U=V?r^JcKF^H7eB`Xh)lpnitg-bctj7%{MOV}UP+^x# z8tBUh{1aGTJ#Mr(H7T+HAVIZ~dG37YeOUU$#ne}BQ4wPt0O|vqN%I3(Kuc;pI^0-R zkupwf>Fdiw)@QJ6sGP21N@fvyf0AIE1<MKenn1sIf87!h31nHnv zv?L;&+Lp(>$L$(&-`z=hl3x1t`jN+%cEN3}GSKs;M$bFc++DSGD}6#8*GgV}!^lW_zHGgsKjbM7;R&VyGwPi`FG98IgkUP41E0~roxAfVI z&52O6(YJ9`H%zP-v0xf0e%SW{;2|Vh52uzoDSP$h+%VJnjQ0ND_qn>W%K5Yy< z*S^jN+nodBD6{JAT0JpGe=}=UA-uD*vO3*0+;21gCt&&t4A!$z#T0I;*+G&0K`^2< z6^g=E?2rk8EJ!~E_E5gidv%_#enC(In7e-cPA~*?L5UX1)6#2D0OSGtIW)Vg?SzG^ z@_e~DE}G@&I`^`r)i_(VX0vo>o$Ykv5PB`o%|B0&FQqpvK?wrOfA%Sqf>Hh{FukB3 zr|gd!En+^lG(H5T_e&I>rLWF;Ffc7ZZS=g(jHG_NxRU_Y$+FpBT}GpEou>uY=twlE z&#cqrJ{ddCcqL!OK7InGZ#`gJ%PM)?L&Wl}Ah#3rRxo`F8&kdUDNHQ{!+k#&V%`ge z9xd8n(bM&b%3lQ{e|P2kyLtwD+Hz;ar^?*&s|3}BNfhEEs>7>6LIF#BFG1^}Y!H3CMZ z$$g8`TsrYqe=rq15mLTi%ZXY6(={j7r>4FI&4(9Z+7a7Gcxv*4;6q?q_>e%Yap#$e z@+b#l!Q5W?xD32tQCZ)D_WIx*I@Pg<%C51V@0X))d<3%tPYpA@F2T1Ax9?zpm>BBb zI>e`f;J^nor*ii;u*Y=;qQ+*c91y_(n}84sF#i;oe~M=M52Wa~ZelDg%8~aeFf~DR zrJ7v?I;{oB5A58ceka)DhK?@bDO#M{fhDBMWKZj8Yi*oy9L;=Sm|3Q(C=XS5`#+2f3#lkLl{f?jOP>)YP;#eS;nQ)0^vdu zFLvkEV%J)u>)JSOSCbAK2MaJCGt_wP1oks9th?G+DtOuw*#VG5pY(9OyLE;K$m?}L>n(VUs`dT$RYUDN7}f169*xLtZt31pSmb@?(VY|`sBFD|Km|i`V ziOSyg!24s{|MNFvS}goS7v@)Aqbn z*>3&Wu55(o;eG!qL;4L&OMyS`PLiTYnBoL}K=RktM7XRtapG4d=zJO@IhdUXf5Z75 ziJ5g-&d@Nd?pW3p`^Djpuklfatv8S?eNR|IA|>L$`xqDnx-*svF&IJh{e0a8`cq(9 z^9h=ODMxHl^wq>zd<0C_ed|qIz2B&kPL-VLDhP{y49o_)J(0dE2N_`kV!+<~&GP*w zue;I7k0pr8U4LEOyS?>#ed~Aof5v?e#rVjhW)+_|)dOF?$_GCg%+(~B*UO2;^MT_m zZ`=L$O66rzF?XbE9mX|Vcol!!5Y2F~`*y1PAA{)K2Ju@AUPY3`$;&>OO3$dG1}gDn z6bCA2B3{nvw+wu@89ha;E8(V71S(>bmK)VIAfARPs&Ga&MLP2 zj!`wr_2m?_C~rA|)$i1n1v9>k#tlnW$9#iY$2x!Y`G1e|zYi;3?Zv;IP`$(E={4H= z$kWv47C^m5X$xCmo8`6~e^I!0=+SUbWwI$`!Sp=6;r?V}(!qo-_a$@XPFG2tOzXeJ z%l9CqJG|OwTdy`OtXM>5{Zn;CouSPq(|(KEveNHy-@Dh+OYJu{NzUdhy$F9c>5r!6 zrqL{22y3?L^JV{7JD1mug6kE$tGT|y8tnbXCe7K5ktm&(@n&4ufB01f-E>=v*E4Tl zA8g&~)vipvquAWnwWzcDjZO9en^wN=Y10jA7u-_BE~#6%Gp<;j-QL`scE_v_R&^P% zn9W-!e^+Y#&M5kXQTz#``EOso)WZg+X$hWB0Z9z9b7^%!Hnmz~G%-=ReyzlKJ2X!6 zck{`jpD@ZkU=*02e=rI@VKhIb_N}>dyHw^bkCwy6{uI!@-;D;_v=n!35t_(vv%=l% zMf|r$=_iclKU9}z{w+Ar>10YeqSdUjJ1E~y#wj$;jZW0CCe5r`9wp7$@7xK@e<-IB z*3J$k_2#m_nM~Wev4yryf6+$E_BL?q050cuEn`>bzcZR&e^JIfnVzzH&rFtKa`LzB zEZt->ZQVsSc6d#A3qINzp<@NVb12Zx87xoZ!`A1k zV~MmNIxf=Ry;GDQzFc(bhsf!h)l+rUai=bKMpdVu9%n<@W1GUgKfH>=)~z`7cSiFx z(cN8pc;6aVf93cd-a7SRTDUZlO52~xXj4gmVp?=JF5lhpYpVYUCixHH*qR7=A3{60m^ zSx)+Ha0f_$Xao`<{0@b_;Bc0}whHs^6Y#GEGz zNoM4#YQgRpn<8E$D+BHzmbR~jblKyGlz;GDJ&>RK*4+4#zW1OG>?*G6Ay$-adjhP? z-Ug%4cln6~xeb2drr)<2|1vW1l#-_q(RAXdc$bxJU0;==Gkyq87KTwa(;P?qdIf!D zV}#xZf62uY`7xEItV~hnY^UkeZ05xoWc1*Q2>Z+CAd&}i+={Goc4K&sKIm#sWa7)n z@B2-8M~7P|oa5`f9@hqRdEo5(yUvK_=-A|&HWNjzMZ1yskC1<^v3^mH!9%`?e_s@Y zzL%B737GUCJaiwkd`N&R|0F~(EN}Vbb8Qai1}+8A2KDG=(zM@SW?& zg7B}oNZF3q-eXTAcG<~Ehn4zj_N9X9!?_O2lVMXZGdn5UQJ*{pd{0ImyEF{dr-SP$ zt26~80h)BZWmsKJ(|QOIfLv>6|B6hY_$`ca#;FK}df3G*rX`HaJsm!1^T1NX!-@=2^ z#$-I#qtl(=qPtb#aDoZ^*I(##YyGO3^n}k>JunkGPBYQ6PxMh4;cp3uah|y`YIV0i zEP(?;u- zD7Z=s=*Mb-+&ZDxsI)Y14=PDNePy9u;_bYr2P%&+74;el{XX=uoid$8bkKuu@DUb< z`gMba^MV|ok}$CtQDCu(z8zAi10h|o;uh$NLYS6hl+$R+rYmdv9lf&Yx?$w?I>r{P zEz=tu(CAjPuekawTU%As4|z?Y(gx*V&BoFW#y_145Wt(Zp|7)rfD5Qqihbb*ypz(t zLe3u&;<>jHyo4<@N7hcc`yJI4cSXq?DnN&$_=Apd-dD`boT%CsPKAe%i!0F!Hv-p^ zFI%!SQn)Ln;y}-;$4HENyWp0Sswl~S3EZt5H4@dIkjNH28U+rC4u(Ao$#-_+Ffx43 zX$+oZf>3BdK+>HpGk8fal+G@x&{y)?cVwW2D>1F_KN8cUhe-C-hY2()ko762dfjULTr%hwH|)F?R;kydQqLvZoc4ZBOPhuF>oTZCj$noTEG*K z1Ke-bYOwaN>_jreE{7ZN1>Rm8EO!-Y2_(SNdrQA&bPlVcFx#Yy4R=JJr%roSJTWv9 zq~_ku)^u2wZea6Y$^~7F4L+<2h!6#dU^rK79fLunJ*e_+tl|mo58t3DNNB=^^y7~1L>y_b|KipsN{;6v@$0Ho#UU02EwdgZCtk6e(1HNDB0x z_k8GXG(TyEiA+!uSqG@XL_SDcsKtnoWn_@hE9*Tm&Mso)gb6=25ypO@{>!}BmvobK zSoctn`?XpsDVQY}EK`=x6*yW7V(OL|#~UywbZY{dW*J;2eq(@C889Ho(GlA8i`=9z z0AHiG3R&lSOC9*M!!G8i&&#Nl`iQVI&s*2_l=Xf-x$36=CIBd!KA#KH%X?E6JIISw zPBuqbOo6!QqZk=l)uKJOvH9`N&L>H;EoU7LvbLK7t_HbaY?YCtF8N6~5Ir(@szuXW zl5-ZvH~+-(*Q2gZpu>uHZuTbD#3nExI{_%)692S1R}ll@iOptwlS?PQoHgQ0mL1{V zPK7ib(48qS2L;sYL&BK$6T>PLBzHf)H_Fp+PSz0I8lHndu9FiQp^!w-MWO=PwK;D( zRP^ziHVSB*dLe0q@-!AD>k{aBBfq_IM1SS_3hb6j4!YDVAXfUkwe7#UtZH0sFJHW& zZL%2UJkViZZpNn%FTKjs0-QR5x#b7&>b7=@Fg0&=Hv#KkDm1XgY4H8Y9J+fR&)qk3 zmNc!DFAw>Lvu#T^q@tq0l6r|BD++!Q&9$ZX`qgnmlQ?4I3u}G$$%6+D@V<7{pi4MG zbT7%dvII#C5BC)@&9pg+gexQTU9hM6$Csi6-9|pB)`(;TVfRS{F3517Q8!j_*t3^w zF8vy6T?LxS(PG$Fl^wq3NAe+2h3JZ1x0S<6_5Tc9<0c+WjMief5m&Eqw~{rN3jc;w z%5OW+aN1_H`=;hcJL?B^j)-`^j~e1_C|=_VD4_{o8s)f4u^T`1fc`c(O_2Aj^wXWQ z|3Tmh9|ye|*=Q1~!)JYz!wwlyUMx09A#<nWnc-N?@2&ssm`Rw7zRQl z)Zr&yl5z9dCdusE^CORk;oGzY|3@}2K3v^GaEkko`HiJBg;Pd&Z!2<*uPWT^!puNW z$~5v(d^lr?SAs`xj&0N`=}HC@?>b4O$au zdKPN~Ij&PKcq5AqAA*INmX70U#{CJ*ONyN|8B=W?5eKuZOPFRVWp+8-0o&c*_0?JX z`uL*zZh#!_Q#a#&GwN6voA`Mqz%k3y{r&`>Ukb#Pb5Nzq|I~dVl zI@=M_Zy-ye7$zl#+i5p?pK_09z~V?S`{faBm?tIHSUq>u7JLiAZzFa`l4}n*wKFXk z-SQ+#1TRxc7NN=8KBB?DHq+uv|wSi!Ug; z9HeI_Ktqg=+OYxa#Su&iZI?w9#<+!vx{R{uTw(1HaETlFsXh&z7A``a ze?cdPnFlMNHPhFK+Q&}so5@0bHy7A@y|F-S>3KOHB3$y7{QOxrp>AvtNT5;&vw71O z;JO#z0s?}n=6aUmeI*p^@{6m;vX<|>gkI${nM2ejvQ_|+U(VZ!{RR`7K51#9{pj`H zKAGeBXUOBjzEEvh>jI;|&DQt3O!)V^pYce@>>BR681S;eE%WG?R?;c#G5ve&o@pMN zE{W^3Z=r)6PtZ*d;x;ijK;)%!#@?t-h4^xR7}SRqSXn*~TNjW}B{Dcpa~RVwfnL5( zqa+W6W?PU6SZ7e7Um_P6)i#6uNE&aHt_A@7ttt9GkaxfjMHNkTZ2y~6ye)P4WM8bl zY2R%N@*?GQO1`6Gog_w)Xo7Du;)?EMBQhBguzbvXJg#-Y83N@&K#i9h_A=fxK@_qL zI%HAD7MN4j2e8tgbFhrv$z}y*ZH0YO4cTaB7=rESbf@)Kz7p5U8;Sjf;i}ro( zkKXfR6l0~bvR@Prpycae6k?u>U0Zb{X|kE`iE3>DNgBp29bShT4UP;FP97{`ti~*@ zq{TVcEaAxJqQHq-IO+CI`Tp-48Tlj)g7JP$A{pH2KZ4xTx%!~>3J!KHTEM63&o5Oaw6s2h9o4@I#SZPlq(Edn))I^2z?j)!%E1Vp=Z ze`3Wik#hZ{u)|>R-*CL$?OC2kGBbg7giTk@$Wk4WE&&QQj5SsqvfoAL`VmON&H(Vw z5DeJtD1#S!Zd6kM<$U1P*2;xt=|98QF+7;g))rbl;N`umv5OmROJVR3%qcr2NCYJC zQMM!eav2l1+lg)nW2+xAK9S=+)zj~7$-mbBaIp?@Wil#M>S&J3QfW!@i`Nv`XwLom>5t?s>H~uzjbp6@gOqE>0l5NqcaEuCU5!g$QiDF^5QT1FXK8B#;t>v?^q_qUAJ=o^d9IAU%H1 z4fz2ig2=A>J%>r>yMDAlh&58GpD<1Qwa@{Wb7tXqSo0b`=<)y2PsLlxE(T-AV#h6eVVX>3rC{l>N#+C zqTyv0@McubDpdu7-|JgpLq$$g%to&8!^mG36zoh8g-iI_F(IU5XKM}(=rprm5YK_m z7upiyTPd-81Z|AjHe9>0NLB-}Yz_gM1aKhh$yc zL-X=1d86)Y)P@eb&;lc_;@gOb`hxUoN9k6W!X(JolcA0JE)|!jBYj`iY*_P}BVqLB zKU0mnmG!^lIvBK^W5Iu1HkBoK4=@8MRhgDbf_#Vj4{AE9z>`yqjMqbusz0^YI$y_q zeM@gTe3Hpc=DM}YPy)L^w#?vmXluyiRj{e@@%WZvSMxN8QJWjnS-ibTMJ;xRtM|-c z%S@bdHowIMjgMwUkBUgl*q1|RnB$g*U>_&g%Qso~gP_ssI|&Ic3D|`Mcg`*l8`OUa zzO#$cYavvQQ^B43;|0}mk~m<4IHnUz_cO~0qI<&&0Rc&@;DR&!5)G(gr`$8gjCT#A zXmhDD>D-0oi;sRBn`>bFDOd^3ZRWT?I7ArnBOWArF%e|IUf<9Bw7|_OlEP_yC~;K! z0wW$6BF~hoicy#hSBYJDzvw3*tT-}VUoI*WIk+EYq4jRi;Xpms?WIB%mODaM)`*}( zQR=c7AZE6sCx>KKUpTR>2I~G7er^`J3k!Kt1j0SVnK$MK3J9NA=qzfz(vREv!J|0& zwdu3Teh=H3vmRBNJPBU!h!|w%GsWJ#2MsFt&U7JnTytW6CdnAtm5~8p$ntXFojEFE zlSm2cxk${7;g1VnnoH~{J``ap1>J^x{Hxxf8NExd2?%|;F?4G4sFC@R3Y6kg$&7Fb zhWb?41(~ln!im<08EHs5FMgN1w07{K-;hUtj#lx3gPobIyl2{u>@2AtL_cV z&jZK^-Z9r~+Y3VuXB1cSs)IvDg?n(_0};n3(`}AEl?V~{!5p>>cHPx<>6(>9rfgQM z!~g7kh>kWoiXB9aDw5`M8X2-Km2QPN`!o$Q%L!F9<)&Le%1$2ujD-6%B@w6{{iOr( z%ki^r^GgXYO4x?uftZ7!WB0nx%N*{xp!#X06U@uQLfzr=?uw@#9B~F&okQX_SR;~Y zguyw}J?vCS^Zrz4Z2MhU%DV#RAc?;+Tad`*emBglsL}Wk8LoHANF1hBu6gD+NDCEo z|Fl9@5bopqW%AVk;FtIr70F*l%3wEzHyfVA<2hg9!*f|Z$|0t99qN|%;^xjW?sK$jr-f^;@e%C1KkA-7Zduwk zy2re%_dR5>2DjHb!rKpHzm`Qpv_K0&i-Z`;_`3v03Yk#+&cEA7xFgs^-;NnHi?mLt z8VG)WKEQJM*wNqagb;YzC3lWBh!fYuR|rm?aw9x&ydC60&m5s!!5)q9EPcBEmF6Ot z{4xD58a)S};QN|a)CuLW!~vGx5hLO@l-!^lTV@)g9YuTDSf`Fy{@`1SA+&*GOZ zysNxa;2Og(ySDWEyPk+jnpBog4F^v-F0#RC4JcqjKwv-yZ3EIVKmo+)tjtW7E>5P5 zmX7LbkRYJy*A!+glAwTHFz|mMsLYha%)cSlX66oV))v<0F0M@f8}~0Z4M?t6J8lRN zkVcqvXAB4c+5a)h!`RN+%-GHRUxu0?0HP3o486brh{0Hy(+OY!q!53c5QPOOfFu2O zLIY~)V*MQn1O$>TeG3l~fbkEry|LxLsfG~%Fvx%4dueClZ@(QGLrzo%;Qj|}=<4R^ z@~-J#`4jWtL*|*@*6WUZ~}v*hZT}#1YLGD<3<9O z?O0|OCw@S#ABG|K&~DP0(Xdqp71d0yCZsgZhMu{QS+)T!42N!|58$;veUq@qgki}m znHQcaWnQq`yh46ZS9+G)!3uiLjhU|q1h)%ly{j@TQZN7R^FxluEpB^k${xWh zt!mj!FW-D3Rp#-GPgfH<%Yq{Sd{A%FJcGu1?^C||lR16Fby&%`mkuODkA9N6l;Jbl zE{e+L4K-ZcfefxdQw3-^bv&Zqoes-4o&j_<7hJCBK!C4f9#$Chjx8MlUd3Zg5?$E< zFo9BY-c0IgCA4SQ3Y@W$b8PN0!}HM0qB{Y4F&fT&WUD9+d;s!uxzzHFj-y)h#M;bs zP4>%GpsB$P+`uPD@Q2mll$vsn(3?}yvSItqs}O36)JvP`%+By5IJYeoDDi1RJ-dd2 zaUa1Qk*yV_LNYnjWihqlcvrs0!hp6Qpc*}mUt~kx`)RhkR3iYzn~0DIiU8vgV&2v( z;W?19Ow^snvs?0qBC|_4{5~^9s}Uj+CWNpO>dn&TrldSh=MO|!{byX>7DipQ(l<;= zFJBIpXB4*Q?0EzX%P=C!Aw=KY7<5zgRiP09{#69Tpd2sHfHVI+7lq>B-JDkI?-{-8@{#GX$9@4%EGtn8b*}7R02tl8 zdwXHx40M4ThW^*2z>Drr?9G=zg6l=9X3)}D@zMEI9Jf*{9TDiz>F13)3qSWmo~G`i zn(B9$-#clAR0B2kzvjGX6T;A%{d`P$Vq=2D_|nL^q{dF*=1A2{q=I8bfDI(o0mB~? zy2V}vt3-y@(o_K5k%Jrgj`g~GveWT(xVF?XW{xIxn_hZV0`OK$TfBd~VEJUMVy-*N z{MoVuv1h(Hr9t2lb~)Rd z+w4HkM#~8ZHqydX)$-T>Y`UI_AxF+6Gjrjtn#xYUz`^b%5y@yD72g8nbn+@QicTq_ zUF=^fOddskdHXb@k2z6T*6k8>>4e161j0#ccA#XLNAHYPs zmQH@Ar^{p;fbK=(R~=blUMa)2yxexNuT&y`QldQ&5&RNbK~pc1NHl1szy1S z2Q~MyQ;e937zE@yl-{EX^;_(RMBm+k&_)C0mc>Wn&u8c>eR7p!URgQM7(dx>&%d9~ z%x{?tq(w!Y2a@|2)-~yTF&>f+j)uc|`a)oBO?2?RS+hf8M;9G9uVgG0P8-zr!vYp{ zx9_9P?@D>S_h_k~Jybnm#{37qB3sY>0*!pQORrnKU~w9;`Ic}{p2AtawiHUkhdY2| z;zbH}CgWD>ZJPZ1NXd^wcN$71aq_paDf_e@3FX8EI;dct(9<*a?qUfh=6)qW!iT_^ zX`dr9IA1BcS2P`P{h3#d`DjKRbuOX7p#P}iaoN|QHc$7vkLpN}7AW5uGHpV2+)F5d z!LRALwZEN0{Ij} zD6KwY;D#PZCn7Aqna+h`s7-Su(M$`TnfhjqtLU}&v=v>sHEczUcZK2msl1K9bRS?D6*>@SG5s32e1_zi#P9wR{ZaRE$ACBy%Jr4-1#Kz5 zng{JzMD6lwr{V@Cc>h>TDh@l^sJhsht7ht+LcQ^h{>0$;eX&z1v0j0nN2-RkCAEXg zWR>Z_4HvLjcCVM7Wp%&Ed!ICKD@Q|=*4_w%k!)|z9LRmYt|Y8d42CJ;j68t{tj20N zFj$TG^w0W2AZHuq;Y^!XiBy?xM}{{ZI#hJ4n+ADBMn7A^m0RG8&bJ&yTG5+YV2VgG zJd|kU`E+e>v&Kt&NZ?~jv$>m)dtKa5Nb4|x99BcU5+E8+8=?f#co|qK7^c@gV;H}* z#H;;opd#MpLdYI>YG4J~wHl#V6Q_=GL$#+DZ*}QV+{*pr4r#US5f1gE^`f6vZALy* zb!^2oI}JYm8fut9k{v5Ez-8?TvOtq@D2WiImt3%n3_*p!at`0 zhAcu=T9v=T$HXup97hwY?{RrDt>=d$ymu9MLxa2c$xT1UAeCd&?XF54t!Mj-84%3A z^qTu*Ta2kKF>6P8Mnxgft20S!qdB=e$uJ(P)vS27&x+tDy zuKKLdYWm2q9qHg8Pc~Q6p_B@7-y$>wq;PnIo*|IquR; zFU&h89qXd6*}i3y3mgH?jrqxlo{BGiX+DI?X}zp&A`XH=t8-RgdU}7{y6kRsys>-7 z-7NJebqmM;Mj$wB-&|3upunF)04LW?>Y5^Mu3o^04>@y!31=@>bK&-mMT0Indf;FKBQD1X>e0alDmqV zs0py%x{_*-^gb{c0B$Mk$Zy!Fb!vKu;g#2JXD_`i(B<1(I;#sFEnm7y6Qyi)-%-{x zXKDxR2n?_ex~_0{h8_9_ow|wx8?|QJep!A_gl@azj}~{72S7B%4P4(;K|< z#fBXKt3JJ9tg8#ITy3`Sq3OKoy8~`y>URkeTNB>n?=Dd#BcD6x0Nu9fbMyxNA6W$Q zXC?hZ_pja=iK-?@(*r>MUj$3`P8yTWZ`sp}l#c54SN8lyGyN4Twt4_F$UlPR*y%ix z^0%%DflWru0O0>u)tOmaSXi6=YxRs|0$~2TdKR_-5EK3vYh~0;w2NX`q#1LJODA?e^G{xPHz9c z9~k+7!2cFGDE>g*%q?Av-K-rQ{vSn-^!38OQ~D?bQ2m_}Z4uzxU&XpziuFgaDwhK= z(wXC{AyNN-`Z=Ac{O|bR7}~$%f#rarzhw?Tl#z!gWDt-%j&$P@%s-O$4^>Ua@5;vi z`42c(1He)K{9~RS|Cab%^59{ zQE{Gicz*#Sr;z>DqMSv!x=N1RfCxqm14cxw(z&5_7U!DRpK$d_(DA|Ns`$Bm-FFS@ zbJs82oU$7^X$qm-0pJpb|TA?qI0OPePwGg~<*CYosT7iEBDgz2qUSLi9ionXy22>Sw}eHWi}(?AnwdFd z4J$Q-S0)-WA_JpL+-I0fOBS+{AqQluX8)EI7K0|iPH+29Njx{r~Dn;<5D``sO)%$JJFSMtk`A1HB(1wg+h zL2Sgh_^YLLPh+LxiGNh^%ax zHRJ^e$ayA*WxQ_@<_uL4FGWBrbJ&v;#hK0tcE8 zcR@_cS`aozHIrJS%CNLuYxmGm9sAQMo>IyT+UFd|)N!y9mfvuq1uTNfo~d)#ypRmk zRK7(TbHX0?Nh$pL6r?PF0s({_F^J!I#3kgFg!qEwXWjA$L0G{@7GKr1$33INgB`G! zsdzDGhtyy+TD(Qi*Jn@47xHErB6zHG?nu4X9Vgc0n-* zUi4x?I_ns~q3ewUQ>7C>ojH)PFuu!Z!!_X5+hB}qVMEyzuf}ZQUil@XRshOKs5_Ru z+_tyuJ*iP0p*xMVH+CgiHPlz|rfth!^49PxO2ZpYy%puwO?UU1e!%@n(U%!KQa#)F zXm-dKdgB%D*c1TW2^GEE4KQYnfb5$@^WzF<%8!Pd=5f5XWd(;j0NWe_j~Y>W9+SN& zR-9A+J3PlqB`NF21soFICpy4og zrWsS5ad&*59pw~!LUtDa*GyK+@bj39K_X0A=`0#0oTWbs5fuE0)jh>CP!lux(Q zz?R(nnwE{Fb^YZ;I{rl+#H^@?Y-rcu*b1l@c@uwFzi1ke1u=93rjlVc^0*t=N=}Nj z-dAyfA3}G^nV}s6pMFN0e$WKu!WDeo$&T6v!wvtvD`RbXhqNGVS~Au=3BjG-C1^o5 zIvrgLv=wbr&zrUou@V^gbf1e?8oH|WcUM7yO-+68Iibj}KB+5d> zqSjdPx?+t6&z{ig8>8hwxwx!qrT@ZMr zhQ)a;XfzZ(Xhih(@-&I$zBin|?}PPi9-2;$Loc8v-N&l z)h0jh!YFA?$9BHh+1Ryu?!DRWk&1(Umh$ra6FpE@*F{!;n7{ldBSUqxgGw3R!T5UF zc+?qP9=XTyg&B|>8_A#x7oU(rYlqdOTL;IM*jKQMJgs}(X1PjZZ2iu~n@Dy?5gBkD zULKLbUD6|}ZC83%NGqT=FsOc=V2s+A`{gAucE6q&!BPwTZBmE(I}ydr_K#nyg!Dvt z^xg2pw?2S+g9^SSx^me4_NJ$RcF5-IZDY>`CMnx9O%q^)O%6E=FJBc=mG^!_)_!=6 zBJ(7>6edeR*d7BqrcEnTv0#2qLv*hRi(GpKqjEjb~LytV8km!D*QblT&IEknh&Y%zD z$0rGpDjgs>jkisLo!$DaSUuc`d#m1oC%63<*>v4wWL>-ygNEVCL;9>399fdd-|YaX zYQ@y}9M0IPOPE4>%i@_SiI_BX*e>D)iH$29`{gXZsWvWUhj5u}C{=o`cPOf_+mv>i zQ@75k?UIdE9^Iv|PUf0r465heQ%Vg-*D8xRf&+k2tl3$gwNt2A7+LmhBp%pY*Fb8q zZQ`5(mh>!^^mJSr_!r-Fk8}IRnu*CfF~f@4QKYl^8r6yDG{1a2GY9)|24&u^uCgEu zRmZ^9e$I6*kr%;WL1*eioG7(CaBpSzUFwKeJJ?y#6L9FjEz<_m6bGXvJ1T6sJZs*= zVp0VjG~;kwPs2{$I;;br4;S+saJm&c9uOj_wbkS9a^TUwhI|)!PBCSgrnHUwRZ}7# zJcYxiM?(_#IjrvAHc}dXpLEZ1$=tiJM74K_h403k(Vfe*(y7b5@{fdp@Jz zDhnb!q5nsy|9$0EGxI;R%^#_9J_A7et8Kt%0bGDT3P|Aa-zdz#fVe}z2mT*G0tDuN zr5-}^f7HTSM8-@8VAPpAt|5H!cu$U%))zjkm;2X_v`TLBLE?mL#U-e`J zz=Te3L&U`Sqn>g#?Oj(n(BA3a;ZoR+l_N#Ctp&f|xv4E%yF2g2lzdvc_QubEpoozU zf)pBYp!#^rgOp1AHMZdSZWP#W^02%P-9C0b_L+r4eIYlks@Z(3*(j2hA-!apCVSqa zrYRCUi6=FZI#xysZDK^d=heU6QET>PV7{^j)^v;C&mg;eS_DRQN_S*N0s6M*PpmRa5>LQle8qe@; z%eQYl`0*{P_TvO=TE`1q4?z}wJlT2USX6bO%LGqq2ff&(14Pa9PWR7o*KnWF0uVE} zH(7xtIEL1N{8cbl8nSd_3lTWK`_nB2%@@yVG1S?%W7T02c3i*{n{=3MoBgnePI%+f z9>*k8`Q`oX_3msg$v-bAU-4jUc_b(|xAA!S)$3bM?!@(Nocuv|<3r=qbp)&!{O=ac zB_rTHDHzg;ZS@QxKZ6r!kVn)=6Eo$ubiP*tpJeJ&S77ve$uwZ~r9^SqK{ArE^e|^# zP7V04=#UKJfFD36ML*~qmP}1R8IB;uOZC3< zyIP{<9X2)fD&?%JV3H!#YyCKU=7F*tB(NVEk*R7cx?%B^F>67{*O+5aC(WnO+`p3n zrcI$OxJx_4a5`FN#;ETX;X?HhW5+L}Z4kODm;YLW&!f}B75gsXk=cTN__f+`S7I)e z5>_eNAzd#O?iP`?JU~y=YwKsXvNOtvR6qJkbI*f5}lz>b_Z33-pkoMB&?K9GJy<}FyseT z@dBG=f2{;@;+DC7;*5%2Cwe~WN<|;KaJeW{M#Zqu$N`FzXnJQTLTd6FH)Oo?Vw5gK z0q@rRh@#m0`k5h-LeWU9o@@=K`)GK0^|n)OM2si>+=-&{4ujXbDzj5}>t~&0AZ)zA zyVjxiUUl+BCKkz2({)9$E|@Q?>rhvqFKZb&g57JJZl0u9>|33aaH#-+t3d=MmO$-; z{N#Yg%7ynF>m5f!Bel2r;xKQgYee`uVU!R=+|cb=0mrrdemNR&o>tg6^C&e^q^i>C zC$*InfW6p`8|vWg-lD(DK7t@0_+eI zJcxeKu?cyssuuKqYdxXRV`BVezPjqkxolCXXC#AI6X<9Ny4%hc#S(x#-EsLHIy z;A6f_nzEo(oOVAPI0x+Lw-)DpP<$5i9Y_>$U!HJ5J_zTc=2>kFxM%ZKAbay(YP}jh z_S4?V0KDt4fn6`^s_LO#v)lx3-{kef*G^D*Ks;8X;l`ALV!qh4_~X!$K*|qIO+@rm zI1Or3|CXUQIz3a)qq9z#Dq7`>9vn?gf5;Ff)g=rV=TBzJKdRt2Eg0Y8T}7=mVUlyH z2fDX7cMAE8EZX_#Oj@YF0G;%?rg|@M=BLEV178Q&1s_OA;fG{XgAqi+O)xJ6}v1CFqCF#PGIROS^2i1|tKLA%T#f zHw#I%*$T46E<#x4{y|+|VYQ)VRKy-2;JU^}{(2dFiENUSo&oRh0_3o`HL=`nZc!o0 zhDXtLt-5W8Zhgh`JnE(KyIbF;$fY~oA&c{%a)Ee9HOCNeF_&g5Ee0L5%t&y6Onn7v zrR`i$9;F5NxOFAchqB+&!;BQhoa^%Qm_Rd5UwkWqg|9vaOE@CaVnkv*maCd2g8X)@ zL(a(@3;)fMh`#qs92hHc9HcADwzh?eFZlJcqgDXPWVT>vJ6a#~DKl6j4-9M55GgS7 zJTC`)GCV9ZHwd+%>3hUFHA_vbdT6)$!yy`wgYpZIE#bDAFGp(2iEV6vs7Ih4PuXtM zkCvsy#OMCb)S0Ymcp~Eb%mH_Vvyh3#KRnCVw~n5#>RvPi8@ObR=iz2$jQt9vRg;)4 zldr&a8;6W^Y#l#_C$no8`hZ~%1Z$(yLyV?BHf$GTlN3D7~p_b6Q6mHR}6%WCe#J*O`?Hlu)(Uv`GmUwrtgLWcwr=huEWNV96o z;U;|W>uan_*@dmI{_%;p{_Qh3{jrn#MbR-|2)Wz<)TUm&C^97R5pTCbNNbmr7* zm_K>CMtv-9mji{bt~)407L7PbivKlZ0&18==ss}3z@@kXQy!s2Lu$0~{pAx)JW=EB zGC%!UFv|&}x~KZx?N0^F3=U&Xd)H9^LMND6gsqjad<&R@Tm-0a5p8f$E&5NaiP07f zPFI^|`1OWZj*Oo-@b;%ov7&N+1z7q3za2hN8g?6~L0pk&%u>;L(|AoRQ8=E+nAKF% zDxD|Q3F#H;xhx`;%`|orhxlBVQfvJLO{SHb{mRd!NXC5j^LseX6n=~bt<^GFVJT85 zLv!fuDoNN+bPrb=AM|Mg2Ny0;^jPzNt5Vy{y?bXdKs5t( z>v^phByfi^MohISIH!*)R4Mw5)XfDd>s77K}{1YE_C!1RedAJvdGZ_Wbf8Um)Q9*HSpsL)qjl zBNnJ&z~kX&S@$E|2Nd!*-!Yv6_is(g-~vA~Nu1kxp>E^6l~{V^9Gn#|N`d3gM%CuR z0zE?epfoga(ol6Med9$UhlFW;U?~Jdy9Yv~}q<7Y?9zeffu{BD@j8PxlCS1Y?qifgRB( z=9%z|3MhxEp9(2G#Y-*>aj#-jurH~uLbtL{(LJt@eT355b!~cGED}Bkq`{e z`@I}LIXK~VU?Q%Q=Lz?zw`*Uw=?=bJ{rh>;m~P5>4#@-oq0I$NN7W&~_-7Bn@5hPg z&y&>Ax$Lq!jK=UB&}Gt1HlI<3=S&2GLJsN#B4o0Ici^3OeFvSg-YG5fb)ENYj(|bd zWk^RzUE^T1y1K}e$@yM$ImBqX`EU>;` zbse|w=s!O4kM}^TWU$ie?5YQgPR)U|WT(Yy=VqgEYvUQzxR#jw_46Mez_seL&hFl? z2y7orE#sOwym%t7ko-a`Q5Gc!MJ@hL5FERh-@HMxz%;>~MDV#^P}*tw&7ZD$0$?Le zx`~o}f{Lw=AVP!<^(}F28I===xJ_GV3Pjx}qW5)3ns?IlnO;j{j9Os;Jxx}&IAp;4VHYh$GucBHh2;mBkV70T?nC%unZ^yYPkwdM1j z@?t5W-|%Sn7A20H`@8rvVh%iTFBPl4+I+Sa^2V*XJX0LfJ*4ihT7ws^Y4u#^Vu&q*B&|RC&fDg&J5jQVtK@La|%%I$Y>OBcE@Io-8gWJ zyzS*6GB(Aht)kJ7{1GDsgrNZCshxu@Ha?_T-ekE5N>xxwW+f&-;uv`>3R+Nv zXhr<)Fh36W)`~>7{F8Ebgb1)=$G%CF>0A~OAMHzFFA=zSG@a?h?mWU*Z(&Nr<%JgO zq{%h_QzN?jr_U&y%=0#1qZdk`u@x-i;);Ja(@RoJD8Zo%X`3$}Ev^vHi$LmZ<4e2( zp{lR$D-h$Lt>ZK|5p1Hg+oBzZ0$a1$$X#)*&i7O}AHoz#j)V63jO2U05 zQOZp35%>3=T}lT%;9wUY?)U#C#es zK%_T2J7TTUU+&x0z+~?cdAR*!PeZ3$@WafrCaJJ zQ!_Y9zY@<>k@r8_h#HiLdR0|*-VN{x822gu^uK^rNsXZZspu0BLBvwLHeing|} z?WqzluY6wK*Zz}`@^%c#E050O6!Sc?;}IS|L= zw2isZK}<9%KH$G9Xurs{PyV1Z>8@{u-aEXrN4WB)#Ol?VmdC@XY>ho3D|ZgGhdEiO zB3{U`Q~|0?K2PQ21P~sb3)kwCf)-<&vgd@E5-}o+P0+Rz8ne~6&-kaYQxmU?$EOeJ zqkk+&_?ud~a{C3>`7mF8h5n%+iY+FL9VU8(Cyc@&pGY42d<%Y_mm!pZ;FuFkd`QOG z@N&SF$ibNK0tZs0k&h2)TEm7@lZHO1KhJw<76Y^-8fEra1)MS*rSCKRvY&EX`IseR z7VG5#`vMczjmjwVB?FwK=^=y3N!HhS)_uKFz2ENoNF-)bxst??SWi=p0L`p`jO6P8 zw!j>d|L$hRc~LBH_XyEOR)|%Igc5?tG-v#kGPF4AC<&1@@{@|aTuwyY_2=ohF9x9+ zyyn1rj-w@QbuBVwK7Wf>;evov5C2tmK@k)T$ze_i3h8u8u>9g{K}Gmvm>@Fj+k+n% z7m$o+TlZf)Ge%!=(aPOKv+Vs<)8M0z;az6res{ciQ#U;NeS)oPX5S-|)l0jrWBY<# zL%S^aj>+50=!FT@4Usy>=hUI19MX1KB)Ix3y-IZA2=SlU9Xjhjn| zZ&!HZ1|f^mx*lP`hA7sB&$h|&e!jJxabF|8F^m`za4|Ej-};dUdn6feq{pLMke`2`OJnAx0g6Q=i zpF7TC24|*i)=Y1?v&BzFFY6Rw_`LCzk^jxmHMV~n7vZ}Se;O`eh&q`gam;LO1Qj;q zF59(@C$W{rkhH-uk}ThJ4%zt6PK)iEqPz5M6oXxvXW!=GX{GE9?zBr-ysYC*LoGp3 zqQ`yjBl`|-1vYIf2(8^YFpggWPoeWvGQkl9reF#~-w-l@5ro87m;9KM3wlxS&itH% zM#g`hb#wIh8lV86E<;&e3shG7n~4?@wl1GIkFnd7Z5ed;F&pC|F2Bz<_5fa+HFr@^ z(;uEx{=CNdnsx_KVbi4E(vG@w>5+_nHPR zL?N%RoW`ew!g+Z{bFsLKn6U+{F$mV|>sZ11v8jG#BJiiGj!|9UJYn;E+_Suqm*K!5 zc|zeBp{YKbt`DxH$4MlroAm{D(^wW@#)q$b1O^OkQv@tThk$y?!|w$wT?(XGPR+tbXfxX-)1{$Bh#`kl@1C{&4Me!iy&85l{vOgt-IotVl&u;U z-`j|0HDXKiQFxh1f~{#)N48%Z_dph2hO3U-(?nGcTjTu)?h>A}6Iq^Ml ze0-|{``CPueDH`p-ho(|9iYbFh8^r&T(&(YM6$ z(VX`eugZ?eO}gZ4%}gOa$O(UP&DBjFq{|4n*M;FTBTFLpIWEb)-=uL@vhh84Z2TSd?9jGLV}wx9|90`~KO{0{8C$^6!Rim4<* zz-t&q@HgD?kTskl1R6Y!SHJVpvPLhXMOy%j?$-H)VbDC-JJ!M2)qj6?)4{_Nzc=|` z=OrNuhF}aO?|FrfI{{*Q82*%3{I9%r=DS@~=61WTrM$|%i^P9k7=!S8F14m{_WB(7 zI+TvtC@b4w=i?}j-NE=~%6&DCZtgD!KL;S$^DV+34H+W#3ovE_at-0n(z*%NE zt1|opG_Lfj>o7HUoR@kn7Bqh`#j#ayT%=_$?~6UUII#ebo*haz$PKHo*^t{gDqmTr zAd8E4e!Bvg+cpus`uEeP3-rk{Ck{h$A%Sb45D@fpHHE^}VGa7Nu{zhFTbuc!Fx4CjbL?7wd z1_WBH9F{y&@s5>Ul6!*6A+wFge-^({6 z6%xHQxqcm&v|UtM$1j(@nH3b~`9ronY73l7b4H_d_1W;Qtc~r((-Y_V@5)Lb@EaL; zUf`k>io#D*8fg6uSoR4vVb|iIW1_)VGZIb4rE1lA+&9Ni*wcS5w|{xl)^1aOh}~!f z8|*Az^Wd_1S_l||tr-P`-WS3;yhK3JYxsWP&RF0UDB?oKp&$gxDX__7hV3r_(r*<- zU8>zqHT~kogwOBm_=S^{QPJLKI9t==Z7)Pyu zX8Tx^tfM_;*Uf+N1-fhs60Fv!@jQ9xnjR4tiIH!pO_H!j(+EvIGHyoSD?y`b5bSE# z@{~_b*ZTmzX8&=$3f>C^St=Et0#x|{fo>t{38 zr@W2;&i4*F^%K-bAHPFxjc#a&;TTtX9BT}WR!!;@0|*H7>P1wb*oj1!F)$V#Q5)Gp zUWtUFxNCSh;m(ny2`1G8C}lU;Qb8Oiw9nA18+}`4*qf7;W!}F3>~|k4?xEm`*jN$R z-YzA?Y7Vf1gD2903E#6Es<(hMv=y)Oym^;>>>nPKOgS$61^v;U)9=Dl|5v5ECSsIySnG|)XpFj6r=B) zI-EB$>%z>+1~05)t%@R zP6(-gNiZsc&tcB>i`34#7<6nmErS3Yu>TC$3wY}~ZM#tMZCB;!eqQ?N5n zLQ$u(aW?WD!X3t614n)jc-yycanW{7pRY!1-$U9O+5F=BUsX-nl^<(e0U^nG+?2^A zF)-2;bA4uTmOWr+nnKTkzmw}^Z(Od$OCidC^_wmZ;uY!pcaNU%y|%J`Md>$)#xM`T zFxSJLHb-~PW=rhGoqMR#lPPQ0^r)8e*q&^#%wW8lwm!kDLD)0DO1oM$y=tF()&{>J zF6yjll1r>V{TAAGwYA6W=Gh6D&81dhy{?U5*F+W5;gsF0C1hNs3tXsbh=x(X)Ur{3 zxIe%J2jo8k@?viK&V)7!st~CWlT69@w@nwJV1lyS?tD{m^RV58Zj*55_E(^h-vJ%@ zZd#SAFnjyHXL^stZWH(5fd6N}U(>TyDM9>>+#fZ+C@Z$r0@|Z!G2;%35QMsWYELJq zBd*Bt-_bl*pn1?&Dtp^$((Zh|@a!#r%q7MxfJM_rW2#+Sx@B7&8zqW=p;_kDpJZkD zx3+xJ3xG9NZN18^y;(p-FO)rbZUlKYoeCZEbk71wVyMNgWrWXQ8{hU;3F|+_Rsup{ z6uHZ>HKrntkF1W0dUTD&rQhK`E@xa%Qx}VBhs|D``djO6!p^)9()H?;J zn|6~O_Rg6~VwN%~u{gUwB7E+D=D<4Dp4>1#kPx94=VgEP*vz5?o)NrBIJFAvYS<)- zrrQ1plz3VtzX_E53wrNnO2HasuHkesRj~e>F(&OPx1q&}^e1SK z{UD`)0B{?L@pZ=>!;ApcP;5|wFX3cqRF^Rv*E}PA%e}a@EM7we4d!uwyDFUQ`*y-p z^*tdHf#XnxT#aDRjgpiO%)+7bgzw079xj{IrJ<^l=a+a?tl4hwRd@CK6d4fcu9GQj z{gI%()$R!@ARZIrBXuNz?pE77^Cl*NiK9M&(J(yS6df0>F~9nzYyc^Baeskv<%I8F zaT-G2a15sd#HDErdfFp@%OiP0PEHYZPKlF%E?)67B&sPN!-msC3!XqK)#H07{S`(S zqSs^xh3Pd1fiN7S9B38K-s7ke)gVq-?&GFh1Ok1-AkQ;eZ$u2RzlF+SYhFvqSKUo4 zd}N%w_LUHY*SH6-3;Zo`TzjSWUCMvVz-I7NVrD!brx5{c|&l|ClQhgTnhVhgz#M= zV=%S4Xb5&(mv%793;aJxxTcOIilg|O>mZb8qZkec@b4g8^TnpL-NqY{9{l3j zTf^9WSwire6A%P{jd=G5c=Xm0k!%NJVm-y2lCs(yZ}T3}bk`TuK&3FpTb#6%n$|d# zUvm3RQ#S3l1m|()8f8P{;X-T~HMONwF}1Yi6CdIXN4urcdg5e1M=xJhb4X$`HuHieI_om{1jCQwSE~Npf$Lt28F+GcW z9+?j5%PK5adA)}8#slp>_#}r-4|wVk(h8w=$dGqnpY;KcLELp(EjZAI(5*HX6ATMM}{4EW8-W4Y6JfuyJ1uIRr@sm z6oRcowc7lD8{|+F?Lue(Kke|gc#U1kWbbyt#GKg8aP$RRD2KF0XhFuPtHex2WU15e zI{zPeUvqQlA~v$%7k0kixVMOR#p8)(DZJUcT03F^g5Lr*mMt~?a-eDT}T*6y5$63gGHL5RvKp(}~;iPo!mb_%hemeP1Pm(dL zLggll*7ysgXH2{{+ENn2*VtvzmYM$&83~xcAqabe5Z?_5n?z{%(c@5ZfQ3gw=bh_G z6|M-u%(F&Dlc#9tabSi?7ogUKAd}^P%KJJArq;@Y#e=!jErc_gCxF4_={6sA6mm8Oblf@dSvE(PKxeh*WQb9F=QUCO3iMH%9%=@>?k9yJQj%~e z7vztZ*cQUum(>9=j$^6v+XsjNn(QmS|h}*bnE%hwH_?0>8 zeJY-{c_$_d#-0?B)!Wm+tbz;l!(YaIcJ?lYY?q7%EQ1@3BW{n79Ko=gf%dh9F5x%sKfojz*!-=hYVuOT}Yf0pGLGBL0>uKH7~M zWD&xPAONro0uB~#m#9P-qN;+WL$p zgd}ayr(46R^M1{sx)gKm{^+AWdg`Vx+$YD6+=D+#qVyXH!GwppK7t~TI!>xddXi&DrQ(kUNxhlnIqXOsjr@a5zRH*^kVSu$mj(2t)>L4e^ z!(8d-jeuRW1zrjx8PMWnU7%kB{k;zy=i&EK?S1wiBhI00ltS*719*jmne&6rZIAq! zWa>%VINq8pgWW}|!XJd+qKQ9$)~>UBD$FfW9#f}oQFi(vO}M!#c`rm%{v2$-C71|4F#d0u!KZH|WVj-*fA`5jH?$vwv z;w?}iYOwO9m*~2tazBO`jhW6>c%_$EfY!`6mxj>2#Y4FMmWsFXC8eT&t`qr=roMcU ze~@1)dnR_f7Ufy+uzi|sG2a_qY~$8#y1n&-$-?}w%(%2wsxKY#1M+*<%BfWM7jRhv z>^`b2c!VbRT$kcz7a*JcyqL`v+G82c@Ra*2kiYq1=gRM!?4v?h9eJd!w03-^D2bPF zB2HFCc!7bFzlGvOV>nxXG?3ggzw`u8*zY}MT$FXxBEYZ~wT!?6NH#hTI5T(4(Uuxy$ zGYy^tISyao&A`Y+gKpj2;wl_-6cnrG^LUMYWwXjNb>D8kc;>=?@5Zu8<01sV`}*gR zW~4qcofFP4`39S>r!Kg(Cfdnv-ZiX1D6XnQr})&t_%9Q@>|ksvOUidTf7+rg(GSOA z7iQkZ@OPAVoa{6KdmyHxjvl_yP7efC)`xM?ek8dx_;nBZY`Z&{5*U&2-aiB;Ot&|= zLYo=y_m@<_4)XMWvXS=>Neh;4{NNBDBkfdqsiQN!y+@73;cZ9r@Ojf_^kozoykgir zg<}ZLx5%q8Hh$THj#Fmcw=*b@789$Qj(C-KJQpNe!q8b^w~HX2=``hWoHpFN0P2*F zW9ik0zoYt{>)p4!(7)g>`^)<+*~i`?W;W>6*yjcc-?koqC>o`UB62c%k=#WlO~SbP zs^MQL&_6`6M!2}@>=m>9*tV?r6gwbhoZ{R0YL21c9GGH2TI0gzgW+xYtH_nbSpmUU z2lF>}8GG)xoro{ThzpBRzvfHHU*hph*E6%_kMX{|!Nrl2ZrP32i9AQagY@bj|0el+ z`w@ECODzh2KeHB6><+t7)N~>+h7gK`(Ae5AnNJU34TIGe>d{nc7E_AzQymQ&r=8cBp2!QP_?_sf$cvY5vGK~M=!+#hb{T9eJH0UTP zK4hk{y%Eyb_rzkyrbw4p*(WFfU=~Jn;mvY+ttI^c_~F4VoGRx8Wv-aY`Go*xmmwPc zDdd2E(?!1uBHH@50ol3y>jvXD{3;EfJ97|foo*Py-cXwMZQ4hC{HZp^qdT;OBT69M zz%^|GO%7usKz^(!$8cG+%~r2YV6i&*msF(!LQRg>0EN&uW?bC*ort3R4>4i*cYw}S zWH;cwUvBlS(dx3?zVVYXF1|U$N3+^islrEQAs6Q^ik3NNNp9C}Q)EZ$2lITAHuR2v zRCdQBfc-0ur@Ij3U1cQZ+0+W;#GR7u!19ExPP^Si($#fRD(Nhqto=TF=J1dZ^dh&y zo)5-B*y^G%=)RNb!4BbKume9fu5cZ~Y7%u}A&Y}A$4l%Chh<89@lZ4tuOGC-_7v|e z+6t7<>Ar1>ebjvk6rF-3YC7aHY3C7t$BP5RT#w*_SsmITk_WG`7F%!wZ$Afa{bqP- z_NMMTH!zG*F!Dxvm<`!vfYVQfcfO=ZKng*@M54eDgK;`8hq=Gp=IK&0eTWo08{Q!b z6F>WT&mMd?jNTnf<&Pip8j-Xp%QcWw9JOJtmta1i88c>Jo1RZteAp+KRsdXoe2@MD z@OxS_B=jmAVW%zzjt|81s6}0NX4Eya1e$bjSumPd##N(9_ZJX<$D@W#oY>i5gUQ&v z-M3rNA07SU(WVDrIHjfw8v)T#4$p_%D!CiZiRw1D<$ZFHtU}~$<&|b`)A;@Q;|fNf zCm10h41rMM&4(cm5B&Ri%E#1yeqcP5+ETKi1CB8h$tjORcm}TwkXmOfMAeJBg#>1R zis#hcE8TR>wO3<(ZoIkoc%wLiz1dU{kO76Qf)8<6+5wePLQca?&!uSY6`r@m?wu#AIj-);M`33bdp;Jx?t7O@ zC1u9$IFeyNI0{g1ZY(D4mF--$L1JY!$YD)zAUA0EsagCRy2rAA%}8ke5?Ty~`7*Or zEX|M3J-6gDzT_bY6d7_0j>ay1Ia2mt)~B}Pr*j)SI2!gy-yO}a4(rsz7!X>`ZFRS(fVg5*#iTeJ`uNCA%HhNI?$mjil9)ZlhA%$v1w zJM{W1h!2k%gmQF$)x0yX0mYOe)XgEQx+*r6CESZ!GMv55#<2wn+kCLuvg*G7@%Geb zLEU$g5fmm-^v(An?|#~Xpq`G!8RHFbE~xK>r9*4f$%E3f=k2_kk<7=PN*PN$09W=j zUY_NJ*SB5#-h3VPtHz3#Pp(|pcTMMP-5X46_>LpRO`W@c+J&V^p~iUxmx>D!94(FT zUy7lAW-oS=tw>c_Xkq8c>5Q0K)G)B58;o0b#T|G9z+!AcG(y+zi+x6O`B`EDs zp&P)O<7`UTkC}tU^jYth=N04Uv72W8y92-XnFW3Jq&Tqq*8ECOy#)al;JA%I1o}u^ zc8dcT+|EgV=gmH?b0xpx)&?T>46CP|M96IM)*SEk8$Ld3WD@AL}i+Kk7cO>xlC~*(E2!vA* z{)PvXVC38wC)0SyJjs^ZsQ zKh|`&HJX?7fjZQ69DC?FVm3Oe1_!Z7;*mgq-Afe%!RD%R(7$;G82YY_kX2(MICSqJ zpx!V#2oMsbAnNH74M`jYo5haY4MF)6a=3(Adyb{DO!YxIqR&NcgXw;k}96 zeGC2K?fVfJ|KqMwe90$wPU>qbRsy18Cwp@uf%JsvyjDnH<+54sw@kBrNd)}CE~;pM zdhhIiTb-X9z4yoepi+oKrbaN^6I5oPvxsf39AfJ*m`524^3mF!+=eELesg$Hd%=nn zfo_?V&Bx2NZaI-&47NPb{%jV~oOXMeupQY#s!boB0$dswXLg5U^6VS}KZ~c(2cxd5 z+M+D0kCpwLl4Mb;Q#jn?BE1P!3t=vQ8Il=Xu#?Pqx{RxevZ-Z{Jl7tAvdPiTccZtm zZJ)9kr<7K$;F{vy?v1?T^ns83Fq&{!ROM~-}d&-z8w z$9@Gh09C)KZBNU;VL_SvtWF=dy2l- zno#=9U-c$ryB_h}Hb1Cjv?ykeEaFTvIurV0J=EczR&b61Vu`yU;mqsRq-tOAf%n~< z56r80$Jcym6`yY~VtX`hQ(izmR_;0l(HJW{;DSG>BbBOCSxOgK40eM^2cojIp{v%K z%k?E;`!Vx-O9%pC=o-v_-iUy-X$tc&&&7TZa~gNx`ro&UG@k16>?8?in()k{Va(96 zF!U}TQ-%g%)UGGF7@A~j9T~)Ke}GBb7(+uOA=O}3!{9jo)sOStr>$j|rR zjhvNojC2e7e5=G!MR5x^C}?GK*C58=p<8yaC9ZAZogz zAh)whE(bmiSd-{~cIipnV#+L7WGj4}wXU&f#ICSh8_bkVcRKE0Q!qlW0^e=s$aNOW;Dz))3UHY)b?guIDD*krr^nN7m zsgO@V!VX{}pab$LQUEC4qWO#*w%55W(qk~SBFh~23AicilBLr^FiL9& z>M8V#-0<^%eL<+5N&)XNjaOQNzUlu z+||6nH~A$R^@O7;tEJsCL@|ALMM+ON>rP(U-M=8fe?LLv2Yz!u_WEIhXz2Yw8oKI8 z6sPDlu0Gbo&>OwY^_H#^KvJ<~E9Dz`7azP7-q31)mXq#$90HuYUVokaWr~tx;;Rj^ z-;YGW=yq~7Ma+-2v5YR)tg@k!L{;qom!s(Z8;ZwCYLbcA^#|&DwQ1dsCo|0UxsnS9 zngYfxJ-O6k4BN7}h#!LUk0>6eN%dwYR7QDn4w%L#J=64y1W#ze6EsuH7BBiGcr^mv z|8k&z+RA^v4(EPr1BTr1og{46_Xs?oaOi0dhyoG|E|{2e6Ch~TgkIj1JPe|~@47qs zV6pA0e}}`__;Tp}CVd&PZ8cs_aN1h1-}yzXX`~6AKsFRf8#4xWt25Lgp>r|J$}f>e zJN#&DFoCS<&4U~dhEdO_9+QNPsSQ55sTx>+3o5yrwj;oAdj*5{5og?j$i|b4uI@;V z{NUeSNndPCJ{L-!Nq*#o4xUH)xh=$P8xJ>*zkx#{(P2aoH@XX?57GV;Wc-gIKi%=C zSZaR(FK1KZ+M>!fHbIgS32dgzIUxl3l!3ldbTx*K$}4o+-FML6zka;zc7Ot+H|P0( zxEs_^kW#Y;=8BNdMh4Z=j>5wenERQE?l&LgT4%Q_Y!