From e28576f437e494f8636fbc811976f4f918270671 Mon Sep 17 00:00:00 2001 From: Mark Huang Date: Thu, 3 Jun 2004 22:32:18 +0000 Subject: [PATCH] Merge to VServer 1.9.0 --- .config | 12 + .config.cmd | 1 + .config.old | 1221 ++++++++++++-------------- Makefile | 2 +- arch/alpha/Kconfig | 2 + arch/alpha/kernel/ptrace.c | 2 + arch/alpha/kernel/systbls.S | 2 +- arch/arm/Kconfig | 2 + arch/arm/kernel/ptrace.c | 2 + arch/arm26/Kconfig | 2 + arch/arm26/kernel/ptrace.c | 2 + arch/cris/Kconfig | 2 + arch/h8300/Kconfig | 2 + arch/h8300/kernel/ptrace.c | 2 + arch/i386/Kconfig | 2 + arch/i386/kernel/entry.S | 2 +- arch/i386/kernel/ptrace.c | 2 + arch/i386/kernel/sys_i386.c | 14 +- arch/i386/mm/hugetlbpage.c | 9 +- arch/ia64/Kconfig | 2 + arch/ia64/ia32/binfmt_elf32.c | 11 +- arch/ia64/kernel/perfmon.c | 3 +- arch/ia64/kernel/ptrace.c | 3 + arch/ia64/mm/fault.c | 8 +- arch/ia64/mm/hugetlbpage.c | 9 +- arch/m68k/Kconfig | 2 + arch/m68k/atari/stram.c | 3 +- arch/m68k/kernel/ptrace.c | 2 + arch/m68knommu/Kconfig | 2 + arch/m68knommu/kernel/ptrace.c | 2 + arch/mips/Kconfig | 2 + arch/mips/kernel/irixelf.c | 3 +- arch/mips/kernel/linux32.c | 2 +- arch/mips/kernel/ptrace.c | 2 + arch/mips/kernel/syscall.c | 20 +- arch/mips/kernel/sysirix.c | 3 +- arch/parisc/Kconfig | 2 + arch/parisc/kernel/ptrace.c | 3 + arch/parisc/kernel/sys_parisc32.c | 1 + arch/ppc/Kconfig | 2 + arch/ppc/kernel/misc.S | 2 +- arch/ppc/kernel/ptrace.c | 2 + arch/ppc/kernel/syscalls.c | 14 +- arch/ppc64/Kconfig | 2 + arch/ppc64/kernel/misc.S | 2 +- arch/ppc64/kernel/ptrace.c | 2 + arch/ppc64/kernel/sys_ppc32.c | 12 +- arch/ppc64/mm/hugetlbpage.c | 9 +- arch/s390/Kconfig | 2 + arch/s390/kernel/compat_exec.c | 11 +- arch/s390/kernel/ptrace.c | 4 +- arch/s390/kernel/syscalls.S | 2 +- arch/sh/Kconfig | 2 + arch/sh/kernel/ptrace.c | 2 + arch/sh/mm/hugetlbpage.c | 9 +- arch/sparc/Kconfig | 2 + arch/sparc/kernel/ptrace.c | 4 + arch/sparc/kernel/sys_sparc.c | 4 +- arch/sparc/kernel/systbls.S | 2 +- arch/sparc64/Kconfig | 2 + arch/sparc64/kernel/binfmt_aout32.c | 3 +- arch/sparc64/kernel/ptrace.c | 4 + arch/sparc64/kernel/sys_sparc.c | 4 +- arch/sparc64/kernel/systbls.S | 4 +- arch/sparc64/mm/hugetlbpage.c | 9 +- arch/um/Kconfig | 2 + arch/um/kernel/ptrace.c | 2 + arch/um/kernel/syscall_kern.c | 14 +- arch/v850/Kconfig | 2 + arch/v850/kernel/ptrace.c | 2 + arch/x86_64/Kconfig | 2 + arch/x86_64/ia32/ia32_aout.c | 3 +- arch/x86_64/ia32/ia32_binfmt.c | 11 +- arch/x86_64/ia32/sys_ia32.c | 12 +- arch/x86_64/kernel/ptrace.c | 2 + arch/x86_64/kernel/sys_x86_64.c | 2 +- configs/kernel-2.6.6-i586-smp.config | 12 + configs/kernel-2.6.6-i586.config | 12 + configs/kernel-2.6.6-i686-smp.config | 12 + configs/kernel-2.6.6-i686.config | 12 + fs/attr.c | 20 + fs/binfmt_aout.c | 3 +- fs/binfmt_elf.c | 3 +- fs/binfmt_flat.c | 3 +- fs/binfmt_som.c | 3 +- fs/devpts/inode.c | 12 + fs/exec.c | 10 +- fs/ext2/ialloc.c | 3 +- fs/ext2/inode.c | 66 +- fs/ext2/super.c | 10 +- fs/ext3/ialloc.c | 3 +- fs/ext3/inode.c | 96 +- fs/ext3/ioctl.c | 33 + fs/ext3/super.c | 10 +- fs/fcntl.c | 4 + fs/file_table.c | 2 + fs/inode.c | 6 + fs/ioctl.c | 50 ++ fs/jfs/jfs_imap.c | 21 +- fs/namei.c | 18 +- fs/namespace.c | 50 +- fs/nfs/nfsroot.c | 2 +- fs/open.c | 15 +- fs/proc/array.c | 62 +- fs/proc/base.c | 56 +- fs/proc/generic.c | 18 +- fs/proc/inode.c | 2 + fs/proc/proc_misc.c | 4 + fs/proc/root.c | 4 + fs/reiserfs/inode.c | 68 +- fs/reiserfs/ioctl.c | 10 +- fs/xfs/xfs_dinode.h | 6 + fs/xfs/xfs_fs.h | 2 + fs/xfs/xfs_inode.c | 4 + fs/xfs/xfs_vnodeops.c | 4 + include/asm-alpha/unistd.h | 1 + include/asm-arm/tlb.h | 3 +- include/asm-arm26/tlb.h | 3 +- include/asm-generic/tlb.h | 4 +- include/asm-ia64/tlb.h | 3 +- include/asm-m68k/unistd.h | 4 +- include/asm-m68knommu/unistd.h | 4 +- include/asm-mips/unistd.h | 21 +- include/asm-parisc/unistd.h | 4 +- include/asm-ppc/unistd.h | 2 +- include/asm-ppc64/unistd.h | 2 +- include/asm-s390/unistd.h | 2 +- include/asm-sparc/unistd.h | 2 +- include/asm-sparc64/unistd.h | 2 +- include/linux/autoconf.h | 12 + include/linux/capability.h | 6 + include/linux/ext2_fs.h | 6 +- include/linux/ext3_fs.h | 9 +- include/linux/fs.h | 10 + include/linux/init_task.h | 4 + include/linux/ip.h | 1 + include/linux/ipc.h | 1 + include/linux/mm.h | 1 + include/linux/namespace.h | 1 + include/linux/net.h | 3 +- include/linux/proc_fs.h | 3 + include/linux/reiserfs_fs.h | 7 + include/linux/sched.h | 16 +- include/linux/sysctl.h | 1 + include/linux/types.h | 2 + include/net/af_unix.h | 27 +- include/net/route.h | 71 +- include/net/scm.h | 4 +- include/net/sock.h | 9 + include/net/tcp.h | 4 + ipc/msg.c | 7 +- ipc/sem.c | 7 +- ipc/shm.c | 7 +- ipc/util.c | 6 +- kernel/Makefile | 5 + kernel/exit.c | 8 + kernel/fork.c | 33 + kernel/pid.c | 3 +- kernel/printk.c | 5 +- kernel/sched.c | 65 +- kernel/signal.c | 3 + kernel/sys.c | 102 ++- kernel/sysctl.c | 10 + kernel/timer.c | 11 +- kernel/user.c | 23 +- mm/fremap.c | 9 +- mm/memory.c | 30 +- mm/mlock.c | 12 +- mm/mmap.c | 56 +- mm/mremap.c | 15 +- mm/oom_kill.c | 1 + mm/page_alloc.c | 2 + mm/rmap.c | 3 +- mm/swapfile.c | 5 +- net/core/dev.c | 6 + net/core/rtnetlink.c | 4 + net/core/sock.c | 18 +- net/ipv4/af_inet.c | 59 +- net/ipv4/devinet.c | 33 + net/ipv4/fib_hash.c | 4 +- net/ipv4/raw.c | 41 +- net/ipv4/tcp_ipv4.c | 116 ++- net/ipv4/tcp_minisocks.c | 11 + net/ipv4/udp.c | 41 +- net/socket.c | 39 +- net/unix/af_unix.c | 14 +- scripts/basic/.docproc.cmd | 11 +- scripts/basic/.fixdep.cmd | 11 +- scripts/basic/.split-include.cmd | 6 +- scripts/basic/docproc | Bin 19832 -> 20254 bytes scripts/basic/fixdep | Bin 15691 -> 15751 bytes scripts/basic/split-include | Bin 14592 -> 14876 bytes scripts/kconfig/.conf.o.cmd | 6 +- scripts/kconfig/.mconf.o.cmd | 15 +- scripts/kconfig/.zconf.tab.o.cmd | 12 +- scripts/kconfig/conf | Bin 20591 -> 20627 bytes scripts/kconfig/conf.o | Bin 10348 -> 9940 bytes scripts/kconfig/libkconfig.so | Bin 92510 -> 92727 bytes scripts/kconfig/mconf.o | Bin 20532 -> 20104 bytes scripts/kconfig/zconf.tab.o | Bin 95696 -> 94132 bytes security/commoncap.c | 2 +- 201 files changed, 2412 insertions(+), 992 deletions(-) diff --git a/.config b/.config index de7e3e791..323a7faf2 100644 --- a/.config +++ b/.config @@ -2296,6 +2296,18 @@ CONFIG_DEBUG_SPINLOCK_SLEEP=y CONFIG_X86_FIND_SMP_CONFIG=y CONFIG_X86_MPPARSE=y +# +# Linux VServer +# +CONFIG_VSERVER_LEGACY=y +CONFIG_PROC_SECURE=y +# CONFIG_VSERVER_HARDCPU is not set +# CONFIG_INOXID_NONE is not set +# CONFIG_INOXID_GID16 is not set +CONFIG_INOXID_GID24=y +# CONFIG_INOXID_GID32 is not set +# CONFIG_INOXID_MAGIC is not set + # # Security options # diff --git a/.config.cmd b/.config.cmd index 358c465ea..d5aa21909 100644 --- a/.config.cmd +++ b/.config.cmd @@ -3,6 +3,7 @@ deps_config := \ crypto/Kconfig \ security/selinux/Kconfig \ security/Kconfig \ + kernel/vserver/Kconfig \ arch/i386/oprofile/Kconfig \ fs/nls/Kconfig \ fs/partitions/Kconfig \ diff --git a/.config.old b/.config.old index a1d48d7b8..de7e3e791 100644 --- a/.config.old +++ b/.config.old @@ -1,12 +1,10 @@ # # Automatically generated make config: don't edit # +CONFIG_X86=y CONFIG_MMU=y CONFIG_UID16=y CONFIG_GENERIC_ISA_DMA=y -CONFIG_SMP=y -# CONFIG_HOTPLUG_CPU is not set -CONFIG_SCHED_SMT=y # # Code maturity level options @@ -20,9 +18,12 @@ CONFIG_STANDALONE=y # CONFIG_SWAP=y CONFIG_SYSVIPC=y +CONFIG_POSIX_MQUEUE=y CONFIG_BSD_PROCESS_ACCT=y CONFIG_SYSCTL=y +# CONFIG_AUDIT is not set CONFIG_LOG_BUF_SHIFT=17 +CONFIG_HOTPLUG=y # CONFIG_IKCONFIG is not set # CONFIG_EMBEDDED is not set CONFIG_KALLSYMS=y @@ -32,13 +33,8 @@ CONFIG_EPOLL=y CONFIG_IOSCHED_NOOP=y CONFIG_IOSCHED_AS=y CONFIG_IOSCHED_DEADLINE=y -# CONFIG_NUMA is not set -# CONFIG_PREEMPT is not set -# CONFIG_IRQBALANCE is not set -CONFIG_POSIX_MQUEUE=y -CONFIG_EDD=m -# CONFIG_SMBIOS is not set -CONFIG_IRQSTACKS=y +CONFIG_IOSCHED_CFQ=y +CONFIG_CC_OPTIMIZE_FOR_SIZE=y # # Loadable module support @@ -49,6 +45,93 @@ CONFIG_MODULE_UNLOAD=y CONFIG_OBSOLETE_MODPARM=y # CONFIG_MODVERSIONS is not set CONFIG_KMOD=y +CONFIG_STOP_MACHINE=y + +# +# Processor type and features +# +# CONFIG_X86_PC is not set +# CONFIG_X86_ELAN is not set +# CONFIG_X86_VOYAGER is not set +# CONFIG_X86_NUMAQ is not set +# CONFIG_X86_SUMMIT is not set +# CONFIG_X86_BIGSMP is not set +# CONFIG_X86_VISWS is not set +CONFIG_X86_GENERICARCH=y +# CONFIG_X86_ES7000 is not set +CONFIG_X86_CYCLONE_TIMER=y +# CONFIG_M386 is not set +# CONFIG_M486 is not set +# CONFIG_M586 is not set +# CONFIG_M586TSC is not set +# CONFIG_M586MMX is not set +CONFIG_M686=y +# CONFIG_MPENTIUMII is not set +# CONFIG_MPENTIUMIII is not set +# CONFIG_MPENTIUMM is not set +# CONFIG_MPENTIUM4 is not set +# CONFIG_MK6 is not set +# CONFIG_MK7 is not set +# CONFIG_MK8 is not set +# CONFIG_MCRUSOE is not set +# CONFIG_MWINCHIPC6 is not set +# CONFIG_MWINCHIP2 is not set +# CONFIG_MWINCHIP3D is not set +# CONFIG_MCYRIXIII is not set +# CONFIG_MVIAC3_2 is not set +CONFIG_X86_GENERIC=y +CONFIG_X86_CMPXCHG=y +CONFIG_X86_XADD=y +CONFIG_X86_L1_CACHE_SHIFT=7 +CONFIG_RWSEM_XCHGADD_ALGORITHM=y +CONFIG_X86_PPRO_FENCE=y +CONFIG_X86_WP_WORKS_OK=y +CONFIG_X86_INVLPG=y +CONFIG_X86_BSWAP=y +CONFIG_X86_POPAD_OK=y +CONFIG_X86_GOOD_APIC=y +CONFIG_X86_INTEL_USERCOPY=y +CONFIG_X86_USE_PPRO_CHECKSUM=y +CONFIG_X86_4G=y +CONFIG_X86_SWITCH_PAGETABLES=y +CONFIG_X86_4G_VM_LAYOUT=y +CONFIG_X86_UACCESS_INDIRECT=y +CONFIG_X86_HIGH_ENTRY=y +CONFIG_HPET_TIMER=y +CONFIG_HPET_EMULATE_RTC=y +CONFIG_SMP=y +CONFIG_NR_CPUS=32 +CONFIG_SCHED_SMT=y +# CONFIG_PREEMPT is not set +CONFIG_X86_LOCAL_APIC=y +CONFIG_X86_IO_APIC=y +CONFIG_X86_TSC=y +CONFIG_X86_MCE=y +# CONFIG_X86_MCE_NONFATAL is not set +CONFIG_X86_MCE_P4THERMAL=y +CONFIG_TOSHIBA=m +CONFIG_I8K=m +CONFIG_MICROCODE=m +CONFIG_X86_MSR=m +CONFIG_X86_CPUID=m + +# +# Firmware Drivers +# +CONFIG_EDD=m +# CONFIG_NOHIGHMEM is not set +# CONFIG_HIGHMEM4G is not set +CONFIG_HIGHMEM64G=y +CONFIG_HIGHMEM=y +CONFIG_X86_PAE=y +# CONFIG_NUMA is not set +CONFIG_HIGHPTE=y +# CONFIG_MATH_EMULATION is not set +CONFIG_MTRR=y +# CONFIG_EFI is not set +# CONFIG_IRQBALANCE is not set +CONFIG_HAVE_DEC_LOCK=y +CONFIG_REGPARM=y # # Power management options (ACPI, APM) @@ -64,6 +147,7 @@ CONFIG_ACPI=y CONFIG_ACPI_BOOT=y CONFIG_ACPI_INTERPRETER=y CONFIG_ACPI_SLEEP=y +CONFIG_ACPI_SLEEP_PROC_FS=y CONFIG_ACPI_AC=m CONFIG_ACPI_BATTERY=m CONFIG_ACPI_BUTTON=m @@ -78,7 +162,19 @@ CONFIG_ACPI_EC=y CONFIG_ACPI_POWER=y CONFIG_ACPI_PCI=y CONFIG_ACPI_SYSTEM=y -CONFIG_ACPI_NUMA=y +CONFIG_X86_PM_TIMER=y + +# +# APM (Advanced Power Management) BIOS Support +# +CONFIG_APM=y +# CONFIG_APM_IGNORE_USER_SUSPEND is not set +# CONFIG_APM_DO_ENABLE is not set +CONFIG_APM_CPU_IDLE=y +# CONFIG_APM_DISPLAY_BLANK is not set +CONFIG_APM_RTC_IS_GMT=y +# CONFIG_APM_ALLOW_INTS is not set +# CONFIG_APM_REAL_MODE_POWER_OFF is not set # # CPU Frequency scaling @@ -89,10 +185,29 @@ CONFIG_CPU_FREQ=y CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y CONFIG_CPU_FREQ_GOV_PERFORMANCE=y CONFIG_CPU_FREQ_GOV_POWERSAVE=m -CONFIG_CPU_FREQ_GOV_USERSPACE=m +CONFIG_CPU_FREQ_GOV_USERSPACE=y # CONFIG_CPU_FREQ_24_API is not set CONFIG_CPU_FREQ_TABLE=y +# +# CPUFreq processor drivers +# +CONFIG_X86_ACPI_CPUFREQ=m +# CONFIG_X86_ACPI_CPUFREQ_PROC_INTF is not set +CONFIG_X86_POWERNOW_K6=m +CONFIG_X86_POWERNOW_K7=y +CONFIG_X86_POWERNOW_K8=m +# CONFIG_X86_GX_SUSPMOD is not set +CONFIG_X86_SPEEDSTEP_CENTRINO=y +CONFIG_X86_SPEEDSTEP_CENTRINO_TABLE=y +CONFIG_X86_SPEEDSTEP_CENTRINO_ACPI=y +CONFIG_X86_SPEEDSTEP_ICH=y +CONFIG_X86_SPEEDSTEP_SMI=m +CONFIG_X86_P4_CLOCKMOD=m +CONFIG_X86_SPEEDSTEP_LIB=y +# CONFIG_X86_SPEEDSTEP_RELAXED_CAP_CHECK is not set +CONFIG_X86_LONGRUN=y +# CONFIG_X86_LONGHAUL is not set # # Bus options (PCI, PCMCIA, EISA, MCA, ISA) @@ -105,21 +220,20 @@ CONFIG_PCI_GOANY=y CONFIG_PCI_BIOS=y CONFIG_PCI_DIRECT=y CONFIG_PCI_MMCONFIG=y +CONFIG_PCI_USE_VECTOR=y CONFIG_PCI_LEGACY_PROC=y # CONFIG_PCI_NAMES is not set -CONFIG_PCI_USE_VECTOR=y CONFIG_ISA=y # CONFIG_EISA is not set # CONFIG_MCA is not set # CONFIG_SCx200 is not set -CONFIG_HOTPLUG=y # # PCMCIA/CardBus support # CONFIG_PCMCIA=m # CONFIG_PCMCIA_DEBUG is not set -CONFIG_YENTA=y +CONFIG_YENTA=m CONFIG_CARDBUS=y CONFIG_I82092=m CONFIG_I82365=m @@ -140,7 +254,6 @@ CONFIG_HOTPLUG_PCI_PCIE=m CONFIG_HOTPLUG_PCI_PCIE_POLL_EVENT_MODE=y CONFIG_HOTPLUG_PCI_SHPC=m CONFIG_HOTPLUG_PCI_SHPC_POLL_EVENT_MODE=y -# CONFIG_HOTPLUG_PCI_SHPC_PHPRM_LEGACY is not set # # Executable file formats @@ -157,6 +270,7 @@ CONFIG_BINFMT_MISC=m # Generic Driver Options # CONFIG_FW_LOADER=y +# CONFIG_DEBUG_DRIVER is not set # # Memory Technology Devices (MTD) @@ -281,21 +395,16 @@ CONFIG_BLK_DEV_UMEM=m CONFIG_BLK_DEV_LOOP=m CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m +CONFIG_BLK_DEV_CARMEL=m CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=16384 CONFIG_BLK_DEV_INITRD=y -CONFIG_BLK_DEV_ATIIXP=y CONFIG_LBD=y -# CONFIG_DCSSBLK is not set - # # ATA/ATAPI/MFM/RLL support # CONFIG_IDE=y -CONFIG_IDE_GENERIC=y -# CONFIG_HPT34X_AUTODMA is not set - CONFIG_BLK_DEV_IDE=y # @@ -316,8 +425,8 @@ CONFIG_BLK_DEV_IDEFLOPPY=y # # IDE chipset support/bugfixes # +CONFIG_IDE_GENERIC=y # CONFIG_BLK_DEV_CMD640 is not set -# CONFIG_BLK_DEV_CMD640_ENHANCED is not set CONFIG_BLK_DEV_IDEPNP=y CONFIG_BLK_DEV_IDEPCI=y CONFIG_IDEPCI_SHARE_IRQ=y @@ -326,7 +435,6 @@ CONFIG_BLK_DEV_GENERIC=y # CONFIG_BLK_DEV_OPTI621 is not set CONFIG_BLK_DEV_RZ1000=y CONFIG_BLK_DEV_IDEDMA_PCI=y -# CONFIG_BLK_DEV_IDE_TCQ is not set # CONFIG_BLK_DEV_IDEDMA_FORCED is not set CONFIG_IDEDMA_PCI_AUTO=y # CONFIG_IDEDMA_ONLYDISK is not set @@ -335,12 +443,14 @@ CONFIG_BLK_DEV_AEC62XX=y CONFIG_BLK_DEV_ALI15X3=y # CONFIG_WDC_ALI15X3 is not set CONFIG_BLK_DEV_AMD74XX=y +CONFIG_BLK_DEV_ATIIXP=y CONFIG_BLK_DEV_CMD64X=y CONFIG_BLK_DEV_TRIFLEX=y CONFIG_BLK_DEV_CY82C693=y CONFIG_BLK_DEV_CS5520=y CONFIG_BLK_DEV_CS5530=y CONFIG_BLK_DEV_HPT34X=y +# CONFIG_HPT34X_AUTODMA is not set CONFIG_BLK_DEV_HPT366=y # CONFIG_BLK_DEV_SC1200 is not set CONFIG_BLK_DEV_PIIX=y @@ -355,11 +465,11 @@ CONFIG_BLK_DEV_SIS5513=y CONFIG_BLK_DEV_SLC90E66=y # CONFIG_BLK_DEV_TRM290 is not set CONFIG_BLK_DEV_VIA82CXXX=y +# CONFIG_IDE_ARM is not set # CONFIG_IDE_CHIPSETS is not set CONFIG_BLK_DEV_IDEDMA=y # CONFIG_IDEDMA_IVB is not set CONFIG_IDEDMA_AUTO=y -# CONFIG_DMA_NONPCI is not set # CONFIG_BLK_DEV_HD is not set # @@ -382,11 +492,14 @@ CONFIG_CHR_DEV_SG=m # Some SCSI devices (e.g. CD jukebox) support multiple LUNs # # CONFIG_SCSI_MULTI_LUN is not set -CONFIG_SCSI_REPORT_LUNS=y CONFIG_SCSI_CONSTANTS=y CONFIG_SCSI_LOGGING=y -CONFIG_SCSI_SPI_ATTRS=y -CONFIG_SCSI_FC_ATTRS=y + +# +# SCSI Transport Attributes +# +CONFIG_SCSI_SPI_ATTRS=m +CONFIG_SCSI_FC_ATTRS=m # # SCSI low-level drivers @@ -400,7 +513,6 @@ CONFIG_SCSI_AACRAID=m CONFIG_SCSI_AIC7XXX=m CONFIG_AIC7XXX_CMDS_PER_DEVICE=4 CONFIG_AIC7XXX_RESET_DELAY_MS=15000 -# CONFIG_AIC7XXX_PROBE_EISA_VL is not set # CONFIG_AIC7XXX_BUILD_FIRMWARE is not set # CONFIG_AIC7XXX_DEBUG_ENABLE is not set CONFIG_AIC7XXX_DEBUG_MASK=0 @@ -414,6 +526,7 @@ CONFIG_AIC79XX_RESET_DELAY_MS=15000 # CONFIG_AIC79XX_DEBUG_ENABLE is not set CONFIG_AIC79XX_DEBUG_MASK=0 # CONFIG_AIC79XX_REG_PRETTY_PRINT is not set +# CONFIG_SCSI_DPT_I2O is not set CONFIG_SCSI_ADVANSYS=m CONFIG_SCSI_IN2000=m CONFIG_SCSI_MEGARAID=m @@ -421,13 +534,11 @@ CONFIG_SCSI_SATA=y CONFIG_SCSI_SATA_SVW=m CONFIG_SCSI_ATA_PIIX=m CONFIG_SCSI_SATA_PROMISE=m -CONFIG_SCSI_SATA_VIA=m -CONFIG_BLK_DEV_CARMEL=m -CONFIG_SCSI_SATA_VITESSE=m +CONFIG_SCSI_SATA_SX4=m CONFIG_SCSI_SATA_SIL=m CONFIG_SCSI_SATA_SIS=m -CONFIG_SCSI_SATA_SX4=m - +CONFIG_SCSI_SATA_VIA=m +CONFIG_SCSI_SATA_VITESSE=m CONFIG_SCSI_BUSLOGIC=m # CONFIG_SCSI_OMIT_FLASHPOINT is not set # CONFIG_SCSI_CPQFCTS is not set @@ -451,21 +562,13 @@ CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=1 CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16 CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64 # CONFIG_SCSI_SYM53C8XX_IOMAPPED is not set +# CONFIG_SCSI_IPR is not set # CONFIG_SCSI_PAS16 is not set # CONFIG_SCSI_PSI240I is not set CONFIG_SCSI_QLOGIC_FAS=m CONFIG_SCSI_QLOGIC_ISP=m # CONFIG_SCSI_QLOGIC_FC is not set -# CONFIG_SCSI_QLOGIC_FC_FIRMWARE is not set CONFIG_SCSI_QLOGIC_1280=m -# CONFIG_SCSI_SYM53C416 is not set -# CONFIG_SCSI_DC395x is not set -# CONFIG_SCSI_T128 is not set -# CONFIG_SCSI_U14_34F is not set -# CONFIG_SCSI_ULTRASTOR is not set -# CONFIG_SCSI_NSP32 is not set -# CONFIG_SCSI_DEBUG is not set -CONFIG_SCSI_DC390T=m CONFIG_SCSI_QLA2XXX=m CONFIG_SCSI_QLA21XX=m CONFIG_SCSI_QLA22XX=m @@ -473,8 +576,14 @@ CONFIG_SCSI_QLA2300=m CONFIG_SCSI_QLA2322=m CONFIG_SCSI_QLA6312=m CONFIG_SCSI_QLA6322=m -# CONFIG_SCSI_IPR is not set -# CONFIG_SCSI_DPT_I2O is not set +# CONFIG_SCSI_SYM53C416 is not set +# CONFIG_SCSI_DC395x is not set +CONFIG_SCSI_DC390T=m +# CONFIG_SCSI_T128 is not set +# CONFIG_SCSI_U14_34F is not set +# CONFIG_SCSI_ULTRASTOR is not set +# CONFIG_SCSI_NSP32 is not set +# CONFIG_SCSI_DEBUG is not set # # PCMCIA SCSI adapter support @@ -485,7 +594,6 @@ CONFIG_PCMCIA_NINJA_SCSI=m CONFIG_PCMCIA_QLOGIC=m CONFIG_PCMCIA_SYM53C500=m - # # Old CD-ROM drivers (not SCSI, not IDE) # @@ -515,7 +623,7 @@ CONFIG_FUSION_CTL=m CONFIG_FUSION_LAN=m # -# IEEE 1394 (FireWire) support (EXPERIMENTAL) +# IEEE 1394 (FireWire) support # CONFIG_IEEE1394=m @@ -524,6 +632,7 @@ CONFIG_IEEE1394=m # # CONFIG_IEEE1394_VERBOSEDEBUG is not set CONFIG_IEEE1394_OUI_DB=y +# CONFIG_IEEE1394_EXTRA_CONFIG_ROMS is not set # # Device Drivers @@ -542,17 +651,15 @@ CONFIG_IEEE1394_DV1394=m CONFIG_IEEE1394_RAWIO=m CONFIG_IEEE1394_CMP=m CONFIG_IEEE1394_AMDTP=m -# CONFIG_IEEE1394_EXTRA_CONFIG_ROMS is not set # # I2O device support # CONFIG_I2O=m -CONFIG_I2O_PCI=m +CONFIG_I2O_CONFIG=m CONFIG_I2O_BLOCK=m CONFIG_I2O_SCSI=m CONFIG_I2O_PROC=m -CONFIG_I2O_CONFIG=y # # Networking support @@ -588,9 +695,6 @@ CONFIG_SYN_COOKIES=y CONFIG_INET_AH=m CONFIG_INET_ESP=m CONFIG_INET_IPCOMP=m -CONFIG_NETCONSOLE=m -# CONFIG_NETPOLL_RX is not set -# CONFIG_NETPOLL_TRAP is not set # # IP: Virtual Server Configuration @@ -598,10 +702,18 @@ CONFIG_NETCONSOLE=m CONFIG_IP_VS=m # CONFIG_IP_VS_DEBUG is not set CONFIG_IP_VS_TAB_BITS=12 + +# +# IPVS transport protocol load balancing support +# CONFIG_IP_VS_PROTO_TCP=y CONFIG_IP_VS_PROTO_UDP=y CONFIG_IP_VS_PROTO_ESP=y CONFIG_IP_VS_PROTO_AH=y + +# +# IPVS scheduler +# CONFIG_IP_VS_RR=m CONFIG_IP_VS_WRR=m CONFIG_IP_VS_LC=m @@ -612,17 +724,17 @@ CONFIG_IP_VS_DH=m CONFIG_IP_VS_SH=m CONFIG_IP_VS_SED=m CONFIG_IP_VS_NQ=m -CONFIG_IP_VS_FTP=m - +# +# IPVS application helper +# +CONFIG_IP_VS_FTP=m CONFIG_IPV6=m CONFIG_IPV6_PRIVACY=y CONFIG_INET6_AH=m CONFIG_INET6_ESP=m CONFIG_INET6_IPCOMP=m CONFIG_IPV6_TUNNEL=m -# CONFIG_DECNET is not set -CONFIG_BRIDGE=m CONFIG_NETFILTER=y # CONFIG_NETFILTER_DEBUG is not set CONFIG_BRIDGE_NETFILTER=y @@ -636,7 +748,6 @@ CONFIG_IP_NF_IRC=m CONFIG_IP_NF_TFTP=m CONFIG_IP_NF_AMANDA=m CONFIG_IP_NF_QUEUE=m -CONFIG_IP_NF_RAW=m CONFIG_IP_NF_IPTABLES=m CONFIG_IP_NF_MATCH_LIMIT=m CONFIG_IP_NF_MATCH_IPRANGE=m @@ -665,7 +776,6 @@ CONFIG_IP_NF_TARGET_MASQUERADE=m CONFIG_IP_NF_TARGET_REDIRECT=m CONFIG_IP_NF_TARGET_NETMAP=m CONFIG_IP_NF_TARGET_SAME=m -CONFIG_IP_NF_TARGET_NOTRACK=m CONFIG_IP_NF_NAT_LOCAL=y CONFIG_IP_NF_NAT_SNMP_BASIC=m CONFIG_IP_NF_NAT_IRC=m @@ -686,6 +796,8 @@ CONFIG_IP_NF_ARPFILTER=m CONFIG_IP_NF_ARP_MANGLE=m # CONFIG_IP_NF_COMPAT_IPCHAINS is not set # CONFIG_IP_NF_COMPAT_IPFWADM is not set +CONFIG_IP_NF_TARGET_NOTRACK=m +CONFIG_IP_NF_RAW=m # # IPv6: Netfilter Configuration @@ -746,7 +858,9 @@ CONFIG_IP_SCTP=m # CONFIG_SCTP_HMAC_SHA1 is not set CONFIG_SCTP_HMAC_MD5=y # CONFIG_ATM is not set +CONFIG_BRIDGE=m CONFIG_VLAN_8021Q=m +# CONFIG_DECNET is not set CONFIG_LLC=m # CONFIG_LLC2 is not set CONFIG_IPX=m @@ -774,6 +888,7 @@ CONFIG_WAN_ROUTER=m CONFIG_NET_SCHED=y CONFIG_NET_SCH_CBQ=m CONFIG_NET_SCH_HTB=m +CONFIG_NET_SCH_HFSC=m CONFIG_NET_SCH_CSZ=m CONFIG_NET_SCH_PRIO=m CONFIG_NET_SCH_RED=m @@ -782,10 +897,8 @@ CONFIG_NET_SCH_TEQL=m CONFIG_NET_SCH_TBF=m CONFIG_NET_SCH_GRED=m CONFIG_NET_SCH_DSMARK=m -CONFIG_NET_SCH_INGRESS=m -CONFIG_NET_SCH_HFSC=m CONFIG_NET_SCH_DELAY=m - +CONFIG_NET_SCH_INGRESS=m CONFIG_NET_QOS=y CONFIG_NET_ESTIMATOR=y CONFIG_NET_CLS=y @@ -802,87 +915,171 @@ CONFIG_NET_CLS_POLICE=y # Network testing # # CONFIG_NET_PKTGEN is not set -CONFIG_NETDEVICES=y +CONFIG_NETPOLL=y +# CONFIG_NETPOLL_RX is not set +# CONFIG_NETPOLL_TRAP is not set +CONFIG_NET_POLL_CONTROLLER=y +# CONFIG_HAMRADIO is not set +CONFIG_IRDA=m # -# ARCnet devices +# IrDA protocols # -# CONFIG_ARCNET is not set -CONFIG_DUMMY=m -CONFIG_BONDING=m -CONFIG_EQUALIZER=m -CONFIG_TUN=m -CONFIG_ETHERTAP=m -CONFIG_NET_SB1000=m +CONFIG_IRLAN=m +CONFIG_IRNET=m +CONFIG_IRCOMM=m +# CONFIG_IRDA_ULTRA is not set # -# Ethernet (10 or 100Mbit) +# IrDA options # -CONFIG_NET_ETHERNET=y -CONFIG_MII=m -CONFIG_HAPPYMEAL=m -CONFIG_SUNGEM=m -CONFIG_NET_VENDOR_3COM=y -CONFIG_EL1=m -CONFIG_EL2=m -CONFIG_ELPLUS=m -CONFIG_EL16=m -CONFIG_EL3=m -CONFIG_3C515=m -CONFIG_VORTEX=m -CONFIG_TYPHOON=m -CONFIG_LANCE=m -CONFIG_NET_VENDOR_SMC=y -CONFIG_WD80x3=m -CONFIG_ULTRA=m -CONFIG_SMC9194=m -CONFIG_NET_VENDOR_RACAL=y -CONFIG_NI52=m -CONFIG_NI65=m +CONFIG_IRDA_CACHE_LAST_LSAP=y +CONFIG_IRDA_FAST_RR=y +# CONFIG_IRDA_DEBUG is not set # -# Tulip family network device support +# Infrared-port device drivers # -CONFIG_NET_TULIP=y -CONFIG_DE2104X=m -CONFIG_TULIP=m -# CONFIG_TULIP_NAPI is not set -# CONFIG_TULIP_MWI is not set -CONFIG_TULIP_MMIO=y -# CONFIG_NI5010 is not set -# CONFIG_PCMCIA_XIRTULIP is not set -CONFIG_DE4X5=m -CONFIG_WINBOND_840=m -CONFIG_DM9102=m -CONFIG_PCMCIA_XIRCOM=m -# CONFIG_AT1700 is not set -CONFIG_DEPCA=m -CONFIG_HP100=m -# CONFIG_NET_ISA is not set -# CONFIG_EWRK3 is not set -CONFIG_E2100=m -CONFIG_EEXPRESS=m -CONFIG_EEXPRESS_PRO=m -CONFIG_HPLAN_PLUS=m -CONFIG_HPLAN=m -CONFIG_LP486E=m -CONFIG_ETH16I=m -CONFIG_NE2000=m -CONFIG_ZNET=m -CONFIG_SEEQ8005=m -CONFIG_LNE390=m -CONFIG_NE3210=m -CONFIG_ES3210=m -CONFIG_NET_PCI=y -CONFIG_PCNET32=m -CONFIG_AMD8111_ETH=m -CONFIG_AMD8111E_NAPI=y -CONFIG_ADAPTEC_STARFIRE=m -CONFIG_ADAPTEC_STARFIRE_NAPI=y -CONFIG_AC3200=m +# +# SIR device drivers +# +CONFIG_IRTTY_SIR=m + +# +# Dongle support +# +CONFIG_DONGLE=y +CONFIG_ESI_DONGLE=m +CONFIG_ACTISYS_DONGLE=m +CONFIG_TEKRAM_DONGLE=m +CONFIG_LITELINK_DONGLE=m +CONFIG_MA600_DONGLE=m +CONFIG_GIRBIL_DONGLE=m +CONFIG_MCP2120_DONGLE=m +CONFIG_OLD_BELKIN_DONGLE=m +CONFIG_ACT200L_DONGLE=m + +# +# Old SIR device drivers +# + +# +# Old Serial dongle support +# + +# +# FIR device drivers +# +CONFIG_USB_IRDA=m +CONFIG_SIGMATEL_FIR=m +CONFIG_NSC_FIR=m +# CONFIG_WINBOND_FIR is not set +# CONFIG_TOSHIBA_FIR is not set +# CONFIG_SMC_IRCC_FIR is not set +# CONFIG_ALI_FIR is not set +# CONFIG_VLSI_FIR is not set +# CONFIG_VIA_FIR is not set +CONFIG_BT=m +CONFIG_BT_L2CAP=m +CONFIG_BT_SCO=m +CONFIG_BT_RFCOMM=m +CONFIG_BT_RFCOMM_TTY=y +CONFIG_BT_BNEP=m +CONFIG_BT_BNEP_MC_FILTER=y +CONFIG_BT_BNEP_PROTO_FILTER=y +CONFIG_BT_CMTP=m + +# +# Bluetooth device drivers +# +CONFIG_BT_HCIUSB=m +CONFIG_BT_HCIUSB_SCO=y +CONFIG_BT_HCIUART=m +CONFIG_BT_HCIUART_H4=y +CONFIG_BT_HCIUART_BCSP=y +CONFIG_BT_HCIUART_BCSP_TXCRC=y +CONFIG_BT_HCIBCM203X=m +CONFIG_BT_HCIBFUSB=m +CONFIG_BT_HCIDTL1=m +CONFIG_BT_HCIBT3C=m +CONFIG_BT_HCIBLUECARD=m +CONFIG_BT_HCIBTUART=m +CONFIG_BT_HCIVHCI=m +CONFIG_TUX=m + +# +# TUX options +# +CONFIG_TUX_EXTCGI=y +# CONFIG_TUX_EXTENDED_LOG is not set +# CONFIG_TUX_DEBUG is not set +CONFIG_NETDEVICES=y +CONFIG_DUMMY=m +CONFIG_BONDING=m +CONFIG_EQUALIZER=m +CONFIG_TUN=m +CONFIG_ETHERTAP=m +CONFIG_NET_SB1000=m + +# +# ARCnet devices +# +# CONFIG_ARCNET is not set + +# +# Ethernet (10 or 100Mbit) +# +CONFIG_NET_ETHERNET=y +CONFIG_MII=m +CONFIG_HAPPYMEAL=m +CONFIG_SUNGEM=m +CONFIG_NET_VENDOR_3COM=y +CONFIG_EL1=m +CONFIG_EL2=m +CONFIG_ELPLUS=m +CONFIG_EL16=m +CONFIG_EL3=m +CONFIG_3C515=m +CONFIG_VORTEX=m +CONFIG_TYPHOON=m +CONFIG_LANCE=m +CONFIG_NET_VENDOR_SMC=y +CONFIG_WD80x3=m +CONFIG_ULTRA=m +CONFIG_SMC9194=m +CONFIG_NET_VENDOR_RACAL=y +CONFIG_NI52=m +CONFIG_NI65=m + +# +# Tulip family network device support +# +CONFIG_NET_TULIP=y +CONFIG_DE2104X=m +CONFIG_TULIP=m +# CONFIG_TULIP_MWI is not set +CONFIG_TULIP_MMIO=y +# CONFIG_TULIP_NAPI is not set +CONFIG_DE4X5=m +CONFIG_WINBOND_840=m +CONFIG_DM9102=m +CONFIG_PCMCIA_XIRCOM=m +# CONFIG_AT1700 is not set +CONFIG_DEPCA=m +CONFIG_HP100=m +# CONFIG_NET_ISA is not set +CONFIG_NE2000=m +CONFIG_NET_PCI=y +CONFIG_PCNET32=m +CONFIG_AMD8111_ETH=m +CONFIG_AMD8111E_NAPI=y +CONFIG_ADAPTEC_STARFIRE=m +CONFIG_ADAPTEC_STARFIRE_NAPI=y +CONFIG_AC3200=m CONFIG_APRICOT=m CONFIG_B44=m +CONFIG_FORCEDETH=m CONFIG_CS89x0=m CONFIG_DGRS=m CONFIG_EEPRO100=m @@ -890,7 +1087,6 @@ CONFIG_EEPRO100=m CONFIG_E100=m CONFIG_E100_NAPI=y CONFIG_FEALNX=m -CONFIG_FORCEDETH=m CONFIG_NATSEMI=m CONFIG_NE2K_PCI=m CONFIG_8139CP=m @@ -899,7 +1095,6 @@ CONFIG_8139TOO_PIO=y # CONFIG_8139TOO_TUNE_TWISTER is not set CONFIG_8139TOO_8129=y # CONFIG_8139_OLD_RX_RESET is not set -CONFIG_8139_RXBUF_IDX=2 CONFIG_SIS900=m CONFIG_EPIC100=m CONFIG_SUNDANCE=m @@ -913,7 +1108,7 @@ CONFIG_DE600=m CONFIG_DE620=m # -# Ethernet (1000 Mbit) +# Gigabit Ethernet (1000/10000 Mbit) # CONFIG_NET_GIGE=y CONFIG_ACENIC=m @@ -927,29 +1122,15 @@ CONFIG_YELLOWFIN=m CONFIG_R8169=m CONFIG_SK98LIN=m CONFIG_TIGON3=m - -# -# Ethernet (10000 Mbit) -# CONFIG_IXGB=m CONFIG_IXGB_NAPI=y CONFIG_S2IO=m CONFIG_S2IO_NAPI=y -CONFIG_FDDI=y -# CONFIG_DEFXX is not set -CONFIG_SKFP=m -# CONFIG_HIPPI is not set -CONFIG_PLIP=m -CONFIG_PPP=m -CONFIG_PPP_MULTILINK=y -CONFIG_PPP_FILTER=y -CONFIG_PPP_ASYNC=m -CONFIG_PPP_SYNC_TTY=m -CONFIG_PPP_DEFLATE=m -CONFIG_IPPP_FILTER=y -# CONFIG_PPP_BSDCOMP is not set -CONFIG_PPPOE=m -# CONFIG_SLIP is not set + +# +# Token Ring devices +# +# CONFIG_TR is not set # # Wireless LAN (non-hamradio) @@ -980,7 +1161,6 @@ CONFIG_TMD_HERMES=m CONFIG_PCI_HERMES=m CONFIG_ATMEL=m CONFIG_PCI_ATMEL=m -CONFIG_PRISM54=m # # Wireless 802.11b Pcmcia/Cardbus cards support @@ -989,21 +1169,12 @@ CONFIG_PCMCIA_HERMES=m CONFIG_AIRO_CS=m CONFIG_PCMCIA_ATMEL=m CONFIG_PCMCIA_WL3501=m -CONFIG_NET_WIRELESS=y # -# Token Ring devices -# -# CONFIG_TR is not set - -CONFIG_NET_FC=y -CONFIG_RCPCI=m -# CONFIG_SHAPER is not set - -# -# Wan interfaces +# Prism GT/Duette 802.11(a/b/g) PCI/Cardbus support # -# CONFIG_WAN is not set +CONFIG_PRISM54=m +CONFIG_NET_WIRELESS=y # # PCMCIA network device support @@ -1019,119 +1190,72 @@ CONFIG_PCMCIA_XIRC2PS=m CONFIG_PCMCIA_AXNET=m # -# Amateur Radio support -# -# CONFIG_HAMRADIO is not set - -# -# IrDA (infrared) support -# -CONFIG_IRDA=m -# CONFIG_IRDA_DEBUG is not set -CONFIG_IRLAN=m -CONFIG_IRNET=m -CONFIG_IRCOMM=m -# CONFIG_IRDA_ULTRA is not set -CONFIG_IRDA_CACHE_LAST_LSAP=y -CONFIG_IRDA_FAST_RR=y -CONFIG_IRTTY_SIR=m -CONFIG_DONGLE=y -CONFIG_ESI_DONGLE=m -CONFIG_ACTISYS_DONGLE=m -CONFIG_TEKRAM_DONGLE=m -CONFIG_IRPORT_SIR=m -# CONFIG_DONGLE_OLD is not set -CONFIG_LITELINK_DONGLE=m -CONFIG_MA600_DONGLE=m -CONFIG_GIRBIL_DONGLE=m -CONFIG_MCP2120_DONGLE=m -CONFIG_OLD_BELKIN_DONGLE=m -CONFIG_ACT200L_DONGLE=m - -CONFIG_USB_IRDA=m -CONFIG_NSC_FIR=m -CONFIG_SIGMATEL_FIR=m -# CONFIG_WINBOND_FIR is not set -# CONFIG_TOSHIBA_FIR is not set -# CONFIG_SMC_IRCC_FIR is not set -# CONFIG_ALI_FIR is not set -# CONFIG_VLSI_FIR is not set -# CONFIG_VIA_FIR is not set - - - -# -# Bluetooth support +# Wan interfaces # -CONFIG_BT=m -CONFIG_BT_L2CAP=m -CONFIG_BT_SCO=m -CONFIG_BT_CMTP=m -CONFIG_BT_RFCOMM=m -CONFIG_BT_RFCOMM_TTY=y -CONFIG_BT_BNEP=m -CONFIG_BT_BNEP_MC_FILTER=y -CONFIG_BT_BNEP_PROTO_FILTER=y +# CONFIG_WAN is not set +CONFIG_FDDI=y +# CONFIG_DEFXX is not set +CONFIG_SKFP=m +# CONFIG_HIPPI is not set +CONFIG_PLIP=m +CONFIG_PPP=m +CONFIG_PPP_MULTILINK=y +CONFIG_PPP_FILTER=y +CONFIG_PPP_ASYNC=m +CONFIG_PPP_SYNC_TTY=m +CONFIG_PPP_DEFLATE=m +# CONFIG_PPP_BSDCOMP is not set +CONFIG_PPPOE=m +# CONFIG_SLIP is not set +CONFIG_NET_FC=y +# CONFIG_SHAPER is not set +CONFIG_NETCONSOLE=m # -# Bluetooth device drivers +# ISDN subsystem # -CONFIG_BT_HCIUSB=m -CONFIG_BT_HCIUART=m -CONFIG_BT_HCIUART_H4=y -CONFIG_BT_HCIUART_BCSP=y -CONFIG_BT_HCIUART_BCSP_TXCRC=y -CONFIG_BT_HCIDTL1=m -CONFIG_BT_HCIBT3C=m -CONFIG_BT_HCIBLUECARD=m -CONFIG_BT_HCIBTUART=m -CONFIG_BT_HCIVHCI=m -CONFIG_BT_HCIUSB_SCO=y -CONFIG_BT_HCIBCM203X=m -CONFIG_BT_HCIBFUSB=m -CONFIG_BT_CMTP=m -CONFIG_BT_HCIUSB_SCO=m -CONFIG_BT_HCIBCM203X=m -CONFIG_BT_HCIBFUSB=m -CONFIG_USB_BLUETOOTH_TTY=m +CONFIG_ISDN=m # -# ISDN subsystem +# Old ISDN4Linux # - -CONFIG_ISDN=m CONFIG_ISDN_I4L=m -CONFIG_ISDN_DRV_AVMB1_B1ISA=m -CONFIG_ISDN_DRV_AVMB1_B1PCI=m -CONFIG_ISDN_DRV_AVMB1_T1ISA=m -CONFIG_ISDN_DRV_AVMB1_B1PCMCIA=m -CONFIG_ISDN_DRV_AVMB1_T1PCI=m -CONFIG_ISDN_DRV_AVMB1_C4=m - CONFIG_ISDN_PPP=y CONFIG_ISDN_PPP_VJ=y CONFIG_ISDN_MPP=y +CONFIG_IPPP_FILTER=y # CONFIG_ISDN_PPP_BSDCOMP is not set +CONFIG_ISDN_AUDIO=y CONFIG_ISDN_TTY_FAX=y -CONFIG_DE_AOC=y -CONFIG_ISDN_AUDIO=y +# +# ISDN feature submodules +# -CONFIG_ISDN_DRV_HISAX=m -CONFIG_ISDN_DRV_ICN=m -CONFIG_ISDN_DRV_PCBIT=m -CONFIG_ISDN_DRV_SC=m -CONFIG_ISDN_DRV_ACT2000=m -CONFIG_ISDN_DRV_TPAM=m -CONFIG_ISDN_DRV_AVMB1_B1PCIV4=y -CONFIG_ISDN_DRV_AVMB1_AVM_CS=m +# +# ISDN4Linux hardware drivers +# -CONFIG_ISDN_CAPI_CAPIDRV=m +# +# Passive cards +# +CONFIG_ISDN_DRV_HISAX=m +# +# D-channel protocol features +# CONFIG_HISAX_EURO=y +CONFIG_DE_AOC=y +CONFIG_HISAX_NO_SENDCOMPLETE=y +CONFIG_HISAX_NO_LLC=y +CONFIG_HISAX_NO_KEYPAD=y CONFIG_HISAX_1TR6=y CONFIG_HISAX_NI1=y CONFIG_HISAX_MAX_CARDS=8 + +# +# HiSax supported cards +# CONFIG_HISAX_16_0=y CONFIG_HISAX_16_3=y CONFIG_HISAX_TELESPCI=y @@ -1161,21 +1285,31 @@ CONFIG_HISAX_W6692=y CONFIG_HISAX_HFC_SX=y CONFIG_HISAX_ENTERNOW_PCI=y # CONFIG_HISAX_DEBUG is not set -CONFIG_HISAX_AVM_A1_CS=m -CONFIG_HISAX_ST5481=m -CONFIG_HISAX_HFCUSB=m -CONFIG_HISAX_FRITZ_PCIPNP=m -CONFIG_HISAX_NO_SENDCOMPLETE=y -CONFIG_HISAX_NO_LLC=y -CONFIG_HISAX_NO_KEYPAD=y + +# +# HiSax PCMCIA card service modules +# CONFIG_HISAX_SEDLBAUER_CS=m CONFIG_HISAX_ELSA_CS=m +CONFIG_HISAX_AVM_A1_CS=m CONFIG_HISAX_TELES_CS=m -CONFIG_ISDN_DRV_LOOP=m -CONFIG_HYSDN=m -CONFIG_HYSDN_CAPI=y +# +# HiSax sub driver modules +# +CONFIG_HISAX_ST5481=m +CONFIG_HISAX_HFCUSB=m +CONFIG_HISAX_FRITZ_PCIPNP=m +CONFIG_HISAX_HDLC=y +# +# Active cards +# +CONFIG_ISDN_DRV_ICN=m +CONFIG_ISDN_DRV_PCBIT=m +CONFIG_ISDN_DRV_SC=m +CONFIG_ISDN_DRV_ACT2000=m +CONFIG_ISDN_DRV_TPAM=m # # CAPI subsystem @@ -1186,6 +1320,7 @@ CONFIG_ISDN_CAPI_MIDDLEWARE=y CONFIG_ISDN_CAPI_CAPI20=m CONFIG_ISDN_CAPI_CAPIFS_BOOL=y CONFIG_ISDN_CAPI_CAPIFS=m +CONFIG_ISDN_CAPI_CAPIDRV=m # # CAPI hardware drivers @@ -1253,9 +1388,9 @@ CONFIG_SERIO_SERPORT=y CONFIG_INPUT_KEYBOARD=y CONFIG_KEYBOARD_ATKBD=y # CONFIG_KEYBOARD_SUNKBD is not set +# CONFIG_KEYBOARD_LKKBD is not set # CONFIG_KEYBOARD_XTKBD is not set # CONFIG_KEYBOARD_NEWTON is not set -# CONFIG_KEYBOARD_LKKBD is not set CONFIG_INPUT_MOUSE=y CONFIG_MOUSE_PS2=y CONFIG_MOUSE_SERIAL=m @@ -1303,12 +1438,11 @@ CONFIG_VT_CONSOLE=y CONFIG_HW_CONSOLE=y CONFIG_SERIAL_NONSTANDARD=y CONFIG_ROCKETPORT=m +# CONFIG_CYCLADES is not set CONFIG_SYNCLINK=m CONFIG_SYNCLINKMP=m CONFIG_N_HDLC=m CONFIG_STALDRV=y -# CONFIG_FTAPE is not set -CONFIG_IBM_ASM=m # # Serial drivers @@ -1324,20 +1458,6 @@ CONFIG_SERIAL_8250_SHARE_IRQ=y CONFIG_SERIAL_8250_DETECT_IRQ=y CONFIG_SERIAL_8250_MULTIPORT=y CONFIG_SERIAL_8250_RSA=y -# CONFIG_COMPUTONE is not set -# CONFIG_CYCLADES is not set -# CONFIG_DIGIEPCA is not set -# CONFIG_DIGI is not set -# CONFIG_ESPSERIAL is not set -# CONFIG_MOXA_INTELLIO is not set -# CONFIG_MOXA_SMARTIO is not set -# CONFIG_ISI is not set -# CONFIG_RISCOM8 is not set -# CONFIG_SPECIALIX is not set -# CONFIG_SX is not set -# CONFIG_RIO is not set -# CONFIG_STALLION is not set -# CONFIG_ISTALLION is not set # # Non-8250 serial port support @@ -1345,92 +1465,13 @@ CONFIG_SERIAL_8250_RSA=y CONFIG_SERIAL_CORE=y CONFIG_SERIAL_CORE_CONSOLE=y CONFIG_UNIX98_PTYS=y -CONFIG_UNIX98_PTY_COUNT=2048 # CONFIG_LEGACY_PTYS is not set +CONFIG_CRASH=m CONFIG_PRINTER=m CONFIG_LP_CONSOLE=y CONFIG_PPDEV=m CONFIG_TIPAR=m - -# -# I2C support -# -CONFIG_I2C=m -CONFIG_I2C_CHARDEV=m - -# -# I2C Algorithms -# -# CONFIG_I2C_DEBUG_ALGO is not set -CONFIG_I2C_ALGOBIT=m -CONFIG_I2C_ALGOPCF=m - -# -# I2C Hardware Bus support -# -CONFIG_I2C_ALI1535=m -CONFIG_I2C_ALI15X3=m -CONFIG_I2C_AMD756=m -CONFIG_I2C_AMD8111=m -CONFIG_I2C_I801=m -CONFIG_I2C_I810=m -CONFIG_I2C_ISA=m -CONFIG_I2C_NFORCE2=m -CONFIG_I2C_PIIX4=m -CONFIG_I2C_PROSAVAGE=m -CONFIG_I2C_SAVAGE4=m -# CONFIG_SCx200_ACB is not set -CONFIG_I2C_SIS5595=m -CONFIG_I2C_SIS630=m -CONFIG_I2C_SIS96X=m -CONFIG_I2C_VIA=m -CONFIG_I2C_VIAPRO=m -CONFIG_I2C_VOODOO3=m -# CONFIG_I2C_ELEKTOR is not set -CONFIG_I2C_PARPORT=m -CONFIG_I2C_PARPORT_LIGHT=m -# CONFIG_I2C_DEBUG_CORE is not set -# CONFIG_I2C_DEBUG_BUS is not set -# CONFIG_I2C_DEBUG_CHIP is not set -# CONFIG_I2C_PARPORT is not set -CONFIG_I2C_ALI1563=m -# CONFIG_I2C_PARPORT_LIGHT is not set - - - -# -# I2C Hardware Sensors Chip support -# -CONFIG_I2C_SENSOR=m -CONFIG_SENSORS_ADM1021=m -CONFIG_SENSORS_EEPROM=m -CONFIG_SENSORS_IT87=m -CONFIG_SENSORS_LM75=m -CONFIG_SENSORS_LM78=m -CONFIG_SENSORS_LM80=m -CONFIG_SENSORS_LM83=m -CONFIG_SENSORS_LM85=m -CONFIG_SENSORS_VIA686A=m -CONFIG_SENSORS_W83781D=m -CONFIG_SENSORS_ASB100=m -CONFIG_SENSORS_LM90=m -CONFIG_SENSORS_W83L785TS=m -CONFIG_SENSORS_FSCHER=m -CONFIG_SENSORS_GL518SM=m -CONFIG_SENSORS_DS1621=m -CONFIG_SENSORS_W83627HF=m -CONFIG_SENSORS_PCF8574=m -CONFIG_SENSORS_PCF8591=m -CONFIG_SENSORS_RTC8564=m -CONFIG_SENSORS_MAX1619=m - - -# -# Mice -# -CONFIG_BUSMOUSE=m # CONFIG_QIC02_TAPE is not set -CONFIG_CRASH=m # # IPMI @@ -1438,43 +1479,55 @@ CONFIG_CRASH=m CONFIG_IPMI_HANDLER=m # CONFIG_IPMI_PANIC_EVENT is not set CONFIG_IPMI_DEVICE_INTERFACE=m -CONFIG_IPMI_KCS=m -CONFIG_IPMI_WATCHDOG=m CONFIG_IPMI_SI=m +CONFIG_IPMI_WATCHDOG=m # # Watchdog Cards # CONFIG_WATCHDOG=y # CONFIG_WATCHDOG_NOWAYOUT is not set + +# +# Watchdog Device Drivers +# CONFIG_SOFT_WATCHDOG=m -CONFIG_WDT=m -# CONFIG_WDT_501 is not set -CONFIG_WDTPCI=m -CONFIG_WDT_501_PCI=y -CONFIG_PCWATCHDOG=m CONFIG_ACQUIRE_WDT=m CONFIG_ADVANTECH_WDT=m +CONFIG_ALIM1535_WDT=m +CONFIG_ALIM7101_WDT=m +CONFIG_SC520_WDT=m CONFIG_EUROTECH_WDT=m CONFIG_IB700_WDT=m +CONFIG_WAFER_WDT=m CONFIG_I8XX_TCO=m -# CONFIG_MIXCOMWD is not set +CONFIG_SC1200_WDT=m # CONFIG_SCx200_WDT is not set # CONFIG_60XX_WDT is not set -CONFIG_W83877F_WDT=m +CONFIG_CPU5_WDT=m CONFIG_W83627HF_WDT=m +CONFIG_W83877F_WDT=m CONFIG_MACHZ_WDT=m -CONFIG_SC520_WDT=m -CONFIG_AMD7XX_TCO=m -CONFIG_ALIM7101_WDT=m -CONFIG_ALIM1535_WDT=m -CONFIG_SC1200_WDT=m -CONFIG_WAFER_WDT=m -CONFIG_CPU5_WDT=m -CONFIG_PCIPCWATCHDOG=m -CONFIG_USBPCWATCHDOG=m +# +# ISA-based Watchdog Cards +# +CONFIG_PCWATCHDOG=m +# CONFIG_MIXCOMWD is not set +CONFIG_WDT=m +# CONFIG_WDT_501 is not set + +# +# PCI-based Watchdog Cards +# +CONFIG_PCIPCWATCHDOG=m +CONFIG_WDTPCI=m +CONFIG_WDT_501_PCI=y +# +# USB-based Watchdog Cards +# +CONFIG_USBPCWATCHDOG=m CONFIG_HW_RANDOM=m CONFIG_NVRAM=m CONFIG_RTC=y @@ -1508,18 +1561,89 @@ CONFIG_DRM_I830=m CONFIG_DRM_MGA=m CONFIG_DRM_SIS=m +# +# PCMCIA character devices +# +CONFIG_SYNCLINK_CS=m +CONFIG_MWAVE=m +# CONFIG_RAW_DRIVER is not set +CONFIG_HANGCHECK_TIMER=m + +# +# I2C support +# +CONFIG_I2C=m +CONFIG_I2C_CHARDEV=m + +# +# I2C Algorithms +# +CONFIG_I2C_ALGOBIT=m +CONFIG_I2C_ALGOPCF=m + +# +# I2C Hardware Bus support +# +CONFIG_I2C_ALI1535=m +CONFIG_I2C_ALI1563=m +CONFIG_I2C_ALI15X3=m +CONFIG_I2C_AMD756=m +CONFIG_I2C_AMD8111=m +CONFIG_I2C_I801=m +CONFIG_I2C_I810=m +CONFIG_I2C_ISA=m +CONFIG_I2C_NFORCE2=m +# CONFIG_I2C_PARPORT is not set +# CONFIG_I2C_PARPORT_LIGHT is not set +CONFIG_I2C_PIIX4=m +CONFIG_I2C_PROSAVAGE=m +CONFIG_I2C_SAVAGE4=m +# CONFIG_SCx200_ACB is not set +CONFIG_I2C_SIS5595=m +CONFIG_I2C_SIS630=m +CONFIG_I2C_SIS96X=m +CONFIG_I2C_VIA=m +CONFIG_I2C_VIAPRO=m +CONFIG_I2C_VOODOO3=m + +# +# Hardware Sensors Chip support +# +CONFIG_I2C_SENSOR=m +CONFIG_SENSORS_ADM1021=m +CONFIG_SENSORS_ASB100=m +CONFIG_SENSORS_DS1621=m +CONFIG_SENSORS_FSCHER=m +CONFIG_SENSORS_GL518SM=m +CONFIG_SENSORS_IT87=m +CONFIG_SENSORS_LM75=m +CONFIG_SENSORS_LM78=m +CONFIG_SENSORS_LM80=m +CONFIG_SENSORS_LM83=m +CONFIG_SENSORS_LM85=m +CONFIG_SENSORS_LM90=m +CONFIG_SENSORS_MAX1619=m +CONFIG_SENSORS_VIA686A=m +CONFIG_SENSORS_W83781D=m +CONFIG_SENSORS_W83L785TS=m +CONFIG_SENSORS_W83627HF=m # -# PCMCIA character devices +# Other I2C Chip support # -CONFIG_SYNCLINK_CS=m - - +CONFIG_SENSORS_EEPROM=m +CONFIG_SENSORS_PCF8574=m +CONFIG_SENSORS_PCF8591=m +CONFIG_SENSORS_RTC8564=m +# CONFIG_I2C_DEBUG_CORE is not set +# CONFIG_I2C_DEBUG_ALGO is not set +# CONFIG_I2C_DEBUG_BUS is not set +# CONFIG_I2C_DEBUG_CHIP is not set -CONFIG_MWAVE=m -# CONFIG_RAW_DRIVER is not set -CONFIG_MAX_RAW_DEVS=8192 -CONFIG_HANGCHECK_TIMER=m +# +# Misc devices +# +CONFIG_IBM_ASM=m # # Multimedia devices @@ -1541,24 +1665,22 @@ CONFIG_VIDEO_W9966=m CONFIG_VIDEO_CPIA=m CONFIG_VIDEO_CPIA_PP=m CONFIG_VIDEO_CPIA_USB=m +CONFIG_VIDEO_SAA5246A=m CONFIG_VIDEO_SAA5249=m CONFIG_TUNER_3036=m CONFIG_VIDEO_STRADIS=m CONFIG_VIDEO_ZORAN=m -CONFIG_VIDEO_ZORAN=m CONFIG_VIDEO_ZORAN_BUZ=m CONFIG_VIDEO_ZORAN_DC10=m CONFIG_VIDEO_ZORAN_DC30=m CONFIG_VIDEO_ZORAN_LML33=m CONFIG_VIDEO_ZORAN_LML33R10=m -CONFIG_VIDEO_MEYE=m CONFIG_VIDEO_SAA7134=m CONFIG_VIDEO_MXB=m CONFIG_VIDEO_DPC=m CONFIG_VIDEO_HEXIUM_ORION=m CONFIG_VIDEO_HEXIUM_GEMINI=m CONFIG_VIDEO_CX88=m -CONFIG_VIDEO_SAA5246A=m # # Radio Adapters @@ -1571,8 +1693,6 @@ CONFIG_RADIO_GEMTEK=m CONFIG_RADIO_GEMTEK_PCI=m CONFIG_RADIO_MAXIRADIO=m CONFIG_RADIO_MAESTRO=m -CONFIG_RADIO_MIROPCM20=m -CONFIG_RADIO_MIROPCM20_RDS=m CONFIG_RADIO_SF16FMI=m CONFIG_RADIO_SF16FMR2=m CONFIG_RADIO_TERRATEC=m @@ -1581,70 +1701,31 @@ CONFIG_RADIO_TYPHOON=m CONFIG_RADIO_TYPHOON_PROC_FS=y CONFIG_RADIO_ZOLTRIX=m - # # Digital Video Broadcasting Devices # # CONFIG_DVB is not set -CONFIG_DVB_CORE=m - -# -# Supported Frontend Modules -# -CONFIG_DVB_STV0299=m -# CONFIG_DVB_SP887X is not set -# CONFIG_DVB_ALPS_TDLB7 is not set -CONFIG_DVB_ALPS_TDMB7=m -CONFIG_DVB_ATMEL_AT76C651=m -CONFIG_DVB_CX24110=m -CONFIG_DVB_GRUNDIG_29504_491=m -CONFIG_DVB_GRUNDIG_29504_401=m -CONFIG_DVB_MT312=m -CONFIG_DVB_VES1820=m -CONFIG_DVB_VES1X93=m -CONFIG_DVB_TWINHAN_DST=m -CONFIG_DVB_TTUSB_DEC=m -CONFIG_DVB_BT8XX=m -# CONFIG_DVB_TDA1004X is not set -CONFIG_DVB_NXT6000=m - -# -# Supported SAA7146 based PCI Adapters -# -CONFIG_DVB_AV7110=m -CONFIG_DVB_AV7110_OSD=y -# CONFIG_DVB_AV7110_FIRMWARE is not set -CONFIG_DVB_BUDGET=m -CONFIG_DVB_BUDGET_CI=m -CONFIG_DVB_BUDGET_AV=m -CONFIG_DVB_BUDGET_PATCH=m - -# -# Supported USB Adapters -# -CONFIG_DVB_TTUSB_BUDGET=m - -# -# Supported FlexCopII (B2C2) Adapters -# -CONFIG_DVB_B2C2_SKYSTAR=m CONFIG_VIDEO_SAA7146=m CONFIG_VIDEO_SAA7146_VV=m CONFIG_VIDEO_VIDEOBUF=m CONFIG_VIDEO_TUNER=m CONFIG_VIDEO_BUF=m CONFIG_VIDEO_BTCX=m +CONFIG_VIDEO_IR=m # # Graphics support # CONFIG_FB=y +# CONFIG_FB_PM2 is not set # CONFIG_FB_CYBER2000 is not set +# CONFIG_FB_ASILIANT is not set # CONFIG_FB_IMSTT is not set CONFIG_FB_VGA16=m CONFIG_FB_VESA=y CONFIG_VIDEO_SELECT=y CONFIG_FB_HGA=m +CONFIG_FB_HGA_ACCEL=y CONFIG_FB_RIVA=m CONFIG_FB_I810=m CONFIG_FB_I810_GTF=y @@ -1656,30 +1737,24 @@ CONFIG_FB_MATROX_G100=y CONFIG_FB_MATROX_I2C=m CONFIG_FB_MATROX_MAVEN=m CONFIG_FB_MATROX_MULTIHEAD=y -CONFIG_FB_RADEON=m -# CONFIG_FB_RADEON_DEBUG is not set # CONFIG_FB_RADEON_OLD is not set +CONFIG_FB_RADEON=m CONFIG_FB_RADEON_I2C=y +# CONFIG_FB_RADEON_DEBUG is not set CONFIG_FB_ATY128=m CONFIG_FB_ATY=m CONFIG_FB_ATY_CT=y CONFIG_FB_ATY_GX=y # CONFIG_FB_ATY_XL_INIT is not set # CONFIG_FB_SIS is not set -CONFIG_FB_SIS_300=y -CONFIG_FB_SIS_315=y CONFIG_FB_NEOMAGIC=m +CONFIG_FB_KYRO=m CONFIG_FB_3DFX=m +CONFIG_FB_3DFX_ACCEL=y CONFIG_FB_VOODOO1=m CONFIG_FB_TRIDENT=m -# CONFIG_FB_VIRTUAL is not set -CONFIG_FB_KYRO=m -# CONFIG_FB_PM2 is not set -# CONFIG_FB_PM2_FIFO_DISCONNECT is not set -# CONFIG_FB_ASILIANT is not set -CONFIG_FB_HGA_ACCEL=y -CONFIG_FB_3DFX_ACCEL=y CONFIG_FB_TRIDENT_ACCEL=y +# CONFIG_FB_VIRTUAL is not set # # Console display driver support @@ -1688,8 +1763,10 @@ CONFIG_VGA_CONSOLE=y CONFIG_MDA_CONSOLE=m CONFIG_DUMMY_CONSOLE=y CONFIG_FRAMEBUFFER_CONSOLE=y +CONFIG_PCI_CONSOLE=y # CONFIG_FONTS is not set - +CONFIG_FONT_8x8=y +CONFIG_FONT_8x16=y # # Logo configuration @@ -1708,6 +1785,10 @@ CONFIG_SOUND=m # Advanced Linux Sound Architecture # CONFIG_SND=m +CONFIG_SND_TIMER=m +CONFIG_SND_PCM=m +CONFIG_SND_HWDEP=m +CONFIG_SND_RAWMIDI=m CONFIG_SND_SEQUENCER=m CONFIG_SND_SEQ_DUMMY=m CONFIG_SND_OSSEMUL=y @@ -1717,11 +1798,14 @@ CONFIG_SND_SEQUENCER_OSS=y CONFIG_SND_RTCTIMER=m # CONFIG_SND_VERBOSE_PRINTK is not set # CONFIG_SND_DEBUG is not set -CONFIG_SND_BIT32_EMUL=y # # Generic devices # +CONFIG_SND_MPU401_UART=m +CONFIG_SND_OPL3_LIB=m +CONFIG_SND_OPL4_LIB=m +CONFIG_SND_VX_LIB=m CONFIG_SND_DUMMY=m CONFIG_SND_VIRMIDI=m CONFIG_SND_MTPAV=m @@ -1763,13 +1847,20 @@ CONFIG_SND_SSCAPE=m # # PCI devices # +CONFIG_SND_AC97_CODEC=m CONFIG_SND_ALI5451=m +CONFIG_SND_ATIIXP=m +CONFIG_SND_AU8810=m +CONFIG_SND_AU8820=m +CONFIG_SND_AU8830=m CONFIG_SND_AZT3328=m +CONFIG_SND_BT87X=m CONFIG_SND_CS46XX=m CONFIG_SND_CS46XX_NEW_DSP=y CONFIG_SND_CS4281=m CONFIG_SND_EMU10K1=m CONFIG_SND_KORG1212=m +CONFIG_SND_MIXART=m CONFIG_SND_NM256=m CONFIG_SND_RME32=m CONFIG_SND_RME96=m @@ -1785,22 +1876,14 @@ CONFIG_SND_ES1938=m CONFIG_SND_ES1968=m CONFIG_SND_MAESTRO3=m CONFIG_SND_FM801=m +CONFIG_SND_FM801_TEA575X=m CONFIG_SND_ICE1712=m CONFIG_SND_ICE1724=m CONFIG_SND_INTEL8X0=m +CONFIG_SND_INTEL8X0M=m CONFIG_SND_SONICVIBES=m CONFIG_SND_VIA82XX=m CONFIG_SND_VX222=m -CONFIG_SND_BT87X=m -CONFIG_SND_ATIIXP=m -CONFIG_SND_AU8810=m -CONFIG_SND_AU8820=m -CONFIG_SND_AU8830=m -CONFIG_SND_MIXART=m -CONFIG_SND_FM801_TEA575X=m -CONFIG_SND_INTEL8X0M=m -CONFIG_SND_PDAUDIOCF=m - # # ALSA USB devices @@ -1812,13 +1895,12 @@ CONFIG_SND_USB_AUDIO=m # # CONFIG_SND_VXPOCKET is not set # CONFIG_SND_VXP440 is not set +CONFIG_SND_PDAUDIOCF=m # # Open Sound System # # CONFIG_SOUND_PRIME is not set -# CONFIG_SOUND_BT878 is not set -# CONFIG_SOUND_CMPCI is not set # # USB support @@ -1874,17 +1956,14 @@ CONFIG_HID_PID=y CONFIG_LOGITECH_FF=y CONFIG_THRUSTMASTER_FF=y CONFIG_USB_HIDDEV=y - -# -# USB HID Boot Protocol drivers -# -# CONFIG_USB_KBD is not set -# CONFIG_USB_MOUSE is not set CONFIG_USB_AIPTEK=m CONFIG_USB_WACOM=m CONFIG_USB_KBTAB=m CONFIG_USB_POWERMATE=m +CONFIG_USB_MTOUCH=m +CONFIG_USB_EGALAX=m CONFIG_USB_XPAD=m +CONFIG_USB_ATI_REMOTE=m # # USB Imaging devices @@ -1902,9 +1981,9 @@ CONFIG_USB_DSBR=m CONFIG_USB_IBMCAM=m CONFIG_USB_KONICAWC=m CONFIG_USB_OV511=m -CONFIG_USB_PWC=m CONFIG_USB_SE401=m CONFIG_USB_STV680=m +CONFIG_USB_W9968CF=m # # USB Network adaptors @@ -1918,6 +1997,7 @@ CONFIG_USB_USBNET=m # # USB Host-to-Host Cables # +CONFIG_USB_ALI_M5632=y CONFIG_USB_AN2720=y CONFIG_USB_BELKIN=y CONFIG_USB_GENESYS=y @@ -1979,40 +2059,27 @@ CONFIG_USB_SERIAL_SAFE_PADDED=y CONFIG_USB_SERIAL_CYBERJACK=m CONFIG_USB_SERIAL_XIRCOM=m CONFIG_USB_SERIAL_OMNINET=m -CONFIG_USB_SERIAL_WHITEHEAT=m CONFIG_USB_EZUSB=y -CONFIG_USB_EMI62=m -CONFIG_USB_LED=m -CONFIG_USB_G_SERIAL=m - # # USB Miscellaneous drivers # +CONFIG_USB_EMI62=m # CONFIG_USB_EMI26 is not set CONFIG_USB_TIGL=m CONFIG_USB_AUERSWALD=m CONFIG_USB_RIO500=m -CONFIG_USB_BRLVGER=m -CONFIG_USB_LCD=m -CONFIG_USB_TEST=m -# CONFIG_USB_GADGET is not set -# CONFIG_USB_GADGET_PXA2XX is not set -# CONFIG_USB_GADGET_GOKU is not set -# CONFIG_USB_GADGET_SA1100 is not set -CONFIG_USB_ZERO=m -CONFIG_USB_ETH=m -CONFIG_USB_GADGETFS=m -CONFIG_USB_W9968CF=m CONFIG_USB_LEGOTOWER=m -CONFIG_USB_FILE_STORAGE=m -# CONFIG_USB_FILE_STORAGE_TEST is not set -CONFIG_USB_MTOUCH=m -CONFIG_USB_ATI_REMOTE=m -CONFIG_USB_ALI_M5632=y +CONFIG_USB_LCD=m +CONFIG_USB_LED=m # CONFIG_USB_CYTHERM is not set -CONFIG_USB_EGALAX=m CONFIG_USB_PHIDGETSERVO=m +CONFIG_USB_TEST=m + +# +# USB Gadget Support +# +# CONFIG_USB_GADGET is not set # # File systems @@ -2035,14 +2102,15 @@ CONFIG_REISERFS_FS_XATTR=y CONFIG_REISERFS_FS_POSIX_ACL=y CONFIG_REISERFS_FS_SECURITY=y CONFIG_JFS_FS=m +CONFIG_JFS_POSIX_ACL=y # CONFIG_JFS_DEBUG is not set # CONFIG_JFS_STATISTICS is not set -CONFIG_JFS_POSIX_ACL=y +CONFIG_FS_POSIX_ACL=y CONFIG_XFS_FS=m # CONFIG_XFS_RT is not set CONFIG_XFS_QUOTA=y -CONFIG_XFS_POSIX_ACL=y CONFIG_XFS_SECURITY=y +CONFIG_XFS_POSIX_ACL=y CONFIG_MINIX_FS=m CONFIG_ROMFS_FS=m CONFIG_QUOTA=y @@ -2074,6 +2142,7 @@ CONFIG_VFAT_FS=m # CONFIG_PROC_FS=y CONFIG_PROC_KCORE=y +CONFIG_SYSFS=y # CONFIG_DEVFS_FS is not set CONFIG_DEVPTS_FS_XATTR=y CONFIG_DEVPTS_FS_SECURITY=y @@ -2085,9 +2154,8 @@ CONFIG_RAMFS=y # # Miscellaneous filesystems # -# CONFIG_ADFS_FS is not seta +# CONFIG_ADFS_FS is not set CONFIG_AFFS_FS=m -# uses sleepon and needs a major update CONFIG_HFS_FS=m CONFIG_HFSPLUS_FS=m CONFIG_BEFS_FS=m @@ -2138,9 +2206,7 @@ CONFIG_NCPFS_SMALLDOS=y CONFIG_NCPFS_NLS=y CONFIG_NCPFS_EXTRAS=y # CONFIG_CODA_FS is not set -# CONFIG_INTERMEZZO_FS is not set # CONFIG_AFS_FS is not set -# CONFIG_RXRPC is not set # # Partition Types @@ -2162,11 +2228,11 @@ CONFIG_SGI_PARTITION=y # CONFIG_ULTRIX_PARTITION is not set CONFIG_SUN_PARTITION=y CONFIG_EFI_PARTITION=y -CONFIG_NLS=y # # Native Language Support # +CONFIG_NLS=y CONFIG_NLS_DEFAULT="utf8" CONFIG_NLS_CODEPAGE_437=m CONFIG_NLS_CODEPAGE_737=m @@ -2212,20 +2278,13 @@ CONFIG_NLS_UTF8=m CONFIG_PROFILING=y CONFIG_OPROFILE=m -# -# Tux -# -CONFIG_TUX=m -CONFIG_TUX_EXTCGI=y -# CONFIG_TUX_EXTENDED_LOG is not set -# CONFIG_TUX_DEBUG is not set - - # # Kernel hacking # CONFIG_DEBUG_KERNEL=y +CONFIG_EARLY_PRINTK=y CONFIG_DEBUG_STACKOVERFLOW=y +# CONFIG_DEBUG_STACK_USAGE is not set # CONFIG_DEBUG_SLAB is not set CONFIG_MAGIC_SYSRQ=y # CONFIG_DEBUG_SPINLOCK is not set @@ -2234,10 +2293,8 @@ CONFIG_MAGIC_SYSRQ=y CONFIG_DEBUG_INFO=y CONFIG_DEBUG_SPINLOCK_SLEEP=y # CONFIG_FRAME_POINTER is not set -CONFIG_CC_OPTIMIZE_FOR_SIZE=y -# CONFIG_DEBUG_STACK_USAGE is not set -# CONFIG_DEBUG_DRIVER is not set - +CONFIG_X86_FIND_SMP_CONFIG=y +CONFIG_X86_MPPARSE=y # # Security options @@ -2251,8 +2308,6 @@ CONFIG_SECURITY_SELINUX_BOOTPARAM=y CONFIG_SECURITY_SELINUX_DISABLE=y CONFIG_SECURITY_SELINUX_DEVELOP=y # CONFIG_SECURITY_SELINUX_MLS is not set -# CONFIG_AUDIT is not set -CONFIG_AUDITSYSCALL=y # # Cryptographic options @@ -2261,7 +2316,7 @@ CONFIG_CRYPTO=y CONFIG_CRYPTO_HMAC=y CONFIG_CRYPTO_NULL=m CONFIG_CRYPTO_MD4=m -CONFIG_CRYPTO_MD5=m +CONFIG_CRYPTO_MD5=y CONFIG_CRYPTO_SHA1=m CONFIG_CRYPTO_SHA256=m CONFIG_CRYPTO_SHA512=m @@ -2272,144 +2327,22 @@ CONFIG_CRYPTO_SERPENT=m CONFIG_CRYPTO_AES=m CONFIG_CRYPTO_CAST5=m CONFIG_CRYPTO_CAST6=m -CONFIG_CRYPTO_DEFLATE=m CONFIG_CRYPTO_ARC4=m +CONFIG_CRYPTO_DEFLATE=m CONFIG_CRYPTO_MICHAEL_MIC=m -# CONFIG_CRYPTO_TEST is not set -CONFIG_LIBCRC32C=m CONFIG_CRYPTO_CRC32C=m +# CONFIG_CRYPTO_TEST is not set # # Library routines # -CONFIG_CRC32=m +CONFIG_CRC32=y +CONFIG_LIBCRC32C=m CONFIG_ZLIB_INFLATE=y CONFIG_ZLIB_DEFLATE=m -CONFIG_PC=y -# CONFIG_X86_PC is not set -# CONFIG_X86_ELAN is not set -# CONFIG_X86_VOYAGER is not set -# CONFIG_X86_NUMAQ is not set -# CONFIG_X86_SUMMIT is not set -# CONFIG_X86_BIGSMP is not set -# CONFIG_X86_VISWS is not set -CONFIG_X86_GENERICARCH=y -# CONFIG_X86_ES7000 is not set -# CONFIG_M386 is not set -# CONFIG_M486 is not set -# CONFIG_M586 is not set -# CONFIG_M586TSC is not set -# CONFIG_M586MMX is not set -CONFIG_M686=y -# CONFIG_MPENTIUMII is not set -# CONFIG_MPENTIUMIII is not set -# CONFIG_MPENTIUMM is not set -# CONFIG_MPENTIUM4 is not set -# CONFIG_MK6 is not set -# CONFIG_MK7 is not set -# CONFIG_MK8 is not set -# CONFIG_MCRUSOE is not set -# CONFIG_MWINCHIPC6 is not set -# CONFIG_MWINCHIP2 is not set -# CONFIG_MWINCHIP3D is not set -# CONFIG_MCYRIXIII is not set -# CONFIG_MVIAC3_2 is not set -CONFIG_X86_GENERIC=y -CONFIG_X86_CMPXCHG=y -CONFIG_X86_XADD=y -CONFIG_X86_L1_CACHE_SHIFT=7 -CONFIG_RWSEM_XCHGADD_ALGORITHM=y -CONFIG_X86_PPRO_FENCE=y -CONFIG_X86_WP_WORKS_OK=y -CONFIG_X86_INVLPG=y -CONFIG_X86_BSWAP=y -CONFIG_X86_POPAD_OK=y -CONFIG_X86_GOOD_APIC=y -CONFIG_X86_INTEL_USERCOPY=y -CONFIG_X86_USE_PPRO_CHECKSUM=y -CONFIG_HPET_TIMER=y -CONFIG_HPET_EMULATE_RTC=y -CONFIG_NR_CPUS=32 -CONFIG_X86_LOCAL_APIC=y -CONFIG_X86_IO_APIC=y -CONFIG_X86_TSC=y -CONFIG_X86_MCE=y -# CONFIG_X86_MCE_NONFATAL is not set -CONFIG_X86_MCE_P4THERMAL=y -CONFIG_TOSHIBA=m -CONFIG_I8K=m -CONFIG_SONYPI=m -CONFIG_MICROCODE=m -CONFIG_X86_MSR=m -CONFIG_X86_CPUID=m -CONFIG_EDD=m -# CONFIG_NOHIGHMEM is not set -CONFIG_HIGHMEM4G=y -CONFIG_HIGHMEM64G=y -# CONFIG_HIGHMEM64G is not set -CONFIG_HIGHMEM=y -CONFIG_HIGHPTE=y -# CONFIG_MATH_EMULATION is not set -CONFIG_MTRR=y -CONFIG_HAVE_DEC_LOCK=y -# CONFIG_X86_UP_APIC is not set -CONFIG_X86_PM_TIMER=y -CONFIG_X86_4G=y -# CONFIG_EFI is not set -CONFIG_REGPARM=y -# CONFIG_PCI_GOBIOS is not set -# CONFIG_PCI_GODIRECT is not set -CONFIG_PCI_GOANY=y -CONFIG_MDA_CONSOLE=m -CONFIG_SYNCLINK_CS=m -CONFIG_SYNCLINK=m -CONFIG_SYNCLINKMP=m -CONFIG_HP100=m -CONFIG_PCMCIA_FDOMAIN=m -CONFIG_SCSI_FUTURE_DOMAIN=m -CONFIG_CRASH=m -CONFIG_I2O=m -CONFIG_APM=y -# CONFIG_APM_IGNORE_USER_SUSPEND is not set -# CONFIG_APM_DO_ENABLE is not set -CONFIG_APM_CPU_IDLE=y -# CONFIG_APM_DISPLAY_BLANK is not set -CONFIG_APM_RTC_IS_GMT=y -# CONFIG_APM_ALLOW_INTS is not set -# CONFIG_APM_REAL_MODE_POWER_OFF is not set -CONFIG_X86_FIND_SMP_CONFIG=y -CONFIG_X86_MPPARSE=y -CONFIG_4KSTACKS=y -CONFIG_X86_ACPI_CPUFREQ=m -# CONFIG_X86_ACPI_CPUFREQ_PROC_INTF is not set -CONFIG_X86_POWERNOW_K6=m -CONFIG_X86_POWERNOW_K7=y -CONFIG_X86_POWERNOW_K8=m -# CONFIG_X86_GX_SUSPMOD is not set -CONFIG_X86_SPEEDSTEP_CENTRINO=y -CONFIG_X86_SPEEDSTEP_ICH=y -CONFIG_X86_SPEEDSTEP_SMI=m -CONFIG_X86_SPEEDSTEP_LIB=y -CONFIG_X86_SPEEDSTEP_CENTRINO_ACPI=y -# CONFIG_X86_SPEEDSTEP_RELAXED_CAP_CHECK is not set -CONFIG_X86_P4_CLOCKMOD=m -CONFIG_X86_LONGRUN=y -# CONFIG_X86_LONGHAUL is not set CONFIG_X86_SMP=y CONFIG_X86_HT=y CONFIG_X86_BIOS_REBOOT=y CONFIG_X86_TRAMPOLINE=y -CONFIG_TUX=m -CONFIG_NVRAM=m -CONFIG_IBM_ASM=m -CONFIG_M686=y -# CONFIG_NOHIGHMEM is not set -CONFIG_HIGHMEM64G=y -CONFIG_HOTPLUG_PCI=y -CONFIG_HOTPLUG_PCI_COMPAQ=m -CONFIG_HOTPLUG_PCI_IBM=m -# CONFIG_HIGHMEM64G is not set -# CONFIG_EWRK3 is not set -CONFIG_NR_CPUS=32 -# CONFIG_X86_PC is not set -CONFIG_X86_GENERICARCH=y +CONFIG_X86_STD_RESOURCES=y +CONFIG_PC=y diff --git a/Makefile b/Makefile index a4cf56f43..8024701c4 100644 --- a/Makefile +++ b/Makefile @@ -1,7 +1,7 @@ VERSION = 2 PATCHLEVEL = 6 SUBLEVEL = 6 -EXTRAVERSION = -prep +EXTRAVERSION = -1.406-vs1.9.0 NAME=Zonked Quokka # *DOCUMENTATION* diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig index e1f20ca1c..d770bb867 100644 --- a/arch/alpha/Kconfig +++ b/arch/alpha/Kconfig @@ -692,6 +692,8 @@ config DEBUG_INFO endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c index aa654cc85..5d9aae6be 100644 --- a/arch/alpha/kernel/ptrace.c +++ b/arch/alpha/kernel/ptrace.c @@ -287,6 +287,8 @@ do_sys_ptrace(long request, long pid, long addr, long data, read_unlock(&tasklist_lock); if (!child) goto out_notsk; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out; if (request == PTRACE_ATTACH) { ret = ptrace_attach(child); diff --git a/arch/alpha/kernel/systbls.S b/arch/alpha/kernel/systbls.S index bf9b31357..57052d8a3 100644 --- a/arch/alpha/kernel/systbls.S +++ b/arch/alpha/kernel/systbls.S @@ -299,7 +299,7 @@ sys_call_table: .quad alpha_ni_syscall /* 270 */ .quad alpha_ni_syscall .quad alpha_ni_syscall - .quad alpha_ni_syscall + .quad sys_vserver /* 273 sys_vserver */ .quad alpha_ni_syscall .quad alpha_ni_syscall /* 275 */ .quad alpha_ni_syscall diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig index 03b9d5bc6..db1feb1b3 100644 --- a/arch/arm/Kconfig +++ b/arch/arm/Kconfig @@ -808,6 +808,8 @@ config DEBUG_S3C2410_UART endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c index fd3d5b2ba..4bcf7f6a4 100644 --- a/arch/arm/kernel/ptrace.c +++ b/arch/arm/kernel/ptrace.c @@ -754,6 +754,8 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/arm26/Kconfig b/arch/arm26/Kconfig index ce96fd34b..b40758b9f 100644 --- a/arch/arm26/Kconfig +++ b/arch/arm26/Kconfig @@ -327,6 +327,8 @@ config DEBUG_LL endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/arm26/kernel/ptrace.c b/arch/arm26/kernel/ptrace.c index 57b9fb1e2..78cd8931d 100644 --- a/arch/arm26/kernel/ptrace.c +++ b/arch/arm26/kernel/ptrace.c @@ -691,6 +691,8 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/cris/Kconfig b/arch/cris/Kconfig index 86a05dbff..9b0b719bf 100644 --- a/arch/cris/Kconfig +++ b/arch/cris/Kconfig @@ -214,6 +214,8 @@ config PROFILE_SHIFT endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/h8300/Kconfig b/arch/h8300/Kconfig index 072192a4f..093f3e64c 100644 --- a/arch/h8300/Kconfig +++ b/arch/h8300/Kconfig @@ -253,6 +253,8 @@ config CONFIG_BLKDEV_RESERVE_ADDRESS BLKDEV start address. endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/h8300/kernel/ptrace.c b/arch/h8300/kernel/ptrace.c index 0843013d1..cdbfe9e5c 100644 --- a/arch/h8300/kernel/ptrace.c +++ b/arch/h8300/kernel/ptrace.c @@ -80,6 +80,8 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/i386/Kconfig b/arch/i386/Kconfig index c46596c97..75ee13720 100644 --- a/arch/i386/Kconfig +++ b/arch/i386/Kconfig @@ -1345,6 +1345,8 @@ config X86_MPPARSE endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/i386/kernel/entry.S b/arch/i386/kernel/entry.S index b3ad2d0a3..bb91de327 100644 --- a/arch/i386/kernel/entry.S +++ b/arch/i386/kernel/entry.S @@ -1019,7 +1019,7 @@ ENTRY(sys_call_table) .long sys_tgkill /* 270 */ .long sys_utimes .long sys_fadvise64_64 - .long sys_ni_syscall /* sys_vserver */ + .long sys_vserver .long sys_mbind .long sys_get_mempolicy .long sys_set_mempolicy diff --git a/arch/i386/kernel/ptrace.c b/arch/i386/kernel/ptrace.c index 0cf2f1187..6f3a62694 100644 --- a/arch/i386/kernel/ptrace.c +++ b/arch/i386/kernel/ptrace.c @@ -259,6 +259,8 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/i386/kernel/sys_i386.c b/arch/i386/kernel/sys_i386.c index 0c36130af..fc8001a81 100644 --- a/arch/i386/kernel/sys_i386.c +++ b/arch/i386/kernel/sys_i386.c @@ -217,7 +217,7 @@ asmlinkage int sys_uname(struct old_utsname __user * name) if (!name) return -EFAULT; down_read(&uts_sem); - err=copy_to_user(name, &system_utsname, sizeof (*name)); + err=copy_to_user(name, vx_new_utsname(), sizeof (*name)); up_read(&uts_sem); return err?