>HlZPmmN(|a$vLFAg*pb-6r zVpIUpp5r*~Q$>FcNeUzDl(@|MS?*5xW?$sZ0PfFCopu)v;OO88aN_wj(0FSk1>e8? zeUkdA?JY6_XnWG-5GPgg25FA8cf=rn<>#@<6R`-$5uciEB?Yg+_9HI#hj5AaNSlTy zxC}<-(pZIv8-xb3(+}?uDj+>Ad=M+Ll?CiUeMUlWK!0&ao_p5_mH^UpM-h;cFlH)E>Y(Nz%?VyG2bTS4Q zny8DTWD;q2UiV?Cyudz-!>9rh9)Y^nxNfcLFiL}&MHe_q3Lw0mMma^U2r2R6`(y?b?<=GK|AWFz#e9ejX&pRMx%yMv2U z+7@+iGhvI{KmujuUR`B-^BpTOmKenbFUNlJ_Rn)A!)AQmpdL30lD1JSc_xt!b+G3B z0kLGOsV+!M(5IVDy~4iVb`pNi760-7FhU^c>L92$WcB<3<`XWAIgjIi!tTjAoMNg9 zw9G!I$79bZoh)cu%6APJ7x)b1R8p6b&k64*(_Gt)p07HC5gNuZ0;S$?2S*W)2t3?> z?CNrb5c8Y<+L-VL2q`L9R8zyx-YKw;04=yvtHIcIvB>?aP5y|Myq~Ye5R7=E2s)td zw=YpomrMN-+WSSc5ROoPIP!+9j^$2^`ZoDzY411Z+%Jd3VRU_4mkuD*rhJ_A|1d3l z-(*1$jKuLb40artasr?B?DtJU0iU?K58HyDnVr6WIe;lfih+|uum1fB z^f{UQO`y-7t!0;ab2ua;s!`(M>feUTKqVpzbQ&(}ewr7VB+OfFf?lP?6XvwgJe zN6!cQz8TPV%_wevNApyT?W7wT2}i(d5PAZAZdtF0`6|l*zPEBbU)rNii78LqB+mrE z(K-_Q1~|m7KOE%Oa?(5KbI5!ICNd=_X$Q#6_!tZ!=-zVZvMYl`;A)-Kx<g!Lf z;TahFQ^1eO3~|Q6q3Dk0Xd;=KURR})q)@?du&_B_hij&XNu~~U>%As3AAr{-{MNY7 z%}2gHX@S4@I1Cz%cJx4*5O(3wmQbsbVmzTxqw-OHKfY$+U!wo@{o*zRfe{qDrPD_%~8b0El{8pE^OO-fH2q|tCJ zn{RDzlj7Ua$6b;<#3xBV)52z`cZk$)%-7o7C%{jxmkO%k*tq$OSGVRQ!C8k*T)P{p z*-$`T9|&dBQd&})zhDQC(@<{KpnYV{)Op}UgK^Um+U<5is1hnsx`O4jmytyAM*UD9 z{R9|){WHMNdj;F}e9~3sLSM;N01kqd8`r?K()}5;1!G(y*S;{Ncn*Z0F1Y8r?lbTxf@9i;p^>O2;G?(C5RuUyLNoLX078~{#ow?Z1e3(u0Qgnwi zZr7>=z1qhM?DKvdrPS^wTpF#;GzZ)vvT`-z-rto=ufi0Cg`Rhu$CQW6 zpFP|_c~|e?9Ct`6xZofT84wV-jv$_YlbTLB@S2{lK$CCx9YoynS?LCrnwZq^qV3#3H|=zDr%zqX z6W;HA%)gH(H-30O3o(DRGp>Vi7MtS+l@DhbPudyUoqS8TgLU&PolI}Gjud#!B%#Tr86zX$_HYgGX7PKK9YQIg?=9G z8Na14%g!ym1454wn-nromxBR+{-95+(F?mXFoK=NRG&^_wW@%}i{GjD>z!!qeg!A$ z+Z0ZaHsa%t<*FqZGv{;^fwRz+KBV=PttUV^!(}d8)~2_^^0F}0K$rtHCILs28S=$aa6M z9aNyz8s~7@6Bgv+u%n3ip9bR>#(O$+zugfdG4w5fSM}os6z0LmA7w=7^-bS9vwX)P zQI~*x5B-yj7<$k8C=`1OTm<(>4~1O9`;&|$w9X@jqtqL0)0jsQ806FRpJTj#+ztuT z?;F50X5Y)Ip6{cNX>GcHs{9m2`266H_-d%3Wsy4zssf91`zl50&^U9ddUl6TJ$G}z zU(Wyb(NoXdfp2Ztt?wPn-LB$C@KB$9`+Nn8Xwrar|GMw-0*d^9eo*Awai&_dIfi2T?PdqozGHyr$NB^@ya?Qch+)YnxAf=L6brd&K)j8W`HsTUh>cbo)`eKt??v zgcjJ^hAyxjkt)5DDuCoh!X+Gmq1x*cFY+z@q4VG?^hXJ^G0eFc8Id-jZ8eU(Hv)pp zTdctG+aAxO%9C7wux|abv1a7eH`1Om=;%A` z{U~4ev4F&Xll6XU;W?~{6xE_eajGLJk@pG|`OIlJmdr6lEIUimSGD>n^wY%;DwW|B zRLq^P42*CMk?2O7dW1PR4)7XidrY!s{l|Uu;`dg4nv{j#zMn^U-94iq6vFQ}ej?Z# z?b;sZq8Nrg?VfFY*AZx7Ac*Upxh5BNADqGn7WA!u57Oy&a?CE#A-5BbFH_%C?wjwH z-|n-xOXm0Av{%C*px!~J)-oXgT?KT10W!ESVXD%Zt6TIA%nm>yyx3QVPHG_FZ;4-)wx~*_zIg9Eq|~2&EBdDzx=DRxL#fKwr0QKBrpaSnhX`-?txq zA$1ymgmN;J@+?I4`D%uN4tnSjtO;F+A!NVY_h#7ID?@E)+$f{a4%}HfZS1a>gYL1>S=qjJxcry|e%?c2H%X(UXygnDaVoQL zp>pQ9bzHtnu5bv9Ta3G8rQ5K@b4Bd_$pf)}TQ=4A&m{uiKbPn=1JUzd01xR17aWB1 zmSUWw(bzd@2yC4V+l4)IJ7l_-ZfNDl=&hH2i|xKHV=tox;xvPQ zWbkzgiZ1qZX!tin-*eT~y%+c8|1oHYmFmR=xaX{j8MWm!_G2A6b<+`wL)S?hjm5ya#izr5*WFE6xV~C4q!KWJ2IBpBRtfRCJ94u`~iBOb@BVv z)SqPB`%cNKUE2fh?Q~+&lskbk8kO2+A90pq>Zo>vh<3MY(qAQbw#|5?Nn8Z$QIb98 z47=IcM-KN7tm;4-4D!*DZ-mGa{;~YQ8#HCv-9HTFvky}umTOQ~YQ||ol8)_v3A+JN zdIS zP%fc2Z2ZlS;OF+eedZOsmV>&HQgataIafR45y@|1dfN@s4)(U*&>pHRbh|QJey{@m zR;ka>#D%>L=LozA8=VA^5*71*48K?@cpY~2xD`R?L{6A9pI^GuzJP{*GxT4D-+jE$ zAWEc^H(X9rLjdp{6ipP3ENjITXmi6A+OlV$(srSg{(3Fl_b1-6rvF%S1#{Gp2^f-Y zdtHGqJC|sDP}@Y?!P=0Oh%qJ5s$hM%&0l%RS9JKdqDSs0r@eT54h|`QK(=F?R}OLj znalxYF*oB(0h?&FHLJz02xRbI1&-D7`Yz5sSvrcq6sIH?j9eFl)Yx2i@PZEjuvhYl zHWc*?92$GOxf;Y*=9hcLC%D}K=uZGZ?s<{8Cd1iN=oigPvrkmHS=oDFXUCt+ zpY6c4>_kH4T_-+0?akT01o&|OC_b(QJHu}4HsC()1_X5f$cV>Muzk4<4%iVXoXh33sn6ITMudLmcJioUXNW^U zzAn57e)*h{pOSyOPai=M0!H7EmDGg-)FDv%caZ0v-NfZ;1I@QXod1`%_i9oc+1f_` z%DE@l^6nA|kU;`}1Tu)59r6_I%r|B_r6BLDqVFxDAvpg7S(yCCJW|B4Ym%9{UL_^7a(!kQbC~Qq2)}TCtH2 zXG$LQXZ+BbqsV9*pN31>Jfb1=qCh?c{4mf*rp6hftb9y=w}vb{caS*-4;DLOMvxk# z{&+lk0rqn4rRT$Z51cnqJ*P>}SHW4)HGcc4adsZ6QuLp3IPOrM>agQY5;b&l9NX@^ zM^1Kq!nd1kMqxSqLectj1(Mot+_p}?e^6X;cW){>Yo8OlW(cc|s_iBPDAK+ID{Xj6 ztucF!+ZdOBFw^VTYIF4X!xxERyh1I8m4Tei*N!L)S+Q!A7- zVWf2m6b-$>w1}OKI>qmRFY~OG&See|<~=%ks86X7G7Z=A=*Y7#yLxtig0uG`O^>-s)3;-}jIM@B1jlKNS=#}O z_%;>LFuExC@AE9dMK5HePCGZC6rf;l|F6Z)JrdO=;o@4jT>dL*S=jj)kW9(pQLtP ztuYhb2STcCW(&fWvaR;<) z-cQ4R98a`(-?;e2a7Pyi=!3WPs*<>WiTyO0o$|NVgWr4QyF1J72qw7ppHD(!hwan6#ZhoLzN8;~hP?bL5UbqS)uhNV3CA1Sc#?-E8#)Nlx0ZWr@J^Mb zIYUE+;a?&zE&Fmmgk!;SlykM&{u~AeFOfash7wi1O>x=OMbyblmaFMck;9^YEs9T! zw_9|uPb+1=H{E9>>b9yRY^?+I!bKRv6_jTO{?pw%I`EpHl=xm65M({FXp`Z)KBzFC9Km&LiAt{cDV z=48oFnj2~G3dzGOyO)P&rDNrNl|g7ywgKBrvZ5y(em_9F@Cv<@)%Zt*=>Ih#_9qDI z4|N5;30WLQQ4+>ria^#5jRSFRyB@J9TepIX@@%8({oe9>c7IPFF?30P3|B4*$eBTKnp^wAlA!?tt?yI<%kI(vtIBZ6y=aHAs$u_VO*&NBp2_^#O{F$j%^t{26$g`uN?1{{sB> zY)Tvl*s|e!WuaqeU?izdZC48-f=LxaY)aR#B{nLrtBv&&q>na>?AH{EYJL*)osz_! zGH_6-z<6rzfUP6wddBv2iiY*_fhUdgZkP*|Jmb1;iuViB|25bF{x3F{h+7A=>-&@! zxRm|z*kUy~P+-J=eKZE9T4wxR>##7vo~V^5F-!=%DW$Z4vUbZ&pV?syd@wtncUMu) zO_<-M!ZP#rT$aHt=x%=OxDaW@kH?XoM5lPPv^$-hev92IukNSpC4TEC@W>y5kJGw? z=1%UjIk`;QMrj1W5SUndghSCd?hqvMG2@9tdT%eqM+QHCNqb=G2@X4|_d@nKlSQnm z4N)@0=T_RK`xkR-P3656gPZRZ-oMnx%Npj{2|j&mi0YPKZ4+{# z4XZGA+OCXZb=B+>7unmP6WP1|Id@3rbvRBqKqPqq8jR9_k{ z&FF8IyZ7zF_`iRJ%l{WhM_}K-S3`a^qqel*GoyM8xr)3KvPU&j%s4I^oQnMu!aSE8 zu1X?*qvx0MiT{A^Ta9UYE}M(Y!AS7hMQGFx0^h~RkNbhW-m>llR(_KkLA^QF*@Ja3 zQd6{T(>4>OTn{V3u&u-M`(^vh!Qg*{ZgA=@ZvsD^oA-6|l}g~x4m9*6|Gy{sa%tml z8DHE{uGhOt%+yxeO*Ab{s4+&@%=2>$gX~*>h!=+VvZAq{gwWr2-HW;oCUQRaskjN- zsxw)I-5E@t7z}4mflpsukDnmv$}D(=SUzArY9gEe#oc7IuwxOL})6}^{kfAy-O zqnJJ@VJFgLAiCwr@hBVKyY--%ew+5vmUmrWn={kgAHdFqnTyQ#;!hszuEA(?dTDVv zVx$2s>Q=mEg7XdE5WQ3<@+3~k5vkyRvW9;P9r^R5r>Q9k)H|2LJ_w$FCvMx7 z4G+(8Y*%GBUSE&aU&xtVHf`Oxz|>rpHJWpPfXE`SwQG}@N4Y?``-_e}h9O`<*mn~r z5La54_}JWmGXvv^9x;I#?CibQ;E0R-9`|cd;=jf(oDoX@uJI4Q`#QntR$Xvp02~6wv=Q$D+a4k5!SgFwu?EJ!g(fP0i7T>#tD;+N zegm6$cV5s#Lqj#07G*P-F_RH=p7syhzfSs%iDMagK8T8in3E&^9_UAV!%?=_C0tEO z1-`*#`bYRhED0RnX-rz(zC#TovRsS5jiNoAZ-y1Ewjn>|l7K014kwzMCGtJS` z_uRfw?xG$MeFn4SEfEWU=>f%`Y_0DQKMa*u$&+Kb?(xp)3 zobEYIA3|FDWS6}Gj~Q^klJ9o})!mIf>Q!K|pku?ORhKdZR~=65MIEi{F_%bI2`^B% zZ@x#KZ(9~Y(Ijx=P?*ArHRIvFhtLFxG9MoRp5d8GRAn5rJ0)&^NBVlZbiodxfU`)i z4v@5is7Tlkf{DFu63?&aI_V(SayR&#no zHfKCeEYW$6E)@VL%#=J&9p#)BLrh}9#0&N%X6u&#PC&80%ozMuJ_X0uj_rDkOZfrf zd4H6-_Jh=STXfl8;LT&ke}UD9JCtqXm`hUlM?vQdXnM?(-r%~56^H#JNKMJK^PA{k zmo&{BZcIm|euhu@m%OhM>Q7@Yx^J7E|I9<>B$eDqpnKC)o;pYO4V6K%)I6+dYr{}Y zr(N=bUB^k6$B^xR((aaZ4q`lI*UTjp7XXE@<^9lpY=GYZ42e^$@;19iS-&5P&* z7O9<sQ&VWWSG(4~wk*>7-LOSf=_uR+=lZh1U7q{( z1d!~mEpq>3Ngi;DU<#QFw_t0Vz^T9`kpQPZ?yFT!X>@j=g-+GneZTXkJcG94pq%0h zGm4(b9fMZhA=~Hgf78zWcwm^uaD-gjl;_e8iMTY1{t4PXZj+*izV(r5Yy0C35JDmd z%D@ak6V%#uF_`gj8yL4Az0c}m#w#MPcC48tk?^c2D!WQ%%^muPc7`a_C=c>Q>Wu6E zgn2H7Pr@WVC-S2KOwt&GlgOgE+`ncX=I4lYkQROYt@8Zee;3E!sym|dbZxNMw1-pl zN7B3J-ZP{G7oe+M4@(Yl+qNOn2Nn>i5@IU5)53Rj6nmA#zsK`#~f^l*>RTyb>i~gn~HFdgW ze5Blux_>^~=j!}q2Vo;N*{$jChr;E7F|%CpB1wx7f9lfrP`hQSG#A&sYeasllJb** ziwN4U_H1jAHzjtS-ezAgSe_A8{<4dJlO01LP~VG=ITTEza|JEn0Irc)^Vu{_0{!!W zFqONUZ6GTnWtO-z4@P3iKG;;1}5IOcHQ!9u`?zd-%CjMD=>nP+@eaAzN>#9P6e zNvK@<^r7e$=Oulk0aJ)B>@xW&>hcYEb=f^G!znWZfqMi`M$=3dd2Eq=J>a*|+ibBZ z1IIlX75Jy9OBXS|viPMC(e@#^49h<8<3T)_e}~Z~(M#E^iZc&^t(c_1*83?cxj1lh zC89W&q2Q=g$8>^yMh-@n(V9NGmz?2A3UnupXWkb-9P77)re!eTvnRN#I2;k_ozT-$L-*v2Vp(RvZ79IE$f ze}m@@eRU_}D~xZ9WP_AVBJrP~J`7z<^`?Wu;LPyXc&gfWnD@qRsy}{M) z=IlcP7->jko*{%Q?N0dYoBs_;Ew7Ng!#(70rydh32_Goj$U(4dWxs zL=^H2IW_mOt=v3T8=~lwE?e1XYxyhf#IeZe2rsXbuc*tf>WbY{-sQl$FN|mtM$n10 zUHDYerr9$B>04YK?^o?k;6K}Q|3jr-bYR3$`E^!)}Z){Db$ojc%f&R}`c&4xfs;+#g^$d41V=X{?PPx^KPk-15q zVrV=?5uyJR=nsR3r72aC2drHt^&Uux@tmA9EU*_$JWRVff1>P>$4y+>C_iI}GduLx z@5P4SZphZPi@w)50&)x{fENc2f6*GVsQ_nC4+{`yX1C1l`nYrI=B&`V&dQ0UCy2kQ z@9xtSq-^hyFL1bKN<0(j0^E#nOgOTd3Xx;WdAHAJlNcL=i%Ku5j}>@ zOK9WEAb^eUe(#9bnl0@2y?X056vD;haPszhv8XqNpNTNubWi@G?k7{*f5N{54&=m) zD&zR!wkr==U~b(jjM_e*(dtp#-?ReVu4u*LfzW{X?Mn%OAESO4G9nST__}&}cdX~e z`{*>?aJ!p)9bRiX*h_+Z>v;6sEj|jp?x@c4RdX- z5JyDvN|v#tV4{Z9h*bU6e|LEyLH{pEuy4)CUb9IcYW zUc!ptxWe+_r$?pn-$D=GtXGk!>EsmWmR_c5WZ%@>*Lu)1(FJlG>8%w@{T0_KEd0)Gt9^$ zaG%at*WG#b8D3V`e^9v|Sr6Gc*fYI2e5IC!(Cq2{A0Ypsq0b)n?0J6pef?MX>!NyS za@?pM#*41V2k_N5!gG1?_SZH&I@K+;kxg*5hO?f&y!e)Ojymxb2Ivm8r9Clkcvym%ZTI3mNysjl^FDUDpXB`h>@F=9>)Q*1xnt9h3 z_{geLB0N_VD^%!N)$e;u8DP;GcuH>0!2fHgP3U1ypZ+b(55w({`~vOH?(Q1+BGgR! z{ou6{JY0^Be_m{kTvD7m`!pcd>UFrSUpqxthebX&SWcer#R-1cS-GpKh@MQ-c_IR< z98bsGzCi8KDaH#1v3HN4CFv@p`juPSLS+&{Z<&bA_Z^s=-tLD$VE0F3C8LpEBDJvD zc7cJ3N}F#lUVzlZQ9SNa_@|i2AID_Ag~9Duc|fKse~REmUp_{vYFIxW9Q~4Xk-F*Y z1EKdauk|hdbFe=#z|5cQ+IzPqgCLEa50)yvW&7<8KJuelu!1A2*15mx=Ymtr3&HLt zF@XXky*nFK`908&&cH#SsHE6O)}S4b(!J!#A*lkb2pcD)!u!#%@aD3$?$FCeC>lSX z+l7Pee+0I%|NW!7pTW5zaiPob`?jw$Bikt#=q{7y7>y5w&AocZL>o4}ECp0qb$*@O z&|8IpZ~ZAhdW}FW(I|}3II)I3-$fh@erb(a*4E>k9V^^Jj%On)uaQ|em+EF=6=jqw z8s1jnFzB@|F5Ra8<=)Rv=|D98_dTlO`(>uCek+tMN8C1O;kLDvrxUwEdM=vcHyOUm zMRu5hMEv%mp)H@Y$4gAXr?X7#o80y|{4io?SR%PV%zmHYB_#;i^LLF|$<&+)b7~0h zf5DRe#5sHQj0_iMOA*ks>vwxB{B4G%*L}7Kb42Z4-r#t1>+#L$8thrWoz7?cL9Di9 zW^A}Eb?*`f9J|~T2o@4bK`K>yOHOMW{wAo6>E*xc1%;L z#}Jih=U3a{mHe%J06Ld_pW6vzWPqb6Y%`0FdWwh;8(2R#+h%uYlp`|^z;`RGgw!&W zL-^L>y?}4q>Q^WAdvY4gd~PCutPwo$VGnU&#KXUqd}(d`34$Wa7O|EzGKZ96e=vpO zYaFp{6k{CRbw4U|&o&IIIuq67?sQE-ojtc6?M(+ao4ZpVnV2$7S5wSq{o@t=n|66! zsU3q!-omFNRST0M`BD=5`u1#Pdycy112od)MfFp}N$}r+M!pJqc_Z$#S=T39iS0)+ zW`lua3x{k;??Ud58Z@q?)jfe9e+;i!?ysR=JP0j~Tgc0|hvsVTQ%=@QdxN+m8y$lJjU2pT7+!H=WmP~ zTaNqLtqfQzt<{Nqnv8_wp*zLcri6;y?SjD0N`XS1KjA{!{0JNT>IN?!eIutoE3Y}1k#sIaTufjfF3-3ta1v{%x(SWe1D;^QIGora2h^4qiwOw2EY zbHU;@L6elj5Vi}`ACJ2B*k#n@GZ>*b{z-%MXs?Nib%;9ojQ0-LXm@UliFC62;Ys|A z7DeZW9fVjrE@Fc}xi2mHfBrBn`gPDBO%Hqn-B3E{vAs($m~3BmN_|kO)8VOa^0rsD zwx5LfzH~kH*U-xcgw!B`q{^b5t1#k2;G6x48;0(_nh>kvo;7~j;FfQho~{2HdU;sf zX=Q6peLmH?gIClob#!J7l@;`Oz`?|mE;6w9?)VIh-}oTZd&g+}e_`CBG}(;P>FQ=& za$~iVe37+@-ue2LU&t^xh}%eFH0W^?52G$Me_GnC+1XDn8ASlUXwuc*aXGU zr2X+R{ANDMYhj{Pe+l%gTOEZo4X=bCDpGCxXYPa$Juz{UXj?LOTu zBcxm}#3R~r5L%JjP@YzKy&+|b+gj#v_Y%>#Z3)jM6p!gN=v;{cTH2z9nGE8c9Wovf4%oYSIb@5#&GHh-4NnT z9pg!p?}s$ug5xTBHt8|V452z+Za3-plHBtd`rkDM7hOOv*$|G*VUi60%0Os%6NWLZ zZt#f92stu`jx6?~U^q7?tl2*i{|F1FS9eM`H(WWXCxKHt~BJ=!ft$dT#Iy z;{>{9fMr7>p6xRWfqI84qK{dXx7;C8?qsM}LQa;}Q69_v=4s2A{tWN(1=g2~)wrqu zjB_8d!=h{BZ^e0kbQ|K}=8Z8K8EFFbaPy@A$#hM=e;*{Az93ghKrtz%iv5Xr3GDcr z<*(b^y$!vT(UxT0i$0JG2 z-7UZpfi+tD^KG$@x)_0eyq(<+wK!?3!QN40ND>c>peM-o_uh~l;WMM&qTS@7@Uz*v zFMRI&e_5b3cE0_({*fQdJ0`JeGwl|*gQgXNd`qwHHQhYTbdR4=&ZZ{5KF7P#EdB|_ zdjvg@HU#|k%mfsBfMK4E1Mh{zKjx%J8`{0NuEPVXtHH2~8c-Ips+ds7?l)v)p@}iK zM}#ATrPyhru6Bz;2KzCOTd@1R|Ju1574?7Tf2ywEJIly%ibl=V4IaOCyY}%Y?!Ixk z9kWq}kW+uw;gu-)8v6`hzGYl@W#i{>y^cSt=_e2Vsl4{WuwkW4&mo0J#OEdCHgp; ze_r&7mz6FRy|&dE#XagxS;9kjGgLdG(f#P(NTv70&f1|b>4l#FFJ&dw9rNqXL$=|t zo$G=Iq8&YzdzM*^z~A}ZXqZ*W{LhWO(rK!9$dYU5g<1`u}_pJ`=Y*l`Q6%|Y#eZvq>-Jl3m zv)?4U3$t=0+|wwfA$K^?zX>mnvhpj~kGJm{rMbqoVPrE~7|OaDfBb_j76F-WFHw3HX)wc3jPE)w_3?a3y=XTlbJWRT zwYo>~t_x^tI5tyu-JsdHRnWuKF+#8EFCVE45Dc;dzb?K{s(9e#*v3br@X>;FvTbuH zOcV14nJ48Zdx%LXXX_c+U8X4sv;40Tu1nA7|Dq)?LNaS zocddc(YGwDIYyU(NrJ?&H3~F{P2eu!E)rUh6uyka6dsWST|&%Vt!%2$N}f04Xa=lsoJgom}VFL(kM64AO(JCQq{+;xYGZ>7Sq4u3Ka z|%bN;Cm`j&>!nym+xSv?rfgSB$?X)D`M8Jja z;St;9=u7U>JLoemf8TSLmRERZO``5lTH}mKI=Yi&SH!@a5%0_~-^UlGq*mUwg2wyw z*~a`Ebg5x!GpWxL8o113sP0Ej5+RBdxY*}PT%`qD-WObC6IJQGjI{LwI|pt^`2Gy~ zo}k&)@v`&)Od}Ld0+C749_HFUW;66h`ppSzpXbTALpIPtf25x32mMLb?pYOc%g4kd z7qEvFZ4TXw<|IQ4Q7Z6DP_Xe8C#wLq42eHI@!%#5`#)#D_bXQ4UMY?K-$e~nd zJCgfX?AmYLsD=vXF??S?Lf9u3gOK8WRrlUDP&SD{o!Y*uSYxVpG=Cxa{jlnHgR=V- zEbP(%p~pdB5m{>M-04f1=d8!w#P&%G*C^GwALs8aZEO z%Xf(k|0VLWtSMol!xp(TcdNWbwzU=irV& znw@`vY`wk8yBh$GpCnUX#yQe<2|VUrJIe{zE^Q}H6xD*V8Xv5I1sGgNpN_M{n)zC_*a7?aCQ-)8Q6$@ae+2h5e| zhjDS=4J;{S?)!tSVcVP2f?dM*Kh83DOXf**b~csVi8=<{S-U+dn_D^eQ1UNuqi7lF ze<{M5(*Gg*oN$s@So;KqFo9=NG>rZM_AV^y#~g$FZg73{EIL);<@m&)SwNT+ z6&cW3=SmSPok<-q?&2p`I7wC)zFs;+T^-m@|F496beW&P7Y&|f$>w5s61huE*tCyN zsJ(ACiq9C-%^X=0KDM_@xAZHXaT7i5f85SJd(I(x&li1tb9c3{pU&bmh1-o)sI`*8 zJFk9RbT-kdgH@Jn=d10_u8Q67fg|6-F%cMLP#D7qbnW4Az|b`1(8S_mpij2B)2V}G z`I(aP9xm-gw~N9XjkUMva79_@d{N3%RQx0Axpg><5IC?V*8$=A6u}UT?Gb;Te|q6B zGjFCOg@X}*{f;_}L*OLteY9SsGu9$h$+>*$XMK{#c}qq?;d6#s?-ZjSF7oAZE2|Z& z|1Ry^D+#3mIZe=O&%s>EC(t=c?xV4}#h)8w+usrx7YKZV6vD0T@7V?p>%>sJ^DsaL zFLQSE(+#wso%0HD1h}OL_@nQ@f3%PJ1hq)A`?s`%AD3PC1W0qGow9hli(mT0C^h$M z0v{R&ww;SoBW1$w=Ov(8Sd$T-a}qriI1Iu=Y1L#2cl8aZfGotqD2o|YSAIK^N@k( z2cbEOa4D$ge91XQb&X>-5Sz9~g8zOD?A&Q$Oi~qrDHn8O0zV_}Dqv+@+MM6YRl;f| zCv=i9v@hSYs6D&2{b4Rke-Q!!SC8elY-{YB12)%!LJ@+1k+p-;KuKU8Y*QcOmTl|c zL6D5f&-`(p%tN$?;llR<{J{ZXL|Yh4`*|0OQa3}x1?q{Ct@CDrb-?@j(w~mc3DNT-X@HsN&f|Pnd^n(Q+Bx#G*iMgE~ zUfC9d4&}1yo}bP4pzonUZ^5FUVT+OwxZLhASRHa|5bW;tTrcXHZt#|N-6)uK?Og`i zxJdXz?DzLT3|=BfOxZ;Qe%Hdyq1`!Mixxg}#$~9e4xGV~e?xOiCy%mIOZ_qOCnMg7 zhuh7#L0k3K2HLJ->oJx!{nnq3E53W4$UBwFSE$h5#QzKKk3NGwNxa>%Dw5u~h)vWz zyy-S=a#0m47dmIy>@2b7Fy-3pz6Y)C;PavC`;%}LpC>3k^d6o@NpCx~w#D4aBt~Pj ztN=QsTNu7hfA06FjbA_KidLWCVw;GlJ7cA+sLQ>ER~AHMN4e)#zMAIoDpRwQ;c*wK zxW4bQteEC*T>mNR_u5m`LeC@U+`|(?F(9Q;2gL}|cNedn*JG%Jt6jL=_u2EB$rtT- z;E2Evr3XtrQLNHb_$KrEQFuRcZ@B}0-gM1>-un`we@ojiyNX$Y`1MA-M|E~Tt~O60 zLhz|ogNMWSEv~g)5md7G?aY0T_foe$;d6hpLx%ztgV;UYa+@6$Q{xpzqcD%}2j6t{ zN-RbChj@#^5gtFAKafpe?xIT*L=#r|F!3rDd@df;D6qqecw*V z>;Xc+aZl%8J{d}3@GT-=9QMRk$cA85In_f(w{?iX?O5n(H+&eFZQh}u&+=alWtrRX z+(lIlXSlDqtF1W%&8@g~KFYHpP-J>2PdYpnOn0ClQL*r>HRYY$Tvw8KhT~j-qn|9r zE9v}W&dU0v*&k>;S8No5o>ZN#aKU( z(*MJL{p__^;7unSBeiG6bI91ko;Db6L!st`W`{k}`p3E}>2dnm@deP|e-{47D-cl^ z_NX*li6}D>nRbI5uN>*H+Sc?@e?T$mR_Rwx!5)6;&s+GdeD83!e@6bv9!I|_FZXZ1_@HWXOqtDVShB{#F|H zZ|S+ba6eapQM7&Cv9-dVxaQ(PG*e&mTU5l7Sozj5+*|u%$G??t|0VcK3XNLs9=CIS zRHu5sy@!QX;EWdv7v^GJu62kVH-}v3Q^qRaJ(4*t@l6feZIQ+9fA6FoT@=G~*!X`Frv^>Hutn%Sgd zY(znM5V!pGzEe;kJw4qjTeUns#le_q&5FexxTAfAi6mA+J0`=o@sa2L3h=^t0kUZPkQTYCPBHZOr5;U!d)TI`}Wy=9_#N zon6m0PS`|1Q6xiqU&O}17)+xmLLv0pMQI%KVZ>t=myzD%7`nR}fjF4ha7l>7au7>8 zu`5YL)f3*NtI}&45nlDbW+UD&vJqnKI<7+zV6Mxkf7me&_d4^egvp9`w4OZ=zH28t z>EY$(1A9DhhDr0in*^NrYc>+_p%{!|>wsZg+6!RDcZe@zLlA_GbjOko1BDfN_qAFHC# zU)g}Y_>xVEAQTF=Y&7;p6C5Bin1B{ z4e&uYvQY+2I!PIGC~17UN5oMzpVgMFxT-tlw_!nXN)FS zgkji}Q5F)O$Uz3v@Weg%RJrV@NROKPe_?k&Q3~%TKc@n_5C+p?2pW7q+o1{1@xkf- z_;h-k1Ugq6U?laSf7zUOn9`jX-fA{(E6DYp{~$t zTj!Z#k*l2`9`?Y3SIj))j#?DDBdZ~Mi^-H?Ds>Uz<;0`;B^muTJsRj{HwaK*SCK$S zeXNAG_vPLV!^Z>5l&8KbPMUM=?fxoV6r_uAdiQ8qT$k?Y8Ga#4<7Gu_f1prEgaHQ( z*f=BwSX~E0+>iQ1H@tj{@EJJ>mm_Cs$wfz@$F55Q0izGDXpSYsZ`WFK0skcPUY_go?d z{%KD$g)3er{shs_#QhZ)e-1Nq7(TE!7=m$d9I;(|A$I>D7x)_(i41|PaRm2h5^)^d zcE5;gj<_apVB3R(2CQz9a0t);5-uQl3E;cXfGhAk#Pw`EfEQsKL?v5^d&5r;T{mdw z(rx2mt6^<9j?PNfOFg}q@(@I3{d&NbT(dj`8<8dmf>{IQ;`o%!f8f~SFk?fD>>u8q z1}+)-RL>$8nIaqQCxZrut~u|Z;DU*x>K$Jd%6DAYTk07N){DYuk^;sdO~2PvG^15O ztAcd902iZ?E;RJKu-cun?DB43p1LdV_fpg~0{p5Vf0N{oOeiayIQ3tS7W!tWF>4Q_ zFeac$BCtOS-f2}Ze=*LNTgQvBT1SY?R-w}Xx5HCrJd?L}!o-k-z^bpu_!BmuPhc2F z32N=3j)&SPk7YM7EtYk1F>^>SYYx0Fp|ai9e~|#?RW!K!E)Rw0Xy>o{ z{TtQtoev9@&i2t!zvJ~~3Hc-j#U7_BPwI4K3;C&~lcrtbHv@(u1=s=^#!M!ebU zK#nu8ANXM8#3D0At7%{dB9F~YCItks*YoL#?fgk4kb2}?Zx2C%YMf`f3WkG$&mkk zSh>G!Q$e9Pis7>`1#%7Zao7Rg{UQKIMvf2=p0+9^f7@F_Vf9_=TRqxiJr=ZC-!~P^ z>e=Sfyc&G3R5Utw#K3^)0shlm2HqjDMdyM)M>U(~!1aX@ppJlsz$u?Wf-j+(n{CXt zB|fLD;{g*8wnre$mrxse@X_W0*0bU++CQJe~N03B&WgV27dJ#@nO;?Fwb!)|4XQ_`O*x-2yE@qG)++m z1zh`&Yt=FW-v+dBIu3-dp>>;673pi0$XS(c1i{~Xm^kpl)+D_AQR7(*m5W&@b{eEfgOm_0ql4_u}oi^2<~ENnwD)OlA^RpmU(>z ze>;!!36_)YB*!>J@U3Jv&@ZX}a_HBX1LGv(`z}o|UqnR%gB-(&wPzz3fqj%v=pcrST^;`m%qKd>?CYt{-waRkRG zAT2!1_gsddu%#BR%Fga;PM}a<=E8E5K}T{N4be~-x3st78Qah-FYP$ur`9c?f133b z@pgoLI0)wLhj@$Bu|G*Q_nD(`d`$zMu=1~FcEyV2~r9x<6#^7tBl3BuW73L;~v;cL|ihfmX)w zk54+#i8A2c-q1DWhI~XLmjWx0f9N!{7yHOki(!!;IRR|24If?8msF1e@KLSUYbwJQ_t$xgAs71+@lFnd3SQT_7 zzm%3ekZ!B)^+NrX3IP@;_w!r7CHy}(=pTS^j3{S@egzMb5ZdBR(I3hB_) zF4f&;F09y;vP@*&Pp#XxXJDWa(b?qm5!we6daKL(B~OAAH;v zC4u*_2gD@F!8hT-kj}Lwe^WO{&h6GRW%71%T7kQ8NA>kd=Q}E32jVaVW<@i8fO){S zpcd!qByF1gjWbhPPh9F6a~i}PuHE2_3WZY)v@z1#{xWn5_j+ggN=3XkjRKwsm=59s zTgHbM4G5Whz_uzMdS}{U)h$sC67qO3x;C|Olgjwv$~MdeeHz5;f92fwRC7W%a8ZG@ zaB%`dk(a=ZKSxE+x9AuScA!rKzW^nCk0I@^paOr*K0Z(%;0XH|>{ ziH_F1;2qLK(Mwn5f5=3yZ*ITG@i7JC5}h2*d?utg9&%Ie!qtw8OXR>leM=XDaz*=0 zk}4AOdd)m{`HYsWV`-p25ER2^kI|ofI-shYkA~S1f_?IqW}ROh9vglrPF-L$v?}nI zy3^I198C+eS1S#Em4Dx{&F`du0(b{=pB>x}Tnc?@%^RM|f2WY`HOt1uw5>gUN2Pl* z7lmgZ=*RP^q+EI`Zhb4i255c4HhWjVZ3OZH4p0Uo88`58;)~d3O@g9xzWACZXcx6T zd~TWgC2X^w_4e|?V8D9}aM}qF(smXXtACJfuIi2>Bo031Iv`1!vK^F$@sAfX2S43; zQHtpIJ#`Btf85))3E8Yx)-|+uRJMiK?r_-3Y>K~{8K1DtIq6_-a~Un*tTGM|Cd>5j zf6vy8xx3i^!1kOIvw@&TJQDVSSqP;4N3P4DgnmyL(lB+vjd)1fj_CYH`7qLx55-f> zQm|A66l%Y!uU9T)t~v^|7+5nLbufgYDZ+!lh-;2Ue_((vc~fA(f~OG|UzDW(V_a|1 z4?tqg>*a$J;Mo*qQ$G1MTsVpW8ASsXHftE*!7`{z&|kyF%=ftjutnFdM*wTX#xa}p zzkq9YkmnL+1dxq$9zB7>sOwXUyW>B|1ze%Is|k#*NuTy9jJ7=#{)%t-<~7VUelZMi zfn5mfe<+~K7QvQ(kZabR*gUs2%z(q?G7M&8U-AvV1zMtWpaqPP;J7)cPh;*|B*LLd zd8^--NyJAh6(OBoIb-gr$XkKlpZt<)d4nb`>a7L%zaaTT6KY=U03Zp0b3%c0MG*h5 zwkzpVl-Jk$`zg-epRa@rB#XOnzJzXD+(7O#66M6s&qwy zGH6Vu3`6y;0N|dh8FQh6N-7bct$FDyABgGnBJjEcH=rNRh0hkFZo{!pbL)EO^s8Zm z)zbd1x|^NrU3=x#`rQ6}$NHHHX{8T=e*ufkvY=@}XfWpGL#3Dq)_I%^L*coea4AE% zP+{HH6YCi?Q2G2Olt^a7`tPLD5g7}CqAxtP|9na?KHo~M325WYECTEaPK2^GfXs(V2NaZ&ghhcdu{dHve;Ly` zQ4zJ>8CGTmlGsq&ok5Y$wy;d1)QAN@Q7Y@jlUxaR5bVUHt7oS{WwIbys%X|cr z7EKsgm=rCfF9;#`U7pJk208$VmA7aVIfs%eZO^2c%Vq~3ff8k16kXrLJ`$EMB+G}& z)O9aVNec*-Z{Px{Olm6^D*gJff6mb_V$l_i*g%jk$VVQOj*j@$YrxD zCiL_TP*M0wcUdmNzL^u1PNIU!O)a{DU}|_$$5!*9GO1Gdx}L{Cx&)C+-}mVIsh-zO zO1A6oRpiQ_^EvbcqdC05X9j^zuG1zbC7kK8(3A_150ze#ZjxUl7)u`@fA1M4$cIXO zDg;eZ^bIWviS#5jbD~m;5g~PindBT>l3Jdh&#Io$Gh~@&(F2CEqjk+qrd#G4sXnq; zl(Yb*ON8kO0sI^!`;$toNQYL73^2>EEcK~K4l?kW?V&Gz2r!CDg%DSd)-l|C&egM8 z!vM;<#e#BEN@8I%pH(R{f8EseSLz63;aUQ7hD8nv|D)JdyWLRPfzZ<-EgiSZhw7PF zqU+g<%Ez)SN(|0(l7Uz)3YtuLjh2rL;VR+boB5n8rS1)eDSlr30M0yDAU7Xrfwd`v zEv$WEi*USG6DR5UPCZk$E+jMiMJ^sR-V_k2+TE-a`#e-q4eqB61h95q|? zJkF>=JP31=7P>RAVd@3|&<7@y#6u*fRZ;csbjlVj5@n@Xf^kexKB|!_X`y32>IgGs zTyU3K*^IaMQE9h_>YRn5FQrA8DVbs9v)OfWCp5IvV?v0OUUUH@Ik?@LN>^wqZv+=T zCYdr~eBaDT+_GmGf1dJ)i;Be)mcbFBxvWYjD;Uf6Uqq67(C~dB^0*It=7uR(PFFA$v9FYsXBw{ZNAjUEb@Lx>vm1H{lqXyRczHH`cQmS3=Q<@KzZVsX(hSI{!vLv^3jLCSViig|H z0rc9*#@bK)e?zq*wzv?LA9BFj2`?Y|{k1#s8nxEsbIRanDy^+_Xo=~l9Hxen76KXh zP$}yc>hjYfA=szdJhMEI6BW@pD_EyZdz^X}fie@;d>@sbulQlzdde|%5tM>KKNl+9 zmch~^vDCIu<{)Q`S()1LcTy>#q%3!32TJ0brm}AZe?)muDGiLD3KACy6P}dHnueL; zrT0;N3`l^=wlH*F2T}i^Or+<1RHmYOs;%O)$rSTVKN~%G7nQzF)%E0RJ-Vt=85Y5exzP1+ky(+xIkJi#!_=!P^+KPTd=7$F8f4= zz1nQif4E)QHIcXFy&7(f4qt?u5ys!k+23)zWjU#zM4yaJ3qTzcE=nvc$~;eZ?0QY^ zOt9VSlA{^NVr6z0qYX7WR^>L>ZE=aVZ|BDTygBR&(fMHfc`L^ekmED{W;`s17g^hNnym*UK23{bP^X)4>#=eYkBydF;SK{t zfBw1&O0Dp4ZKl@!e!dPq=NA2&E8FVe9e6+5KIrZ&YPUV(Ilz+A^sr?S&wMl6D;~EK zc9IL|(3Om^?6O+{25Gz=tvj%ANW1gSaeZ+M*eicd_y39a>JQ;nEK1HO?aby6XER7E zJ>7AzcBqpe8L$VVx0>+d)437+{`t_GfAPqh@vNta*&VKzq1kc89IWP-)5tnIoA^Fi zUOMITK|0B(QK|QoDbx77N( zoz0{+j%@@%>knKX?Lu{9CacIi6Zuqk@!}{KE`66~=*)Li#29-fS{N6BM3$fgxXgXi-iYH}HlI&R zd4ed?eR8Eok!5(^er9{majGnCpc4_ z^FA^?j0~ymp&JEo`OG@8JeTsE$aLTdJeySjz%T|Dl18UuGke{PFGxOHH> zKZAPPt|!KL4%SsmbhhAJr`yKpv(5Mwna)|ndN*=z2t(}-ib#%RmaYUU`a~Hd%=Zz1 zG%qrp#Gt2b7G17>QNFARDawfqnL6C1i|ci{HuO#8n&j1_7_Gx8i`JFJDmX5imHlnu zo>!o80d})ley~nB3ml8ye<};(&l}{UI$VjYqUiy`DU?2=A}=z1pr4VAX9U?Yo=#^@ zWY3X*NXf^dXSmSQU>89HH&0$8+6DP2XTw#n-T2}QNq5E0|)^18U! zj>&W`NU!5`I*oR9Zac6nyW>%d+vm@1sDCA++V3=Ua}Gk4kLxlIXR~;C!L*eVu-q)J zi`6yVugJ7~th7v8fACH93~{!C%O9hMa{=-2_m%IG$RU;YyhgnZC+- z2A5HhdOkD^A%&T_`gkYVv+hp!U{wyhX%HV6%A5mvkpZ1itGh9{E~JwB%yKj3ChsMK z&ndTRWy%Cm`qTB8Z{rWnjpZKC?LWE$nfVW*R2E zjqI6BX{oglf90Mb=wZXOENWtr7n#y#`Ug_xH-N~HfC}X1MW!~0Vd{iRQ+u2y;vUHy z>UWYo^M`d-Wf2HLJm5>^&E)mXbdz)nb(;%rVdw(xT1e*g8lU+@dOsF@SGj9a5eiK5 zB2z{q)#-Xg_2twV7p`SwWaE3utfw=mY!HKRfs_$0e>15n?<9lDcw@THPmy8I)Im*; z`k62p>Nt(m>jPAt7w+Nda=DHs?e=-`po>x3YNqx+DlfYC`t+BZ_Fu_#KKrvIN{M02 zk)S|WUS4ESN6Rc_$|+NaD;dnGnK4qwJLER*>)wQPlVdU$yIWy6xxs0nyYJjeCqL+q z3a|lKfBBc85xO_Of1XTN`xSl#bzg z+F=uKX)Y!VH9q%_{)!CiMy^09Pa+ZVOlkR<88>ew13C`Fl!`IAV2}f02$~<+N3JSS zrX1wN*WwuF^%`~27gWcL6oonhi0h^X80AK$f1C=W{3i7$RKi1hrpL`Nq+cUJ#PWP1F>_z_***-b(q;9D=~+8g5u`rt;d(c8h6gC> zb(7Xx@VKwlcj4!z7r&BG-FNaiaES0rD1WLA+w14;x9ACkPtnC|AK zf6leqjq3Fo%3-3y&$PNEXA}^CSAJPmY_v#wkHDD&Ii9r_^V^SBRVPk(b&4*h36g{PWiVVkkUt04)f^3@+LoQW{%(2r z)5`R$F=7HlkxtZx%wj&oW~LML8_2+4f0-D*al4*aycjsn>K^XG8R5{`Fy#L!mUYD-bM~`w6$(UO*4^W9NW|XixFw8pB%i zo3-M%Jlf4qk~sNv|DlJ_DUq)n3P!P~Y+=jI9OhODKM13zJ?pr1;Z_UAqN3$^px?1q1tY$WCk-HL6A_@+u`WK# z-~XKFpD*k4q;K~SXuj-xQM$$Jf89BB?O|cf_SU?As;#LrBw{-2w^?{q7k1U(H%;j{T$NtW`FqT>GV7vsTTZ>`~%LdGRwmS>wi9)EMGY)g7X_ z`$w;+=SwS0n8ZJiqkoK$52awYN#=P-ux$(;Ij<3GJpefMCq7XL-LL0Uf_+==T5i8mEfeHgXMtpS zrGu&cV?4tp-g(;XA6#$p8C}Pr&baZuPDN@C6_4Gnb8GTo@R_eQ(ds7?c(Za%+PtoT zQ7!kl*BfW^-D_`dyj5c-iAq^|Ma|8r^Bvo4AxBmSXY8@g#YQs=mn}9-Eeo~|K;Tsq z)6k-VJ5Shc(P;FKq~nv9;i7u((cOGzWRTj~3NOWSxLOUJr;)(~QM{A=5V=V&6f_rk zxl1e)VSOImqa9Z-gaeC27~^Q@CXPWR#bjxe?<-zrvXEc>w|(B@8+)T(oXKU^*7W2N zvNLP;*2s|@GsH5NdNrM~6}F~f0U%H)Vc5l+spf`%r@j*?PxQ8{EYrNyQe0w>)I$#; z^?_~qlElP^>v!N1#=IANdC!10m~tvl3qeWXfGLA}qP*{9-kUOu_P*K=vDURt>PQ5B#W&-j+G&Sa&hH`*?VShrlOIM»X@W z5o01z{9XcHqth_KE~eIp2_5+?V5{2MNY9KbA=DG=dP+)Dc%Vi!5QMp$J2AkRiilxm z%Ia(SJPLUwAr_(T@M14+Jb_fn%ZI{DyH>r;CB9mxYkEdk%OJ{$^&-xzvJcR~#jLUH z>Ks+b9Ihpmx63r-gA@7{QN&C1yTZsCDsm4KAtG82z+QCHg6e&rVRnuU4-vCdowVjy8y7TQD zmNCD?5M{=+(#0_aAFLPA)8$V4h>nylT5DDO%FN^QZ{POzgzfhV$)qe>IW$>-50qGW zxYZJ%S>Pu}P^l}wops4G^V0LdkPkMUD-ESt$<8|xNl7za&V#x0QH?{O{n-Ydy0NPr z^?TTf6?b*(X2Z2!Joe8C8w@>Yx+yfdx^jA|P}CLRlfDr41?Vg;)seBM8_b9&^uR;DITO$vojv8?3SH^Q;S~bAv^OAT@eH}kKJ>oG4 zOfwJlHuYRu?7nF+FCO}wo-vBv*#-0Z*_K(^!B7d!bXCp56@LRsZ}fN2)4UceQ}PBekuGc~qxwCG1{6Nk>YE3SkT8Stx>TsDxG}VK2`W zyASt{@9&wzdsg5sVx3kmx5PmsJc60PYyS9`)Ftq5x2Mx8rSj1|i(0m6BnI?erWsgH z?b;PtKG6@L&_gTo^V**w5{SMY_YrOUoYM=~4z{8XIw3r(M`VtLP$mnG zX(dTY&~c!c;yJ*ZS=EHSob19tozd zIx3a=O=)j+do?n-B}{UZl3%m=(lV&3sFj*@y+o98s-z{K}Z z$6(~)V@<+Mzo==FO4G6}^!8}q(E=X-iF{9F=tv%t4%N*_x8a?a(JxT`@apFL8|3Rv zcWel{oc0hA;xx?WMOS#ssEszK`n&`gFGHo71<~RFchmDjckSLdPy9jXek-Xb@`{ZA zxt1?b+3Bz}I9{{6+rkcplWI+eqq6N1RzCOX_k7%}@)(XAw0?2qK}ps6B%~0K^{7&N zT6x+&-oJ>bvK^YI&SKvS*?pnn4gQwG<9DPhy2NR59pdegNY&es@#~+@%>2u+_nC6o z@fgbYCqrdH_hZ?Xn_){nN5S@~)vPJUtQO#1nt;B6L0A6()^aD~#_m%3J^+UM(bD*) z(8AaNrYKq?wh1@!>-f^{V8?Mo!yv?J2GzXYa&g5B5ZOcvtu5BvrR@v0fwO-$6gaoe zv@%OHfI&LnLdo>2Y;8fK(*Zxl_#R@2mZ%`^P+&$Yajcs!xfz&BtO2d^0cma_&>2YX zvN=U#3Pu{_+DX}s!xm04R4e8&jVxWHo4EG8uoj?p#(qK+^Hc|P`@PjBPiw?wc^WgQ z#Jv2S1nRI@#LVQE z^gq`v-_~?(OVrmwj$U_#@m_CG*j@om8ruu6y>lZY%We!5B6&|tcFop+y!<085we7J zL=|bv&0@O?7x&k5@O0?ajDav=`z18dUNfooBkfNIP%I0hos0v6<$ePX845OQKa>(= zJV>^LNbfR=Pk^ zrg7oEMhC_9x1%7W)sG1z-Y@Dt95-fF8uCl0_)Y?FdM^iAm8>>DPovs7vSn;u_O!+$Jwxz7JG0{JNnmkb?Ls;S)wkke{&%Q6bUOz)KWwTU`oHXiGK*#sKQmT}3!+Y~{ z)gc^ht$}LSLXrP@xwXZ4fv^EQ@N`Ef;9?B97=F`9Xm4TV+q;=-!=Z0=D&PFGPQk`m zXLI5;0auVeRp3~xMZSc~Pu=(mnbFR0Z_#Cie^Ev*)G~x9C<{jKP3TWqn**7e!OO%@ z&MqQLWHOVV>BLeghTd6YhpO9(J2vgR#JgO(`e9?=&0%HL^6qNeH)#YoWl{g>&N#xw6a538qZ+|?2l)kUbX=2U5QNtKSB)l1C=B%e?R`fIl2R4=J?KwzY_ zYX)SYbUTL{Pu#S(DlEFDPN3hLdmABq(?|1Ymm?3yJ)g}DpUnxM&2yj4eV)ylkb^fo zBwuVvHg6q+lf$VJMy5t!&(unu%5Jxz&-hZ_=orH3-8Xfr%M~Y3XTO(MnUY=WwoYU+ z-qn7~qQR81rq_?tZo<#jfp}UM{h#pBoUD&C4K_A98PD1D6bsLBH18nT;4bv`bkxl~ zk-66!=Xy(2Pc|=PkA;(S^4q{RHJ3w^>(oJpxHky5OQ$dX5nyG&&$(Hzhff`s{Y9#( zBkO8H1n}l8}00W_#K-}D|a;?n}O+z5*09I?d0k>{q^h%A}5bp$jx`OU(nw}jiy@j z+ddbRo@m#k6Ueok02OcHMR@Ie$$Nmv_ufK|+H?K(tk#L6&F*2p&^!3%e@FMM@~%Qh zUXocCVthWr)X=SM$_Fw%scm#$}q+;#jqrYO5R{Hesb^^9?;-0p`dKaBO=pGa=X4w5(un z>lw9{su9P5(rR-GRf;=~X6z3tI$C@DWk9IwlW#BCa&7BRmrSU1Un{K@Zcs%OIeu_Z z1TvDX41I2tC0}7vG@IG-)oA#gUPJHGwu7wEI9(JZZq<3vx8=TC1Nj1Dy0fS`N==JM zS5*9a)tu#I9Vk@*V@e}lq*^|8lA!sq*<9aL^X?*G1doQ6E4Z18@8=Is4jj(}U*%lJ z9U<>5+}74YThQ=KbM)=$aOuFw(p=WkZeAwt$)H(1O=YLVT%#z?j#x3_LY}i#%v6ET zK7->7XVUbVr}@*ZtD{4UhI_F9BLj^68-(e#LVV-(HBbYklboxK)@qlW=~T}{7h-T& zkdzDuDzjf5<7dvH1hmZFs@_XW@siNPbp%GUG5Yb#&MO29YYh6pOWm0_-8j*;{n+C% zyX5nIbu7nh@2Y2Jp!*2sfQNnhNXPhf=i3%PPpUPQr8;8fCeFL;(XhTjuJ8haH~Jd zK=;YI-yWArfW=H-ZgF*%zh}3jb%)}JSI2eRbOM;t=q4mPZjNtzn7%i%Q0r&&8<#0( zl4R}Z_s;3?+m@6C!2+#pk4xr5h0gwI_^z9MdPw@llixt)lQ;|FquUIRx{iQQV$MD5 z+1`yx`U&dUk6`I`9=PcrvwFW`Ds$(+u4(k#(n)Fq}tDLRXhlyqRQ{_; zf#j^54>gUY(ERY-q86MiOTQeirOY4sdeSjIKnb1| zfR9ITT3X`5%Izq1@xI*%cM@KY%GITHyO{y)+$-=#rX&`#Qdb&zzu4e_B6QML2S<78 z-U=2^x7-fs8a*}RW1YoL!A)<>z05UF^JYqFAHdH~0QyMiE}!gmL}P3W0?hRO?36FU zn{hx!a9PN3cEzUZ?S1UBj;68Zbq^J{LaV3zy<1TC4F9nmoj!f8s=3y_b*3|eC)g0^ zPDJYC($-YurNbtDv9*TV%V#Sgv_+=#1?rY&#~bFVsu`$RAE!tssXqNs^!d!b^}}6v zO=^f9llFLTd*jmE^TaaiUF1dg`Wq)4(_+!WXF0tkDP03tWGCA&4Ha*1{*Y;3gM#U& zi2=C)X^A&N?hDs?EBt3~yS>$(aEEc=qxmxx`zo@i0?eEVCJsA|8Q^^7=XH&Y%jPU2 z4c)iG-Ua;C1t%Dt&+U=0>{{)V?N%$?9wi-Zx^F`TIs&+`hcV*?kHvl}FjOv9w+ait ztj=jn^a)V)C~{+>YREp)HdVlSvg!70wtdcanP3w(&p8+ z4b~+7D*i?K#xPcEiK`Nb3B~aP0o<)zmLupbf|3hPt~anfeFYtOvW}zxmx?H?z^Go# zjj|lzFn2b&zvYc(T;a2J7>~4ivDZeZ3PG`M75y6R$xG*QABvOFZrr+T79f!;(t3AE zOHlI*sz98z1@ZA)KEk&dc&pMSAiuoF_Y01t;bDachx8 zEqB{D7HKx_C)G^?>^IaE+r2c541<2VNvBnqh=d&O%W{iZTS{cbTu1aLKpMGUqM*;j^_HFGYHIxWxl-|5MB|%+9Br$zqJURAkNdQOh$R$UwyOR00 zke;9EA55uxru-!AUAzxsQ1K>q%|5|YW815r)@OCumvpKK}5}MBcvl&DwSHFxQmD9Re4AuWaR0Qyy7ypR-ZX5m9m%G|Acq%{Im2- zxfeV(U}Sj9ZGr#j%Oz#JxKNiY_$r_%0|5yS1_lNTHelnY{uncEN(})927m!Mu@Yf^ zU||L+6=7n4y4nG-Ai)*@Dx}&4g=wQ&3xEXz;!g)qL_2`^KT-JafQ@#5{X0OZ`#%7o z-2k+AKxQ|f0p@Q6_2K^j@PW$E-vN2U08GTcfY!PH02G4C{uu#g9xw}u^bgWiM@ApR z;lRKyutD*N@1((30L;LDP|eiTQQ2-n^NRrn&#Be!Dh?R^-sG+7hd}?v#nsz`F-%_% zr4nUKClt)!Wya;7w$+(^n(_q>4xyG8Ma%j|&iCQRq<$AR-qGdc&~Bz#El;;{IXy`F zTNJ_kt$aEyT->2-fv_5>N&QHW5kN9lCaWjbAbc^qM^%~b7Rb+Kh>8~EM}z+wLr>^7 z2LC#g)KFFdc^-$UGo;IW5f?GVQY`pIX)mEvwW_|(gM83MDsIpqD>N%FC8{?BtpngI zJit&K1@xFp3C)}IZkOjQPPeSZ-;Jrl&6FD`{5?JGtC-sGMXkAr*1T`M{*%U(So;Y#3toq!LmmSCRY!Qt59bA`*ZuPn6 z2<3E~FK3o~!6%mHw4bj&7j6R;F-%Oc;}(h2G_6gh+mTm^!?w;&NCrfU7Y_!A)=iutpsf_l+=Y#f3nZE%#6%3jX^wVCfMv846T`TnL-nFUCW0H6J^R8 z+wp8EmdMm;NB4_CoL*v$QIg2p0Su&1%cGVqKjVN}pYdymx&?)AA5T=MIoWd;{pAYo zYNA5AH)yawugNg#S*wGzmxp?`BJiRrgsi`t+C39|qBmBN*Fx3&6I)|o10QW<7%Aa>) zO#t3Ns4~V&N69Rd5bQ(R=715>IH9^>ra#Af6^qxdnayF|xHz$2<(Gk6#yLOkHYM!6 z2)jQ&R5Rt)zR6zwB-(XR>a>42VG#CAQNsK{qw|!g05TXDuFfO&#XZa;1BCRUQu-cJ zWiv7s)YYWWP9Ke+)}eLPLqSTzIhkWk-leAlcM6j7n+~Q7J30EOmw+0+v8@mfU38Q9 zLnt#uyr1Glg1<2C?m}GuOq4FXBXPtePg*EHg)u zZ)s3s4kLD1J5$P$>!zWFa4%+3^JR@YlCUc=4t&Ui>dBXSkw6*zk}@?$ zqfAwgHT<3_VUhZ35G@uTs^cPLEE(yXKC*M%Y}-|E)FH>LL|U_2U4bzRIz|cr?G4=u zKuY^9Oo5V&Ha?ztJ>_xVzu^d?7d8n||5gTeiuuI(wLl}#_T{2z=3so_g4FC$#KkkR z$M?9IGgIyQ5j57fy&@Le8I@_zLdiyBHulW#3i2^gvXjF*Tt zI3j$-dASR8+Hb>uOS&4x(tEa$713wX z{8K-MvVP^qWlapNqsAti9xP0aH06>;}Ju4 zFCQqvZq62{N31GWl9*%klp*jTMik?EaNaNqdw@aKIlt}GjU za8Li~5ChQ<18`tKb%Ja%)yd}eOxYML#~vk@$6h;ho%wRSxnCY1Dis-sdWw+Bymt0+ zZ5Txtp=fbn8hmeH7ScZ8Mup&dkTz<9TWN_&9j4}UEo;=zAd!qabMnC}4H13>3HfbjS~0NSZ#c<%t0 zV?g6OfZ^;Npl}BGXPf;Qpd9M2pOoOSvhRli12aPd8U1mg|FE|tnPmVFeOejnUsHLa zq2#d4j^fwg*Dt3DPE)`8!)pxFO?* zuNJ~bk!WJH;cX8hfi;5uSAQ5V5w(i?ApoEN0VzBo1#Z|4K5&FFi9KFI9gB2x>KubM z)fo{W2SXuqJ{je@=}{4_hz8Ub3q^_ZU;p^92`5yh1_h-Ps0yI%MHRvR7MTHIK+#r5 zOy0sYqRX7>s0rWd=!csW#=ORXZ7ojkzZrz4bJak?d_+C%U}X2uvTnc#LUnN^%dhp* z$4h(d_vB3L%Og~FS6Lg*z=KEwmIV#;|C;NPCQquunfkeimIR$*6$3O;N8QW^s1KDP zh>x8lSjjUNGpk2xncZD4P4ucYA}W5O>?Z1Cj`8(m4I6X<304eFXEUwKZF)Ppv3-*r z%)@4^H1y=+!c!Ooq1$Hm8eS6m5h(m>=~802?$yXIz$BIvlD?c72Do%c7*$wH7wm+8 zi-ZJG)<&4&v$&1d_W?15hTTX$o)ifM&~)$QqNHfe-{|>nl!mDWY=1|1IAn_;IN)siDb!D1txO`r6-xrYWVr(I)R_|*NGnV_r0#9DVfE- zZBmLbs=7y4sG1eZ?hLv0fUr1GG&wC7B&JbbZ@Fi@OO-PmDL=RIL*dDJDH)Rq?!-hp zlAnjBu|`fJK<{Q1t7U>Wk1*?gRw$dY5xC|y59wwX0l37Y0zM4h1hvF+BD(xCRfBFo z@C)4AK4Ne72?H+a%(30FAvXqOKaY>2X1?_Q%7t|L9Ylb!Bpp@>0P@_Nkd zQE0P=cA%~G%Tt$Zt927FqJE}n;ybnTdBJrem&IjRNkmUE;u8_pE!lkvMaWvIPwJC&6N(_9 zo>hl8%cc7@!cu)NTnBUSBwycEV|_6=+aK1Ao(!DXA|noxW8N_f~ddk9#sxi?hT zsPXB|Ai0|6liW|l$^kj8XW8-t3|q{|PENU^-x8hGYCb#%&twRygq;KoY@uS(w?5z$ z^2iE6!{!`^PP}`4L8iuY(%@xuNzBi)H^E%sPLIAQVIT=3NitV}%f&Z7t{l>=Do~0m!y? zZ9%7a#4aMlrN$v7k#5x^Dl-sF$w9*TLNm2`fNh4fc}>P>X^b11dMQCb7*f$v=|sNK zEFlg@InHC%7y=cgePTBPWxIYRa%^lYFoU@`jfNw%@$>HDXF-q8qnheT>1IFo(~ubO zY2BLGJA+vs!`Pyj*=tt9mZMwqmc?@^!?T92zAir_|CbPf^q=0P;qREA@&x#&xKus? z5+VNTgAv}0ZSbFZ10*ZxQ#JJe=!5SY;Ge~dq&Gk;++U@lgv0t1G5ue~3s*R- zqj#~PQM&$0^(R<69Z0D7)BglpPA?;T7p*pAtWR)%6SvdvnN0r?CO8z(#mIjorpCc~ zmq?Hx4i+}>*Iv0>#Dbl=tC-MelB_5tTSA1%$Jet~GOP9(`E=va&;`I*me1*Cyoa>> z2jL;f6rKL7WRfdPvSN%7=kA$=k94&O(u3gI?K?E+X$(>nDYB>#1-%Ic=bIYPI}9pm zGD01Z+3~Q5!krkmK=H8hvY|Bl@VF4wG;rv7@@*&}*)fS(K8dd2y_=RJt+F`#N|`Nw zEE?GWPb>-6P=cZ(^`^!gJNb;}$bBPA0k2HLm^r$N3`YvB0=z|0A}DdvlN&GlgW1ug zIEJiE?!r2zM%=Nnj3r!=UhY3X+3;$n=9LFWEeYsViT5#!sqw zm3ud_kZF&d*x_quLF^(Zrv;H>W{8|&C8>tGnlbDn#i1X0KV(uaqYC5FhUn5*6GnXs zAWcQ33+8mUW2}jrM85@8Hh&-B=N_U%l20H8g2kVqgd+4ho7n||6-k;&Vq6Osi`*M1 z*GfAcT_Er?%jQMh(izk;e`VtOp~_%P9S%8TOsQAgw`8^)WIdJy*J-$Whx${M0tFQ0 zA#m_*lw9pODTSBj>=KgSZ3{8s$)Pug2vUneIe}IjvDL^+P0mRKsUBdrBwGY?OoB&ng>MnmfJkTk_sLlD^`P@ig-=8i`nxL~q#~E`L z4C3;55R0iRz#>ecgNrHv3p)=6M+1I@sxCfojnUEnLX#lK4m>0^soIPAsfqoV0fV(R z+&c{1>&>W|jsEiB)_)jzJUcKpcDcV2m}s@lW6V=Y!!6rq+sfF~WFjL`m>>F`)?#4l zEvjzmK|n~~;o(zlfnG9SWRZIZNPcPw>x6p4pP$ZBSeCZ`{!E zSNBameC@utPWP1Sk!+M|yt!tjc^+TZmRK&l`}|CmonUVd^XDX3zJUc_=#g37889(x zT1QLOrhrUD{#g$&ZYS?K3*Qo=dj0@={)q_cjv-K9y~Bg{%hy<1wv@6~cjg^TRb0qt zS^^R-NGUXy8qNuunkbqOhFSJy(`?*HM+cSue0~?C!XJ9{JJ(oS3A0 zwbupiZhw*6z}14L=`o}AZxD|N#X@CaRx$9ti#xYNv*j`8L*K~S!ZuvXRegfY^{f;p zSeR>Roi+IGu~TwHoxxj=oa~MQQAMINr7tdP{YXO{qjLK|FC-DAx zhfX?IzZoCl2lJ5PY_g7+#t_(;5rt5p0ULY<6&r%P-iuRisbov$Q!Z$sEvZ%a#FG^v z!B&Dt+h(MS+pHDZYragr;bYJVag96z_At5whcWeF(;tY;j1zX3n)EIYH#&nMi>Y-D6+vG>`nw+N5BrB>&+ zDzaqb=W@!^-QSks_Y~Phe3|yVVY<(Lzu8we>%dILI{!Obn^|H=aPkMcjr zi0-|sY*rZ#Kur}24E%p%;-b|5hWLXa`>zmxR}et3^#2Y)2%5+$LwTp5OOKWCPT_*} z9f1BBi~7Ay;4@a*`>d?n58`iZa84|&|0{p@HRHc9c>fp1K!EdK7@Gf$c_+Hg@y_E< zE{=B|yqs7aP=8hXh40^OG$2WStbZ;!=<{QlLH`9fX>$B40X}Fgw+t6__Pq=W|3ClM z`+^GJHaEo)I2f231ZXl*?6184N%+q`cDeuZ1G!>YH{gFGr%C)f^zPs*r6zUNbDQ_@G$N-bVQJfA(qBml`}B0ltAqNogRuX=!j z6|hLS>ZQ%B%*5SNr9_ZQUZj8ATY0ox7k*YhNbrj?Q0#*@YQ=Q-Ge_sqo7O%qnu)Qd zGZN9#E)q^?lL4(OVBr8+rO`MQH*K6sBzwGuo*P{&S|k%r-0={QIp!!8BE%;t=kvN9 zc?oX87Kxe}5Udz*9;(%$yMK9*(}GF&<1-^vQ`kxFh#QYvLASAu6tkQq%px>mir1vd zYFW&*xg%fJhlUm@V8(q?QeMcOvc#P#eRchOQWM{pw^+&1$m$JT&X#@LUbN)QPlrRa zAJE8K+&7P^G$<1Aljw{c(9la50z413jyOVoE#^#Qxw1-^egNwc=7_VUP^nj>5vIG+ z-brw7k1r4vRh6n$Poc90XEtFC)~2J%zq zx0wQmm5D_HDX$Hb&oL;e{|G_v45>115=SDG^+N_kdEp(YH#G>Z#~vc zAElp&Zq67%iUe>=_3lS?&=+BKc3m4l9p}EL;dFVjYiR=hn6J^2sI+eN$v@-n##sg} z3T@{QX0%H%L>rO7pc&Y-dk3nD85K+?e;(Nf z@6-MrD*e=6{29;H6TuWQ&Nk@}%xnf{VPG(r-y%cxxgaHe6rwR~hkxp9UM$B^-edD#fm1 zZnO8*Gmt^0Q^NFN z0BpUfC;xMP&Y@V}iCv(f9Z0{!)9JMR<$Hv%R=6W;3VToS+i8ZX(>*GQa})4o%prp1 z&DFVa#f56uGDmt`)Lx-9^|AZVK+%prmZ@SuI1!bxB6Hi9m1y7jyYnfCgF8K-$i){p zKeV>BkrS6&MkgNNzsJ#?3#aZ~{u-|&GC`P*g!9&YGI_l5o!U5tXhyi;*-3P(*Jo8h zh57;t;}-BNFuX%a^B{jHSo{6AXh4#uZT$wdS=Y~o;~L?wlhaF}nIKkTdtNf6k?83~-jV1T;a@`eKCJ7nGI|gFkz-~Ukdi6k z`>gFp8Rh#}&7_7k^)AJm1@B{Zw+R-;|D{8UTK|IqJ^m;|dJpnV3kwqduOf7_G5yt= zKS8MfAA*^)Herpu_+yocGLC0a#@p-iyNa4Nrb(U|?txpiPqZxwn5X7U6q6 z7~jTadFZ6}hVFKzfI=_Txgs-Noxo!tJ~PrgJhM8Z^}utAPOQRI9RoB-!O%+hcK2Zc z29#t;7w)iRb;jQ}!w*LP6{P zsP{*q$UP1p+9@UeOG7i-lB+4Mf=q^2}VVS zX@|kZNf&vgxV9Tn$7NDXzxpK?N_`W{C{MghJGZ0;@3~J8Au*SvKrj+U>fAdO1f+zyK{9;nj?U5M#I{nj*$hIs)DK(W}bZ1I&^Br{>!~ zb{+8hxbbGn!oco?4)3O4A%l)Xw<9CBYe$CGsK5v@Djx3V8Hf-LrYFA6d9s4- zf*+#3tNcC0b8 zY`6eqRVb`z^9dFN(~p#NBGR`<4T5Yfz4Eo3SUDB4Csu)|hRa!GAq_yXZ&P5Eu|GFj zDg_K*Xl3lXKM^Z5l*$r|)%C^iV~)vQe{M>?s?#Rdnz%z;LLh0#rOzSo|7e8Yl&NLX z8r~%ont*7p56wJk*gw2M3s0Dw+q4{`<8qIvX}Pk)faZGEU4JOv1!$TBtOlQc%w%c$ zTz613=kO9rKiH{LTltea&&9$NKl&VKCu(eD_zs?TD^@@;BvfQPE|z zEfHfGACjmHPDXGjU`S+cNP`@<;ykL#8ZGDcQGwI>ZKfQb;gaesy(=daWfLt6^mk#w zj1RXzZEi7m>21nE@Q-2bns?!l{fr4JRA%Ufcc}-YeR`_?T?KF|R*WE(lRz1W2EU#$Hvu8Lw@4`a&GeiX3rky*Th|^UlMZ6BMx|3 z+#N`_Q|i>eP*nHO&64d5H=F&#-f(=zzHvnsjD6uF$gvXf$^xM^P`sMNNJ~MtwC7Ue zw2LqrqsRcp`xsQ>9VY0`oPVuFdX_A~!Qx6etnVwV0=Wvf_>Iz?7e+s*l5Ov5W60QP z$74CVh@wr@v^EWqd3VU(uM(q~5pj((V^S26Fm@+lvnUv97m{vbIoY}TK1(<)I8{abz4p3LGt z+?{rfXXP5i2(L*yP83L{IhcmqXz4-U&2mH(0}D7>W?5IqC6d4qA#pa+Rr5Ea3TyhQ ztgliy63Tm?rBSahQulkPowy7+Jke--J_;N51p@hoBznHoKf``r7n~N6bHu~dadiBR zA}PY$+D}$$nUpK9t?knidW_Ais9IkEF8-&4DKw#*z1~hpu1$u=wbW5vZ$xnBi8J8n zhi8Xp&K(X@v_{5FihNE*{~Xw7LRUo#po7*S2}*Q<0+R6S!fJAii`F+4+z2}o7I>#6 zE&`{&e7!}6>k~K>kd1^|w zCyo`&Oj%i;q4^-2J0I6N=r6t@4J7xP?bPZ{aLa? zcf|U-`}L%ZG7IOt>2-8*p+vS&o|gV=-yjeUB9YUQAZ=qtSLFQTMjBWq@nt+*QrgE~ zK_gU2l&=gBwbn~*)}bY?g*;8cp4t&@{x}dc~oRE=%9kQej^ zj+T+B128LDg%0UOZ}E_%92fjup7ng!;ADK&pbFY!NG+p-xH=GH^jA-)vc6~Xay&=)v-_DD9@2{#>a7wurBxT#sn zMAZ-8keS8&4GL8`2)giX;`-O^Pz0PZPze)N1LRau+cCj6MQ3e2gsqcs9LJ=KWa(aq zvwkW@0B(-}ZB18FibJGX!(3-0v*i=7P6vAqM%*uU)_b`mg}I@CN9jA6YrP?0EUmRp z4?W0gb&+djW4OlBFd2)kF6m81o72D2IVmVnHo)sn6`NM7il5g!RKz^)1@I{VLb(&a z-Yg$a12!QROyC*lUM_ff$;1|n8SZi=ewu-}o4N>VK|ZljhvE(Wrq&e4ENL4mu?*W_ zbw+wHkpy@)@qWdt_t|@AfWjH0Ytm|M|81A3Rn2r?}f$};-__^3>#*J{So_zP^z0BcR6+2AG}C3y-+6oaT=%ef<)VVvRXpVuRxaGjZe?Ae%5xRi>4iZ*6H!n&}TlY0hG znyr7-9)raq#cMr`5xoi|SIV5T!4Slu?@ZrebF58wlI8bng376=EV2sXh0HY$=rTDm+9$Y$bt70tTv0r>rax z4jsvBxDY7Fy02bIGY~gzjV@57d*H;hWhTs^6X4B{a-{R+6Y*k_>*@-Neg;~jS{h7} z2#AAI?%xSI<4wEqeP#FnbecTGPhqsT-2I7*cEdv<89vJ`*Pw;S>_=a1Ey0(dk^hri zZ=VNUtz6<)p3kaCq~`+Lf#npg{hZUWdCh=k=moAHPALNKoKZkAHZiawqCAWR2+7^0jUr5g)4ADC zF!x3&toBNb!KQv#L%0B6V2u*l=tU2~o(eHDP~{(pXH=H>xn5F^D-gO#`+^gkKyHjr zj&C-7eiUD`<)a_kyi|V8vixFv2^qvgQJ6wmHMLE}pLp$R4wxax%RFBgUKC5L0j)FCua zNaubGuC#>@bhSNbJ1EVo;?&fZv_#;xup$@M1O9YhIJ{ak1+;SiyyPxaVBAbIS=m>U zc!Gcw)l+Wz@UkLYG5hZGY9l4%ro*#xF>5seHS`x}3+&RH#;PK;FsH$e-meJ3+Dy z5PoUre&%E@?eyk)47=mvG>860!(aHYR;ckg-c$d%4+#S#aomsCL=gbJE}&H*SZQ@e z?Mhl4uw|zPUFL77SMqfig*MFH^aWeuG3^1d0Rr}I5gUjm(1Rjahah06^}GJ27b=2l zjiJ#!tV5`;TYr0DkD}!gv5h%_?`Q)`5a2Q;YL#S-fQ3=axm-S&u1qLZ?^$~SQv7b7*V!d>Ed;X)nCbPdB1(LXB0Az4=tgv?=-`<;*$o z!qwDKs}iUs*e15^ykCME-2t?8?#9SZ_b@E^*3uX%nnB)wgia?*5_pCG^)7T_9w=+H zX@OM<_0^}IgH87bwWuB40!-&24Ixq&AWGV;sG zsXPZb2n{tOt5dz)hn16`{^IES!76vM1c`N72q(}|*h0jNKtQL3fy5xSz>w76&zGc} z(Qrez50me{a&g)_aOTjA#IWyda_qW6%>f*)Rdsb}CP4f&U#j8y*lpZE%vj8zQi?2) z4^i+jI{-sG_2q>!Y1%qww;=^BzsuUbJClz1UdVln1I^p<4)2EjWia`Xx?e_u~_m=Pn;3hVy{4c z4b?{%WG9N{gxc4p=%)8CRAwSAw=d2{p#%+1AnNaNMk*AQD>1yKK86f_4E}Dnl6MIN z7z=+n&LG8!mp@Z{@aLBEEI3iaX82?U-MZ>wkWT%UW9V6O&tH3#OJ&xClF4}qOHvI+ zU8vs!bx3*Pf7;}yv7hP@?5XO!?A!TCLu776d9)8Td$@GSE6j9l#cgJPxisT8lB661 zcEsbx{>vwvbYmgKFPggkOQA)sv^M&{u;eFbp=|9j-kDn8Ct`N&BluG7=KqhbuMDem z>D9*Fb>Z&rR@}9?ySuwB+zS+UcXxM+w0LpX;uP0X_}FFdea?HX?_GbBNiwqX%w+Cl zNDsQf>wqdB1q}inEz;!kr)?X=_pzEcm}Xh&>6Y`wIOmHc^vXPV?l-TEp;(3^5+LIQ z?7V_Zr46}UdnWgqwY*-p1Y!nTxBA0vF|n?A<@n8fX6Ao@@-A2QWURg(A~!vAZcg&c zTbcn;ECB@Hu&lHeSBg&RsKZG7STRc` zx6vxkq;cMG>6Kvx9~~i%`ZP7f44j7JH)vAy1Ip_L&+goB2lcjYG2b{L{(B1fK z!sY;#>19rNjWPJMui$sT2K^4W!oGgNM!?T5uJjm71J7qWQO`eZ5R;#6`(325?#vG! z`IOA1WTlGC8LHM9*51@;=9j&jptE{7+&So7=hbksJAA^d;OXss_#5v(;+3h2Y433} zg^DVQ_sCXe8g?)k;$P`A5fy|d2yeGWHK`;=B!41dEfrN%e*#;{>UwXNMi_o?K*ww% zI3CAhSNNd(U?TjHvnDfll=iVGH#*D6l*rK{31#;fl2^Zb zwtQ^|>v=9X~O+S1}l6xO-UXsBSH=ZdwDIUS-gW6B#{>Y&t+c_qES2AF=% zRkqYUbw;id5{A_&7|%KrvNBBHf0(3219r_0z@;PhmnE;WOhi&*4qMmL+l|x)f6#Tq z3y5Wb{q2OHv=$!igg+!o+WrYka7vJ2%iY(7Er+4N3gH?rZQLSthBRZU?jCfwaq7Z` zy%QfyvXvRBmx;X^#0<_kp>(n(?K(Cjxq>`Bh{~7(O*dm)CdFxVF2yF2E-2{a6Og&7 z5DKzHEHV01-FQbn)d^fz;`H_O9^Ve?_bWNRs)KxtVulC(TBi21zc7wWX?o#FpmTYk z6KuMmEv&_|RzpyUW%koHV~FWz8TK%EIE-DoP-)yG-rwvR7V-zH??~9fY_QKcRJ&JU zY>YR4TY}{eh()(np%^)(hCZ+x0TE$Z&!0B>uGNd>3kRVnoZSGG`)%><+U4vlXf4eeNNKC^eE|wL(h81zee?{O$lj zehm;~-@!`ntA)2gR!&I!q77 z*lG${K6tje1y^r6U*=`>X%U^y@`~btJ9mUxM4XRArJ2odC2+%Nf7FYm+}qy(Bl7w) z*awiQOUte(N)xS&@2G_(TENQe>kNmZ{x$;@P2!_VEBNEq zAG%uncy4lY@1=q=JyqjJg`;m%U{8(}EygrN;2J4OD}n4(bvP^gyTl)3?vF9bM90;-DWTj_a^_$F}~ zD0=oUm^Qb@_!A{u2Bko;=p(c6#bY!p7H#=e#Dig?i#im$@tHzb7{RQZrl(0cR^$mw ztV%h@L9HiHn+hOx6|kR4X7r~QkqB4%bWnx5z}KK0C(iD@{d(eg_lzHOH1p_?PO3?J z+cB%z-#uOec$KyjW7#oXZR$SIj?*1F;T;eir&70AaJfbzlzaWm5b~%V?K-{extEny8-wNOA)P!vN1%le!lQWavhz>xiz%+B=P99_DHieE&# zXIi0US&UjnCnEEcR60y9MdMhK$VaBOI>n9z^(tnI0eERtN#|`OP5TJ*`(yV@vp`0T zSqK$MacTSOVukEA-$YiEww4(-Ws*ti7B=8(rgVsm3j?DT&G#$+&pQT*P{6>O?Sryq zYtDn@aibvXjmqUutm+MzaSXZ;Szn7FUpeu{>VmgtaBFz;a8n0kqRof}(5Y@E7!+Ya$QPjhPGb=_=?F$enp{7{Yt*^J{ zPu)?3{Jbkv15eNr*Ww@ISAosn?~VLqvB)N{)%w|!toPwLYGc&s%J^ez@L8eHjuGNk zt=G2OMW1xznLKc{?Gjcx4rrd}xKSx-sBmY{MnT%cN@;&}!yp45X!G={tbQeR()C$h zS_tKkLIk%(5q>Q-0a>PrsSt4$FHSX+u|RLxK?oI zOZ@xJ#lJCC6GK}K^&KgXqUh1lvM+fys2SZvI@o>j1W)6r=uLs@$&&03F#JHraShK| zzwJX#djj)g8a^NACxa5G5wMSeROJeC-fv}^V!E+Z`88+wrF)UOwqMx%)zT;EZV$7U zCX7Xop|Yp1-78UHACrE{?ktuc3hvk%jqYZnGPz_l^YKHpe;MloOGPGhV7#|lt^6Uf zkRxhC^sC9?1AjA6n}i|lQ1;v9*oP~hPZ0;Qkf~_OUGcNL_k43u?(4{#1UcQjUtS3h zLLWxkHj&G6X|c|4CKJ=XRotOUwkm#5_^RS@1sa-e#yzn#XvO1we5%#6Gs7RN+Y-yZ z$zrtb=#G)q9zQ@YjfrUfG2>X!(TYwTBa<6LNlwFkmC9HTsJt&7Yn>P|qaIc_|7oYn zD};8WvYgq!gXa*$vyVJ&rU-fj|9H>MLa?D10`Si6!#UU&0sAP6H*WOkQfb`D|hrKp3LrH8ul8=nLT8RJ*P2;L8lHL<;m4C ztyssB>)&=l!1B}A-tt}TG8E~elgCOX0K#+o)g8Dl{+hLs->t;?#-_s4uF<_-FZyqc z;RDkG`^%EqOJTuPWXAj>P)UK_p@j+ROb9-Mg-!>bkr;fn4-lU|Dqi=-UV@GG7fug!^uOQzGnBq>%m3m@eXOj4f8U!smttRl z{<(Gbx+sG1hXMgX#!CGsDe4bzX8GTU@7Bh0?1=XZdV#wCC2Y8=3hP~1Y#nw7%AYI# zf6#qz68=BvzIRkyR{y_3h*R^btKi;+oc3d1yx+jTz2^Rod>h4Pd8cuXVt;&xJ4B4V z(~N4W7~W~CW7wJRck*7d@3fhkDw20v-z;{{dpo1WcN$0SKeVz%><+j;Bao!brojA$ zw5Wpm7i^ziTSfCOqG<=4_g%#0k9QI0byb+DI;Yr(D6VEMu8bBA|ARFU-^X5i$K0Dz zrBqHpgMioqQZHMW{-8JhY4^8n0jJoD?{;h7{44lxC|=DC_C5R`+q$yYmqy>@NTL5b zJBIaD)a-wu4YD=uTyS~NUdEr{%qo=mJTGI;<~Ard9>D7_L-~npaT?02J1TTo$b^0f z?~o&=$){3+0`!2Jq4mmi?w@n&A-KM5tF662ircylVfhXwxmPuSnM#e7G+@Ym*f%~( zQ_b_Qr>D?pH?%q0FQSr?RvIP}4$C2y8Q$(g^Ow)W!|{N?5p+37N!4o6uT@cSRIxMH zI^tS6tpTp%#dw#3q{sRy7uTiWT;|H)GP^ez`N9S`3xKAAfdO>D1ea0`zyMQVn=z@( z;D9->&9+o12mlQzaw{_gKobmDN>5_l@863&hIu18vv+vCXQ#c$T(*C(K_WzOmg}`r z7~#6=WCCVdc7^}#wTaf_X5H+BX;a+7^?)R_yQ1H5O}1oSTgpJPVZ3(txvsj^k%(3{ z4<`l^xl^l_<+_gJ1~aV3+|=RNY)wiwHP!LE!@xbv5hy;88hUCzJv$3%C~C7~3C^}o zg~qA6Q9t+btKAf>2piQwaSo1ga_S)%t9j~Om#3+`aFm0 z?G}FqEs3=o{9?F1-@U2<#1$-JOyT;zxa&%PIO49&PfX;DtSj)yXd-{wWG)~JyL7k=L z-Thi3AtZSbl)5uD?%!&%$qz#An!1>rw*_@gL|55J1_ZsjFQXTBbL5^&gwQaT_Q;N= zTnJ$mttMI`RC#%!lF?qgoX*?x5G{+OtAsy<^FOFld0;m!a?XwMx~vc?1Ax61w`uEV z`swy33IBTnS=?@0~_{(=+^AiT}$CaSK0?6P0&)l$p!gpuJ@*VOoS_%pP z`~QP^qDFadS%(fFPOWPA2Q%f10ziIu2eEI2znt$I!{4508yztDj^sg;B9!TW!zT?v zq&i_h{Q39WHC7S4TX2g77<+fU+ub-v5^n&ZBFKLMKcLN3SP1{&Q=oAGito^6ZM=7l zZ#>wkYyH>=@A3-q0D@3|!YorlZCK)Oj!Yo&lKoGV^vLi!j8*tjtWdM#g5gZ%+sQU!eH= z^gar`OHe>;{`*tJAq@EXj`ji-eW%T|Rsr4zN>CJF^{%;6{GB!-4)}Xgeu@LC-)T8g z0Ah^4G@BW@nEl60e3t@jyz~5J9o;`X|IIpeK`iX_sTR(TCjX)TTmeAzzV=X+0mOj+;j}XS4?bySfYZC3 z-Ky{X+*AeponrQ&3SfFiQ~xE$!Q#I(SNB#>2y1@py*l(iy?^61ajtA2!|Dri{#u7jb|G!vML1Byj{-dB< z0gT^udD_0~%CP-srF7Z?l;3p;hY=Gqya})~b2TzGay9xdiqx$?XRUvP00F5)N_BjN z#r$ho|J&rPp`)vVv&(->V1ffc>wN%!y1c75>iK7{Me7RSc{eSGh?<>9>TCA_c_x5@u3N6g+T()YQ4^Z-0U0`HInFC_Kpiu|V_2aLYg*KMR}FNvHy$e5Z1e)^nOc4*!B zDWrt!R9Mm{w47zzp2Zzg(0Q&v-n5_3AR+UsgQDFgAKNr18W>yC#ZURN&npgft(XO+ zRUb@4gMiu->RE`I#{%C6v0jx4ketV;&dg-^Z6dD-**Z8<9NwOk(c)(H7<8Asl9#lS zTGvV=iQAR@2Da{2Q!e2^KXm$e%>)-ceAchkGjoq>A05#A$4`h;dh_srnFyRd4GqMFHkL;tF^zru^u@N(Wi-fgPgY$!s+ zwp5pGlh>YN9~15W6ck9s1-?(u2jD*|Q40vDe#g|pM!nPMq5ywatdflagud@MSAKPQ z|3G-#af+wb6M+AjirXXr$v;R>hgFHI#v3|L2xY}cxgSA00%fXLlqcnO{AHxo(=!Wy?6A`!0wkCs`(;pyuPM;Yfo=~FE@V(`q`vbY5MO;G?zA5 zG@7TLUmp+vz^g~VQp{tJ^w5JCY+ES>YnS5Z*aYd+V%9nM8i)eeg10>3tfP!B=R3oB zHIR6~$27J!<3YOcY=oLH4Lz}|S;w2HMF+{#(*8`Y;IWyD=csP~K?MVY97M^%#ng+l zAVfx>`6e>cREJzZQ$TE6HjOT59Zo*ExR7xtTEVagkQ!0;NbW%i@L1Pmns6Cuh|Yse z8;Dt-t~g6A{;8zTFu-!h64$E6%F<3x|Cd(nIuyw!aZdU4hpmj()xL1mjP|pX;9&~; zX7E%InmUFqxKeiJ-KUQ5g#c{sJTU-#?oX@F1@T9$8E~bD*yx&$oOgYO-o+D~`e@17 zTYZYez=7X}f%4r<8=49i$fjrqoqvYZgHL2!TEuld=elV`%L<1!Um+@#EqEL0|2Pwi;1od-{5 zLB+TuQ;@d7%MPA40NbqAqSKZo1hEw*gQ`ZC40K7>zxIr$*UJL=AV$*vfkz@~)J4_@ z8@NSR4?pNgl(H(4qmqw0lQgwq)FwrFo|}wz4QKwDo7Xj@kEthc%3*o&;_{hiI~EMz zBPv}I$!D_fD8Q+&e7!6f0pNUIu*Dyo%#i?Ew{TH4Rgf2*TKk~+#j5vP&LeSO3OXc< z2=@?#<5RoT7GGDzO>U3rNT25j*jHj^W?-ezN4PvbZ^{09yDW?Lnnn!Fsubs8WtV-EXwcqVav>ZqXvc$E3g&PO0iu*gE7jcYkTB*sKsJ_zJ%9vt6hRb<7_0b<$& zEYio??Joy3Lpam0dm|o)^y#%$ti!(S#=C;dhUhVY1^Ij-Y$=8@KS`r^>GD5GyPa@t zCvWx=%aI0HuAJ1PK;c9bjpf}Lnryq!f58gUyKe8h8bFbdO9}PwAA}Bn=D7tZdWvLZGuj1PAK(V<|(lsdN^09CcOPl4DpqXem@oKxq(UY5mUG*;?2T0W`+ z)?sschghLzp6Z=LkA@kejMxCLKTMHH+8~HlZX|~nsFPwf%XyKl=^Zub)FC$VLg95B z$)`@pzK+*xKlQ1miO?>-G{d`{Rnd#CSzIenL04W}|Ab;YT8r6i9=pe9tEvTI46cmS zJCczrRUQfXiD+z-uu?IN09nZ;TPE6`>eqMJN5YLFIxfM7Wb}atZ8jaKzXCH(-^lZG z+Rc&A;`6c>ie1YzI94TG*)`n5);@&0e_d%KIXI2-3cG^RbG!M|=@GsYe>UGbZXnce zTnStH7EO5hgRTSE+BR7Y_BM}_dMj(sFj(kB$w2-9)+$X=M#6D&%8vmz;HdD3K1NGG z1|u5;KISE(j1}QkFeXc2%Tz-e^MbQPT1>ZCzd$?OMgVwqiV*x=Yuz|wCdi#^ITQKm z%^ihvmjVR4c9E*e)U=3`pQ&zZo0$|XO?rsS2r>15I*;kc)8TQv5+1HE_q3nswMaz6 zlqQDjPGMRJdk zAceby!6fW*Veq+ZA@RxNstySf*Wfs9-R_0f@YOBVY#7Q5q?0ZH!x`Tph0=~uw3tgm zH{!?h0tyzxq>adTKyuAgE8EnKL^C6mq|NWx!j+x%e?PnKt+A*{th6cf)Sz_#+&RkiacnihK*e#5Ssc7I7-@;cb zb@6J@B5TS+X3rP=I1o}3h#26+`$AOy4SG%oB@~61B>l9yPus0aI(pD_a+exVCd~=C z*O}~v3tuB(aG<+*NK^*qZTw&r={Fl(W<;Kh_7~st`V#gwW^*Q z$07e}Tn*uwn#=+JV668?cmp)`HC(F3`+*a2fO_p+&ISdF$c=;d*?s`zQ$ z?_OoS!(Z@8S~k?|gBdBC-%`&53db#4`a=BcPh7g3JK+8KJ;d>|dUQza8}uSZl;Y}Q z%1DPow3*oi=?7wh8KG5;IKD~M*Vj~juz*(DmNNe9T>Ot1OIPgQpFWS^q<`+_?ce2ZqOhJpeLprw0;%2#L14d zHC;miTBpusq)t!2nluHUhu^(4$#a(7ZlvkswSk?;U$n7_Vk{Mj@b^xHElv}v+CXWy zW_DX(ut)h9hG7+%%J!sh2x@yg9pL)5bCw-nFRCMPJC9*w%ADh_ZOrM{~ zU8`SEjURcEG3YnX74osYfo@olJcR#p;VwuFBt_l>CyASF0R0Iv%QNomoMp)a1*sTo zJX;t$@}N=mRVyx`J=vE^{g)hV{%fB^;;(9u#~=AnY@5wtDQ7vOoxxlu#R$hO7n^ z2SR$n8*@YZ)kIB8)rfR#JS&Q3>yObR)e)m`M}t9=IA1BmMfp^VncIAzWWDz6Pc2sy zM{R`vDZ_$*GEjZdxsah$C&`~ofr&8)=YM?sxWLO<@R!O3wFHuS+#jzA&js?SN$o+_*X{Xh zLz~Sg(px<~2KkSmESos)%%ExHii{nWD&@&hjNik)B`-kd>aF(sx*OAtDJBNh)qe=039&^mz%0c;$3WRCMt|QTV0VB@q9mD-=7X9tC)LU)#%B&GpNz zVriqJ0Dd$gA|SZl19wbS5sQg8Knf4^{~WN?Z-0M|KlL8 z&<9{e{?kM^*#%tjEjJHc?2jRT1^%l0t8o6D*oOFQ99D-La*GY>C57Nv)u^fD6V>^9 z0t|R=?X0m|R(JZC;RMuKO(IplCfjZbz5X5_7kG>pTkUHHLzCS*?Q+-W>*VuZw}>J5 z5j{ehy#eR$Hl~$jK`O_lPkw4hV}D(M@C0+q^T|v7Dukgi1X~W|u%9$$JIODW~Fh1Etg$!6nHZC>GVyBQFShib5ghqDVWoUGqiX=ic=pdiPq%3de5B) zC!C{9WkoZ?iZ7jm6M2!OEuJGzw><;{`ZRKeyueH)lrlnx$oOgDn7N)g)6wNJc3-a* z*J9zeK!EfY&?^Z3{m?_K=)j|_IIL*W+_z$fwwx5~L8;taH<*S{eh;jW{0xO4r?#f@ z-M4i4hY*u&ml#Vk^l^h)rKoucAs;)OSU>Rv7Q3Y7*aIv+(02yyt2~F}olHRz9iiURbDvo zcg>sNy)*-|3^)+|L(S~BnO|9>`5)IUa!>`P`+~4hh^E`0Upi!hXO*I^kpAlY0f;z|=;1L+L+KfEq{> zgU+t$grf8Y{`%g`?HT)Zn<*aNE4U55|3j+F;#jwXWk8&aa4O9xJ%|E?hHnqI0z5KH zDu*6fi0jZ+%x0%~v8dNYuUCc_90^Q5K6WTnun@*;9VKzl$9OGs!Vl_M+z_(l`%9vg zki=N>CgZy96auQiz&!}L^|CqL(PJ2a$M$$o9}%1DXfqi^P?-@T}LVr50s zzr)jL??G;s8E3b59COQ%ih_Z^RiwVOCv(q!4JOBZ5N)~N{{4%D^jwNQG9F(esMl{l0VkrEQ_)MV&=iPX=6V+%a=PGhVsY@+x(N_2EyQ}EKRZ}rsF;ESsQpZl&d$2;8*uw3`0}2n;V=bxpze@JswU ztZan#RTlzR4UIvq@zf|WBq7w2Tq1L3RAM9v8pwIi0 z-Gz^%e7<^^*lJG?KvV68c<50AOZS5w6W=e<{V-_kbm5;lG@#7QEli7ISv_35H7A{J z=*Dec`xCmzN0)IYpi$R%fXjbVW@%`x5{ifpI|Vr18Pj8Z=Y6__@FKH7apu-N$X&TH z9R^?3ik{$zmx2Tss3xs8*kM>vYUz|(W{>4O>4TMX)=yBo2yepZtP*iqjmBgu9*ntU zAQ+wp=yH6)k!3Ri6m4@5fyeuKqv}Q}Cgl);R5a3R;mafsA;5iQonE$4)&PqoOH4cZ>pu2sxrTavu1Gpn$P$W3fT_v=)0T`Q1MbmkOv_QHe#jqV`! z{skyD=)(_BV2O_8sQ|^BOUP09w!}f&kUikz*T~KzgA$=sY+*c1}NOif_ zkC7rW1}zkkrDkEOq}~$xhh>v?Gf_A9bC#i@Pi%#ln2&&JYA~PTJ1G-iY|Jnid`k66 z*O4XVE#ptSoDgC28o*AY9}Zh+N{E;;y+hn+d|xL|Uo?EFtt3orM%r@0E9D&w>sf$S zA6DE0;+EwmrFbqp03V*;-Vn5Sd@S&}@M=M}iwL)AuNn?8(7S!$ok$z0ST9@b3Qj~} z4e%P@E(LkY0-)Nvm9LEe%M)@S- z{3}__$pvPAog~qOlWEwuxciB=sPpfa;_`3zE_Uh<+g)wh?rU>&d?uQJ^Q3qtwO@An$Z3iH2_D`GPc>>8~w znZE?b)+S^fqb~$o%ier*7S->#x(kTfw#Gb4(~r!R@E6DL>zLIKZKOCC@*aHwlI}G9 z#(qW>p~v2!9k|Dx7bvuN7`?rBbCH=p>CPXYw=p>`ISV19o1mP}{qW6#Eh67*#xmt$@d;e?E9{b#f_@UkI!2xGCqRMry$?aHVMoDoArmDj8?~i zH(YdkqGP`NpBm%bCZ*sv0$$>WYaI3@oE`hee6_ylmN=?qW)Z%!V~SOgZfkuNejvXQw@P(B!jSXmUVGKR>Oo}i z!6U#glkGJCLg43J1rh2`V7Pi)6ib&+1IzOTn90K>&+v4KU{eGGsH6O&1(K+v6VMNw zZ1M`Cs0%Tnc0YT0QZW@j{hp2(c-q+96UnJ^RtbfA6c4XfFB!NfxS zVvt}Oz4hUCl zsZXf{a08=SG(4F3G-tyKc9PLp^oWW3=#(xqcy$b=Pj@jDmY zxm)LgT2R2A-|D#O)p*It<YS*x%FWcRzPxA>vYCM`VKm*1)l-$FpaPPA6b4tWu zkyr}0oY3OsTOmflEz!Nl=$%LSUsOp0NEjc!KPMJ)wl36N2I(KL7MpNi6l>x&FqK?i zhWdM-*+t;vYK~fh5u{fdmdc--M9wtP?))Wmn^F-?9Zx?FoiEWbCgt} zSVa?usG7hz3n-!Hiq2%Jj+Uw>F*{0=qzK>nxWdzF2>G(1>R#RNtl;P=^sr>^zkmKh zW-r@pl+XwW4voati*wLMmSh;9|8zD(T?`Mw)y2c3%tl27IdbLbL`9fLLoUoJ%5!&h z0KTP>A3y2Pu5b-Hz{lG)-P@fC&QE*quF9`-HfguV7Sebfkj;5HAPRQZspeI=7 zNs1w0Un7UM@?wEC;*jL-JG;CR%Mn#o6)txsSE2N(=EPgX1ZB6`bzMqIp|adfI5MM8 z)&V@6^>p}j&01{O{D`_0;Tg}WfOG(qxtt~;{;~_5Lr&fNs62QEyUNeNkgm88IE}A?R9J-_~k}{`14d7;5Ra#IKzb00B^3uB=o2p2r$Jxt*+OrJy)D^F4BYetj*qoTVJ}gsNp6DwIy^CZ z0@e+rgp$}dP(KkDu;94~3mW<%cWHuke zPBusB9FlD`VLR)Z7@zN)G<9&5wqK{_%WxOp{!P^j$3oj%a`nyyIuympxFvZENDO)w zQ{n-V^8Bg68>iCDCq$rws_-8FsJs5KoFZnB|F`#L>A0~Ll^ZJqD$dmMPV7!@@aEbJ?}cUDaEWc83Ni4ERy%gp9wi!h71thC zd64K31d|Ew%XHN1S&CsJ{Y$a5(XJ^WyXK5<#s&IKY2i{B+EKGZKEv5_JrcfsOXsOp>U6c=& z*1F3qBL!+IE`Ee|`Ea>wDNQLfO25o64QQIHx@kD%@z#jp3=F6FiKf;C1)nMbb4qm< zsrq4-1W?2L!@tI>pI1DvaTY0cH@1^Xe)LCdM8T5~iow#j^B?LG(Y%7cWY3g<;zHmurdt52rfQZ!xpzmywrTuBSmnhONYXWL@4jb5)R(9on5EZ8T z+Ue8UkX;<*AOERB4h6l|@JPo1SRvQ^`$K1DRHWDGf--riFK)Vun~beyIPydTZd);v z;)pjJ@jmjpS)^^A*?yR=a`kiWU>>5?m8HA{FB)x1v#L?iqJdXJnDq!51DwEa<@9Od zp*6z2<{r9M`wVmn%mPcLb^Pz@*oviT3bu;Rkv9}7r89|No{AU~1~#9_ft?kY)WzsS z^(D{GS}k^bb(-q9pK~nyIE_mq?;wA`^76)MJq|3#<2hOxdlvW2EQR`fb&c=kbEd|L zpH3U)|G2xKQ*kx-)Swa;09RxstTVmB5UZW3HJ{t0?1uXJoJVty0EbPE*C-m9^C4w< zg)}I#ET@5qAZ5N_iI{k30SJ8(cy_IMDdHv-nr^}n-o{)~?CM9b?k&5}-awo1#4x2F zeiA^c#08q`1G`!fKZjv`0uONTJ+@Rhc)k<~T0TBNM9r`zr zW$~ZTp^6R{D{J;PrkLQV7jAf)wY#$zwu}{`1;BBUUtIS$`uT z$sV=lhmeg^Udq(PByP}XySSNYitw=qUKp~*aK-Zv;SCWTreAe&697WU*e&2hSJJ@T zXSu;qctHKQT>)7DC6U$ez0?kgWeK=jH z+pl+QCMA_wJ`dL>NH7c2L?Xh#w`EiWe2HxzeK_Zh#fA>d65#ND9IG@5s9Ibkg!$k7K(|m{q$9Q18F^-#f zB8Mxv%qCDK-}P3)_f9m+YSbVlw5$dT7_yaU8f4+Yv)P;2ez0AWB<;=8>+yTtPIz|q zbaL|a_i|^YJZBo6`E~tPaH{eCz|l9mnx-4Ef+;Ke8B%Qnot;#>7l`0lyIef-Go) zoB!!i!$F~$&^JA>XDkx-l64d)qW+uLrHRroGAmemYh-Nc8g%T|yzg__Xn#-x1|9Br z5CbU0bOcOYptQ*dN4Ft!KcDv0;cbcRe!MJ5XP#0W0>P8RFa5Z$Y~}G@R`I>wcpFLN zQ*qNm^pvljh%9NHZpW*a9&973)FeM8Y;%HcUQ`z+m#WWv7}LSXiH4ExHTk!d)c4XkO*5;Wd7ibpfu2O1N6tQ)!N7vDOOAh!K{KMG_#k7pq%W@(27&f5FFcF~i&;YEg&GI8 z{PbvPOM|E0y(w#wqfH&wL&L@SkdXP$*kT63EpVkioN3uzUo>oN@ zs!TG#Ll~XNE0a`Q7yxO zzfK6Y9jbl`>PCL98vRegUYS=8>K`;VOmWImP(iTBLj;9{%)kkPPOm-$<0f7K1y3twzK^JK5bsET9#o2ag;^twnW*$Pr~hy@C$%q;no3MO(Q|Qte7hn0bRQcgoZS2 zjl)XfqHBtv0icW_I2yN`Bg+JxvnFE}G~_TG3HE}95UIvz(`4CRlGu4ri(c@_ zXe4f?%w0`_8)+wZ-mO#jzU7ku@aQZgDH~D}*v+{$E43+X0|pj}Y8H2Glhc;rC7Vz6 zo4C8;HZiFuEL95`I@KJl8J3f?>QFzC@r2bzKB89enghjR$4^sIu51FXA${Sutar@^ zVy!VWq+(^-KY-TQDoMw5Wa+I7$Y`47jF}@XzXW;>W~UKh)exu<;K_RXe#|ix6I^PF7%T z;>*t-=lF>;ryMwH+DPaR0z!qLmS;IOmnJ9Z5mLr~5U?I(@N#j(6CHuT+(L5Of2aB? zwobJ+Dn&-(NG<@%-uOZF49Tg+?#?=TR7=k-OchAsY)i=-5QHfyO7qD$Gk%f;>g6Z8 zfEL*~u&RAFk3nV8tn9Gk`IQs>8{IA(|E$?J$92{p(pXK8L$@mQ$V89C_q|7MBW1EQ z&o?#^9ZxkKst-(Mt<{v?rlCq``|ETAn9Un2+H|?43De!pqC3jDS2#RHE~C$Fx0zwi zaj8Hu!WgY)4Afa7xrmJtas6J()q;)qkWrg8wo*mtq9m`&YpF7#nWAH9&EmeJYKZ6a zr_<;;3#A$X@B>c9i4r*xto*Cwm8hVz>H9`!yKiFcVJ)JNN@VM!YFaCRc+U&iP>w>K z0I63R(CjaE{a*RhSd9r+bZvDj(%%#xy=#E9>I<_DX0N|(=89!hdM7r#2N`D9CB$-V z%J9a}0pQT2xm?8C8a>Z#}RgF@E7Q~HE<-IkUm(rNNQ%Tjlg*gHG z=?&9VQ~Dqx)gkC)(X{8g)^n6<1%3S_*++=*&_p(w7|PA3xIZ1y2KtL?4bfMy4Sk2^ zqimt76=etu$0Ut$bzm0sV4Zx9p~ky*0S zt+ebO_+0%MZ#(8r8QqQo(r1luy$ldwoc!aN`>uv=k;gGHJC<{8CC7cQ(HU(fxqMUQ zX;PJl?kpn@aS?byadn+}@V;EK*20a>%5_7><%-p0bZN6(C6i&q`bXv`i^go@u&{hp zdp8a^y-HaK_15_XYjcj6J_&{?1q<{FG2QhB9kaf9zfPN}Q4Iu8-$o z);563+q@FL*nmc>4nawizCggu*lT+URh&>Lm%!9R-wu@En%hv7>&uy>z5Ygesy-vT zHD=+?Z!;;c>v)exu9*rg9l;|Y!M=AO`58eEO9Uf=<(M=)}MP1Y*k03L0HdAbO zd}k05BMRss%O(@`Y+~xyaUdk&tO@oo3@ghzYz%TkcW*BfmV%nzD1Fe=4sslGeZ%(0 z_`>*4gM*{ISKx{eWZ{KH*89781Di6N7@{Gj-%6qJW{Xwi*|^{{zC~;Uop)m6&c4X5 zYIt}FN%g39=JOVmL>Owo1U|EA!Z2n(FvSFE#Wx1n&K97eOvHohSv7+b5z;CLxn4`^ z(vcM4g;w1*N}gN0q@mIP*d%t{MLjK8rvej`K9V22c@wbn$KGS?BK&t*u~~I`eFG< zhtdp_he8t(AoO+qWLTKe?><%pBT%C6XaV_$&y{8vl;n&MPT(&YH*2xkC!0$S%$snL z$QQ=fSg(Z6W_yTowODYp$p@<~-`emfby{p6W;%Dm8ZV;d)~GDqfrc+mv)!adAX)1m zMN;BY4DRue$NLNrxFC-EZQ?Nyzk&iYjxISqCTNO8@)~*S$>n@?3GM=~1bi{^4N4I1 zV+eIjAEdn~kb-7;5z+;x4D3r~T6C5|`PL;St?1^zi|i#Tf5$Vb;nla7yo7PMmNRQ< z#OIZkEWgg8W#MoS)z$cu?vXK90zqIRzb(QZfnp?RShj6(m*6bi-Gc>pg1Zyk-5nP0 z4#5&MxO;GScMa|iL4pK$BqZnVecwHQSbSg2uBxu?nmwy(jxoru4DO>J1hH<=WCvRn z%j#nrQFb72-=~zyVY-CcCR48Z7>tXh^L`qL8lw+e=^|I;2br$j^dO_TJD@~Lzn36V zdspaFrFf86*e5k81{u+|-QdXODGnU6EcJNmL#A+Or;4}?mMy8tRx%WBoDLW2CZVY_ zJSwbJ8u7B4ID^#K)S0zv zT2g~wwF~JEd=lm);twb_DYv1CX{_Q~ed7`*f{2r!G{;OOWi#24!!m^}R3zr*Xbe?c z&3T;3Dk?laO@>sE-$#YI7QY2bx{Njot22`1zc|#H%ki2g83zvxH2eCdy?rW1rB)5? zoWdwiwz}B|`Xg_LM+G+!e`Mz>8X-}0_xu7W8yl5YNd?;E{f3VAMmBc(L;*ZX-GvcH zCmyzxK%UZ)B**tEo7-o>nV%U3QGOmNnEO}(kuxh$58Xg%Ilg~ZH_!n-xjDj1>1w~( zO5W?HRmqdaYWuXi5$<8zKVa&_H|EA5XKBQwdbo z#MZI3nqFhQ&6w}$m$^7;wkP{Ixa&+LAZ2*DU5W?hi@Cg`_K?WDN1p~<6SOZ}hA&vQ z`S(nyAnDI4FCoouo`yqkhe_|+5a)>FyIq;(AOFpNkc|BFn#;lbg#8D~BlCo9_nJyi zLI*dt@uDu>$?+ek6;}6OBnmhzARZE^TwYAd)}YqL76qy+M?|=CQ8=&_7({bx+p6*7aHI_Qwkhtx zzGS_5=iCA(=7NtaR6W#ic3+r0R1PlzVT{JPW)}Byg z4kSFdEtSdQXK@E96sS4)jKGmuHr;#T6>-)iYq|?^(w(!WaW(VAWqTJv>UA|~P+h$B z47^3VW$57;JxqPLo13*@;kUwT3yO8fhpN1)3S+Y9M z{9Vh&-`58jjBP z?R{LGVe5|-PfHTj`;VxtmCbsB4`nk2I+v7%<61mcw1>`)NfxsKz$>mXA>^N3iEHJp zX*wzGXrtL~<9+a=Ny5sl7QtwRqiV}L$%Yn32s^Oqs!vU=CmspYO%$AraZ7_7bpnu zgRd|jMJjqU>k!j{0rgkq6;{H(8(&Ijk;)8P-fb;;x@+TPQC{xyJm$Zk)qA#^ zWW;%!7%#S$JgHbI;tW|!Qx54YWqu-6=-jX$oG^8(`|k4O*+R z`Z-ZZaxzOjRWY(oYLPdu?Orldvg*4yBE40iO$*%FjCZ-o1aSJJ50V)@1@sj~#%Svf zRL1pZL>^k?GB)NN4wH|3`6on_zI9;Qo#$^MzACzLRDO(o@M~gf0jnDqBDLah87bxZ zrkSmD4xCwkKfxS>PPKKE$v*)e(lyicqo`-1-DykRQjJ+>8TD4VywNaVdCaA3E-!X- zBw71gQ%Z}ur8RKrl9mIe?miTqRmSO)@$_kRp@P0ul1On+Lmr+5rtm|u&;z>AC`+M2 z!