-EFAULT:0; } @@ -225,6 +225,7 @@ asmlinkage int sys_uname(struct old_utsname __user * name) asmlinkage int sys_olduname(struct oldold_utsname __user * name) { int error; + struct new_utsname *ptr; if (!name) return -EFAULT; @@ -233,15 +234,16 @@ asmlinkage int sys_olduname(struct oldold_utsname __user * name) down_read(&uts_sem); - error = __copy_to_user(&name->sysname,&system_utsname.sysname,__OLD_UTS_LEN); + ptr = vx_new_utsname(); + error = __copy_to_user(&name->sysname,ptr->sysname,__OLD_UTS_LEN); error |= __put_user(0,name->sysname+__OLD_UTS_LEN); - error |= __copy_to_user(&name->nodename,&system_utsname.nodename,__OLD_UTS_LEN); + error |= __copy_to_user(&name->nodename,ptr->nodename,__OLD_UTS_LEN); error |= __put_user(0,name->nodename+__OLD_UTS_LEN); - error |= __copy_to_user(&name->release,&system_utsname.release,__OLD_UTS_LEN); + error |= __copy_to_user(&name->release,ptr->release,__OLD_UTS_LEN); error |= __put_user(0,name->release+__OLD_UTS_LEN); - error |= __copy_to_user(&name->version,&system_utsname.version,__OLD_UTS_LEN); + error |= __copy_to_user(&name->version,ptr->version,__OLD_UTS_LEN); error |= __put_user(0,name->version+__OLD_UTS_LEN); - error |= __copy_to_user(&name->machine,&system_utsname.machine,__OLD_UTS_LEN); + error |= __copy_to_user(&name->machine,ptr->machine,__OLD_UTS_LEN); error |= __put_user(0,name->machine+__OLD_UTS_LEN); up_read(&uts_sem); diff --git a/arch/i386/mm/hugetlbpage.c b/arch/i386/mm/hugetlbpage.c index 0397fe963..a8dbbc57b 100644 --- a/arch/i386/mm/hugetlbpage.c +++ b/arch/i386/mm/hugetlbpage.c @@ -43,7 +43,8 @@ static void set_huge_pte(struct mm_struct *mm, struct vm_area_struct *vma, struc { pte_t entry; - mm->rss += (HPAGE_SIZE / PAGE_SIZE); + // mm->rss += (HPAGE_SIZE / PAGE_SIZE); + vx_rsspages_add(mm, HPAGE_SIZE / PAGE_SIZE); if (write_access) { entry = pte_mkwrite(pte_mkdirty(mk_pte(page, vma->vm_page_prot))); @@ -83,7 +84,8 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, ptepage = pte_page(entry); get_page(ptepage); set_pte(dst_pte, entry); - dst->rss += (HPAGE_SIZE / PAGE_SIZE); + // dst->rss += (HPAGE_SIZE / PAGE_SIZE); + vx_rsspages_add(dst, HPAGE_SIZE / PAGE_SIZE); addr += HPAGE_SIZE; } return 0; @@ -222,7 +224,8 @@ void unmap_hugepage_range(struct vm_area_struct *vma, page = pte_page(pte); put_page(page); } - mm->rss -= (end - start) >> PAGE_SHIFT; + // mm->rss -= (end - start) >> PAGE_SHIFT; + vx_rsspages_sub(mm, (end - start) >> PAGE_SHIFT); flush_tlb_range(vma, start, end); } diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig index b856ffae3..d51c192d0 100644 --- a/arch/ia64/Kconfig +++ b/arch/ia64/Kconfig @@ -497,6 +497,8 @@ config SYSVIPC_COMPAT default y endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/ia64/ia32/binfmt_elf32.c b/arch/ia64/ia32/binfmt_elf32.c index 30f2b84c3..1613474b1 100644 --- a/arch/ia64/ia32/binfmt_elf32.c +++ b/arch/ia64/ia32/binfmt_elf32.c @@ -146,7 +146,7 @@ ia64_elf32_init (struct pt_regs *regs) int ia32_setup_arg_pages (struct linux_binprm *bprm, int executable_stack) { - unsigned long stack_base; + unsigned long stack_base, grow; struct vm_area_struct *mpnt; struct mm_struct *mm = current->mm; int i; @@ -163,7 +163,10 @@ ia32_setup_arg_pages (struct linux_binprm *bprm, int executable_stack) if (!mpnt) return -ENOMEM; - if (security_vm_enough_memory((IA32_STACK_TOP - (PAGE_MASK & (unsigned long) bprm->p))>>PAGE_SHIFT)) { + grow = (IA32_STACK_TOP - (PAGE_MASK & (unsigned long) bprm->p)) + >> PAGE_SHIFT; + if (security_vm_enough_memory(grow) || + !vx_vmpages_avail(mm, grow)) { kmem_cache_free(vm_area_cachep, mpnt); return -ENOMEM; } @@ -184,7 +187,9 @@ ia32_setup_arg_pages (struct linux_binprm *bprm, int executable_stack) mpnt->vm_page_prot = (mpnt->vm_flags & VM_EXEC)? PAGE_COPY_EXEC: PAGE_COPY; insert_vm_struct(current->mm, mpnt); - current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; + // current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; + vx_vmpages_sub(current->mm, current->mm->total_vm - + ((mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT)); } for (i = 0 ; i < MAX_ARG_PAGES ; i++) { diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c index c46ba04e6..df9539ab8 100644 --- a/arch/ia64/kernel/perfmon.c +++ b/arch/ia64/kernel/perfmon.c @@ -2361,7 +2361,8 @@ pfm_smpl_buffer_alloc(struct task_struct *task, pfm_context_t *ctx, unsigned lon */ insert_vm_struct(mm, vma); - mm->total_vm += size >> PAGE_SHIFT; + // mm->total_vm += size >> PAGE_SHIFT; + vx_vmpages_add(mm, size >> PAGE_SHIFT); up_write(&task->mm->mmap_sem); diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c index 0432abe56..eace1b77c 100644 --- a/arch/ia64/kernel/ptrace.c +++ b/arch/ia64/kernel/ptrace.c @@ -1310,6 +1310,9 @@ sys_ptrace (long request, pid_t pid, unsigned long addr, unsigned long data, read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; + ret = -EPERM; if (pid == 1) /* no messing around with init! */ goto out_tsk; diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c index d823ff897..20d11f4d5 100644 --- a/arch/ia64/mm/fault.c +++ b/arch/ia64/mm/fault.c @@ -36,10 +36,14 @@ expand_backing_store (struct vm_area_struct *vma, unsigned long address) if (address - vma->vm_start > current->rlim[RLIMIT_STACK].rlim_cur || (((vma->vm_mm->total_vm + grow) << PAGE_SHIFT) > current->rlim[RLIMIT_AS].rlim_cur)) return -ENOMEM; + if (!vx_vmpages_avail(vma->vm_mm, grow) + return -ENOMEM; vma->vm_end += PAGE_SIZE; - vma->vm_mm->total_vm += grow; + // vma->vm_mm->total_vm += grow; + vx_vmpages_add(vma->vm_mm, grow); if (vma->vm_flags & VM_LOCKED) - vma->vm_mm->locked_vm += grow; + // vma->vm_mm->locked_vm += grow; + vx_vmlocked_add(vma->vm_mm, grow); return 0; } diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c index 56e409ec6..c72435812 100644 --- a/arch/ia64/mm/hugetlbpage.c +++ b/arch/ia64/mm/hugetlbpage.c @@ -65,7 +65,8 @@ set_huge_pte (struct mm_struct *mm, struct vm_area_struct *vma, { pte_t entry; - mm->rss += (HPAGE_SIZE / PAGE_SIZE); + // mm->rss += (HPAGE_SIZE / PAGE_SIZE); + vx_rsspages_add(mm, HPAGE_SIZE / PAGE_SIZE); if (write_access) { entry = pte_mkwrite(pte_mkdirty(mk_pte(page, vma->vm_page_prot))); @@ -108,7 +109,8 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, ptepage = pte_page(entry); get_page(ptepage); set_pte(dst_pte, entry); - dst->rss += (HPAGE_SIZE / PAGE_SIZE); + // dst->rss += (HPAGE_SIZE / PAGE_SIZE); + vx_rsspages_add(dst, HPAGE_SIZE / PAGE_SIZE); addr += HPAGE_SIZE; } return 0; @@ -251,7 +253,8 @@ void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start, unsig put_page(page); pte_clear(pte); } - mm->rss -= (end - start) >> PAGE_SHIFT; + // mm->rss -= (end - start) >> PAGE_SHIFT; + vx_rsspages_sub(mm, (end - start) >> PAGE_SHIFT); flush_tlb_range(vma, start, end); } diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig index 1fa88d5f3..35ea6886f 100644 --- a/arch/m68k/Kconfig +++ b/arch/m68k/Kconfig @@ -690,6 +690,8 @@ config DEBUG_INFO endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/m68k/atari/stram.c b/arch/m68k/atari/stram.c index b03d03163..65b1b9c7e 100644 --- a/arch/m68k/atari/stram.c +++ b/arch/m68k/atari/stram.c @@ -635,7 +635,8 @@ static inline void unswap_pte(struct vm_area_struct * vma, unsigned long set_pte(dir, pte_mkdirty(mk_pte(page, vma->vm_page_prot))); swap_free(entry); get_page(page); - ++vma->vm_mm->rss; + // ++vma->vm_mm->rss; + vx_rsspages_inc(vma->vm_mm); } static inline void unswap_pmd(struct vm_area_struct * vma, pmd_t *dir, diff --git a/arch/m68k/kernel/ptrace.c b/arch/m68k/kernel/ptrace.c index 12e4acdfd..0f0b28d34 100644 --- a/arch/m68k/kernel/ptrace.c +++ b/arch/m68k/kernel/ptrace.c @@ -140,6 +140,8 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/m68knommu/Kconfig b/arch/m68knommu/Kconfig index f11317725..b8f71e760 100644 --- a/arch/m68knommu/Kconfig +++ b/arch/m68knommu/Kconfig @@ -566,6 +566,8 @@ config BDM_DISABLE endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/m68knommu/kernel/ptrace.c b/arch/m68knommu/kernel/ptrace.c index 4f3df6d67..0c57f873a 100644 --- a/arch/m68knommu/kernel/ptrace.c +++ b/arch/m68knommu/kernel/ptrace.c @@ -124,6 +124,8 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig index 920bec861..8d6d86c07 100644 --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig @@ -1646,6 +1646,8 @@ config DEBUG_HIGHMEM endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/mips/kernel/irixelf.c b/arch/mips/kernel/irixelf.c index dc9f7924e..0bcfb5ab6 100644 --- a/arch/mips/kernel/irixelf.c +++ b/arch/mips/kernel/irixelf.c @@ -686,7 +686,8 @@ static int load_irix_binary(struct linux_binprm * bprm, struct pt_regs * regs) /* Do this so that we can load the interpreter, if need be. We will * change some of these later. */ - current->mm->rss = 0; + // current->mm->rss = 0; + vx_rsspages_sub(current->mm, current->mm->rss); setup_arg_pages(bprm, EXSTACK_DEFAULT); current->mm->start_stack = bprm->p; diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c index bcb3e0c5a..836474423 100644 --- a/arch/mips/kernel/linux32.c +++ b/arch/mips/kernel/linux32.c @@ -1201,7 +1201,7 @@ asmlinkage long sys32_newuname(struct new_utsname * name) int ret = 0; down_read(&uts_sem); - if (copy_to_user(name,&system_utsname,sizeof *name)) + if (copy_to_user(name, vx_new_utsname(), sizeof *name)) ret = -EFAULT; up_read(&uts_sem); diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c index 6e8511390..db86febff 100644 --- a/arch/mips/kernel/ptrace.c +++ b/arch/mips/kernel/ptrace.c @@ -76,6 +76,8 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c index 7e1eca973..5785d06bc 100644 --- a/arch/mips/kernel/syscall.c +++ b/arch/mips/kernel/syscall.c @@ -209,7 +209,7 @@ out: */ asmlinkage int sys_uname(struct old_utsname * name) { - if (name && !copy_to_user(name, &system_utsname, sizeof (*name))) + if (name && !copy_to_user(name, vx_new_utsname(), sizeof (*name))) return 0; return -EFAULT; } @@ -220,21 +220,23 @@ asmlinkage int sys_uname(struct old_utsname * name) asmlinkage int sys_olduname(struct oldold_utsname * name) { int error; + struct new_utsname *ptr; if (!name) return -EFAULT; if (!access_ok(VERIFY_WRITE,name,sizeof(struct oldold_utsname))) return -EFAULT; - error = __copy_to_user(&name->sysname,&system_utsname.sysname,__OLD_UTS_LEN); + ptr = vx_new_utsname(); + error = __copy_to_user(&name->sysname,ptr->sysname,__OLD_UTS_LEN); error -= __put_user(0,name->sysname+__OLD_UTS_LEN); - error -= __copy_to_user(&name->nodename,&system_utsname.nodename,__OLD_UTS_LEN); + error -= __copy_to_user(&name->nodename,ptr->nodename,__OLD_UTS_LEN); error -= __put_user(0,name->nodename+__OLD_UTS_LEN); - error -= __copy_to_user(&name->release,&system_utsname.release,__OLD_UTS_LEN); + error -= __copy_to_user(&name->release,ptr->release,__OLD_UTS_LEN); error -= __put_user(0,name->release+__OLD_UTS_LEN); - error -= __copy_to_user(&name->version,&system_utsname.version,__OLD_UTS_LEN); + error -= __copy_to_user(&name->version,ptr->version,__OLD_UTS_LEN); error -= __put_user(0,name->version+__OLD_UTS_LEN); - error -= __copy_to_user(&name->machine,&system_utsname.machine,__OLD_UTS_LEN); + error -= __copy_to_user(&name->machine,ptr->machine,__OLD_UTS_LEN); error = __put_user(0,name->machine+__OLD_UTS_LEN); error = error ? -EFAULT : 0; @@ -260,10 +262,10 @@ asmlinkage int _sys_sysmips(int cmd, long arg1, int arg2, int arg3) return -EFAULT; down_write(&uts_sem); - strncpy(system_utsname.nodename, nodename, len); + strncpy(vx_new_uts(nodename), nodename, len); nodename[__NEW_UTS_LEN] = '\0'; - strlcpy(system_utsname.nodename, nodename, - sizeof(system_utsname.nodename)); + strlcpy(vx_new_uts(nodename), nodename, + sizeof(vx_new_uts(nodename))); up_write(&uts_sem); return 0; } diff --git a/arch/mips/kernel/sysirix.c b/arch/mips/kernel/sysirix.c index 25d7e97ed..3e0cf6e41 100644 --- a/arch/mips/kernel/sysirix.c +++ b/arch/mips/kernel/sysirix.c @@ -577,7 +577,8 @@ asmlinkage int irix_brk(unsigned long brk) /* * Check if we have enough memory.. */ - if (security_vm_enough_memory((newbrk-oldbrk) >> PAGE_SHIFT)) { + if (security_vm_enough_memory((newbrk-oldbrk) >> PAGE_SHIFT) || + !vx_vmpages_avail(mm, (newbrk-oldbrk) >> PAGE_SHIFT)) { ret = -ENOMEM; goto out; } diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig index ccd63a41f..4f195174a 100644 --- a/arch/parisc/Kconfig +++ b/arch/parisc/Kconfig @@ -223,6 +223,8 @@ config DEBUG_INFO endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c index 514e8b5f8..d45980cb5 100644 --- a/arch/parisc/kernel/ptrace.c +++ b/arch/parisc/kernel/ptrace.c @@ -110,6 +110,9 @@ long sys_ptrace(long request, pid_t pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; + ret = -EPERM; if (pid == 1) /* no messing around with init! */ goto out_tsk; diff --git a/arch/parisc/kernel/sys_parisc32.c b/arch/parisc/kernel/sys_parisc32.c index 6b5649a69..cd320b20c 100644 --- a/arch/parisc/kernel/sys_parisc32.c +++ b/arch/parisc/kernel/sys_parisc32.c @@ -676,6 +676,7 @@ asmlinkage int sys32_sysinfo(struct sysinfo32 *info) do { seq = read_seqbegin(&xtime_lock); + /* requires vx virtualization */ val.uptime = jiffies / HZ; val.loads[0] = avenrun[0] << (SI_LOAD_SHIFT - FSHIFT); diff --git a/arch/ppc/Kconfig b/arch/ppc/Kconfig index faeb15e37..d5b49d26b 100644 --- a/arch/ppc/Kconfig +++ b/arch/ppc/Kconfig @@ -1269,6 +1269,8 @@ config PPC_OCP endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/ppc/kernel/misc.S b/arch/ppc/kernel/misc.S index c3ed5ed1d..bd006ca95 100644 --- a/arch/ppc/kernel/misc.S +++ b/arch/ppc/kernel/misc.S @@ -1386,7 +1386,7 @@ _GLOBAL(sys_call_table) .long ppc_fadvise64_64 .long sys_ni_syscall /* 255 - rtas (used on ppc64) */ .long sys_ni_syscall /* 256 reserved for sys_debug_setcontext */ - .long sys_ni_syscall /* 257 reserved for vserver */ + .long sys_vserver .long sys_ni_syscall /* 258 reserved for new sys_remap_file_pages */ .long sys_ni_syscall /* 259 reserved for new sys_mbind */ .long sys_ni_syscall /* 260 reserved for new sys_get_mempolicy */ diff --git a/arch/ppc/kernel/ptrace.c b/arch/ppc/kernel/ptrace.c index 2ddfb1a37..f9120785b 100644 --- a/arch/ppc/kernel/ptrace.c +++ b/arch/ppc/kernel/ptrace.c @@ -197,6 +197,8 @@ int sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/ppc/kernel/syscalls.c b/arch/ppc/kernel/syscalls.c index 7f2531d12..d33e63520 100644 --- a/arch/ppc/kernel/syscalls.c +++ b/arch/ppc/kernel/syscalls.c @@ -229,7 +229,7 @@ int sys_uname(struct old_utsname __user * name) int err = -EFAULT; down_read(&uts_sem); - if (name && !copy_to_user(name, &system_utsname, sizeof (*name))) + if (name && !copy_to_user(name, vx_new_utsname(), sizeof (*name))) err = 0; up_read(&uts_sem); return err; @@ -238,6 +238,7 @@ int sys_uname(struct old_utsname __user * name) int sys_olduname(struct oldold_utsname __user * name) { int error; + struct new_utsname *ptr; if (!name) return -EFAULT; @@ -245,15 +246,16 @@ int sys_olduname(struct oldold_utsname __user * name) return -EFAULT; down_read(&uts_sem); - error = __copy_to_user(&name->sysname,&system_utsname.sysname,__OLD_UTS_LEN); + ptr = vx_new_utsname(); + error = __copy_to_user(&name->sysname,ptr->sysname,__OLD_UTS_LEN); error -= __put_user(0,name->sysname+__OLD_UTS_LEN); - error -= __copy_to_user(&name->nodename,&system_utsname.nodename,__OLD_UTS_LEN); + error -= __copy_to_user(&name->nodename,ptr->nodename,__OLD_UTS_LEN); error -= __put_user(0,name->nodename+__OLD_UTS_LEN); - error -= __copy_to_user(&name->release,&system_utsname.release,__OLD_UTS_LEN); + error -= __copy_to_user(&name->release,ptr->release,__OLD_UTS_LEN); error -= __put_user(0,name->release+__OLD_UTS_LEN); - error -= __copy_to_user(&name->version,&system_utsname.version,__OLD_UTS_LEN); + error -= __copy_to_user(&name->version,ptr->version,__OLD_UTS_LEN); error -= __put_user(0,name->version+__OLD_UTS_LEN); - error -= __copy_to_user(&name->machine,&system_utsname.machine,__OLD_UTS_LEN); + error -= __copy_to_user(&name->machine,ptr->machine,__OLD_UTS_LEN); error = __put_user(0,name->machine+__OLD_UTS_LEN); up_read(&uts_sem); diff --git a/arch/ppc64/Kconfig b/arch/ppc64/Kconfig index f0a6ef197..8d5e077fd 100644 --- a/arch/ppc64/Kconfig +++ b/arch/ppc64/Kconfig @@ -437,6 +437,8 @@ config SPINLINE If in doubt, say N. +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/ppc64/kernel/misc.S b/arch/ppc64/kernel/misc.S index 3cdd1a097..5a6064a2d 100644 --- a/arch/ppc64/kernel/misc.S +++ b/arch/ppc64/kernel/misc.S @@ -871,7 +871,7 @@ _GLOBAL(sys_call_table32) .llong .ppc32_fadvise64_64 /* 32bit only fadvise64_64 */ .llong .ppc_rtas /* 255 */ .llong .sys_ni_syscall /* 256 reserved for sys_debug_setcontext */ - .llong .sys_ni_syscall /* 257 reserved for vserver */ + .llong .sys_vserver .llong .sys_ni_syscall /* 258 reserved for new sys_remap_file_pages */ .llong .sys_ni_syscall /* 259 reserved for new sys_mbind */ .llong .sys_ni_syscall /* 260 reserved for new sys_get_mempolicy */ diff --git a/arch/ppc64/kernel/ptrace.c b/arch/ppc64/kernel/ptrace.c index efc9dbd3b..5ff2b1c90 100644 --- a/arch/ppc64/kernel/ptrace.c +++ b/arch/ppc64/kernel/ptrace.c @@ -76,6 +76,8 @@ int sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/ppc64/kernel/sys_ppc32.c b/arch/ppc64/kernel/sys_ppc32.c index ca8014224..ddd1cb7c6 100644 --- a/arch/ppc64/kernel/sys_ppc32.c +++ b/arch/ppc64/kernel/sys_ppc32.c @@ -1158,6 +1158,7 @@ asmlinkage long sys32_time(compat_time_t __user * tloc) asmlinkage int sys32_olduname(struct oldold_utsname __user * name) { int error; + struct new_utsname *ptr; if (!name) return -EFAULT; @@ -1165,15 +1166,16 @@ asmlinkage int sys32_olduname(struct oldold_utsname __user * name) return -EFAULT; down_read(&uts_sem); - error = __copy_to_user(&name->sysname,&system_utsname.sysname,__OLD_UTS_LEN); + ptr = vx_new_utsname(); + error = __copy_to_user(&name->sysname,ptr->sysname,__OLD_UTS_LEN); error -= __put_user(0,name->sysname+__OLD_UTS_LEN); - error -= __copy_to_user(&name->nodename,&system_utsname.nodename,__OLD_UTS_LEN); + error -= __copy_to_user(&name->nodename,ptr->nodename,__OLD_UTS_LEN); error -= __put_user(0,name->nodename+__OLD_UTS_LEN); - error -= __copy_to_user(&name->release,&system_utsname.release,__OLD_UTS_LEN); + error -= __copy_to_user(&name->release,ptr->release,__OLD_UTS_LEN); error -= __put_user(0,name->release+__OLD_UTS_LEN); - error -= __copy_to_user(&name->version,&system_utsname.version,__OLD_UTS_LEN); + error -= __copy_to_user(&name->version,ptr->version,__OLD_UTS_LEN); error -= __put_user(0,name->version+__OLD_UTS_LEN); - error -= __copy_to_user(&name->machine,&system_utsname.machine,__OLD_UTS_LEN); + error -= __copy_to_user(&name->machine,ptr->machine,__OLD_UTS_LEN); error = __put_user(0,name->machine+__OLD_UTS_LEN); up_read(&uts_sem); diff --git a/arch/ppc64/mm/hugetlbpage.c b/arch/ppc64/mm/hugetlbpage.c index d660b0d28..9416e53df 100644 --- a/arch/ppc64/mm/hugetlbpage.c +++ b/arch/ppc64/mm/hugetlbpage.c @@ -125,7 +125,8 @@ static void setup_huge_pte(struct mm_struct *mm, struct page *page, hugepte_t entry; int i; - mm->rss += (HPAGE_SIZE / PAGE_SIZE); + // mm->rss += (HPAGE_SIZE / PAGE_SIZE); + vx_rsspages_sub(mm, HPAGE_SIZE / PAGE_SIZE); entry = mk_hugepte(page, write_access); for (i = 0; i < HUGEPTE_BATCH_SIZE; i++) set_hugepte(ptep+i, entry); @@ -287,7 +288,8 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, /* This is the first hugepte in a batch */ ptepage = hugepte_page(entry); get_page(ptepage); - dst->rss += (HPAGE_SIZE / PAGE_SIZE); + // dst->rss += (HPAGE_SIZE / PAGE_SIZE); + vx_rsspages_add(dst, HPAGE_SIZE / PAGE_SIZE); } set_hugepte(dst_pte, entry); @@ -407,7 +409,8 @@ void unmap_hugepage_range(struct vm_area_struct *vma, put_page(page); } - mm->rss -= (end - start) >> PAGE_SHIFT; + // mm->rss -= (end - start) >> PAGE_SHIFT; + vx_rsspages_sub(mm, (end - start) >> PAGE_SHIFT); } int hugetlb_prefault(struct address_space *mapping, struct vm_area_struct *vma) diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig index eab5d1e96..c0b72b438 100644 --- a/arch/s390/Kconfig +++ b/arch/s390/Kconfig @@ -425,6 +425,8 @@ config DEBUG_SPINLOCK_SLEEP endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/s390/kernel/compat_exec.c b/arch/s390/kernel/compat_exec.c index 595c43a89..3e781bd77 100644 --- a/arch/s390/kernel/compat_exec.c +++ b/arch/s390/kernel/compat_exec.c @@ -36,7 +36,7 @@ int setup_arg_pages32(struct linux_binprm *bprm, int executable_stack) { - unsigned long stack_base; + unsigned long stack_base, grow; struct vm_area_struct *mpnt; struct mm_struct *mm = current->mm; int i; @@ -53,7 +53,10 @@ int setup_arg_pages32(struct linux_binprm *bprm, int executable_stack) if (!mpnt) return -ENOMEM; - if (security_vm_enough_memory((STACK_TOP - (PAGE_MASK & (unsigned long) bprm->p))>>PAGE_SHIFT)) { + grow = (STACK_TOP - (PAGE_MASK & (unsigned long) bprm->p)) + >> PAGE_SHIFT; + if (security_vm_enough_memory(grow) || + !vx_vmpages_avail(mm, grow)) { kmem_cache_free(vm_area_cachep, mpnt); return -ENOMEM; } @@ -69,7 +72,9 @@ int setup_arg_pages32(struct linux_binprm *bprm, int executable_stack) mpnt->vm_page_prot = PAGE_COPY; mpnt->vm_flags = VM_STACK_FLAGS; insert_vm_struct(mm, mpnt); - mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; + // mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; + vx_vmpages_sub(mm, mm->total_vm - + ((mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT)); } for (i = 0 ; i < MAX_ARG_PAGES ; i++) { diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c index 1176b4f5b..fa7875fba 100644 --- a/arch/s390/kernel/ptrace.c +++ b/arch/s390/kernel/ptrace.c @@ -680,9 +680,11 @@ sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = do_ptrace(child, request, addr, data); - +out_tsk: put_task_struct(child); out: unlock_kernel(); diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S index 9186fe765..d17ba7b7c 100644 --- a/arch/s390/kernel/syscalls.S +++ b/arch/s390/kernel/syscalls.S @@ -271,7 +271,7 @@ SYSCALL(sys_clock_settime,sys_clock_settime,sys32_clock_settime_wrapper) SYSCALL(sys_clock_gettime,sys_clock_gettime,sys32_clock_gettime_wrapper) /* 260 */ SYSCALL(sys_clock_getres,sys_clock_getres,sys32_clock_getres_wrapper) SYSCALL(sys_clock_nanosleep,sys_clock_nanosleep,sys32_clock_nanosleep_wrapper) -NI_SYSCALL /* reserved for vserver */ +SYSCALL(sys_vserver,sys_vserver,sys_vserver) SYSCALL(s390_fadvise64_64,sys_ni_syscall,sys32_fadvise64_64_wrapper) SYSCALL(sys_statfs64,sys_statfs64,compat_sys_statfs64_wrapper) SYSCALL(sys_fstatfs64,sys_fstatfs64,compat_sys_fstatfs64_wrapper) diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig index 8efb8e02a..e774424d6 100644 --- a/arch/sh/Kconfig +++ b/arch/sh/Kconfig @@ -792,6 +792,8 @@ config FRAME_POINTER endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/sh/kernel/ptrace.c b/arch/sh/kernel/ptrace.c index 602f6c570..732afaeaf 100644 --- a/arch/sh/kernel/ptrace.c +++ b/arch/sh/kernel/ptrace.c @@ -108,6 +108,8 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/sh/mm/hugetlbpage.c b/arch/sh/mm/hugetlbpage.c index 4d5d687d1..4bc97038e 100644 --- a/arch/sh/mm/hugetlbpage.c +++ b/arch/sh/mm/hugetlbpage.c @@ -62,7 +62,8 @@ static void set_huge_pte(struct mm_struct *mm, struct vm_area_struct *vma, unsigned long i; pte_t entry; - mm->rss += (HPAGE_SIZE / PAGE_SIZE); + // mm->rss += (HPAGE_SIZE / PAGE_SIZE); + vx_rsspages_add(mm, HPAGE_SIZE / PAGE_SIZE); if (write_access) entry = pte_mkwrite(pte_mkdirty(mk_pte(page, @@ -115,7 +116,8 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, pte_val(entry) += PAGE_SIZE; dst_pte++; } - dst->rss += (HPAGE_SIZE / PAGE_SIZE); + // dst->rss += (HPAGE_SIZE / PAGE_SIZE); + vx_rsspages_add(dst, HPAGE_SIZE / PAGE_SIZE); addr += HPAGE_SIZE; } return 0; @@ -206,7 +208,8 @@ void unmap_hugepage_range(struct vm_area_struct *vma, pte++; } } - mm->rss -= (end - start) >> PAGE_SHIFT; + // mm->rss -= (end - start) >> PAGE_SHIFT; + vx_rsspages_sub(mm, (end - start) >> PAGE_SHIFT); flush_tlb_range(vma, start, end); } diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig index 79d52a1dd..4b3dd85b5 100644 --- a/arch/sparc/Kconfig +++ b/arch/sparc/Kconfig @@ -450,6 +450,8 @@ config DEBUG_BUGVERBOSE endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/sparc/kernel/ptrace.c b/arch/sparc/kernel/ptrace.c index d838bd8f6..949072b1c 100644 --- a/arch/sparc/kernel/ptrace.c +++ b/arch/sparc/kernel/ptrace.c @@ -321,6 +321,10 @@ asmlinkage void do_ptrace(struct pt_regs *regs) pt_error_return(regs, ESRCH); goto out; } + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) { + pt_error_return(regs, ESRCH); + goto out_tsk; + } if ((current->personality == PER_SUNOS && request == PTRACE_SUNATTACH) || (current->personality != PER_SUNOS && request == PTRACE_ATTACH)) { diff --git a/arch/sparc/kernel/sys_sparc.c b/arch/sparc/kernel/sys_sparc.c index cec8ac302..7f2ab05ce 100644 --- a/arch/sparc/kernel/sys_sparc.c +++ b/arch/sparc/kernel/sys_sparc.c @@ -471,13 +471,13 @@ asmlinkage int sys_getdomainname(char __user *name, int len) down_read(&uts_sem); - nlen = strlen(system_utsname.domainname) + 1; + nlen = strlen(vx_new_uts(domainname)) + 1; if (nlen < len) len = nlen; if (len > __NEW_UTS_LEN) goto done; - if (copy_to_user(name, system_utsname.domainname, len)) + if (copy_to_user(name, vx_new_uts(domainname), len)) goto done; err = 0; done: diff --git a/arch/sparc/kernel/systbls.S b/arch/sparc/kernel/systbls.S index fd452a6d3..56c8c878d 100644 --- a/arch/sparc/kernel/systbls.S +++ b/arch/sparc/kernel/systbls.S @@ -72,7 +72,7 @@ sys_call_table: /*250*/ .long sparc_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl /*255*/ .long sys_nis_syscall, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep /*260*/ .long sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun -/*265*/ .long sys_timer_delete, sys_timer_create, sys_nis_syscall, sys_io_setup, sys_io_destroy +/*265*/ .long sys_timer_delete, sys_timer_create, sys_vserver, sys_io_setup, sys_io_destroy /*270*/ .long sys_io_submit, sys_io_cancel, sys_io_getevents, sys_mq_open, sys_mq_unlink /*275*/ .long sys_mq_timedsend, sys_mq_timedreceive, sys_mq_notify, sys_mq_getsetattr, sys_ni_syscall /*280*/ .long sys_ni_syscall, sys_ni_syscall, sys_ni_syscall diff --git a/arch/sparc64/Kconfig b/arch/sparc64/Kconfig index 3b110a53f..57156710c 100644 --- a/arch/sparc64/Kconfig +++ b/arch/sparc64/Kconfig @@ -707,6 +707,8 @@ config FRAME_POINTER endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/sparc64/kernel/binfmt_aout32.c b/arch/sparc64/kernel/binfmt_aout32.c index 4ba5d4801..609b6ed06 100644 --- a/arch/sparc64/kernel/binfmt_aout32.c +++ b/arch/sparc64/kernel/binfmt_aout32.c @@ -239,7 +239,8 @@ static int load_aout32_binary(struct linux_binprm * bprm, struct pt_regs * regs) current->mm->brk = ex.a_bss + (current->mm->start_brk = N_BSSADDR(ex)); - current->mm->rss = 0; + // current->mm->rss = 0; + vx_rsspages_sub(current->mm, current->mm->rss); current->mm->mmap = NULL; compute_creds(bprm); current->flags &= ~PF_FORKNOEXEC; diff --git a/arch/sparc64/kernel/ptrace.c b/arch/sparc64/kernel/ptrace.c index 3e9aa09a9..8e5e09832 100644 --- a/arch/sparc64/kernel/ptrace.c +++ b/arch/sparc64/kernel/ptrace.c @@ -172,6 +172,10 @@ asmlinkage void do_ptrace(struct pt_regs *regs) pt_error_return(regs, ESRCH); goto out; } + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) { + pt_error_return(regs, ESRCH); + goto out_tsk; + } if ((current->personality == PER_SUNOS && request == PTRACE_SUNATTACH) || (current->personality != PER_SUNOS && request == PTRACE_ATTACH)) { diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c index d3ce03bd7..802949957 100644 --- a/arch/sparc64/kernel/sys_sparc.c +++ b/arch/sparc64/kernel/sys_sparc.c @@ -459,13 +459,13 @@ asmlinkage int sys_getdomainname(char __user *name, int len) down_read(&uts_sem); - nlen = strlen(system_utsname.domainname) + 1; + nlen = strlen(vx_new_uts(domainname)) + 1; if (nlen < len) len = nlen; if (len > __NEW_UTS_LEN) goto done; - if (copy_to_user(name, system_utsname.domainname, len)) + if (copy_to_user(name, vx_new_uts(domainname), len)) goto done; err = 0; done: diff --git a/arch/sparc64/kernel/systbls.S b/arch/sparc64/kernel/systbls.S index b2ce2cdad..66e82e77a 100644 --- a/arch/sparc64/kernel/systbls.S +++ b/arch/sparc64/kernel/systbls.S @@ -72,7 +72,7 @@ sys_call_table32: /*250*/ .word sys32_mremap, sys32_sysctl, sys_getsid, sys_fdatasync, compat_sys_nfsservctl .word sys_ni_syscall, compat_clock_settime, compat_clock_gettime, compat_clock_getres, compat_clock_nanosleep /*260*/ .word compat_sys_sched_getaffinity, compat_sys_sched_setaffinity, compat_timer_settime, compat_timer_gettime, sys_timer_getoverrun - .word sys_timer_delete, sys32_timer_create, sys_ni_syscall, compat_sys_io_setup, sys_io_destroy + .word sys_timer_delete, sys32_timer_create, sys_vserver, compat_sys_io_setup, sys_io_destroy /*270*/ .word compat_sys_io_submit, sys_io_cancel, compat_sys_io_getevents, compat_sys_mq_open, sys_mq_unlink .word sys32_mq_timedsend, sys32_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, sys_ni_syscall /*280*/ .word sys_ni_syscall, sys_ni_syscall, sys_ni_syscall @@ -136,7 +136,7 @@ sys_call_table: /*250*/ .word sys64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl .word sys_ni_syscall, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep /*260*/ .word sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun - .word sys_timer_delete, sys_timer_create, sys_ni_syscall, sys_io_setup, sys_io_destroy + .word sys_timer_delete, sys_timer_create, sys_vserver, sys_io_setup, sys_io_destroy /*270*/ .word sys_io_submit, sys_io_cancel, sys_io_getevents, sys_mq_open, sys_mq_unlink .word sys_mq_timedsend, sys_mq_timedreceive, sys_mq_notify, sys_mq_getsetattr, sys_ni_syscall /*280*/ .word sys_ni_syscall, sys_ni_syscall, sys_ni_syscall diff --git a/arch/sparc64/mm/hugetlbpage.c b/arch/sparc64/mm/hugetlbpage.c index 6da2759c2..c9954c2ec 100644 --- a/arch/sparc64/mm/hugetlbpage.c +++ b/arch/sparc64/mm/hugetlbpage.c @@ -59,7 +59,8 @@ static void set_huge_pte(struct mm_struct *mm, struct vm_area_struct *vma, unsigned long i; pte_t entry; - mm->rss += (HPAGE_SIZE / PAGE_SIZE); + // mm->rss += (HPAGE_SIZE / PAGE_SIZE); + vx_rsspages_add(mm, HPAGE_SIZE / PAGE_SIZE); if (write_access) entry = pte_mkwrite(pte_mkdirty(mk_pte(page, @@ -112,7 +113,8 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, pte_val(entry) += PAGE_SIZE; dst_pte++; } - dst->rss += (HPAGE_SIZE / PAGE_SIZE); + // dst->rss += (HPAGE_SIZE / PAGE_SIZE); + vx_rsspages_add(dst, HPAGE_SIZE / PAGE_SIZE); addr += HPAGE_SIZE; } return 0; @@ -203,7 +205,8 @@ void unmap_hugepage_range(struct vm_area_struct *vma, pte++; } } - mm->rss -= (end - start) >> PAGE_SHIFT; + // mm->rss -= (end - start) >> PAGE_SHIFT; + vx_rsspages_sub(mm, (end - start) >> PAGE_SHIFT); flush_tlb_range(vma, start, end); } diff --git a/arch/um/Kconfig b/arch/um/Kconfig index 47fbaf3f4..7ef333e57 100644 --- a/arch/um/Kconfig +++ b/arch/um/Kconfig @@ -188,6 +188,8 @@ source "net/Kconfig" source "fs/Kconfig" +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c index c68c937f6..90f8d2861 100644 --- a/arch/um/kernel/ptrace.c +++ b/arch/um/kernel/ptrace.c @@ -58,6 +58,8 @@ int sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/um/kernel/syscall_kern.c b/arch/um/kernel/syscall_kern.c index 2af5fc2e5..f3a72d2d8 100644 --- a/arch/um/kernel/syscall_kern.c +++ b/arch/um/kernel/syscall_kern.c @@ -264,7 +264,7 @@ int sys_uname(struct old_utsname * name) if (!name) return -EFAULT; down_read(&uts_sem); - err=copy_to_user(name, &system_utsname, sizeof (*name)); + err=copy_to_user(name, vx_new_utsname(), sizeof (*name)); up_read(&uts_sem); return err?-EFAULT:0; } @@ -272,6 +272,7 @@ int sys_uname(struct old_utsname * name) int sys_olduname(struct oldold_utsname * name) { int error; + struct new_utsname *ptr; if (!name) return -EFAULT; @@ -280,19 +281,20 @@ int sys_olduname(struct oldold_utsname * name) down_read(&uts_sem); - error = __copy_to_user(&name->sysname,&system_utsname.sysname, + ptr = vx_new_utsname(); + error = __copy_to_user(&name->sysname,ptr->sysname, __OLD_UTS_LEN); error |= __put_user(0,name->sysname+__OLD_UTS_LEN); - error |= __copy_to_user(&name->nodename,&system_utsname.nodename, + error |= __copy_to_user(&name->nodename,ptr->nodename, __OLD_UTS_LEN); error |= __put_user(0,name->nodename+__OLD_UTS_LEN); - error |= __copy_to_user(&name->release,&system_utsname.release, + error |= __copy_to_user(&name->release,ptr->release, __OLD_UTS_LEN); error |= __put_user(0,name->release+__OLD_UTS_LEN); - error |= __copy_to_user(&name->version,&system_utsname.version, + error |= __copy_to_user(&name->version,ptr->version, __OLD_UTS_LEN); error |= __put_user(0,name->version+__OLD_UTS_LEN); - error |= __copy_to_user(&name->machine,&system_utsname.machine, + error |= __copy_to_user(&name->machine,ptr->machine, __OLD_UTS_LEN); error |= __put_user(0,name->machine+__OLD_UTS_LEN); diff --git a/arch/v850/Kconfig b/arch/v850/Kconfig index 8665652e2..994e4f859 100644 --- a/arch/v850/Kconfig +++ b/arch/v850/Kconfig @@ -334,6 +334,8 @@ config NO_KERNEL_MSG endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/v850/kernel/ptrace.c b/arch/v850/kernel/ptrace.c index fc06058f2..7d2554774 100644 --- a/arch/v850/kernel/ptrace.c +++ b/arch/v850/kernel/ptrace.c @@ -138,6 +138,8 @@ int sys_ptrace(long request, long pid, long addr, long data) read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; rval = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/x86_64/Kconfig b/arch/x86_64/Kconfig index 2122afc52..1c07776ac 100644 --- a/arch/x86_64/Kconfig +++ b/arch/x86_64/Kconfig @@ -499,6 +499,8 @@ config IOMMU_LEAK endmenu +source "kernel/vserver/Kconfig" + source "security/Kconfig" source "crypto/Kconfig" diff --git a/arch/x86_64/ia32/ia32_aout.c b/arch/x86_64/ia32/ia32_aout.c index 040adf699..b7b698c68 100644 --- a/arch/x86_64/ia32/ia32_aout.c +++ b/arch/x86_64/ia32/ia32_aout.c @@ -308,7 +308,8 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs) (current->mm->start_brk = N_BSSADDR(ex)); current->mm->free_area_cache = TASK_UNMAPPED_BASE; - current->mm->rss = 0; + // current->mm->rss = 0; + vx_rsspages_sub(current->mm, current->mm->rss); current->mm->mmap = NULL; compute_creds(bprm); current->flags &= ~PF_FORKNOEXEC; diff --git a/arch/x86_64/ia32/ia32_binfmt.c b/arch/x86_64/ia32/ia32_binfmt.c index d8104898c..fc1a9b01a 100644 --- a/arch/x86_64/ia32/ia32_binfmt.c +++ b/arch/x86_64/ia32/ia32_binfmt.c @@ -327,7 +327,7 @@ static void elf32_init(struct pt_regs *regs) int setup_arg_pages(struct linux_binprm *bprm, int executable_stack) { - unsigned long stack_base; + unsigned long stack_base, grow; struct vm_area_struct *mpnt; struct mm_struct *mm = current->mm; int i; @@ -344,7 +344,10 @@ int setup_arg_pages(struct linux_binprm *bprm, int executable_stack) if (!mpnt) return -ENOMEM; - if (security_vm_enough_memory((IA32_STACK_TOP - (PAGE_MASK & (unsigned long) bprm->p))>>PAGE_SHIFT)) { + grow = (IA32_STACK_TOP - (PAGE_MASK & (unsigned long) bprm->p)) + >> PAGE_SHIFT; + if (security_vm_enough_memory(grow) || + !vx_vmpages_avail(mm, grow)) { kmem_cache_free(vm_area_cachep, mpnt); return -ENOMEM; } @@ -365,7 +368,9 @@ int setup_arg_pages(struct linux_binprm *bprm, int executable_stack) mpnt->vm_page_prot = (mpnt->vm_flags & VM_EXEC) ? PAGE_COPY_EXEC : PAGE_COPY; insert_vm_struct(mm, mpnt); - mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; + // mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; + vx_vmpages_sub(mm, mm->total_vm - + ((mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT)); } for (i = 0 ; i < MAX_ARG_PAGES ; i++) { diff --git a/arch/x86_64/ia32/sys_ia32.c b/arch/x86_64/ia32/sys_ia32.c index af5f3218a..08a60e519 100644 --- a/arch/x86_64/ia32/sys_ia32.c +++ b/arch/x86_64/ia32/sys_ia32.c @@ -1059,6 +1059,7 @@ asmlinkage long sys32_mmap2(unsigned long addr, unsigned long len, asmlinkage long sys32_olduname(struct oldold_utsname __user * name) { int error; + struct new_utsname *ptr; if (!name) return -EFAULT; @@ -1067,13 +1068,14 @@ asmlinkage long sys32_olduname(struct oldold_utsname __user * name) down_read(&uts_sem); - error = __copy_to_user(&name->sysname,&system_utsname.sysname,__OLD_UTS_LEN); + ptr = vx_new_utsname(); + error = __copy_to_user(&name->sysname,ptr->sysname,__OLD_UTS_LEN); __put_user(0,name->sysname+__OLD_UTS_LEN); - __copy_to_user(&name->nodename,&system_utsname.nodename,__OLD_UTS_LEN); + __copy_to_user(&name->nodename,ptr->nodename,__OLD_UTS_LEN); __put_user(0,name->nodename+__OLD_UTS_LEN); - __copy_to_user(&name->release,&system_utsname.release,__OLD_UTS_LEN); + __copy_to_user(&name->release,ptr->release,__OLD_UTS_LEN); __put_user(0,name->release+__OLD_UTS_LEN); - __copy_to_user(&name->version,&system_utsname.version,__OLD_UTS_LEN); + __copy_to_user(&name->version,ptr->version,__OLD_UTS_LEN); __put_user(0,name->version+__OLD_UTS_LEN); { char *arch = "x86_64"; @@ -1096,7 +1098,7 @@ long sys32_uname(struct old_utsname __user * name) if (!name) return -EFAULT; down_read(&uts_sem); - err=copy_to_user(name, &system_utsname, sizeof (*name)); + err=copy_to_user(name, vx_new_utsname(), sizeof (*name)); up_read(&uts_sem); if (personality(current->personality) == PER_LINUX32) err |= copy_to_user(&name->machine, "i686", 5); diff --git a/arch/x86_64/kernel/ptrace.c b/arch/x86_64/kernel/ptrace.c index 5dd7752ae..d07a45b01 100644 --- a/arch/x86_64/kernel/ptrace.c +++ b/arch/x86_64/kernel/ptrace.c @@ -208,6 +208,8 @@ asmlinkage long sys_ptrace(long request, long pid, unsigned long addr, long data read_unlock(&tasklist_lock); if (!child) goto out; + if (!vx_check(vx_task_xid(child), VX_WATCH|VX_IDENT)) + goto out_tsk; ret = -EPERM; if (pid == 1) /* you may not mess with init */ diff --git a/arch/x86_64/kernel/sys_x86_64.c b/arch/x86_64/kernel/sys_x86_64.c index 38a286ca3..a2c5b038f 100644 --- a/arch/x86_64/kernel/sys_x86_64.c +++ b/arch/x86_64/kernel/sys_x86_64.c @@ -146,7 +146,7 @@ asmlinkage long sys_uname(struct new_utsname __user * name) { int err; down_read(&uts_sem); - err = copy_to_user(name, &system_utsname, sizeof (*name)); + err = copy_to_user(name, vx_new_utsname(), sizeof (*name)); up_read(&uts_sem); if (personality(current->personality) == PER_LINUX32) err |= copy_to_user(&name->machine, "i686", 5); diff --git a/configs/kernel-2.6.6-i586-smp.config b/configs/kernel-2.6.6-i586-smp.config index 2ac8f42d7..c776cab9f 100644 --- a/configs/kernel-2.6.6-i586-smp.config +++ b/configs/kernel-2.6.6-i586-smp.config @@ -2293,6 +2293,18 @@ CONFIG_DEBUG_SPINLOCK_SLEEP=y CONFIG_X86_FIND_SMP_CONFIG=y CONFIG_X86_MPPARSE=y +# +# Linux VServer +# +CONFIG_VSERVER_LEGACY=y +CONFIG_PROC_SECURE=y +# CONFIG_VSERVER_HARDCPU is not set +# CONFIG_INOXID_NONE is not set +# CONFIG_INOXID_GID16 is not set +CONFIG_INOXID_GID24=y +# CONFIG_INOXID_GID32 is not set +# CONFIG_INOXID_MAGIC is not set + # # Security options # diff --git a/configs/kernel-2.6.6-i586.config b/configs/kernel-2.6.6-i586.config index acf01adf2..eb84e1a7d 100644 --- a/configs/kernel-2.6.6-i586.config +++ b/configs/kernel-2.6.6-i586.config @@ -2313,6 +2313,18 @@ CONFIG_DEBUG_INFO=y CONFIG_DEBUG_SPINLOCK_SLEEP=y # CONFIG_FRAME_POINTER is not set +# +# Linux VServer +# +CONFIG_VSERVER_LEGACY=y +CONFIG_PROC_SECURE=y +# CONFIG_VSERVER_HARDCPU is not set +# CONFIG_INOXID_NONE is not set +# CONFIG_INOXID_GID16 is not set +CONFIG_INOXID_GID24=y +# CONFIG_INOXID_GID32 is not set +# CONFIG_INOXID_MAGIC is not set + # # Security options # diff --git a/configs/kernel-2.6.6-i686-smp.config b/configs/kernel-2.6.6-i686-smp.config index de7e3e791..323a7faf2 100644 --- a/configs/kernel-2.6.6-i686-smp.config +++ b/configs/kernel-2.6.6-i686-smp.config @@ -2296,6 +2296,18 @@ CONFIG_DEBUG_SPINLOCK_SLEEP=y CONFIG_X86_FIND_SMP_CONFIG=y CONFIG_X86_MPPARSE=y +# +# Linux VServer +# +CONFIG_VSERVER_LEGACY=y +CONFIG_PROC_SECURE=y +# CONFIG_VSERVER_HARDCPU is not set +# CONFIG_INOXID_NONE is not set +# CONFIG_INOXID_GID16 is not set +CONFIG_INOXID_GID24=y +# CONFIG_INOXID_GID32 is not set +# CONFIG_INOXID_MAGIC is not set + # # Security options # diff --git a/configs/kernel-2.6.6-i686.config b/configs/kernel-2.6.6-i686.config index c245c3d55..f416d4c37 100644 --- a/configs/kernel-2.6.6-i686.config +++ b/configs/kernel-2.6.6-i686.config @@ -2314,6 +2314,18 @@ CONFIG_DEBUG_INFO=y CONFIG_DEBUG_SPINLOCK_SLEEP=y # CONFIG_FRAME_POINTER is not set +# +# Linux VServer +# +CONFIG_VSERVER_LEGACY=y +CONFIG_PROC_SECURE=y +# CONFIG_VSERVER_HARDCPU is not set +# CONFIG_INOXID_NONE is not set +# CONFIG_INOXID_GID16 is not set +CONFIG_INOXID_GID24=y +# CONFIG_INOXID_GID32 is not set +# CONFIG_INOXID_MAGIC is not set + # # Security options # diff --git a/fs/attr.c b/fs/attr.c index d63350cfc..5bb63a855 100644 --- a/fs/attr.c +++ b/fs/attr.c @@ -62,6 +62,24 @@ error: EXPORT_SYMBOL(inode_change_ok); +int inode_setattr_flags(struct inode *inode, unsigned int flags) +{ + unsigned int oldflags, newflags; + + oldflags = inode->i_flags; + newflags = oldflags & ~(S_IMMUTABLE | S_IUNLINK | S_BARRIER); + if (flags & ATTR_FLAG_IMMUTABLE) + newflags |= S_IMMUTABLE; + if (flags & ATTR_FLAG_IUNLINK) + newflags |= S_IUNLINK; + if (flags & ATTR_FLAG_BARRIER) + newflags |= S_BARRIER; + + if (oldflags ^ newflags) + inode->i_flags = newflags; + return 0; +} + int inode_setattr(struct inode * inode, struct iattr * attr) { unsigned int ia_valid = attr->ia_valid; @@ -98,6 +116,8 @@ int inode_setattr(struct inode * inode, struct iattr * attr) mode &= ~S_ISGID; inode->i_mode = mode; } + if (ia_valid & ATTR_ATTR_FLAG) + inode_setattr_flags(inode, attr->ia_attr_flags); mark_inode_dirty(inode); out: return error; diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c index a31cba58e..8db14c6df 100644 --- a/fs/binfmt_aout.c +++ b/fs/binfmt_aout.c @@ -310,7 +310,8 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs) current->mm->free_area_cache = TASK_UNMAPPED_BASE; /* unlimited stack is larger than TASK_SIZE */ current->mm->non_executable_cache = current->mm->mmap_top; - current->mm->rss = 0; + // current->mm->rss = 0; + vx_rsspages_sub(current->mm, current->mm->rss); current->mm->mmap = NULL; compute_creds(bprm); current->flags &= ~PF_FORKNOEXEC; diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 908661518..d9e71fc7d 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -767,7 +767,8 @@ static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs) /* Do this so that we can load the interpreter, if need be. We will change some of these later */ - current->mm->rss = 0; + // current->mm->rss = 0; + vx_rsspages_sub(current->mm, current->mm->rss); current->mm->free_area_cache = TASK_UNMAPPED_BASE; current->mm->non_executable_cache = current->mm->mmap_top; retval = setup_arg_pages(bprm, executable_stack); diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c index 465133cd6..8728d532d 100644 --- a/fs/binfmt_flat.c +++ b/fs/binfmt_flat.c @@ -651,7 +651,8 @@ static int load_flat_file(struct linux_binprm * bprm, current->mm->start_brk = datapos + data_len + bss_len; current->mm->brk = (current->mm->start_brk + 3) & ~3; current->mm->context.end_brk = memp + ksize((void *) memp) - stack_len; - current->mm->rss = 0; + // current->mm->rss = 0; + vx_rsspages_sub(current->mm, current->mm->rss); } if (flags & FLAT_FLAG_KTRACE) diff --git a/fs/binfmt_som.c b/fs/binfmt_som.c index d7e5f1f23..496196b4e 100644 --- a/fs/binfmt_som.c +++ b/fs/binfmt_som.c @@ -259,7 +259,8 @@ load_som_binary(struct linux_binprm * bprm, struct pt_regs * regs) create_som_tables(bprm); current->mm->start_stack = bprm->p; - current->mm->rss = 0; + // current->mm->rss = 0; + vx_rsspages_sub(current->mm, current->mm->rss); #if 0 printk("(start_brk) %08lx\n" , (unsigned long) current->mm->start_brk); diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c index 1d49ef4af..17b686a82 100644 --- a/fs/devpts/inode.c +++ b/fs/devpts/inode.c @@ -18,6 +18,7 @@ #include #include #include +#include #include "xattr.h" #define DEVPTS_SUPER_MAGIC 0x1cd1 @@ -134,11 +135,21 @@ static struct dentry *get_node(int num) return lookup_one_len(s, root, sprintf(s, "%d", num)); } +static int devpts_permission(struct inode *inode, int mask, struct nameidata *nd) +{ + int ret = -EACCES; + + if (vx_check(inode->i_xid, VX_IDENT)) + ret = vfs_permission(inode, mask); + return ret; +} + static struct inode_operations devpts_file_inode_operations = { .setxattr = devpts_setxattr, .getxattr = devpts_getxattr, .listxattr = devpts_listxattr, .removexattr = devpts_removexattr, + .permission = devpts_permission, }; int devpts_pty_new(struct tty_struct *tty) @@ -162,6 +173,7 @@ int devpts_pty_new(struct tty_struct *tty) inode->i_gid = config.setgid ? config.gid : current->fsgid; inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME; init_special_inode(inode, S_IFCHR|config.mode, device); + inode->i_xid = vx_current_xid(); inode->i_op = &devpts_file_inode_operations; inode->u.generic_ip = tty; diff --git a/fs/exec.c b/fs/exec.c index 3ba35b672..c5a7dfcff 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -320,7 +320,8 @@ void install_arg_page(struct vm_area_struct *vma, pte_unmap(pte); goto out; } - mm->rss++; + // mm->rss++; + vx_rsspages_inc(mm); lru_cache_add_active(page); set_pte(pte, pte_mkdirty(pte_mkwrite(mk_pte( page, vma->vm_page_prot)))); @@ -409,7 +410,8 @@ int setup_arg_pages(struct linux_binprm *bprm, int executable_stack) if (!mpnt) return -ENOMEM; - if (security_vm_enough_memory(arg_size >> PAGE_SHIFT)) { + if (security_vm_enough_memory(arg_size >> PAGE_SHIFT) || + !vx_vmpages_avail(mm, arg_size >> PAGE_SHIFT)) { kmem_cache_free(vm_area_cachep, mpnt); return -ENOMEM; } @@ -438,7 +440,9 @@ int setup_arg_pages(struct linux_binprm *bprm, int executable_stack) mpnt->vm_flags = VM_STACK_FLAGS; mpnt->vm_page_prot = protection_map[mpnt->vm_flags & 0x7]; insert_vm_struct(mm, mpnt); - mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; + // mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; + vx_vmpages_sub(mm, mm->total_vm - + ((mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT)); } for (i = 0 ; i < MAX_ARG_PAGES ; i++) { diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c index e03b54231..5aa6769ba 100644 --- a/fs/ext2/ialloc.c +++ b/fs/ext2/ialloc.c @@ -579,7 +579,8 @@ got: inode->i_blocks = 0; inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME; memset(ei->i_data, 0, sizeof(ei->i_data)); - ei->i_flags = EXT2_I(dir)->i_flags & ~EXT2_BTREE_FL; + ei->i_flags = EXT2_I(dir)->i_flags & + ~(EXT2_BTREE_FL|EXT2_IUNLINK_FL|EXT2_BARRIER_FL); if (S_ISLNK(mode)) ei->i_flags &= ~(EXT2_IMMUTABLE_FL|EXT2_APPEND_FL); /* dirsync is only applied to directories */ diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c index 769c0b3af..4389ac953 100644 --- a/fs/ext2/inode.c +++ b/fs/ext2/inode.c @@ -31,6 +31,7 @@ #include #include #include +#include #include "ext2.h" #include "acl.h" @@ -65,6 +66,8 @@ void ext2_put_inode(struct inode *inode) ext2_discard_prealloc(inode); } +static void ext2_truncate_nocheck (struct inode * inode); + /* * Called at the last iput() if i_nlink is zero. */ @@ -78,7 +81,7 @@ void ext2_delete_inode (struct inode * inode) inode->i_size = 0; if (inode->i_blocks) - ext2_truncate (inode); + ext2_truncate_nocheck(inode); ext2_free_inode (inode); return; @@ -878,7 +881,7 @@ static void ext2_free_branches(struct inode *inode, u32 *p, u32 *q, int depth) ext2_free_data(inode, p, q); } -void ext2_truncate (struct inode * inode) +static void ext2_truncate_nocheck(struct inode * inode) { u32 *i_data = EXT2_I(inode)->i_data; int addr_per_block = EXT2_ADDR_PER_BLOCK(inode->i_sb); @@ -895,8 +898,6 @@ void ext2_truncate (struct inode * inode) return; if (ext2_inode_is_fast_symlink(inode)) return; - if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) - return; ext2_discard_prealloc(inode); @@ -1018,6 +1019,13 @@ Egdp: return ERR_PTR(-EIO); } +void ext2_truncate (struct inode * inode) +{ + if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) + return; + ext2_truncate_nocheck(inode); +} + void ext2_set_inode_flags(struct inode *inode) { unsigned int flags = EXT2_I(inode)->i_flags; @@ -1029,6 +1037,10 @@ void ext2_set_inode_flags(struct inode *inode) inode->i_flags |= S_APPEND; if (flags & EXT2_IMMUTABLE_FL) inode->i_flags |= S_IMMUTABLE; + if (flags & EXT2_IUNLINK_FL) + inode->i_flags |= S_IUNLINK; + if (flags & EXT2_BARRIER_FL) + inode->i_flags |= S_BARRIER; if (flags & EXT2_NOATIME_FL) inode->i_flags |= S_NOATIME; if (flags & EXT2_DIRSYNC_FL) @@ -1041,6 +1053,8 @@ void ext2_read_inode (struct inode * inode) ino_t ino = inode->i_ino; struct buffer_head * bh; struct ext2_inode * raw_inode = ext2_get_inode(inode->i_sb, ino, &bh); + uid_t uid; + gid_t gid; int n; #ifdef CONFIG_EXT2_FS_POSIX_ACL @@ -1051,12 +1065,17 @@ void ext2_read_inode (struct inode * inode) goto bad_inode; inode->i_mode = le16_to_cpu(raw_inode->i_mode); - inode->i_uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low); - inode->i_gid = (gid_t)le16_to_cpu(raw_inode->i_gid_low); + uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low); + gid = (gid_t)le16_to_cpu(raw_inode->i_gid_low); if (!(test_opt (inode->i_sb, NO_UID32))) { - inode->i_uid |= le16_to_cpu(raw_inode->i_uid_high) << 16; - inode->i_gid |= le16_to_cpu(raw_inode->i_gid_high) << 16; + uid |= le16_to_cpu(raw_inode->i_uid_high) << 16; + gid |= le16_to_cpu(raw_inode->i_gid_high) << 16; } + inode->i_uid = INOXID_UID(uid, gid); + inode->i_gid = INOXID_GID(uid, gid); + if (inode->i_sb->s_flags & MS_TAGXID) + inode->i_xid = INOXID_XID(uid, gid, le16_to_cpu(raw_inode->i_raw_xid)); + inode->i_nlink = le16_to_cpu(raw_inode->i_links_count); inode->i_size = le32_to_cpu(raw_inode->i_size); inode->i_atime.tv_sec = le32_to_cpu(raw_inode->i_atime); @@ -1149,8 +1168,8 @@ static int ext2_update_inode(struct inode * inode, int do_sync) struct ext2_inode_info *ei = EXT2_I(inode); struct super_block *sb = inode->i_sb; ino_t ino = inode->i_ino; - uid_t uid = inode->i_uid; - gid_t gid = inode->i_gid; + uid_t uid = XIDINO_UID(inode->i_uid, inode->i_xid); + gid_t gid = XIDINO_GID(inode->i_gid, inode->i_xid); struct buffer_head * bh; struct ext2_inode * raw_inode = ext2_get_inode(sb, ino, &bh); int n; @@ -1185,6 +1204,9 @@ static int ext2_update_inode(struct inode * inode, int do_sync) raw_inode->i_uid_high = 0; raw_inode->i_gid_high = 0; } +#ifdef CONFIG_INOXID_GID32 + raw_inode->i_raw_xid = cpu_to_le16(inode->i_xid); +#endif raw_inode->i_links_count = cpu_to_le16(inode->i_nlink); raw_inode->i_size = cpu_to_le32(inode->i_size); raw_inode->i_atime = cpu_to_le32(inode->i_atime.tv_sec); @@ -1262,6 +1284,27 @@ int ext2_sync_inode(struct inode *inode) return sync_inode(inode, &wbc); } +int ext2_setattr_flags(struct inode *inode, unsigned int flags) +{ + unsigned int oldflags, newflags; + + oldflags = EXT2_I(inode)->i_flags; + newflags = oldflags & + ~(EXT2_IMMUTABLE_FL | EXT2_IUNLINK_FL | EXT2_BARRIER_FL); + if (flags & ATTR_FLAG_IMMUTABLE) + newflags |= EXT2_IMMUTABLE_FL; + if (flags & ATTR_FLAG_IUNLINK) + newflags |= EXT2_IUNLINK_FL; + if (flags & ATTR_FLAG_BARRIER) + newflags |= EXT2_BARRIER_FL; + + if (oldflags ^ newflags) { + EXT2_I(inode)->i_flags = newflags; + inode->i_ctime = CURRENT_TIME; + } + return 0; +} + int ext2_setattr(struct dentry *dentry, struct iattr *iattr) { struct inode *inode = dentry->d_inode; @@ -1276,6 +1319,9 @@ int ext2_setattr(struct dentry *dentry, struct iattr *iattr) if (error) return error; } + if (iattr->ia_valid & ATTR_ATTR_FLAG) + ext2_setattr_flags(inode, iattr->ia_attr_flags); + inode_setattr(inode, iattr); if (iattr->ia_valid & ATTR_MODE) error = ext2_acl_chmod(inode); diff --git a/fs/ext2/super.c b/fs/ext2/super.c index 3a06830a5..3e54fbeac 100644 --- a/fs/ext2/super.c +++ b/fs/ext2/super.c @@ -270,7 +270,7 @@ enum { Opt_bsd_df, Opt_minix_df, Opt_grpid, Opt_nogrpid, Opt_resgid, Opt_resuid, Opt_sb, Opt_err_cont, Opt_err_panic, Opt_err_ro, Opt_nouid32, Opt_check, Opt_nocheck, Opt_debug, Opt_oldalloc, Opt_orlov, Opt_nobh, - Opt_user_xattr, Opt_nouser_xattr, Opt_acl, Opt_noacl, + Opt_user_xattr, Opt_nouser_xattr, Opt_acl, Opt_noacl, Opt_tagxid, Opt_ignore, Opt_err, }; @@ -299,6 +299,7 @@ static match_table_t tokens = { {Opt_nouser_xattr, "nouser_xattr"}, {Opt_acl, "acl"}, {Opt_noacl, "noacl"}, + {Opt_tagxid, "tagxid"}, {Opt_ignore, "grpquota"}, {Opt_ignore, "noquota"}, {Opt_ignore, "quota"}, @@ -362,6 +363,11 @@ static int parse_options (char * options, case Opt_nouid32: set_opt (sbi->s_mount_opt, NO_UID32); break; +#ifndef CONFIG_INOXID_NONE + case Opt_tagxid: + set_opt (sbi->s_mount_opt, TAG_XID); + break; +#endif case Opt_check: #ifdef CONFIG_EXT2_CHECK set_opt (sbi->s_mount_opt, CHECK); @@ -646,6 +652,8 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) if (!parse_options ((char *) data, sbi)) goto failed_mount; + if (EXT2_SB(sb)->s_mount_opt & EXT2_MOUNT_TAG_XID) + sb->s_flags |= MS_TAGXID; sb->s_flags = (sb->s_flags & ~MS_POSIXACL) | ((EXT2_SB(sb)->s_mount_opt & EXT2_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0); diff --git a/fs/ext3/ialloc.c b/fs/ext3/ialloc.c index 11ac3c2dc..c68240561 100644 --- a/fs/ext3/ialloc.c +++ b/fs/ext3/ialloc.c @@ -567,7 +567,8 @@ got: ei->i_dir_start_lookup = 0; ei->i_disksize = 0; - ei->i_flags = EXT3_I(dir)->i_flags & ~EXT3_INDEX_FL; + ei->i_flags = EXT3_I(dir)->i_flags & + ~(EXT3_INDEX_FL|EXT3_IUNLINK_FL|EXT3_BARRIER_FL); if (S_ISLNK(mode)) ei->i_flags &= ~(EXT3_IMMUTABLE_FL|EXT3_APPEND_FL); /* dirsync only applies to directories */ diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c index f6f61f741..433ba25ed 100644 --- a/fs/ext3/inode.c +++ b/fs/ext3/inode.c @@ -36,6 +36,7 @@ #include #include #include +#include #include "xattr.h" #include "acl.h" @@ -176,6 +177,8 @@ static int ext3_journal_test_restart(handle_t *handle, struct inode *inode) return ext3_journal_restart(handle, blocks_for_truncate(inode)); } +static void ext3_truncate_nocheck (struct inode *inode); + /* * Called at the last iput() if i_nlink is zero. */ @@ -199,7 +202,7 @@ void ext3_delete_inode (struct inode * inode) handle->h_sync = 1; inode->i_size = 0; if (inode->i_blocks) - ext3_truncate(inode); + ext3_truncate_nocheck(inode); /* * Kill off the orphan record which ext3_truncate created. * AKPM: I think this can be inside the above `if'. @@ -2020,7 +2023,7 @@ static void ext3_free_branches(handle_t *handle, struct inode *inode, * ext3_truncate() run will find them and release them. */ -void ext3_truncate(struct inode * inode) +void ext3_truncate_nocheck(struct inode * inode) { handle_t *handle; struct ext3_inode_info *ei = EXT3_I(inode); @@ -2041,8 +2044,6 @@ void ext3_truncate(struct inode * inode) return; if (ext3_inode_is_fast_symlink(inode)) return; - if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) - return; ext3_discard_reservation(inode); @@ -2351,6 +2352,13 @@ has_buffer: return 0; } +void ext3_truncate(struct inode * inode) +{ + if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) + return; + ext3_truncate_nocheck(inode); +} + void ext3_set_inode_flags(struct inode *inode) { unsigned int flags = EXT3_I(inode)->i_flags; @@ -2362,6 +2370,10 @@ void ext3_set_inode_flags(struct inode *inode) inode->i_flags |= S_APPEND; if (flags & EXT3_IMMUTABLE_FL) inode->i_flags |= S_IMMUTABLE; + if (flags & EXT3_IUNLINK_FL) + inode->i_flags |= S_IUNLINK; + if (flags & EXT3_BARRIER_FL) + inode->i_flags |= S_BARRIER; if (flags & EXT3_NOATIME_FL) inode->i_flags |= S_NOATIME; if (flags & EXT3_DIRSYNC_FL) @@ -2375,6 +2387,8 @@ void ext3_read_inode(struct inode * inode) struct ext3_inode_info *ei = EXT3_I(inode); struct buffer_head *bh; int block; + uid_t uid; + gid_t gid; #ifdef CONFIG_EXT3_FS_POSIX_ACL ei->i_acl = EXT3_ACL_NOT_CACHED; @@ -2385,12 +2399,17 @@ void ext3_read_inode(struct inode * inode) bh = iloc.bh; raw_inode = ext3_raw_inode(&iloc); inode->i_mode = le16_to_cpu(raw_inode->i_mode); - inode->i_uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low); - inode->i_gid = (gid_t)le16_to_cpu(raw_inode->i_gid_low); + uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low); + gid = (gid_t)le16_to_cpu(raw_inode->i_gid_low); if(!(test_opt (inode->i_sb, NO_UID32))) { - inode->i_uid |= le16_to_cpu(raw_inode->i_uid_high) << 16; - inode->i_gid |= le16_to_cpu(raw_inode->i_gid_high) << 16; + uid |= le16_to_cpu(raw_inode->i_uid_high) << 16; + gid |= le16_to_cpu(raw_inode->i_gid_high) << 16; } + inode->i_uid = INOXID_UID(uid, gid); + inode->i_gid = INOXID_GID(uid, gid); + if (inode->i_sb->s_flags & MS_TAGXID) + inode->i_xid = INOXID_XID(uid, gid, le16_to_cpu(raw_inode->i_raw_xid)); + inode->i_nlink = le16_to_cpu(raw_inode->i_links_count); inode->i_size = le32_to_cpu(raw_inode->i_size); inode->i_atime.tv_sec = le32_to_cpu(raw_inode->i_atime); @@ -2498,6 +2517,8 @@ static int ext3_do_update_inode(handle_t *handle, struct ext3_inode *raw_inode = ext3_raw_inode(iloc); struct ext3_inode_info *ei = EXT3_I(inode); struct buffer_head *bh = iloc->bh; + uid_t uid = XIDINO_UID(inode->i_uid, inode->i_xid); + gid_t gid = XIDINO_GID(inode->i_gid, inode->i_xid); int err = 0, rc, block; /* For fields not not tracking in the in-memory inode, @@ -2507,29 +2528,32 @@ static int ext3_do_update_inode(handle_t *handle, raw_inode->i_mode = cpu_to_le16(inode->i_mode); if(!