$;oypt2=lGRzC^O(N84=5Cr$Suzv)_% zeFxgJfs!7wt8@#jCVOrkI7PjU_%g+S4`>Iebl0>p%w+L8Dm!AfI@wu=28=tg)a+!1 zr^AFYc%?&CmM#ow_i0*=L*5pR-6v(%U}7uU!AmYMBpjGvt(69>Ws&!-@kTiM(=t`4Blho{*3 zOGhZG&Ne@bUxmz!mfpjx?8{r~O;?P%ZC~rOmJhTMms^%$=Ejt8@LcY-tg82~5E7d_0QVK-3sCin`a|*fjap77 z>MzCrKVZw0y04e|_Lu$vJlns>F~0&$vB4)Mja~-21|b>L756vlY_I<>S=+ciz~*&K z|0+tLxB~vGqC}+WYcs!WlG_JL{|xA~DIn{$n=Y3BFetTr8RuV&1z+1O0hF&Jeqj3# z1428%A6^OuJAnIZ4aJWCFj#l|Tf?Oz;O-TEdFJvTgFhff4p)FWB~AmW z!T{B;IOUC)|1o%DXKwWG7nL#=Q1aT@zk}*GR{CEDl{n$Gu3t9EY6*Yu*dhTi_xb=^ zNMr|vU$C+q@X7XpudwppwurbDe}*qK2_W-&YYVCWs0=9$@P}msFAc!?YM_?>9|O$f znDoDclbH^He0>iJa{gn0^KVG{Sq@^$p5WEg}EE!oc!@cWf|=@IGc!$v9q zM7$2;=kotlg`P~;$nxhwY?cFRUxz2P>eaw*@5>+GF<%9E`&tG%jz&cJkICcYZfE>| zOr6)6_6yWc^ZyyUF#i`!Y;s2JYr`G2fIli{TeSdz*M|Q~T`d2tF1xRQ-`L}qLzv&r z;I*SJER4VZ`B!3b-B$p_Ya=a<0HWV%&9=@q{}rnI@M84qMaFOX>puCK0M)NdBLUn= zwkt2Qy7|q2P`w=hlGnuKzuaJtFWg`tiibmjemMe7UUun5*GZhh$F(r^*;(X66eI~a z61~jzPd`=^YU%s!H!&7ebL-6rehGL+9pXWOOepOLMGVe#nGF%EOtBC*j%8^r7EMvW zzCRSo)yByXB>%$>M(uN#&hE9l1Vg@I4RnA&ferMbjpUCF4=UE{!+c>^9I~4sM%d0- z?;upv(R_nCIzA-Cl&;;`Zqb4n!C~qyJGCY+RW1ThUwJtJy=IO zv^>i698A{q2%j@6CLYg#*p)b34Ld`DOMaT{$;AsW^)O#WcCi%5PXSXM6lq()3>65s z@*oU{DX1?F+@@&>Y0}swy$#j4Ui2H;^D>}DkrFV?!u!a=w+r|;A=ZlD^Z4(boZtF0 zt{fem>do-ucFnR~l|vOgDm+{GmN@Ps*=+1Rt=A&rEedh}%%0f>?LzM%8^^O29^)X| zE)F)5%m~-c-B0_hY}KWobJ~~$+(${&9uLe8#eqn9p$8jzp$B`c-BClub9qtlY9r-+ zt0I8_?k~S2gkCFD&Ss(%DmUbvG$PB5?&Fa~IMS6{O0_@fAY9rc&b+1Xi;Q+vi9?w} zobDXoBu-4LkCpyyoiIJu5KWY!(Tv|o-mxHllNe!>s4@Z-wt>uRWE<1sSfMeoGWE-+(KBfY}TM+U8^#XMg$!}8W{M%+J9O$jSo0B*tkF+ zZVb5_$RoGhaPt$~wY>$G(|x31rY%aQGbiAEEs{8O6#3GOTchMeJ246Kp9{Utd#=<--U_3Hy9#IcFNU4kK;d4 z@v$RG`KpMXG45!h5ht!cCf|7ES=1f&L0TM|f-g8={zs^D9t>NLGfo9P*L-WYj@=9G z$+)Cd$$~C*#K7*p@PM76w&*)=quxf-C|=)phJGk5%2M@`D~QAQv_+zY`z3MxQW8k56tEJvs>ReX`%?u`-_ET zwM@b18fUOkcLLwN>xVfzV%zkqol1Lnp^f>v3|cHKW#^!{XP~5yo>o*GKJr0mnpy|t zFk%wT!*XI{tg132nK2T|D5$iG0!<2a+=AujEM;e&^5in<5Y1<07eOc&_WF+ye&48e zJYq#?{aWAM@CJ^sS$gE{FE*_zv^Q6UG`k#yi5f>DPN)ED9M@I6L!|F1x(b|WNUSf) zMaqvJ)_p##K>yh2n`C#Z<8Ua~kSN|V{nBP%u}FFA*8jfXx&+B!ksERI*|@fqbE@71 z%I_{&ypLakK2LHh9(vK;L;EKspe{~mxTq?QHp%?ZJjyEj2aDhgfp^Cl;X1x|yU$5% z>6c^e#yA~do>KLdEz`Y+2m9d-pLIx!@p%-^bgYld5&GHUbyZCaNB6SfeVJ&5)?np& zOXMnkCvn4d9u=HE=U6aD@Gi9#!L2qkne%3VgE=lH<5Qe}9xM`T#_~KM8fJGPYanZ+NxZ z4J3(tYvsvYweiI7H|aG8UC2XU?11;TSJ zH}g;8$d8(x54k{iVo>$w-kcbbsyQ~gTbx7}c`ZM@DIsDhP=k+QLw?HGJ_;Y>OQbs# zn^IpeU}QZPtveHFim-Ud%D1XK5MZu4ERQ3fOQNTo8nr3D4a?M~<{N|89`t4bx$x2n za*Tl6B{V^GdOb4qh!or!;1%-neUwx++foxyw=*!`9Mgahj8RUCGKQ5+c2YJFliO2V zq?C2b7nY>RH9jx`{S9DqxSe`E>yEap*u5g(t(o}R@413)TaS)b?RYrxJ72yB6~UAN z7wZsuFaf3o8DQRhQUNm~e zwm}LhD9XSty4<{QP4pBr8EUL4`@Q6h?T-*=Q$zv@dp$K1bzLl3FxGg1f*~02{pT_D zSIwI?Ns1>2ewYKuY}cN$>eY#mf|N3ZtVWun1=QAavPn!^m@MYiP1{fo3a~R@s@WC~ zaEIYRc;ek~O7y9{mQk{m>zt10QR|{A$_aaI_-aKTmJ^fidbpWpofzyjli6Dz$#>@90!~E*+L-*D=Xl>jcxEPNBz= zxKjjVUJ4xRuE#ClU}H3QMvEzouR&=&7POvq`$qmTKPQN)!BQy)PiMf4GH7mky9uD= zSyl%hR}x@Pg^?WDo5K~CXf#2*cUJQ)kr)teeCzlXK9jHW!3JW1_{!xD@PV4=w!lz+ z0f3Fn%e{s4)|{^4^38{4PsL*Gsrd-VXo&$J=4Dqk_CmIy7LdxufyBmMnZ#eVQt5li zi<~6QPQrmweg7de=u^UMS>N2MDZ*0EqHjQS8Rb60yQ(``vi6O16r0#mP^Rr% z?HIx3ZHMR|Y87I-MH-le0e^CN+&q~BGNt>ZG`lNp z!PtlV^KTQ_!CE*uYZzk(&x?Ljf@4G{=+NNdjp4+c!{mf!W9%pAJ`wwwD(_uK4 z8T;H>*^!Gq2@5bDoo+J0IRwxAfqxUA{^UQU55ES;?Zbc9?<>QA$=3+GYV5V_{q$ez zzuPeY{%aZb#&vp2CwTL0q=v%louC^2KRy> z1pZoY{0`rL|NUp6@2#T$i=Foo?w)%$C65EW_VH{+^Iy1nN|R&2Ua*xSQikNS7+ zh`J_Uzt;46_|*9C&}-9U&0k)7HD=A)GHH1Qt?fk|p%AG=d|x*#(*T`J)Rq|0UQ`V= zMR(YtP6gs9r4A?Nsw|6Hq0}FOI*W#9iG7gl#%B{@GE5Olnu0sxdlXkgZA}$H!Ehhv z%(I}e0FRSj>LO|i)v&K)vuBOW8HC`o2buRLh8sK}o}Y2=JmFbl@=JyOQeMekN_U|T z5uh0^ZkxS&k8io5}&IN!2!qEoX^F43S)rr99A!;~i~8Z#tzaTuw@9p@0EWIw;3l#l%~FNJE{aVRfb~gwVn+{v`J%Le z44o9u&u(P-Jw><-QU)q)@Z3*QZn4>_|L5?MEA`A|hwDuEcw)HOc3=4D!h$dgy6^W3 zSa@Kvc2D=f#v5t^DlR3gu6XOA)whXXhaFrA75N+I#==R^v0(;bOX@sgHRh?igE$|o zf>v{)zUNEc-4X?^tTeAicKOJ2Ld>Mq%9kt*0Hd-3hpA)TxwZhS&9U#GzpJKle)bCi zw7IV7%4Ej}MYK$q;eNO<)#MfZiOZ+(J~j`iU{p+ll<5_$Xe{n%Cau7CC5y1Lt@O>I z%5_Wa=8ew&yY;uD-KUwd`9BF$jW-cE(}hMZwL*oDo$o5S-7}q9({9X@`5fe3Jcao> zqvKQp+K{kvdm7;4g9YdJP+D*W{bmOh_;Aw%#bw=Y!te<g_;_p6 z=R7sKIm+4;4$w6SG$A%0YIaIe`XJ5Xt)==*dB$yV>Y-X3AU-D+C?Sp;a1uhdDicL> z*7?S`@A}L0I_wgRx-YL>1p_ndo1k4;f^!l1v{;LG zCv-nU{+li_Wc}6U6|Mi>P90naz`W7|-aUzWeR~4}0?qK7#SG@J(@T!4B>F?`hrSQk zee*lZ6lw+%XYR#6zQ~0C-KiqH0}zt_rY%){VJzoFc>4SkZcG5Q`SQ3fWWyKX9nled zQZoa7TC)Bf03G-_S3=k3?#(i~1n;(RcsTMhh+R&25ax7h&}5`=POh<#1FxTsxvAu* zLK#ggl8vcz*hGgeHg)9_47yJ7R@AO`ZQN`!Jn^$mO2`VG@BT5{2HBDWi(t9c@;K3a zfqu$Hc(>kN@bE&LH|}w;6lh3}`ldFSOHv|yZS#CHDe^!t;Q+AqDH&0{Il=t3k)<58 z{>wWa10y4PI1LiPdc`jqDlpJXKrI=e&HanJ($X`~KJ0h83b!=fCv!OFRx}TWHDA(@4 zj3>{N-p&D=n+_4h9&3oTbvg%k)@%6>b&<}G@H_&}&gFo1IAHx&8+X5fw za1*?wd>m9Hb3p~EtUGPLwy=IB;7iPY_FvSH{x%JShh>#}o56`VjF>lLx%GhFP1BE( zB-&Cg{e#Ac`j~`bXDS>4@s3xn;}cDI@1z&ur=T#2k-i4Y37di!F^513EJ@i5`<(CE zgB1;p4L|7d=Cs7WfDkOve`2CT-FMpPm)kCprjyVb@VItVR2B#9;!l!(q8*H9B~-;h z9)80Ev<275J4;xI&|-elBTOJ_R!#e7UQttBw$sv~C+_(&pD37aQqXi^nh zT-%_WtIm{^RP7BbLqZ%7BfBGmb&^9NWAv?h@?8y`l=oSGC&a*!oEhs+aI`>Q`puC8 zc;fJ{;v4yyv6$djb!4@}i2f)rNhIHS`u$Pvfz?^X-fX?al_nuuJ-xwWIPqHXWRL||RxJBUn zvxMZf1ioJeq1lt&r7EtJ>8-Jh7kWW{&D|pbBrQ7b_kLd--LcN#*)~1h){Ff0+pm63 z(Ljz#<)Y56iXqTY9iGXpXKNd$XmP^&*%gX98tAd#4eyVwXru>ww)0Go_f{Oti!}AE=^8|rPY^# zpoPk3e!xC)WnExC%`N)?;{%oR0|s3HhrN)%CQBh(%jIu#D0ZleGc!)<`?#glEql5O+w#I&USy)^e`>Bq+y}U^!%nHDe zFVa^*vIIc3hcE3PJGee6=Z2g=jUyA<8S#Xhik8NF4^DKkRB3Um3k`=~T4XtE5!JfTui68Zt~-vvOr?3T!lY zqhFD!NH!kBg!NkVT73F75IUbyE~bgTSN4_l>MP;FP~MX^$EVsGppYK!0}E zy@=_V|Kz?JAU>22$=P0n4Y& z>9^Q&x}CZS2fZMiCh+4M93S&xV)L`4zmEV5tjF%~;TkQdQ^N~Lu&9G6;QQf_f;`55 z`NmBTQUsM5qRvP?$tsj2jrJ=IZF{%)Kw^qJ`VFhZ1a&B~?Ajn5Y>~7*ayje3uSvL) zn&`oT@yFFNrAfjpeVWwGfh|Ts$?&^era1@!mZ5NwGi3(KlGSJ>?HE(A%VZGir9i4L zm4v~K3Dk6UJK;6bgVlGRLQ^w>5~4+0_PaxvvI-o7b9^TOEj|I)_C@5vvGxfb%nGAM zezZcWV^c#%90W+oOc&UAP#5M0NjFpT;E_B+JscmcJ7Ph;fG+aPm?0l^m+7u;MxB;F z3=>e9I0s<7t#rb`q(k$N==C=)y8>!GCtB8l(pZF9Z7{gv={$ zZ0ol4I_#XHV^y_|W5QQi`REu0E81YZ+A zzryY`6uQ%|yI0gK0{NoLxYGY1H*dXXtz}s>i|PUQJa|8&`P5MV++h&9yJ5Y{fp~Bx z|Bid++7xid9yLc{lpG4QtQUTsW`y0ExVz|Pt%QF(+B9(}Y`KU;T&tP7!0(p@oi|$> z+~_cM-R(9ne)h}1KRXN2)ieT%D_u>)p3<5<8To%1rblvN9r=LVkl*Z_Q-00 zf)dyL#fBo1k+Xtf?Vak)RcA_4-xJ0nWv*L^F@GhbUsNXZ@K8(0l+?#LGg|Y$LA%^u ziBfzQv2)xuOLLCas)wFfnAKoH(0_$es^T&|F+wlozhJEp|3h8#KZ`_NXB%_3f36h2 z20Q_zUyu2o?BA0wQVbYARHb8$mOD87R z3d5p?yOJlQ3rlmqG}%Qgnp_3}8B?j7%~97-FXhaY)TAJr2Si#nD=v|NYOI7NN_7L@ z78>`lsk7p%(e+9_Pz0|vunS4t61yX#00K`+>~8&t>WhQfmi?76ExJ*Ju?Iv4{rK}* zs)@*gb=C6pSav30njP#l69bv}>aZ;&==`!@+?V^>%MnxJ!Pn|~F8rvpe2J7VpQt`W zO4^!4|ujss!HeXZnSKzR z0Tazv#Ocp^EHAO$@Dg8%nmBUJDXv~`N}wH2$RJOkZr|k~4@GRq;O5rKBN#zn&7xaV ziuTxs4b-0NFZboZ(OW=^Eyv$kk#Hc2fL9V^f2)*74W3I~7|-Kq{K@et5-3#8L#}k8 zyiL+OW28{yFPzP;Ej0o|Q$F7%FOG;h0+Ww!sh{dBCGJk%xvcO;FOCq_wCrWV3!uJ; z&-e?zAKH{-?^*UbVHgSo)q%^^VMMcf+|O!zvMvf|!iMS$))#0iw}E{S%ZrBnEZBJh zmdqF!Jz>G>4=tkY6r2%m4^*ZtV<+j(akYda7l~a!!B^jG z)Xy6rDq&NJ;89dfGLreRx+VEuds#@>p)a}4>4_nB*Ru5bQa%k!+Eg~6EWhfLv-trm z%B5!hctV8Y1BA74f+H}BJ0AG+z{)_t^eVEpYmjtf&;Ul;GB4!K2C%OAnHD=%0)dS_ zBg2nn@Pzbxj@_ifjv)-PjK`iqaJL?j!`bsF;JpIszJQ~aCG5h@cD&GzLdsh_FAkBS z-4Ox{J2>042_=Eb4@_A;4qx?0yn5yLI7Oz^$5?10bqSJ{fXB9p(hQL)we z-hV6?Ni}B>T(G%(O90&04=UMqTyu%y{B%p+5L+~rR)G2N4QeRGIM%Yxg|j{ZaW^6k z?Y0mnS_u<8sraBE*s#T(S>;3NXS2kgV_a{P3aE!jDu#tqzIZV~F5yXy5p1<`C&KNB zB;vi9B)8Uk2efdnzhpY2BQ_e@^XoMcft?+K~_|qxtR)W0) zt`8?_H%R}xMv4t2w5e((k?s4Fj0y~FlrNn*yk`ZWV3DP4hUqL_&8?V$g3t0zJj0RpWQJ1$mly#G0T=Giz6)hp<5zi z`SZGQ|0bLxA3v-cXr-8gKGOK(9Eu=Ddfy(prH9}~_geVGZ?LWGf+-jY=vrvP$UHP) z%V_NwJ?-JVq&sYmjP)Cc-K=MT6Q{-18){L*hBmC*_uf5MTYGP1C1XQ!x8R`8zRN5A!kMp*3EYh#!x! zs3+%#Ee0wMh1-YT>%B!@AJP>apSF~dbI)l&wnbMZBaZg*4?+~AHN@t1+kd;|DMq_( z&X?#c0V>(v75leuC0_XJKi{I@2)!mpxS_u~N3VsyIX|uFIDpqZ!$r*3vMMX6KXl=! zSU5MY*P+1S5|O>EjBWI-jUDau4gar1h1VP(Io#J;>~V2$U(+RGadE&Qey^SbWi6jw zU%nmjQ2#l=c`-vv9wx*={C$eEqtt2hh3O4%zb><=CUp^&#tCx?fmxcxq^bx_tx60M zLJv(uPND1u`5f>zWpLqH8? zk`ILg{R)`F49vax)P$;S0#jCbR4x~T${ATeAY6tgwXQ5bUBoF1VZ%Lis-dMdown8;8t%Qq=)`{j;A786UPk+v}z0|y*O7bjcd*aEtRLI|LXG8+Chi}hTQw71kD zP>a4aHV;`0qaL_}gD=exIcqSxfYy%mvY%)V_O6fIO&?5Qvr{ESB-u=pz>g9FKyujwTC4w?1Dk1Xkt50dk#~*ZTW0#~$2bW!I5$ja}etr1p;jXf2d1 zM9KQl*m2VCvNAqsdNp7x;gg4ULBg0A1>oAav)u&aFj>wjyMIlhh1esMJW`m&J)&8A zJI>H~8LbZtudsKZ+vgZE-7XBWWz2Yvo)(@iWpcz72;}A%z*s!;%C*l3J>Q6xb@6`V zRjP*MKh8%(a6h?=`t|cu2IwAbqwr|az8I1pv9}n_hryyb!_}FM6SFz+1Kcup_`7=` z(&MH#R3sOfSzIZ0Z7d_Qc4mXyLY&-_bM^DV&MiFRzvfeN6v^vrTtR~KCvj((1jpia zGH_Dh{7!B8$7FDP;ky5~sDdj64$kYIdi78geEQ2j2`G3jLQB683==i0{PzmunvH`rz)nC?zR_4b4i%RgA z5y$_vT6-28qQ8c}cliIE>Nnvb^tga1n0o(_D237DF{eyW&%pe@3`z&3%@SV zwY78lSHDhp%^h+3KW2vMPKuQo3j_;Dt{S->FsZOoFH4gtkV`7$DbrZOuy!!}0gRA@ zLc5;Z&JHb+Kyr;F%N-OknR&fie%w2^*Lb>|xh5)#9~gY>osJM{ZJDr0q!2}?{x4D-CTn5!Ild$8_ttQt;9F-`idP5-_)o#2Ij{=AqgyliC@ zR`rhQo{GX8e}TT|59qxHKv&mBZ6s1K*A$@1^a?<2#5MCX9}w2Th<+w?t} z>1UcPgjinPA~R5ss2oQSM@)K^v?8-Kb2qhIm~)nh2+mX_reah(hvKBWT2nMvS5 z%~nD(Wx@FRfw=SSapvI}<#;r-BzT=3-lI<(F%*bNWa5k=$#Uu(C`>}4;1HGvy4)s8 zR+99vS@A4u>y!odZl9y zKF#W1=VBA#qQ7X0ySzRVOzO=2C~NAfmfm@JkTalCenIHwfQLsJ%E(N~F#4X{dy&kq7yg`*VL>3pQ#n6{Dx>A52DDDonU*ng|5eGqe^t-lMPCgpA(bGf!$ZzyFjQVPJbxHOZ<9S zr&}he)jagDaYz8=%|U-H85JA4N(* z6#-sShITV_Y8V?huiHeW4{K3URc+3+d$X{j!b10`pW$Oj8*LeJ%&iCYrm38(# z%IUTKz{VhRxN-jqhLw->+v!C_N>J|0JwXaT>4^6-TeMlgQomyxlfLdeQ!!O5bgwGM zId;)Nxuh|mI)=cs22PY?{}Y-U@h5o?jF>^$pwz+1((CtVSCd+W9JW=O+|)iA;-R`W z0-+BLx_TQSmWc(I`>4JFkI~s7EAbS#GD^DXBBXY=G=3l0+CxoRMQgasK{Bwq`#INh z=kYDsNgF+Zz7D8zixo^^>ubyt4I?ZwL6;7GP(|3_ZAIBPv$OMeZTB9F_*9svn`78S zFpq4SC31&^_A_?%6P)@bxqQ|zWH>H}3BkPABM-~=7X$WHspYuRn+AH{lhgSc7Y z(q-|_?ipX>>ae9ut85TRzt2&6SF^ga8B}K34C^Hvp^Rn_IQ0o}e4|LP&Qw34PkLLk zHU-$CYy4`Au{;Tw?Io&&37#tULKuNIxy+}#^5EP|Iev#-;BSNyNf#h`l$6(ojZ5Xk zc9-LUQdz){J!cz@YZvA{5Ee&+;flG5P6^y06io{(3m^^`OYR@yhEWQO8Lq>`rbXwtGh0ys^(eD3M#(3k)u@^}s1? z^)Q|RGg#*=sMKVc*hMw|mT-Fe_ejmar$)b9E;DT4W`&IAb$^F?}DUA-$L6v9nj z4JLN#t^DIpIK&#sx`#fZ10tyLsXQXdB+k;GbnL1Nio?oz#Zs4381=%~KiWdtfyDKR zPlCyz?T>R-&3q{$XLXgWi!p0R+MjF*fv4@{hEN5!o#4<_R&Nw1mqm?r-;LxqYBaRG z6H$+^Zrs=Yn5(;NJ!$#v%RSRgdRSrcxxFVDv7-QXAcZSeruZPXm6c3si&(?^gfBas zx#5%ZN#-tLp0k`|SB398zpX|qPw3l1r2Bv>3w_fYr0cgFIRC!GpRRZPxZqD;^um|U zLC;nST9t`Yhs)YlIgN@xTzQ;rD30rP>qNrVGoSr{8X&fR&M7Y%Y}vkuriw9G{f!2! z;o_!=iw*UhfX+05_Kl-i087i;9yQgTR==igkRGHItQfv9l(w5D$vjG^B8L! zvC}Er98+{9;na`5kMr8jw>Zo}Q2W4Z{o02zXP}A0dt(Y&AmZBd=UvE8944D|%x#0S zK`qWR9M_&&iz1oP=fdz*@|eUH;s?}FR}Pi|@?PU_xo(|fA{4N`Xk<-s3yO4HV&Wwu zKq$spSTE!m6Z2Nemy?=V`m(2BxzZNv!5S92n~D$MP9-~$#nJAg8#862zsUgdOHB8+ z!F!FSFPWuHSfmkxD^|8n_JOHLOMAGnf7oyEJcY#-&|U|5YcRcKi%zGpt*V>ADf+AXw8j!emwxb|$gs8xb@N$(2Cd^&Yo4 zwK8~V)uOn~u(v9kXM#9DLW7V*bTe4FM;^mABZ6vtv910sDwzku>>z|S=!4>viNm)= zDk_3e7W^nRvFtr2s9x7dxg_0eBd3)fcfHp5pii8P$)@Wev0pEG&q64Hx2Cv;m57Pk zmif0P-yn!~kLveKJ??lSD)f}nNTgz+Nz%{B_@%nPqTyrg$ET0v6osh;H95&Yf1SrG z0qHu$@ta)8zf9NT8$xMDUHn3I@lN4dZ@l_R^->4D3wBpa!84?E{zHu7hXx^1TGhjZ z4`S9(Fox}b_ti-@h*S^Jz!o=>ML#nr&ooL$(PCNB3;)P!0CfUyG7@4gg*0w|{a z;zd}$4?HtTjW5#Ln1`H=btukZKSqdqGa8y&D@LnT5QGp zUh*?deC2OFm^)>yW56+8T-NL&+|hmlZSl)0XsmK|Mo9tZGVXl10Qx%!#Lx!wVn zalgO03HwC0rdHcdoo4`gFb_N`?t6;Mab#i<8JnN5G@+PenAgp`fGNGn3Y|=Z4gCIQ zl(iJ@QikJ-L(xU~`V9*kvsy2ArjVG|=a?MGJ+;&ezwj_Jm6)l!clSsN*V{VSw*6&? z8Hb&k@&&0RVqC!7kCiPQ>y{{S{jq3t;-rRm`iyAc-J*%yDr$Oule;ob1jX}MTyYG! zyp6Q0?kRY9Sv5!L=8VnC+7s_1r1@hNMj{={>qFi!L6blL$CQ{T4+I-%(&)daL=!xN z5s4+68gW9;d4!FX@W7zCuOuaowT;i_O?GGN8h$?fjJgVZUqL7@_8^Mj5Z#00dtq`$ z|2_8;!lO>i5ZDLf?yNO&VJ?1wpN9tYxp5#Yx$O&s{>)6xhRQu^C;+r_Ppo1jL23r3 z)}&f=EbtOw&>_tbP_ zi)lk_^(1h>_gHLVV8Sv6xq}fPVUvh7S36%YnkI%EC$>KK z2B+(_@T6t^NNk9O5(m%mQy6F4(b@;|i6X&f)h0@0CW}1EN>|chAMs2Qbut0ZT|n=X z07RoA${zIN67I&_$vNX6Ib)ns=a9iWger0NQ&!^v<3d5>2CK1I*F}Bd;c+%8Xg?-i zI)2`i!1fDgL6Z6ywkQe$fz6=sj-X8))SgalI)h!cRWzJN6Jb=fR(kvA`)LwTm#%I+ z`Bqzfz*eFG61uI%s>5IejEly%MN}JEBZ7Jh6#39a3@e>uT-V2>CDDbY6bsda#39^| zh#Yu{K#2Q~3EOU9uyoxzSUovf8ma;=4}M^@0e6bK1n=Q-a^Rr9{K$N!B1~;#+oLT` zP(Lm6D@Qr`D3)6FqKeAPx+LK^Y%2)w{|uys-(dm}GS|dL1-J5j11|s22I|n&A?<`x zx_WcU4ya5|rCqhklM0PfyIY<633ll2!!P}C1~&USJ3z#(Eq#uMv@(umsv$$_j%QsG zjDB!RbK)Q`(X)7rF-_q&06-wqfIczR7zRmBLZHbB^l;TIupQDD?%+cq-a&whE1&;} z)#E36!_B7Or`+`+S-Dpyl23htUcuZSQPlM4vv4FuS`?Y|F)R*Xp-n&`TuU&BZ}&0n z3OK)($b`w)tW@XGNfS-h#VP@mxcZ(PM4QyGE;JU1EnWmUXg_)xJgaR2kwwxLO-+n^GaP$=AtGCaqGzge0EFkX0Q|TvNzqV zLQ1oILez9J^HG!1EjRQw6L7>P8~g2XthorLw0{!LAZ4Kzm>E3lG^hX<5=4DO8nA$9 z)QW?}*qWLTRD>5~+q@Q=i0FJ?%u6DG^PSI-_o~7%AktegxIq+ zKoN6uaJtuw17P||`ai8&jl2a4_1UqzLW?cF<)D#tczhomRLU`G|&`0`0-I1DvgWs@c4B8d+b6DNtLD<*#W(Vd$2w6GUMsDy0$5;q1Krvr4 z_~!A;K40eeG;`*CguYUg-j_YJ3v?7aH&|Tvy~%S6%#1oJ;2SiEef1rnug&HCmSbPZT@&0@(@IzMO>Qa51cQlvmh@j#*QrRpdQPZp0xv5GhUb-bea=rKbmzA z@Y1zra?VKBk>5pHyDB#(8@s9J+K+$6Fhdk~bTbL_AW6pzfbvpi&CyomOHnY|P9Lbl zZ1<5qgY2~^9nZ3fRmbfwspWomdO^Lns-pEXCf3Ku@JFI=rJKi3|65mfS&Xh3!C5m?XkXOjs(k0K=UAl+VEn z^S;gWMa&_kgD^~GKtxvZ7j60v9rdM@Uq>wIOX=-T>{#5_-HzSEt2o3bL2yx*cvb|O zD3tRfhvXL80LewYy+{t8M&2$KS}7}uC#D59eaTx^gBe-g10ndy0INR zJpI$YbEKC3U@{C=ag~$q8Dm322^3@0aix4Nj{xR0*@-&}VBx%|h(iT?c)bASS-sPT z-WGh?Y2M~N@~3a?!N~BzpUnDe12PVdX`mu_J7RG@wHVhNHO_A`#NjW5Jd1_Nuq)t@ zgFV@GFujL+ z^>&gg)9OhJe~YZ#>|FFU38Nz#9%yX-L3$+yhJH6}rZo@FAJ1-_Wa_UB)T!w62qT`T zL#ZJAah-n~0Mpp=;AA#LIckO&-^VQ|LhsVQBT{8EkWREYeRBH2it4o zWci|a7wcN0-nZg^ISC$KlT&>v)~-w4s52Gz>?js1?O!;bHbR(~^YM&i7Y-QhLz7An z7)_A|BB5E~PATEie8w&3VK8rs5nezFjY5=H;XDqcJL8vO1?22g2zDB(u1mq#5(U`O z`Fo4%a}-hsF9~d5^lSp9pq5@La^7daQoQ7wP`jFbccyO`WYUpcHu|fRf2GB&{t1C; zT3)Z=JilyOSwFFfkUGqO|5*{@+{V)w1Lr9XVLSDAzEC(Gj^ye_F*{Lqm_A8RJbtP_ z!k0b_eK?%clR@I0afvN1BKW4KsI-}+mYE69ExK1gKx6Nj#3l#$%zPjsP5#ulyGLT( zb6=E$B_GwOY~*oEvH3Nc7FEVfKSE^hUu#O&7kvWG?#Pjf%k$f0x#1EnH#)6ta0jmh zno;e)(H8bqzTN2}qRr6pTe)9ZdmQUVh#$b?1#h~8e7b>>e?AR${*+nmx`KoYj&|GF zU{d@m4R#lwfFB185()q~co^n7jBeW)ajC9shy2`T2)*8;)ZQ(;>S2noCAFN?c{hFd z{ATM%O>YpgBVSznt3GLHUcV%t^ZsG+ht$CYxqY1^R4oB#;+*jT7J>dk!Wk#gxC4I) zS3JL;8|rHb8p8%xkBjtaiNy)lkXe2PZC{js0fY4~KVUnMNlysRH}3plu9SY#H`f$U z7iYk1wz4@KHA)epqX)cjrdadMU8*mlQZcixtAbP=VeQem|1JF^)qix)1|yW>rZZQ2 zu1b~)Hluz)(AMHExO!_|s)CLtBY7+LSyOieh?UnxBg~r787?_`wBJrmyTGYiD!ATc zY8|+%WuXp)e3*x^!U?`6b0MMRJ+X*b)8uP98)W(6O4`NWVVt$A_LI}2H)0(XS+}^y zxoNReQRez>B};OUXDEepg2BXUZkhcg@ui=1G#HMEmuS%*ELc^Z<|hO-KNtK)M=k+r z?-duk90-e1-d}&5X6B{vrbm32&78IGA63(MG^r9mq(`W~ZQ_2b$j6+dv$_BxIJcUx zom_^ZqAG$j8EEPbQUpSQ%L?=|{hrfsEQFZ4bQ&cJro$!@YR|zd zwc1*j2`yo^aQxJW9KKYQ21#2AAj~2^#Hlr;x75(!3=q0;X=w#^1tW)4hIA3_e&G0YYgz(K#~i}t6Eq(EL2gRl`km@sOLC1#QS z>=|^*?Gpnvm9Rc#o3L4srz~Pt7j5`fwR^>zhKEM7pa!jaAM-1cxJCEld+ruAxdk}# z8!Gn6a}}2FAx+@BZ>{SLzW!yO6d^Y7HHR2;k^spq3|s%Uo0{Z%A>^x(uq|!MdZY2S z=4M0%tx_axS2J_Gq3Ut&ksOm=`nvx%ryWp$jbPa04(i zU%=edxhgoZb=HCBCXQd)>gKq{IV_#(48Px0W*>`H#Run}8HgJ=qZQ-0EYc1{*i&Kg zTzejLln38yKI`#oONeeh3jT;()ZB1%Y*|SlqGj1gGI_9w>@}L_G_h4k=L#MHJY|U3 zVhyr)&@Fv0Wgh}>B*fOkEDzMF$=rA!fzFp<6`Fc38 zy2IV14rYh=!yo-3*-0((+{hL=@;JoEYN0$jV_K77@jCZznzWoxx1XE(y#EdI8{E%5 z$^^#4{D(Y?nH($|hWjlLth8GnqZ}*1r+eZu@7GuMTz`q7>(6RU;W(D45MRtH6t1aA z0Hb%CBI4bx^jg#q{BO1Fn@Q59uC#O2U>43FQ8EZz2x)`$wb5)`qmHhy{?Bq7!<*1O zO%?-IIg1y;8VbLZ-fQK&QE6X5?@Vvy70QWKfdcz>B4{UvDC z8PD(spQ)59xuChpO+Y=f3q1AEHyPvPn-k@ubF@FBFa05`MbWV1BkWz^35%|(7fsK2 z_D=7(D1!Y_26uG*m9!GeKXp{gB0l+ZB@vJ^)l~p1;D1d4GHEdi~4y zem{}zc|BNKxvs7Jhk4l_+xJG7o55)zp@XE1d-te#rpg=&65jLDAX|E`pW(f7t6z#u zPk6Hoeq84YS@`p^A|%TTckjwd9z>nih8~)Ms;j_!oFSV=t_yxnp62y6X()Qq~ncBSWm%tneOGkGn&{apUwX6oP+O-tyVz z1GMWd6Z1(Dh)#uQ?RhC`_MiqA#YA!7S2%l~##a{J=BYeq3Z2~1a{!8Jv?Q4T{zf76gi zx^f-0X|Mv|IzTB^WDAVAloXmPzQiAAvtxFaeC}wpzH0ugDkZdmYI*Z%jj@FtdM2dw zHh`)QAZiTZQ+^#$QuGqr2$|YpesZ_U4tsP5*T<5^1iIgHvTWuRwdY|L&DnE@J9e4t zp?+@a%?u)c6QI5HVCGw*kV+y{GPv`BjwhePJ>r(mtat;vOxQ0LRukfDcATgRisYdn zv9vAWsd+0#NxpRcj)lZps6>H|oey~=%q`p^;4cc!NzTRUI5pnr*ti6eDRV@A^>sl^ z7ftChqMs%KUhtI&@@XR16*s(1+5WGL##^=y+{$iIL{@A@SYho)QPhk}*s(N5)9i7SU70(x~$fm200GmI5{0?=Wq34UTUd@yh-qb#>Z)2#Gx6cga z6mcenk~6-yYW943V6MbH4`h(Yb|U@-0tw1U2%N%DMC)4nEgkB9>rDHa8z~+H#CpXg zhAPMvxja)~)N9>H;&5zq9^tq9KkSIlJ9@>F4E(0I$XX%VLY0P2D!~f?91-0lAAvh# zPbt08=G&e$?|3F3Sp+P$?GSILGq(3HuI4!mt6TD4%P6u7<8VPR5#0Pf!-Z`K0{*C1 zAIJQ`G1|Ac?77vq)uj*~h_DWdG_>V&inqk7?)ZUwFvY?fw)OZ%xCIgn{(|RZUHK;h z)FV5zk?y#!Uk|$HG1QjP6De&z*Qj~rblD7e)ldo5axl(l=f;juJTH58NTaXJygo2)POxzQ3$g) zp(-9(sH1t@!yaH!t70>}X;1katV7W>^elPXrvN4KTwr`K+Vo zQhp*2-O$5-nj+Z&l13=H34Bhqi^|4&dC5d(^}Qe5v?NRHkE3jX&K;T)nc@pp}l6CDym z<(%unA{&!6bM8v8+89?gYSHtMm|gx{=g|;tJ4OBiwn-YJ%L?sNAw9kG3vcfO75!^h zZ2vRjXP;N+qtE{yAK zWn8OlFN+i4Fe7r=eW%d%RmPcHil_JpCZFS8`R-&Io}~hqW3gYJ>kK~x75skKZtm$6>Zt3h}8`}}I5 zyRT&J+b~wbG|t3N=F^_J87t<9;gQpkgNR%8%;-saiYZe&zM$*pmFs;62cKa1 zDFdemC_TB!Xp-$=jLJS+DOu#NLk5|f`I#Sk?cfHvJfzAuBD5m@xg+I<*da1NT}L`5 zV#*f!z}(0$bWnV{4q7kssh;%!I&???p+G!;Ji+f!LID^lZJ2-n`~~!`nhubzU!e_Y zLn)^{Me7&u79RR}dOqV&ur!LvyG+xK3S`MRuHd?oG~Yf_(4ggB?Tb7F`C*{I-J(nx z5^ILu0K&Z`b7-IYEfF{0AX7Mi6ul^NiqYsl*R&6R?ZF^m{Fb@kg4+_7736uyMs5#b zGL>kx4Z(?(>+v2a^Y6oMJp*3?I6hzt?>~qP|0QRIc>%dj2@SMk4SaBT-xi?F*e)iL zh)X!}`+^9?Z$d#g9aFnx?UHX2p>rpjyNQ2STqch;a?)xOi0L^`s~_|O9!duN>Smi# z&uXv7pslCIRVQO{3f&&0!nUz3r|D+bpp9%4iZ@sNo%1KdN+*h0n>)WdW~BT;)LeFN^c-s);D+YJ zRN=Vv5D-QTcLMs{N@eK|6eVR%x3fO)zb^7h)3IR`+bGPNBrhZpHTBN%=cHK9UOFL8 z-YN%c6HT^%C6p^q_bjVXj#i0*?hhp_2E>qvr(LJ%tC!jiwE3)Aj7F8QhP$rWmWtTW zEE#^?gigu!esL-iRObl3?A%#TeSH z5(yC<=O=4W*B>lfwLFot+1IWUF{P?ZrPY*>)6Rv%Nt-bbX~rgs)_<59R2Tq1tz9|E z9!&KG$@CQ!LLD+exR!JptcnN00}cKJy3q9GtAV|bO*OIEx0M@yxux$O;rla)SjZjI zw`XrD6?~KxST_FzvgehABTQKCO`pEmv7&ZEOFU5Hg`X_o`%B__P6lUX@V-Se=uK2s zCo@0ZrYE9fQEXMW{($X(D7ze`p})l5h{hGQ$3tK`w7-n*wEa)OUNv;uy7ApP}X4=^W;#{z-0vHBxlj7t*Zv5-}L{GP9r$XCWc?8dxtF{FOP|mEK_Ov0h|0SQkS&7y%iP zpI+zLYL%V!;|o;!$^QZPyPjt7$$yNW{2Js2j;`Q zpEYv93U)RkTiBHli%&OAeYIG)nU=#r5H;{3Mj z6zX^vFTzL|RA;XlE3(=g$&aa3+`*VJVJc|6ju4m;7>2I0bGjFh|FL~c)NB=;aUDo4 z3M75cV1n(*nvzWP7tTM%U6;wjMvfOjmCTigb8;h3HT9Y$l8U^ijYnJPmoXoiWYHZ_ zzrYvK#qf<3&3JkRci_1ixqa`s&Iyp(#6!~W;Khk|eJw72ec!pB@oncNgSLGQ8S2|> z^5*aqe0c4O&5n5u!4o3V{u!cIh(ZFw4#YN%A0)R1m!hGM404t%bm||pg2=s=#E_*- z4V9+m6cJIPE|xJ6Md!fEPYaYyjjlJ>ilDi|56ps={0Q{u4|T_HCM+Pgt~wy8JpTQ# zW5>g$FSPT?I*Uo<4}w%Js2l`)&&!b|ps?Z&k^__6T+YkdT8S>tFDo>kZJuO>5A1du zyyL;8dFn$ZjA~IT;1MfGWZ;D{f!Zs&Bl;FB_Oc^Vp5j-l%-b3}i0~sTBu+^s%}WLX zqi6e;TE!9FG(-1!Gx{iq2orX%l^r=ey4`+I+!$tW%Wsnf%g1YZaoqXM-S6y!och^n*~u$*DV45PVkfe%YL|R z!)7WggsB7GJ&CkKA(xbcoIKLA%U?8K4O*B>7AX~?jxK}S(W*fb{^1&TdfMR#I$kU- zubMze>kaXQ&;7=@xQ_Z7?8-p2cOC*H{*pgqip^Rbd`;5=UKmi z_tD4F`(>!%Z`Bd%lo+}8!2zai>X6RF>u`w@>Bn)b?N)(op}ok%F^trOOYlJWvd=la`HM0n#TUD@%2LAmew# zom!e6hHQjf1yspxYxIIxJ`i%cS`g`Ok)v)=>mC{=pm2@0hDk+uqH}(C| zP?2vjwk>!aM1YD=Sx)>hdP|7H$N|_Xr7uMB^h<`h>Mw+h^uGw*MssTp>djd@vgpmq zsOqO^zmQsNJ+Jx^%`-u&K$#6`8mjfH{PZionL9oVxX{VO(^`z(dIHG;8~5h6Ij_z| zzWv<$(GTf%5&KH=M7h^xlAOa3U4T|w;YfhO|kEci0rnh-+B>G-u(q0Hq zegW{V)#=4N4O_{DhyXYEFq>O{SJw|{o-84bK2gw{dZpVpiA14;J#WHHD+zM?Tf-NsZ~$K9OF6EaIl9ix#6l@k1-0CzM=Fp_zM_(`_>z1d%O{(&+~1f>znu>a^|mKLL(;{TdKkdBB(F1y*9zoX=8Z9fa)&tsC#6?uRi0reXtpf%~0G>q7- zEcIRJmsN3m!wU@Bp0cc)G{IgcF2gn>q# zE=J=KpBB6NCXcE&FM#OJV9^V}ZPJ@TO~j0A)wCdB>s&X_y0SpNz)=)tP^B z2{qR*SdGFmYjPk4<=Za7S+*CC+x>&?mcG?^fNZeEzOM_@60%IWu-FKS*d;$2ltDi; z`WMUK$P9_Vo-G15YUoQqBFR3SvAstc#R+X284?>wAQmej&UKC~q7>c+Qba{#hdmr0 zNQJ=eOp4*_?G<}G93he-4Mr?rJ3epSU=^ZN(4^8t`V7QQw*5W3Ar)2TGQD?KB|N+l zIJ`vM4=NnDY-*2yqelY|D*THAOz5~O3H33_b5s|FIk0PRvN0vvQpH>lbEByQ{fw?ignadVakY{9%imTdv*@! zrOmb&aZz*m)Y9pgXOOIUG*v8snk$IygbWg386d=Z$Njr^oxH_5b$bhpJdo+qC|kb; z8x-M^)bWvZ`P^dTUA?IdVT_h-Cs_Ons;tCXA{WTCNTgPZB(7$7b=|UZd-F~=ZQRES zKJ_$DX&X(`G)>^c!vnY=Xzz7ecCN3=k$@$uDb3hwj(3^Wp}qVQy0T`W=c)a>jPk-b z4Cypu>xniWU^7Nq4^lp7snDj42U1OUF$*!3U+Wt3Ty5Ba_*ZA`^&$i$`MzW($5{0Q z;t}ZLp1WE)@HE2PFrRr!WwlMsEuXpaw87<`F&QZy%MJ%XJDyAJk~Q7fZcEvumdMP9 zRIp{cezI>_Vu_3RafF+lAPh*S1ZzVu#Np^g*pfi~lgb{p)r~etZZ@uJD~@rhrnPnx zgissI(3m;NW@j1dj&A9Re!@I2wV>UXrVZRHCq7@P%QIhMt1uHcrfRO#U_7uzRFPo= zDep0!#CyD4az5BDyWS0c(qrmcv+{Xd9KW;)|B$`IF|JCpUsIDEz!_XRkkQsPKV~IX z_S3pbGO^f)(5F(cj!#>szXq-R3{8_q9pv9Rr3cwI)hii)^utr>h-cSz@A2=dI|shC zSFALI4ciXxO$gZPSy;tXBT{KydS84;YkzbXW{ykxTP$2!{Z8kGuVNT{eJZ|t`TU3M z2aQ6LO+Up#48c~Q;i+0yi>v9o4%FI}ydK+EE_2(2y0hN?lz-+Av^&_tuqZn0}?s-=!@pPhWigPzM>uqho;()r(|o)A65@7KRYAN`PL&S z#S&D0Ki7s2DVDJ*L3(2PyIm z8Yu0v6>F8Po-;5P*j*TH!1)T@q;{i6^cvoi)2gqlW4Ftnx@9-3hyIJkA1`~GDJ`Li z2rq-3syj7F0r8iri8`2q=$uP~JKX$HoVBG6^4WYFDfGv-jk}wdL^hr5E5rKWT8W$B z4to=DM~pE;b#%WO?$+N~W2 zGS#D7;AYU7`)9=7&P_OaAW3Q>R)M+R7z2cXXF))yDnFWvCt@1 z-a8d=C`tRn3C|c3>M^Z%m%X6!om8~ZOO2$Sh&pK6He-<3Qy*KAHs|V1Vihe;dbBja z;ih#%4HcYXwn)&ZA%fn5S+^qaxcvwnVQ&(?Gp9y~=85|qj+}@PyD9#p4WwoXpQ{tP z5YH_lkcgI5h@+5!75vENVi@o=OtrK&6L~OV$;*`Y{y6Iv>d}h-`#} zp=;Hvr2q*YHM0@7C|(HdEM~Es2ezkr=VY}~BQ|=`^87pJaoSB)mbximri+z7lBML> z?sotWVtwEkbd{k>hLV1-iDWTPkQw*e6g@nbtxCD4mUUiWMzEH+6@bcnv@`qVLxZqI z5P{g_?oxX>*sTkg(dKj3EDn|JafS6J?@0LRrEGITM_`govu?ceF1Rj*R;W-0S7JNx<#3{*6K!8;07<**@dJ*$RAP~-EBrmu=^|Xnogu9#Kn<2 z!WZcO{yCGE<);(*qIYrdCHLro{ag3^>GVI!V|-@-4I+>#bMiQ>Y@e;8Pzi$7S(RPN z=>QFyrpgEuW|+MU&NLk=OdY_oM-Kd6|0$Bpav+7%)~hgoWvHr`Nc-|>NJtH)o$&kh zPnw87Gu_-YF$KC3Gnvy9-Hw#v_Plc zz;P9^Z%Nr<8_GlM2f~r~9tGgVvpjC`^W4xEWowFz6Wu1B-A%vtMjd-PvMy9>MA3#0 ztAd_vd4F5-o>m}tbPh%n5>Xbv9*%6jCD6Lzlsy9D<@0g$mo@IVg0{e0#Z9URVQNw)Qo08*jW2C_KDwUTi1px7%#2oJ2CO^hGMYe19ATcq|BFu?(n~ zrr;0|iyy4D%2iGfKPipWc$X%;S&+UvOT6F^yLTdvIATh+04Sr5?RE)iLAnH47#6Q@ z4a2fu#+SSR=9#dI8acE+i}tO-irnn{^P_Be29M2FPDw*WWuC((>30mRmeH8MG0d5i z_yDvJL)Joahy84yLv%rIACLh~Mug`SX9 zH1g9Gne;cr`liJ-(r>IpRyr&;^ToWBiq0fot2Xedme{=BbKUYbPFs92+!!eetP?A< zfv(c)(PU69^~5Ql@&W=P2}lGz@Iks|nmkEPqXHJ7a;HaOOQ#cKoo(`?WPxClt#Odl z5oAtfBH+*$D$ySgXW1z_$%d z8(L}RdaW@|2py)w2?sbC8qYX5ge+W@N(Qq!JzLHt3$epv@?o7}$uL`g`6}Yp8ur6^ z6+Y}oN9t51=JP$0$ck-?G7v!v4vOD(R-xvUH#7+b-B6YlXC~kWp+x|iV;bzE7+2|E ztnx}726$!}stOi|jTQw{9n%=erT5; zE`3?f8#LOGr7&Y=Ne&s4^2X$P6=Ro{OoQtmqsdUFK3w0lD8Y})*nz82C z<|$k>NkTp}CW;dVGuh5#oi$~66nc_ga3r`%4!(7gQV)S#AC~%BVkCD{`hlp7`Gx$u z_GQcbejam?smW&-}JXv zwOGdyO~ef3ebh0jIW;}f0obL-eGpj%8xq_Q{ouXiZsEa5s*FDC(=*UfoWu+XcH8A7 z+%?zfn@~)GbY2SGm5{cTHX!bB)x!!~>NQ+sw6_xM-#>-ob!Pw{Wa3rUps7q3e|-owjlVa`iJ(6K zCM>8Yz?{vX>-TSymJo$#~Y z$Ra3>fvc4V;_zd3Qa^!U|2-#(n=+H{LIJpl|A&hFOB9|=wEsVN#vfsTTkwBd?zl-~ zi@tx&-r}hX|fytS*xp&i@`)&>YWI;{@12;HePjt5@IckN{{J{Ph!n`h=ze6e(OAO)@pJ zY_tR4{zV8UMKm{{mxk~fuXZ3r57JjFM57iqE6{%8@FO#bmiH5$;*kEnuQ1c~{NsDz zE!C~5!_u?p%LEykycq~P$(3IUZw1#;6w zQ!2nTl!!sBm7F86H!4o9EDuR-N|ywlS(g55imJ6?dQ{BimoxpB-ZwZ!Ia)U?t=`+SMpY#TdA73ll;E}h0QpE1Ikx4U{ zlyYr+iswpED1%bU=?^k(1M(y0{8<&n2(aAgtr^NP7-}G^w0TQ@63TdLQKIxo;BEH9 zU#UDjfGFt=`0cTb7;@p)Eal)jxoYnfU&+8egNrkcPc&-y z+PtYRU&uTl*~A*tY|1h#`m!Do0ci7pJpb;)5<|ELY{?D@+Dv%x%@~5<1pj5>r8>>j zDwYn-O)0&xUS``s`CiXYApco5Q|=OoaJ7%+rN6TT_O|rfr-nm_Njzzw&N+m}3n_61 zG#Qxh(YZPJxZ3LYM(YYzqW&FpXiHf=x zSbee1@-KG0jqv*zwqJkfsYgRBgmnNNZ-nc_mB*mxBXdE`OH!U>s_)BSuXLJ^WZF-o zDD3tW!;BPiS6&uP%hPdkuD~f+SwIAt78j7--m$f0+Wy{ZH$ba=-#+>Nc*<^%J7|?paa!jIzK3~uMb6}+A$71?BR%OYMW4tes z;9{-1tUv_x3s|tD1_6^pxL|Q+7-TxZ(_?oU5(n&N^KF#dVY@`elEY+XxU15dzWR;D zke|R^B~fBO^^dJwNpPOEgY!=jQd8mp*mOZ+R^xDzD2X1%aL%h!-(o->#ESeZhoNM* z0pO%&$Efs4WRG21SSLQQ+fFE4UD%b7(ORUat7g%>cq2=$n2%-mMJRgJo=>4+3-2*T z4oV!FvNrXGD6B<^@R>l9RB>etyBZDh+cJFxX^#PMmFoBK2~gMa{G z`wsr4m?C88XsDRN?H;M;t?q#z@L+&l<)$S7a{9&~;tAVU`oekBWyZ5(O1b zSP*P#G?m}HyR_Puokqi)y41Zzg2vr;H*v)TB$2!5`kcn(s4v|q zTv*}X3P~T_L{BhI>=4iw#*|9+PIFPx`B5?Pwq!OJC!%EF*ahkMdX5TtC)FgQb?_LG z%{~-@H_fMLd9gJ+&Dxi%nRrY9H2Vl3hhs@~^Z62_$t>s?;zod9>9<+Wj{pV_k+ULgc#uS+^GVxm>Lj1`keoOtR#u?U zqIa(!F$!3f4JjQc!*V+!dm<^mAiHxv?94wfQL6HZv;S!o%(OqHHmF%;Y{}L_owr$xb zr*(7LUbCHVGK+Acb4>Onk@!0rZz=Eixmb81RL(9_hXskl9H;@VP9n|8PBt>&-|CHn@`0^RoPd^rh1Us-WGFII-)*+X3PFMYbNc%d260s5SsYN!l0{uyh~*A% zKqdD!0#nY2(^HroS>K@HcOQD0z@H321TEr(p-ULXL7MN|(cGNil33F($WH5ZdXNCs z8@EK5k*)qzfTMGYVq-hTZfW-b3P(ALE2P5NH{_|5t3;;U_zW6iKR5H#>xSlP3!5+m z5kuvR3_D)*o4UUPH7P(JiH~88NE3J@BzdUM@#YNP8QfLM2S@t%1&5K~z%FXiMyawW zkwxQVgdaw*RE#7l^3n5D7hq#JBb-h<#>( z+VCjkTf%hTr;hZdr%2GN6GJvGVsnQW;LY>IUc*_lK_iPog$RLjCS@*jJL)?I9pA>P zbKW0i@=$mN*DcRP6BO~uQz&4wI}Nhk`DQLiy&Od=ha1iW3Q25Pv$&+{GYY}}oFj6q zq~=MI3hCp%zNINw;@=Gz`@hn>yvOzPy3sH`ZtZ^G*=P(^1NukPd`M~akkW?MLm$@3 zXY*i1j5-ZX;xPhUicJ5u4G3sNTjLl{@K`X3JizxWbSgA$9J4*vviP`+EXoRfr)jG$pWq!j-)(^S!XV-cYsTd+Dwydrn~ckrqV!VuNFb*uJV z&W%;}?&+fwy+??2mR4|>9P7<@!?)~Wn`9{-5-AR*w57$<6Iumh zxZV-hH&@ryGE@C5?2krKQGv9=U^MAC)`yj7ER#yw$<0tpqH%T}N|1VAkUV=aK)_Et z;@RYxvb_0>IB-*(c}!xoUPE!5`K7%RJobRi-`ER`IVjt=x!U>eZ6R@^6aR*7S30cA zei?f&+zj7drp>qTdXR9W>(xVC@=cyCOAiX$wHMc6&6;CKd zEvN~Ah{I@$&3*Heu*Vu?5d=~XQs&x$Z3N7kw5U%hJ=h(^5GVWBClA|+nG*^3mx3cSJxG%Q6J#6j6@J>SSJd;4vsk`H-i#07|3z>;b z|8$-J62UhAD8UFa;jeDWwEXWf>+w_qqIZP7xiEZ=u*wOxMlJ&ey+Sr8(`vOGSETn1 zIZmvPi?U)p0^L9sQnRFFY!SdZ~T@1HkKKmw0%{>OG`Dax1yraBl_AOHcNLxyO~=nuNmU$Ru#@Rb*OI(%it`#poG@JGkgYP>qd|~EV z7Mi51^#;9?>7m>9R)i^H0(DTXys_N&n8+mS6I*Y>HD4}q zXjad-?hWe21nKg7x3baQ!Bi8I^_j%?;cJ&$()_1dp|;GR9?