(test_opt(inode->i_sb, NO_UID32))) { - raw_inode->i_uid_low = cpu_to_le16(low_16_bits(inode->i_uid)); - raw_inode->i_gid_low = cpu_to_le16(low_16_bits(inode->i_gid)); + raw_inode->i_uid_low = cpu_to_le16(low_16_bits(uid)); + raw_inode->i_gid_low = cpu_to_le16(low_16_bits(gid)); /* * Fix up interoperability with old kernels. Otherwise, old inodes get * re-used with the upper 16 bits of the uid/gid intact */ if(!ei->i_dtime) { raw_inode->i_uid_high = - cpu_to_le16(high_16_bits(inode->i_uid)); + cpu_to_le16(high_16_bits(uid)); raw_inode->i_gid_high = - cpu_to_le16(high_16_bits(inode->i_gid)); + cpu_to_le16(high_16_bits(gid)); } else { raw_inode->i_uid_high = 0; raw_inode->i_gid_high = 0; } } else { raw_inode->i_uid_low = - cpu_to_le16(fs_high2lowuid(inode->i_uid)); + cpu_to_le16(fs_high2lowuid(uid)); raw_inode->i_gid_low = - cpu_to_le16(fs_high2lowgid(inode->i_gid)); + cpu_to_le16(fs_high2lowgid(gid)); raw_inode->i_uid_high = 0; raw_inode->i_gid_high = 0; } +#ifdef CONFIG_INOXID_GID32 + raw_inode->i_raw_xid = cpu_to_le16(inode->i_xid); +#endif raw_inode->i_links_count = cpu_to_le16(inode->i_nlink); raw_inode->i_size = cpu_to_le32(ei->i_disksize); raw_inode->i_atime = cpu_to_le32(inode->i_atime.tv_sec); @@ -2651,6 +2675,44 @@ void ext3_write_inode(struct inode *inode, int wait) ext3_force_commit(inode->i_sb); } +int ext3_setattr_flags(struct inode *inode, unsigned int flags) +{ + unsigned int oldflags, newflags; + int err = 0; + + oldflags = EXT3_I(inode)->i_flags; + newflags = oldflags & + ~(EXT3_IMMUTABLE_FL | EXT3_IUNLINK_FL | EXT3_BARRIER_FL); + if (flags & ATTR_FLAG_IMMUTABLE) + newflags |= EXT3_IMMUTABLE_FL; + if (flags & ATTR_FLAG_IUNLINK) + newflags |= EXT3_IUNLINK_FL; + if (flags & ATTR_FLAG_BARRIER) + newflags |= EXT3_BARRIER_FL; + + if (oldflags ^ newflags) { + handle_t *handle; + struct ext3_iloc iloc; + + handle = ext3_journal_start(inode, 1); + if (IS_ERR(handle)) + return PTR_ERR(handle); + if (IS_SYNC(inode)) + handle->h_sync = 1; + err = ext3_reserve_inode_write(handle, inode, &iloc); + if (err) + goto flags_err; + + EXT3_I(inode)->i_flags = newflags; + inode->i_ctime = CURRENT_TIME; + + err = ext3_mark_iloc_dirty(handle, inode, &iloc); + flags_err: + ext3_journal_stop(handle); + } + return err; +} + /* * ext3_setattr() * @@ -2722,6 +2784,12 @@ int ext3_setattr(struct dentry *dentry, struct iattr *attr) ext3_journal_stop(handle); } + if (ia_valid & ATTR_ATTR_FLAG) { + rc = ext3_setattr_flags(inode, attr->ia_attr_flags); + if (!error) + error = rc; + } + rc = inode_setattr(inode, attr); /* If inode_setattr's call to ext3_truncate failed to get a diff --git a/fs/ext3/ioctl.c b/fs/ext3/ioctl.c index e2ea75cf8..cac06b641 100644 --- a/fs/ext3/ioctl.c +++ b/fs/ext3/ioctl.c @@ -12,6 +12,7 @@ #include #include #include +#include #include @@ -220,6 +221,38 @@ flags_err: } +#if defined(CONFIG_VSERVER_LEGACY) && !defined(CONFIG_INOXID_NONE) + case EXT3_IOC_SETXID: { + handle_t *handle; + struct ext3_iloc iloc; + int xid; + int err; + + /* fixme: if stealth, return -ENOTTY */ + if (!capable(CAP_CONTEXT)) + return -EPERM; + if (IS_RDONLY(inode)) + return -EROFS; + if (!(inode->i_sb->s_flags & MS_TAGXID)) + return -ENOSYS; + if (get_user(xid, (int *) arg)) + return -EFAULT; + + handle = ext3_journal_start(inode, 1); + if (IS_ERR(handle)) + return PTR_ERR(handle); + err = ext3_reserve_inode_write(handle, inode, &iloc); + if (err) + return err; + + inode->i_xid = (xid & 0xFFFF); + inode->i_ctime = CURRENT_TIME; + + err = ext3_mark_iloc_dirty(handle, inode, &iloc); + ext3_journal_stop(handle); + return err; + } +#endif default: return -ENOTTY; } diff --git a/fs/ext3/super.c b/fs/ext3/super.c index 9c5901176..1aa5b0491 100644 --- a/fs/ext3/super.c +++ b/fs/ext3/super.c @@ -585,7 +585,7 @@ enum { Opt_abort, Opt_data_journal, Opt_data_ordered, Opt_data_writeback, Opt_usrjquota, Opt_grpjquota, Opt_offusrjquota, Opt_offgrpjquota, Opt_jqfmt_vfsold, Opt_jqfmt_vfsv0, - Opt_ignore, Opt_err, Opt_resize, + Opt_tagxid, Opt_ignore, Opt_err, Opt_resize, }; static match_table_t tokens = { @@ -628,6 +628,7 @@ static match_table_t tokens = { {Opt_grpjquota, "grpjquota=%s"}, {Opt_jqfmt_vfsold, "jqfmt=vfsold"}, {Opt_jqfmt_vfsv0, "jqfmt=vfsv0"}, + {Opt_tagxid, "tagxid"}, {Opt_ignore, "grpquota"}, {Opt_ignore, "noquota"}, {Opt_ignore, "quota"}, @@ -723,6 +724,11 @@ static int parse_options (char * options, struct super_block *sb, case Opt_nouid32: set_opt (sbi->s_mount_opt, NO_UID32); break; +#ifndef CONFIG_INOXID_NONE + case Opt_tagxid: + set_opt (sbi->s_mount_opt, TAG_XID); + break; +#endif case Opt_check: #ifdef CONFIG_EXT3_CHECK set_opt (sbi->s_mount_opt, CHECK); @@ -1310,6 +1316,8 @@ static int ext3_fill_super (struct super_block *sb, void *data, int silent) if (!parse_options ((char *) data, sb, &journal_inum, NULL, 0)) goto failed_mount; + if (EXT3_SB(sb)->s_mount_opt & EXT3_MOUNT_TAG_XID) + sb->s_flags |= MS_TAGXID; sb->s_flags |= MS_ONE_SECOND; sb->s_flags = (sb->s_flags & ~MS_POSIXACL) | ((sbi->s_mount_opt & EXT3_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0); diff --git a/fs/fcntl.c b/fs/fcntl.c index 68b3d561c..4b75518ed 100644 --- a/fs/fcntl.c +++ b/fs/fcntl.c @@ -107,6 +107,8 @@ repeat: error = -EMFILE; if (newfd >= current->rlim[RLIMIT_NOFILE].rlim_cur) goto out; + if (!vx_files_avail(1)) + goto out; error = expand_files(files, newfd); if (error < 0) @@ -139,6 +141,7 @@ int dupfd(struct file *file, unsigned int start) FD_SET(fd, files->open_fds); FD_CLR(fd, files->close_on_exec); spin_unlock(&files->file_lock); + vx_openfd_inc(fd); fd_install(fd, file); } else { spin_unlock(&files->file_lock); @@ -188,6 +191,7 @@ asmlinkage long sys_dup2(unsigned int oldfd, unsigned int newfd) FD_SET(newfd, files->open_fds); FD_CLR(newfd, files->close_on_exec); spin_unlock(&files->file_lock); + vx_openfd_inc(newfd); if (tofree) filp_close(tofree, files); diff --git a/fs/file_table.c b/fs/file_table.c index 5d56ec5db..1894e3b34 100644 --- a/fs/file_table.c +++ b/fs/file_table.c @@ -87,6 +87,7 @@ static int old_max; f->f_owner.lock = RW_LOCK_UNLOCKED; /* f->f_version: 0 */ INIT_LIST_HEAD(&f->f_list); + vx_files_inc(f); return f; } } @@ -184,6 +185,7 @@ void fastcall __fput(struct file *file) fops_put(file->f_op); if (file->f_mode & FMODE_WRITE) put_write_access(inode); + vx_files_dec(file); file_kill(file); file->f_dentry = NULL; file->f_vfsmnt = NULL; diff --git a/fs/inode.c b/fs/inode.c index e5ee5a79b..1f847baad 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -114,6 +114,11 @@ static struct inode *alloc_inode(struct super_block *sb) struct address_space * const mapping = &inode->i_data; inode->i_sb = sb; + if (sb->s_flags & MS_TAGXID) + inode->i_xid = current->xid; + else + inode->i_xid = 0; /* maybe xid -1 would be better? */ + // inode->i_dqh = dqhget(sb->s_dqh); inode->i_blkbits = sb->s_blocksize_bits; inode->i_flags = 0; atomic_set(&inode->i_count, 1); @@ -133,6 +138,7 @@ static struct inode *alloc_inode(struct super_block *sb) inode->i_bdev = NULL; inode->i_cdev = NULL; inode->i_rdev = 0; + // inode->i_xid = 0; /* maybe not too wise ... */ inode->i_security = NULL; inode->dirtied_when = 0; if (security_inode_alloc(inode)) { diff --git a/fs/ioctl.c b/fs/ioctl.c index aef5391e4..12f3e71d2 100644 --- a/fs/ioctl.c +++ b/fs/ioctl.c @@ -9,10 +9,18 @@ #include #include #include +#include +#include +#include #include #include +#ifdef CONFIG_VSERVER_LEGACY +extern int vx_proc_ioctl(struct inode *, struct file *, + unsigned int, unsigned long); +#endif + static int file_ioctl(struct file *filp,unsigned int cmd,unsigned long arg) { int error; @@ -120,6 +128,48 @@ asmlinkage long sys_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) else error = -ENOTTY; break; +#ifdef CONFIG_VSERVER_LEGACY +#ifndef CONFIG_INOXID_NONE + case FIOC_GETXID: { + struct inode *inode = filp->f_dentry->d_inode; + + /* fixme: if stealth, return -ENOTTY */ + error = -EPERM; + if (capable(CAP_CONTEXT)) + error = put_user(inode->i_xid, (int *) arg); + break; + } + case FIOC_SETXID: { + struct inode *inode = filp->f_dentry->d_inode; + int xid; + + /* fixme: if stealth, return -ENOTTY */ + error = -EPERM; + if (!capable(CAP_CONTEXT)) + break; + error = -EROFS; + if (IS_RDONLY(inode)) + break; + error = -ENOSYS; + if (!(inode->i_sb->s_flags & MS_TAGXID)) + break; + error = -EFAULT; + if (get_user(xid, (int *) arg)) + break; + error = 0; + inode->i_xid = (xid & 0xFFFF); + inode->i_ctime = CURRENT_TIME; + mark_inode_dirty(inode); + break; + } +#endif + case FIOC_GETXFLG: + case FIOC_SETXFLG: + error = -ENOTTY; + if (filp->f_dentry->d_inode->i_sb->s_magic == PROC_SUPER_MAGIC) + error = vx_proc_ioctl(filp->f_dentry->d_inode, filp, cmd, arg); + break; +#endif default: error = -ENOTTY; if (S_ISREG(filp->f_dentry->d_inode->i_mode)) diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c index 865334f6c..848fbc8ba 100644 --- a/fs/jfs/jfs_imap.c +++ b/fs/jfs/jfs_imap.c @@ -44,6 +44,7 @@ #include #include #include +#include #include "jfs_incore.h" #include "jfs_filsys.h" @@ -3098,14 +3099,21 @@ static void duplicateIXtree(struct super_block *sb, s64 blkno, static int copy_from_dinode(struct dinode * dip, struct inode *ip) { struct jfs_inode_info *jfs_ip = JFS_IP(ip); + uid_t uid; + gid_t gid; jfs_ip->fileset = le32_to_cpu(dip->di_fileset); jfs_ip->mode2 = le32_to_cpu(dip->di_mode); ip->i_mode = le32_to_cpu(dip->di_mode) & 0xffff; ip->i_nlink = le32_to_cpu(dip->di_nlink); - ip->i_uid = le32_to_cpu(dip->di_uid); - ip->i_gid = le32_to_cpu(dip->di_gid); + + uid = le32_to_cpu(dip->di_uid); + gid = le32_to_cpu(dip->di_gid); + ip->i_uid = INOXID_UID(uid, gid); + ip->i_gid = INOXID_GID(uid, gid); + ip->i_xid = INOXID_XID(uid, gid, 0); + ip->i_size = le64_to_cpu(dip->di_size); ip->i_atime.tv_sec = le32_to_cpu(dip->di_atime.tv_sec); ip->i_atime.tv_nsec = le32_to_cpu(dip->di_atime.tv_nsec); @@ -3156,6 +3164,8 @@ static int copy_from_dinode(struct dinode * dip, struct inode *ip) static void copy_to_dinode(struct dinode * dip, struct inode *ip) { struct jfs_inode_info *jfs_ip = JFS_IP(ip); + uid_t uid; + gid_t gid; dip->di_fileset = cpu_to_le32(jfs_ip->fileset); dip->di_inostamp = cpu_to_le32(JFS_SBI(ip->i_sb)->inostamp); @@ -3164,8 +3174,11 @@ static void copy_to_dinode(struct dinode * dip, struct inode *ip) dip->di_size = cpu_to_le64(ip->i_size); dip->di_nblocks = cpu_to_le64(PBLK2LBLK(ip->i_sb, ip->i_blocks)); dip->di_nlink = cpu_to_le32(ip->i_nlink); - dip->di_uid = cpu_to_le32(ip->i_uid); - dip->di_gid = cpu_to_le32(ip->i_gid); + + uid = XIDINO_UID(ip->i_uid, ip->i_xid); + gid = XIDINO_GID(ip->i_gid, ip->i_xid); + dip->di_uid = cpu_to_le32(uid); + dip->di_gid = cpu_to_le32(gid); /* * mode2 is only needed for storing the higher order bits. * Trust i_mode for the lower order ones diff --git a/fs/namei.c b/fs/namei.c index df5b8f852..c2d43bbdf 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -163,6 +163,9 @@ int vfs_permission(struct inode * inode, int mask) { umode_t mode = inode->i_mode; + if (IS_BARRIER(inode) && !vx_check(0, VX_ADMIN|VX_WATCH)) + return -EACCES; + if (mask & MAY_WRITE) { /* * Nobody gets write access to a read-only fs. @@ -208,6 +211,15 @@ int vfs_permission(struct inode * inode, int mask) return -EACCES; } +static inline int xid_permission(struct inode *inode) +{ + if (inode->i_xid == 0) + return 0; + if (vx_check(inode->i_xid, VX_ADMIN|VX_WATCH|VX_IDENT)) + return 0; + return -EACCES; +} + int permission(struct inode * inode,int mask, struct nameidata *nd) { int retval; @@ -216,6 +228,8 @@ int permission(struct inode * inode,int mask, struct nameidata *nd) /* Ordinary permission routines do not understand MAY_APPEND. */ submask = mask & ~MAY_APPEND; + if ((retval = xid_permission(inode))) + return retval; if (inode->i_op && inode->i_op->permission) retval = inode->i_op->permission(inode, submask, nd); else @@ -1073,7 +1087,7 @@ static inline int may_delete(struct inode *dir,struct dentry *victim,int isdir) if (IS_APPEND(dir)) return -EPERM; if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)|| - IS_IMMUTABLE(victim->d_inode)) + IS_IXORUNLINK(victim->d_inode)) return -EPERM; if (isdir) { if (!S_ISDIR(victim->d_inode->i_mode)) @@ -1877,7 +1891,7 @@ int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_de /* * A link to an append-only or immutable file cannot be created. */ - if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) + if (IS_APPEND(inode) || IS_IXORUNLINK(inode)) return -EPERM; if (!dir->i_op || !dir->i_op->link) return -EPERM; diff --git a/fs/namespace.c b/fs/namespace.c index 2adae4289..d497b2d32 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -234,6 +234,9 @@ static int show_vfsmnt(struct seq_file *m, void *v) }; struct proc_fs_info *fs_infop; + if (vx_flags(VXF_HIDE_MOUNT, 0)) + return 0; + mangle(m, mnt->mnt_devname ? mnt->mnt_devname : "none"); seq_putc(m, ' '); seq_path(m, mnt, mnt->mnt_root, " \t\n\\"); @@ -333,18 +336,10 @@ int may_umount(struct vfsmount *mnt) EXPORT_SYMBOL(may_umount); -void umount_tree(struct vfsmount *mnt) +static inline void __umount_tree(struct vfsmount *mnt, struct list_head *kill) { - struct vfsmount *p; - LIST_HEAD(kill); - - for (p = mnt; p; p = next_mnt(p, mnt)) { - list_del(&p->mnt_list); - list_add(&p->mnt_list, &kill); - } - - while (!list_empty(&kill)) { - mnt = list_entry(kill.next, struct vfsmount, mnt_list); + while (!list_empty(kill)) { + mnt = list_entry(kill->next, struct vfsmount, mnt_list); list_del_init(&mnt->mnt_list); if (mnt->mnt_parent == mnt) { spin_unlock(&vfsmount_lock); @@ -359,6 +354,32 @@ void umount_tree(struct vfsmount *mnt) } } +void umount_tree(struct vfsmount *mnt) +{ + struct vfsmount *p; + LIST_HEAD(kill); + + for (p = mnt; p; p = next_mnt(p, mnt)) { + list_del(&p->mnt_list); + list_add(&p->mnt_list, &kill); + } + __umount_tree(mnt, &kill); +} + +void umount_unused(struct vfsmount *mnt, struct fs_struct *fs) +{ + struct vfsmount *p; + LIST_HEAD(kill); + + for (p = mnt; p; p = next_mnt(p, mnt)) { + if (p == fs->rootmnt || p == fs->pwdmnt) + continue; + list_del(&p->mnt_list); + list_add(&p->mnt_list, &kill); + } + __umount_tree(mnt, &kill); +} + static int do_umount(struct vfsmount *mnt, int flags) { struct super_block * sb = mnt->mnt_sb; @@ -456,7 +477,7 @@ asmlinkage long sys_umount(char __user * name, int flags) goto dput_and_out; retval = -EPERM; - if (!capable(CAP_SYS_ADMIN)) + if (!capable(CAP_SYS_ADMIN) && !vx_ccaps(VXC_SECURE_MOUNT)) goto dput_and_out; retval = do_umount(nd.mnt, flags); @@ -483,6 +504,8 @@ static int mount_is_safe(struct nameidata *nd) { if (capable(CAP_SYS_ADMIN)) return 0; + if (vx_ccaps(VXC_SECURE_MOUNT)) + return 0; return -EPERM; #ifdef notyet if (S_ISLNK(nd->dentry->d_inode->i_mode)) @@ -843,6 +866,9 @@ long do_mount(char * dev_name, char * dir_name, char *type_page, mnt_flags |= MNT_NOEXEC; flags &= ~(MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_ACTIVE); + if (vx_ccaps(VXC_SECURE_MOUNT)) + mnt_flags |= MNT_NODEV; + /* ... and get the mountpoint */ retval = path_lookup(dir_name, LOOKUP_FOLLOW, &nd); if (retval) diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c index 864615916..a561819b6 100644 --- a/fs/nfs/nfsroot.c +++ b/fs/nfs/nfsroot.c @@ -306,7 +306,7 @@ static int __init root_nfs_name(char *name) /* Override them by options set on kernel command-line */ root_nfs_parse(name, buf); - cp = system_utsname.nodename; + cp = vx_new_uts(nodename); if (strlen(buf) + strlen(cp) > NFS_MAXPATHLEN) { printk(KERN_ERR "Root-NFS: Pathname for remote directory too long.\n"); return -1; diff --git a/fs/open.c b/fs/open.c index 8bdcf32bd..a2566c942 100644 --- a/fs/open.c +++ b/fs/open.c @@ -22,6 +22,7 @@ #include #include #include +#include #include @@ -607,6 +608,9 @@ asmlinkage long sys_fchmod(unsigned int fd, mode_t mode) dentry = file->f_dentry; inode = dentry->d_inode; + err = -EPERM; + if (IS_BARRIER(inode) && !vx_check(0, VX_ADMIN)) + goto out_putf; err = -EROFS; if (IS_RDONLY(inode)) goto out_putf; @@ -639,6 +643,10 @@ asmlinkage long sys_chmod(const char __user * filename, mode_t mode) goto out; inode = nd.dentry->d_inode; + error = -EPERM; + if (IS_BARRIER(inode) && !vx_check(0, VX_ADMIN)) + goto dput_and_out; + error = -EROFS; if (IS_RDONLY(inode)) goto dput_and_out; @@ -678,14 +686,15 @@ static int chown_common(struct dentry * dentry, uid_t user, gid_t group) error = -EPERM; if (IS_IMMUTABLE(inode) || IS_APPEND(inode)) goto out; + newattrs.ia_valid = ATTR_CTIME; if (user != (uid_t) -1) { newattrs.ia_valid |= ATTR_UID; - newattrs.ia_uid = user; + newattrs.ia_uid = vx_map_uid(user); } if (group != (gid_t) -1) { newattrs.ia_valid |= ATTR_GID; - newattrs.ia_gid = group; + newattrs.ia_gid = vx_map_gid(group); } if (!S_ISDIR(inode->i_mode)) newattrs.ia_valid |= ATTR_KILL_SUID|ATTR_KILL_SGID; @@ -880,6 +889,7 @@ repeat: FD_SET(fd, files->open_fds); FD_CLR(fd, files->close_on_exec); files->next_fd = fd + 1; + vx_openfd_inc(fd); #if 1 /* Sanity check */ if (files->fd[fd] != NULL) { @@ -1033,6 +1043,7 @@ asmlinkage long sys_close(unsigned int fd) FD_CLR(fd, files->close_on_exec); __put_unused_fd(files, fd); spin_unlock(&files->file_lock); + vx_openfd_dec(fd); return filp_close(filp, files); out_unlock: diff --git a/fs/proc/array.c b/fs/proc/array.c index 190198240..ecce1806d 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -73,6 +73,7 @@ #include #include #include +#include #include #include @@ -128,7 +129,8 @@ static const char *task_state_array[] = { "D (disk sleep)", /* 2 */ "T (stopped)", /* 4 */ "Z (zombie)", /* 8 */ - "X (dead)" /* 16 */ + "X (dead)", /* 16 */ + "H (on hold)" /* 32 */ }; static inline const char * get_task_state(struct task_struct *tsk) @@ -137,7 +139,8 @@ static inline const char * get_task_state(struct task_struct *tsk) TASK_INTERRUPTIBLE | TASK_UNINTERRUPTIBLE | TASK_ZOMBIE | - TASK_STOPPED); + TASK_STOPPED | + TASK_ONHOLD); const char **p = &task_state_array[0]; while (state) { @@ -151,8 +154,10 @@ static inline char * task_state(struct task_struct *p, char *buffer) { struct group_info *group_info; int g; + pid_t ppid; read_lock(&tasklist_lock); + ppid = vx_map_tgid(current->vx_info, p->real_parent->pid); buffer += sprintf(buffer, "State:\t%s\n" "SleepAVG:\t%lu%%\n" @@ -165,7 +170,7 @@ static inline char * task_state(struct task_struct *p, char *buffer) get_task_state(p), (p->sleep_avg/1024)*100/(1020000000/1024), p->tgid, - p->pid, p->pid ? p->real_parent->pid : 0, + p->pid, p->pid ? ppid : 0, p->pid && p->ptrace ? p->parent->pid : 0, p->uid, p->euid, p->suid, p->fsuid, p->gid, p->egid, p->sgid, p->fsgid); @@ -278,6 +283,10 @@ extern char *task_mem(struct mm_struct *, char *); int proc_pid_status(struct task_struct *task, char * buffer) { char * orig = buffer; +#ifdef CONFIG_VSERVER_LEGACY + struct vx_info *vxi; + struct nx_info *nxi; +#endif struct mm_struct *mm = get_task_mm(task); buffer = task_name(task, buffer); @@ -289,6 +298,41 @@ int proc_pid_status(struct task_struct *task, char * buffer) } buffer = task_sig(task, buffer); buffer = task_cap(task, buffer); + +#ifdef CONFIG_VSERVER_LEGACY + buffer += sprintf (buffer,"s_context: %d\n", vx_task_xid(task)); + vxi = task_get_vx_info(task); + if (vxi) { + buffer += sprintf (buffer,"ctxflags: %08llx\n" + ,vxi->vx_flags); + buffer += sprintf (buffer,"initpid: %d\n" + ,vxi->vx_initpid); + } else { + buffer += sprintf (buffer,"ctxflags: none\n"); + buffer += sprintf (buffer,"initpid: none\n"); + } + put_vx_info(vxi); + nxi = task_get_nx_info(task); + if (nxi) { + int i; + + buffer += sprintf (buffer,"ipv4root:"); + for (i=0; inbipv4; i++){ + buffer += sprintf (buffer," %08x/%08x" + ,nxi->ipv4[i] + ,nxi->mask[i]); + } + *buffer++ = '\n'; + buffer += sprintf (buffer,"ipv4root_bcast: %08x\n" + ,nxi->v4_bcast); + buffer += sprintf (buffer,"ipv4root_refcnt: %d\n" + ,atomic_read(&nxi->nx_refcount)); + } else { + buffer += sprintf (buffer,"ipv4root: 0\n"); + buffer += sprintf (buffer,"ipv4root_bcast: 0\n"); + } + put_nx_info(nxi); +#endif #if defined(CONFIG_ARCH_S390) buffer = task_show_regs(task, buffer); #endif @@ -300,6 +344,7 @@ int proc_pid_stat(struct task_struct *task, char * buffer) { unsigned long vsize, eip, esp, wchan; long priority, nice; + unsigned long long bias_jiffies; int tty_pgrp = -1, tty_nr = 0; sigset_t sigign, sigcatch; char state; @@ -311,7 +356,16 @@ int proc_pid_stat(struct task_struct *task, char * buffer) state = *get_task_state(task); vsize = eip = esp = 0; + bias_jiffies = INITIAL_JIFFIES; + task_lock(task); + if (__vx_task_flags(task, VXF_VIRT_UPTIME, 0)) { + bias_jiffies = task->vx_info->cvirt.bias_jiffies; + /* hmm, do we need that? */ + if (bias_jiffies > task->start_time) + bias_jiffies = task->start_time; + } + mm = task->mm; if(mm) mm = mmgrab(mm); @@ -358,7 +412,7 @@ int proc_pid_stat(struct task_struct *task, char * buffer) read_unlock(&tasklist_lock); /* Temporary variable needed for gcc-2.96 */ - start_time = jiffies_64_to_clock_t(task->start_time - INITIAL_JIFFIES); + start_time = jiffies_64_to_clock_t(task->start_time - bias_jiffies); res = sprintf(buffer,"%d (%s) %c %d %d %d %d %d %lu %lu \ %lu %lu %lu %lu %lu %ld %ld %ld %ld %d %ld %llu %lu %ld %lu %lu %lu %lu %lu \ diff --git a/fs/proc/base.c b/fs/proc/base.c index 6bfde43f9..69f0a305d 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -32,6 +32,7 @@ #include #include #include +#include /* * For hysterical raisins we keep the same inumbers as in the old procfs. @@ -67,6 +68,8 @@ enum pid_directory_inos { PROC_TGID_ATTR_EXEC, PROC_TGID_ATTR_FSCREATE, #endif + PROC_TGID_VX_INFO, + PROC_TGID_IP_INFO, PROC_TGID_FD_DIR, PROC_TID_INO, PROC_TID_STATUS, @@ -90,6 +93,8 @@ enum pid_directory_inos { PROC_TID_ATTR_EXEC, PROC_TID_ATTR_FSCREATE, #endif + PROC_TID_VX_INFO, + PROC_TID_IP_INFO, PROC_TID_FD_DIR = 0x8000, /* 0x8000-0xffff */ }; @@ -123,6 +128,8 @@ static struct pid_entry tgid_base_stuff[] = { #ifdef CONFIG_KALLSYMS E(PROC_TGID_WCHAN, "wchan", S_IFREG|S_IRUGO), #endif + E(PROC_TGID_VX_INFO, "vinfo", S_IFREG|S_IRUGO), + E(PROC_TGID_IP_INFO, "ninfo", S_IFREG|S_IRUGO), {0,0,NULL,0} }; static struct pid_entry tid_base_stuff[] = { @@ -145,6 +152,8 @@ static struct pid_entry tid_base_stuff[] = { #ifdef CONFIG_KALLSYMS E(PROC_TID_WCHAN, "wchan", S_IFREG|S_IRUGO), #endif + E(PROC_TID_VX_INFO, "vinfo", S_IFREG|S_IRUGO), + E(PROC_TID_IP_INFO, "ninfo", S_IFREG|S_IRUGO), {0,0,NULL,0} }; @@ -954,6 +963,7 @@ static struct inode *proc_pid_make_inode(struct super_block * sb, struct task_st inode->i_uid = task->euid; inode->i_gid = task->egid; } + inode->i_xid = vx_task_xid(task); security_task_to_inode(task, inode); out: @@ -979,6 +989,11 @@ static int pid_revalidate(struct dentry *dentry, struct nameidata *nd) { struct inode *inode = dentry->d_inode; struct task_struct *task = proc_task(inode); + + if (!vx_check(vx_task_xid(task), VX_WATCH|VX_IDENT)) + goto out_drop; + /* discard wrong fakeinit */ + if (pid_alive(task)) { if (proc_type(inode) == PROC_TGID_INO || proc_type(inode) == PROC_TID_INO || task_dumpable(task)) { inode->i_uid = task->euid; @@ -990,6 +1005,7 @@ static int pid_revalidate(struct dentry *dentry, struct nameidata *nd) security_task_to_inode(task, inode); return 1; } +out_drop: d_drop(dentry); return 0; } @@ -1375,6 +1391,16 @@ static struct dentry *proc_pident_lookup(struct inode *dir, ei->op.proc_read = proc_pid_wchan; break; #endif + case PROC_TID_VX_INFO: + case PROC_TGID_VX_INFO: + inode->i_fop = &proc_info_file_operations; + ei->op.proc_read = proc_pid_vx_info; + break; + case PROC_TID_IP_INFO: + case PROC_TGID_IP_INFO: + inode->i_fop = &proc_info_file_operations; + ei->op.proc_read = proc_pid_nx_info; + break; default: printk("procfs: impossible type (%d)",p->type); iput(inode); @@ -1555,7 +1581,7 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct d_add(dentry, inode); return NULL; } - tgid = name_to_int(dentry); + tgid = vx_rmap_tgid(current->vx_info, name_to_int(dentry)); if (tgid == ~0U) goto out; @@ -1567,8 +1593,9 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct if (!task) goto out; - inode = proc_pid_make_inode(dir->i_sb, task, PROC_TGID_INO); - + inode = NULL; + if (vx_check(vx_task_xid(task), VX_WATCH|VX_IDENT)) + inode = proc_pid_make_inode(dir->i_sb, task, PROC_TGID_INO); if (!inode) { put_task_struct(task); @@ -1610,10 +1637,12 @@ static struct dentry *proc_task_lookup(struct inode *dir, struct dentry * dentry struct inode *inode; unsigned tid; - tid = name_to_int(dentry); + tid = vx_rmap_tgid(current->vx_info, name_to_int(dentry)); if (tid == ~0U) goto out; +/* handle fakeinit */ + read_lock(&tasklist_lock); task = find_task_by_pid(tid); if (task) @@ -1624,8 +1653,9 @@ static struct dentry *proc_task_lookup(struct inode *dir, struct dentry * dentry if (leader->tgid != task->tgid) goto out_drop_task; - inode = proc_pid_make_inode(dir->i_sb, task, PROC_TID_INO); - + inode = NULL; + if (vx_check(vx_task_xid(task), VX_WATCH|VX_IDENT)) + inode = proc_pid_make_inode(dir->i_sb, task, PROC_TID_INO); if (!inode) goto out_drop_task; @@ -1676,11 +1706,14 @@ static int get_tgid_list(int index, unsigned long version, unsigned int *tgids) for ( ; p != &init_task; p = next_task(p)) { int tgid = p->pid; + if (!pid_alive(p)) continue; + if (!vx_check(vx_task_xid(p), VX_WATCH|VX_IDENT)) + continue; if (--index >= 0) continue; - tgids[nr_tgids] = tgid; + tgids[nr_tgids] = vx_map_tgid(current->vx_info, tgid); nr_tgids++; if (nr_tgids >= PROC_MAXPIDS) break; @@ -1710,9 +1743,11 @@ static int get_tid_list(int index, unsigned int *tids, struct inode *dir) if (pid_alive(task)) do { int tid = task->pid; + if (!vx_check(vx_task_xid(task), VX_WATCH|VX_IDENT)) + continue; if (--index >= 0) continue; - tids[nr_tids] = tid; + tids[nr_tids] = vx_map_tgid(current->vx_info, tid); nr_tids++; if (nr_tids >= PROC_MAXPIDS) break; @@ -1766,11 +1801,14 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi unsigned int nr_tids, i; struct dentry *dentry = filp->f_dentry; struct inode *inode = dentry->d_inode; + struct task_struct *task = proc_task(inode); int retval = -ENOENT; ino_t ino; unsigned long pos = filp->f_pos; /* avoiding "long long" filp->f_pos */ - if (!pid_alive(proc_task(inode))) + if (!vx_check(vx_task_xid(task), VX_WATCH|VX_IDENT)) + goto out; + if (!pid_alive(task)) goto out; retval = 0; diff --git a/fs/proc/generic.c b/fs/proc/generic.c index 474bee886..32a3f8798 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -17,6 +17,8 @@ #include #include #include +#include +#include #include #include @@ -341,8 +343,15 @@ static int proc_delete_dentry(struct dentry * dentry) return 1; } +static int proc_revalidate_dentry(struct dentry *de, struct nameidata *nd) +{ + /* maybe add a check if it's really necessary? */ + return 0; +} + static struct dentry_operations proc_dentry_operations = { + .d_revalidate = proc_revalidate_dentry, .d_delete = proc_delete_dentry, }; @@ -362,6 +371,8 @@ struct dentry *proc_lookup(struct inode * dir, struct dentry *dentry, struct nam for (de = de->subdir; de ; de = de->next) { if (de->namelen != dentry->d_name.len) continue; + if (!vx_hide_check(0, de->vx_flags)) + continue; if (!memcmp(dentry->d_name.name, de->name, de->namelen)) { unsigned int ino = de->low_ino; @@ -438,9 +449,12 @@ int proc_readdir(struct file * filp, } do { + if (!vx_hide_check(0, de->vx_flags)) + goto skip; if (filldir(dirent, de->name, de->namelen, filp->f_pos, de->low_ino, de->mode >> 12) < 0) goto out; + skip: filp->f_pos++; de = de->next; } while (de); @@ -552,6 +566,7 @@ static struct proc_dir_entry *proc_create(struct proc_dir_entry **parent, ent->namelen = len; ent->mode = mode; ent->nlink = nlink; + ent->vx_flags = IATTR_PROC_DEFAULT; out: return ent; } @@ -572,7 +587,8 @@ struct proc_dir_entry *proc_symlink(const char *name, kfree(ent->data); kfree(ent); ent = NULL; - } + } else + ent->vx_flags = IATTR_PROC_SYMLINK; } else { kfree(ent); ent = NULL; diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 2d38f02c9..bf090daaf 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -211,6 +211,8 @@ struct inode *proc_get_inode(struct super_block *sb, unsigned int ino, inode->i_uid = de->uid; inode->i_gid = de->gid; } + if (de->vx_flags) + PROC_I(inode)->vx_flags = de->vx_flags; if (de->size) inode->i_size = de->size; if (de->nlink) diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c index 60e38c796..f96582d28 100644 --- a/fs/proc/proc_misc.c +++ b/fs/proc/proc_misc.c @@ -44,6 +44,7 @@ #include #include #include +#include #include #include #include @@ -144,6 +145,9 @@ static int uptime_read_proc(char *page, char **start, off_t off, do_posix_clock_monotonic_gettime(&uptime); jiffies_to_timespec(idle_jiffies, &idle); + if (vx_flags(VXF_VIRT_UPTIME, 0)) + vx_vsi_uptime(&uptime, &idle); + len = sprintf(page,"%lu.%02lu %lu.