_*p5jP!JUo>=k>`bJc zZiZZoEeNS7CkDk2FH9Hy;$Oz=QHD$uZjc-9C>tjPxt=)TbvytNG)e3t9+*v}2#&|n z0xM+S;l8@+x`g*hyH||gFTE;c6Z#-6Ql2x!j$vl_*&-%5^Kyv5I)bi-A5JU7OzsyOkC+nB z-mVeS+s2R@6VDjaJb#f!rAO66p$^e{TSo%rP50zp-(Uxt)yN?d@QhM&U(8Xs;wGca zSzOw6`Re6!o6Oy1FJbKsbeY3jm7Abj_265}x_|q>K;Z-|&#>AsARzX{|6;k}{-3|? z|2HJO$>uk}1m@pt$OtAJ0ejY<&Bz~C z@8O!D2xlrZcn_<2_e2D>?k)Gai<+czNFjN;!zk8uH6nPD6{xsxTd(j`EAe}W80Xm4 zboRlwFLtIWq|$6zOAeWH=~1+f4NQXZ(*#IK{`;(id2p({mcSMr&9n*#ld}5KFB6)R z_QrqZcQP(TjfTIbwqUK60rm#P~mzH5of8&ioVDc z)~euuV$V(sRYHap%cvw7!`_QFB$=neu1d5ycmSxF#-3W@au2P@3YQgjtY=IL=D8A{ z>uMVT6eFf}z%b=sHsyEBnx0|_>oW9}MUU#X2DNK93Y9@j1p^EX^L8#DGUkv0wN8jE zODDmJMNXxVW@4Cx1MS1A$K2d zJ`MymvDxHxNKHsAFDGvo7hYWHIvaE6c)IIy3>0-Ez;iU)B`3c3RG$nP1`?D|jJwcc zsXAyzWd~Bxi(VH7k*UC-8}d{sV+SIZW;Oa#Cn~ejP8i)@lCnVhf}KbJR!Ut;18sq9 zg|^3zI&KEJpf4eRE$;6TLSI-ZZ2(k&f*AsBkee1-(r2P)sZyI17WmtDC=JctI1hYq zm=XL4;KtBj`&1CVR%6gJ-`opw)i8%4YZTpNHH=+47V_xVbETTYLc?r4+$@w^tN7ML zc>~68PbE6$ys8gxN?v}piEsjHSRCnE0+WImlE%2jcVxO_xN%gc6pYM3TrbIczfhJN z(9mK-7Wj9$DFh}?xlmtU>2iD@3$EK1}yls(-;2bJ`k z0SPytRUqF|c!>CN1gL8(Oz7KFm$cBcV_~%BO@8bre&4ItiEe+Eb>gEmdWYhpZd{Cv zy>GQI2~&nrn8G#(kpfSGfcNdhNL78|MAVR0U$ztJ1HR3XQFZS4zT6Mf5X@BdbpOdO z1TLS$YFc0^hGN-(Gt>#2QsjB7zRusDG$msH+~}BF4tmDFl-s7n8V(|9=ge2COl@I9 zs6qzayG9?=gy+2pGkKnGEvQRmdN)AjdX9yj(>%mEjG%y8!R5k%TCT3k%`RL_Bx$^h z1Vxb6o?4E9XbjBV0_CmI=03e;)yDA?2NFM=QZ?F;EFNrZ-x_e)TTVYa$2krP5#{SG zJfsMj2?+3$jMD1wp~1P5N1>Wdv)BIi99N=uwq_kVGZEJ9pR4~a8wl;|gjJPY8!NXi z{Lu(vQ2|Re;i!Ldz5SQ^5j7xqmWpFJ)HW+eZPASC^5f-ViaVFh==M)RJFWJL9B`K% z_?kq<<=Xqr1@zoh^=gawXlplFYu-OQ14nTyqJ*tq^k=u$cbT1pPKncodk92#HMZiu ziuPbkm@?nrjV?p{l$wa1>oZwT_(e!-IWb~3pNsEl9-RSFN6QZbFT(9>F}FHVTHr`= zTl5Y!nJGkB#C&ZWQQ0mC)*=)XPQZG##@H|Ol`$prEzUk~?tLHML4XGxg!3xgj(ZMO zy(czHmV*KwlYN}pXe+2uws|lll5ofBh*7_sK$^jZ1Uz9JyP3WiJXs(}BblnpgQKfO z#j$C7)N9-~Cc9!x0zTJYJWn~W2-hez@f^|O3|Dm<*|moPnV>}5j23h}n?SBJ-TH%9 z3(tbujx?WNgEiyqmW;VuUfS(0ebv^kl)Q{yWwi1g%0{u?+i+9sxy`7Zh>fK- zf98hXW^I(%4P$`TB&aY{6tImA`&4KWyQ3pT!Sx~%T>Oa2CICkx>8}?%MzFbrq!KlJ ztjpQw6V3uze6o1SNOQe$%yw@1qL%NQ3__fpA7Pymn~gJ8gK=tw15h zNeSovq8_h`+M&Vk?2^Hb@PjMV3$LPj6U#!Kih<6<8{Wwy!FmnKx4@q7=5yj9r2Oa2 zA4}2vZhAELFeG@oNyo=QZ5j$(M-YXyRop7K=*H|;Tuu)^c1RU|iENXr{c6N!iiwnc z#lE^*K#qm$zea9Rc28^V>zh>6luY3caA{`BBhGIw z^yKdFZa>ImzhTkz@Nqa~FaCh-JlRilIS|sucll9(TPs&-`wA?76-ISx`^nDVk#tZt zoo9A|w?t`vwmIE)S5+yWuiL=o&Y3C&&P!r_26 zDV5xN89kfER+J#x1Ba9#&9Jb?b3t;7FY_8;DKc=bO` zG1dVv{@cxavKqkqPk#~X{Z>S*bm6rtyejoljxgv0 zP>7FJ{-jS72@yA=XKSibVC*lnDFREd`=&rRm0BKgM>$RJewndooOy*vg80fXL#H6F z{LD5m1TuZ&*^%zXF@;;JLmPiDT>dUrm>M(zS$C8>JU|l!{b%x9Yxb^ zoLdWl5X>J52i@$%BqhB*RU_TMmO==8WIRfv5=9`pRb0niRl+1z(~G8-ii3$p?>>1h>Au^$uzK*! zciZ9#KB&^VbM5wOa+EveH#Ei<<(AGwEJIi($q=7Hj)P^s3a(rR@#_0G4Lr~`3QgKW z9W7q)M#JL9j(R}( zG?_2njs@$DIAWa32&3TC2RX>LDhDQoFM}MLLNSBhbZYx>zw7Q;zFG0pf`zc+V7Li499l^K;qpaSFN zHm1I`#>hL_jiuJ|rZ=(*!kQlkS?DF^Ih>R@&H6twCdZ%O47F#NPo0U}pXc{qb=Ura z4PIYIzUYIfSCYygr%K zrjYHmn#ml}>nCxqQj4|fJL>Tgn(S!UMXZ{urgpk_X-Tyys#}c9OT6&L)_cwCOiaU` zbA+8Re*+>U4z`Dgz;R&A_`b(+Fr>yKN5ZMkCXWX{OT=#bGnej5`H}QPJ#&{UdVlP= zoM|PV1FLPtu3)ZtG~)?pp+f{VN*bKZ_XAD|3;SW-Mu{N;=F}3x4(JuZ!k=R*w-Y`e z>|M-j5>FwNt%n~*jF96XFI@K|u`fn3Fiv$H@I^uHa#E5w2A|Q0Tiy?K7y4nG6TSz6 zupPt?lszxZ(x=n;Scyx_o>~Js)o;*`o^lPWTRnD+Bj!4>dsowr%!?Ny3Bw-fS7<%W zoAYfxGkh!{E$!ZZFF~02?YTcaekJi$+#76JRDx<}8A)@3`A2dS;ly3+G-&>nr&4-{ zBtt^b*zzF#=%UKm1S7g-DGpMqX1ZD2w{zav9aNQYDz>J(GDz_8G>bM~k&71__stGK z8AUpL0b(5r8J0WbexA+XB$*cMex#Ka&u6GfbV6v#nsHUW?nCG_`3~%4aGvEPfH`?m z5p7IdMl@PbbnB3x04~xxfl1By_VQf>W9VMKi+kUQR9z@dKfN<4M-5`hiomSR!1>PF$`dEYTVtHViC>!uQaxo$| zYP1EWOwiQ-Y$JlP_^G)kL?|!VniHam1(vflfxA)F2M)oew{~wB=6^tnAZQa^pHZGXKIzs=`JRHg2&A%c6kiOixBH2sx_GExRqmWDnV0=+)NPDyZ zNQ0}rE(m_hf&N8-(T^(s&@31#fGW~&muNG;n6N$iTSz5~8L;>=kRF^b*T#-2|J+?G zCt&5J>A$Eg+rM1-m%73K&za^2nY!-akQh1k-$}tKynq)f_en<|oQ#I!8{-FSlb8A0 z!->c6O*}dJyA1p9OD*Bkt`cmv(UOajRA2#S-T|-xv$NbmpYohJ`bZS@+4=WA@9`%? z^KpuSg)(b5y=tBmeS4UZ*LJOyA!Cc5KLLuAh~j5#(j%6_vp%^pb2eaP^9c5-=%m*h z1aqs;f(|P#`J&_uu~KM;+&>zZ=xLo1S0tNNVNQ^vGMLh*wS1E_Nv|~Ow3Z+GsaRXp z2(X~Fl#?5D5DROgNQyR*2x>NF{MzCgx9?zL=Pa0M*Swr0&{8(_Q+FTs+u_yb<)M%3 zH7r>>)5(E4L0{u-MKV!X#}eCj2-Sfah=%Pq#URct8>U)wT*&X%R%RVJ?1f0}J9=>$ zZ;2{)G;MAkXM6g}2BA&~Y8Fj9jiY9ReMJnIv^3Pu{odbgov%`Ri*&W5dKwWzBY{@xc%=!;7+oA(&O9Bih{xVH zc>r=9nGdX*{V>6$+)tFxU`1B|2jQ%)F)XiVzgptGD_>~QKo^);BNuC389`yFx>V20 zpMg==UzNSCW{LW4QbVm3eYk^j#ooLh-m5$8)0CZ^87xHzd;-Pbtc`8=1yPuNje49p z_o>?@uV?V+sU-It~56%lIB(jf);*@PbUENwmWM#$@$HXQyScVox)McdYZLWnGYZVS%OxSMc zoW+#X9W+~VWB(&Vtf`R$eIi`DY+|S=voW9G62+KEwKlS34H<@%Vylxdm&FBBMg)*q z$?9^#$6qlqNNzs8&rg-CNH*{ITxcgTF`C-UgIUK8nUJ@YRGvMbaXN{+Ep zqz#moOu%AfLOpze3TNVZNa|~4eGcc@Z#ub7G1P4m`kzFj$ zLf)Me)H0;S?F;Na8qyyr+Xd`*etHJ&B`b|1IAT8dppsMJwVaYPlq?S=UDJL)usqqw zr|2R{F=FU_&{r8Xc)h6AtICvmtM=x6MVkBdyu%8Sre0MNQ#3<+iYXV8e&InDhFwx! z^sux%KYq%NeA>P9Wjf8SR&8~hYKJq$%mI;oX}*~27r@}07<&4C;a*o9#;g+PlrN8+ z5-p6Q-){$%x)FT(iC`w^MkLqt;Fq}IW~7C|)TBc!+~Ibx5{>XPbZY4pw6S2BX6`AK zZLq7~o}E(L?eYGT?xAo#4@}Ykq_!bORM=Hal?Fxo#dWBb_*x$Hmxs{-Zf(tPjUz$v zDKmq+tdtOZg!Rr@xZZ@)aiaO45bfAl*KDcCRm+r$Y($=%oWNWD4FurmtWOY@Q;S?~Dl6q~|!R+%@w11|LNs9Pk znr8cgWziznGxJB^#oF|UKIL1w(od;A_!R62jDWQ%6{yqO?^8HTIw2maAPP#S4ufR5 zwYR(K29f0vv~-AxqdyF81=AkkL7juAtvv)3>&-~2yI(nOhr2FU5jtq1`HR-)Wp!_h zdIXC)uoe>Z-}HLye04oDx6~RC<%rz+&KY(aUff`_Soo z#&x|j_R8nSIBp^X_PNy?0Z@&1Wc#E0i9^|?%a_8R@OF+JiK3qFT|tjYLNaC!C&_Nn zl>6wC_x-M-+TTsE6z~{&*mZNX9Pb;1SA}_Va;7EL1yJ66(FJS3=vz2ewr*rx z5uiR`SQl8xiX0Y+Fs3rd%vV)9f8q+Leoge8Rv$T5MXV&K5MKsUh-`b!|Z_~)zI^CpUeBT;y%cm&yscLQWh9~ zrFSHa=My8)R$iefX1i&+jP_9x!5R`AEn&Hml9~^9PmSrBn!;@A6yMF+lJ= z#IaBczV1s`_rl%Y9W$Us^lSlyDJjQ3HDGmcDPc6(suRdz`|vVt*p^&vqZyEHSL$TC z@(tz`2Pxdq1)*G7JSP28edM5OnZSz=X=%TX!Bhx-5QXUdq`<1c@Lpw29Ki~+qp=w66|;rZ*)VhxH|KbzpFj5edhQ; zi&=JQwRM#VsOJb;9FQ7m*)h^8zWZd=Xx-RP7m^R{te2)j>K4MmvC1)VmHu3u0C>>L z=y<0h@lBy@Yf?DtSr{~!e8_xIoRr5(KD2AnS~o3G%6A3i(W1X!i))B7PO? z{BkFC&VS$KxHBN~h1~qbvFZLrZk)}W+|2%$$lVL0pNwVxO#*ws0&%J9ZU9)o|HJ6D zxaVL9M!__8Efo_B{NfiTEAH0kmJ*oOhJ{zzGi5RiXdW=Gx`ofx*Ni zfH2(e=Fa+|h&sW-rQeWJ*%0x6H&=HLb{j?};7{FP` zPmw%;@JoOE3;qF+{g04o0l)X^;N_JBTo9a^!__GQM zuLpd={r!Zie*MSjZ`2>}mVE^@lm4~{haa9r4SvY(;r?S0)4|2k%;`T1kLEo9%gd1M z|NNIx#>2l|D}D(0_VSRgeiYs!2B&a3bNw?6V84*3`riKiLYSQZXpw*SF!uf*W2`SO z*|`S@zUYr-Zd_w=B0@lfQl$no(EokAbgA}Gz&|e`2nr~S_}fl5I2-P-Wx?+Octi&N z82~gCAk&L~h0*>65WN4pCy{8twHJUb=Dz@?m_Uq|?tI1setzkyH}Ss!&BQ?57r+ED zaPsB8Lp?dc@pK3XbJSEdQ|7x zKKSbwsmBkMf0_@W0UEq4&vuz#ng;_IUs~p40s6iSNh|xmx;FgyckCaY19lge%iF1hL;+W*R&kg3 zMYrwMaD*miWPhvoMiRr^on+^4_ba=5m$F>S_MNby@6cjGWThX^m75Q9Th@GUG{0MZA@X^DOo=Y4Vic8xfJVe+yLMai2nNuY?YG zkG$luM~oHfq*{Ro>5e6UE|2|GY?C~JWmNIVe;Q3kXyQZ6HX5lJn1@U(b!9|>KuUGt zaOBG~a&hFA89~Ow(KNJ7KDk30)et4+c@{_&#*ph8H5Tv%ZzHZE0+OdR1_9-&HAC!`*(~{Bd}5@MxD1vq>*1dkz{8nNLE}^h~pH$ zB=^5cs*)5;P|Xxe_^Dd1Cs$vb`HmCeL#tTD5T=VI&+vO0V#G=UP_ZUpCj>p#?>t$G z))Pl9zJ_oxpE{3@0(Zbmwm|N!gAY&&n`PxwPz!m_)2qVJ-B=FyTWyzD7C7SWo-Ijh zpCb`V*eba>olK=OtL04J#zs@~ zZOuJ=PY}W{cwbBM8f2y_=n0i9Hc0tRr=_s7SR&AJ8J_ikMbE|-Z?+>PPL`M4Y{$_4 zUQ(Rm2~ApIanZ3@(3-aJ_K^2iWGHTSuK0NuVl{`6L{K>WiWGKP2P)gBvY7e#Szuk- zQ;4uyMlAft0{P-;%Yp;P{aB5OaoQ7u=Mt7oVS7diRRD!5%wU5HBT!SXZ(tTOU}^UZsz*UN8#?4;|Yup zo!5&A5QFTr(?YEHydm*7?n3#gHVY{Jef*fS8V54_|mN+&Aenn4_6-F zLoDH@R!c^SR%QNYIWpquVhb5~dPzY`Ws9c$J-vWmFe=c$=ay`(f9l~hMWN|6itJP* zkVQPK+6a}h$(6Nn#MmaV%&=4Bl0R;mN<2Rt)A6SOsZlraM>fyePdXnwT-<;V-4WnI z2Ayigx7EDczxAVixS0k zhO8&h@KqgVitf#Un7)-`7A$1sXBuE17ZfaHz3P%UPIRx6Ngo-3uK65XFEy4u9zD0< zvUl~vSL=98q=L**yWwgOBId5Hz>(dz4^djLGi@G}Xj)wZ9^uNOT_~#-@>J%#(!u9r z&Tpa~Rn05(vVzjl9X*34ec?=!e~g#y&c21mzh>_ZuR5Q~hg zm97F_azMJMc*$E0(=ie%qq;*8liBKVo(`?`{yP$%)NJTYot3_0Q{=AHH&eu4yqVA`CJ^f zLk6H_Fu9UEB8cV23P3g^v#;#q1LkS^*F12st@2P?WeFE zbJh2fBLwl*i)yjs`QxX^H)SYVtRqWMK(!l^2xCwJWTs#rE$q1FB>D8k#m|%PWWwLZ z=&1$+NUSP`)0ownqbx0P-z%%j&Hzf;}FwWf1;>_$mtIucAoL_IuMvdxG@$ z8yc&i){32YK83bTNJ}SM1e-8*FN`|FfhSsWoVJw^TX?9ax;}-zC#zF!&2~t+mS*2i zp>M7hz^A;6-0%}oWD9cf@>@#j%q!ChU(;-N+VAQoKM!c~?DzdxOF zXcqBCZ=5JF_FI&Zc+9Pln!wK~Rs;!N{-wnv&^r{FHcv6aVA~dvO^I6HEfT7QDwJKm zh5MCg3)`Lwz8a4hvu64-BN>^-U$`0EU@dRI;PqWXq<4`!Pi;NSs7?o*M;jg-Oge`v z7eaOoZcqX&*a%W=Bw-?V?=Gc{ezu}nyW^qFSUySw{@RZabg}QaMjp>sADcHVafO=C zmH=ymeNW%b*nrKS!eL&pzxgGCHW2QG{$LvY3!q~J{KKT}jet=v4C~S2{{sFO`uy4w z=<&ic$F2VXa=wr(dK+NW%PIl9$Mc)Tg6DM-G}r$I)L|WgZ(p)9DGLrh%7Iy|r$ z`mY~gyE^|rr=K-9djK_F_#b$D?Qot?+6%!A``}xDcQdiAr~rS0_s_)hn)r&@xu*_E$~pTr#*OR!2_zo|jm@mmrrP zMaUwB%u+(hA<9<EZBXBLD3s_~jOVUq=L9(=(m_f71%~)`RG^ulhd=4uC?*zP(t~#OV zX>fx3=%Y)>v(QVntVYS2w-!m~Ni7@&KDQDon{Q3xR6DG1dO7jse5j$lyhaO6R5{)C za3X|G(8GbB|FnS;UTjLuc2lo}iB8ApqA)ayoC0Ibl)Ee6#&Aak%r98dp{Z-k z{c=>&JY#v{Og9OB*VM;T3T$-KD}H4(@aZOZ^*qHrxM@ZyImphMC99{PEI0rU@v|j# ztS^GFKP&FOVDw^rA88}xXX@3RZj$9&K)x(>*vR9cICToT8ovXmi@1pcjU7Z8OS(I} z4vL5~`9f^TV5G2C!Sb5?iI6Zy<`<$-XWw?w@B|^o3~~mIg^c(De#AMkSPtCE{SkBP z)E5e*ySTRqMEEr)eGBfsxs@T;b_RlcLfe_ZU^|tsw+T0m7TkoZJOz>b3iT$~(-ZHv zKcO~xmpFg4H93V#<%|o}bX5RhZv@#VdHX5vKs74uaq_Uo-k%{muRk%Q=JxCyA{;6P9&N7Sd#cpv$F(5+zAQt76RwyB0O`(s$Zult<*I}tL|wNo)%`{!T(J#edSi}fqhCsJ6US-z#e2NC9L#B?32bCg?*Soh%pr#J_3d*ZF5ZOu`zk+#oGMY;X* zkv2jN-)g?TY}?PXii7flu;uABd$s}Pz*Au-i;H0Wao7fEk&S8=iZEi9L{E$_=E!Bj zElsB;8?~UKlkjkAQ7@nq;JGx1`9Vsu4sdI0cwEbkMNmGn_lPUC07#1lcBpkJFSp>WCZ(jktqze0>&r z9PjbX$?>tGvg0?hj4L5If*X;n?9T#SUh~jj`_Dl`H(?gaSsH4TVcpF zk}eam{#!<@iBuSbTV^Nh`CM0Bpkkr`2_nu`%X_TWL^JhMZ6x%{ImB+06^ns0T!D7> zh1fxD3vGRz^Ph`XDx@O%4F<6+EV1J?&9kK}g7ML9FQyU&aq1VC| zV~GMmjI-5>%(H>WrFqEyX8B1AIm;)?$rv*rPYYQUMy+?LiV0dm!AAk*mZ1L@;JZG) zXF_4@Lh0**-)q?uMwr%^m4<=!B>3tomLd`aWTSqTv4UQPubH*aB`GRia<| z4*8E-8Dzo4dj!H1j0=b+wL_2!si4%^n>y_=SyXpnT2U2KV8yxm($+d4Zo(-lkPaf% z4;lFNIk-8IA_37Jfx+y`+^G#jadDlS{RCtt#Q46N7&yTY+<=&8#yvTTGC+}$X${Ck z%~a^)&#jsk9%Om*u-*&F%}4}Xs-9kkD~ZR*{u~+K$nX2Uxq}$jLng1w+X$+ZD`rm` zY%HI{WQ8GrKG5l81^7hh#>;XavWrEKIqw4&}#4kM1G|;FQB>jLzW* z>N2!t*V-l9{csI?np`^nvbtyqE;9oWuz%90vl+5%?rYj-d4L`^s*m=$4jLiRd!xgD z$P6i&f`Am}p8)hrS@eMhrMLw;H6vu%4mkMh3(s_; zjx}WBd>DKW@^Yz$)N(W*urAI#TH6l@9f3sX9J{AAgCa@bvGBa_8nouox*)f}#EL&` zO<}PW-9hctKrbzR*bmrP?m@6wrm&ZbRFI9T;1Cr%IJ44CxlD zA0#Wws3m&rtPSuL9T=BM`+W~beQh!EN@FTkVcuEzG~#sg;I$<71PIX%n+j1+D~n_u zeb(CElHB-F*~Ex9WWalI5B9loH=lP;Q-B)V5eaQN^LD_X`3z2ftC+$8o0Ll<9816%gl? zF%EH295YO>zIgTe1|;>WB&8hf)0oy?3AfU)XI$3T=N8i}VW-;OwO331F=+wI%{VA? ze6Tdmmf7ZU6`Hcgyrl`APM;0ch_{p3HT6$611Th7j;^z`IIC-rXJ?g4;%GEcy+T#h z@{%{r+R`iKaOtpd-sN6}`;4d~*tFO;#MGIUKWl3a6h>s`<$y>QD(V@SxK#DIuS6r2 zw^FVu>DH^B;17(7a7%F0lfqmJKLowOc5BXMrT%`mtN=45_o|_|lNh(dr=d$j$CfV2EKCf?%!{G? zqr;^zA8nnWjv>(4#E%rN6%oOY`NHWEIR%zW9#^)HOU~IjD}FyZ3GoL2@|{_7q`FC5 zi5=EX6UK+bPsG=;b1@n66CYGjEHxcH-KYzaZKAkQRw88@ff&3!(D`y>o#GZFuHrpU zyPL;CUCFCQ<2=a$`JwO~m3a7QP7hZ_3L{;%KQ+H*&jUfq60OarQlwa0N|72?jy3>f zy6=sze~4*!YgjRpm0xz^7V8<5tZHHrRQ2Eqd7&y{(Q;qPUf*mY~=Q<^wM#@@|w+RG=9GEHq~0xn`{Mv~lh6Emj+Yj!&sQoOc4ff!7eetII=3 z42BV3(GseDU^)qOW=`7s2NLRH9}oEtJ_bf2EaP95V1Gg9nEo;rdzgo_@(}GvXS_8L zd1cMz5m+05bB+6%@OJkXEn4!FqU(=XbzBCdq-^Q$AP+(ezrx&WpIEV}o+pH#YkSXc z`H;L3^^q9tc+m|vA9Po?s5Ci%Ea-t;y*UW(T$WIen#$L&Tz6v7-S~A6hwxH_G&szl zEAc4F>#;({l}6Da-IwH5;oTuGVLs|TZr?-ReN%acnoDyol@h_hs5DU#m?AD2OZCD` zNs)M~4caC{CgAv)1KF^hUP8uHm(nAAhSKH&l@c3=h0N(jsl*?-m?MGfx?&b-Ic%4P zI90gY-g>Hg|8e}o-*7;V?j7bC3#w zZ$2d!R59>bWlv;rjj1S*&Jn=6D)87+5a^G}LVZOOaO{^RpG&jdX?cZRU8feniH!GS z7GFjiiI(tx-_+ z9zoULsk0NSd?N=+!tO+uQ#fFSMr#=Ro13~t-g66#6V08te5^qm+7}bO@H2ZFYD-x7 zV${Ru`ZM3D>3Pf`8_7a$zA~-_>E3EO_x1;tvzsD>T{8o&My`V}y8WwhEiQGwx-X}M zEX8*foFw+zCfT}ZOQdi-dvC#&r5_Ya-F|>fPAR1{+H@h1HcKr1PnyIA*B9M=kPH<` zB}DsSB+d!1;}iXGWHbu16+a)lWkE?(|Y)8ZAKpS0$AsP~4!Vz@3AD@65N(yAD;p5dGc=DDx5ep(0Z z%;B>h+1WnPphLZ<6?HFfe9-)X``FtTLqDV1RdxREzOwIm!0jU-;*tW%_H&wtq!epn zUPckBD#Ab|nbfB3(63oJvX4$$5a9$wrbZ3=7ur1OL1}J3vX*CevjGbngfh3cB%QiE z=-Ewek(SS2kKVim-72?FCu_hy-9z?(T$8?kx~dv+5m21aFLS^rTlYfKGruq)EvE7e zIPdt`<8)v2i5Uf`WX|oZmGih!E!y@}(4UVxgyBzvo9Ej5IzFkv`ZLOYObIlA$p6!N zgpi6xX}AOUNs2wxr7GObSDiEMp6?~$sA^h@tS5Q)_`uBcOQC6{HOJ)QtFD6*=m=U1 zBPC74=cCP|z_+%wZ-iVhxR4gFQ41*pEGbNj&>-+z6q+uL>$M&|kYwL0et(!jK~yME=T1`UPva4Y#ZPYj(KT}JNMjFn)B_0!6;Gr^Tcm|vnG-=q& zL?-6wwa*tjU#LlUoHJKAIDq)K!c*g0aF7=?NWH&%#(nN%Ql6dj6KVILHhjp=5e2I# zw&X!G#0)A4Em0zhckXitmMW=F4u|zRvb_u}l$357Zxmxvz$(?qOHLVSbK#q58+gJ6t z8+)YX6fpGKFvn*g3&^R!8Q~3^Ey9G{8Dg)-^pPT_yAFJ}7cYXZ{#`E8Z~~^g@4?NW{&Vh2CXJT`;_TIgosu{?t_E_;o7``tABYiuv_wO!vB|=tjd$+N z>i9hL{^<15&W8b^y(I|kr7w&!bH?sw*T&qi{Iy;Sx50^o2SJmk4Kga%KoH)%QB;4A z5#Gd$#3cy33D++bL-EePz3|i==atEQ66r0w&DZTuus%%MJ6PYaCoFT|-H*_|7>zHP zEZ3jOL%@}o_?@ph>>6@wO*1ZA>$=a?S!RzL}zrPEWbsg{Pk%L!9FM zEPHG9x>t|e0$N8Qq^K;v@|g3xsDFf#mX2|MTrqtf$~@h2VPK1~YKPFQVkuWC%_V6r zU5>RLtml^|!KzbIJUS}PhKQZUG8?A!H$$1)fX+ZzLcgtjeAxtfUnU_oN>*$8q#D*? z>WpX;WH+OWzvjBrSrLF4dgHY^uK@2K&q? zHY^ZTg_3S-zOE)eTkGB{YQHY2V2-}fskHN~AlXLz0(4|06^*{`^k_=1)oz z@E0)ZCHbTriTL-7NW|+ec_(X_@X`U`aPk|pe=;w?Frrj_#J{6F6llaz zFF_nd@~??D_~2YGnZFazz)-x@JuG6BmjhJ=ZJd{zQgW*d0<3Avl3pcEH@Z8_o*nHi zDgU&4XCiRqR-Ybu%_PVN1cj;gzGw0 ztl+b-kbD*lh4|h;+{cVTY$-j=;oIH%a;?NOkB)b=^!b^4PHbbI1%x6Ze1d+SZjS`2 z#ncXwZ;2@7@A9>%f!D^AQ@9{9P6ZZ-Z-V;B`jIYb@&px}6rY(jiz2_s5(w4ISUFmcP4)T*)3T&2arD^MHI6iBL9+aMK>$3930+}jj>JFK$cj)0hA&$|E zkg7HCI(zk4LEqnjwCuH#Nwiz{!wlxvPJa1|n6XV0+6r{aes~;ozqRbFJS~hnHi=$w zS^LR8Sd-yjHFe+=T@Y*lI)zMV)|t>LN~vE9VnHTT^Nsfp{}7ZUWAJd3#*t!{KEwxw zhCYj>Y}>yY<+<5$J#+>2Bi-2bQwzLd8W*=z8+&S7xhSep89v+Vp?2~lCuRl1K%j+} z8}*1cx$baLwdjXV55$qe|PjBP$R)qSn+)*sLa~-X9`o=}Sf&e%Z3`yL`J*T~c zyf)Fl(gu-*o^ONQW=io**{cWXTw3JcQF5E<=NU#k&x$A&TzY7g5AMrj(ymWOAHf8| z^s2uSJ`hSr1aBgSc6|3>%!!vTv}T%y5>BZvrQtm_rSnVOWPhTYj49nb!;*b#->r|qqC~4~Ke;DPnpJsY>BM1P zN!mOg5DFg~u6G84nae&^fp-WoO;o{9m(RaJQW06ert19dTM$GyPzJ`P2lhM9vikO206z=tq+(v{_W?36OfZ+T9x(b0B&MggmB+BM_gD_sX0X=+($fHuk^UuP5X>2ti3lw^&D8k zh+)I3wky|^q3tOK(3$E5w_y2DUW@fy3(d|uHc^x?^#P}0v1Wg0`qx}Yl1=f0RVXI@ zqA{?0;$$C(15cF+caY=4y`=OeLIn3Jb_rxXb!RKoEQn)6*4DLKo4GB_+EgvD@1WV!-Ayq{LK{G zheGl)n?P~_qD1us&UtDC5VJ;fH$|cg!GgsBED;DpqAg|<<$B`$PJAprbu9AM7yB&g zUEv-CHv$F%iWtU(`naf@;D%%8?y~)G?ZUuZu%u;Fjw77bXyjN}HBKYGV9i!6fo-n) zp5?R4*9gV3{#P~lWSypy3uE#q?M4Lia~6w4Elz2ISzhU(>~eu2>Onr4Gfo2rc(fHXn7>(63&L_h9rUq@6_PW z71mp~m#eB-oalqCQ2c&cyM)rvgr~%JNeT2YNMfRWsaAxq{CbHc!Bg!Qno&n}2Hx{X>Hf zKM`7uMr0)N1^|*a@b;E!OCnS(2;t=z<4Tyfvf9QBxnZ?fC+p>3f5m)zAc~VWR=fO; zzM_rsbXQiiEfq*faUllEDbLb4#1*&UyM-sE+3aZ(!9wHDhkCOjYC5(cK$XZL4-5ZU z1g-b^IV~I^9%2*yS(xRW3WT)z%n3C!c@>A!(o|mnlNR zmh}Kz_!|fcs*Mao^7yE|IzVUTI*t~B!jqgMImbau9SCfkJS$|>zUE|^692}wMJ78* zj}8MPhei5*U8F9lM?}aAMR%6u6_sOm-sjK0_-?ShCMie~2z*}80;QF!FyW{1$nOfT zf#deHD19+=mom%5FO+-pG-ifo?hh6bCUP>6)QTk`MF(1o=oi! zU9vTh&;W9heb@M(oE(so$7js4wDFCo#*;rYMlHk!P>9~1jYq6yN5xo|&*iIU&oY#U zSbenZ@SZ6jLP+Mtihzy|H;YGI!Iovke)BetFnjQGlY}8@Vle8cc6+PGN0byyVvZ82 ze0??$D!R+a81di-#Cz`ucnXq=B1 zF*1SWDQp%o-um+v6;vI-to7b(byjK{?f zZTkx?aMW~+NI**ojBzGai%+Z;+S{;h{N8Mj%lluu;@aGJ<0 zRQ-EELJi@?QOX1+b*x&Ba@tdJM&hn;kiBar$||RX&?08;oz7toeCAwx+f)!bBWD5B z`zsM!*Mz_(3~v7SlpWTHK*InWkgJ~{1lzaE^Y_&U8^N;4W99tc+6i{lp)&J~-OGc+ zQO2$?={nIoDaFvObR^M~vH6^(%pz!v_z@$;Tf64n4Jdk(*eF}NC#Ct*@c_}kKr-Bu zq|V=kugemX%_LWLf)G=fY_)QnXj*nPdIT&DM-YJ`@K(VMwH^z`$W*~izJvW_*@t|X zUM(C}ciTx`n>rqSJ*%j+`f1#T1fz(-`Q|jsn(PxOxg%tjtt|(Li1#&*^lxQ5dZj64`{WYiL1P$b7pd`%xoUGwyu7$@NmOVYM5<31th4KdNTkr z$`NO z4}IOlr*absB_Yh*3i>8R(Wy6W!I|H5v>%O0Gg7>@L)3I-c87Q%$y`9Cw)vAGh;w@~ z$zqkZ`A=yT;^_+2wgu>A{xEQdLNuS77y&EF{0+E1uTtECNj!D~kk)jUS>mDV!+G1Y ze!P`|(Y9c{>OIK3pbMtei|z7;eVlY&lfYtPerW&Wu2?3pIYi zA~TK%Jw$!{LFO#pEyE3p9TqJhcMZ%6sYx(ROV_)WM5S@|4j+&khoPzZevU~L(5P@j zyS)GW&9d1?L?em_;lnrVYS(2CbGau-U3E;nL;*%-xQKqf5Nt|)tW#Bc=0iqNz1=tw zmZdv_`0;aetT2g;aU&X4!ENz5rRS&S+u?VEvdW`L)IZW-%>B_o)Z9y^9Sgh{$K1!w zi->`*tHRJp+lCZ(no$!vx1>qp1b3il)afdbtxE!5q6#fiiGAo0G#n7}W-iJ;^U6s}!N zH?i?HR1dFy+RB(N*B$ELH4Gm&d&&$%N7ma|H2!33*Eg}3L^Uuixe**`{2Ylp1|#%P zX*`UdFujP@Tk^%(O^x=VSmxs`OtQVCK1f+rpD-LXV1&OcjF*B=+CgBRP^Tk~OJ-J~ zjehB&_kIxH5maM)S@Ze9a0HE02;^s;s7*>1aT?84Frb+19l7bqFPvn?1*foa>{0LO z##UmmVyCdh1YgC~yJoKN$Z^Q3wO;o20Fdxz9zRH}{ZUj9MMEUNWeh^MvsMB66xpH3 zIIX!kY-UFU23vq)C4keH8% z=~4^(5y?{N0+3jC*p95>aP7c1+OryFRa9El=dp6^nc{fcjt-V@8rMDUNpr;O?+H<+ z!yR|ccmlteBHg3&Wv`Zv_itK>N8Y@hWWrTAw1usANnv8``9fIts9xSap6LM_PHPCi zebmlW2Kp6jXwSG^d${&#m_w0i%$3uV6=&;xzO&|QY?R%Z=%3EajqsT_2In=eI)cAG z7c$QJ{2#L3GAxc|Ya1rGyTc3+EVu@T;O_3hCAd3-yW2o;cXxMp2=0&s_k>`9j}x-@ zch2+voU2z=SI^a5wQAKZd$uyQ8>*4QYno(<<;sqr6N#`hO1*5(#LL?=-g1|$*yrm* zw+}N6*4HH8&_0|z@3o&l-Tf#%=XANSYMZ>mp8lzQye@(1{(+BsEfplqxUsw)nHIJa zOr|+8h9hWIpHO>&Z;_Z0a4f3YZen{6!Yl7TM9oF~QKQHIXqn}o?&(qQ9EGC7Q7*ASNS=~#zX zq)TF^EEHD5|9W3c^#Ign(;J2z(}cg8l7RS|V)L{0+c!Stn+SNk%33VKN&Y=iAy7q~ z={W1M$qqj`x<(9mwWE9l-}oj{^hleJe}@qQtgfL2KA7T)$hslCQO5J~GCGG0D4}zk z-5K(N;Dduhi>7B8ur(eGzRg;T_Z?^ApnC)DN3==_Lv1-skX?&36`5sU*j=1;2N z(yV``(`PQ|{An5K0|V&yUP;TjBNdT`8*s8?F!}t}Y<%7DJYwvP@-p6ffq-cMoF^Jk zj85wNt-P!^3snP%m6+aEkBbdEaik2@dU4K`3d9sdw&VLIw0QP?A$-AU$oXPh^Er=b zk&qWMOQr0K=Wem_n_U=O=fYlv&+iW1>by^eI$V82ggz=ZkI*J>723>HCdc(k-i~$% zX`GAksMJPJ$~(8r&k4ilf9Ucpx6d1%&XQ9Dz zK%X+#W-b=El6r1t6+M-MF2zxWOudZJ|lq@>>ouXB-&?B*q``(R_ z$suETcm1dvO0jQ}T3^gwBSnDh4?qnSvP7mzPkCxD$lNm#b#I-0!rgrGSUfX_I*MuV zq*WsC!_%$JhZ>f;#HTYgca9^+Y2-Ksp4wI}lGJG;$)J4y4892Tby`EOHom@HflKno z^kMWncbup1@%_%p`tQP!AvVHA@ci%nqdR?Rp3Z8Ip(XuGQPtMS3lOu|&`%9`Z(Oy*T3~EG2BGxQ^0W9v+I}{b;AOel z^!p?x_eijC`VFf4YsxY}(TzdPD|hDBWf=h&`!E?3MdB3w;@)WVp&UGpB9FIqE7d7K ztU11RHhfp)f;|^V_Ce=O0*>YtT7KF zx&dX_b$$qX%J;<*w41&f7*38S;X)K)WPa=*N{iV7o4}@{WLIW15+LnnVn&Y32RBF^ z?+29;6M51=+I$KvWpU3bq~~jDhNH`#y4rX4`M)-aD9Ny3|;Qf zj1z4U9ToC!AJHQ-QXr7~q#Z386tWf9_yD5v#ZHgoiiG^4)D3l&rHziGTC4PD^0Z>V*?FH2hrwgLlJ{wx{S%m;z z!YnFR>mmzkrqW6(@L@5!KzA!xbNcM>dt*hr371l1p_rFnpDWaeG0Mf7B>9IbFIsiL04{14=8O?fwG1e;CRwz>~B4%`naR)g7Z%+>_Z4F_Yf^YmlEA>Nxk4=-3r? zgZNE`+`dTgC+_%p=RpLhvb>ru|5Sigg|Mj<_P2KE44C=nUrTf&Cu3^S4fTpAjMy)L zc~=5<1yYN{y}Py(mvPwWbi?gCufm@X9Ah9$)pSmi1h~lWos}Raok^ktdKOJ%WXkb; zTV%==MKZh0uJ7KWC3*rq?e6sKY#nmIt08`oOMyNrkcWKsIKeC@zP9VS44pZOY%W6h z9yWMy^R`(xXvl_fG_PwkcroQYoa%j7X}NYQR~sO+h8mqKH!lxIaY7@h7KZS7zgypJ z8algB?)o$eMM-SOr{y^c^AI7{k2K@yk+#k`Pf>UQ2SrX$ z^#Om?Nq6)C3$M`RR>Rk8YlZ-_Kkb@~0D`YC)wVbq)$WTH0X5XWoNEATFBGkUc=@(9Vml6f8D)hm!ISy80!S0z4D`Prp0i0C7mr@i!AW+ZHl#I6n7fj;g5+ zn<$2u2K=dDyQ{1x;+TxY&tP_$CEoxBLDVn9te!cT`QNoYgz$>f5=*gbV0?fEMcv8(#2(ma7sgE*^4e}gI zc=7Dxe8>m~VO|=K>sRWkfFUUpbmKGm&c0#J^$gQ530A|nJR<>kWndKspXwxX>qM4+ zBg&JQ%4I}RgO|g;7(W#^jHUuZnENFfBx>fb6)=qg1EqchJ04vq&Fb*5y%SDaqCafe z$pq3CRL#MrRzOAt`BTa|@#mj>II8oAc=+K`*U2gl`r%{@2>2?uW@p*o68*hs7wTX# z%BRBNV@77UV&$mk;j?U!K&%~OHU1TeHXJmUZ?ULu6BQk45_7iJ`m-fC-!2i_MvjEf zRqvn!3)ZfGn{D@|3sEhOy-BI_=z^Pjtted7E&xzt^Jqh7l=!{Sl7uZV9ZxVh3!R*d zHUcIX9M1r^?6Tgy6}uU8N)~yh*$7SOW<+jU zgC~OJE?C~~13_}@8!ion5~ATA0@%&X&RdJ)lBC104O(G<48%l*B^A%!;K^4Kbj&Ds;lP5Bj@Ukn~km zs30Aq#RVLAytn z2SjUdC_`3Y+uoYp&`N?P*$8fX7gVm{?cJeU{{u{C_j#U$eWt=c@3*gOpWjz6{dSz5 zAkh!0g~Hc>3tB>`FOYJ*BE$SvW}-GFir(&mfQ3FGTWc1YU{cJ~%TTEeB9CR>sQary=MsZ9>gFi=Q!N`+T<1QOL!qp3;B8^m|Ua{RVs->;PB z`9ewz*zH#Og@?5F+k4}+SGKoH)wyFsajy-{%P!OcV#z|XVcB*sFF`S3R?6OWV*7#Y zodaz5ow$mgzTw2XSu*9u#0+zlQo&Q(_8d!ad(PPf;iwkf=fUn8=A&3yzkTOiOF=Q@ zeCwCaSLzDAIP}h$zk|!{#_Ft^GIiUuSq^jFlO=}_#D4`R!HHCF>M4n<^k1g#G$2;NN_KwKl(oX~cfAJ#%7&=ww z&0x_5T&VclOlOqF3lcXiIi1d(K7hPtH4dC6AU*Cos_>ANl0;9IP`E7gcN3rQ{BSX) zfeGf^cCD5^-G~EQao232O#T;3clX*i>Rp-Vok7y~WMCquW509Z&$gDTEl(+nO3yJt z9&|IX39={c`eyp)%zRhcCA0{h%dKndC{=>225`JY{5vZ#rs#MJ0WpZN#Gn9GHyHl` zeN0Lcg9d?_uU-7J>Nw6-VepvqH$Mps47lXCdeE;*TtD;eY!74N?t$BVWpFYVQ1t@Q zMZ2R9_n}&ba#VK}yC}0zh_{YY9|gUQs#S#I7tsQh6_J+ksq7E4ub~Q%o!A;5Ylb{pkB$4tv7?eG!A~oUWzF_*$P!XhPC;g?;J$G`_;NeeE zC$PV^@mlha&aS=(r`(;;o_;o7K-|{BuTpIiVRbutKYsIIdB!}EmWd_kAo)v9b$&JK zbBCt%6B@cLt~b0ZT!0;1GdbR~#YW}bN>#_?&o4|pKja{PW`Z>b>s$Hp(ggRdc0!J4 zJz2MO?LMa7RlAg)KBl?OCV$0A%I8oV0Qf{d{jUg-dU!!Ff5eL}jRly+LH!Tm@6Xgu zkN`mW1G+F()>Bwx#`YQN-o>;mG1X$N<-GZloF^ty`6Y=Axbc;$^KB#BgPG;~)9!N~ z=y%#5*O!Nf_xFk{ZK|6A?OxSoitDfU? z@CNk}E}G0FGatK~XDX-)ZYcQ=86#xU%)S93IWHawr(9BmWFPQpL1~Pdr$P&|1I6a6 z{dX;RmygNu$7ejSQLhx00{ucEbzoVq9=mKL(;;)IH&M=`=%u#ZiMdZWN}w6=wC~E~ z{c}9xh<$m#-|)yibSeBG<*coePdCp|IIp`iN@EfT|GG2QX*uI%e_KvYZPqL?Qwa~E z{h@Bc(FS)cxP-EmenEvBWbiM$UaUsPJYWV zUeAY0fwuDf;m8*Xt^TKH)4E9{vAR`ibqePSl@7zVV_dUwiQ9MvJ0n3Unay62;{d35 zDKaVg&}GK~H%!_G`q5@hMX_K_HkV?MRnY2_xcLA^!@GbRha(>2QytNl-4Krob12t+dE2r^rR;vs;ZzKoZN;P`srtfkKvc$C z0PEqmBXm$ii|p>cyT}vXjhy&Ri21D&p>S`s`e6Seu;+l^Q;7zOj+ZRlUXDHhq#EGK zROm??+5-8Lj<4phxu-7?!30?$tP+%q(CQLW`o`!mz}+G*4u~8&C)V5>fTiYAIM|6|pz#tw&8J|l_ATZc_eO9MpAJowxE zDPqTcWJ$QuwN>qV6){+F2k=+WOK}Gf zh5YB1Tc`i_NcZ}eFrNX$UZ2?g$G_Le!JR+;d7!Bu03Vn?JmCJu?+x`Y^FqbHB4hta zC&6eaKp1fJJ>aiwPNI_CJTv-m_OXJ4D4}#Y{hKVsS)lZi(7>0xBIDKkV_jvdN`STb z%k0qZBtJikf*!>;;OPD9`T5LS3Kkh+sBM)%tBROj9bTAjxKKE;zr>Z!#(Kj0OCfd% z{ddK3ViYb!fST^iT&Cy+N_4VzZ~HAukO1jHOu!Qej;VJ3z4a~XA8%X~%iK6C=yk*j zVo9-^^iK?}nDEig<%`8C;hjTr#kt@tOfE{*2D%t1|90G!4|Mxwh6(I)Sl76mi$$`F z4}$5sMSG*{=^2=g>5heq77X~0`Z6MejBY)2keJ?5saBhQ96d6D&fgp0Y@?i&lQA^) zT0kL0KUiBErbbLpvwj@=NvM&)DGs*;7$gaOhPiM^D%AQaRy9Akzp?;XC2@Uc(I!bv zF!7x^OKy5zj3<5W3{rfa=r%!qnq2S*_inq1wF|N@sVgzH*=8I)n-tqK)`SkbE-pY? z#dK08NO>z)NfkrYf@AKUs1Z8VE3I)|au}rda0qTQ;*iA8r`qxaM1}<6lOx&?2UXx< z6X7vy%baekMlMq!>g}4NHajn~H99(qBsx884k=Ujji~647PK*7Y1_=fP`KGaEt*%9 zB>O4$_(8HcQX~j?FL;Re$aGG^FD5kF>m11LUiwClAj4+rKGK`Y|B6j9x<`NF9s;Si zWqPrTrwgpB*tn9+_y+C}ge?P=8+vcC+GcKlDO9qfJ@_mpiltv2At&i3s#cr7nB(5r zK!0g<-_?s?&e5_&5kgWT`cN>5h{IKX4Hg&Cl1vscN1}Fxr124j19l3i)*wi(srWDML zm`NTtNPdwU27)=4)qggPI$PU7&r-Wa_u#wf@%=y8#?Qb1{TBYb;IQD;-~W6N$G-tl zuRaN$W`+b)FB>N3e~9t_d=Ic-Mcm3)gkq-pn(ZD3x=&Nri;Pr}<970@01nO7_V+nN zBCgT3#97?t-;p!FvO@R~ZCFQD;G&u# z1?kdJ7YM8Lw74MISQFcS37k;UqR&x-A+*Qlu@#jk*%*cQ6)`SUzwmi{L5LBfyGra_ zNQ5jO;HDTsN%LATV1_g(juF0D;^sgt$onx~lp_2Mp6(D=Kp_;9ZD<%(WctO^y=`Wu zj1T#br@IcDSr3pZ9G-xO(b(Jx6^i#p={v`_9S}KV6W5$m1mrDT(Dp_p+_U9vCHzzw#sZIr zY9RAyS`##H>rBHWu%$Z-O^7B;X`B*@%G6cilYNEqB{A47Qsx{bKnxi4_(duIv5VGu zp2L9yOQ9>qXA=zPk>!w*;;wRq1qf*}>fu8}$rw0wHpvs!Ns4u>dC2-G+${1wuJUO} z*_!O`C7wA-+9#XMb!8um=3ayC<+x#s)Z`fve&4|n$xQy*3K#dJzi*Jji|g>lgY74k z#Kbh*sBRl+x+N$DnGm%s#;G1_n6N4>HPA$$IP=97#7EcW4BC&zOp4XbLr zkdrbJq+&~izK{Vv^0GcC##L;$Jw!YBp^T-q7t<2f@fZQ*B->2o2(bP#h_x%2B5;B- z8`sz^u-p{7L{4fq=vL7l)u%j@zPn%VMag4ueh(;a&aT=%r9F`vI;^DbYki{n-M;E! z$v?;^P%0zJaLOXyF8figrAHUfC-WxuQbQ6yqltNwRaDr+uR2$YJTl$$ z^m$9Z;5A&**kleFrSa~IAVWA8=#LSXu9T7m`&bg%!?TC>fJRTmL zz;@?#?`GHuU8(lE$8X{vfvLushSA(C%Vs;;db-S@p7cWdyIroY&*(P-g~ioLY9vOb zCi@<)^-@KS5xgg}6Jk%f0Qw6rw^qm5C({YT~R z|DP5*asOH6-y;GuU)S$-PQnh4m*(GJ1Udi8K>pLHOzKJq9DPMtf8s$r&VNxY{6+LX zAUoQvN)Q@91$yx2Z?`P91m zAg2&~YvxNF3R8a4D#h&E6bLJT5V3Sb;;1*FcBV;ip{X@{&(cActaj%~8>PRZr!4)p zUUewtsHqMF@L4z!IzopalyPJc&i9v^iGl#h+4MEWRZl-Efg;v2(;-SP2VqxbU?tQIQhG~m;-#RfEf#D zMrTVgc2ABJk1}u$-$U%|9X^`6jtq(P{BvsqTOF>?Qpgh%W_wyZXa>*I0C<%oP`NsG z3IA~sy{#>JhrNE$F0gu!x@W?n4Ex`5b$0TevUU8r1C&Sh3fK7@P{lsQl6^&st%rF z0y2Qg&%2|-B&b+DlvAUdK1vQ7C%Rg3zSbdEN;|PlM&0k=Hfn%9x=l7d^ z_k^PIqdofDtz&PJca@fXz)pi9A3=UOD8aZN|I1>KC-K=gz7UGffRlXY!@)=T_1(8C zW87`g5B5aeRF3qHpn#?e)F{;)>e++KfO(>yv`5p@O>0fqv7bdTUvT=LoVcs+k>9LI zW5SsZjxRH?`6o^GnopKS|irx)E>k&MKW1;3HH^K0D(mgFZp*@`M{R-MwjlDswV*sb5-r{*g_Ue72 z0ACY$t4S3-Aq|#$hhrtcG%K=_h-l`CcR_IA7Bl}+Skf?;D|Dt^IiS@MX4Oee5Pr#oIm_Xwlhow~Q07x|9QOLUo z_JAy>2!+t{P>n*paPtO%UX8%%S68#!wx-1C5hOLCUCG+O$awu7BsJ^2dU(=Qg^WLp zKskYs^xnd4Wu^7jv&~+PiOe7Ja74{mu%ULbJ zP=Fpg8ehj`IVBfq+cHVtZBVykzqt0fofbsPu|GvmOi%!rCIJbf8l z4f>pfCMDHJZydwMSf}>r159L3hi-^?`hzM z5C$3YIx-}lI9^^d34;*ZBY>X8qZUC9%JN0>emO?xJLk#gWRFdRs5QW(Vb~?9@s`ZI z=GaXJ|4IO4d^+t`uMLtw+~?0EE`44{Vm~WZas%5SYq*mfF zEb&FUEW@Mjl!x?ET*;g7QGLg%H_9MG*v!B<+NW;b?}_6q4irVx7q5Le`a~)*wC50h z;c5iI{Ll-{1KCMV@V>oxaBG;Dv9)7P0j^?ya(os{^{;(!KdEV+U!~6FCj_5gZ_pCX|QKJls>U&!BN?!Zoa+UJ5Lqfwhfl0FOfGtknmu=y-NkF~Now?hZD;US+aCMW6^y|-X+O(y?F zQRt$_=Kxwp?g-JcF8ZKAPB@|J;a+uHj^q%JEx3((eHip!_jdd z2Pu{MBV_&becYLa;}*9aZ|`JJe0wdth8#~jZ+3QsEUWngyejztGW7jGk3wM;Vi8HV zT+%mCwxP#H(6`2ql^@!Qnsc%90WZ&g#EgyK$sLe5zJ&krBfLj+7M2jeMzs63J;GHG zV~ZqGPF8ixLhr@+fafH0&v_#DIf8?6{)>*>eO;U|K3AcoCwm8_(#rK?=hK;=#<@_f z23+SFS-<>^miRa%4iByuG*!NN<`*o;feA^F$+)y@{bVHGPo}oABI`Z$TV=z;ALo>w zNl-KpaT6yB zA8Kjy`BQ%_qT ztRKc?p!Lp`LUd`nK5Re0#|-i~9+IbOc9|!3P@A-<4>=j(u{&4oERm)Td5L>}sKiKx z?6eHR>S87GPJ*Qtp9_ThrWQy=iPfAYe{MvQm~h8JU9V-Ic&gvmGb~G>BE{x)2bvu3 z{@tJZDBE{hz*goSu8xGD7U)NVy96W`h z%;`c8-XoYWi31e?nc`ox+NTKgcu;=(0Qlv*k1ff5^S}J)9k{!t>Wnd$%pz-pixDDj zs<`!cn#tLFmi`4(Dk5TDPvcT`xN3AU^OfzP*BDFLy=Kq-DlO9}U3s=Z3-oEm)8j|& zkWo$+v9eut{#O>!b4hc(#9PTw_K~l}NE^oUwfyC%gn5r&!~7T(#v=5mdz#K}+0cOR z%|A{9u$dDSAu6?Y9WxH-n&g9A(-^zQFBjz+%?X0; zX=&?fL=1rr#4?NNLGpYKtpwuHgZr8z2*<2_t@5M$_JN6eZQ{RQOaod zFXZ{Q$4(3e|8(Xf9%)xP900+R7u-+I-DYclV_8Lai@pbFI$oT$2^u_lf2^Cxmfci5MTB6EV$VoFm0Vw}k z*SA%B?I%tR2z(txofvu{blzL3sy>gb*?@Cw}&ikVBzb&U)`4zqY|PYkGJdL6-r1(4*m>9f`AH8N`; z!|OF=Yhc`~W5rD}w_M)KU)_%i-iamt^MEg5lwf)%;Oj}`q=wCZq(`4#q({>gksY@c z7|-wl(AQ6;VB)%&kwf@+8jWHK*Ooe-B9VSRoRv%l*!C9|j@)#oNE zN$i5-qZKwoK4VI6mnd$pS${-tsf{~i<19KDy!_N?wBBbbZGPE@kaF2B^z6#j#V;|U z{!OF{-4sFFyR=})px9~~22%PK+mP`VF$p#cWa;lEjr1MLS#MGn&sZL!`!Ue3ep^x1sL97VqIIY*s* zB2N>%Tc*ij8V--WvctFcyiCb*MV~0+^G9Ixey40ZFyeorqY&@U#xzc4vrPI)Hg!@c za*-O64k~&3y*H{o=fs_I5P!{MHXbd%M1;EZhY-NJtm7dXN4Rbc{eTi8KO#@D4p(S#4RSq>b4s-T<`F6igv6lx*x5I2p=^w)iu>soE3D^QM{_> zp0>?YmwZ)>34?#Ot}L6olkr~k@!#l+GFLv?i=Dyfgo%Q{_ z4Fl|;4i3EzqSkK85?9|&ij+%D(E(jkh5#X4oy&xq3@jbJMyEx z>$YjL*KE7D%Yw_t&f6nQtCC=9U5YQ9Px~utk>B2Vz)3CRiQeoOTw^2r?01ME93#@% zh`XAt$OAGGJH+mnh-Jp%pFmtnq`9o)omP#vMy&QTTGqrysI)zV=}aLN&%kzp}|M_!8{obZvdkF4rEY z1-kKAc-CR1+3aO}a~Be2-DXKZcUEz6?W<$>A#yy9h2k3zEi&!;_T=x?at#NlyF_i8 z_efEcvYXOtM}1XTV>|RiKl>#jRpQF)VyaU9i>%1=e%H>N3H~}d z8Y8@5OF~&-Ksg`T789{*7jyQg*n$kaGqh|;7Kq+hJ5)p^_JU3{IdsnhQI&o*66>$} zKp5qKyX(_mo4^caU$k?srL&dzVY`s9M%d=)VW;zPtM%vLsvj3abNLC>m1N5eJ;q4( zZ#DnS)KPK@OelLnR98>l&OjIHRX^?oe$8KX44-{9bNMYoB9KOKe6Eej)@Yef)~qb1 zMpz0@(!FO!5MyP}KIhhlfli3UUBfaxW+aAu9U*>sSwLan0X{#dPPjKR!=aOCI=k90 z7}?$B_w*k&tyxF8Etd^Mh-aTEN5rXPpp>XGY$VXFfzFRJcMoIT>y(}?WAPR)N(mz# zE0a5Wd0j*LnH0$RDn_asw`~WDV~$cLs;Oi5=Dl2^16smA&mVDJ2!zB=ERxogdXlHH zKA64x*tC(s?gF{DI1Y|rItl6C-v+6>B1;_Pb{3Wm74wt?cK@FfHYAVNd7r@p_!r`+ z=mGrpx-`C-#v-NuZx1MEJ4e(1*WvQj0?LpM@6Xzk>kR}F|37PwdRi2YpYsb)u>}Ww zIra*Ie2F9gBl-MOz9#hnn!^#2z@DqFe{dGxH9N027n`vj##2 z16^MYPQ9Z3E2=39__xwN83pWqt@D3TH+?F4smiy#_%Hp1W7ft3X<+^{=4kL%ERYRE z>+(^Pk8R8Q+QUqi>juK0YAhdjWwXz9noNC;m8@0XKz*fij_P9MSZP3)FiVgUtExBe zxWa_RmpujHv9}RJy6<6|`eM{@IW;674cb8!2m1tGS*rwD0@;uhha2vR@OmyFF172O zQ?JRy4(Z9}H%mpxzS~uU5c`#YKc|(t6hq}5 z^*!>NnL}uj-bms^D@)E@v$O@hs~fcX+uYRCII}6#9QGPnrv@#tAT(`FvU&vk(r_PE>w0F<+_-6%r31rqXJ_IZBA`5UtR~ zg2f|OTIBZ1_8^*%3E8l9mC-wT zK-B>p`H8)--;MlsfI%kJl%oD!#8_Lo@e8=S_WMKv#lij4I*tyxFJp3?Gv&mO{p}x2 zWes~C+jDqw)@whYl`JOQrM>M}iTnNqWga`e_6X zz0ej$v3o9QpZnw@!2Uo{kX*mU4L@tg+Q(@1MC)nItZ~4(SeOx`v$>wgGM0w>=bcnz zgy)ypHb>B;@Ezl26fpMd zRPUMgw|7f(*#)T2gnvXUHs7y>_h+EgI38sj(8YX;U1UtFskYzYW`v)w1awuy)cS-nJ93IeR8q4#Nb#;rGWwrjw;3 z2qfumaRL6!eZ;s0J&DENmRVN*2n&&N(m5ogw#fKRQk6o?(`03d2FJkJNh z{tw#%Je3Nh0YMNux}gsaJ)LcI!r7C;hdbVHM@284+5K|;b>lz?bb}`|=i7>KZ&d&4 zIVm~9Cbkz99u|ev_+1zlP|y}8k|Kp0|28s}6j5@R8)e6+8+l|aHI8L^WU1F`P9&h} z_m@*pB)X1%T#~KS5Dv|Y=cHzWX$Es2P$Y#8)BMHX1eBO+Mn;~lS=mS&iAg#XiyOF= zn-T;mf~p{s9j92RHngQ(>dj7U%aQK)$pwm0y?+3GY-jL?HLH%SypZXnVe~M=Z_B;kh3-u zE>9$``kh?`NRcaG9G8t5?O}4vqEbxaIo1MdKO@T6swQwF?U@qy&DE(1X+%}rLSYe9 zgngAQs1=QsR%8}VrI0rkOZHvR)R^H0y7Cx&^#Tph?3K*F5o=K_SmHjaqyLKGhXzXF zJKjYiBOSP~O{49w{~f2&2sEyT-GG@-tj2+ z-F)doW`=qE(!vRl}AKvAA_>V))ir9G%AX2;P?9bkb61XW}ZNA8L)heT3JQc^9 z__C$TnQuKjt$l0XF6Z9k9;fvH2}tUX-^+ut^tPV1>@G>BLlcKJe>Z;v9CTBQzJJ^n zYGPA(5*U=bb(k)mj?<;JXL~Sob>a2$=bfE{linn=+7?I?q`%H6RGi4l^RW2sF3_6l zH|y-selr(*8pecG=g|%=)?woZQPxnr z#V}`mkdB{d+H&)&G28K(a#$0ca)GxW_7L{%V|4n$fBIAq?<~Njh_z$!K_gLlSwPOV z?jg#qt{5l&+f$#vr543#3dPK&OE}x5;Y2Cl;Q}-Wx_}g z0Yp}8)LRB(5`(@rpn`eg9h}Y%k3=?oSaWB$yNG@_{DkTbV)+;=Q%IeSRYJXaP$DVRCzK45Ns;xt4J^(S`Z zR2T#L&rmv}7K~^F9C^Ow1l0!kb_Jp6vcL_@e8HYpBu96m&lM^?u&HGl4CL@lN*(1- zt(B|RF{vAI7^(J5sj9!0Lp?UOn@vfr-j3LZE9&+~r}?q}+bdJn#TLCSH1ZO=PZD6^ zINlnb2#uAsEfqk`!QRnq6G}}mc#}bN8Xd`6o#qd#W^fk(i2&aC1hT=Z69DI3m{=&0 zj^}BY@7X(ZHW!f9%T521y*pJ}cv0!s&*q8*tLs<`xz$hMnv$aafUB{<9`|B8O@GU> zx7yOwqM4|-NnbT`C` zBUmNsRCyGf#{g<|uR)MEh$AuNDc=RRk)121eJkG2Lu%jf$|8;|7~w;$IMKEu4#U)Q z53uJ~b+gACydMmK__(hs9oYS$!%tiR_}v|qhOFm=JGszl$hq=dK+gsCTJ;!VY5~H_ zdOin*czJ5E=JI&oFtNZIvVPIkqkY0=G6NZ0kM!Mpw2|tBTe%vA zcRHtZ=B(~_-ubgveNbT%0W0R%vF!@=ShC?c3ugQeOTwYF2UZ z>6?v56xvQ6fT$0|yH34)Bm>=GzEIMZW{?vk8k|M12%&2;qMG1FUKGzi>kG$Ijw`GS z%luiiFfa@8t%k^2Mj%o}TEQd>n(7zw%~(>RFZ%IzC`tR+b)CUDYM)dHb8x8^@1`!> zqQ1NxCd#3jPG4K?tZvpC9|(msLB`Q}C?8lnAxqmv&`_e<(ucnCT@2~H+M9q(BYre#HZf9& zXH}QRlhGcFavkJO$Y*04R_0Z!&Y3~p>lna@2W)Ir&LbivUy11w5Cb`az&@hbEg~DEYd8u+ zt?D=0#fd%_cNkA%M^H25^hwN7_vXtD@-0aN8g;qfK}6P^IYP$^TWGXI3kE1dvtI7{ z1J6d}3D9T01_G9>6T26q^s3#@LFIzx2Oy>^Ns0VELDn zs;=|qRztZMyv1QXFg)Dmn0nh4|D^Bb5T}F8G;x|v4cUp|=9RRHlOvzcy_d_)=(}O|z*5ot#vlghPLO*F`Jn2DS z0oHi<8su!KDk{ zY1JIsD?-vSu+dR8X25$KVF+&#-qgBWAg$~W(EI#wCOMjN%AzsX6Pv2Pl%;XiN3`IgKCj};XRLpH@wTKY z+}J4(3Dx4niF@(3Jc%}7M%-!Nv|v7pOZ*jhi3Zj%cHbgG^*VH)A?f{wKE*hH-Ro|j zw!1`hP)M?UO3Hr@A<@K)+D*r9>cCcljex?@B_Mqu-O@;RNq0yn(jXuyilp$K9Qb_wJ$ z5AKhdot>SX{p`%_?5x*OvkG?}a@o7?Eyc!bJH?2yNu4ja; zvrwKTc>SjZX-%N9?%=)NtuLjc-a)+I`n%+V#Q^myud^PtSW#s?+G<0IDs?U0T-9Ph z6}-R#T3E_gTZ~It8?OVV`BC4}^fku@%)GJdQeBj*jayE5U+${z^;NU{v+B+us|P&d z5jK07a4p9HAj~DIhkqZ8HFUOj5% zo}VW|go3M#=<%~FE5mnI&DdIL#Tp-?EAkqiq^PT0peLkZU9>u1zr;jg*QXW5Nha3a zvI-Gtc|0X?{)?Eqognkcl2ptR8uRd_7uN}xj91%GIFhgJX|**WxQWAsQA@q-o7h?-swpr%m7?8E&HvH*I@`_?A?WJ(4&LnG5_dzzB?ZSU0(H$9%S>Ypc$ zr*cfQTRvI!HWkRrECt*54tm%d;MkcyYo=f}dPH0_nquMUZLMfZ(2R({pUu}beC{SK z{nr0gT!oBc!R!m~JiJX`NI$=QVYuz(A$ftFKXM#hr4Em)28YXY_LOCVZt4!R>J65z z{5jtFQYyX@?K$mOomP+j;>Yhvinif4{28B=Bowf1U9O*nFbIJ~)}AY*3Vv;CIG*Lm za4e~43U{aOCScGSQmfBSG}X4xu(c83s*w#nEmzr7nfD96ckq13H*|bwm-^mdDSmUp>H3^gS$cEzk8YqJy4kMkBN9^2#ab40f+gM|7>6)&2!2i& z50gIDoG!m4J}ZP!6=Md|@17sOaG)5`jhc({LVb$Y1C_k(Q{O?E`C;rw+Du9OkFOBK zuF3b477=TkLkF52jviQqAys_!eL}%*^AXG8o7*5yU#2nwnBp_DjQaQ3;=yt(6{?Qu zAXe`n%O~vFIz`YbSRa%&y|O4$T)#ghCpyb?I#yP*7-V}NXrjyUFuO#8Xc>n>7I?Kd z=zzgCyJ@Z*(St`&BJrhNLVJjclk8VA)RKLNdWx>VE2SYK^0eB;BjuWBgJBnmgz_41v=gh8dNj;5HOg|~@)t{_lXMGmnALPJ5p%Rs!2FDx za)qPStND7kl%$tzm_@a3H-J&ao#43*rEUtigzhJPI^B9I(=?;D=&l8l9rLx@x{Ude!ZW8hg$(FB5D(Re&JeLa{xZ&#w9 zB_xlZTP5XjM-8{*s(wVvIn53}8$N|jMPe_(G#uxn2f@0m1Qg^#m8=+}j1q84zS5#L zSl5AY;_9_{CY+?E<^zm8L9#jw8W=AWu1ZSqQL7$A?HHuoL-g$Ld}B!_!K={Z_X7~h z*gu}jHX>hDRj!t@9dFM6`iu@-G@Zv)EM8-7Q|wX{b*QC9Q8UFc72o1LB>5t>g^q6p z$nFfkm#xYvo3dcr9J8z^G8<0te8~B*JO5O%zh!Bt=|ji@dc5tk-J&I>Pp zBNTgB;GX!F^nIhEo+?Q=EADUtn`)Hq!)!?-szjL@(CPzJuuO?m$wm^|&DWb=g zh30y(_KLY+&6tnZD)~%ZCWB=Qu(U-*FfpJTU&^ksp^RmmhL!fUspz zN`0o0l8wq$@u;Pgd}_W=Z8wK0=iPD&f|*G%`H9~(B{7@j*w{$Zch=%{72^!q@5;ce zD^Wa8r|Sm~2s!{4qG4FiltUvpu!_{_)W-rPnmwr;0dtTm9lEE;Po}_vwbLU6Ssjnl zp1V#wz?$%`8fHfYOL;}UnyKbR%|8rp4n{=P_1aJKEiJKh8M;~~?Q8nV8WB*+9Iwgp z5^q*6tvaLPnP{3F^XN0UMZM?xeqsO%&*g*((je_)WvqijOzQPFs_hz_iYT4dLx!?VK zp4y)@`xT0j>F#`^z$TKbu+h=zTPjPkANl<+o=&4#y^!0!XA~Tma?Qekbo?15CHnNU zTd>1YUHVbDbpZHuxnGwjpLHE_da4LVciCsDoHY z!y_!Z?rLhBb_yz{^;NQANECu^UwFKPP+l(ZA%e3>EM`j(RxZm+^{5Z zeELba>>H++wZ=XKwU5?`AQM+6Nj}Jfin9)06$J;sD!3iKe~l*k7?1g*R9K=W<6_-x zciYuW@7oU5BrIugPn)tIT8EMVP)D~e%LX@x;H$-}o<)?L#>lD6S2orq45*UU4QtW8 zdE3`r7-b@Rf%fllo9p+AL)`(VDNzNYx*I=H#y!OXd~2g^TO(fKjtIK$$Q&p=niD|w zNnUC^tum})+(JY4m#Cde#ay{kkHBipZ6#qp_*I;v(}F?*Hm!gDA&L0YTl+EOO%g)k zOWD|n3xOPTf>AkhY%`Xp`tV_J5BVwCr1aOz42G$iZ%Z93aU4Z3*lE01Lm*Ti?Zw#ieZ*8{zuD09k`|iC`eSz%M zTaG@yPmNC=gO!fT58M0pFivONO?DjvOjpn(q=<;hrx1O}QMKbf`8oh64 zocPnT^za-KXI}4nYF+f zhT@;AAmt9{6o&aT9)K!?E_eZHr!10JIbV;`M1OYdT!cr@9+J44MgoWiIeos`nqaue zt&6W1u$zPZGqq-`P!dnkCD#~h0hvMiq;Pv%Z8G|CPx*0Gk9@_6^g~EavD8DaXjaD- zFP;%nB9osoy+%^HDpMDGuyxj97?tzmS;>C6;?g~uw#QWLLl3LJSe}Y}d21ZuLrP$s z>G#r?@tjILYCc{x=LD`3Z%MZ;%BRcGgt2hL$b*?1d_E{X_QjW{M;S1Im7SezZfxIO zVO)Cn2@gygu04^1uZPZ$a22-yQYsvAgH)_frBu3XZEkJJ?IgBfi1i{xqNws&Qb9Dq zn#FrV?waS7$_=Ys%pivKe0Gy%O%J{i!ySmT%JZt7~h zU??Mpa5CJLSF#@hyoC`W9fS1*MYuHrEye&@Fj%KA;*AkGwhABt{cj^u^Jw&I;u~nL zK?uZT3UJfaZ)`}+6ae?eUWMdM0Uq3Adh?3yXe5>Y{fb%uWMc}zru@vK;E-fih6(-P zmyxlwpGoxtN-!uQusF*Y6`KBKA>e|BSky0gIGYTCMiG8IO2K3>!+v4%oJ0BjDnTD4 zM9N;Cp7S2lH}*Y5e;vk@D~Rz2Kp^}QWc>pG0#+vA^;_Op7^iq)h%5f1K_`;;>(d@Z zj^b~T#7j{t1odntNfQ!bId4ma^^#3nzUify z&xZEGM)eE_u6K`*i9=7=A5kzkeMM>b3<;b80KtmiAS^nw$=-!Z1NJpgMPCeg?9!}t z{&C}hXS3k(prDyD5&Bnz7sXxlikJ)tu>qCc1Euspk1J+pNe_&|R{4PA`xh(U>G0P1 z*l-{P>CM-j9^}`@dau1T_*ZDZj(uC?>#5_YwoNM9;&Uw8@*7<}XT%MD)~exz-hPN2coJ>CM<%}?y4CwPIo*ZOEOQ%K<6oXoCP@nFn2`ZnI_-z5eYW$jekCmYrrS)qB`S3_!+e7E z{)*K`zAllwm)4G8IG{1CsleHQAkodu|0BD8(Z&eH@-R)>PlFYz60{Zr@-+5kYsVdeN|$&P4s{w@t5 zDr>~GBgINlt`G754B!G!fM{|s4fZ2-%cvI0>GPYMB#9=?dCNcRQlv_=xtFQxXs4)X zm`}z8ZZ!}x`+kk5{>2`p(UfHrm&t7DZ|L)3C-Yr+digV25A|oViHVijZ0s5w@(=T? z-10E=+nHVIBh)7~8*AGO>*6Y-lxwkCjql5gXLs9tB%)hs8M>?odz6b%Mb*vQ)3h{) z^OdLokoLB`U7R1J8~s9pv<`;SKxX1%uQdljb3M`0=%K3b{8Ag|;`rz^Wmbo+Jv?m_ z)Ou{>H198Hk`7pMTcoQ%-wj)yZU}wbj3BN+_<>@~n)_g)V(rZQp*by(vA%ujWkde! zwU2fpt?BwB+m41`0b4ty74a2qat2P_|NK*dBY-huFN?4 z+FzIB*e!~aSROs=DaL1&XZ^*b=pXhr!7`W4>O)s&UlSZU;*{)VDW_KdPF}-h*!dzxD8LYsumufx~I?eRJ#yp+x zX#RmrqjvwL@DH}}b8H;hQT0c~euq=3iJ03M`qQs-Cc?hJ|0;MB+aZElQdX|O@~%p= z@G?%*Oj-W8PdSU=hgX&)#b11+rV;z@4`MEmg&2jhO;vF&_{oKIZ1k?x#^T!wXTBc zVLvBWgHfx?eK|~xljKc6f)yQQl}`K&$Jt!$sakMgYwIV&ht~Xo8{0uKNo9OE>S0ke zOxTU}aN#F!-`Cca$FjKd-Sbg#9<4LADtdaR!>XU9*HUf_o^2ZB`5bzlA8h{MGgl&Z zy6N&j?CB${RF3;IFXb(ySXrYudWz+F4%uRDYr>=MpO^`t0*>fNZPZLoB46!X9{b4H z&AY6sE{|Su)lff5LNWBk$zO`f5UnV5nOB`B2+&h|GWe3D%UXelj6mT5fah)DczxvO ztV%Y$?*k!k4!~wzCU1D(qz(${zLFhyk-;V3%^-x`&F)VjiA}MO9DO`5Bo41FBt8R2p_dMV=UR8UA|sCTLH{`hy-gQzqceyPO$ zIS9ed6!A%GNNhPb@&mMsSE=5s00sF|V$<-!p1`6yS+&%mKEX%G9-Z1w*BVaLTpRhFUwoMk4vVQ=lb z^8ANb0pVlpC}O8rub-}o9MJ;IUs47r%Tgh4<`N(~ETG~qEui*{jTzE=c99bTd=@3u z*VuND5Hxqd1*G#~rh3f_R@-wN-*|b7x#(q3lSLxQ~s%)<6h1B)L50`pgE^D`h@wVGqgi z;L}nvWk%ws0kv!UrT*E)_bWmHb&h54LbV(+<*vPOtH|z+Jh1;}r~|&3Ne)7J)>Y`Y zsXNI~us^UT*PmZWiXMsv97RnMbK{XFzTEw~Dg}=^HUa*7kJ;B%LWkaVfYh!6NPkz2 zfbJK!HJYwg0j01zA!S=IyKrm^aC@QTbPMniX2~{V{hH#2?okY=e==R6XjBj{=DY2Q z?hqgXvmx&;Yz#1$QT>mkStE+o&<{{jUC`|go#f`?1v5(-6D-sT{{yfH+vJcOO|W&L zXtk(+Dpx?!K#(Wf#J5*r9-IQq|2Blx?3UF)ZA6)@XV7Fj)k%2euu~C2&uyL@X0BvBjGk{DtFcmBy z0b~pfi2Of9GSgG^=qGfnU(o;f2{-8E=s;Kn<3cucAgs2S^M%PBIlBMBY6upL6KHcF zM2O?ALh@%UpeT$TO5A@S7~leL$Kr|$T!9r1(*pbhAsGO?O*O6n0MB5;E}{7c!Y&Q) zwonH=Ef5uUqerC)e8(aIM4Sys@IOXeDcM$G3iTn-F(G)Kuhd!xG0yVf;@c-Nu`cDI4?mH>B$pWci%S8uabe<2I z7~Y2WN5^j(kSGCf%dT)L0mV^oh`;1@V(5c%Bg*yn@Y!!(@)aZb&k3`I7$6z;6gv)k+EmsjDjC~ zk$f^dI_y%@&Ke}3x}liJ&QY6e_&D~hWS|UxvGYH&65&Ci*PoZl!yX33wqup zK$3F+P?!K5VPv6URg9~g+eedyj41qo^hzA$piZ0gEs80DSdkr`wxma7C_mq03u~drdc9VKFevm zQgI-j$<@{4AC{hJyqm~tsfy( z6f0Qu&=A(X+0oFKM~JtqEw9qaon7DPN1VMvkYnTMUUs7CjraF-79dlWL^!e(5fywP zO5})rp933O0186j>_Htps`R>V>f1-=MPI_uLdTx5wW+nIa&nlS>lalt*y5HlaS6}fX0!RW3Qa>Y+l%)hh2+xFyylc=(Ns4c~CqI;~vUj2qwH?Sk2WBnud)VnX)>}@#< zzb5wgpMmS4R>$ki%c!!io0ceVRfj%R7vFzSbib}pnY%#wU0#KWjFE$s(THDL$nndd zZSi6)BqX~5PjpaoGe|;17pYk|Ft3TZmVCPfunbnzB#I2n;C^)dzHWCcjBq0(m8Gx` z`Vz^HlIncQ-Bpw94>XVoNxY5H{zn=NxzhP@{)=2jfq?}KXfd%F{Eeh+pgK$9&QTec z6nd@3VHwQh{?XUvnOtop?XxNcGR`UNCPIXUjxrn5rg@H!q17_-C-KFTVu&Q2%50rC z3uM4nXV2{WvZP|gErNY({PGe8cgox~)M5zXY97U?f23{UvAZ;Vt;5sgYZ^5DZY~}B ziq;+}Mx~?y&l*b;K}w0gvBUzI0xuKMJrF{jGlG^KwbDu5pLJxX*)xr$|9Hp-@P2Q_ zC~{Jp?Y(JVPylX_96WoN$JpLJwvLJ$f=DB{6odpim$yMgEE(uBGHS6A%|?`Cy}z5P z%~$*7kT*W3{|Jr8y@<)s=`&X@P3qXdi;sEXuOEL!>BNt&M@+lFG(|yR1*eVyZYA3f-T302l`hpNM!r#Q|E>4Jq?~;YZa5%ytKn-98!PQ7 zSU^$l*CbDHp=L?gOMfa6Pzi-(-?xz+{7(vaj@#Wj29L4rsq|HhiW!v2yrVf;FeTK# zfW#9!V`Au?GlqEA#TTB{N^j+4Q}}7+hi!5a`9F_>VlcZf3CxB+#r*(9!w1i9nz#X1QDKboAe8FT-h_vY_cr4AxzIh_^NV^W8 z^x$KchFON;O69__`c}^D-D7sbRP=B01APm5|1KeTj3v-Kg^Uw8$9O+-G<|X=O(g)F zrX#WYkq8mML^?*Lj9L=sOYe>KoVI3IVT9!K%@ zvt6uceJ^S9uAmuywrE__((0xB)4tqwe5FQWmz<*5M-MwAG@WJ|&*jd3_WKyIX$W<8 zrFb92c5E^to$Oj~;pp<_Xe zQt(DPz6lP3-}ywt_UF`SyzmnP3nwts&g)`7YpS?S3ME~%kOTpeYSN-G%&wP~_#8CF zqFm3KqPsmg)~i17Q`6@9)I_}-Da~!#>o&|!qSA;~T5~UqVCSESOgJMI0gyHz#mll8 z@6MVZI_FTt*b+(5AeE9Nh548>;Q(0UZr%{1l&rzE7 z5H7;+;IGq9IIB5l)FL|*S%o;n(>mck>ZhLdxMCQ^2x`zAivPY=pU$h7AX|e@dOlJ2 z=IaNz*%=lIp(^6Q)Hrk1SAO3my7Tz(WAb;rNu5`^4(*Cvrf2Zd0OPjNykp|}V>mLU zQ=~6xqRbptcLau@PvvZL>H36$t)<>}XFoc8eed#n5+jM-mGo%q%N>ftJ>-;&2BpX` z0yYS(iXf<VHEnnL!Nl}iEzu=d zVPoud^8m02?hbhAmCqV0V{uWJaLd5b2Q^}8VxNP>LkTm{t>BLiZv>9(DY{U1{rZnf zD-fa8UTs7YSyP{-W+A>J3D$4iO+Btp$%wZ|r^-YoM^}&Q(|I5QLRNX~K}MLn6l$nc z$;iQMU^SmkEBqA~WrjPd04!;urV7ylJxQMn>Z8kbGn`&sZk*#m37(}wMELv$HLNF5 z71b2SV$g&flC?gA?VE*+UW+a#Zaih#Ez3)Ij|($<*W6V_7R7j7DQI)7kqMMG?`k@h zLBiY01JBkawj2lH+)o=n!-(9|@tc@G0*38qvp#;42iv7j@@ zT-b_Ai^WwLTQc=$n^d)M>ovxb#Yjcjeafsjb?gzh0(kNM~ck4h2^~{^C?`J8EVY z?}savE%=q0T|8Z)PZ%7Pp(U5K7!S9_E;L$f{G??wSwiJe-8J@%?5mOnZP0}yvfSnT z8U0t%M2}bcXl+!NKU^?4P&TdNx0eG|Hj4Rj?r9S4eLKNCz`hrgO-6eOAAh23j44zl zp&;!j)$CM^K&GRC6*`KcyMZUK2|jG1gFtdZ9{>HQs$YmTM+{B-8u! zV~lB2_0$(1%}73h2Qbh?3Dt8XE(H4+zfHw6D&uquA~;HfzD|bIDQBUSwM*9$u!u|c zPS&g3?$61s%4f<4)5XQ1D=YNU+QVyyu8$GA2@*UPl-&v7BmMMj&LgPXm!wCir@U4| zK|HYZg!TR#2``l3xf6K=-{>xZjB3J_MO!_)2Q)Lfg+UuDbpdVy9QyIyBiC16KTKnwmpAKfl%&u2iJk z{NPIfCue%whK;UGalR*aIA&_Ucw3dm8a|_&=9eQ;lLzFyPi>xy$Yc&85``zwIDjK~sg2?3>}amIShBVk|MqDxv^cV2r4E|@hogxRI6-Ib+Sl}b0rd<640s<* zm*$3_Hek=TGJFFYLx$d9s`x#13mw1$FC#B{%}(_CB^y2@kVM6p2z>F&3{-M2fp`kh zZ+C8yDsQT8RznHiX2#qrVhuz(&Mdn@H_;(4*}x#sH>bO{pIx_j{c9UMnkmxsurIq! zx4C|)tgiH6?0KpC(F=p2ywDSY*$~`cqn`@s+ViINyjH!yvz0r}kG`Do{CcOp-TcXK zU*t%SB`b8rko}ZI3RoD?EHtATz4S3f?|#wulAdq)CV}1Ev+oTPIQhd8%25yz*Um&n zN2XaG1yJPuNSS9VyZ8LL!i&k72)aJWuUkYoD2V9^`U;*pUwtIqkB}BBY^P4^MkHq` zqju^Hb~sv*C~6< zV*5Mp9~DUo;~Iq5g#;P&O<4fF?9=UXlUb{=+Fx!wJ%2AF!iM@DZPugRxyT!!#f2tr z!oMu&f)Pz)jj3dC)`?tPftQCMRpzW+3hLGVT8N>N%god@BiaPb@`cP`e~e^Oc4?SF z3)^pD`DFv{Hv#GsKw|^7;&tWqxje2Wk_`fm;=zx3Q|V}UbM*zARHj-S+`S9-N0CSgJgSA?KH<;%EG>*H|zd^+u|A+%l2%-s0*mz@*NNGE(7su`=QC! z;?D?&m+$X4g=39X5{&ZidtjAZiVX^~8BpwhGup(T|G00|b${?o_EcJ#@0y4zcQ;E9 z^_iON_2N3R1zx+aBLrz9ZJ>$v1rl;(%1}Uu+d{)rPrT>&z2y&eKfQXRSPRaO<;*r9 zn>wKD1rvGGeN&8VKX_yF?0$9=pio=G+1lmViO<02MWGMn$fd>fqHpfEw0KS~2z?Z0 zx#Ax1OSf=KDfy*b)N?xLzuk-B85TBA9xYbei6Hl6Zg6B?Cby>3*I>nY;@F*?q?^e= zt&PBk`j8&%liM)1zo6^WVD$<;`KX+|P0=gvKnLt7rM&z6O=tiUImtqze^k*TDx3Mk zfcAvQLqc!v%RsR+^v0g{V=_6)!Cp2jP~z!T=x#4EE2<<(4Mac217g4sQR(1uz&!NFw-7md3$Abc~x? z>UOXHzz8500(bLO^&0pJ77xLL4)*@-V67ehKWd?g8&}r({dZ+`o#XSQXZ6}o8jZU{eyEGiqw4zw1!R4?~&h4 zv#q_mn}z4U2^gakMun~PZkivL0uy23#aE+eS=i7#``&whq*5Vr_Y@OjC6E*rD&pci zG2VnO3xWSE3p~-gW#Lx~{03VV@Cwu*_S@NTuyAv5{TG%r2~11W*`PIXL?E5@z?-x4 zcF{5b%J1X+GHuAOdY};4j@q)oDATv8Z(=G5cU6^ShdXtojC3qtuBOVlz&s_w&|;~|E2i=O%7LSCJDV&j$ z=e3q3geD^q-&QlevxK`k<&Asrgj#dN6M56g;W_S9bq_|vTCc;VMtHneiO)`COgU{{ zL0Tt_KhRSjpspD?f)}HDE*AIf9R&bCWLLjv>M!1_Kw0Y?!F8;Vc05fz-8A-`Cc>Wx z0GvHdSce}TW{Tt9sEo?{%wAG?hWl-Sa{SwR|~4r{do!oU^1_~tK}lhP)@c#8Yu z^&JEQXWrrx{rrf8=02F>62n$-(~>bHbkg!A3MI&x(2BU@Le`8MO_f3{)Ni9^w-`?%%Q2U zoFgH6rIV-awFd4`Ri25}p}1uGuE6f8qh?OZkJF-Aw41%~)#;6_H?u9Al6%GuQIEZD zQFkz!6Yh|mW^ck5>mrC-n7Fmy;Qbo6xE=YL$f!hmJ^TE3i6brq&M^nZ&yI0Nc`5SN zF&g9^qeneeK1h&3tdS3vR^U#2xE3~0L)*fay_(M}m!1daMZBzIF%e0liA|vF5;|*m z4zi1_R|k7^lwEYYu79gUXY^(1sb7*{vxNA6JcX|+2y9?AWuqnKouS0+_;%Q4li z(#Pwg_AjZ?SXRm+r;I19)6Lbc&YMXjEdvRYBUI0;p065 zX~!7~J+0aUldKLDk9dR5XcO=;UB>4|2x~L74ayr81oRVTMGvrmlmv;)oB`DN1V}2$ zUJARNjF{=nvW{Gd&>DazWLb`7meg-vJ!jQHqEJXKI|)nXTS-N}x4Yp*byzO&>tamo zxvv+Uxb{bZuj3L4w2)u}Vd7}^7o#EQR@^530nAyHV9P$i(R^FndmTt)iDX^6+~GN5 zEHP%U4s-8iih4b}3Oye_w~?T3T2zY;FH_AKcWkchc)~(s+F^WQ(+ad3ou& zeDrR90!(iB>Z|1smrVtWhzuFr zH0w0P7J7G1?R%h7P7MSqhK#|NBdX=@Rbk^4-@v&1x!=-aIz-83S0ZAQFoQ1hMVI9k zZP?%ym32_q8Jsg{wTF{GT#KsIDOu_wMd3CjcO|lxF%9;I+G0`bsOoiK#zZQLb=;dF zi-7p{FKd0Fl3l6fAL|M5jb-Mi6-fiS7A5a$&oKZ#=Vt>#{E;lr*+hhYQ9Medt>EIs zn*ys&p@&Xl%W69r&0KEG7*6SO#{aBhdE!*bldk;qaiG$s(>WEKL6?t6+9}G9H`Bw= zM}3r7N$d*8o5L4I*}fXB2=@>Y9S&_Ak5q#BciVwK`!ef$i+uESAX30?baL1u=NUE2<8(J% zB&(?SskdF@cpmugao6%3Fpy+l)=T3bz`r7=$cIQ_8CX}0bAsdHJ~w)FU4(oPO>(2* zkyWurj`X+q+&HoD1n}k49&NbOW9*Y=naXEBD_6t6MU`uQAqTk1g%+a{$$aQsxe_A> zm-a0(_`a~8e)4u&%4vsoj5*O%SViJ0eh6uClY8^si&O{EGsFb}yEKXOD#DQ`Q%~1q zV@7PA+F3@Pfc(S!E6Tkqt8q0aPu$GzG;wQ9`%Y)h(2+H&q+B%y0kmz!y) zbli-O(y^<0l~Y$(GeENY_E|Cwi~SvYc3|1PzE2-ajvZ*qdcZba9(l_h{`jZcL_z}C zeb2RiIUgL&E`WTlTTl1pf&dTR9xaOy#-^iN&7WdhZK<%+10R;=$BLnL=RSB085&mJ z>slbD90wHHycXid%Sj2Nq5aN0I$61xR!Wh#c7QXK{4q${qbRWPof8IzWYofU#aCdR zXr1SUPqO)sd=yKbhVduAMOFr~4$yqI*E?Sm8-Hs9ec49Vkv~Q}a3*6|-u&K!hO-BV zZ7Dy}z{->Ty_OQnn--~k95t;pPr|oIu(kbx)oLKNS=$LStn{^ zSm&1Wt7BtVziZ1C>pi z@ob-=mp>~=+^CCPQi&QI#@YJ7>bP(dqI9I^QkFi7?D?HC2T!tE7N{zCo>ex1Pt2ZN zv6%NBIvl=Dh%o1f56-q6tuGDa*Wr4NrSPa(`EDhvEZ9jm+IJXC zPwLL@SNsmVhWTF-UubSr!TAbE^goW-Ay=@b*T^6e$oSQrBlYM{SU?8dw1*=UXC$t+!%9#)ZqQ4c^U0)WS7G_4SZYFLPe+j#e5JU;{<|33W5stCp;I26! zT&L(n!2i?U+QHiGua<;lplj@#vuyI8Ne*PtJ7mW!f4nLICeUp(LXQbV3**Y469l@O z!aJ_49si=)#tEW=Ju9{-ax=UnQ7C)A{iJ%3D2NB96$nGqcyv(l_##7ALWpkG+K6n~ zEn2cThyx~|0V$Y(*yQeDn9`stn1bAsg~2#vLARj*1zFH-K!c=W)WHFIicgF8mtNm- z{M+gNTVLHCgFImc+x%l-Wbsr%|115Wlc)c>7RvY`%8i77e{@pi%Wh}SO%>D*8{g|G zLCH+$Dy%{HzY}5Q@>^@n9nJm{n!6^b2>xaw*1+Gt3`1KUA>2p?{GTa=wX|?GGjaNB z{w?BE98-V4t+uA@yjrwJTC<>6C|b!oHO@j4?50uMD&W*nWc;Fzd7%Cv#ay+TntJGJ z>DRAj;X*A0xTH^%Y_;j3_MuO$H|Uvb9+>AI)VPPEsopE?z!)P=D`o;nu=B9o3y3y3*1xjT!vEY_NKuW(>a+Ab-`;C~4xfHVNshjc`MThS z%JCMZ_9ai;hUs(Em=J$3OQYGap;8um{|t?-A?or#9OHEFvfCP?HP_sS^_KjFt+DfC zlGi1^zz(W-jGWS-mdIsW%`X;|3K>UxC&z2V8C4?;taWF_LB}XbJF5?uzU%}%Ujnga ztjHRE?(_T1-iCV88-hU^FUj~WV_uUcgPQj|Z2g|*ho?RHMIH(4V964r36^rSd!PLE zli!+k2+jTAje+<+Jg+E+mL!*SiZ=>){jLd%PV(@T3xJ~=!GIpCizLkVz|kXCyD}PZ zx}5jYZ)^6L6Vsh^G39XEG7O}cxG#U!yoP_}seYOK^;AO_;CM_!Y$Eb?X;<%OE1~0G zd#ENvTo(lVtz{;5jOpOg{)kMAIw z8LTM_^cS``mCQf~uvI5+1%t6F+|?(3Wd+KGb-7YN0%E(>Nf+oAVQp{W=;UVY_`d=t zuu6<~7ZWmVK$QQ3kzpHHXHYN+zKN4Hhm+}FD}%%qTaJqUMKVvRgOG_ZF{2MV}*imkgj(CVgw&)82l==^~)u%E4j%!?V>h*&r_{4pX!Emn^k-99c7=oVndO${Y-lB!xwBxB~`i$=tpiF^3T^rDSuJT4OBG~BoJlk?jcpH(MAT^ zP|4p_4)CY8d?qfz*uhHLIcl3D-cc<^UEg5!CEEB!NoPGk>0Qm?07|Be&$Emuqd5<% zK5cQ!6t)uLBZY3QZb>E{IP`cWH#h-k?F4 zR^vf8_Pfp2)xylo(cbCbjJg&dn7)epfe8N&f?oN6s9@v(et&Ro_k2q~&=_oS2?YIt z5kVY-K(|?XAwi%9n2{k70{YL;EG*3bg%Qn-Q=v|8s9{Bh^xIm!vol?PxA^_@JjE3&V4_nk9J0^!5*0E?)yEsml4 z{MY}a%|g+r@QmCnT>rMAy3;_{u&MnWOQyYJ#m(H>@!!USo(+==Yc}XM>-2FpNCGC8 z=v)}AG8c4vhBKTCx`s*qx6HV1JNV7V|3~(kLhQ}n%+SDo92&%#5ccR=MKOp7lBH2` zdw8H#0OEnkFsc~VClujUU#E*fl(+W#GT#|7RL%PS^VNl-5hrQgRh}0shc>?XK-+ZQ z$Ek$sRyo2=J|qf^Q;3*$#qG{jR0(Q=eV+@JZ9e}-ZTuURvyJx_wX6z?dSeLxb8X&i zH}3y>E>lqh8^=V=-G2D3=5DY2=K+tKn~Rg#|3`Qbss1{2ml{XchC z3zz@3^TGUIj8+&GHs~*GkA2z-dI}Tk+Hv*y6jT84h<|PZiRhLwz|amlKnt+J|5hoE z-*U7wakF%EvHw@KwzxK!dI(kPheZFec>lEd{XH{r`O9dmSB1Vx3G;Z;2ViWr58T=N zs{^1@m`X2Ie_ zH*qsDHF5o$JJVTE7);!I^Dqu@KHsesj?bX4FzHY%!eF@TAVP?Y!JQdkwg{?%^+vk# z2Z0n)VQ_b1X}AK4f+6g${Xw`rt`b}a<-=erU;e-dAtali+m{wtHbKU>%Vy^v2%inh zZr$to9Z)6=!RHW$ka>8gkL`ybE0_<m>0_qKV%h>N3} zqp7>)e}8*nmV?S5!;Lr`2tdk+ zk>mVdV^xilnj1FtVZ8rAgBY2Y-6p(G@lprDR#xW^*v$nf9g2S|`cfwFhX@;N@~;J` zq1idTw!V-`u|F^h$etKAOgrnusRd!mAtFf)BKR#ecRRbkMCK?-{Ti0;f45(`SXf%P zSU8ydYcciTd+cvZ;k9KM$^W<#kQ^iQDVGd-)T#&ZwT}&%qma|Bk&W{ z6Dm?SA;7<`A5*4wKmZ$!=Vp_*$%GQ_d83IV=?> zjU#P@;}~9`Rb)u->)Fa~s*Z?Vq2kbqy78!;v@Pph^QJ#=)6DgYHtUzw< z@qCS?AxT1{M3dkPsUHC!aF-)yF@K7Cj%V^%AcjgWUF>oh1BkHNu93dHB&*=~p(l=S zs#~dgJ#Hb+lvfo7rjCZQ;?!H^{kFG?6a*S`P!nkM9)wc%1_Sy=X)>?cWEev=83MSi^bK(XGucla|11$?DG+I<1a!KGU>OsAd|C zMp{GGfXLV45WryGv|P=VpA~4&r~4Q~loHQiXyVmqzJUHmSyT$sxKjngymgy#E$ypZ zLQZ__RqOySI53EYA)_7h;iwLgV&T-MHVRJ7ZN~)5Fbcb>P?RS*2Wc2<+g{VyntPA% zO&G04eG0N0dubwohG>J7leyWB@Zw6!-*L4Rp6ctX4HDNU?RTa7HKad0MHa8+%g{Qa zDrCd9%;x?XIo+kBpz7qW{PqwHks=nZ7P)M6DfvhV{}@amhtt+Gn;}UOD?xUwi@_-6 z9t;{BVJW*LqSfs6pY{N7m{S+Qt7u{$HJvlDgj>T${ZM40ddXeXLMFX69rOH5$$V9g zE-uCvyIwmSnd0AGlf=&HC;xh zZa=&!-{FC&jv_-0AHKP_F|`(MHz;U&5h(2)`GOfE7RdzL23v_!g_=1))+kTu3+^_{ zDBbScnr`{;Eu(SN_HR!@rf~QY7zB8G!a*4*M05d9`3lq?3J7zV1l*77Q z<@DVX72yrJ%j7%M_9v_%*>n9D3p8fx@KfsH=nZkUU_wNfSqiydmPDV#DszX&ct~1| zy*&3VIyxvLg=}m1o_%7?bjPhU`(nOF>A8dZVS9|^eqX>C-=p?aGkgerjHX(8UqUi% zt~Vj3Kz7}7h~ZmlNt8Tz*}aPeRf8(IRQWM|b$I3N7ZtKbtsqlUy1K*tq|hY`K@NsT zBr(jARp5I=IG1t-wy~Og9GH9|9mv4NJsR|ASt$SgM-+x={U?;>O( zk0dU(*LK50qk6^z$UvJ>79ZDRwXHPcGP|>qA?9qqw2V!#9TE)_n-C={W|KE@O)xr- zKtwZe)L|j2(c$OREq+Y4l!PFxn!b2y>wJRpA@F^MhFKcrep!k&0-5h&J?UmfYU0t_ zU#TMDG4*IsuzyC;nCPeVOPCTjonyjPOS-^IAX;bW0;hmnbL=N_RI1EFmD>ASK-)-AK36DIzJ|4T`+0 z5BT2uzxRIH4>M<;^UQPhoSEOmK^}U3y0O^v4l67Fo#N2qvxt5kZ+ui6FHzoskjF1N ztG>rBsOM8cY_8eGbEYaR>J;l@Qoiz>9&uIP*;hUFCV$;4AWG_ZQ0?X_O1^XWs$}2F z=6F>QBvO4RC5m|D0r}gtZxCoE7rJGM&YR$gac8uR#+tbgB|BfrFhkg;t=;ytgJukS z`4l02_`Sh38{1>rOz*$mee&WU{I0p8+In2dG%3HN_knbOL4mZE65*w%S= z=lKix=@QGZR*LCz3u9X$eaF$u@LXy_Ls*5SZa0FT^v8wt&ok1|e-aTz+D% z>_f%U%vSVX;%|}cN6Bj<{NP`Eajr+EV7pQg1kkC=KN8mv$rgFsmY)Q7I->d@E(iTv zBjPl6R~dd#K#krP>29c3bDERrtn}E&tf1#!HCo>q^`N$U#_wnvRawnTg}!~2!$wod zT;utYGu40mqFdzy2e$lo2dPx`8? zmY-KSfy?s!qm`+XLOEWhfY{D&(U&1fy&9aCP|BB5YBhU~y7_(i!;*SjxZXboD84Dc9R}n_0wH|99&I|r*CDspO@U zSWO4O6WG{WRy~2wpc9ev)t@cO{rt{Qxe=Pazb~?}Bi*HDR9mP8`hW@@YA(BqqiTxx z7|Ucy=bMs$A#?aR7s2%vBTbIvuFc9U(fTOl0g1B_JT5fXDB{XrXTB$?cfF5Y^E15c zWToVXu*#83y04b*lUv7RY&1XP5IZ;{5`*f?aF0=gr5?OxJ^PV#74s0Wp^?2g*Mn!j zCUw-}(;DxWEbc1e2H%HYpt(r9btgzwKU=4sgl6*_Dqk+558m;g@rGMbOq?BsV&vlK z&!4Oml7A+de?BbP`@!mhJQLzK)^35t9q-Obl~p=CH4upJF+2)q7G%jCe)#SEZ0cO5 z-jO!f+>v0@>FEJaZM`WE2e!cXag4F{>D^YxtAyIdq>)qI*>;n%T4<^{PIlw*BClG} zu9PS3_`Fv>p*fDb%XX!;KHpYnnWsiZIflnin|3(N?SaK_ivRygjKJ)J_rr% zj0Vq4GX$Cqp6Z8|o?3d_DPMx8xeQr(FxzRjqqAZ^srWj7xzj1`8G#Z5r~H;ZyD|oW zDc8G#IIv%WG56^cR3a#sj^QJhiZ{Zm=8>}8hM8B7h@WBmPIJ=bYpDJy8?UUQ0;F>E_E7$ zW;}6ckR81}5h~0p>qA35>!9#^Qxc@yb5vH}Xg<;62K!med=UHuUHoL5X>Jf!m@kXp z^wO_wis!Lakp%so6gb!I!(HbW$h`OhV-O1hwH)hjYTQ<5SoFMoBofqZKagV4Bykll z+5)e~5bfK>8$0M_vnn4ye~|L5)tZg=(&C&P%{`}*x#=C=u59Cvc*()+OErro6j)8d z4&LVz1C4<3(WaP74(QcWt7Oyn*|xmxsf_0$@+Un}dsM|2nET%yg^Bj(oMM%?E55Kk zP|?Q~9CKc|s$f&`XW-7<$AhAhK=0O*M@WT`>p#8ZH^fx?>EEV|@4GV>SzzP`;;yn0 zV?BC?hxPMVN&K^j^TH3rQZnT901D=WG^M*H{PQY#-zOjTgm%*&KLHKwRH&I>C$S1V zTsFEVf8~+8}BwRTHGN_zDH;A906Q~K0ap?}wT1;;dRDo9@0)VFE4baHVZfQ~8plQIh zvkV4k;lZGr;An9$2#o$4rlZint@6QugBzjz0~P(5qB9387b`ofqm7m2pN2HGcjG`I z7{8s)^mNegEQP=FbN_>XAswUvs7I&(m`0@e?G!xjkFP< z2{ztNU!xIbkN-|^AVP{#{uSDx|DE9QD>>w^v*BUo_}}SEHG@6?&;x18ork~1y8gbkHLNN9V3K=>=%{6FgC|NB@gXjmHkzGNm5NjZLCG#A&L%?62>w=N zlA=VDXplm5+SnRoKP^+GtbLLl{#sm-FKoL@^!6oJoxb*9GAQOwJK5cSU8d!H<>xM2 zO_CHpv%9qK7MS|nwc;9F$s7sA) zg4i8b$~RIussbA7U$17AJ?Cz#i8~c$vMh@b5#Ol^ZsKD=tLOI}F;x@QaeY}tC)8;i zJvg>ytDHNWy6tq?tTM1Wpopk9OAq$dXWNtLiH~p=#*FW?bayK!8e%Uw5Q*vD6<3BYe0Ek>ac(XbNZ~qDx zgCK*O)zQ)(ga=!f-+!;me||g8|M@GVK6`94CW_nqT`lx3w(QgGY=(lcPLOg)T`PPr zqmo=hdCykP>8`m;YSj;SV~Sb6y9vh&erwCkyf(%?k%fhKu~U30d<{|zQ0h6U58zPb z4T=0}RuMxV&RLd9KT3y&U4|9R%Bg1Hf>Oh#hFaM*5W70Po&72?JTbrtj!|7b9bawaxWqc(+#X4--|wa94(S*j^Xml%{Q zJZ?+L30oOiH?h?k?nRANOlJ~(B}-wx+$KURS~vIJUziI^kM$jN1R;iWT)+U^N(Q0F z;5?IjHV$n*Vubo_o24_0B|dYU``zeg7~@1?wfk?{!U|6g)MV*nohnHcc6$!G%n#TZ zQpQd_39wQw-&aSK4sad{kC}Be_HmX~PxjXt=L>?koXW~LzI>gIHPfuiCy|~V(J2|s zYt*cE>`Ba!DPfU-e%mu|L5pGEZDV^0?=|BKB^ZiaEM1LE2=$9xkQG?xdq^b^j>;qa zRcQ(q{fz!Lz@mCtS(x+cSlkgii3cNmw4eP5A&zbHlYI1%B&4svZICq8T~&bna@~}( zssQiv$j^15G|h^Mr5`~BYq1~4IsH>3y$D)LjOsAwosfvv#BD;{74IZ1A4c3K_Avdn z0QcQ(^8H(r$Bu2hklA(qJmeU1`L0=1?Tx##;ta)zakXah??ujmJHB9LOTcn_ISec} zpW)l(mNpEM12(wrQGoW|=5{w{9s_v-n^^HUKpPyt9k)FW@&ITSlK?Gj@|IRK3DN;* z7}EfaW%`yTKMm3Vo|pIepQjBE>;LX$Yo9^)fS?jG8IKtcd z4l_hp43O#0pX=CuKN`mSZ<3czKv+N?8A~!EMiwT_M4-D(pMZ_K2@MKdf=Yn=uG`Fx za!eZH|AMgjQGs;4UpxugP9-=#@r{$t3ZHiY!}!XILh z;>-7qNQ9(h9p1D_v~;qAK0QJpz3#(JN{i{+aZX-9`|?^(R(1kh6_ZM&wH0QOhHKc) zIiaFETZPOMt`9P}5dM^i7TJ1$mJ98-GV93X??W)fCL`IOR8G&7KdZ8OV>_S$7ox$) zQ$_IA$K)sa0;s41sn;MyQ96-hj!b$3oy$6GuRPMtVs!h-{o@qUu(w~cRql;l;e9%N zH8Ghzv6u1EDQSac-ML7uIS>AjXcW;o*Plg{op4*W3}Sr`(H7+qw~$QD9VAKUb0otg zR{j(u(>`0D95C#1c=aUxWx{H_R$8Jg#v}xOnSig;ap@1~7|{9M!oH>R-6agl#6|D$ zbqo!bxDZBiCJha33CXj1$QNvlD#jdX-2tQ&k5?vuD)F%@}*@*a1AJj*26&8$UD-HcA z_MMJ)wfCLuM;C)kUu{+m6wS!#Ibp25{5RiRWJ1Gjj54vymZTtjxgy|+#ujz1f7H;6mvc!ACQg7aYxJ~28t z3LZTh*KG6?5?7C;lJ^zAx;@lpH_jvK$&Ukf$H1_f6eB#S+hF)3kk9?d@8Dn=y6Y4F zNy4}?3EfO%jR4y2%pt1n1n(dseuAZ545}~mry^0J5CaapruN`nxZ*kdA_QTn@p-+C zb7Fn;6gL-@xGXASc^7UrAz0?ChDFkyZN)A}}urr_&3?4!kNZ4Xm zY$=mU)|hPN_pjVe#9~n@Mrc(38En*7X(V18Ytw@{vtN|+1-bC!owt>at4}viKn?rcRjjmXv5vPksCL&;W2Q< z^ui>Bq#wtY{7B4lhgToQo_?GzIa1ZE`cWhb6kI3mNR#)uuCO_a!%mE{{T(P+N6|@? zj3xXm_7QdIz5SrIN$Dur9X`x-sU z@e5Cy?!1?b%o~XzoP>H+ z(rU-VLe7cs&|jC;pIBr#zGE8USfRMI{dsIKG(d}}SZ?Vt>@kQ`*u4Br5TPUS)bk`` zd&}Zl3HgKD$aJAcL^E1MWxn&Kw_A*R(BqWm zl2*4{L8;BRDg#>diaa)3zDN0CV5i3sn>B*zIgS6r-MHG>mA0qHBw}9Bw!4zZ+O34# zj@IDM{GPJQuY+iG%B?%78P4jihYVv1=6zQ}&aK1HN;7CgsL!@L_bV+|))yR_Uo?A( zg=3JP4lemOId>Udzud;+VJbCUn~Hhi@rqx6Wt}6!ccl(GutP8&QCM44+Uh6f>$>j> zCC*lnu$~UuB~#)kBs*7INKh;QbG{zRqg+R7RAnv=1#&dnBB1G!a zx!hC3c7-|qMVXp9?orcyvka_LH1$P+GTvSx)AxFCkit@3KIDNjJKdja;{)%rE=m`U zZO~3X9)FdArl1!GN865Ry}75h(PI>>-8|a-;ft5XQFT;%{KGuyuBEN=l#J*L(5}}6 zEuwqG$TOj@V?MEwgqg3~zT@}K|D+Dm@%V%rZq$$Jn3E5RkI8HVw=Q&_+@-#33Q~#< zpKST+FF#kUH9sNTocsRE`TR(e9&Qg!Q_*XewTRSOZ0I`<2@KJmQ9rF%wKS5WSJ^8Y zJRmRR1-$6I+1HD_2$UT&y(-;?(YvI>yksq+$&TG^0#Q=|D^7*>`(M+PeBkUg92d)n z1@NG$cfb25Z$~C?pM8N)%|W2^k5@+?ub$08n(Sis-zA5yeNc&<3pZ&wF6eC zWEQ@3?S;Y#yhAn(Z;|y*3ppM%0tw|Q5O)($UOm!=wdw3|CX;X-?mhv1ApPKTTo`-o z#IWJAE$QRXRD`blnF_i<;?A|beC^tIco2FX&qJ1f?tkVK2EF!tw(OGGy_F({L4f&1 z`<~+<+WT;6DiR{1%TW54Uu90EZCD19Cvfa2UV1}Q!zeqB^gj-?5i>SbZC)&BcDs(n z-Z3HWclpVr#hlVZ-zR@Afn&)O{$`MtW96W+mLf{D^$l5}x`YqO@<{y-Q|I2ohxYU* z*JY2cC^zk%<`6`}d!aNm_FoXX=P9N27@!SmP4zZQ{R}0?nWK>oLZvVk$*%Bt14;?A z=Ax;ALK{uAUl28PiJm511u(_lZyG*KwMXA)%joEM(D(K@W^0}riiRO_2XvKPTjKQ; z8)ESbz9~%f0Y|mH_9gK zAbDf0{%r}>g?fUjmMG!gv#94MPm?3E^H!~S3V23O{YuWFiylrHzFIXMdQMj9=GBZO z=k_A4aVDo=T%e?G1+%f}TNQqU4PJm)P%TEg!7IuqTSvYzE~|gt4DZ59hxU& ztns05x`bQ8*LVkc#iUro zrS(3vx@x@8@+E!Px0CG1VqpdK#<;JlZ9ItHoy0vOpm+rag6eyc5!m`f6~UN zdaEic@6)WL&p0<|cx6~u-N2s81HVmBacDp0%S03^VId=ly`!BcSa=jVUc#;r7MHE* z@8<2-US*aIp=ZxIC=*nr!md9bjH_i*Em1sMG8Zv*I>GBbdcI=DpP&bBj=pa<9aaAc zs+y8Lm03Zc?)Q?I&zSGiM5>cui!W^(J7br>(&X#Y7fwZi@3htk8THA@w$0-dO{hMy zXv+9o8D18=XyIEy|L&0&tN37gQCq|0jMWiGvAXxscfEP}PlY??