%02lu\n", (unsigned long) uptime.tv_sec, (uptime.tv_nsec / (NSEC_PER_SEC / 100)), diff --git a/fs/proc/root.c b/fs/proc/root.c index bf4b5d299..c84e88fe0 100644 --- a/fs/proc/root.c +++ b/fs/proc/root.c @@ -23,6 +23,9 @@ struct proc_dir_entry *proc_net, *proc_bus, *proc_root_fs, *proc_root_driver; #ifdef CONFIG_SYSCTL struct proc_dir_entry *proc_sys_root; #endif +struct proc_dir_entry *proc_virtual; + +extern void proc_vx_init(void); static struct super_block *proc_get_sb(struct file_system_type *fs_type, int flags, const char *dev_name, void *data) @@ -75,6 +78,7 @@ void __init proc_root_init(void) proc_device_tree_init(); #endif proc_bus = proc_mkdir("bus", 0); + proc_vx_init(); } static struct dentry *proc_root_lookup(struct inode * dir, struct dentry * dentry, struct nameidata *nd) diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c index 68050af43..402ba643f 100644 --- a/fs/reiserfs/inode.c +++ b/fs/reiserfs/inode.c @@ -17,6 +17,7 @@ #include #include #include +#include extern int reiserfs_default_io_size; /* default io size devuned in super.c */ @@ -1010,6 +1011,8 @@ static void init_inode (struct inode * inode, struct path * path) struct buffer_head * bh; struct item_head * ih; __u32 rdev; + uid_t uid; + gid_t gid; //int version = ITEM_VERSION_1; bh = PATH_PLAST_BUFFER (path); @@ -1033,12 +1036,13 @@ static void init_inode (struct inode * inode, struct path * path) struct stat_data_v1 * sd = (struct stat_data_v1 *)B_I_PITEM (bh, ih); unsigned long blocks; + uid = sd_v1_uid(sd); + gid = sd_v1_gid(sd); + set_inode_item_key_version (inode, KEY_FORMAT_3_5); set_inode_sd_version (inode, STAT_DATA_V1); inode->i_mode = sd_v1_mode(sd); inode->i_nlink = sd_v1_nlink(sd); - inode->i_uid = sd_v1_uid(sd); - inode->i_gid = sd_v1_gid(sd); inode->i_size = sd_v1_size(sd); inode->i_atime.tv_sec = sd_v1_atime(sd); inode->i_mtime.tv_sec = sd_v1_mtime(sd); @@ -1078,11 +1082,12 @@ static void init_inode (struct inode * inode, struct path * path) // (directories and symlinks) struct stat_data * sd = (struct stat_data *)B_I_PITEM (bh, ih); + uid = sd_v2_uid(sd); + gid = sd_v2_gid(sd); + inode->i_mode = sd_v2_mode(sd); inode->i_nlink = sd_v2_nlink(sd); - inode->i_uid = sd_v2_uid(sd); inode->i_size = sd_v2_size(sd); - inode->i_gid = sd_v2_gid(sd); inode->i_mtime.tv_sec = sd_v2_mtime(sd); inode->i_atime.tv_sec = sd_v2_atime(sd); inode->i_ctime.tv_sec = sd_v2_ctime(sd); @@ -1109,6 +1114,9 @@ static void init_inode (struct inode * inode, struct path * path) REISERFS_I(inode)->i_attrs = sd_v2_attrs( sd ); sd_attrs_to_i_attrs( sd_v2_attrs( sd ), inode ); } + inode->i_uid = INOXID_UID(uid, gid); + inode->i_gid = INOXID_GID(uid, gid); + inode->i_xid = INOXID_XID(uid, gid, 0); pathrelse (path); if (S_ISREG (inode->i_mode)) { @@ -1133,13 +1141,15 @@ static void init_inode (struct inode * inode, struct path * path) static void inode2sd (void * sd, struct inode * inode, loff_t size) { struct stat_data * sd_v2 = (struct stat_data *)sd; + uid_t uid = XIDINO_UID(inode->i_uid, inode->i_xid); + gid_t gid = XIDINO_GID(inode->i_gid, inode->i_xid); __u16 flags; + set_sd_v2_uid(sd_v2, uid ); + set_sd_v2_gid(sd_v2, gid ); set_sd_v2_mode(sd_v2, inode->i_mode ); set_sd_v2_nlink(sd_v2, inode->i_nlink ); - set_sd_v2_uid(sd_v2, inode->i_uid ); set_sd_v2_size(sd_v2, size ); - set_sd_v2_gid(sd_v2, inode->i_gid ); set_sd_v2_mtime(sd_v2, inode->i_mtime.tv_sec ); set_sd_v2_atime(sd_v2, inode->i_atime.tv_sec ); set_sd_v2_ctime(sd_v2, inode->i_ctime.tv_sec ); @@ -2429,6 +2439,14 @@ void sd_attrs_to_i_attrs( __u16 sd_attrs, struct inode *inode ) inode -> i_flags |= S_IMMUTABLE; else inode -> i_flags &= ~S_IMMUTABLE; + if( sd_attrs & REISERFS_IUNLINK_FL ) + inode -> i_flags |= S_IUNLINK; + else + inode -> i_flags &= ~S_IUNLINK; + if( sd_attrs & REISERFS_BARRIER_FL ) + inode -> i_flags |= S_BARRIER; + else + inode -> i_flags &= ~S_BARRIER; if( sd_attrs & REISERFS_APPEND_FL ) inode -> i_flags |= S_APPEND; else @@ -2451,6 +2469,14 @@ void i_attrs_to_sd_attrs( struct inode *inode, __u16 *sd_attrs ) *sd_attrs |= REISERFS_IMMUTABLE_FL; else *sd_attrs &= ~REISERFS_IMMUTABLE_FL; + if( inode -> i_flags & S_IUNLINK ) + *sd_attrs |= REISERFS_IUNLINK_FL; + else + *sd_attrs &= ~REISERFS_IUNLINK_FL; + if( inode -> i_flags & S_BARRIER ) + *sd_attrs |= REISERFS_BARRIER_FL; + else + *sd_attrs &= ~REISERFS_BARRIER_FL; if( inode -> i_flags & S_SYNC ) *sd_attrs |= REISERFS_SYNC_FL; else @@ -2611,11 +2637,36 @@ static ssize_t reiserfs_direct_IO(int rw, struct kiocb *iocb, offset, nr_segs, reiserfs_get_blocks_direct_io, NULL); } +int reiserfs_setattr_flags(struct inode *inode, unsigned int flags) +{ + unsigned int oldflags, newflags; + + oldflags = REISERFS_I(inode)->i_flags; + newflags = oldflags & ~(REISERFS_IMMUTABLE_FL | + REISERFS_IUNLINK_FL | REISERFS_BARRIER_FL); + if (flags & ATTR_FLAG_IMMUTABLE) + newflags |= REISERFS_IMMUTABLE_FL; + if (flags & ATTR_FLAG_IUNLINK) + newflags |= REISERFS_IUNLINK_FL; + if (flags & ATTR_FLAG_BARRIER) + newflags |= REISERFS_BARRIER_FL; + + if (oldflags ^ newflags) { + REISERFS_I(inode)->i_flags = newflags; + inode->i_ctime = CURRENT_TIME; + } + return 0; +} + int reiserfs_setattr(struct dentry *dentry, struct iattr *attr) { struct inode *inode = dentry->d_inode ; int error ; unsigned int ia_valid = attr->ia_valid; + reiserfs_write_lock(inode->i_sb); + if (S_ISDIR(inode->i_mode)) + goto is_dir; + if (attr->ia_valid & ATTR_SIZE) { /* version 2 items will be caught by the s_maxbytes check ** done for us in vmtruncate @@ -2648,7 +2699,12 @@ int reiserfs_setattr(struct dentry *dentry, struct iattr *attr) { goto out; } + is_dir: error = inode_change_ok(inode, attr) ; + + if (!error && attr->ia_valid & ATTR_ATTR_FLAG) + reiserfs_setattr_flags(inode, attr->ia_attr_flags); + if (!error) { if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) || (ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid)) { diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c index 7f2fba5e1..b1f32fc27 100644 --- a/fs/reiserfs/ioctl.c +++ b/fs/reiserfs/ioctl.c @@ -20,7 +20,7 @@ int reiserfs_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, unsigned long arg) { - unsigned int flags; + unsigned int flags, oldflags; switch (cmd) { case REISERFS_IOC_UNPACK: @@ -36,6 +36,7 @@ int reiserfs_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, case REISERFS_IOC_GETFLAGS: flags = REISERFS_I(inode) -> i_attrs; i_attrs_to_sd_attrs( inode, ( __u16 * ) &flags ); + flags &= REISERFS_FL_USER_VISIBLE; return put_user(flags, (int __user *) arg); case REISERFS_IOC_SETFLAGS: { if (IS_RDONLY(inode)) @@ -47,7 +48,9 @@ int reiserfs_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, if (get_user(flags, (int __user *) arg)) return -EFAULT; - if ( ( ( flags ^ REISERFS_I(inode) -> i_attrs) & ( REISERFS_IMMUTABLE_FL | REISERFS_APPEND_FL)) && + oldflags = REISERFS_I(inode) -> i_attrs; + if ( ( ( flags ^ oldflags) & + ( REISERFS_IMMUTABLE_FL | REISERFS_IUNLINK_FL | REISERFS_APPEND_FL)) && !capable( CAP_LINUX_IMMUTABLE ) ) return -EPERM; @@ -59,6 +62,9 @@ int reiserfs_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, if( result ) return result; } + + flags = flags & REISERFS_FL_USER_MODIFYABLE; + flags |= oldflags & ~REISERFS_FL_USER_MODIFYABLE; sd_attrs_to_i_attrs( flags, inode ); REISERFS_I(inode) -> i_attrs = flags; inode->i_ctime = CURRENT_TIME; diff --git a/fs/xfs/xfs_dinode.h b/fs/xfs/xfs_dinode.h index e0b529b33..f8f6e0fe6 100644 --- a/fs/xfs/xfs_dinode.h +++ b/fs/xfs/xfs_dinode.h @@ -456,6 +456,9 @@ xfs_dinode_t *xfs_buf_to_dinode(struct xfs_buf *bp); #define XFS_DIFLAG_SYNC_BIT 5 /* inode is written synchronously */ #define XFS_DIFLAG_NOATIME_BIT 6 /* do not update atime */ #define XFS_DIFLAG_NODUMP_BIT 7 /* do not dump */ +#define XFS_DIFLAG_BARRIER_BIT 10 /* chroot() barrier */ +#define XFS_DIFLAG_IUNLINK_BIT 11 /* inode has iunlink */ + #define XFS_DIFLAG_REALTIME (1 << XFS_DIFLAG_REALTIME_BIT) #define XFS_DIFLAG_PREALLOC (1 << XFS_DIFLAG_PREALLOC_BIT) #define XFS_DIFLAG_NEWRTBM (1 << XFS_DIFLAG_NEWRTBM_BIT) @@ -464,5 +467,8 @@ xfs_dinode_t *xfs_buf_to_dinode(struct xfs_buf *bp); #define XFS_DIFLAG_SYNC (1 << XFS_DIFLAG_SYNC_BIT) #define XFS_DIFLAG_NOATIME (1 << XFS_DIFLAG_NOATIME_BIT) #define XFS_DIFLAG_NODUMP (1 << XFS_DIFLAG_NODUMP_BIT) +#define XFS_DIFLAG_BARRIER (1 << XFS_DIFLAG_BARRIER_BIT) +#define XFS_DIFLAG_IUNLINK (1 << XFS_DIFLAG_IUNLINK_BIT) + #endif /* __XFS_DINODE_H__ */ diff --git a/fs/xfs/xfs_fs.h b/fs/xfs/xfs_fs.h index 1ed650e90..7e1b82c4f 100644 --- a/fs/xfs/xfs_fs.h +++ b/fs/xfs/xfs_fs.h @@ -76,6 +76,8 @@ struct fsxattr { #define XFS_XFLAG_SYNC 0x00000020 /* all writes synchronous */ #define XFS_XFLAG_NOATIME 0x00000040 /* do not update access time */ #define XFS_XFLAG_NODUMP 0x00000080 /* do not include in backups */ +#define XFS_XFLAG_BARRIER 0x00004000 /* chroot() barrier */ +#define XFS_XFLAG_IUNLINK 0x00008000 /* Immutable unlink */ #define XFS_XFLAG_HASATTR 0x80000000 /* no DIFLAG for this */ /* diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c index ab973fe10..92a4c654e 100644 --- a/fs/xfs/xfs_inode.c +++ b/fs/xfs/xfs_inode.c @@ -869,6 +869,10 @@ xfs_dic2xflags( flags |= XFS_XFLAG_PREALLOC; if (di_flags & XFS_DIFLAG_IMMUTABLE) flags |= XFS_XFLAG_IMMUTABLE; + if (di_flags & XFS_DIFLAG_IUNLINK) + flags |= XFS_XFLAG_IUNLINK; + if (di_flags & XFS_DIFLAG_BARRIER) + flags |= XFS_XFLAG_BARRIER; if (di_flags & XFS_DIFLAG_APPEND) flags |= XFS_XFLAG_APPEND; if (di_flags & XFS_DIFLAG_SYNC) diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c index ab9b4d181..2777aca04 100644 --- a/fs/xfs/xfs_vnodeops.c +++ b/fs/xfs/xfs_vnodeops.c @@ -835,6 +835,10 @@ xfs_setattr( } if (vap->va_xflags & XFS_XFLAG_IMMUTABLE) ip->i_d.di_flags |= XFS_DIFLAG_IMMUTABLE; + if (vap->va_xflags & XFS_XFLAG_IUNLINK) + ip->i_d.di_flags |= XFS_DIFLAG_IUNLINK; + if (vap->va_xflags & XFS_XFLAG_BARRIER) + ip->i_d.di_flags |= XFS_DIFLAG_BARRIER; if (vap->va_xflags & XFS_XFLAG_APPEND) ip->i_d.di_flags |= XFS_DIFLAG_APPEND; if (vap->va_xflags & XFS_XFLAG_SYNC) diff --git a/include/asm-alpha/unistd.h b/include/asm-alpha/unistd.h index ceda5fc56..aae3ab664 100644 --- a/include/asm-alpha/unistd.h +++ b/include/asm-alpha/unistd.h @@ -233,6 +233,7 @@ #define __NR_osf_memcntl 260 /* not implemented */ #define __NR_osf_fdatasync 261 /* not implemented */ +#define __NR_vserver 273 /* * Linux-specific system calls begin at 300 diff --git a/include/asm-arm/tlb.h b/include/asm-arm/tlb.h index ab3cad4fb..a21e6a01e 100644 --- a/include/asm-arm/tlb.h +++ b/include/asm-arm/tlb.h @@ -58,7 +58,8 @@ tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end) if (rss < freed) freed = rss; - mm->rss = rss - freed; + // mm->rss = rss - freed; + vx_rsspages_sub(mm, freed); if (freed) { flush_tlb_mm(mm); diff --git a/include/asm-arm26/tlb.h b/include/asm-arm26/tlb.h index ee6d11d86..214185e68 100644 --- a/include/asm-arm26/tlb.h +++ b/include/asm-arm26/tlb.h @@ -38,7 +38,8 @@ tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end) if (rss < freed) freed = rss; - mm->rss = rss - freed; + // mm->rss = rss - freed; + vx_rsspages_sub(mm, freed); if (freed) { flush_tlb_mm(mm); diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h index 1358c5136..aa7d3c093 100644 --- a/include/asm-generic/tlb.h +++ b/include/asm-generic/tlb.h @@ -15,6 +15,7 @@ #include #include +#include #include /* @@ -91,7 +92,8 @@ tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end) if (rss < freed) freed = rss; - mm->rss = rss - freed; + // mm->rss = rss - freed; + vx_rsspages_sub(mm, freed); tlb_flush_mmu(tlb, start, end); /* keep the page table cache within bounds */ diff --git a/include/asm-ia64/tlb.h b/include/asm-ia64/tlb.h index 5d714b206..f1ff70964 100644 --- a/include/asm-ia64/tlb.h +++ b/include/asm-ia64/tlb.h @@ -163,7 +163,8 @@ tlb_finish_mmu (struct mmu_gather *tlb, unsigned long start, unsigned long end) if (rss < freed) freed = rss; - mm->rss = rss - freed; + // mm->rss = rss - freed; + vx_rsspages_sub(mm, freed); /* * Note: tlb->nr may be 0 at this point, so we can't rely on tlb->start_addr and * tlb->end_addr. diff --git a/include/asm-m68k/unistd.h b/include/asm-m68k/unistd.h index 0bf278903..65806ca4e 100644 --- a/include/asm-m68k/unistd.h +++ b/include/asm-m68k/unistd.h @@ -239,7 +239,9 @@ #define __NR_fremovexattr 234 #define __NR_futex 235 -#define NR_syscalls 236 +#define __NR_vserver 273 + +#define NR_syscalls 274 /* user-visible error numbers are in the range -1 - -124: see */ diff --git a/include/asm-m68knommu/unistd.h b/include/asm-m68knommu/unistd.h index 6f35eb257..bf2f87892 100644 --- a/include/asm-m68knommu/unistd.h +++ b/include/asm-m68knommu/unistd.h @@ -221,7 +221,9 @@ #define __NR_setfsuid32 215 #define __NR_setfsgid32 216 -#define NR_syscalls 256 +#define __NR_vserver 273 + +#define NR_syscalls 274 /* user-visible error numbers are in the range -1 - -122: see */ diff --git a/include/asm-mips/unistd.h b/include/asm-mips/unistd.h index 22d59d82b..40a96a4e9 100644 --- a/include/asm-mips/unistd.h +++ b/include/asm-mips/unistd.h @@ -288,20 +288,21 @@ #define __NR_clock_nanosleep (__NR_Linux + 265) #define __NR_tgkill (__NR_Linux + 266) #define __NR_utimes (__NR_Linux + 267) -#define __NR_mbind (__NR_Linux + 268) -#define __NR_get_mempolicy (__NR_Linux + 269) -#define __NR_set_mempolicy (__NR_Linux + 270) -#define __NR_mq_open (__NR_Linux + 271) -#define __NR_mq_unlink (__NR_Linux + 272) -#define __NR_mq_timedsend (__NR_Linux + 273) -#define __NR_mq_timedreceive (__NR_Linux + 274) -#define __NR_mq_notify (__NR_Linux + 275) -#define __NR_mq_getsetattr (__NR_Linux + 276) +#define __NR_vserver (__NR_Linux + 273) +#define __NR_mbind (__NR_Linux + 274) +#define __NR_get_mempolicy (__NR_Linux + 275) +#define __NR_set_mempolicy (__NR_Linux + 276) +#define __NR_mq_open (__NR_Linux + 277) +#define __NR_mq_unlink (__NR_Linux + 278) +#define __NR_mq_timedsend (__NR_Linux + 279) +#define __NR_mq_timedreceive (__NR_Linux + 280) +#define __NR_mq_notify (__NR_Linux + 281) +#define __NR_mq_getsetattr (__NR_Linux + 282) /* * Offset of the last Linux o32 flavoured syscall */ -#define __NR_Linux_syscalls 276 +#define __NR_Linux_syscalls 282 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */ diff --git a/include/asm-parisc/unistd.h b/include/asm-parisc/unistd.h index de710ff4e..1c410cdb3 100644 --- a/include/asm-parisc/unistd.h +++ b/include/asm-parisc/unistd.h @@ -728,7 +728,9 @@ #define __NR_mq_notify (__NR_Linux + 233) #define __NR_mq_getsetattr (__NR_Linux + 234) -#define __NR_Linux_syscalls 235 +#define __NR_vserver (__NR_Linux + 273) + +#define __NR_Linux_syscalls 273 #define HPUX_GATEWAY_ADDR 0xC0000004 #define LINUX_GATEWAY_ADDR 0x100 diff --git a/include/asm-ppc/unistd.h b/include/asm-ppc/unistd.h index dd6e92e8d..388789e68 100644 --- a/include/asm-ppc/unistd.h +++ b/include/asm-ppc/unistd.h @@ -261,7 +261,7 @@ #define __NR_fadvise64_64 254 #define __NR_rtas 255 /* Number 256 is reserved for sys_debug_setcontext */ -/* Number 257 is reserved for vserver */ +#define __NR_vserver 257 /* Number 258 is reserved for new sys_remap_file_pages */ /* Number 259 is reserved for new sys_mbind */ /* Number 260 is reserved for new sys_get_mempolicy */ diff --git a/include/asm-ppc64/unistd.h b/include/asm-ppc64/unistd.h index 7f38d35f1..39ffcca2f 100644 --- a/include/asm-ppc64/unistd.h +++ b/include/asm-ppc64/unistd.h @@ -267,7 +267,7 @@ #define __NR_fadvise64_64 254 #define __NR_rtas 255 /* Number 256 is reserved for sys_debug_setcontext */ -/* Number 257 is reserved for vserver */ +#define __NR_vserver 257 /* Number 258 is reserved for new sys_remap_file_pages */ /* Number 259 is reserved for new sys_mbind */ /* Number 260 is reserved for new sys_get_mempolicy */ diff --git a/include/asm-s390/unistd.h b/include/asm-s390/unistd.h index 785c764cb..874e25d7f 100644 --- a/include/asm-s390/unistd.h +++ b/include/asm-s390/unistd.h @@ -255,7 +255,7 @@ #define __NR_clock_gettime (__NR_timer_create+6) #define __NR_clock_getres (__NR_timer_create+7) #define __NR_clock_nanosleep (__NR_timer_create+8) -/* Number 263 is reserved for vserver */ +#define __NR_vserver 263 #define __NR_fadvise64_64 264 #define __NR_statfs64 265 #define __NR_fstatfs64 266 diff --git a/include/asm-sparc/unistd.h b/include/asm-sparc/unistd.h index 62eaacd9f..b742c9f4d 100644 --- a/include/asm-sparc/unistd.h +++ b/include/asm-sparc/unistd.h @@ -283,7 +283,7 @@ #define __NR_timer_getoverrun 264 #define __NR_timer_delete 265 #define __NR_timer_create 266 -/* #define __NR_vserver 267 Reserved for VSERVER */ +#define __NR_vserver 267 #define __NR_io_setup 268 #define __NR_io_destroy 269 #define __NR_io_submit 270 diff --git a/include/asm-sparc64/unistd.h b/include/asm-sparc64/unistd.h index 1309641df..e907d845b 100644 --- a/include/asm-sparc64/unistd.h +++ b/include/asm-sparc64/unistd.h @@ -285,7 +285,7 @@ #define __NR_timer_getoverrun 264 #define __NR_timer_delete 265 #define __NR_timer_create 266 -/* #define __NR_vserver 267 Reserved for VSERVER */ +#define __NR_vserver 267 #define __NR_io_setup 268 #define __NR_io_destroy 269 #define __NR_io_submit 270 diff --git a/include/linux/autoconf.h b/include/linux/autoconf.h index 546d52177..c4806367f 100644 --- a/include/linux/autoconf.h +++ b/include/linux/autoconf.h @@ -2297,6 +2297,18 @@ #define CONFIG_X86_FIND_SMP_CONFIG 1 #define CONFIG_X86_MPPARSE 1 +/* + * Linux VServer + */ +#define CONFIG_VSERVER_LEGACY 1 +#define CONFIG_PROC_SECURE 1 +#undef CONFIG_VSERVER_HARDCPU +#undef CONFIG_INOXID_NONE +#undef CONFIG_INOXID_GID16 +#define CONFIG_INOXID_GID24 1 +#undef CONFIG_INOXID_GID32 +#undef CONFIG_INOXID_MAGIC + /* * Security options */ diff --git a/include/linux/capability.h b/include/linux/capability.h index c96e7b624..7798d2c26 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h @@ -235,6 +235,7 @@ typedef __u32 kernel_cap_t; /* Allow enabling/disabling tagged queuing on SCSI controllers and sending arbitrary SCSI commands */ /* Allow setting encryption key on loopback filesystem */ +/* Allow the selection of a security context */ #define CAP_SYS_ADMIN 21 @@ -284,6 +285,11 @@ typedef __u32 kernel_cap_t; #define CAP_LEASE 28 +/* Allow context manipulations */ +/* Allow changing context info on files */ + +#define CAP_CONTEXT 29 + #ifdef __KERNEL__ /* * Bounding set diff --git a/include/linux/ext2_fs.h b/include/linux/ext2_fs.h index d701ba88c..7c6f650c9 100644 --- a/include/linux/ext2_fs.h +++ b/include/linux/ext2_fs.h @@ -192,6 +192,8 @@ struct ext2_group_desc #define EXT2_NOTAIL_FL 0x00008000 /* file tail should not be merged */ #define EXT2_DIRSYNC_FL 0x00010000 /* dirsync behaviour (directories only) */ #define EXT2_TOPDIR_FL 0x00020000 /* Top of directory hierarchies*/ +#define EXT2_BARRIER_FL 0x04000000 /* Barrier for chroot() */ +#define EXT2_IUNLINK_FL 0x08000000 /* Immutable unlink */ #define EXT2_RESERVED_FL 0x80000000 /* reserved for ext2 lib */ #define EXT2_FL_USER_VISIBLE 0x0003DFFF /* User visible flags */ @@ -240,7 +242,7 @@ struct ext2_inode { struct { __u8 l_i_frag; /* Fragment number */ __u8 l_i_fsize; /* Fragment size */ - __u16 i_pad1; + __u16 l_i_xid; /* LRU Context */ __u16 l_i_uid_high; /* these 2 fields */ __u16 l_i_gid_high; /* were reserved2[0] */ __u32 l_i_reserved2; @@ -272,6 +274,7 @@ struct ext2_inode { #define i_gid_low i_gid #define i_uid_high osd2.linux2.l_i_uid_high #define i_gid_high osd2.linux2.l_i_gid_high +#define i_raw_xid osd2.linux2.l_i_xid #define i_reserved2 osd2.linux2.l_i_reserved2 #endif @@ -312,6 +315,7 @@ struct ext2_inode { #define EXT2_MOUNT_NO_UID32 0x0200 /* Disable 32-bit UIDs */ #define EXT2_MOUNT_XATTR_USER 0x4000 /* Extended user attributes */ #define EXT2_MOUNT_POSIX_ACL 0x8000 /* POSIX Access Control Lists */ +#define EXT2_MOUNT_TAG_XID (1<<16) /* Enable Context Tags */ #define clear_opt(o, opt) o &= ~EXT2_MOUNT_##opt #define set_opt(o, opt) o |= EXT2_MOUNT_##opt diff --git a/include/linux/ext3_fs.h b/include/linux/ext3_fs.h index a4440a9f9..6e4497d8d 100644 --- a/include/linux/ext3_fs.h +++ b/include/linux/ext3_fs.h @@ -184,6 +184,8 @@ struct ext3_group_desc #define EXT3_NOTAIL_FL 0x00008000 /* file tail should not be merged */ #define EXT3_DIRSYNC_FL 0x00010000 /* dirsync behaviour (directories only) */ #define EXT3_TOPDIR_FL 0x00020000 /* Top of directory hierarchies*/ +#define EXT3_BARRIER_FL 0x04000000 /* Barrier for chroot() */ +#define EXT3_IUNLINK_FL 0x08000000 /* Immutable unlink */ #define EXT3_RESERVED_FL 0x80000000 /* reserved for ext3 lib */ #define EXT3_FL_USER_VISIBLE 0x0003DFFF /* User visible flags */ @@ -237,6 +239,9 @@ struct ext3_new_group_data { #endif #define EXT3_IOC_GETRSVSZ _IOR('r', 1, long) #define EXT3_IOC_SETRSVSZ _IOW('r', 2, long) +#ifdef CONFIG_VSERVER_LEGACY +#define EXT3_IOC_SETXID FIOC_SETXIDJ +#endif /* * Structure of an inode on the disk @@ -273,7 +278,7 @@ struct ext3_inode { struct { __u8 l_i_frag; /* Fragment number */ __u8 l_i_fsize; /* Fragment size */ - __u16 i_pad1; + __u16 l_i_xid; /* LRU Context */ __u16 l_i_uid_high; /* these 2 fields */ __u16 l_i_gid_high; /* were reserved2[0] */ __u32 l_i_reserved2; @@ -305,6 +310,7 @@ struct ext3_inode { #define i_gid_low i_gid #define i_uid_high osd2.linux2.l_i_uid_high #define i_gid_high osd2.linux2.l_i_gid_high +#define i_raw_xid osd2.linux2.l_i_xid #define i_reserved2 osd2.linux2.l_i_reserved2 #elif defined(__GNU__) @@ -354,6 +360,7 @@ struct ext3_inode { #define EXT3_MOUNT_XATTR_USER 0x04000 /* Extended user attributes */ #define EXT3_MOUNT_POSIX_ACL 0x08000 /* POSIX Access Control Lists */ #define EXT3_MOUNT_RESERVATION 0x10000 /* Preallocation */ +#define EXT3_MOUNT_TAG_XID 0x20000 /* Enable Context Tags */ /* Compatibility, for having both ext2_fs.h and ext3_fs.h included at once */ #ifndef _LINUX_EXT2_FS_H diff --git a/include/linux/fs.h b/include/linux/fs.h index bd4c362af..0f6c1e938 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -114,6 +114,7 @@ extern int leases_enable, dir_notify_enable, lease_break_time; #define MS_VERBOSE 32768 #define MS_POSIXACL (1<<16) /* VFS does not apply the umask */ #define MS_ONE_SECOND (1<<17) /* fs has 1 sec a/m/ctime resolution */ +#define MS_TAGXID (1<<24) /* tag inodes with context information */ #define MS_ACTIVE (1<<30) #define MS_NOUSER (1<<31) @@ -140,6 +141,8 @@ extern int leases_enable, dir_notify_enable, lease_break_time; #define S_NOQUOTA 64 /* Inode is not counted to quota */ #define S_DIRSYNC 128 /* Directory modifications are synchronous */ #define S_NOCMTIME 256 /* Do not update file c/mtime */ +#define S_BARRIER 512 /* Barrier for chroot() */ +#define S_IUNLINK 1024 /* Immutable unlink */ /* * Note that nosuid etc flags are inode-specific: setting some file-system @@ -167,11 +170,14 @@ extern int leases_enable, dir_notify_enable, lease_break_time; #define IS_NOQUOTA(inode) ((inode)->i_flags & S_NOQUOTA) #define IS_APPEND(inode) ((inode)->i_flags & S_APPEND) #define IS_IMMUTABLE(inode) ((inode)->i_flags & S_IMMUTABLE) +#define IS_IUNLINK(inode) ((inode)->i_flags & S_IUNLINK) +#define IS_IXORUNLINK(inode) ((IS_IUNLINK(inode) ? S_IMMUTABLE : 0) ^ IS_IMMUTABLE(inode)) #define IS_NOATIME(inode) (__IS_FLG(inode, MS_NOATIME) || ((inode)->i_flags & S_NOATIME)) #define IS_NODIRATIME(inode) __IS_FLG(inode, MS_NODIRATIME) #define IS_POSIXACL(inode) __IS_FLG(inode, MS_POSIXACL) #define IS_ONE_SECOND(inode) __IS_FLG(inode, MS_ONE_SECOND) +#define IS_BARRIER(inode) (S_ISDIR((inode)->i_mode) && ((inode)->i_flags & S_BARRIER)) #define IS_DEADDIR(inode) ((inode)->i_flags & S_DEAD) #define IS_NOCMTIME(inode) ((inode)->i_flags & S_NOCMTIME) @@ -281,6 +287,9 @@ struct iattr { #define ATTR_FLAG_IMMUTABLE 8 /* Immutable file */ #define ATTR_FLAG_NODIRATIME 16 /* Don't update atime for directory */ +#define ATTR_FLAG_BARRIER 512 /* Barrier for chroot() */ +#define ATTR_FLAG_IUNLINK 1024 /* Immutable unlink */ + /* * Includes for diskquotas. */ @@ -418,6 +427,7 @@ struct inode { unsigned int i_nlink; uid_t i_uid; gid_t i_gid; + xid_t i_xid; dev_t i_rdev; loff_t i_size; struct timespec i_atime; diff --git a/include/linux/init_task.h b/include/linux/init_task.h index 29189706e..3ba25d682 100644 --- a/include/linux/init_task.h +++ b/include/linux/init_task.h @@ -112,6 +112,10 @@ extern struct group_info init_groups; .proc_lock = SPIN_LOCK_UNLOCKED, \ .switch_lock = SPIN_LOCK_UNLOCKED, \ .journal_info = NULL, \ + .xid = 0, \ + .nid = 0, \ + .vx_info = NULL, \ + .nx_info = NULL, \ } diff --git a/include/linux/ip.h b/include/linux/ip.h index ab799b48b..5ea190d1b 100644 --- a/include/linux/ip.h +++ b/include/linux/ip.h @@ -111,6 +111,7 @@ struct inet_opt { /* Socket demultiplex comparisons on incoming packets. */ __u32 daddr; /* Foreign IPv4 addr */ __u32 rcv_saddr; /* Bound local IPv4 addr */ + __u32 rcv_saddr2; /* Second bound ipv4 addr, for ipv4root */ __u16 dport; /* Destination port */ __u16 num; /* Local port */ __u32 saddr; /* Sending source */ diff --git a/include/linux/ipc.h b/include/linux/ipc.h index b29118973..079c2feb3 100644 --- a/include/linux/ipc.h +++ b/include/linux/ipc.h @@ -66,6 +66,7 @@ struct kern_ipc_perm mode_t mode; unsigned long seq; void *security; + xid_t xid; }; #endif /* __KERNEL__ */ diff --git a/include/linux/mm.h b/include/linux/mm.h index 09e6742dd..76a8070d7 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -12,6 +12,7 @@ #include #include #include +#include #include struct mempolicy; diff --git a/include/linux/namespace.h b/include/linux/namespace.h index fdd8abb07..ae9c17d6e 100644 --- a/include/linux/namespace.h +++ b/include/linux/namespace.h @@ -13,6 +13,7 @@ struct namespace { }; extern void umount_tree(struct vfsmount *); +extern void umount_unused(struct vfsmount *, struct fs_struct *); extern int copy_namespace(int, struct task_struct *); void __put_namespace(struct namespace *namespace); diff --git a/include/linux/net.h b/include/linux/net.h index a4684166d..1f531a9b5 100644 --- a/include/linux/net.h +++ b/include/linux/net.h @@ -60,6 +60,8 @@ typedef enum { #define SOCK_ASYNC_NOSPACE 0 #define SOCK_ASYNC_WAITDATA 1 #define SOCK_NOSPACE 2 +#define SOCK_PASS_CRED 16 +#define SOCK_USER_SOCKET 17 /** * struct socket - general BSD socket @@ -82,7 +84,6 @@ struct socket { struct sock *sk; wait_queue_head_t wait; short type; - unsigned char passcred; }; struct vm_area_struct; diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h index 2d439a839..3c3226075 100644 --- a/include/linux/proc_fs.h +++ b/include/linux/proc_fs.h @@ -55,6 +55,7 @@ struct proc_dir_entry { nlink_t nlink; uid_t uid; gid_t gid; + int vx_flags; unsigned long size; struct inode_operations * proc_iops; struct file_operations * proc_fops; @@ -237,9 +238,11 @@ extern struct kcore_list *kclist_del(void *); struct proc_inode { struct task_struct *task; int type; + int vx_flags; union { int (*proc_get_link)(struct inode *, struct dentry **, struct vfsmount **); int (*proc_read)(struct task_struct *task, char *page); + int (*proc_vid_read)(int vid, char *page); } op; struct proc_dir_entry *pde; struct inode vfs_inode; diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h index 8132a6ec9..2eb4e7974 100644 --- a/include/linux/reiserfs_fs.h +++ b/include/linux/reiserfs_fs.h @@ -888,6 +888,13 @@ struct stat_data_v1 #define REISERFS_COMPR_FL EXT2_COMPR_FL #define REISERFS_NOTAIL_FL EXT2_NOTAIL_FL +/* unfortunately reiserfs sdattr is only 16 bit */ +#define REISERFS_BARRIER_FL (EXT2_BARRIER_FL >> 16) +#define REISERFS_IUNLINK_FL (EXT2_IUNLINK_FL >> 16) + +#define REISERFS_FL_USER_VISIBLE 0x80FF +#define REISERFS_FL_USER_MODIFYABLE 0x80FF + /* persistent flags that file inherits from the parent directory */ #define REISERFS_INHERIT_MASK ( REISERFS_IMMUTABLE_FL | \ REISERFS_SYNC_FL | \ diff --git a/include/linux/sched.h b/include/linux/sched.h index b82de21dc..3276ebc9a 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -105,6 +105,7 @@ extern unsigned long nr_iowait(void); #include #include +#include #define TASK_RUNNING 0 #define TASK_INTERRUPTIBLE 1 @@ -112,6 +113,7 @@ extern unsigned long nr_iowait(void); #define TASK_STOPPED 4 #define TASK_ZOMBIE 8 #define TASK_DEAD 16 +#define TASK_ONHOLD 32 #define __set_task_state(tsk, state_value) \ do { (tsk)->state = (state_value); } while (0) @@ -229,6 +231,7 @@ struct mm_struct { /* Architecture-specific MM context */ mm_context_t context; + struct vx_info *mm_vx_info; /* coredumping support */ int core_waiters; @@ -323,9 +326,10 @@ struct user_struct { /* Hash table maintenance information */ struct list_head uidhash_list; uid_t uid; + xid_t xid; }; -extern struct user_struct *find_user(uid_t); +extern struct user_struct *find_user(xid_t, uid_t); extern struct user_struct root_user; #define INIT_USER (&root_user) @@ -495,6 +499,14 @@ struct task_struct { void *security; struct audit_context *audit_context; +/* vserver context data */ + xid_t xid; + struct vx_info *vx_info; + +/* vserver network data */ + nid_t nid; + struct nx_info *nx_info; + /* Thread group tracking */ u32 parent_exec_id; u32 self_exec_id; @@ -730,7 +742,7 @@ extern void set_special_pids(pid_t session, pid_t pgrp); extern void __set_special_pids(pid_t session, pid_t pgrp); /* per-UID process charging. */ -extern struct user_struct * alloc_uid(uid_t); +extern struct user_struct * alloc_uid(xid_t, uid_t); extern void free_uid(struct user_struct *); extern void switch_uid(struct user_struct *); diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h index 9b955be35..0c923ca54 100644 --- a/include/linux/sysctl.h +++ b/include/linux/sysctl.h @@ -133,6 +133,7 @@ enum KERN_NGROUPS_MAX=63, /* int: NGROUPS_MAX */ KERN_SPARC_SCONS_PWROFF=64, /* int: serial console power-off halt */ KERN_HZ_TIMER=65, /* int: hz timer on or off */ + KERN_VSHELPER=66, /* string: path to vshelper policy agent */ }; diff --git a/include/linux/types.h b/include/linux/types.h index 23c414f11..288ab653e 100644 --- a/include/linux/types.h +++ b/include/linux/types.h @@ -36,6 +36,8 @@ typedef __kernel_uid32_t uid_t; typedef __kernel_gid32_t gid_t; typedef __kernel_uid16_t uid16_t; typedef __kernel_gid16_t gid16_t; +typedef unsigned int xid_t; +typedef unsigned int nid_t; #ifdef CONFIG_UID16 /* This is defined by include/asm-{arch}/posix_types.h */ diff --git a/include/net/af_unix.h b/include/net/af_unix.h index be877d75c..b47489bfc 100644 --- a/include/net/af_unix.h +++ b/include/net/af_unix.h @@ -11,9 +11,9 @@ extern rwlock_t unix_table_lock; extern atomic_t unix_tot_inflight; -static inline struct sock *first_unix_socket(int *i) +static inline struct sock *next_unix_socket_table(int *i) { - for (*i = 0; *i <= UNIX_HASH_SIZE; (*i)++) { + for ((*i)++; *i <= UNIX_HASH_SIZE; (*i)++) { if (!hlist_empty(&unix_socket_table[*i])) return __sk_head(&unix_socket_table[*i]); } @@ -22,16 +22,19 @@ static inline struct sock *first_unix_socket(int *i) static inline struct sock *next_unix_socket(int *i, struct sock *s) { - struct sock *next = sk_next(s); - /* More in this chain? */ - if (next) - return next; - /* Look for next non-empty chain. */ - for ((*i)++; *i <= UNIX_HASH_SIZE; (*i)++) { - if (!hlist_empty(&unix_socket_table[*i])) - return __sk_head(&unix_socket_table[*i]); - } - return NULL; + do { + if (s) + s = sk_next(s); + if (!s) + s = next_unix_socket_table(i); + } while (s && !vx_check(s->sk_xid, VX_IDENT|VX_WATCH)); + return s; +} + +static inline struct sock *first_unix_socket(int *i) +{ + *i = 0; + return next_unix_socket(i, NULL); } #define forall_unix_sockets(i, s) \ diff --git a/include/net/route.h b/include/net/route.h index 7a851de92..4cbac7da3 100644 --- a/include/net/route.h +++ b/include/net/route.h @@ -33,6 +33,7 @@ #include #include #include +#include #ifndef __KERNEL__ #warning This file is not supposed to be used outside of kernel. @@ -146,6 +147,59 @@ static inline char rt_tos2priority(u8 tos) return ip_tos2prio[IPTOS_TOS(tos)>>1]; } +#define IPI_LOOPBACK 0x0100007f + +static inline int ip_find_src(struct nx_info *nxi, struct rtable **rp, struct flowi *fl) +{ + int err; + int i, n = nxi->nbipv4; + u32 ipv4root = nxi->ipv4[0]; + + if (ipv4root == 0) + return 0; + + if (fl->fl4_src == 0) { + if (n > 1) { + u32 foundsrc; + + err = __ip_route_output_key(rp, fl); + if (err) { + fl->fl4_src = ipv4root; + err = __ip_route_output_key(rp, fl); + } + if (err) + return err; + + foundsrc = (*rp)->rt_src; + ip_rt_put(*rp); + + for (i=0; imask[i]; + u32 ipv4 = nxi->ipv4[i]; + u32 net4 = ipv4 & mask; + + if (foundsrc == ipv4) { + fl->fl4_src = ipv4; + break; + } + if (!fl->fl4_src && (foundsrc & mask) == net4) + fl->fl4_src = ipv4; + } + } + if (fl->fl4_src == 0) + fl->fl4_src = (fl->fl4_dst == IPI_LOOPBACK) + ? IPI_LOOPBACK : ipv4root; + } else { + for (i=0; iipv4[i] == fl->fl4_src) + break; + } + if (i == n) + return -EPERM; + } + return 0; +} + static inline int ip_route_connect(struct rtable **rp, u32 dst, u32 src, u32 tos, int oif, u8 protocol, u16 sport, u16 dport, struct sock *sk) @@ -160,7 +214,22 @@ static inline int ip_route_connect(struct rtable **rp, u32 dst, .dport = dport } } }; int err; - if (!dst || !src) { + struct nx_info *nx_info = current->nx_info; + + if (sk) + nx_info = sk->sk_nx_info; + vxdprintk("ip_route_connect(%p) %p,%p;%lx\n", + sk, nx_info, sk->sk_socket, + (sk->sk_socket?sk->sk_socket->flags:0)); + + if (nx_info) { + err = ip_find_src(nx_info, rp, &fl); + if (err) + return err; + if (fl.fl4_dst == IPI_LOOPBACK && !vx_check(0, VX_ADMIN)) + fl.fl4_dst = nx_info->ipv4[0]; + } + if (!fl.fl4_dst || !fl.fl4_src) { err = __ip_route_output_key(rp, &fl); if (err) return err; diff --git a/include/net/scm.h b/include/net/scm.h index b7ba74dbc..30e9fbb98 100644 --- a/include/net/scm.h +++ b/include/net/scm.h @@ -51,13 +51,13 @@ static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg, { if (!msg->msg_control) { - if (sock->passcred || scm->fp) + if (test_bit(SOCK_PASS_CRED, &sock->flags) || scm->fp) msg->msg_flags |= MSG_CTRUNC; scm_destroy(scm); return; } - if (sock->passcred) + if (test_bit(SOCK_PASS_CRED, &sock->flags)) put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(scm->creds), &scm->creds); if (!scm->fp) diff --git a/include/net/sock.h b/include/net/sock.h index 1cea99704..67a55d513 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -50,6 +50,7 @@ #include #include +#include #include #include @@ -109,6 +110,10 @@ struct sock_common { struct hlist_node skc_node; struct hlist_node skc_bind_node; atomic_t skc_refcnt; + xid_t skc_xid; + struct vx_info *skc_vx_info; + nid_t skc_nid; + struct nx_info *skc_nx_info; }; /** @@ -187,6 +192,10 @@ struct sock { #define sk_node __sk_common.skc_node #define sk_bind_node __sk_common.skc_bind_node #define sk_refcnt __sk_common.skc_refcnt +#define sk_xid __sk_common.skc_xid +#define sk_vx_info __sk_common.skc_vx_info +#define sk_nid __sk_common.skc_nid +#define sk_nx_info __sk_common.skc_nx_info volatile unsigned char sk_zapped; unsigned char sk_shutdown; unsigned char sk_use_write_queue; diff --git a/include/net/tcp.h b/include/net/tcp.h index 62d75ee68..6c9bcf81b 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -195,6 +195,10 @@ struct tcp_tw_bucket { #define tw_node __tw_common.skc_node #define tw_bind_node __tw_common.skc_bind_node #define tw_refcnt __tw_common.skc_refcnt +#define tw_xid __tw_common.skc_xid +#define tw_vx_info __tw_common.skc_vx_info +#define tw_nid __tw_common.skc_nid +#define tw_nx_info __tw_common.skc_nx_info volatile unsigned char tw_substate; unsigned char tw_rcv_wscale; __u16 tw_sport; diff --git a/ipc/msg.c b/ipc/msg.c index 5f256af8b..210641516 100644 --- a/ipc/msg.c +++ b/ipc/msg.c @@ -96,6 +96,7 @@ static int newque (key_t key, int msgflg) msq->q_perm.mode = (msgflg & S_IRWXUGO); msq->q_perm.key = key; + msq->q_perm.xid = current->xid; msq->q_perm.security = NULL; retval = security_msg_queue_alloc(msq); @@ -788,7 +789,11 @@ static int sysvipc_msg_read_proc(char *buffer, char **start, off_t offset, int l for(i = 0; i <= msg_ids.max_id; i++) { struct msg_queue * msq; msq = msg_lock(i); - if(msq != NULL) { + if (msq) { + if (!vx_check(msq->q_perm.xid, VX_IDENT)) { + msg_unlock(msq); + continue; + } len += sprintf(buffer + len, "%10d %10d %4o %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n", msq->q_perm.key, msg_buildid(i,msq->q_perm.seq), diff --git a/ipc/sem.c b/ipc/sem.c index 6316aca9c..d226d3dd1 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -175,6 +175,7 @@ static int newary (key_t key, int nsems, int semflg) sma->sem_perm.mode = (semflg & S_IRWXUGO); sma->sem_perm.key = key; + sma->sem_perm.xid = current->xid; sma->sem_perm.security = NULL; retval = security_sem_alloc(sma); @@ -1296,7 +1297,11 @@ static int sysvipc_sem_read_proc(char *buffer, char **start, off_t offset, int l for(i = 0; i <= sem_ids.max_id; i++) { struct sem_array *sma; sma = sem_lock(i); - if(sma) { + if (sma) { + if (!vx_check(sma->sem_perm.xid, VX_IDENT)) { + sem_unlock(sma); + continue; + } len += sprintf(buffer + len, "%10d %10d %4o %10lu %5u %5u %5u %5u %10lu %10lu\n", sma->sem_perm.key, sem_buildid(i,sma->sem_perm.seq), diff --git a/ipc/shm.c b/ipc/shm.c index 9761e3bcb..ea2409464 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -189,6 +189,7 @@ static int newseg (key_t key, int shmflg, size_t size) return -ENOMEM; shp->shm_perm.key = key; + shp->shm_perm.xid = current->xid; shp->shm_flags = (shmflg & S_IRWXUGO); shp->shm_perm.security = NULL; @@ -847,11 +848,15 @@ static int sysvipc_shm_read_proc(char *buffer, char **start, off_t offset, int l struct shmid_kernel* shp; shp = shm_lock(i); - if(shp!=NULL) { + if (shp) { #define SMALL_STRING "%10d %10d %4o %10u %5u %5u %5d %5u %5u %5u %5u %10lu %10lu %10lu\n" #define BIG_STRING "%10d %10d %4o %21u %5u %5u %5d %5u %5u %5u %5u %10lu %10lu %10lu\n" char *format; + if (!vx_check(shp->shm_perm.xid, VX_IDENT)) { + shm_unlock(shp); + continue; + } if (sizeof(size_t) <= sizeof(int)) format = SMALL_STRING; else diff --git a/ipc/util.c b/ipc/util.c index 81a145ede..7c99ebe64 100644 --- a/ipc/util.c +++ b/ipc/util.c @@ -105,8 +105,10 @@ int ipc_findkey(struct ipc_ids* ids, key_t key) */ for (id = 0; id <= max_id; id++) { p = ids->entries[id].p; - if(p==NULL) + if (p==NULL) continue; + if (!vx_check(p->xid, VX_IDENT)) + continue; if (key == p->key) return id; } @@ -369,6 +371,8 @@ int ipcperms (struct kern_ipc_perm *ipcp, short flag) { /* flag will most probably be 0 or S_...UGO from */ int requested_mode, granted_mode; + if (!vx_check(ipcp->xid, VX_ADMIN|VX_IDENT)) /* maybe just VX_IDENT? */ + return -1; requested_mode = (flag >> 6) | (flag >> 3) | flag; granted_mode = ipcp->mode; if (current->euid == ipcp->cuid || current->euid == ipcp->uid) diff --git a/kernel/Makefile b/kernel/Makefile index 238c65f60..81849958d 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -9,6 +9,11 @@ obj-y = sched.o fork.o exec_domain.o panic.o printk.o profile.o \ rcupdate.o intermodule.o extable.o params.o posix-timers.o \ kthread.o +# mod-subdirs := vserver + +subdir-y += vserver +obj-y += vserver/vserver.o + obj-$(CONFIG_FUTEX) += futex.o obj-$(CONFIG_GENERIC_ISA_DMA) += dma.o obj-$(CONFIG_SMP) += cpu.o diff --git a/kernel/exit.c b/kernel/exit.c index c80a44115..c6cd8aeff 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -37,6 +37,11 @@ int getrusage(struct task_struct *, int, struct rusage __user *); static void __unhash_process(struct task_struct *p) { nr_threads--; + /* tasklist_lock is held, is this sufficient? */ + if (p->vx_info) { + atomic_dec(&p->vx_info->cacct.nr_threads); + atomic_dec(&p->vx_info->limit.res[RLIMIT_NPROC]); + } detach_pid(p, PIDTYPE_PID); detach_pid(p, PIDTYPE_TGID); if (thread_group_leader(p)) { @@ -236,6 +241,7 @@ void reparent_to_init(void) ptrace_unlink(current); /* Reparent to init */ REMOVE_LINKS(current); + /* FIXME handle vchild_reaper/initpid */ current->parent = child_reaper; current->real_parent = child_reaper; SET_LINKS(current); @@ -380,6 +386,7 @@ static inline void close_files(struct files_struct * files) struct file * file = xchg(&files->fd[i], NULL); if (file) filp_close(file, files); + vx_openfd_dec(fd); } i++; set >>= 1; @@ -599,6 +606,7 @@ static inline void forget_original_parent(struct task_struct * father) struct task_struct *p, *reaper = father; struct list_head *_p, *_n; + /* FIXME handle vchild_reaper/initpid */ reaper = father->group_leader; if (reaper == father) reaper = child_reaper; diff --git a/kernel/fork.c b/kernel/fork.c index 559e6bbf5..b20afcbd6 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -36,6 +36,8 @@ #include #include #include +#include +#include #include #include @@ -78,6 +80,8 @@ static kmem_cache_t *task_struct_cachep; static void free_task(struct task_struct *tsk) { free_thread_info(tsk->thread_info); + clr_vx_info(&tsk->vx_info); + clr_nx_info(&tsk->nx_info); free_task_struct(tsk); } @@ -419,6 +423,7 @@ static struct mm_struct * mm_init(struct mm_struct * mm) #ifdef __HAVE_ARCH_MMAP_TOP mm->mmap_top = mmap_top(); #endif + set_vx_info(&mm->mm_vx_info, current->vx_info); return mm; } free_mm(mm); @@ -450,6 +455,7 @@ void fastcall __mmdrop(struct mm_struct *mm) BUG_ON(mm == &init_mm); mm_free_pgd(mm); destroy_context(mm); + clr_vx_info(&mm->mm_vx_info); free_mm(mm); } @@ -564,6 +570,7 @@ static int copy_mm(unsigned long clone_flags, struct task_struct * tsk) /* Copy the current MM stuff.. */ memcpy(mm, oldmm, sizeof(*mm)); + mm->mm_vx_info = NULL; if (!mm_init(mm)) goto fail_nomem; @@ -875,6 +882,8 @@ struct task_struct *copy_process(unsigned long clone_flags, { int retval; struct task_struct *p = NULL; + struct vx_info *vxi; + struct nx_info *nxi; if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS)) return ERR_PTR(-EINVAL); @@ -899,12 +908,32 @@ struct task_struct *copy_process(unsigned long clone_flags, goto fork_out; retval = -ENOMEM; + p = dup_task_struct(current); if (!p) goto fork_out; p->tux_info = NULL; + vxi = get_vx_info(current->vx_info); + nxi = get_nx_info(current->nx_info); + + /* check vserver memory */ + if (p->mm && !(clone_flags & CLONE_VM)) { + if (vx_vmpages_avail(p->mm, p->mm->total_vm)) + vx_pages_add(p->mm->mm_vx_info, RLIMIT_AS, p->mm->total_vm); + else + goto bad_fork_free; + } + if (p->mm && vx_flags(VXF_FORK_RSS, 0)) { + if (!vx_rsspages_avail(p->mm, p->mm->rss)) + goto bad_fork_free; + } + retval = -EAGAIN; + if (vxi && (atomic_read(&vxi->limit.res[RLIMIT_NPROC]) + >= vxi->limit.rlim[RLIMIT_NPROC])) + goto bad_fork_free; + if (atomic_read(&p->user->processes) >= p->rlim[RLIMIT_NPROC].rlim_cur) { if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) && @@ -1097,6 +1126,10 @@ struct task_struct *copy_process(unsigned long clone_flags, link_pid(p, p->pids + PIDTYPE_TGID, &p->group_leader->pids[PIDTYPE_TGID].pid); nr_threads++; + if (vxi) { + atomic_inc(&vxi->cacct.nr_threads); + atomic_inc(&vxi->limit.res[RLIMIT_NPROC]); + } write_unlock_irq(&tasklist_lock); retval = 0; diff --git a/kernel/pid.c b/kernel/pid.c index 6ed44f56c..a8b7eb3c2 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -224,7 +224,8 @@ void fastcall detach_pid(task_t *task, enum pid_type type) task_t *find_task_by_pid(int nr) { - struct pid *pid = find_pid(PIDTYPE_PID, nr); + struct pid *pid = find_pid(PIDTYPE_PID, + vx_rmap_tgid(current->vx_info, nr)); if (!pid) return NULL; diff --git a/kernel/printk.c b/kernel/printk.c index 9e34ce41b..8bffe0433 100644 --- a/kernel/printk.c +++ b/kernel/printk.c @@ -247,7 +247,10 @@ int do_syslog(int type, char __user * buf, int len) unsigned long i, j, limit, count; int do_clear = 0; char c; - int error = 0; + int error = -EPERM; + + if (!vx_check(0, VX_ADMIN|VX_WATCH)) + return error; error = security_syslog(type); if (error) diff --git a/kernel/sched.c b/kernel/sched.c index 02f9f2253..53c92f136 100644 --- a/kernel/sched.c +++ b/kernel/sched.c @@ -41,6 +41,8 @@ #include #include #include +#include +#include #include @@ -233,6 +235,8 @@ struct runqueue { task_t *migration_thread; struct list_head migration_queue; #endif + struct list_head hold_queue; + int idle_tokens; }; static DEFINE_PER_CPU(struct runqueue, runqueues); @@ -354,6 +358,9 @@ static int effective_prio(task_t *p) bonus = CURRENT_BONUS(p) - MAX_BONUS / 2; prio = p->static_prio - bonus; + if (__vx_task_flags(p, VXF_SCHED_PRIO, 0)) + prio += effective_vavavoom(p, MAX_USER_PRIO); + if (prio < MAX_RT_PRIO) prio = MAX_RT_PRIO; if (prio > MAX_PRIO-1) @@ -1983,6 +1990,9 @@ void scheduler_tick(int user_ticks, int sys_ticks) } if (p == rq->idle) { + if (!--rq->idle_tokens && !list_empty(&rq->hold_queue)) + set_need_resched(); + if (atomic_read(&rq->nr_iowait) > 0) cpustat->iowait += sys_ticks; else @@ -2027,7 +2037,7 @@ void scheduler_tick(int user_ticks, int sys_ticks) } goto out_unlock; } - if (!--p->time_slice) { + if (vx_need_resched(p)) { dequeue_task(p, rq->active); set_tsk_need_resched(p); p->prio = effective_prio(p); @@ -2174,6 +2184,10 @@ asmlinkage void __sched schedule(void) unsigned long long now; unsigned long run_time; int cpu, idx; +#ifdef CONFIG_VSERVER_HARDCPU + struct vx_info *vxi; + int maxidle = -HZ; +#endif /* * Test if we are atomic. Since do_exit() needs to call into @@ -2224,6 +2238,37 @@ need_resched: } cpu = smp_processor_id(); +#ifdef CONFIG_VSERVER_HARDCPU + if (!list_empty(&rq->hold_queue)) { + struct list_head *l, *n; + int ret; + + vxi = NULL; + list_for_each_safe(l, n, &rq->hold_queue) { + next = list_entry(l, task_t, run_list); + if (vxi == next->vx_info) + continue; + + vxi = next->vx_info; + ret = vx_tokens_recalc(vxi); + // tokens = vx_tokens_avail(next); + + if (ret > 0) { + list_del(&next->run_list); + next->state &= ~TASK_ONHOLD; + recalc_task_prio(next, now); + __activate_task(next, rq); + // printk("··· unhold %p\n", next); + break; + } + if ((ret < 0) && (maxidle < ret)) + maxidle = ret; + } + } + rq->idle_tokens = -maxidle; + +pick_next: +#endif if (unlikely(!rq->nr_running)) { idle_balance(cpu, rq); if (!rq->nr_running) { @@ -2255,6 +2300,23 @@ need_resched: goto switch_tasks; } +#ifdef CONFIG_VSERVER_HARDCPU + vxi = next->vx_info; + if (vxi && __vx_flags(vxi->vx_flags, + VXF_SCHED_PAUSE|VXF_SCHED_HARD, 0)) { + int ret = vx_tokens_recalc(vxi); + + if (unlikely(ret <= 0)) { + if (ret && (rq->idle_tokens > -ret)) + rq->idle_tokens = -ret; + deactivate_task(next, rq); + list_add_tail(&next->run_list, &rq->hold_queue); + next->state |= TASK_ONHOLD; + goto pick_next; + } + } +#endif + if (!rt_task(next) && next->activated > 0) { unsigned long long delta = now - next->timestamp; @@ -3918,6 +3980,7 @@ void __init sched_init(void) rq->migration_thread = NULL; INIT_LIST_HEAD(&rq->migration_queue); #endif + INIT_LIST_HEAD(&rq->hold_queue); atomic_set(&rq->nr_iowait, 0); for (j = 0; j < 2; j++) { diff --git a/kernel/signal.c b/kernel/signal.c index d1f7f609b..d8755d805 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -1052,6 +1052,9 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p) unsigned long flags; int ret; + if (!vx_check(vx_task_xid(p), VX_ADMIN|VX_WATCH|VX_IDENT)) + return -ESRCH; + ret = check_kill_permission(sig, info, p); if (!ret && sig && p->sighand) { spin_lock_irqsave(&p->sighand->siglock, flags); diff --git a/kernel/sys.c b/kernel/sys.c index d22fd2d12..464d5cb8d 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -342,7 +343,7 @@ asmlinkage long sys_setpriority(int which, int who, int niceval) if (!who) user = current->user; else - user = find_user(who); + user = find_user(vx_current_xid(), who); if (!user) goto out_unlock; @@ -403,7 +404,7 @@ asmlinkage long sys_getpriority(int which, int who) if (!who) user = current->user; else - user = find_user(who); + user = find_user(vx_current_xid(), who); if (!user) goto out_unlock; @@ -425,6 +426,72 @@ out_unlock: return retval; } +/* + * vshelper path is set via /proc/sys + * invoked by vserver sys_reboot(), with + * the following arguments + * + * argv [0] = vshelper_path; + * argv [1] = action: "restart", "halt", "poweroff", ... + * argv [2] = context identifier + * argv [3] = additional argument (restart2) + * + * envp [*] = type-specific parameters + */ +char vshelper_path[255] = "/sbin/vshelper"; + +long vs_reboot(unsigned int cmd, void * arg) +{ + char id_buf[8], cmd_buf[32]; + char uid_buf[32], pid_buf[32]; + char buffer[256]; + + char *argv[] = {vshelper_path, NULL, id_buf, NULL, 0}; + char *envp[] = {"HOME=/", "TERM=linux", + "PATH=/sbin:/usr/sbin:/bin:/usr/bin", + uid_buf, pid_buf, cmd_buf, 0}; + + snprintf(id_buf, sizeof(id_buf)-1, "%d", vx_current_xid()); + + snprintf(cmd_buf, sizeof(cmd_buf)-1, "VS_CMD=%08x", cmd); + snprintf(uid_buf, sizeof(uid_buf)-1, "VS_UID=%d", current->uid); + snprintf(pid_buf, sizeof(pid_buf)-1, "VS_PID=%d", current->pid); + + switch (cmd) { + case LINUX_REBOOT_CMD_RESTART: + argv[1] = "restart"; + break; + + case LINUX_REBOOT_CMD_HALT: + argv[1] = "halt"; + break; + + case LINUX_REBOOT_CMD_POWER_OFF: + argv[1] = "poweroff"; + break; + + case LINUX_REBOOT_CMD_SW_SUSPEND: + argv[1] = "swsusp"; + break; + + case LINUX_REBOOT_CMD_RESTART2: + if (strncpy_from_user(&buffer[0], (char *)arg, sizeof(buffer) - 1) < 0) + return -EFAULT; + argv[3] = buffer; + default: + argv[1] = "restart2"; + break; + } + + /* maybe we should wait ? */ + if (call_usermodehelper(*argv, argv, envp, 0)) { + printk( KERN_WARNING + "vs_reboot(): failed to exec (%s %s %s %s)\n", + vshelper_path, argv[1], argv[2], argv[3]); + return -EPERM; + } + return 0; +} /* * Reboot system call: for obvious reasons only root may call it, @@ -450,6 +517,9 @@ asmlinkage long sys_reboot(int magic1, int magic2, unsigned int cmd, void __user magic2 != LINUX_REBOOT_MAGIC2C)) return -EINVAL; + if (!vx_check(0, VX_ADMIN|VX_WATCH)) + return vs_reboot(cmd, arg); + lock_kernel(); switch (cmd) { case LINUX_REBOOT_CMD_RESTART: @@ -644,7 +714,7 @@ static int set_user(uid_t new_ruid, int dumpclear) { struct user_struct *new_user; - new_user = alloc_uid(new_ruid); + new_user = alloc_uid(vx_current_xid(), new_ruid); if (!new_user) return -EAGAIN; @@ -1392,7 +1462,7 @@ asmlinkage long sys_newuname(struct new_utsname __user * name) int errno = 0; down_read(&uts_sem); - if (copy_to_user(name,&system_utsname,sizeof *name)) + if (copy_to_user(name, vx_new_utsname(), sizeof *name)) errno = -EFAULT; up_read(&uts_sem); return errno; @@ -1403,15 +1473,17 @@ asmlinkage long sys_sethostname(char __user *name, int len) int errno; char tmp[__NEW_UTS_LEN]; - if (!capable(CAP_SYS_ADMIN)) + if (!capable(CAP_SYS_ADMIN) && !vx_ccaps(VXC_SET_UTSNAME)) return -EPERM; if (len < 0 || len > __NEW_UTS_LEN) return -EINVAL; down_write(&uts_sem); errno = -EFAULT; if (!copy_from_user(tmp, name, len)) { - memcpy(system_utsname.nodename, tmp, len); - system_utsname.nodename[len] = 0; + char *ptr = vx_new_uts(nodename); + + memcpy(ptr, tmp, len); + ptr[len] = 0; errno = 0; } up_write(&uts_sem); @@ -1423,15 +1495,17 @@ asmlinkage long sys_sethostname(char __user *name, int len) asmlinkage long sys_gethostname(char __user *name, int len) { int i, errno; + char *ptr; if (len < 0) return -EINVAL; down_read(&uts_sem); - i = 1 + strlen(system_utsname.nodename); + ptr = vx_new_uts(nodename); + i = 1 + strlen(ptr); if (i > len) i = len; errno = 0; - if (copy_to_user(name, system_utsname.nodename, i)) + if (copy_to_user(name, ptr, i)) errno = -EFAULT; up_read(&uts_sem); return errno; @@ -1448,7 +1522,7 @@ asmlinkage long sys_setdomainname(char __user *name, int len) int errno; char tmp[__NEW_UTS_LEN]; - if (!capable(CAP_SYS_ADMIN)) + if (!capable(CAP_SYS_ADMIN) && !vx_ccaps(VXC_SET_UTSNAME)) return -EPERM; if (len < 0 || len > __NEW_UTS_LEN) return -EINVAL; @@ -1456,8 +1530,10 @@ asmlinkage long sys_setdomainname(char __user *name, int len) down_write(&uts_sem); errno = -EFAULT; if (!copy_from_user(tmp, name, len)) { - memcpy(system_utsname.domainname, tmp, len); - system_utsname.domainname[len] = 0; + char *ptr = vx_new_uts(domainname); + + memcpy(ptr, tmp, len); + ptr[len] = 0; errno = 0; } up_write(&uts_sem); @@ -1509,7 +1585,7 @@ asmlinkage long sys_setrlimit(unsigned int resource, struct rlimit __user *rlim) old_rlim = current->rlim + resource; if (((new_rlim.rlim_cur > old_rlim->rlim_max) || (new_rlim.rlim_max > old_rlim->rlim_max)) && - !capable(CAP_SYS_RESOURCE)) + !capable(CAP_SYS_RESOURCE) && vx_ccaps(VXC_SET_RLIMIT)) return -EPERM; if (resource == RLIMIT_NOFILE) { if (new_rlim.rlim_cur > NR_OPEN || new_rlim.rlim_max > NR_OPEN) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 75f3c3db1..40b0d358c 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -100,6 +100,7 @@ extern char modprobe_path[]; #ifdef CONFIG_HOTPLUG extern char hotplug_path[]; #endif +extern char vshelper_path[]; #ifdef CONFIG_CHR_DEV_SG extern int sg_big_buff; #endif @@ -466,6 +467,15 @@ static ctl_table kern_table[] = { .strategy = &sysctl_string, }, #endif + { + .ctl_name = KERN_VSHELPER, + .procname = "vshelper", + .data = &vshelper_path, + .maxlen = 256, + .mode = 0644, + .proc_handler = &proc_dostring, + .strategy = &sysctl_string, + }, #ifdef CONFIG_CHR_DEV_SG { .ctl_name = KERN_SG_BIG_BUFF, diff --git a/kernel/timer.c b/kernel/timer.c index 3a8162b97..0e4b116a7 100644 --- a/kernel/timer.c +++ b/kernel/timer.c @@ -31,6 +31,8 @@ #include #include #include +#include +#include #include #include @@ -996,7 +998,7 @@ asmlinkage unsigned long sys_alarm(unsigned int seconds) */ asmlinkage long sys_getpid(void) { - return current->tgid; + return vx_map_tgid(current->vx_info, current->tgid); } /* @@ -1040,7 +1042,7 @@ asmlinkage long sys_getppid(void) #endif break; } - return pid; + return vx_map_tgid(current->vx_info, pid); } asmlinkage long sys_getuid(void) @@ -1249,6 +1251,8 @@ asmlinkage long sys_sysinfo(struct sysinfo __user *info) tp.tv_nsec = tp.tv_nsec - NSEC_PER_SEC; tp.tv_sec++; } + if (vx_flags(VXF_VIRT_UPTIME, 0)) + vx_vsi_uptime(&tp, NULL); val.uptime = tp.tv_sec + (tp.tv_nsec ? 