@lmysjL}}q6v4=S z?uA8%#RG~YbX%M_iJsjbKM$N|x6z@pXh3UqRKM<;2TbUm>=vd>Fn+0mT~HN9^gR0% zQnd9YW*~m2plC36&^OE`aW%Ly=f%t*Cu-wM(!He!_St31z)yZ(WX-t18v?Qp)rD%q z8`dv2LP!0ANABvdyOA7!aviI%_wA^8CcIW|IW%#hJEC-?fa2z+WN^4dSG0!0c^wHY z;ES<)7tGF8@V-Q9RR9Y!h|P9cQhS=PQB`R0`PR43OG>@s1y%|>jBvpfHYU$&hs_;I zITFDMYzfah;|U+lO<@}c%sn{7>aCPzIGTRWNTDkyrKug%`spxoLNlGCs2Eb+GB8o8 z{E2dhHpEOtNeC^_UU8smX)u?Ip>J0kO8k1#m|12sDV;SgDKRd3tG=;aVz!JTgGa8u zdGq7+PGRP_=s`M31;(+tagNzQ5H@zqx6ycW=HNcXLeBND7>3$**3`cKK{X!xWSb!I zDYG?=+^JM_LDVkDm%-$mlh#ybO5^B~PpHVRe(*gsL=6x!IeL)WWH9}?6#lHa9a>@P zlDp0PptP4sC9=V~qrkb~jR5_z>h~*cZ=Kf-qc4K7m>!aUPQG7S`zdb8U-)|3Dxpp_ zIrSrPh?%j_Q1(ueIyrsdeJfvf%oD`4iq-V5wya&dEVQ8PN34Q2e&3Rt&<@YzdJ&NFW4O|?vk zjbUS$nEXPfAnL&R3Da20EJ|O^h$YJi=ZW&M-mS&%cLJK_&AocD>9PTL{fuG#Jg`SRukDfhE(Bq(aOUpdrKEaf; z`Cf1{{F3c&ArRFax)0z%7?2=~@u$-%%+JP8km01c!7wyAX{M2WOk=cQ2u%Jc>v0bc#iBbu8cGh8tm5+E&+Nfw}`Dbo=DJ;mNumIfUN zaCj>J;kiKtdX#B=fbsI00L@DCR(7N&jUkXWcc%M?2D{NnkLISy$s;|QD*zpOWCSq0 zce~BT4Kt!y1$v6abkW~w$Ag38=zhUkw`O2 z{QG%<<$q`-{{k3|meaW7|7N`H?`+paL-8-Uk7->u&+nqS$u-^WqG`VSduZu2KzrnQ zd$--eGz|`*mOU(YM0nWhP{h1Ni!wZK(IWY;G#CI{rLhD^c(rt^vD77+j2or@57uU6 zZ*TLTDf|gRHzl4eUN?2cd7oBk071hWz(c5^w>5b1el)$g7GG~Dys32>g%tOLt} z;u@fdT+`gt@@Zew!~qlkg%|!Rd9pXMwXt{n7rgK{xToqx%B8aj%fPP0`5j65g+2y* z-^Oa3k-*2mldLenKrST)_$Go>iUH;T@@n7yK}#=gUJVBKAyfS4 zSWfQ0jjg;7)&oF5Vs7AlbbW8%Rh=801%&Z_@&hz#f!lW#5dfRv{9aH+vH@96u z7Hk1%TvHLCc_`k}k`=+CH$|nIziIJWwG1#KH6E~V@c->K zP<6prH^{3g@JN2sTe<3{;P=2@h3){*m>q6u@($oL;FI+d&W{q{!UA-_C;Ro)pZecw zBESVq31ki5rfS>U*f<*h*Ahxt3j|Z&`?b;lEB@dv$8l49$o6|y{}cqE@_J0fzyEAXSzyY4+3>uxfaidMZoAkIW`Xs9I(o%5851wq z8yP2LXe0bS#$ZB76RdKunnx!^azTcPFyVtzAV2A2SrDb=dxgOhl;0|_;*Bb za9NfA-&FjUFt#G_O;LeZ5jdad_y1z2?JvS$3@8b#?ch7WmM_>2ehq{=mgterL9kFq z0<6bAtmzx&ua$74Q!5+T$Flib_I*t!mXcS4>%6M=YJ*CGyLWGu=-|4J^O#D(fRu)!5#pU{#VdoyC2X2jOXT_EB*m+ z=kGU&ANoTgO%NQq)t}-Jm=^8#KFF?EZo~#_;$V;WXV!10ZfD&z1?C5~rt>d=oO0gk zo1_b#Iq+TJA0xkb^EbTFsH2{P#ozv10gGT+VCQ64hT2QP{xX7?f7bnO`0cvCyAFN| z{5_UflFMGgREYrV z{Exo|5Q|FP0~F8#`vq3l@*cSQ&Tk#A=Az}2z;yTo>ragwjEy8=D6#|yt2C=x*(^!n z!on(Dy~<260z9%zDw+MLtg?G`bP@=qdCyc-EM8&FPQRGn6+p`QaW+^SW=AcXmCH!g z`ZYDdx<*?)`atpidYKE1K1xRM z${VeqA||{eu_L5H8t5WAW>UBu(ejhZ<&O8-W*`hcER=;PpIOWLt2FvfP1VTC2Lz*{ zIsDzYWXe%?3uhc`SZ@%<){N-X@f_6eR93kq(ZhG0k9J1l!LByPru~qkBd*&mmOC{1 z)}AB)*4|#1$eMbB=A*ed#fz{Zw)>R>2Cpr39uksHkr7;L-tmWaNm=O9A_Qx^X6LFw zDDY+>=n)3r*_XQm4)({<%r)*J$YT#0mI}(}j5zaoyEw7PhflZlR- zOHJpdZ<%ertvEO^WCgyP;O4XD;k} z9e!i82-vyRS?}b`gvQ>xaAOWF)XsCr6W-(8TdZObs*vgbxM4-6_SF8z*-&=!5U93bC=hKD?}Ih~A8kul2<9h|Sy|or5 zn4Kw(USYEy`6Y#P{K~S;-6>Qh)XomtXWLZV-wryu8?vCiosYzGkgc%%m^K{^ziG|l zpI9`{i8qugiIhFfCU|0KGHfj*lwzZ0>A~^Z2Zt(~=Xjd)!^}BPie&i=f=8_sw%u+V zZMZRGov|F7#;OLSCOWs=H>l~k9OIBWYBsG=Z`?##lXHc#w@{SYcmT_1N`fF934U}6 zj!p59#cvW&E2Lq0jm5dFB0i}L$FnaVB@9>m>*v;^5Os+00uk0K0}_IX(#G2`7hRP^ z*Q~`S@mvZm`C}a|r>+*wd;?>v zylgvC=VNH+`?&yb#Cda@t>;X^-3|M>!pC%E#eMtbtJC?7!%rlol#iq$UrcF z+3%SNAL$L(+Mm!Q3C4rW1i5YCk5Wn}?>6O?o-C>A@2nZJn@--#m=piHz1KPml{`n? zfCfT2&()AIH$#53G?%5-yW6JB+g=kT>9qZ;G*OJQT^yX(XLCx?C492?iaUO^#rM8)+g+R!@3~J2r=4$K z)Maj^SH2oaZF-?CK z+$9UqvG$2Wqt}yvomh!Qk7b#|zYEon^ybx62dRNb;%2bMQrffI)mh@>JX_T;aEf-x zs0|c+MUpxUcRRL5JUDR}dQS`wPB%LcN~J4jOdH;64=$Rc5UY(H7;@AnEzLe*Px5;G zl5WfnjeMqE=tt@JbNF_GPRJ7qD~CZU(cb4+eX&A#i85u}^@Y>H9ddK_Eagxd`g+#a z8Tb#-*mKzH>0cX7vIrM49V+S%iAUSe5AGzcfe><7kX{Vs)hxM8_DHkh$Laf?vt>b8 z4E?p#0zSwaPjNgz79K{p>pxh#YiDsce(l(_9`xB0CrwS=y*jkaX-WLdnTnRF?vd^n zqw~yqxz3R7{$v#eK1QZPFscevIW8hc1If!%u2ZuyfT6mxC=Y6k9p ziS*Tdv9deg#-?9Qzhf0ft{5qfe&nz_(#c5l#tZHF+_JlS^K;W+{VZg*{_^2RX{x+( z^TYPDaw9`>y>M3I`({Hfswj<#A||Um7J^X%S?y9s${1#qtqC3u4UUjBub4~F8v$xc z)rX8<3?mP@UwaCtp*G_n8kZCbAwQ$NQ&F2C%SuR=-pRX40WTcUdr-KI2LTJ3UQM%(PGT%cHea7N>B z=PDiXu<-RFNZ~f$dwVtZkS`BeE>zsnLAOdu{xzlBWa7TQ1i26`X}b_1_JNB@+X8=S zD^tGNa*YfX*=8t`)jtv2XM&|T&P1r-{PoGH5A9UufkKVOKH%tXY^$UZLO zI#(=6YS7FHHxPYXrNv7dHc*!JSZ{|1i6Ejmd@t49iBp~U#d$NB&FJP0;bP zsHpKwyxN4G6UsjQHfz`YDxLuLb-|7A%t>1DU^7(imx!zUVWr=G$P{dKsg};IP3R66 z^JaR!ZkiGCc7YD=zkq(e#=f3dcuB~fe@*bCHsP9UiX{9UtkKsNBm>(7|lU$PRpP<$SMF4b+daiPs7*{{{OYm(n@X&iN<-z5}>&B z#ha<7-J+I@i;z432>E3+a{m=m;QWO$8T`{|1Q2kB>DGX0Sn0hH=WQI|boJ(I*OIS6 zmH>0&7L(gbFChi}v0DDV@b=_p{H|fm)=Mc84hATG2U=k4tiN%JgxnLzeI!j|a7e<) z34|DWWXqRA?7UyxLvpXcKFg@4Y}**5o{2tS1aj;Th|{6BTB4NG>6IXm$}VP9&PYTa z(d)xMUv4>`u@SphfPPBjH7G`a_9KtlJqY)nN;&O(nV5zuDLlz&S^Y<3{4I&t_&$Vj zwgK%!8azwd9p7WuSP~AeGZOOvX41erv`wF&jlQ8;nW5K2lks_eZRXX%{3Bs;gDCa* z+p$$>y%1u}`WtD8yV+TO>d0b+q*{@%`8;hm5#?HA%H>{8B-;PP2x%G}?Wft| z%35{qsuq3woUG_uafQ}t;YM3wBZ4l+i!xn4qh+&JFG|Ipv4_4*RP#Rs+*~@o;=F$! z2u&n~LiQs-1Ef38M?)WYlkI6j&2R?d8RBCJE2pVYv&lAF?bl zyTL;p-=lKJ)-Z2VAg^obTOqmLa=vVAVqXkN7VOY zM{6-Ict#qwCA539`18v&HGM+KQKj~(Yw{V3q>~HrGjjFCW+?nIgpQ)_LDOUy|q#AtiEqpcUOKaKOp&RO{GtFz81Y=qZ=iM@|0 zSX+58s?8bdJK95sU2xH<^;(;JysOD1c*nUG<5#Dj(3X#6m~8+=wfWcYaxvX^Gmc9JW| zsqpM0=3GW{@>Wq4)!F7HGhrp80hBA}@Qwe_aNP39-7^14IqA;9;d_F@23Bu_*|vHt z(uAUn#|5Ju?*7DnZ4^FcG3BS${^+G3Cruh}et+j$dTqs9rw%`kXqC_Yt}NS(!X7+R ziEW7#dHm>#NysRkC|kK4j%eJx&9){Vbkhp%5LXGt&`>k*cO;3mK3vjDL%t6^7Jl=E zCZ3_f*7@xFPN?6g9l10Fza^T?Teolbq^ZurZp5oAb-WM_+zJ(T6Z|nXabn0V{GDTe zEbpEJ@`b)BOFQ{@$Y%;NO9lIkmvB;r?-Q zQqkMsO?9ibF-Oj|-x)oj1K<54sB0{fc({+rSN|Logji}*%(neFZyH2|MWNt116Rw; zgh2YjtgM+AhSRU--(<9O=wB(>fHyg%(l!(d?kliNot9V5l8f|4bt79ur?oPv9~&G| zRHYzZPuBERoLugZEb1d5MCb0bigr9!NUyc#+ZTU7%$4@}9kpqgR2xAUJX8U4ZnTWd zH+9n9StJ`;JdWRfy6DpZuWw2q1P zwY{Sm1Erc!=v6Iq&@Wk9ovYDuZNw}>Lj&Q?eAY&-$>I@o;x2*-)88B@==uzwdZG;BWkj(m#zm=% zmr5_teGyjgW{g;P7(=9?xnD3$n- z-S5VoEY6fa)MU<>o3*PA{74DPHRIXNR*XMlLcET zI`Xk89=>&+;1A{LAg6$O8a~k&SoSl;5q9dcX|rRpx3_)-Uya6hg|zvV6!|6e0yIrA z#N^XciA%HNS&6z6!fv&Cg7IC_DD0#@+x?lmvg8iym7}h*%ywLW!XVK z70Ff#y~_7&zim&fpT$N9LGzsjH8+y>bZWt4qs0WbNqcWu{&5RF4*hH0AqtM-M%Qw^ z(q{pVjWgIj;|v|`&;;#d`y7HjHmKF)6XNcL8A>t-*?%9mul5@q)hAFS9E+*?KKA|X*DWSRxj^h zqd(bl7Eb@}Q-6@~rmPJq?>nwIXv_{SB9j?MSe$_*G@*F2k}Ep8R1q!6>P+h< z+B`HOh^2iGLQgh(UvyAV39|J>q~bm~8v6Xi+QO0eE~7eB0!yiCD3WOozr6d!N(;Hz z^KoH3GJ!4f{*0Q(BDq^uBB44Wch4m^B&urJaByTxE6yKSS^S{rLO!dW7{+zmab>5Diq+FC%>FER54SH1)JHPduNAwEEjYj;6oT zJk-uUZ#$4!q`U>b0_y;ZxU_M8l6=sG9HgXvb}bjYe&*DAiF0cS{ykh6nfc3he~t_X z|ErVqEe~LKR^5RYdzFx?jqtm_=P%AU3fh|}E&H$TT@>A{6)RYOA9T-~Y1k8H_48o; zDINMXGGPy%_9lLdh(H?%z>i@_w7-2D7{g6G@-q^xIS{XvzW0Yl`9DBh>^)j1KmaBs zz{E;PdxP;lqokb!AjfoEgx|uivrCBn84v}u(56NBhbIA>juthcm6jIyU!0{OQ1(o%4=rTsUzaq1~B^y2C5P--Pw zc)*8ZUPl)jhxt$(JpTx)!XV0jVBz{Iv|q7*JDmT(!U698aBC7m4Q~{ccbn8SZb*v? z#DB5gcX5Wpz-QJ6w_P^lEodoz_ZjZeeD(YCZ>>uLE%-jA0I@vTJ=?rVK0dG1Vc6y0 zwawyW1hC7$(Vl5jCRAl&{Ft+${GJK9Z~cCUFdw{Y;B4&dyvkeo%5|7nEG6Ik*;pwFBRTEYJa7mt`-nN8-qtQv^Vo1w0AQlcXCy7esI3JdVc6^&qJuj zyR@=-=x8rk-|+gqgPq3(+riGtp(6xhiZK~QRY*n)$Kx=b{ZR&L^^8G~`6FRvHdEs2 zkr47ozhp9VwtD_6jRfkbe8cAc2fO(wC|r;{&n|`;oDh zIra_U(M?S_NQN_Np^N)@O$kQg4i5#Zo`&2HV~U9zr!My(o7uFs%TKV1DR8=|x+B@x zYe#R+RbYQ`!Jw*k_8vP~VqVxR@zuk+hzP5s2D#b>V)G2_BFzWplYMKO-M=?$cis0N-9Pe? zQB2OZE-ggCjvr?rXD;Z2^Y6w!HaqednKZ1ot$UU@-_e#lWlnf5xY`zj0Ja!IA$^+? zybHC2BB*|77HAG`eTCVxBvrbw{pJpNH{-}UBiBC2?3v}T3j2L}yCeet;p7Q9o|D{p zK|9Q*zJctoBumh%uXgbxN?$dr=Np@w>mS~EW!1y*E+TR$Q5m_gS0SuvZ z=@1e~in1d_Y9>N#bq5=lCuADdZNw;* zXFP%b%>heF3Bxez6snebZ?X9C}1aimez$3 zkY#bnQ=2}}TRpP&NQhlqk6RT^OiH>uBUD!`eKaKf{pTSa8kCq0U0R(o8}v)fq+a*dt@dcL=cQ zn!3(-@8%@caPcj`Vc>qCrXKAj$fSCoEdi#}T1B?ZrNGW5_(&_s-j>W_9v-ZhM9!_) zK^tvvfOc=p$UA0rLD$Ydnd0!-__S8F`fCe_RhBBXMMIG-_Otb3(o{0z!TW1!5HZox zWpxGtGLvDbuo$mByy%n3mGUe^GLk2KELbz8E?;ERbzFH#y@?8Scf31se0Gjyl1d z_X+3kKUk7(_gaG^c3ILIYE7`d?{cwTgWvpJIPhzGBD4lSr8U*EhNvo)3p(y1h#&rO zuAqi%F8GwY|5LV1U78l(7j`xLcsiYXaJH&nL%rm)(Bp&bliu^BXr-jWeZh~wLugb zWX@fOkXlaY;XJ4NejuB7wWgEkZG#uFkmwEqY4z4(HTd2gRWG>HmV-fdTQ@-Nv%ZUO=3V#+v`L{=^|T0E58bu;~nV}@KCH* zlQ!ZsD@>V2jSQ21k4j%%cE@Wb7f3_2`xbytTBF4&zR&uptM5TWRYlMT-^FHsPHJ4# z6WblKyBcQY=I+GJUJTgh4vddNL#4@l*CKmgK5jvzR=0`F`zqdY<}IQt9UIODR~mOV zvaqxXZCr-FnAc8KKoz$`%Ci!cz(pML-y;~1NPwDmD)htpat1x1Om`b4!rElgd+xh> zhTdY4SdB&%g{vt(Q);{*m+{^A(Ek{Fx%xF`aQM6G0}|u6%xtG2((k=@0-ySj7e0)r zb`~JD&3NNaLbVtb!4`?h{IpYnuy#p%0#~Lj4=O#xZ{Jxc`)lXK*iE5p>PkFJA)AnPEJ}k4rP{j!l&)+|N798Le4Dn`;NIdVwjr7_#LfJD zzMT1T@$7eUL>ChoPd)8k+evx6)-HXHjP!-$+V47o+c%S2M~+XaZYD$-UN?mjdU7~n zApsT8EXmFf&W7*M0=?C`e~+0`>3nJbYvo9&Y5K}hXwbU4^G@MSoBGY4_FCP znui+UzAX>^tNs|8>xk^bP`H@kCw&dt?UK$2u{4hP*sb6hhwZlK9~Un8!i85L9j)mf z&--+{9#VWr(?cjs#sPim!g{u1j+WtjjEe+qgXqORXyVn~2+{Om>&yyFmHzIufEm>= z=%8U3RfO;3B^nMAAgiqHMSCOd@W|x_52XO-UCfqUb%e_(75p@{^ax{0pL=h4NHO7h z&J-fLxP;5bGVnZ6LR*>nFGnd`o6Ym|@6)gc=+!;0?O)Z=p_Vec-+_Pcih^kDQ=y;> zlwQD%Y?R#?N!%d&ps%k*Ry8nWDbm#*T`R$af~eQXNm)CW_Xp<77S_kyedq;t6A0RJ z=rYt5Sm(yYd~g;TJ59a@Y%&WjI({M@UiA?;KiT)3+e5d6?xFg}(H9w*l4ZU>qKz-# zIecu5M5GhxyV3RJ|M+_AuqvCbeVA_P?%Eqcxn6-YSt3l_42r$6B=ny z4AGQ#e&|DT9Ii-*5ct?8z>JhH-Rg1u9zXK=fEoFL&WL)Opa?yuwTJj}-)%}De3tcm z>MDfoP`+J9fV&lB7pO#ERWjZ;y*{q(ot{Y`Wdxft2ErSOc2iVyMas2QDGD`}N&@_S zWPO_VTVa^r@sF9xpqMv%`jQUGBB;ZcGXh%m7}v_$dsKaVJ1he^7n)SsN~UHj9V^h<+vdCshWe z_g&kROnXQ<+-2oRvXgmBOgsBH<_iwD2xfdkVAoWiY%FLiE34)m1_(pTk8TtWH|d1H zKR#Gbf+@c`ywT-YRQEYuUqiGE#o(3H!OW7@+?82Iid0jok-EkNbtL*CL(j5MxE4_C z-1EU1X&g~O4Y~2|MkTu%T9;&Fv$3{K4c;rs#;-*kR&JH7=k6d*P8h8a)>Z+!7$IQ3 zo2XH=BN)`HC6^Ffbq15}T?4%-YH-VFPk#~bW|x1OX86_&MOwzm#LrTk6qi?*&|pFR zB#ntS7X73*deIOUc%~=OMce*RqQht_W-|4*aBH!Q5c{Wn!<+SPh1#y~$l*jYZiVXy zS8wRHJB7}4N8MyEbG_&8x$w-`YKLwb;Tb!lzf^$k95hBxe!R%}=CC4;jTiM^M8g-q z77$ynwR5eBw1h{jfs5fh_PFTi&;nhV345A7$Z9;PJ@VoY=ackKsPNdC>$$25v$L!d z>+<6)2u}HyNt;o3bD>vKV4Kz5@OJWLrd6(s1~F;;B?YrWTU(Q&&2A@O6sbUnmOj5n z6*>kv!s<21ONlf22dBDS*!DredqRb?4sXF2cr(7CqDvXUxYrtA7JN95m~mCBHI2@r z6Wpyg`G9JlE8`bdFVhYr51+9X8x5x$B5Q+cXXnVrUI@?WQCkxCY*x08@u6ynbD9iF zSNqgUShy8tbXF9Wnm7JYFMhvqR=(5KVLlEt{Z2uTKSpYnpt^m2J%`?Je!c#&T&_1$ z2VFZif#kRc_H29L8dGN)#Pg2rvM&>}20K|}`nD0fP3Sy(SBLyF$@a)0Je5I56zZ3% z*mWc3&GsudGU7)Gxc7tEIy0n z#0`6ic{ucpwboZv>9f*g@#nX?94Gq&||mHL>XDRG~>Uc5^%WfTX;f z>31kq3jD-a4mool9{hMZCuF!TJ2^(!asfp7 z`p>w+SmS98R6W!(QJWKU`kVQC?@0*}$+|UJ0S1!e7UZ%^O%!V+4HuqVqT+<8DbSk* zY4rxnMFk{G>sr-psz#WxdV#TBiCK6@f(ws}H{Rt(iX}-9a+$;Pa-4G}hF1j>ZKPk; zdo9b(hJ?2dG7^C)dpAq)UrWTSaCG->-IkR?@~#m;*hLDO)wVBT8_P??VZ)dys~en* ziD!A4M7E|EH9y>fYz1<36 zdiA-3Cn|8=t6-6fX@~#PE%NGmR7-8T9pyc5gc;p;^&|tSP?cgUbZz07nkx`fYxK&x zhbJG#Ri761)y1jbR7}0T?0kbbL_ieA342{|1oo+ozUuR)#2!}j@ppdkjj@@o(2dou zV?EfeUzTolpYe!@9V;m6N-R^E@*K72z3?EZ^52U~JQR)6*b<5#K_ zpZoeu-jq=aCZo!cOqvf^x6KBiuRK<^hz=b!*RE6#t%WDkVF--4xFs9k<}a{0UM%af zx;Ay3ZM$)|GDjU6Drt`)AkE6H7WYD6RDB{kgAQ6u-&~1Ih(%KK%Rp|8S_wPLmI{6D zX7t@R%#?p_Ma$kU*m^i-wq@d~d$UwdrFBOm?63&s>fT7~U=<5ZzK{7DloL|Rx5X9h zy~R{;FQM|>qk4?C>%Rl>_I=k<7KW=j%mQdl8NKo!VB@BN5_D&1u$zqGsn; zMo261WIkx8-Sfosy9`F`>4!`Y-)~Ca+KZl3wTn>Jc>5F~Q(K|}CrJ<`jAk|bO15X0 z^@(Ef$DyMs;#iQ$h(pwjgx6#U?pugnQXUs`sLQy++%@quCTfQU6sjP{=&)8cag6;` zx|VrRUaPAdoRpAw7Hs|X0QCP*Hotg+QJ-i(0B*t;CfGkTMsg5f5$s=2e(Ct-R|OC3 z{}e{~E&B`v_!HFeTlN>?6z}t2x(W)OXopfh07@_=5?ZrAZ}kzjLr;K&gZ~ZNJ*oni ztBO#5<2c8R&bR)y{1lP(tC53DkRLMj59(^RS*cG-60??LUGdsdTZXK6mnGp!!WriE z>blKdw@V`5R~8_>V~RLKNAcidVTI`e^tICm+DeCo=?-~toqLtA3EA?+0+CRJeun0p zo4MYc1iyBqU72X~E`hB(jGw=?q6KkQ1jbqmN=$% z1_GTjVCI5siki8S9hRwHKbICna{WE!%x7J`k11Y)$!(WATZj%?CvSbuFTiqrLUF3& z1oLnrz2>xDcGUj6W_Gl^e#1P7QaY}JHQCmR4`a{+ptQ(gw{+nqg{J#?B$hT>%!LYZ zN>C5s5aJkkvju8R6VIyi7diNBok5}3Lb48OtUDxF{a?i^m}{vK9* zs;(Mdh%?;e@X-Bz=RCC@H%xn&NNcQMO~ct(j0)LC*k+8bNZCGL)?5hZP52zza&CvX z{NVV?i&6#Gg{kSw49#m>#CxcJV)OU|HkD?u5DBG$0Q_IXo!@q~90))G2dW$g0vup} z#~Md^jVyhBw42@pj7{PvyTMIJ34b!d(r`c?81B}H0^1;Y0sto=ItuWI8=Mjacngji zzK{Pa@F&xmcmf~^3^fz^(|Tn-23H27KQUWQzC3}!bSZ!$Fp~c*^REWn1k0i))(>?S zKmrV%+vNS(2lAd^_3}J`HyBB#FfYyPd3=>&m?tDTfu#5;*4DKIFa~~&*X3XpUd2!S z$Cd-qz~rQ4vjYmv$6zD~#J|KK)hfUrVvu_kz~~QvUk6qpR`LY=)7Jy^!0LZNc~PzmM1kl4S}D4YTC5Jy_4P z2LKhpFF({{y4=UWSQeyzEZ+pF2e6ps1Aq;@Vly8A9$>l^IV5<3-71P{!ELsXKy|SC z0cddB0W=WoCrQA90kZv`FDV#s69pjxy@rq zHOId$v)U;H;37C)+pseOLh_NsRt5W)@b+8pAu8}sIQ%^-P!amKg>m_Qc$xk0 zbYQanZ_((gV$|PWj*m*mwv){0KbKn9cA{sqIW>Z!(GkqQsn!IKr&k-!)$;ZOs_m@S z$@=LIqqb8_3~^3;JS7coj}{wUN8w8iY~Q3f5@cCXn7XhLl0dZ8PiS@SNBB*_Wynvk zFphtScB@tB5pOKB)J?Ba_e}s0+F>V~sg9X)C$+ha2V$n;pDfvQIh97WtvTusp2l)Y+Z?E&aBVLGxh!N2p?0KLI|juXZi4xgkpJ4hD4U z@B((n$y;VN$C$^L3ZA=rSdeqX)VTtVB8AJ5

06>vIkjG0E13E zy9!4WQz|ZvzKt7OK#ih_Ys?BF?onL4UAkf1svDI4HPV*surNe&De-_4q2w`Wj7=d~ zde=Dyj7v#n3yA>>dbe)mJ=y8hDTHc^aY+j#cF?E5d1iHK>_JkAlfai-H_ZZ?$blL8 z%9_3Y-k4h0uY>S&{GY`(w+xL;z!EDu-~5a(D)D9VQG+oVCsE+{(hDWcMPi>(XJPDc zx`Jq!7U%is!8qWo2U~cYJTy5r5NYv)STl~AKWgWB4eGoqZ8*p@t)_Q89QbhQFMK;^ zy9{cLu;j2F!0L#ckDH7y!W_PjQT&pw-<}4_^_9lMdsE-)I5(2%3K`gdw5IYJVd{r( zOr z5Z+?8pv}~u2ZmybmLi^K`bT8?pUT_5Y8c`)sr)u`uy)~oFQtNWAgHf-M2%)xkgD|m-t44tz^1ZVRm=c3!BiaJpZyOKAKa!;{j^g^;{(gVru#tf z*Tnv~F(nCsv0&3(B>vlmi(&UG9^O>Xa$qaire9J2M`^-c%~M=)Fg5VcVW36x9|80~bu0hVX%-F89lXaOreMeaDz?4} zmvA}&&RaoI_vjWLs4d3+ZN=6q*0yt!==Vo&SsaR_GkcJgXI_4MuE?_zn@=rd?s$z} zXi*Md*}YWlGDFS2*6QlQ0#~vMJ^OO>)!EP>ss!`2xOD-_ zs*z(TWs67+nUquk))svDX5LTGU-@#j&=xSVeSMDQUne^(>R55&-gdMt^0Y z&(flp%|t9eSHISR(XS2YGO&jQ$l)scFiX;XX7i*drb5`Bj?bO9m{RR@A(h!Js=k~v z$u2+h=`YkaqUb`3j63Rro|RJ|h3`y=EhM<)tPZeSetiXkRFRXk35Yec*?#Hamj9qh zC>>$85!6oh@}P_EV{*T&YJ^G7?p;)ndnLt5e>`?+GvBs-&CC3Q+ElQry`6AtsQ52SQhLY#+Ss$kpfiWk4?SLd=^ZdkN*)Y`oMOp2SM^Vy0= zww4t&yNQYc+n&f2dCC9n?XhLOGIDr9_os=={JEFv54snHuj+ux8TqXFOj80KIT+%l zCC}7cxjKJPDfui;wkOT;E(Opu%wV zkh>8ci7Fw|#x?sr)ZrePr1_%~rydfIu3Y)7k)<_E)hxzPeH5Z|lBeGxlEfytTI9;D zX^RS-_SMp#|I}EH$~uJtW$p8h!&rHJ8qKi$xqK}vjz?>v@R;UJl~rX_(KjpIVK<({-65^ z3nRzh>j{`l@~faG(<7_<&&}yq<-LEQKB%JgB+c7CZXBKor-CHE@7Hqm#neK-RC_7w zM%^hii#1u}tZ0!KO~B&#a}KIy_GicdQ=ULmz~JnzSI z+|%P7rD!|0gI!*l)m&{SASZFw9D5h@ttut}sg7Cw#S8|ePejiHLyES9BV!*03C@*A zI8Lpm3A;Vnx&#IFoSntUr>*qzHwj0Clh53$faigj9tIE7w`*@Ij9AX~gIp8y;@ zlV7`ZG8?{2p@1eP`s!O*_hgx<5Kj>`HBPe~M}xRfZYJFR-qYpNHOBt1{d6*??S$sY zFhx~2wj1R4cWy1aJa6^S*&%!cKS>Ff!^aOrZ_@N;RW6Oo#68rYi{Ivv!ynW9V+AFU zvV%_vL3ZGu*gjo$UKDTQ5rsh)U-cIKaj5|i63X!rey{U(H6TtxRAVvP z?=vbw`O#9CvArT&*CK-o$>Xg&hPt4$igBxb5qAnLKG9*Js6)T3{H)0SW7*Xfq08Ki zitS(|oz+ss$_*J#Kbj%c*8 zAr=EPhfOI+ot1NjL87Wg0q;b0v{pIY?`93!TNBh?Xci66QmPf0nijSa9G<@mXp2gl zlIG@qRf8cxg98ClKk19e`#7xYfRAiegQi0)5J7R|(>{K4MxL~y&Oi!6&kwnH?kqe! z>Q$v>PVCP8LbZ0D-mNDh!meI{!{gxE_#xsV!?EF7d_TwYS)OWaSY4fkL=toT4(0n! zQv+*5v}Gz~={{F&EfIu|J@pO_e%+OGvS#cLPhUbaaPKpY;76|=fqx(h0w-V}7-RAN_&P@BagX7J|C_%J&I9--vi`XTP!-&R&wH?n zW^W)~!hGvftlPkQ;0X9jAldt`z@PBhE@F>|$*5?@4y%_pWSa9x zZZpq~&ZqU38cnZ(@1PA0r{tUE6Y9Wephj%yI^)gpORCqA*j!?$ z`+hPb9-f}I&*%ENp}g6wFI3|#(ZV={OFrT$W-yQ!-)U;$Nenf7;GqkGRW1}nPR%dC z;PK+GeoW*zB7D|tlt6Cglku%k8fMjU@J_?SHdm@*{?I^SKBAf-?hSdv2J6el z#9=1ceuw4_aqBUjva9CU_zuQPaukAr?pQ0EF4QVm1x@N9OU|as32BguY}@X~WyCOg zCCTk#ZPk{U(rMD1Bg}k5;dbWFBAjF$X}hnI<Z+Jg5RD|(p>vVpb zI(VgJq{jBi%iqZb9%Nd1hDh!lcF`_j$OHN9!-5q3Ud=Fu2d*lwx&xeJeJqcdk}=@5 zzoJ08$_E6Lxnd{J%t#avE`4Q;)^0$lv_$=yS&AqI$2Hk>jFx-Db4t89ckU3l49f7w zA_68~jAep8ziPH!q$tM>y72j+gNX}7vke+wahCqMlR!gR`Ru}%IcZx*Y3SJr?g?q>)uY|PWzosby{4MH@l+ZW&oVoS;k*&Pjye@--&{1EwEk}K==S`Zoyq+0_RY*%9lGD3o5b+oW)+jwv zgF3A}w99j5cf(MAchGa0I@snmvf?EdN+qt|(T=M6w+KHS3@SZY*o2sJ-#eV=Zr%fV zGFpdauSzE`Yu5tCTCx-SCa@in(|i5LPrYObkaOhMx!UH5V6VVtn3&;RXP@W zB@1j$j0I`$=X`_%%9Y1Kudj4I!4)a-AWgUMP)wJPV!Vo)3nBVJ>~5TYyL%@8Ad&k3 z@sAxk;WP$FPW@k(DyBasW@T%r|IZ{)9I?PPFd#~p2sZv#kAJ}%s$L?n5WH7C1<#fp ze8K;>4Ou4z{QNJO1e>m69I%qI6yR&HlAme+C9u@>{Y?jCL&h=tOhIlwTb-72ljUZ{Qs|hCSMHh`?UK{GRN8v#Xuvls@pPf8%g=o ziwl(lxxkb1be$w8g?_~INuXi>$63%<1AhLu%tOr+x`|#36a$}x>Mj2z5Y_VZGMO#F z0`Lf)@}>QKna6}_|M!CX`{YrbbT{+Md;C%>h58Ha)O0+ZU*9^OV5EpHaG#}Jz(0P5 zsjkO^<@fOz+-W>a z@c$@7n$VhE`o}%OIS5PwM;%Kk>X3>&x><`r!Z6EV)fFkch z{Yar+%5TmtUaU}{>BibDO=Jfz!ik}0SBVaa8Y=(_xXq&!hE}XwWimvkenDmD=Jx8Q$@&-Bf+kLCR%g9$#IZ z|9aS2oK35TeWaXiy5l{@{a$JsOdAHndFQdC7=d1*Z}diaKymN2FoK9iV74P^NJcPo zH9f6*2Z$oZRogfbV?#S4AUD(kg&D|JfREf6uA|xi;vAJQHHaJpeA$XNs;?#CzC|^h=kEtr%KJA{U1W{_a^Ef0sZ%i_2uV--|Zt_zcwzYm{H@Rpg`<8a` z`{7ASjHKf!K3jDojPvmctrE=lRw5G|(C{N_v!K$>tlHjmFPPg+PW~ev%3A#kbJ#jh z+MI%-)!qbi&o6f0YHuSsj;$aF#Y%1Shcv#M!RqMAQF~CbD_GEcBNZN*fAOA!L8})J z&(M02> z#xqdW9Ry=NEq2b@ga4M9b<0ELgD7cgnYSOHY$pBFX}?W=tX_yR7IglrngM@RAM-<$ zp|;w0UR2Db+aZoQ&wrezgmU1vrAOXX9-xkjxfgy==I}c#!v5~s;CPdxN6Sz-X3yrW z>b1z3L7z-XxzqrD$E%@)bZ-WILUP%RAfQ ziDII;7vU1WPu7%uZ>gDa#HWIqCtYIf-rIPQt?l@VfPX~J9}tCjyD1VeE0lL-tyel0 z9>Ih7{8jHe*xc{ilrYQv1Gr$W;tdbE`h(GHc@GE9n%->9b%2 zrPisIuDi}1|$Kgz`e1pWe?3bjN z1=*VCP$mYj8e$QGCC8y76{YP>Zs=2(i9*V8Gs$JPxl1qk!o-b}DET9aaaR3#mqEh) z+w^smdc5rA6qB3ijJz9$lE@<5`qzzjz*Kju#GPuKiFV1)~TJt zIoCMy2!V)3dQ?LKuPr)k!xUHHQ1kpwb(EkCeL9(z&=eGOMr_L%jku*ehM!i(AbV$z z0OFLTIaxrp1{bFL+53edR)36>ME?q;oK>pyy}E`Es+S5TVV^$|W#dFo?M76K>sdoe z0~&fciF>sobuEUrL+5Jp7IgFItr{IvTbf#2xMyFWxe#h=$Cyto-54_t*7jOpePDjO zYSeg&nXbwCb{6R1e7JOUin%TD_IL_E zfrLyRW{ht6>;n%*537AghvRaXPF7hZB{AWKmyYjihJ=w3_^8wf+O@;k9zav#uU2Ei z-w|AtWKCA@M{KT2;3Tyt0DOTs8urJNL)j7rogn9%_5>!k2}W_GY<$ zT&Gj8c1}f$-JR~9_Rlvmyw!?)eLu_k^+MX&lS+1{m+z(cs|zxR$YamsGI1nVIlET> zS9Szd`mKZmHC+B5#WUz&|4M>Xfn4m=T?~yA%SWNc&P}+QDX*=H#o3{S8-7sB; z$8K}$fUmJ`cMGZ@uIAf3yHHB%k(dH8Gp03ij2MZ6%NoP?Wmi&av1^rDzU3N0tS~~< zAhynT_9^Z95(q3`H!B8!lbQ>%A0?d>28-lX=w!ElD60XF$iLpwD+DMMB;pkmiatxv z%aK`0@B&TZwSE~eYCv!8c?`gU(77#~_Xv0%@6Py$dL!wC)hl>Yu^FUnzRvFz{aD?H zr2bxYD~TQxKw9DcdS9KMW$h}VJL5R|HHE$~qTD*VeBUR@9?)b1V-&n!P*9LMW_@`H z&@TmYc;#pJ$zA8p9c;9W5@gylPqiA^a+IpYba4pvP2@p83KuG=y_L`D@B3LfrE z8rDbSyeAwr)6G3K&9Jz&^#1-#0BxXR!jKp=?w|4Dhm$vNAemkICp>3Pr7H|Ec^QNu z`Y;&K*_RO^1EZvnBbY?q)-WMj_~Cj40jRGKu1Lhp>?NV@W!zB8TN2EP!to}BmYv)! zeDjRgd}V&xG_1#Kq&_N9gM4OAY>4kms}(uo&zd-IAx+m$b-gVhl@lS=!)Wur%vs8U zN@zUVhm{$WGzOc!2X7JO85~s(pGAJk*}j!39NLa65(E_DGQS!DdLR@iQ1ZTmPOY19 z*FBW9y_^aa*SMTPu3X5#bk_Okh9rco5}$~RSRi|(uY~opqXo7O(ffgAaDrXU%uVa$ z>L}nfJH7fBf|0BkxVd5YImmV8;bHzW5Rq9TDDR9AxT`)TMQG}77erMhK(deNq_T^5wKvA%mraqL0@D1}j8g27*{qO$Q)dEZ9V$ zmYzvMkZ|4#Q7qCWQLVdwMz!jRR_G;p+pcP>(cB#ZK}5nO98tW~iy$eJalQU72IPG? zw3koQ;(|&%COI{Z)YIbj4a*PmDvprvNSZ|nvkA@9Gnya}Mb82~W*}i>%8Vps`Q4tA z-cp%jg=%esC)zZX0CZ{U*M@-)7>La*8yyxpEqxe*%7mF%cCH=Xp4i+L0u&~NwUprp z3Vi2zoTL+_spL_CL>%Z}sg>?NNPS9qV+Zl{D6>dEK_mjGqms@G^|PcMR*)F}8$M0gIu_(M zT}u=EQR>z;4Yx~P=cPg!ujEgGs7Uuxgu4VR1tT6-hV+$}=$Jp3ea2-QRVqQ4U14pD zjO|C&pFY=EH&6SPQR-IYwn{f?9N z>Pn*u|5Lhxl>vy#^fkQ`D%@noD%O5eRM|#fz=&cRn&5#2#;Ul9`}k5|4vDX=#5u35 zgmk!LmC$^4sMuFApv&!x*ArT>b5Lj0%Bb51`@C1*x`($2^5bRA1w)EJ8h)MI&+thF z*nRYJD<8T|6;|efF_q=qNldS*rG7rQVvYnNff{qTG)i~uL=kR0zxNw(NkE=u0WzJQ z*QBzz9W?s6c-P$MGEmqmB4!paXP(`f&fA)~%(+UB6V%6lR4{dnw}q+n817%N8!=Pp zBVBXM_9AxPhTU`^|BlH53NeLC3_=p!5wl=%4PkxZ6Yob^s8nGFPh3DCx9Y(#X-R5X zo?YqFVXfV-*SSe3EzTk7;WE69HN;d2H)Q3R1+*(v-dq-AzvF#jRP6~r0I6>wDhY|5 zzXhkUV80tfTaF<~B zYd2i9y!1$v9(+n(Sk94VtG)v6{rJC`?C%-{ZHbVt=`f) zi0Q~NcoIMBbhY7GHR%hixfli+-e>AC7|(s*T7F)Ct&Y-xJ{cj_4AgapWC)V z+j^~ycKBP_WbueTJtWS@3kSV22&i%wC;C)ACvyeitFO77{D6pVi8Hv!!ynhiUABmG zXH2A91fpG?N?$?WO>ThrMNLS!=g$%-<-*QgRgBkj#GvA&_@Af8JKR8jC9E+;a7e%= zR*IXV2=Y;ip-JDS7wE#r^6+M^sv6gp7K(X;zOOd@0I}>jE8gAi8A52|7v<-!QHVQ$ zQapt}gxlZsu6&32goV@bJN7repTt6LW16C{>RgjBdsWGxBKOZqMyBrrRT#3hb~-pR zMSK@T=Y&-gv&dwc05Ct&y}W0OpIOlp%qHvR%Nmf>E(IN;kWa1?OXvg5g)>t z_U#y(P*O2C3eOyMPro=O-?`C?o(YzWO~RG>gI3g>nVHU!ouZ|Vqplmg$!@04^#`1s zU7YD{u(Q!0$!KELwk-X_*SBd96}>DQWL^rz0nyVR>L8}vUy|Nx zdqH-gj?d7LMcj`gi4W@0Wot3(_K?{!5=Y>fa(~FN2Kkj*c(7srV6NwLSb}TEXzxzi zbX@_k6ugfscoos$M%aL#u+#y6k)~HL&ac!nkOI1(X&B@$dczx{U7hp{WA~c{Jgssk z1PLhNoDE$x9Zx#~A+ z(sj&dt3MQl{;2ECV29*yq%DKLNxfd7hbP@&Dz$TSwG+#42Ao-{=bG+X_`^0t<2Y_o z$IzA4(m5d9_~IU&N{SNKP+V3P|haDq8ijsS{pFRPz%LTO6^6VlHQUcoUC% zixkZFk@0X)WmRmdGp@aWG?3cq3rgtiHS#SJ{#Jv;x@l89dV!7a+i6tpP0u|mwFYM| zDv@X$DSmiqgizBM4*OE2Sn;q8d@_oPGgOcr9R+EfQXxWd+-0JRL1kKeMbU@Yce4rh znZT0kz>qVZxyg%wdG{(0V^kWytDRDHfw2nPB2=LowD}f8Qx_lGfVjb{!ne53>^< z{Rt)5)lJayd<7ff8@^LcCHa^H$|9e65e7U=(6L5ea8CkilG^B`a>Iv-I(TPzGBSJt z#1iz7w;w4vUzAOMhI*s4CbSx$q*93svbSD7%iw9VVQ<>3zU=k49+(yEcGB-^q2xjg%a{C|+3UZKOTV=w8XsaxQzjlV;7C zkMu$HoOG}sY1{IvSJa0yiDNGWHMoB)?F<;hPU5gXbi7@I-wxk0}AT?E7j- z63`)6HvwhYw--A*GlurXmW)fm3ZN1)2OXca)M<_r1yQUBSKLK4;{CNBZzD71u=`-^ zv$t_vmh>w>wL*VD|Go-Y!9|?$W|4frqFih{aHixt#`LS_HJG!CfvI}Qx;~rBbkQW+ zIj6XdA4h$xbMIsphiNiGbJ$m^ERl!VEniM~znbc9t>>2jScza4#7A&d2H+b0EtDA=mjC|+%J@X>aCz?cmc~>9$9Sc%E69wALNa7go!C3TU#4{-a*CMqB*+5N)jhSCw;=i_(dxTwCq109%3p+ z)Un@c7WRh12e&Hu;6@g1I)3F-3KDAWN3C&Z&vXfOi_hsk)r+XYYP8+@=!Ee~U3t9} zQ1kiK4tNhbBxrBwNo}~TyzQoHN&H3JnD))(r3@`bDnflN-QTSpw_YjK>26-Nw%=B1 zWj45cE|IJF48>MZw~DZR1e)<#b&bv?IFjWgqA=}D6(6zW^IJ3w8mqw37!4o5!|$)< zhFw~}hMT6qQ19S%=|Zi~OVsd%J6S`qHkff{pG41|whcA(SqrZa%RVMbWI>Ct1kg@1*}`VdA)W3# z&^feXG4BRuF?~)d*vGP5OMO!}+^SXa3@(HZe~u_(JHntfaPy#=VWbvcLMh}&g5_t^ z{_pCK`SI|s+Bi=0T7{qMS~^b(Z(lW6o7-4M@R+;XLiB2>NF*m-c;#5$?P|8`;cbcY z7tw!r4`B`E3|-xx?f`L2m$+(YRlhAT>6B|Ji)K6D6jO54$XH~wMQTM+-a;&^WECj$s;+T2)BuiGBw_A99j z<(?aPHRw5EWAP;)fBn<9=ezjPtF!M!i&o-JyB-;X4Ij997o0%&ehx*S32b>k=_iN| z=0V>bvyOVdCGxs4$vLxHs9x)zZq~(*P)Yg9bP9dvz)cVL0^069E7!pI?CH%9eiTvq zi+j~Mov?@*>U~9jp-DzJe(@G!dloJ?p6$|k*;yhQVS+r@SN2}ZS2$D)9Pb4YbiS+Q zK&(^z$Vs!u?JIT!0U<(?@89A1wdx!PfF{nx7toQ*N#)s)Ts`Y0v zQ>qrOquZNRruCoiMIsXLc0c!UCXc>Naql)Q6-vdOVN(4_5EJlY2KVlf@D*7%&5tqs zV+KXtSJA+lPaoqpy(<3yO-0JjAiru&m|vG za0E_C*@@-P3C4E4vY#O@i0}c+`4gep)(4igbxvc(y?Qqm-9n4!7F9z1Irs|cLoDi)AgYh<{8{ zNZ9yTcIh30xX%w;AKc>!nwr{Whcs1+Q)eR<1#qR2`^V{GX*`Gqjq?jEwtsF&T6OG& zsl@NwVvw(iX`>#NX=zRFUn7e&AfQC3+L3Tqa`4{y+IjN8^KjNMB8;oaL1u1tsD?D4 zuN;MN=zog~d0V9}ghhwglqeLMwve@KsP;yLENlT4WblR}gv6O9;%n!)j&0NW7nQjib247j|g{+QJ*O_st|JV*m?#hF$*C z*$Zmadf&b*$v(>-7kW*zddT;g^KbRI2aQ_3|A4Kcs$EG$A#K&4Bqypb<%{(~>hWVj zT3Nv511X4{5Mpckvfb?2buE)eYWYDdpGE{>BxZFBTTZ>iO~ZaTgt<+C-zhQ984kNg z65cBPp>ASd*AfRYRKsGn;l6KAZ*}OpyyBv$Wqo`Mf?q1L1wk*V9=}ifm~Xt*G)6pl zQu$+lY3)aMHln*r?GM|dEAfT3Z)r6o{h7{uQW}zzfsSp5@5FkE$aCijaVsG9e>i3j zrS6|pkOawbVjL8DT^!>?cSsglbf7H3FMW1lNrS^lN9XDeD}dKogwMIKvBg?i*$>8;72fNNdC|z{}eAo$D_gdA2i4&%U~KIEC`5u<-ZZJpB!_Q2EoA5wK^XF&4ctP{0d>L{pMuyzu6tMnf{rna!W}x}Q`e|dJ(Ez_P zG4o$te;m?A%rt)zS$|^t+lHGUH~!~+6CNMNuDxcX5eLtAT(0%T)T8J72I_A>QO5XF zs_8IJnq@FG%9U2~q8E3|wk9sLsgzD?;__fu6qT;d+pbC#v}CKw zp)49HP3`_zc{iBb$hk9Nk#|`H4bfYuY0mRm1Ai0*V^mlbLLV@qFF&6&0X&MHf=>#W z2qxZR#UrHugjz`5N!B_M@PJ^QO{Xt#Bq9mt^A;(SYr`PNLY?}>^N#^@2sID`u?19&D`qd0JS*MqXuj5U;qHd4+BL4lK7c;r$R!CCu!vJ zTTjBy?e@*h70*|%NZPvr#BWp5P`m>ppgf)_;%zu=2zZ*c7Ks_baz4>mcf^MW$oAQ#@1os^`m7PrD&J*Y!QC_|cbQ z+AIq%lp05ttC8m?_1v1`-~e`a010aaRzXHvs{vb+s&mJpVg)|bwy?ho`jQ`MF0jbt$m*a4?`y`r<)l(1QO^A$V@UpcXIGoo?{6%$p=- zliZ?f!|9Z$f*hQv)*uGPLyON|rSgTZ%Zabz>u?ERl*Ej;Q0tD8KJJdMQ#n#+{J*WbEyh5hQ{h*1O2te*t`cP>98>eVvH#V z9a+J!XgrVAlE*W-QYe=wRGVnQkE-921}v@aot2H(q+>RYqXYEEsE~~?lB+sM8_Gc0 z%`&!2uj0G>YqjsczbFp$8RfOu3^5-O<=l>Rn&a!e$AYcXW0qp}A#N9)51otEL-SnH zoYhPqeedy13owS{`T&}SRI1ktAoq1s7a$|!SRfE|GgDj3amr~^ ze;osLx(bju`)DQm2r*$xbqq+JMSfa*G_qPi5~EwFHIJz+ITB$62zb&p40Af> z?=}VN+JcEnoj`WY_`OtM440oPET{)NgGi4QnV2b!)l)X{mGu0%9RgMG^4KbQTI)$$ z%!_O@9p07l?_I(vPzu}T5gM2M#ouij$87T>Zq0+ZJ&SUVOKS=$QBA zh9O6qnxxjH%4|yiKf1m#I*5mTL5DDf`?8n#~7zS?5iatYYJ+OZ6f z+=V{cnU-~TjWY(-0s)XyrB|gT0(B6Ktv_Q;2OzTJRPoCgS=xnvKWj1#oFf2)e<|Yi zpT~U^r;JmI(s4-U?YRJNnMbzmyCn#MfW25RZu~_cS!%jP> zn}GL-$xjCc17NNgU^za@^^ZTAb=cd zAMjIc((1*ZD%#n1Q-N|ggJ1>>GF}jb)z3jsVgkBysKz6VzCEYgWR`itf)O(n>TLGy z>_c1IQ9Kr;U*G1|p<@9yuPvgSQ0a3i-e$>tvN1&ri7VHlwY&oyvMV4$d@x(K0-RVC&n}Y)0e|C4f^x6V)JMFi7Vj~JW zCVs+y!3~*bwN;+0(AH~!r1LgHiGGZ0@4CVFUR~-lW!_Zy#r8g*m`;f%k|CJ+0zP>j z+VFDxbAe@#bpV3`gD9F+O-%}l$A;gKzT`CoEYUdL6d&+diG9+ky{oAcx4vD(7gK#| z+6}PoW(fT72A3>$%kKuPsc;R`N@>2zhn-tjjH?;fSzax_DSb1|cjkR``}8_Sszl=u zekW0S5%0ecDNbtmUSYyRiPc)vo>2GtneLkXUc%$u^~7+zDq~;sXC7j^oJ-J1nQQP^98_N%FTr(8FR3*DOR0pK6L|M#$% z2iR{ij%`WtUqNsZmVda0g(bz`O87)e3gthQz&{F2g@tnL{~$*kwtpV=^QS;dv9LgB|7X_VHvre20`WgK;dTEXn|xqkQULB0$bSe_k~>B2AJ)g|^#^se_zx-d z_o7(-qa)Sz|91zQwaRwftSI5)__+&C=zAJKO6IfP{jTL{Nu~~0r=>IMpFEj z2$ekY-%UtUtRgA?R#v)2Qgk5x=49R#qJ&K!%1Q$Clr1u{-^$95{g{4>SjyE`{*uvq zM|T)d>$&dD$HmuW&?)YAhiT6(_CZ;>wu&mC)`+Z#kbX!jziRGoxCX~NUlmlZ!1;?{ z!%t>5$Kp=km~0!xUr`2zQY^LaxnF*NvvHrK1LD9q3fQe}4!+71Bt$;D2^>b`O8W*= z{57JE-mMF{UuY;E5Gy(LV_EVS&^sE5^<#)+zbJ_KIWR}Q9)_^X37jBLD6GLdFmf)D z5-d}bKUEB7)r)TdwwwR{4(qlLGGo(@hs`M}CB42EEn{Dxx_=CcqF2T|TK7UQ^RKb` zFLFE==jRi5aN24^X&8IqBdv$o58!$0e2Q#J>l8>z(4;Tv0Q<0sFZf+@aq^pTu_n74 zezBXAq`gdZp_f^^=@hkWluSQeJB&V|I24d&8?_)+g7MzARQMv@pj2^_9L892oJ2n7 zvH5u&#%yS}6ZD2m*ezm3zO*BKh1+_ym^zDjQ3Lhzgvsg_e{AJHZ1B^sn}TnZBXjp< zqRld-qw&ep8#P6I<|9)t;y3>*4}Q_OtQeOiI z9H>Rw^nk5h)H?17U0iHP@3RL(88aMWq8a**eJ9D!v11FTAbTid9`vqGIM8*;^%%7S zx6%!>P7Z)@QLzfnfgoOTILQRe#t6IaOrY>#+3-=exJexy;B#MbUaBBcN5~~`&*L32 zBXnmo`SGtqy_I7gx$>Leg-pL}vVVNsYN?0|4!~lIT3fs}hCF#0&m_z+8>g|D)Xv}D znoJ3XokpcdM{KlN-K7pLM7*-`mQ4=itUs)H*lR`fJ(6Dz4At6f85@qC34c~Afc9$Y zJSbHbZ{-j@mw7Tna$byUpI|tmyx04n)N;7+b)Bkg1>*AhuySW1iNNKADo}x~oJ4O3 z8W1Tg&(8CUIm`~{`8rBcPz$x2cfN+hDDJYiyhgqFJheZMKc;c)J1hC|I{VUoP~wi_ zX`GmL-FHsvhScD5p+)MXR$2p^5m|k>78Em|R+&7iGU3@5NVyD|q^_hNinzvZp=4XJ z#k4j;l~~1Fj%bg}Jb9!k;KwzpbU&H!!vS!IEk6`cN!M#AsRIjYhC=u@xx8qMrVwGV z<{6Z<)WF79zM_ftsy-^W)t3!!Gip@CtC(W1%xUVPA7E&%>$3=j8WhSp4Ua{umY~^^ zXM^0q*i=5)0$9l{wTB++Rb64lH$%!`LYI$7F#=qD znq;z4axBzyI&;p|Da)Yn*Dn4HqEHX671&|k(QL(@KKXOrB$v5Ey8(^5S zU?pY<^strHiV<#<3jBq>;yrQSBVa*4+HFyj))9n!sVHEw6v;v?Wp1r-4Vwop{cYcW zqh_yP2~V~ZtRS-O)**L3^2$U`P2)y{pwj_f(|Ra(t@H?$zj0n!pu%0*+yD@0;?W^C zTWHure>c#P`4g!%vY@~w*YQl6U#yeQdt#;J;vN`e@#Wr-h079tJF2u|svPY-nP~)L zQcg}+H$+SJtw8E)Nu@tO3{6V9{>o=Ue)d*{mAeYFo93yxYRAw`F4sw9pX2#HDU@~g#}Fo;}0r|DaF8yBC!7X$1xyd3Jgh6$DnfR3im zbbqmqWZ<;;+SySLwfWpjird? zXf_PPCq@eqXv}iLhwAr1)m#NX6x&=LOy{B^SI|#A@%zy>NSQTM$;st$l%DtLDVHkD zF99lXr2nDNuM77L;vYuwr#<77|L=i|mJ+`5Pxo#(pJD*^_j$NHwb3Blv@;Tg>l7z-0e zM@q0k!`x&_id_7i$C#NsOK1%y?FC-5eG5t25rCdR9F;~2EyIl!wHbqF9`_)#|23cV zRxT_8T$X$8)<-Nfh;k^9UV<8x$^jgchl1oAW6wU)DC!m!E&nj`m)X!bEVTy@yoha* z0r3c;;GuZ=)L21FWj0b}^O463o#Im-NR!$$xzF0VL-w(ly*zHS?M=sbl|Dct9wXZ6 zRRA7}cyFqvPo^O-LM()+(?nA;hmnwyhw99jN+3{^q-s2PjS}=?7Gh+=si_B2*ZR5C z9&|^33&x=Gk%jq7M;|i=k~*%>Yd$c7d`=LZYpZZWAroiTMeK(ZrYLPbrv;9x2)1lTmDqLYFT|c z^fSeuyk!OXa(WV-N%|;Q&9E)myfX(rsoJs;ICPyxdLg&5UE%O z-rNfNfaOfivSH)g(I$_HwPz;)zT>jTJPe@AoYRl6ZK{C9F7<_alDaTT%hNyGCb4rpGkU zKU_7AJb*Ws+q2V0nVgV3bSst*iJZQg^&1{0%b+p$=OMk)o)zQWDzOQJh_5#+%e7k5 z^@^TSztC&Wch|2~to&@5pev6=%;|%dpb;BhTrIjUywjp4sGwSnL7(&#`8hXgi0~ut zrt-8GFw0x_9CV#-n+3Aw_8hz*Ys-A;t?c-Uk{n%U)%RKHC(=Lc)aQ9tlRVwd+0&qsX4ya+cZ`0 z>8H={4S;H4dfz6@bfP;5{lt??(&_>*0Gvv{xY5lFM7SGDB?y@UVl5EQDMzXm2APG;hxEm@0N~kP$Y`|iryKgnTOs#}k zr|TFYh$df|`*R|{N23)Jqk>snl?g>TG#S?~YxV^1yH^O?o=YH$@Qw>^!7@gZFp^yc zUNeVxIBD$&e2+U<*gF68<_jOB3ajPpg{v}=0%Yz5k@I|9Lu)*RS8JrTuWu8F@APiR zJI3ddtp!BTtX{oV4zbXSnvN@fBva?b;kcB^87w^bXUt^|D*6+Y5E_h*arq8Wn{Jd z?^_s}W{TB6g(q~||3ERWm81NrFxA^A?va0=b$pB>Vmr_u?sFt5_ACUyYro%b{lLNi zbpNtu`JeYx^;o|?MjEaT9xFFdrZBjjcNb||h=d`UBwO4qSBYKJcu*0*tf$#9B$Xvc zzUah#4BCkw_Y&A=y1-0n630Av54I{5v8Wv+d>ufFFizk2%!PMf^R|AN$%<)+LEXCG z&{1X8hGF$uBIv}EjA;M5 zZ~p_zVVDDVXwzC1!e|wF^s%vujr+n$wNzy&Y)$^iox;Vp@WuyVXa5;jI}2pgX;%pw z#xNCq!=YGkahP`pi;;B?MUQ3wulP(yI=xA1Be#Nrq@%X+$n+(&1(0cx8Fe~}X6;$E zZhQ%C2%xB|M6h2-IFTUt4gA=V%b~kBdap4E*#oDJ@B4-PxCj+ur@e5kkBn`&kq`vI zm-o?kA)VC#xL`nvHMxM6fcUEMU%@hD7K$SI4RMH;v}1{e!$t8f#(F~)dfZaTatutOzaQNGbY&Qg$(eIaH3`?=O?F@gE~rxT{>$E zAa$VG34l*cG&RXBJ4*C-{@w?fVTyA=^0_@|yqRlU$$WgEB93b^Qi8iW{RG#wKP$CH zuVM;hH`5i*(Uz-ejN-gWNL9F0*@|nF-?@oNC?K<343vX4Un8{OR*|+FS^GX1?9pQx z?)aqLp&bBmLMaD_uM5TJU`g^6;(K?F^$Ts3w{w*yIga5*AtJ3!n6|*;3yiad8+neB z0S5CF<~pB0X*9y*z2_*kE7h41|jFG+ZQ|LW-k%n6?E5LrYev633#m zo}eYsHzfmO?F7>`?~gI@<~|QdxjO_*hocOsj8<@8Q58H=e-03@lOWV(#K%Zyi_-Y^ zg}n^0T6fw9;lyE6eKBFrc;ADQVm= zfeL;r`XtvphY$tM_eo$5qgJ~_^UGTemPIE(_bi425Czd>kZ`?4Ll2SMM^H09bw%hJU_uZLiH8FZ0B7@wTupZvVj84(c!o*pTZLY zlzT*-W5B2b0$mr~2{QtaO&y|9ecE%xjV|&Ier2iv3aIr7+OJ4fMee+9)mME+qc92I zfAAroIO$R(=vh9T@nXJYI_uV=1V2CUL%LFpC!QQy!(s$qsh3T}`9WOpl0skep_XcL z_`Niyp;%>K74q;l1Z{Z{i=6rwUlX+eZ7b~ji^-5tqn&#I9g zfqaA)5c^b}CUqZh!Um5iCt?mMK%b+tfdeSaJpO3_90%pHwCc}K5+E=w3Kuhav zj+2$9Kb$t9Wro$H{t1sp> z4=$*(k(0Fdl&{IuVwLxLjl%@3;>TC5t(qlednE+N zSUKXkDJ*@mlTi6NuKOx}T^b~pJ+Xsd^<~Nrer%=n-(HTn7UPd( zlHR0uktv~w9Ir1g45HKlLGMtBh$K)wt1sL7Hs zO^dhagP;yLEyUgfhDxtI-STi}h2}JMqQ$L6kT#!lQdg%Fv>m-)q7SOuH(ZcFvjoeB zv9@T~OgpGE2mFiN_fweYw}8{`(Q_ZF2t9C5LgFQvB={KNVbM!MKnEyHdrgANC{!i_;%SsvKg`saqoLA%KDcF} zx{!DVOifLYub*2tXiAtFT|)N4go3+VI>E3jFnzn+_lVwYm%1LY{r+o4DK5HP#(3}| z=p>u_7$K_V

ooa8s8ufr{-B3s0FXtcr;aOY}To2%B?PtRVRV`{42PyQIO0yrR`P2?K-(AMuo8GC-eP2}y zXF50?rQa1|b=*!DK={QJo5vlrj^X)f0x_s1bNJ1`0mElwfgG@Yx4~_J`inhlVV`=v zauUXS2Lk3StYnmPmibK?WU4f7nwi&`=ASpx8?VKBhTjGzT*$^tKmp4&a%%P5@ke>a z=Ue8EmbaQNZYm7*o;eCBuCCG!KlnRSV$0ZHYrg?6wD?s#aJ;(Q)FalW0xX}&6?&iB zOEeck0I^$LiFaRXg=Q?Q8!%UX-hUBRrW|?3DJp}QzlcaFPqfK@_ZsXTaJ1}Z6Cad2slDJUi#cetVX?0r0e6l zgT|f;-2ZrNVU6bv`;Hey`1wn2Uk1!XE7j-*&R zIpaK6n;ytAmFXk_Q`ae!)Us!qt<+m@%@Yepf}9Nh`5brswi1HM+s6!iZC$s5qFV=c zVq!>+W1bN2KFvfoe3`?^kK}ET0Vc3ej_)pwSY=lBVOlQ9(YGE!$h-AQ@P|lEO5#H> zGR7i+z_IraYy%L!B9SN^$C!Cs*tLH*6DZPHL=L?Ayr6EXi~)gM^8 z-_4`(zXUEE9|D(m=x@I3BO2mTZRQRO!Uz(XpK!izquP74_is%V7%%UOA*+0t6KUUe zZm{H&c9M>BwbR*&YDsU~J&wVc;xk7V9gqJ=JW4HKW*}I$AM4QdwjJcQ9#GdsgP|*8 z8MQI>C!=osx-S&7WN&UNmGMJXF$KVk)Qn`Px^I}97IbLejq<8YqJ1xy8>P&7BI-#? z>X(BJ%>^JqgHfr8WKgf5rHS%|H(wMf^bZRWK}{aU9W@oDcK-&+mg2HMUtA}Wzf&X? zf{i3Kz?9pyVx$sle?mB$omStU!SQYK0Lj&kq@c+D7);j7eVQK!cG3lSNfzLqUDShF z*k7b*fyu4Or~@S5Bkr4a&8d`rRg8{V8xAyCU&oy7lBR&deV`eeUd^gHs$jnGs?rHwzbmAy`}SdTaZB@Z_QKwD)R!{A%-l+iIx7R{h<>&coi*p0{g- zlNDRv+(5-V9I!#7O3@7@4&aEL0|#N{KLxN*srh)>Y@Fd0nih)>gVbi#^%RR$_{($wB!l@OGP)ZBEK?~S8#jQ%P z^)3!9Ob1o9-(zlr}7K1k$R{PNPKgky~ynfmJ-(6Uy`Dr*g_b6!i?cMu8&A#yg^;VPHciXrafL za+)oOyC(BN8slXeqgEJ(>ujoCl4_xrEF&kwn9S1I9Q%wtN{3q}mj38=&<#|+pdMoT zmsVb?o4~d0*(&5JAq0RqYn@dQw5!vKerLT_z4LU`M!>!p6^&*-yJrYmY4lvO*j>!$&r9v6j1!lq1;zorUsyMrnL%y_^ou}$ zx}^_MQN1~C@XmP9IrMScnA&<7liX@Qzg2)JdRN*vSEJbUi3b1TNbD3MT;y-V24lU( zdS~4(QE;f=R4v1lT?gr)zv1vbbXD72ZB>jO zc9Kl66>QZzB^0)!u`6;+R82F-ua1uot^6OC~8t?ec142|s8*1(}FATu=18I9ek|+BmXE?57{2iZAxw;Q3&& zP6+li8~NGp1Zni|%#W6<)`M601EXbB=I%OJ93K#~578U;LG{&{nu>N>NpLyZ7> z&VJ4%9zM|6+j_UI4gnssSr06v0%}Z{fMDEvfWZ-9*-0cDL;r4jpbLJM|Zg8w@Ks!okrhM31yUu!*Rz5b9A0c2s(-2EIMSeanf zDo)C+NNS4_fHt9LLAeCy^lSA;bz!RBc8!#3>+ z+$Uz1)#;{1q(?LRWKEL=47;+LtN8%rDwI3$E-|I1MWwOWE2^vf868@?6 zQTI9vn+5X@*Q8^t0<}NP+V+1NKg=52jFq9V* zj}RH{7L^BVx3lMW#`6nC#2TEqVowFp@TY*r5Fzn(rZJJlp>6V1FQEfX0?C%FfiO(* z&u6!YyZiCQBXQ6HM0}#MZOxAPy!2CghX%o?5oSw=g$g3U&0iF)Q29zDSVoxzW(|PBJAoJ&XQzO%z%9wSNdaR+8CBYy`K9WOKcrRPa`xq-*D+So zcU7k+8yv|kbd)}$sYquYEUv6(yj{FEH8{e%{%W}0GzA1zWg?2k(J-u|XTyB?E?29q zT>bD4^Unp>pZ1~P-wN;P_45BxcuQ)a1YdkaMzeFLYz3qJZuwDdl>hBjS^r4!g!EhC z{g)9Z_5ac!+vq!)yBPm}+{aR0pecU~bqLWYF=78_)38wxhO*_4qUH_tU(DZH7a26l zu|Fzg9E?9}Rh#91ubE>|*8f=}!ut0)tdy@2SYc5n{poY+(_s95IXNyR{(o3d zHlaW>UVMnrzo#hRko~ricEzRqJ4yXJF6GmoO}-KQc}o`oCFXy0T#x=<-rOn2{@;Hf z6CowTA1MtSDJv$+2l2}y{nw}NFL+8eBPHB#_IHN$p{HTHU3!E5A^_B^vX_s56Z>IQ zHe<8SRaCX+EQ|6fUB zl{JC0tOiEocQcpv%0l^98F@q|lw`TSvE8$6&=Nn`h<7#=PfqJLbSoE#K5qvL(LaZQ zDgR>cy-~{>F2x|M5p+)>m!TpCEQMrB%eyoXv4Z*$bAd9Uw2%uSx5UDBnEQcLk}dFP ze-a66)=?Ucl^IJ)_DViUZ->4TIH3kok1XuNkr}evj=KQ=aFrDxz6hBmpx=-ke(84O z!ITZDB;R$AnP3pd=smi0_#{_3tapp^WX{n72?=TmOyH6tIS16YYbJ>fz^RqREDdAC zP$f;O4xM!WR8kO;Nsp-!szt6e6>20?(IgZ@jmRj*45e!?Tkn1+P+9d-wsGbkXB!J2 zFL_wF0>%_L*LUH<6Zv7n%iEMyIVMW^I{riFo(b_1T=z#*xLN#Wxe4^yiSw2ZFxP%9 zqCtKq-0bn0)NXOECn9qzK;t&fslt5*TCjjsNjmrEY|hIBd_UR~Z&KilkiTShXwY(T zre)WObL$OHl*Gt9%7Zq`6TX?YiRKfCj|67$ZK7qZ~nT13Zj<(SXsTt$7s;W7ii5*(iNe4^YDqEtP{Kn=Tke%V90)Y{T~Dv5GCY$mKe*Z`J3H{wcN4y{Hb|C|_w z!E9@2Hja8BpOld|5YtcHCE(Rss0~MZ{bb~6#g>=&>s2Z)-DDl8z)$UEO3w7^c-Egk zHHDB#g;W+7h9Oi&QRB@vDND)(+LEyf57XjRR;r~@9qI{8T8bkJASXX3J0J+k;cn8< zIyr8DYTSG}hyfT0C*LLm`}&bHrU;-#Vs-{y?LrFY2@OM8l_a}6I(u0+mG>Nx8x9R+ zT(RD}G-=FW3*zozkw7-}o`Y7^=F?K7nyCjmA~VvO1YU}FD=omZS(^rjpuDEhnC7W) zAT>uu%9CZasP9=C6UFec4k-bFk@e3E&{%!A*5ZHqrw zaoE$QpSFgK>cH5VpN|%P_x*KJa};bHD?w%rZ;Yu|H(3_E$nc}&lJ^w!^mAXaF2X#q z9V1WBr3Y|x%Qx$sX?N*pxj|ik_v%Z7tZE82$NM5OQ$X|?mMFZE`K5Dv*eeAOyjk?C zj_bSd{W)M&@dyOG&BjK^&^%*3X=qjHxtm3%;}*K%Z1>IT=SDeKIks;A?-Zzu)Ds_k zxrKXJo7UL0WL1HS2^KzXW*pe;hF|@L5VV#qBu*Unmu^2Jx?Q;MZf+=!?)z~E+~XF> zVE46xLoACGNZqSE{`y)P6iAjZwl>giv6plr(9r;%7$~!^pSbnPlXSFKynC&%r$`pp z(o!eebE+QHphW`uwc)NZY>VpRyBe}|vNClrIGPQvqb=Ik)=RW(ISgo3FM#$JfV)2C zZW-gDq%ZsOg*?>|q0waw0W06zk>^&@2(f)jO$07J1v&cn9GfAvR&K8MfjYFVC0nqF zmMZ}qXNzsmtX2?nqjKGG<|tDY8Z|3jiLbYw%Ns0DCMK+RKt_$KvsP%JDdmZhg5OwF zG8$xMj-*Dv7TZCG(_rU@Mwi01bAs`Io>Z|!&qE1o-m>&zC6`KYtA&MRt20#8~#vGi`Oi^kKJ17^Q>O`PI>@??e<1sf1>=B z+)WLxb)hYKW!T>{|CN77WOIjtv73ERj>QiT9YS&&W0^2l)xm(t4&rF5buI@(5l8|6 zyD2CtH5Ln=t@-I>a{d5*Y#yf!p6^=FetZ?&US70>P2>hZm>{Zdl)PFu2u2#G-Su!r zcmLyXqrEb9>V@CCRJkl@`)l*h>d**cNY9_2=;oGD*2S4}?Z=RU$?xF}k@5%4ASC)Xd*>g_A7fZeEsm=^C?KF~tbf~4AMn4k zhZ;C3%b|XEt#aINX}3PiUoRk2wqkI96GQpka^~N>rC#}iw}>Hnqjwqzbpe~xFyQCxs3casmN!1v0ny-SOeTr}8cHGZww!%$$rnNRs z5++k=z1_zAa=)PCbqd^7Z=))f%mOisB~+M%qL@3Zzu1z-#&*4UoG>P@F_x>siEU>D z;Ia}Ct2~n=@DVmFP`zZr7U%+hyB|WB#4;$*`q2-a=rW~A3TvJliv~i^VudRqx^+?* zFJue}b7Z2ONhj5ZsoQ|bWt>bnl$)zkZ424socP4w({F$j7HyL+i=~Dmj03>d z-iS_EK@e$nbeBidgaPktn2B9<0{cz`5K5B>Ga*CIfeW1>%;Fpm#1P{u9^q5hZVF-? zVr;IP7^-t-xUSC=FL{8YG!*jVm(fdnwEHY0CYdeB7gNYDhhKQRjhkO0m;4(;^uLFQ3lV{Jcn^kCZgUZAPw{o^1gh%&q>wFGvH zp|X(#an06aXx;J*1jD0Ular(M6NYTHjZHojrA>@Eav76X-41S)JyIq-xSc&P0R++1 z=JoLcO(jLd#N!$nrG|amw}|sV6cvFLRHL=D!+Bo6nz2L8h0i}3^?CrXfVWdewH+I8 z4>25E?v`%x5@U&QAs0!i_NRPj*%SZES4PI_ZAp3#E;?@C6DciHeHogx(L%^qnMS9b zD&v&$%|oU@5>IgP7(_(5=SS@44CM~JX{em)W5v?$Ya`GqOKXSs`}oRiKgJJoM%+D-?{Wu0_2TrHB+CqQsw5( zW`3dOSBX2Zk5^WFLf)5=uD@$GCn1$9X?fp@?gKE)1k_AcpBI*bLv(JC*&?Wij_`?o zMQ?ynzhPln+RM?R_Cb%XGT(Vojt3@liVmTQ~Rr zUm?jT^JlA*y?@3>on$C&{sbr-(w^DdpaKE)ar_&gAhZ7uj7o{p4fS{J`cEZ?WJZaS z(zXAeUwmQu=QSUgzat)4%_x14euoa0QANTleAJ6N|Ar2JpfFO--6{XhCwzCO)cR92 zYJ2_JX8Pctz_ubU%Ah}A%iJ81jR^(>^njLv_QUy2wACD&vQU1t}T@aYZb;;4dT@T>Ao{B`aTyfP4(XoOp7|LCL%PKRj5skXWg%xbZD6&g zNRahWeL;u_@`@g=J%W99bCSsic0a>r`9`7>3raL=|hWi|3a5oJtFT# zn>y&{QmCzN2%SXGLuI4xLZp2o!yBBNB};)IevJe^QE2%<@JgtW^2%M}(~~!PkPeUx zaPQqENgQd$EgG@Y%wy?9Sc1-`!(Wt@mMV0`Yh|x+a80C%TM0VhB5*A4zr)k=q@t-s zx?&3A^c4XC{`6B4c5u&eN{I8tSIfkS_4(IK+fl!YtNSXx`f2|?`h;%p{4iKUV1eo) zBM47pyN*efwz(`h*&reG0ng|LBpx8PgEy|}PFE)YwOCkWoZ+gg5V(UP0&YuWi(^j) z-F?$7u>*V(csh>np~x)~NeA^^wcfOuzF zLBa?ssvs82t2!6iPUDoaVP|vmYua$!`wP&3KdjoLcoXQPUCJ88xI2qH-_}82KSGbm28MjAb2BQF zcL3+xOy_1`FPt>Z_arVk^UW5t1-zdCQd5>gfZU`QTm#@ClYHZw5WgIg%Z~?8uCas|p}Yv(l=c^X zE;;E6{J0)nZRo3~>m#Z<4IMaSgpjmPK1=AOSU?cmao7EvJf1!~+(q0$VHcJX z%s3McM%MN;?VeYWGvs{m!)~&NKX_2YA?^{IuhZQf3S4QNBjqzZQ`VS@P%2y4w(>m3 z`2RVI{&3hO0WZ6+@IXMGQYlQ;eE%|CYSpg}`|K>4Td~4- zo5lf5F6jL+JsC1&t!WNykwQlvL>MG4TnV!hq+dWi+wX&UWFA8S<2^_iGC~Wpi+DXD zKC}A#j&W`ZLmm@Emii%uK0mEGg^**WBf-u|U`U2dpdheydIr8tVgWF()tMPS-3y+2 z+HmYzoexu8O)KN(Uquumtr1J@_xNIVM4d&CC4Itr&yd0*Aiy0va2zCS`a(($(Q%xL z+jgF<{S}V>9+(*p;EwUkBbmC{InD#zv(CrN4lW@4fUfs^o+;|zjMBZ86^VHH)olib z0xwy_kkb`RoSB3nuBSC?II{zmCwBQ92-{J3o(He$EoZocAMX|dkMz0&aMPRN%6|Im z=iEn6mfCBlVYHHB0@E)hLvHC5&T2sJPt&97F)9%IpD)6b0oYTz_x6g`XJ2XHh8Hh z5KDD+1b!o-fS9ncnGVUrfnnD8{`CaP^haF2`w&4dp!Y-XKsQ`0Q6C38fYT;96h2YnZj)i>|j@w(9v@6i@wuv1OT*^6OI{r_$ zOxmsdaZL@~DvpvV*swge{nmJf?X)WeL!77p&}26F6yFF+aKQ4XY_d6!S(K>A)Tu&7 z;Wp3cZ|n_-+lhAAkIICL@thjM>|Mn~Lx!>WJ=DaIP%wd3wM7HpoGMK9OP}QEU$!_b zdfXnOH-OHPl>^cG;obH=yNa{-z@enX)+74iFX%Vg^lVr-*RPxrZV7FE4JT73 z<(TeU^kt5sQCb!{VC^UiFLNJcRdXx@b5a5^Ugr1o@&O!q_|#CHCHl&~q(e-T&kFp7 zT~&X&G9I}g;^)lpc$2uaQ#xjY%jngTP!wL`-w}2DHnCK6u*C{;&z$Lnx03%ZRCmzSiT5-3KHh z`b`yW8@fdJxZRgSHuv)_ugkAMhHqJ2@9~d*p3PNMwLCSxK)_w|&@OKGbK_x_C+$L; zfFMn|BzV+LA-l&JI|V!5ck1*;+S%AIn$o`tP@5d44I1C7{n*P4aIvgyvg4W68ka`I zl=k&-_qEUxz1>n)bw^6?K9T_kAd3_p9X0m@S@8bG%43P?PHkT!ZCv7OhRzF7^l zf*yS(6i;>7nQNa@o<{E3%_wrbXbz1?rCNtpK?AIqv7Nhyac{|iUTk#bzq}6m0algW z+le11iv~dwb;|KQbp!F0Oy3PnHey}W!#mi453s-(Yq zkRtYg-L9jdc3g493EpoH5X?247=j~g@J=taw+9l3(<~NtKdVFfTne2b#|RcY!tM3i zxQEq(e(w4?Jbm$V_G0e{1FLdq1fW^u=*66(qX5a_Q_4;xhbJUi(j<5i9)d5>pV4(gt>-YfdP30>#ZH^ zTxbazKm!_3y%TkSV?&T>!z93^djIJ1=(;l51pr;N~CHPjR!$YzO&V#FdTNWO) zX*<{zeZ-7C(6j~`$#h<%WWZE+vEpDZ;>3DC2?m%`Z=6o7nANF0AW<*QGnBFFkfulg zwRBMc5(Q9FJzBgeFifD3y9U#g*RbE@gPPOL3_>?iaPVOg(&DfTLbn6|IoQ-AD9YLe zN7RCj1lDO6^lZWsgIr++Yl>Qgo4JYkIzJ~L zq4s<<6rdbH0ko_?_%NTyRX?BWB}=%#lz72{z^4YQ@0$**Kx_;CYw`@CaWP03ymSXRyX>w8EJ?M#|tTW8jyhKRXB*v5ZneZ&d#(dtcB!nFkmt zL5$7Vq^z+;tzXS0?XU=DkKDY`XZ9Y&7`ck@r0f(w8u!*YUF&Jg#zV^!Xb z*DvSy7kW2!r=Ew`JV=|yizj^}u=5RoIU7`4w3#GwKIm!Q2HdEk^t1qpt5qjo*+B+$ z8+HT6juhi?$8=ufvG5ZlcseVfJXI9hX|P(% z2pluNV3&WEUW*$b@G7h}-?#N2vx)gkeZQpzlut!r#x=-1jJ}OP&@EM)t9+|qUXYKd zyNTP6VWeOs4+t}!zm(be$&@c8as$;l%wajR!>g%!{V9C-m;bGg`Lnj@#+SCzts|!< z@XRC=TOc~Q7f$V2vmW}?Ei*pi9D>Rp6%sMf!vBY_>yD@L`{T*pBqL;0E0DHIalO4TM`rRMeHi!6!#>q^!v2M)yDFBNY=w` zW7R$!xiUsyhdu6Y>cc4!W_T8Q6~d-FR4H9_RS?B zXPrlWS&!cLX87L_l$F)z)L+}VU~Gr6oyuYplX!y?#(-x}-ISlLH*-s!UwTaIk;XK= zIW|-2!q=~&Z>kNwEIu-cCYlWJI@$# z%&KO*ueHgirtv3EukcBqGi!X_O4iPtz>J9gi$$JuqjHWMTpQANWC7d&dti9wimk^} z2K`yJY@BP&b-m^O`cKW?zI5unDb?7HH&^jjqvy6Njq)#b^~QlE)2m}UVm&tyi$4qtf`vDW~om(>g zx$PADDj!gP_M=w&!!?C!J~Eckl)54Nv*ky1?H8eQ6IXdS^kec(BU+WV z^q5;N-&1txvyNl0(z0WV%lj(T@_P=Odg6nh>WMo|eu)!nE&PeEVx2jV!or@0tDbnCkOkrrkh_l}6d=Wkup^i{>M!XbEN^U1R%){~#kyqXGkOpNpYaPZe1k6lGc zMZ-2{@Adw4{`4r;?pNz;I^OrUZg09c#iqZWt>J*gJ!!Vp1J|Cn3OG97`E{_Kqr;5X zyY9=D_$ucPcar;bXjRY1y=l8f30;U#jgTH@L&pee{;mzp)6gH6Go&>Egnp76IJ~vM zP&B^9cJPCOdjI!6|2Hk{F(2}t6DO9B=@qi|klam%ui;VchnW-D7FqlA z^7Kw7WlYr24&37&uUKlosWE6y`n%|+GIv$?(mc;RqnQbwEW_T%d;M-~J>bz--E8SW zoohZ<=f1mUx-7fW!z%cB;iz>s#gz->Psn!EF51n!sZzM6U;j@JEhmNYKFC-DHDJXE z>+4Vx<#QnDi1*ZW2MxD@$DhuZm`1n79`UO`=BL3CT$G)tq;GqEQvQDUO!0<`MdPa6 zR~Hsc51ewV*LuBPNiRKaDMua`q;9miYci>~^M`3?N`qqzhS>cT-$04B*WhbqT0Ru( z{_DlVMu4h~(FEKWU8F?a`ghQ3tpQm?EjlkIW(q!?$D3~2&s$L!X+FCs2C&h`f=gBfh!d&; zn|-C*tu%})=*#kt_;KLbSFFyWz0;hm1=Y>4&t9_l3E>I#R@A+a3+k+-pE&0)P+47 zjaFuTJ2yYg|JUQQzym@IC`edbY?S2VnM)h3WDz&3-&vs>A0eq3p^`T~o_%LE7NN90 zTA7(r)Mi9Pg~5h{l42s}No=I@`e@Y`!DE|H7c-lzsEu2PnykV#$#FCKYh`9kk&2Ct z4vLD1Ns^>9@vl{+9J%B-Q{(0WCah4$tAnb*o}@mUX)ZQGqbV=T5FkYzqQoG#R|P6D zsOD0X81oS;+A2oqK~dPh_^{x(?w)}}7cV%eA}Z5V8C1o6sVZZ(GO6hg-yCT4gX1y< zR4JoJf+4CmVCgcb%amMo8Pm`uo%^e&Mh%C{l!@?-%DD!*CRA4wVyDjvOZ>0UUgeiNOi8Bu37`jA5aRjs{FDIZy|8h;1_hRkljHof_1M4ubD`N;bYt z$asy6Hsq7deIdM+bd@$Z^hQUwQ!mAz{I|cAP7G&sIn<^3s%D+i=`4}`Yq7<}6^%*9 zH+;?Ma#zL<)am$2M$17cuSar#*QQJ=M{sL#AEX?iBN@k#0vL~GnDxQUgd{~og|ZW7 zidUk`CX8mtBYpxr8D_mPFw7=Qi~*URi~*$XcD}7WkOm2gi4Fbdj>8T}uXA0>d@REIAq;^3!@XLj70Q5O;CW58TD0evB5R z|NEyhNLwc*8JCnWQ=*5@rZTRem9B%+Xrf3;jDQ!s(naxV8lw&YQ?8hr5uN>v51t+o z6aJ6U@v|9b=J^bcyuNy-kFFsN9~B!ep$otr=TG-O;ffi!~*-cT$)jS5liWMg^4qDb@nFes{Zicyk%jJt=hGT~&kIq1oG z_1gRA-a#=vmj`!->mxIw_#oS$f{$Vr<0}$RJLs0SQ#-z@X4)3UEA)Oatz&)v)%i?C zKJJ+1zc9acikq|qYyK8%>UZAv%w&hn3sb>$cqFEoyJ*PLT?}-aGdRDCF_0XzPxRlD zJE*to!NAQ-PFdn^#(31l>U0k^EoG6h2md01$cpyCKa z0aO+;sBGnWA)^3oEsnDd68EwbB{{?>06jfIYZYQt0QV?0UclujV+PrQ!lTllr!pey z&T5Tgj62A26rc2*H?bFtSB~^SCHYeU(|U?jk(YEm$q4R6k}asFk^NlFP(gt9YV56@ zZ;Jso=r?eiF&ACHtX(JmjR`7cMU;+3*D>6XKRNMK46w{@U{HBquLj0$bSrpSW7qGX zqY*2q=37P++U>19lGi0Zt=|l}e`(6%17b6=1Q4k7Umz0pm0z?bA&|OyV&HEE8|lEL zb{b%3JA(==IyI6w1YXbvC5y}RREn;e+h?^lJ3DN*>WSH7We!pdy_t9vD zs407TLpN8b3(PO`yR->XRR>lIOzMvKAqvbX$gXnKCCS3&0CgrcrtRv?Ow@x+EgGs* z7J#WNqG+{hF_VyHMjJ|_I4UAl$sOc1hRl0tBoCN$gGT8R=xfT%Cq3_I%Z$tIsy%ur z^#^wnSzY~cQ4=YHN)@cGR%T2^bfwkz{J*~s!TjZ%Ebv((_Cb~af1n7~5KKyIwiC?L zNVrqjG+rQ71C+9vNO3_0o7q7sb|ps=WIzfZ4B#?c3In{Lf#r89SOgW^t8=^M#*Ie zlX~GkbO@7)q>$+-3DD4*85=8^-u-Z7`lC#tsw;|+<{<~3Xo{4&Y4(&WjVct298eg} zq$Yr-!rGPlbLFW$DLE8p|QP1)O1kWpV=QNfn6XCl^Te>!{$Kd5!9l4SQkJiJ}fRc zJ|Rp(?e>N-JLJeIgve9wNpF~tJpzZS8RUcYxnpzr-;`lTs1&B*yrl_HDU5^0fpR6tZ>)%l#Fm^*12C(~xkbeh78<@r=b@G0|koEw z8RK%9Eht6@IS(Rjp;Km{*$fU-v$05C;)M-TaA;E<+F5sJ(+JXe<8Mse&r< z>%<>;C|QdT*+0rsWOZhSMZxlqWEmq&#o7S5*~MB?cmM`sHr{Gk4@7L7nP}w5heC3Y z1Hp-GDIpnKVK0%QW9^89RG}+HRy#U2DMsSjvN8)j>spfOYy&AUU@$~zPiH~6fi-di zkw(&>N+WA(25`^FIuPZQ;h#4<>cP^%OLNdNPnyv+rq+~G-DhfThEjv8188KmEUc;M zY++%22F<69*m9H%69v;lAk?IB~qe021C6wypt`!mX(k%RJor4@%D^I>Y6P zy6Fsx!)s^LSb#vv8o$l9)ig^qpZZTe;%tF&tn^z_r1uQnJ{3G-B)bYH@=kKmion;8{w*8tY-` z@JF6*=A9_0&P7^)myZsAV2TQ$d6PBeFM4jao`ckRL5?)pt2ubwp5$2XK&XXz(x_{B z)>K@5k!RfpvG{ktG-^yCmRxY5wFa8RT-2WuC=X{n!|lX#?k*N9kKxAe!M{*Wlp`0m z_B52zIij0B?H6KEji|D|i1<*imgd91+M3$(9aU}JjvQIkU1`**ySVWicdh#%BYF3T zhU#M{qKfL?kF6J?#%{f&0e0A7ZWynusnwji*J6Mb&>Muu%>Iq_BUI2n(bwb9b{Oa3 z^Rg@K$ZQnK!wLkwr?>&}@2&Td=414MMoQHlCu8$IST93L*YQydutl-W|C4nAT7^

!Zb!v*4gD*6zsj z(+Op_TPt_tt_<6|+JX={5Yui=6$TcyTR%li)9BdzmubYz6)x{f?wdVX$S+--e8<=u&^ftxg$=(+Be$yu#-VyEF)H10$z-VN96byC%M`)}PT`Hzy4FFqp1)r+=pLibKSTlX&PaLu2kO;w`; zXV~b!zTcF(nRqvJ!d3U@1I=5?@^8IAe*Jn-YS!KnX{N`vd=1ohnyT#RKX&7on{&N} z`;E3JNY>vlp3iI0jq{zb?_!L3NwQ`jab#sldCvJI7kv{R_tQDqW9z)aY^HYn#EB6K zu?qD~O>BoAr^fkwd9SoObl9Pzp~JbZPK5S=TRB#bs+Z25*uWm-a4_^zR*3t=>M=*W z>TeRPuc=GUZhR#C>U<^l)t?t~rESmrO5a|do^$5*eM@bKZQ`nh-+dlDsnYjF#Pn#C|=#KmYrupYE^T z`7<*vL(Wuk+xIjd4XX^Z&hnaDuhC)lE$w>WhpShgIPbPK#qD6p2v2)^H!EM3WpHSIa_WuW+NKJnFEmCEs6WQ_s;n$1Yy5N8LzKAlN`Y$N-YIV5mFB68 z-B~B2>T~$n^p?yc;gg$R_i8`C-)?h)ch=8g4d2T~6W)Q72`jMM%u);nc7 zee9@1z9)~B`0n*_y>)Vm-qxIgIJWN!wVUZ4Yt`$fm-A9SpDcTp(l{V}=@#`lvzw1L zPP{b!bXM!Q#-}%j-(1(k*cYBFuQoI5-rK7xL#zk&T)5djZ;Qd{<_FIN$&2HD%MRds z$DC%iB(GKLVZ3hlxz*h_k7rcMRo2UhHTq9x9<@(> z^Vwm8(Xo|_=l0FGy3OUw+kulA$F{7wZs0szCtFXqt;s*zPxr*jA!+OF^Y&Hlv^9vd z1oHEuZi+&c-+Gx%Ei$WiiygE?;ZC@5RmO$$M|!D7rK+T5?;SIH+9IdWag)h)rWPpLQ&pup4zB3VV76@Qq${`HqNg4 zxjWYBZi{Sk;}-qPd9S>`_t)y{HhrV1&n$(j@&?+=fs>W&LeGPT8`ioFjaFy)I3{dy zzA>uU@%YyvDH9Y+9LL*!-B|jeMES8x`5x!Fi~b}`{P0r1+C1)x%l;Ps!Ow3#;`UJ* z_ia?My~Z3ys=k$HQch*$ljfeK3zOoKtJo#nOXDqT1}JP0o*j2Y5sdiFHaY(J+{e1N z7Bf9g3;m<|gsmIrrf5D^RCjE8fH0pJ6 zwUb`{RF1FnyC=g@_+^)>Z*gK_e2)FR`Cq`RSNkSqWRz@Mb@jrDC=$IAs*+@fbTNb7BBHuoUGQY zyj&qtx!Ll}t8p@H%huCF^CwT)Jw7X2b^K!c;qQ&+4Jm&0#AR#TvZgGVE2$eNeaQc~ ze!;6X%EPy4>AJJb*$?;kaZ_-1eL1B3*rg@2xnX+?&%CO6yEtS~`Np;+p-x8SE91Kr zJykh@z2k-49z$n*ca%#sTejD(*J1aK7K{-8txI1lF4vkPv&-Ej8K6|*7XdJZWR%PE_j&7^(dyo4(cgoCEE@ReZg#kyGkG^)=aD3*6-T6f~;)_1C zo@=c>z2lT?%iR@T)<2SYhffKg`CdIfx~WlU@@)PZ|J2K&;oH)_K3}q~da&n_9pehs z#vVN2YH-=tf_L4???FU*l`MPS*msAX{~oM3cmGe`iC#QU~PNi`>RQM)JvU{`4)33XbhGaE z9x1PI)uLG~d(VrZzM`wLQ><8K269dpvsG)s9^0v2E1k82{I^+n0IESI$W*zIN9n(KV`R#0~vHzg6O^RF+#JWEv;OEi%$_tWo%gRN2W_WB3NDa!d?0qc3tu)zxE-P4Ysktxj;;~^f!K~<9 zj|YmshI%M$K3}WR>w&fW=?f_}dq7NeTPgMvS@gM7VHnFG1y-!B_{ zJ)3{(-Y}h~E3}R6H`*%=C%ASBpM19+ytzexpZ)RT!RsFWIMuh;sVVtKw~S1@YH(Q7 zamA?AMH8>B7%124`)g*C*M{ckGS|ExUl#^_aPN^hwRPws6+ z*q&SKczN&N=bWl+`DpF7nzDw49~N*c)m~W^m!58j7;|Z=-eUvrM=MM#dz?D@Or`ir zdhn9OOV^t}CJeb;D|h(Y@}fY+Q+nZxTY79*=z5~|(WcZJug3(mzYgdn8}0#WEFV~= zTQa#h8XGI4qt~o#W!!$ZqsOIZhUVO%yzI5c+byr%A3k`S(08Xz#P~hoEm389-`Y4Xb$Uy*eOd9vyavx0VN#*&1NBw%-_zbrEYtpGwY<)4?3i@jqZiF1 z#!t}YacNlRc(BH=h0wGo#IEfIrE#{E@}PA$Q-k-AzX8Y?e1UuW!9FN5F^)>w;eQi zUf$Ea?2t{gp@%?}%NeR%+BSU9P2HLi-)2srjb6ge z-evQ={*d_u?)Qzg!-!IWeDvfVmv<^LV|1=na(4+$3=G^3zMs?YqH<5QN6sZ{{I}-6 zGz{|2Iew4(#Oq7(b*CYk*C&h_ZvL(Kp5}o~sm%9Jo-6ymxhmXY)&66>f4u8=r;6qW zU(8MnkN2A2+xYvenvri-uYDTju{mt+*-ca4ukC-gedxXmqdnU{tew8$^RLs^TShya zYh92Yvo1QZOh-GWHv8DYY2Tyu<$@xDo9jb^@{Z+xx=5^XKcaNm@m^`kEIb#0d(ENo%U-0yvoXKc2Tbn8%`cJg69J6}-`Qy4F z*Y|72Ob6x)Id2*-nvauP?tE{-GQ&~XwrcxMroFHoUsKGs7;vVU=asZ3U`Ef1oISz~ zpMYn|Hs9TsUi=6eRa2HwxMBa#-(f1HA-&(*%fzo`tn(Wp0s(MKKC(Z&!}CQ@_#2EpWz?6)yzyl)q-ZRUpRB(C$4zyJo=3X3jUqcW$Yvp0hsR z==*oSC~sKo(6K8I|53PDw*A@O%WJm%HucKC>(!?yueQ!<7ps1od+o>l?5`l~Vu{>- zm!xUorv)E=*69!QxwH3ucA=%uVGGlRzP-2pI$yEq&zNiLYmNHWmLJRSsJK((`Z8+U z;^X5zVn)U`+}379e=kymHn~x9L@V#Sj zao=UEA;uvC-}SS(aVfR+Zr?o3$3AN(`hAE^{hJ`y*f{UAL&mVBe_E%@&WbBBoEY5S z(Xs5w+$iN`rGe*;wmgb4IBf7xar^{Np9k-a`kTCszkaR!QjVtI$vGv>J@y_9tKHzc z)^NLBYO9&|6V~n+nclxoTAnCBJ~sQ#nCgdjwtkFzW^u6Nv^p0OJD4BofCGqT+@qNzaJeB$-` z+|0o>!wI{=8j?{bfxW)(CR*tw7GYI5b5L6Zahy`J-E>Wq56bJuzfex(% z_4L}aX(L=~QIZp{9dyD$37?>LMqK0*+tH3?eqZ~Dy|ARFFGFv8FsKv~)ZVLmLZXCh zdbuqsDP_8f9KZ`(0xg9DMLPm*#gG|9``yJAR~+L85#v!6@Up!aFqW(W0*ArGRg$)% zgZL*05HK895a&7&mgw7^Lui2ZAp})u*K;IX5n!ql4X|hgUR}N8L@-eGt$ipBpg9t+ zD9;{7JRw=|cBTEkb0n^ZR=EpBe!bA4)ZWnGf-X?3uE! zWY6GYkuO2*=UDGc3_?P>GLD9d8!J)*tnmc3eb0V8VSsAPTDJ2RzJaV1f!litvc^pI z7vhz{sR@+m!OaOoGud>NpCnOgYl!_sf{j{@oFoa*1P>-*D(@!|XzS9)$&w&taL|id zU<5O#5HHB4JpH9X!@Vih1DE|NP|;KxNI8J$i)!f1074z{GdK_dNHdS}p%#z8i9mSc z794-DJ&5*uTM(}Bs!Su&5P=QBG{E~{%J$3JgNcD?U1?w_4PY{kT5kZmLy3B_G=KN9 zjByK;aFtlXBri|Hs38M?!ie7_FTZBcD0z;@`$yu#30uU=!I_c(EubGkP|GA%5yWhS z+8!y1QUo25gdWn~KC_6YsI6HvkY5xYqR1%XI{CYOH0}4SXoA{BSQJghBL35bO|uT{Cp0u>?F*3pcTr)y5L~2%GojQd}(*!D<<>>mkvF9Xp%yRv>&fHK1eS zY3&+Kfm#?hNrbc(l*bcIBy*w!NstQYm_+Rz0OpCrTN0#}Bn?WRjJ@abB*Fv@;! z3}lGUtwx3IgEBGz+78GNJJqB&ybwJkHaI?1Vz))uVxpAnqd^*ts#XBCq7Ig)5r0YD z+qr+-^|z4d1;7jKA_}$!U@etdN_-(HeP2qWS&aWbBNY=KlrnNk88V)}yYluiRM03~C0P?|jCtBM&LY@?U_6FMTQ#WAQCvG5= z(cmmjrvWrWMG9bWh^RlZ808GgQ+&#h1gV3@5bTd4Gl|b6uTwWlgD!5QQWfxcBhf;F zZf=qUQBKQaGogw23CNNJsDn#cIN_`4PDqb@b@^)Iyxfoj>n(72_rNj`uViBAwUr%=M&WOFC?sx^1pXA#exGyz zd*#>z#92guSJVZ_E+v#ebTsyP`-_Musxu-f&;k(^AIh>s(B4T?u5;VCzdu}jo&!%$ z?CtW|kSLXDn3NJMWPf81OVaC=kQkhpB)J{w!eK%iwO)Iq3k|%>2xZ`Sl*&uM=%d7I zvZK6Xk{}gz8@dN9%RfeVB68o3OCqU^WL6oL>Fg6UK-_F<<16@Zf>Ns|CuzSAI)x_! zV^0y(e)-fhG(g=MEUMNs*d`P!Bmv4Gs)C?)gDtEe(h;K?l?auVAew|+%eqS99ogG? zRpOrnGi1#F@{+tv@6UGL*P=L>QqLG9;T#$rPQ-VVm2!F(j<|P_H zYYv_gEW1REK!EF)5dfNw17KXiiso_!8${q$8sPL*Yzx<}5(-Fv7Q}e1u!hFfyC+?L z900c(#}?0OLWr=Xj+x8vL7NSc0kep1JfHz`9^e32`ha*za+&>*_Iu<)JO-+@&^40G5bwPQ z--l9}C(a0}7K+@F>a2J~G>}wgJ{D6M3|1||J40$76N-q9r*$;I;3rgoD4XyEX2_(W zk5Xz*yb7BMm73@7O~EQyQ%~F@8$0lnMoXaqCvT<=R9r zH&O(3qJ!h&;2}T>8?tPqVxsn2Nw_kY^A^Y8weUC87tuRuRKQYd{#?dc{=4{hK8RY0EoJx*;tv|ch`)&)nfg6?446gVaKi`9E2#ijR``?HrccUe zls2nt_s%wL7B%}R(q?6$eXKWj48PwBW#gzMK5+wuVFR}GW>F;`QEyfUl0&J!m>3Tv zuNJ9xv+u~%fQI?GnsOOs>kL>|Q1@wjjyQc{{&{S@%1}&)lg(f$NII_pMl3@_Zm6*& z4s0=IQCpOXj9DzS3-!qWDUk9yEUMuatPUhroh@^>e}T4f0on$2_6SOXY#eM@hmE^* zAPd!JO5h@5=c!%_L&c0f4AvoZc;N<1;&%nGeLWsZTQ=(*l76)A{yo`nH{*1DdiI6d zoX^7}kj`W6lqc=?kM8%8kDD2BWeT!?BBDknG5!HUj22vL2)1pFIhkqJb3Hz&S&t-pvap=6Q)_!ytoppt)Rt zrzs>_2@Dy^qIM^H4P}i%!@9QAWIi%7S?8& z2o?{d&tNHZvk5k9)1O9vD3cK|v{MIbNqFpL5p}v!F`N~KBC6k*w~XRQvyyjYZe;ALmYG8 z#M1zr1guZP5?H#3YkacpYISps*0@@PL~Qi8uBX_p6II z=QK+J%-w?np5P>FCmPC!r%>l4pww*D^E8XP!N$E@8kLcct-HLOwG?qH>lC{cKn`y7 z1m=&VyJxl+N1G#OS-Vi<6RV`jmQ=B*D%$lb7PUdS__8$0c^~!)##dP1&=HqCAEsR2 z0y|XxfC8MT<=-AXp0U?f|WN#pz zifPUDtVyVGj|N)fB*Fa+ILABLz=}ck!F(x+QUV7LV0GC1lGRI(w8z4qG*qW5>%{~| zhb6{_Cq+n_5gs~QR0sY4nyx(K609jv>k(<8_CI-CYO zoiCnBb`4>j44dkCs|XO< zmB@MVBE6CJGoWNg02f(nG9@Ev%^JX_CIbrxu;Y+AeYOzOazzv8NtWy|QadUw#Xku_ z(P8RfFR&cQjw6518A$uRc_16rbF!`2XUQHpsg1E)0ZnvZ*EECVq7MU0hhVTXkoeA8 z(?|_IO7#d>6YN`LQ|(08@4es!REc5H^vPk_3>Nz~qGZqQLV^q~CFio;TsC!P{uYl0 zxOEI0g`ExC2T6CWZ5N;yyn87)E`r_`_-4y)B0IQQ@Mz&vl^#9b*ojN|WCw=~!b&!2 z5c{nPIU-saVdIuT-G$|wWPNf(;CUDeu*MaS$TnB@2Bfw4U_A-ARn~15X7I^ZMhnVz zuAJmiG6+`z-Y4*UR>loJk3kC1#2s}C6IB7R?rbUmt#W5KAZ4JP@3H_HbJ*P+{6;6N zB~GS6pawAWWOtXd*m~01C4p-_DMcykx`*c1&{rF#L4Eav=`wX`1j#7*K|}zXDkIMe zU`HZXuxO;*f^`be!D@*QmEaG01D7B+wTL?=h@FjQ0}e zaW_wpMlDL9LN2W&4kwl>!1{|Nm-a}HEI#=>{Jx~Jg zVMP;*OLN)O#Ny378p^CvL@m-!n$Nz1MuG6r{<9lSpWpP56c@xAXeLEVoSOof3)n?u z<1PznWJ$?-RZ&(5iWjnXk|6Iz(x9S6*i_0Fv8f3QPW|!N%YmEcM5@3nmEB!F#?^6| zJ`#@ZZ$-&t#E=K_Ln;-?O=Wwd5ouW>$pl3{@H`&k$xGQ0C>>MFJE_)F(edw0?ifV{z}G=r@ODlbUQ2#^`#7q&1^{a^8G zL53tns;f6L*onwLV9OU%0&$n%1Sfq{x01XUa{13|Xnu9Q0dM4BauO)who$R*O`N5f?d(_ zq{qc%)j>f4n<^NcE@0nAM!KPp#v*K79o#O&p6Xd4I~&Pqevu@Ks+im;V&6j9MBXt; zfVx&>LTrpg0BJeKMwQIQ<5F0_C}X1u9dIgR*OHdd=L8Kj_5_=eOB*2o-pvCplxyyvsKJ z*AVgC(XCAoBY9r}8o^y>?Js2`9vjss!HRqAn`BsxneUml z4tk(-AlQ&a4l+i{fyNtDng)*6u(L^7dfumz3%E)BUbgQ(dmRb@I>{>0^3aTH6+qe% z2C3L2!3DL{xRhnovNh2Z#AkosNhS~*s03P$bGon|w{XVxw~lRvOrFs|YdE%n>POk~ z2KE``N*}M2;U&OYb(^mEJTTd?<82(J@}IL8q1nYH`Hc?`!-j7vi+v4=jeLi-I^`Yv z3~Jc%6RlyhyYT9dm7lO5-SUZj0ClC+WcKDU&{mq@1q;-bW+X-OgY*_`26-)PKcoR| zUnI#=*5vz@O)a2SeM124`y!)%sz{UrsRIzx?_Zb}>be(*>E^l@bX>K%Ros?EZ|brY zcH+E5@jWWXCb_2~^WERp1qGkma6p&&$$o|;k&#~Z^aUJ;{_r|3>Y@YKw6$a@+OeJe z5!C_+c@FM^J<6Wf%5(ORy2euw|6~Ks-WMsL@S3i`nSoB?wyBB%gm!G=OsUHTC#rE) zA*DPKyE37(O1(-3v?L%!gFF#{tI0trH*nG9pbE9KRu@gMUW-FbH1o7LO-LVbXc@Yk zYxpmj&;A`ub_!xl|BFE~x7S4tbz(rWE{9q;$k63jBMqt0qX9bfIMjyFUizGUq&!INI=ooN5lF7Bb@g>d2FvR>(7Y_v4R>dPck@WAwd4(P`)Ar7vy#dxuiq*uH zNMZ$#ag50|<7`1vx3{FVTl^Rk+i1yYLn^YKK?B@mP$DjS%HUA-x>SM&s3bVllV?RxPeSy+yr8jd7Yqd2 z;!%yW<%~ddP7Ia=C}cZO0x#2X;25BxXFJhAaZVH!u*8YuLP|WR?rz`HP>QYU;wRxc z`2vd0n3kb4=ORjXQX`K}zX7K{C*Tbul6}T(U|w53 z@o$9#z|#?Xagt*DGm*NaB{zj}I*wSuCg`Isk(#b?r2>Em4kDP|g5i2O;OOY#!$olF_V%s5_(`6fMN| zd2S)+yAHCy3>x6pOC01?GdWerfNyQ20kk$@3YMEV<^4$tZ;sOdrLQPc1H;NVACUt* zLHnKY8Yde|PH-L|=Xtwkjo8nCxNlI5J6}tsxyad^uB1^Sfm(0yj6tu8GmmU8vq~CN zSH)58W(DJJu8wK39^97c4u%$^6%0~JBw^=sSlNBgamrAYOzn|0Wr$J)0gtdD#y;Yd zp)N6=cMENAq;_ePZFYj1Q2(HrwiwClcjhinyR7idCl5^XL)Ti1x8!hXg zj<|>~u;{{fbWm((_2QD-gR*{crDQu?hD+_qoGQb8h3Z7M2J;(}px%uWt7sR=^(tJ7 zg-r#C4S$fP#rNZ$NF4qb* zUTh;x)~N}v5X$qpKT+c{LTQwTkV{oN1BF~QGK)o2kZYJ^Bu03JAT50R$2 z#txJYKHuj=0lb&$tYJ5{%=O?ZO1gWSVcbLL z;_`}L%W^v};dWLQSDd;=3Vuk%6n779ByyuDdk$lIDAc7nkz*OT4(N z(1cjsPZ~AR52F(NxVFfh6a`44C^E`{+`(wJiDy}ms{!EiH>peg&@$B5sGMa{FdEit zh~Lg8;r^{yfq%{5&OsNuR4M0$dq5vEp@%pJAhEYwDZ>F*W^pHw<6{;j=4}9&5ru6( zIf|Q&Qt3Vo&2NuF5noXPnd+uwz$9r+j)NLYZhw!6gJVq+Vf}WEc3Q*pe&Xq*-VW|U)UeJ))%On2AGFJh zXLTg8rk^-XYR%)0K(4@XH;ve=UwH8p?B;$!_Pwrv2Dn>*S$|u=)kH%4b$|wNIf#Ym zdyuE@0`8sKRo9`vS0uACtm(ByPh`n-YcoE6_#3b`=_YufRGhDT3c zGvdZc2~`tFK&ldticFi7c*9T;q*jLpi2X}t2W8COJPmYjsDqg#Kwc*(Au(QRZ(G@B zGoC7HF=L${89;q1Z2o!mB~ITvF&4o|Gyb)+$?t2@w^W^FH_LK;~pCx6$sL%rzy9B9atP@y!&jyHlzeN}!J{Di8mWi2*f z68qhrM-fvU%#%eT!58(BfNwG-+TA2e6C!)w90!efg@QQZlkgcmOQ=HBosql%q<`2M zk$`4@UN_}Cl+UfFYC~e64m&&|F(N!BHooifQ}D)}*G6{wxd*M&opixf*%E5z3q@mA zRyxAn4?Qqa>MseUe&W7@gka+9kBta^)mnZnMc}o$glL=iYKz6Ppfk&ku8i~Avi0v~; zQmAe(wA7u$3q+RzpZ{V{bYASA05a4~#R`Y$pGoFX{`Yz^?<-Q95kYfPpF^)_2p