1 : 0); val.loads[0] = avenrun[0] << (SI_LOAD_SHIFT - FSHIFT); @@ -1258,6 +1262,9 @@ asmlinkage long sys_sysinfo(struct sysinfo __user *info) val.procs = nr_threads; } while (read_seqretry(&xtime_lock, seq)); +/* if (vx_flags(VXF_VIRT_CPU, 0)) + vx_vsi_cpu(val); +*/ si_meminfo(&val); si_swapinfo(&val); diff --git a/kernel/user.c b/kernel/user.c index 60e942b8f..209a7d1fa 100644 --- a/kernel/user.c +++ b/kernel/user.c @@ -20,8 +20,8 @@ #define UIDHASH_BITS 8 #define UIDHASH_SZ (1 << UIDHASH_BITS) #define UIDHASH_MASK (UIDHASH_SZ - 1) -#define __uidhashfn(uid) (((uid >> UIDHASH_BITS) + uid) & UIDHASH_MASK) -#define uidhashentry(uid) (uidhash_table + __uidhashfn((uid))) +#define __uidhashfn(xid,uid) ((((uid) >> UIDHASH_BITS) + ((uid)^(xid))) & UIDHASH_MASK) +#define uidhashentry(xid,uid) (uidhash_table + __uidhashfn((xid),(uid))) static kmem_cache_t *uid_cachep; static struct list_head uidhash_table[UIDHASH_SZ]; @@ -46,7 +46,7 @@ static inline void uid_hash_remove(struct user_struct *up) list_del(&up->uidhash_list); } -static inline struct user_struct *uid_hash_find(uid_t uid, struct list_head *hashent) +static inline struct user_struct *uid_hash_find(xid_t xid, uid_t uid, struct list_head *hashent) { struct list_head *up; @@ -55,7 +55,7 @@ static inline struct user_struct *uid_hash_find(uid_t uid, struct list_head *has user = list_entry(up, struct user_struct, uidhash_list); - if(user->uid == uid) { + if(user->uid == uid && user->xid == xid) { atomic_inc(&user->__count); return user; } @@ -70,12 +70,12 @@ static inline struct user_struct *uid_hash_find(uid_t uid, struct list_head *has * * If the user_struct could not be found, return NULL. */ -struct user_struct *find_user(uid_t uid) +struct user_struct *find_user(xid_t xid, uid_t uid) { struct user_struct *ret; spin_lock(&uidhash_lock); - ret = uid_hash_find(uid, uidhashentry(uid)); + ret = uid_hash_find(xid, uid, uidhashentry(xid, uid)); spin_unlock(&uidhash_lock); return ret; } @@ -89,13 +89,13 @@ void free_uid(struct user_struct *up) } } -struct user_struct * alloc_uid(uid_t uid) +struct user_struct * alloc_uid(xid_t xid, uid_t uid) { - struct list_head *hashent = uidhashentry(uid); + struct list_head *hashent = uidhashentry(xid, uid); struct user_struct *up; spin_lock(&uidhash_lock); - up = uid_hash_find(uid, hashent); + up = uid_hash_find(xid, uid, hashent); spin_unlock(&uidhash_lock); if (!up) { @@ -105,6 +105,7 @@ struct user_struct * alloc_uid(uid_t uid) if (!new) return NULL; new->uid = uid; + new->xid = xid; atomic_set(&new->__count, 1); atomic_set(&new->processes, 0); atomic_set(&new->files, 0); @@ -114,7 +115,7 @@ struct user_struct * alloc_uid(uid_t uid) * on adding the same user already.. */ spin_lock(&uidhash_lock); - up = uid_hash_find(uid, hashent); + up = uid_hash_find(xid, uid, hashent); if (up) { kmem_cache_free(uid_cachep, new); } else { @@ -156,7 +157,7 @@ static int __init uid_cache_init(void) /* Insert the root user immediately (init already runs as root) */ spin_lock(&uidhash_lock); - uid_hash_insert(&root_user, uidhashentry(0)); + uid_hash_insert(&root_user, uidhashentry(0,0)); spin_unlock(&uidhash_lock); return 0; diff --git a/mm/fremap.c b/mm/fremap.c index 8eefa7a6b..6c38dc8f7 100644 --- a/mm/fremap.c +++ b/mm/fremap.c @@ -38,7 +38,8 @@ static inline void zap_pte(struct mm_struct *mm, struct vm_area_struct *vma, set_page_dirty(page); page_remove_rmap(page); page_cache_release(page); - mm->rss--; + // mm->rss--; + vx_rsspages_dec(mm); } } } else { @@ -64,6 +65,9 @@ int install_page(struct mm_struct *mm, struct vm_area_struct *vma, pgd = pgd_offset(mm, addr); spin_lock(&mm->page_table_lock); + if (!vx_rsspages_avail(mm, 1)) + goto err_unlock; + pmd = pmd_alloc(mm, pgd, addr); if (!pmd) goto err_unlock; @@ -74,7 +78,8 @@ int install_page(struct mm_struct *mm, struct vm_area_struct *vma, zap_pte(mm, vma, addr, pte); - mm->rss++; + // mm->rss++; + vx_rsspages_inc(mm); flush_icache_page(vma, page); set_pte(pte, mk_pte(page, prot)); page_add_file_rmap(page); diff --git a/mm/memory.c b/mm/memory.c index 4e9684aba..19e49a572 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -279,6 +279,10 @@ skip_copy_pte_range: struct page *page; unsigned long pfn; + if (!vx_rsspages_avail(dst, 1)) { + spin_unlock(&src->page_table_lock); + goto nomem; + } /* copy_one_pte */ if (pte_none(pte)) @@ -322,7 +326,8 @@ skip_copy_pte_range: pte = pte_mkclean(pte); pte = pte_mkold(pte); get_page(page); - dst->rss++; + // dst->rss++; + vx_rsspages_inc(dst); set_pte(dst_pte, pte); page_dup_rmap(page); cont_copy_pte_range_noset: @@ -1092,7 +1097,8 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct * vma, page_table = pte_offset_map(pmd, address); if (likely(pte_same(*page_table, pte))) { if (PageReserved(old_page)) - ++mm->rss; + // ++mm->rss; + vx_rsspages_inc(mm); else page_remove_rmap(old_page); break_cow(vma, new_page, address, page_table); @@ -1341,6 +1347,10 @@ static int do_swap_page(struct mm_struct * mm, inc_page_state(pgmajfault); } + if (!vx_rsspages_avail(mm, 1)) { + ret = VM_FAULT_OOM; + goto out; + } mark_page_accessed(page); lock_page(page); @@ -1365,7 +1375,8 @@ static int do_swap_page(struct mm_struct * mm, if (vm_swap_full()) remove_exclusive_swap_page(page); - mm->rss++; + // mm->rss++; + vx_rsspages_inc(mm); pte = mk_pte(page, vma->vm_page_prot); if (write_access && can_share_swap_page(page)) { pte = maybe_mkwrite(pte_mkdirty(pte), vma); @@ -1405,6 +1416,11 @@ do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, pte_t entry; struct page * page = ZERO_PAGE(addr); + if (!vx_rsspages_avail(mm, 1)) { + spin_unlock(&mm->page_table_lock); + return VM_FAULT_OOM; + } + /* Read-only mapping of ZERO_PAGE. */ entry = pte_wrprotect(mk_pte(ZERO_PAGE(addr), vma->vm_page_prot)); @@ -1430,7 +1446,8 @@ do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, spin_unlock(&mm->page_table_lock); goto out; } - mm->rss++; + // mm->rss++; + vx_rsspages_inc(mm); entry = maybe_mkwrite(pte_mkdirty(mk_pte(page, vma->vm_page_prot)), vma); @@ -1493,6 +1510,8 @@ retry: return VM_FAULT_SIGBUS; if (new_page == NOPAGE_OOM) return VM_FAULT_OOM; + if (!vx_rsspages_avail(mm, 1)) + return VM_FAULT_OOM; /* * Should we do an early C-O-W break? @@ -1539,7 +1558,8 @@ retry: /* Only go through if we didn't race with anybody else... */ if (pte_none(*page_table)) { if (!PageReserved(new_page)) - ++mm->rss; + // ++mm->rss; + vx_rsspages_inc(mm); flush_icache_page(vma, new_page); entry = mk_pte(new_page, vma->vm_page_prot); if (write_access) diff --git a/mm/mlock.c b/mm/mlock.c index a9e37161d..b896132c6 100644 --- a/mm/mlock.c +++ b/mm/mlock.c @@ -103,7 +103,7 @@ static int do_mlock(unsigned long start, size_t len, int on) asmlinkage long sys_mlock(unsigned long start, size_t len) { - unsigned long locked; + unsigned long locked, grow; unsigned long lock_limit; int error = -ENOMEM; @@ -111,8 +111,10 @@ asmlinkage long sys_mlock(unsigned long start, size_t len) len = PAGE_ALIGN(len + (start & ~PAGE_MASK)); start &= PAGE_MASK; - locked = len >> PAGE_SHIFT; - locked += current->mm->locked_vm; + grow = len >> PAGE_SHIFT; + if (!vx_vmlocked_avail(current->mm, grow)) + goto out; + locked = current->mm->locked_vm + grow; lock_limit = current->rlim[RLIMIT_MEMLOCK].rlim_cur; lock_limit >>= PAGE_SHIFT; @@ -120,6 +122,7 @@ asmlinkage long sys_mlock(unsigned long start, size_t len) /* check against resource limits */ if (locked <= lock_limit) error = do_mlock(start, len, 1); +out: up_write(¤t->mm->mmap_sem); return error; } @@ -177,6 +180,9 @@ asmlinkage long sys_mlockall(int flags) lock_limit >>= PAGE_SHIFT; ret = -ENOMEM; + if (!vx_vmlocked_avail(current->mm, current->mm->total_vm)) + goto out; + /* check vserver lock limits? */ if (current->mm->total_vm <= lock_limit) ret = do_mlockall(flags); out: diff --git a/mm/mmap.c b/mm/mmap.c index d6005880b..7e4c2a822 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -853,6 +853,10 @@ munmap_back: > current->rlim[RLIMIT_AS].rlim_cur) return -ENOMEM; + /* check context space, maybe only Private writable mapping? */ + if (!vx_vmpages_avail(mm, len >> PAGE_SHIFT)) + return -ENOMEM; + if (accountable && (!(flags & MAP_NORESERVE) || sysctl_overcommit_memory > 1)) { if (vm_flags & VM_SHARED) { @@ -949,9 +953,11 @@ munmap_back: kmem_cache_free(vm_area_cachep, vma); } out: - mm->total_vm += len >> PAGE_SHIFT; + // mm->total_vm += len >> PAGE_SHIFT; + vx_vmpages_add(mm, len >> PAGE_SHIFT); if (vm_flags & VM_LOCKED) { - mm->locked_vm += len >> PAGE_SHIFT; + // mm->locked_vm += len >> PAGE_SHIFT; + vx_vmlocked_add(mm, len >> PAGE_SHIFT); make_pages_present(addr, addr + len); } if (flags & MAP_POPULATE) { @@ -1191,7 +1197,8 @@ int expand_stack(struct vm_area_struct * vma, unsigned long address) grow = (address - vma->vm_end) >> PAGE_SHIFT; /* Overcommit.. */ - if (security_vm_enough_memory(grow)) { + if (security_vm_enough_memory(grow) || + !vx_vmpages_avail(vma->vm_mm, grow)) { anon_vma_unlock(vma); return -ENOMEM; } @@ -1203,10 +1210,13 @@ int expand_stack(struct vm_area_struct * vma, unsigned long address) vm_unacct_memory(grow); return -ENOMEM; } + vma->vm_end = address; - vma->vm_mm->total_vm += grow; + // vma->vm_mm->total_vm += grow; + vx_vmpages_add(vma->vm_mm, grow); if (vma->vm_flags & VM_LOCKED) - vma->vm_mm->locked_vm += grow; + // vma->vm_mm->locked_vm += grow; + vx_vmlocked_add(vma->vm_mm, grow); anon_vma_unlock(vma); return 0; } @@ -1252,7 +1262,8 @@ int expand_stack(struct vm_area_struct *vma, unsigned long address) grow = (vma->vm_start - address) >> PAGE_SHIFT; /* Overcommit.. */ - if (security_vm_enough_memory(grow)) { + if (security_vm_enough_memory(grow) || + !vx_vmpages_avail(vma->vm_mm, grow)) { anon_vma_unlock(vma); return -ENOMEM; } @@ -1264,11 +1275,14 @@ int expand_stack(struct vm_area_struct *vma, unsigned long address) vm_unacct_memory(grow); return -ENOMEM; } + vma->vm_start = address; vma->vm_pgoff -= grow; - vma->vm_mm->total_vm += grow; + // vma->vm_mm->total_vm += grow; + vx_vmpages_add(vma->vm_mm, grow); if (vma->vm_flags & VM_LOCKED) - vma->vm_mm->locked_vm += grow; + // vma->vm_mm->locked_vm += grow; + vx_vmlocked_add(vma->vm_mm, grow); anon_vma_unlock(vma); return 0; } @@ -1371,9 +1385,12 @@ static void unmap_vma(struct mm_struct *mm, struct vm_area_struct *area) { size_t len = area->vm_end - area->vm_start; - area->vm_mm->total_vm -= len >> PAGE_SHIFT; + // area->vm_mm->total_vm -= len >> PAGE_SHIFT; + vx_vmpages_sub(area->vm_mm, len >> PAGE_SHIFT); + if (area->vm_flags & VM_LOCKED) - area->vm_mm->locked_vm -= len >> PAGE_SHIFT; + // area->vm_mm->locked_vm -= len >> PAGE_SHIFT; + vx_vmlocked_sub(area->vm_mm, len >> PAGE_SHIFT); /* * Is this a new hole at the lowest possible address? */ @@ -1623,6 +1640,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len) locked += len; if (locked > current->rlim[RLIMIT_MEMLOCK].rlim_cur) return -EAGAIN; + /* vserver checks ? */ } /* @@ -1644,7 +1662,8 @@ unsigned long do_brk(unsigned long addr, unsigned long len) if (mm->map_count > sysctl_max_map_count) return -ENOMEM; - if (security_vm_enough_memory(len >> PAGE_SHIFT)) + if (security_vm_enough_memory(len >> PAGE_SHIFT) || + !vx_vmpages_avail(mm, len >> PAGE_SHIFT)) return -ENOMEM; flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags; @@ -1672,9 +1691,11 @@ unsigned long do_brk(unsigned long addr, unsigned long len) vma->vm_page_prot = protection_map[flags & 0x0f]; vma_link(mm, vma, prev, rb_link, rb_parent); out: - mm->total_vm += len >> PAGE_SHIFT; + // mm->total_vm += len >> PAGE_SHIFT; + vx_vmpages_add(mm, len >> PAGE_SHIFT); if (flags & VM_LOCKED) { - mm->locked_vm += len >> PAGE_SHIFT; + // mm->locked_vm += len >> PAGE_SHIFT; + vx_vmlocked_add(mm, len >> PAGE_SHIFT); make_pages_present(addr, addr + len); } return addr; @@ -1708,9 +1729,12 @@ void exit_mmap(struct mm_struct *mm) vma = mm->mmap; mm->mmap = mm->mmap_cache = NULL; mm->mm_rb = RB_ROOT; - mm->rss = 0; - mm->total_vm = 0; - mm->locked_vm = 0; + // mm->rss = 0; + vx_rsspages_sub(mm, mm->rss); + // mm->total_vm = 0; + vx_vmpages_sub(mm, mm->total_vm); + // mm->locked_vm = 0; + vx_vmlocked_sub(mm, mm->locked_vm); arch_flush_exec_range(mm); spin_unlock(&mm->page_table_lock); diff --git a/mm/mremap.c b/mm/mremap.c index 329190677..ca4ea79d8 100644 --- a/mm/mremap.c +++ b/mm/mremap.c @@ -224,9 +224,11 @@ static unsigned long move_vma(struct vm_area_struct *vma, vma->vm_next->vm_flags |= VM_ACCOUNT; } - mm->total_vm += new_len >> PAGE_SHIFT; + // mm->total_vm += new_len >> PAGE_SHIFT; + vx_vmpages_add(mm, new_len >> PAGE_SHIFT); if (vm_flags & VM_LOCKED) { - mm->locked_vm += new_len >> PAGE_SHIFT; + // mm->locked_vm += new_len >> PAGE_SHIFT; + vx_vmlocked_add(mm, new_len >> PAGE_SHIFT); if (new_len > old_len) make_pages_present(new_addr + old_len, new_addr + new_len); @@ -335,6 +337,9 @@ unsigned long do_mremap(unsigned long addr, if ((current->mm->total_vm << PAGE_SHIFT) + (new_len - old_len) > current->rlim[RLIMIT_AS].rlim_cur) goto out; + /* check context space, maybe only Private writable mapping? */ + if (!vx_vmpages_avail(current->mm, (new_len - old_len) >> PAGE_SHIFT)) + goto out; if (vma->vm_flags & VM_ACCOUNT) { charged = (new_len - old_len) >> PAGE_SHIFT; @@ -358,9 +363,11 @@ unsigned long do_mremap(unsigned long addr, vma_adjust(vma, vma->vm_start, addr + new_len, vma->vm_pgoff, NULL); - current->mm->total_vm += pages; + // current->mm->total_vm += pages; + vx_vmpages_add(current->mm, pages); if (vma->vm_flags & VM_LOCKED) { - current->mm->locked_vm += pages; + // current->mm->locked_vm += pages; + vx_vmlocked_add(current->mm, pages); make_pages_present(addr + old_len, addr + new_len); } diff --git a/mm/oom_kill.c b/mm/oom_kill.c index ed0cee4e6..2f1529049 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -54,6 +54,7 @@ static int badness(struct task_struct *p) * The memory size of the process is the basis for the badness. */ points = p->mm->total_vm; + /* add vserver badness ;) */ /* * CPU time is in seconds and run time is in minutes. There is no diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 5769a391d..04468cc92 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -1017,6 +1017,8 @@ void si_meminfo(struct sysinfo *val) val->freehigh = 0; #endif val->mem_unit = PAGE_SIZE; + if (vx_flags(VXF_VIRT_MEM, 0)) + vx_vsi_meminfo(val); } EXPORT_SYMBOL(si_meminfo); diff --git a/mm/rmap.c b/mm/rmap.c index 871e76b9c..da85d34f4 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -505,7 +505,8 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma) BUG_ON(pte_file(*pte)); } - mm->rss--; + // mm->rss--; + vx_rsspages_dec(mm); BUG_ON(!page->mapcount); page->mapcount--; page_cache_release(page); diff --git a/mm/swapfile.c b/mm/swapfile.c index 2eabfd19a..fc9b47d83 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -430,7 +430,8 @@ static void unuse_pte(struct vm_area_struct *vma, unsigned long address, pte_t *dir, swp_entry_t entry, struct page *page) { - vma->vm_mm->rss++; + // vma->vm_mm->rss++; + vx_rsspages_inc(vma->vm_mm); get_page(page); set_pte(dir, pte_mkold(mk_pte(page, vma->vm_page_prot))); page_add_anon_rmap(page, vma, address); @@ -1573,6 +1574,8 @@ void si_swapinfo(struct sysinfo *val) val->freeswap = nr_swap_pages + nr_to_be_unused; val->totalswap = total_swap_pages + nr_to_be_unused; swap_list_unlock(); + if (vx_flags(VXF_VIRT_MEM, 0)) + vx_vsi_swapinfo(val); } /* diff --git a/net/core/dev.c b/net/core/dev.c index dfd505c1c..f0c0c9a95 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1979,6 +1979,8 @@ static int dev_ifconf(char __user *arg) total = 0; for (dev = dev_base; dev; dev = dev->next) { + if (!dev_in_nx_info(dev, current->nx_info)) + continue; for (i = 0; i < NPROTO; i++) { if (gifconf_list[i]) { int done; @@ -2039,6 +2041,10 @@ void dev_seq_stop(struct seq_file *seq, void *v) static void dev_seq_printf_stats(struct seq_file *seq, struct net_device *dev) { + struct nx_info *nxi = current->nx_info; + + if (!dev_in_nx_info(dev, nxi)) + return; if (dev->get_stats) { struct net_device_stats *stats = dev->get_stats(dev); diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index 26e3577c0..f577cba67 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -224,6 +224,8 @@ int rtnetlink_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) for (dev=dev_base, idx=0; dev; dev = dev->next, idx++) { if (idx < s_idx) continue; + if (!dev_in_nx_info(dev, current->nx_info)) + continue; if (rtnetlink_fill_ifinfo(skb, dev, RTM_NEWLINK, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq, 0) <= 0) break; } @@ -309,6 +311,8 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change) struct sk_buff *skb; int size = NLMSG_GOODSIZE; + if (!dev_in_nx_info(dev, current->nx_info)) + return; skb = alloc_skb(size, GFP_KERNEL); if (!skb) return; diff --git a/net/core/sock.c b/net/core/sock.c index 8c433e763..78d318a96 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -323,7 +323,10 @@ int sock_setsockopt(struct socket *sock, int level, int optname, break; case SO_PASSCRED: - sock->passcred = valbool; + if (valbool) + set_bit(SOCK_PASS_CRED, &sock->flags); + else + clear_bit(SOCK_PASS_CRED, &sock->flags); break; case SO_TIMESTAMP: @@ -546,7 +549,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname, break; case SO_PASSCRED: - v.val = sock->passcred; + v.val = test_bit(SOCK_PASS_CRED, &sock->flags)?1:0; break; case SO_PEERCRED: @@ -621,6 +624,8 @@ struct sock *sk_alloc(int family, int priority, int zero_it, kmem_cache_t *slab) sock_lock_init(sk); } sk->sk_slab = slab; + sock_vx_init(sk); + sock_nx_init(sk); if (security_sk_alloc(sk, family, priority)) { kmem_cache_free(slab, sk); @@ -651,6 +656,10 @@ void sk_free(struct sock *sk) __FUNCTION__, atomic_read(&sk->sk_omem_alloc)); security_sk_free(sk); + BUG_ON(sk->sk_vx_info); + BUG_ON(sk->sk_nx_info); +/* clr_vx_info(&sk->sk_vx_info); + clr_nx_info(&sk->sk_nx_info); */ kmem_cache_free(sk->sk_slab, sk); module_put(owner); } @@ -1142,6 +1151,11 @@ void sock_init_data(struct socket *sock, struct sock *sk) sk->sk_stamp.tv_sec = -1L; sk->sk_stamp.tv_usec = -1L; + sk->sk_vx_info = NULL; + sk->sk_xid = 0; + sk->sk_nx_info = NULL; + sk->sk_nid = 0; + atomic_set(&sk->sk_refcnt, 1); } diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index db0931a9a..8d450fb04 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -158,6 +158,9 @@ void inet_sock_destruct(struct sock *sk) if (inet->opt) kfree(inet->opt); + + BUG_ON(sk->sk_nx_info); + BUG_ON(sk->sk_vx_info); dst_release(sk->sk_dst_cache); #ifdef INET_REFCNT_DEBUG atomic_dec(&inet_sock_nr); @@ -397,6 +400,11 @@ static int inet_create(struct socket *sock, int protocol) sk->sk_family = PF_INET; sk->sk_protocol = protocol; sk->sk_backlog_rcv = sk->sk_prot->backlog_rcv; + + set_vx_info(&sk->sk_vx_info, current->vx_info); + sk->sk_xid = vx_current_xid(); + set_nx_info(&sk->sk_nx_info, current->nx_info); + sk->sk_nid = nx_current_nid(); inet->uc_ttl = -1; inet->mc_loop = 1; @@ -421,8 +429,13 @@ static int inet_create(struct socket *sock, int protocol) if (sk->sk_prot->init) { err = sk->sk_prot->init(sk); - if (err) - inet_sock_release(sk); + if (err) { +/* sk->sk_vx_info = NULL; + put_vx_info(current->vx_info); + sk->sk_nx_info = NULL; + put_nx_info(current->nx_info); +*/ inet_sock_release(sk); + } } out: return err; @@ -460,6 +473,8 @@ int inet_release(struct socket *sock) !(current->flags & PF_EXITING)) timeout = sk->sk_lingertime; sock->sk = NULL; + clr_vx_info(&sk->sk_vx_info); + clr_nx_info(&sk->sk_nx_info); sk->sk_prot->close(sk, timeout); } return 0; @@ -476,6 +491,10 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) unsigned short snum; int chk_addr_ret; int err; + __u32 s_addr; /* Address used for validation */ + __u32 s_addr1; + __u32 s_addr2 = 0xffffffffl; /* Optional address of the socket */ + struct nx_info *nxi = sk->sk_nx_info; /* If the socket has its own bind function then use it. (RAW) */ if (sk->sk_prot->bind) { @@ -486,7 +505,36 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) if (addr_len < sizeof(struct sockaddr_in)) goto out; - chk_addr_ret = inet_addr_type(addr->sin_addr.s_addr); + s_addr = s_addr1 = addr->sin_addr.s_addr; + nxdprintk("inet_bind(%p) %p,%p;%lx\n", + sk, nx_info, sk->sk_socket, + (sk->sk_socket?sk->sk_socket->flags:0)); + if (nxi) { + __u32 v4_bcast = nxi->v4_bcast; + __u32 ipv4root = nxi->ipv4[0]; + int nbipv4 = nxi->nbipv4; + if (s_addr == 0) { + s_addr = ipv4root; + if (nbipv4 > 1) + s_addr1 = 0; + else { + s_addr1 = ipv4root; + } + s_addr2 = v4_bcast; + } else if (s_addr == 0x0100007f) { + s_addr = s_addr1 = ipv4root; + } else if (s_addr != v4_bcast) { + int i; + for (i=0; iipv4[i]) + break; + } + if (i == nbipv4) { + return -EADDRNOTAVAIL; + } + } + } + chk_addr_ret = inet_addr_type(s_addr); /* Not specified by any standard per-se, however it breaks too * many applications when removed. It is unfortunate since @@ -498,7 +546,7 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) err = -EADDRNOTAVAIL; if (!sysctl_ip_nonlocal_bind && !inet->freebind && - addr->sin_addr.s_addr != INADDR_ANY && + s_addr != INADDR_ANY && chk_addr_ret != RTN_LOCAL && chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST) @@ -523,7 +571,8 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) if (sk->sk_state != TCP_CLOSE || inet->num) goto out_release_sock; - inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr; + inet->rcv_saddr = inet->saddr = s_addr1; + inet->rcv_saddr2 = s_addr2; if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST) inet->saddr = 0; /* Use device */ diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 6e16cc55b..37581ba5b 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -488,6 +488,33 @@ static __inline__ int inet_abc_len(u32 addr) return rc; } +/* + Check that a device is not member of the ipv4root assigned to the process + Return true if this is the case + + If the process is not bound to specific IP, then it returns 0 (all + interface are fine). +*/ +static inline int devinet_notiproot (struct in_ifaddr *ifa) +{ + int ret = 0; + struct nx_info *nxi; + + if ((nxi = current->nx_info)) { + int i; + int nbip = nxi->nbipv4; + __u32 addr = ifa->ifa_local; + ret = 1; + for (i=0; iipv4[i] == addr) { + ret = 0; + break; + } + } + } + return ret; +} + int devinet_ioctl(unsigned int cmd, void __user *arg) { @@ -595,6 +622,8 @@ int devinet_ioctl(unsigned int cmd, void __user *arg) ret = -EADDRNOTAVAIL; if (!ifa && cmd != SIOCSIFADDR && cmd != SIOCSIFFLAGS) goto done; + if (!ifa_in_nx_info(ifa, current->nx_info)) + goto done; switch(cmd) { case SIOCGIFADDR: /* Get interface address */ @@ -724,6 +753,8 @@ static int inet_gifconf(struct net_device *dev, char __user *buf, int len) goto out; for (; ifa; ifa = ifa->ifa_next) { + if (!ifa_in_nx_info(ifa, current->nx_info)) + continue; if (!buf) { done += sizeof(ifr); continue; @@ -1059,6 +1090,8 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb) read_lock(&in_dev->lock); for (ifa = in_dev->ifa_list, ip_idx = 0; ifa; ifa = ifa->ifa_next, ip_idx++) { + if (!ifa_in_nx_info(ifa, current->nx_info)) + continue; if (ip_idx < s_ip_idx) continue; if (inet_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).pid, diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c index 2316dfa91..3b4f8e35e 100644 --- a/net/ipv4/fib_hash.c +++ b/net/ipv4/fib_hash.c @@ -1010,6 +1010,8 @@ static unsigned fib_flag_trans(int type, int dead, u32 mask, struct fib_info *fi return flags; } +extern int dev_in_nx_info(struct net_device *, struct nx_info *); + /* * This outputs /proc/net/route. * @@ -1039,7 +1041,7 @@ static int fib_seq_show(struct seq_file *seq, void *v) mask = FZ_MASK(iter->zone); flags = fib_flag_trans(f->fn_type, f->fn_state & FN_S_ZOMBIE, mask, fi); - if (fi) + if (fi && dev_in_nx_info(fi->fib_dev, current->nx_info)) snprintf(bf, sizeof(bf), "%s\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u", fi->fib_dev ? fi->fib_dev->name : "*", prefix, diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 755d53aae..9cba88457 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -102,6 +102,38 @@ static void raw_v4_unhash(struct sock *sk) write_unlock_bh(&raw_v4_lock); } + +/* + Check if an address is in the list +*/ +static inline int raw_addr_in_list ( + u32 rcv_saddr1, + u32 rcv_saddr2, + u32 loc_addr, + struct nx_info *nx_info) +{ + int ret = 0; + if (loc_addr != 0 && + (rcv_saddr1 == loc_addr || rcv_saddr2 == loc_addr)) + ret = 1; + else if (rcv_saddr1 == 0) { + /* Accept any address or only the one in the list */ + if (nx_info == NULL) + ret = 1; + else { + int n = nx_info->nbipv4; + int i; + for (i=0; iipv4[i] == loc_addr) { + ret = 1; + break; + } + } + } + } + return ret; +} + struct sock *__raw_v4_lookup(struct sock *sk, unsigned short num, unsigned long raddr, unsigned long laddr, int dif) @@ -113,7 +145,8 @@ struct sock *__raw_v4_lookup(struct sock *sk, unsigned short num, if (inet->num == num && !(inet->daddr && inet->daddr != raddr) && - !(inet->rcv_saddr && inet->rcv_saddr != laddr) && + raw_addr_in_list(inet->rcv_saddr, inet->rcv_saddr2, + laddr, sk->sk_nx_info) && !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif)) goto found; /* gotcha */ } @@ -687,7 +720,8 @@ static struct sock *raw_get_first(struct seq_file *seq) struct hlist_node *node; sk_for_each(sk, node, &raw_v4_htable[state->bucket]) - if (sk->sk_family == PF_INET) + if (sk->sk_family == PF_INET && + vx_check(sk->sk_xid, VX_WATCH|VX_IDENT)) goto found; } sk = NULL; @@ -703,7 +737,8 @@ static struct sock *raw_get_next(struct seq_file *seq, struct sock *sk) sk = sk_next(sk); try_again: ; - } while (sk && sk->sk_family != PF_INET); + } while (sk && (sk->sk_family != PF_INET || + !vx_check(sk->sk_xid, VX_WATCH|VX_IDENT))); if (!sk && ++state->bucket < RAWV4_HTABLE_SIZE) { sk = sk_head(&raw_v4_htable[state->bucket]); diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 87b73c85f..dd6d462a5 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -179,9 +179,63 @@ void tcp_bind_hash(struct sock *sk, struct tcp_bind_bucket *tb, tcp_sk(sk)->bind_hash = tb; } +/* + Return 1 if addr match the socket IP list + or the socket is INADDR_ANY +*/ +static inline int tcp_in_list(struct sock *sk, u32 addr) +{ + struct nx_info *nxi = sk->sk_nx_info; + + vxdprintk("tcp_in_list(%p) %p,%p;%lx\n", + sk, nxi, sk->sk_socket, + (sk->sk_socket?sk->sk_socket->flags:0)); + + if (nxi) { + int n = nxi->nbipv4; + int i; + + for (i=0; iipv4[i] == addr) + return 1; + } + else if (!tcp_v4_rcv_saddr(sk) || tcp_v4_rcv_saddr(sk) == addr) + return 1; + return 0; +} + +/* + Check if the addresses in sk1 conflict with those in sk2 +*/ +int tcp_ipv4_addr_conflict(struct sock *sk1, struct sock *sk2) +{ + if (sk1 && sk2) + nxdprintk("inet_bind(%p,%p) %p,%p;%lx %p,%p;%lx\n", + sk1, sk2, + sk1->sk_nx_info, sk1->sk_socket, + (sk1->sk_socket?sk1->sk_socket->flags:0), + sk2->sk_nx_info, sk2->sk_socket, + (sk2->sk_socket?sk2->sk_socket->flags:0)); + + if (tcp_v4_rcv_saddr(sk1)) { + /* Bind to one address only */ + return tcp_in_list (sk2, tcp_v4_rcv_saddr(sk1)); + } else if (sk1->sk_nx_info) { + /* A restricted bind(any) */ + struct nx_info *nxi = sk1->sk_nx_info; + int n = nxi->nbipv4; + int i; + + for (i=0; iipv4[i])) + return 1; + } else /* A bind(any) do not allow other bind on the same port */ + return 1; + return 0; +} + static inline int tcp_bind_conflict(struct sock *sk, struct tcp_bind_bucket *tb) { - const u32 sk_rcv_saddr = tcp_v4_rcv_saddr(sk); struct sock *sk2; struct hlist_node *node; int reuse = sk->sk_reuse; @@ -194,9 +248,7 @@ static inline int tcp_bind_conflict(struct sock *sk, struct tcp_bind_bucket *tb) sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) { if (!reuse || !sk2->sk_reuse || sk2->sk_state == TCP_LISTEN) { - const u32 sk2_rcv_saddr = tcp_v4_rcv_saddr(sk2); - if (!sk2_rcv_saddr || !sk_rcv_saddr || - sk2_rcv_saddr == sk_rcv_saddr) + if (tcp_ipv4_addr_conflict(sk, sk2)) break; } } @@ -405,6 +457,34 @@ void tcp_unhash(struct sock *sk) wake_up(&tcp_lhash_wait); } +/* + Check if an address is in the list +*/ +static inline int tcp_addr_in_list( + u32 rcv_saddr, + u32 daddr, + struct nx_info *nx_info) +{ + if (rcv_saddr == daddr) + return 1; + else if (rcv_saddr == 0) { + /* Accept any address or check the list */ + if (!nx_info) + return 1; + else { + int n = nx_info->nbipv4; + int i; + + for (i=0; iipv4[i] == daddr) + return 1; + } + } + return 0; +} + + + /* Don't inline this cruft. Here are some nice properties to * exploit here. The BSD API does not allow a listening TCP * to specify the remote port nor the remote address for the @@ -426,11 +506,10 @@ static struct sock *__tcp_v4_lookup_listener(struct hlist_head *head, u32 daddr, __u32 rcv_saddr = inet->rcv_saddr; score = (sk->sk_family == PF_INET ? 1 : 0); - if (rcv_saddr) { - if (rcv_saddr != daddr) - continue; + if (tcp_addr_in_list(rcv_saddr, daddr, sk->sk_nx_info)) score+=2; - } + else + continue; if (sk->sk_bound_dev_if) { if (sk->sk_bound_dev_if != dif) continue; @@ -460,8 +539,8 @@ inline struct sock *tcp_v4_lookup_listener(u32 daddr, unsigned short hnum, struct inet_opt *inet = inet_sk((sk = __sk_head(head))); if (inet->num == hnum && !sk->sk_node.next && - (!inet->rcv_saddr || inet->rcv_saddr == daddr) && (sk->sk_family == PF_INET || !ipv6_only_sock(sk)) && + tcp_addr_in_list(inet->rcv_saddr, daddr, sk->sk_nx_info) && !sk->sk_bound_dev_if) goto sherry_cache; sk = __tcp_v4_lookup_listener(head, daddr, hnum, dif); @@ -2159,6 +2238,8 @@ static void *listening_get_next(struct seq_file *seq, void *cur) req = req->dl_next; while (1) { while (req) { + if (!vx_check(req->sk->sk_xid, VX_IDENT|VX_WATCH)) + continue; if (req->class->family == st->family) { cur = req; goto out; @@ -2177,6 +2258,8 @@ get_req: sk = sk_next(sk); get_sk: sk_for_each_from(sk, node) { + if (!vx_check(sk->sk_xid, VX_IDENT|VX_WATCH)) + continue; if (sk->sk_family == st->family) { cur = sk; goto out; @@ -2224,18 +2307,20 @@ static void *established_get_first(struct seq_file *seq) read_lock(&tcp_ehash[st->bucket].lock); sk_for_each(sk, node, &tcp_ehash[st->bucket].chain) { - if (sk->sk_family != st->family) { + if (!vx_check(sk->sk_xid, VX_IDENT|VX_WATCH)) + continue; + if (sk->sk_family != st->family) continue; - } rc = sk; goto out; } st->state = TCP_SEQ_STATE_TIME_WAIT; tw_for_each(tw, node, &tcp_ehash[st->bucket + tcp_ehash_size].chain) { - if (tw->tw_family != st->family) { + if (!vx_check(tw->tw_xid, VX_IDENT|VX_WATCH)) + continue; + if (tw->tw_family != st->family) continue; - } rc = tw; goto out; } @@ -2259,7 +2344,8 @@ static void *established_get_next(struct seq_file *seq, void *cur) tw = cur; tw = tw_next(tw); get_tw: - while (tw && tw->tw_family != st->family) { + while (tw && tw->tw_family != st->family && + !vx_check(tw->tw_xid, VX_IDENT|VX_WATCH)) { tw = tw_next(tw); } if (tw) { @@ -2279,6 +2365,8 @@ get_tw: sk = sk_next(sk); sk_for_each_from(sk, node) { + if (!vx_check(sk->sk_xid, VX_IDENT|VX_WATCH)) + continue; if (sk->sk_family == st->family) goto found; } diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index 61c77cc3c..54f1c3351 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -362,6 +362,11 @@ void tcp_time_wait(struct sock *sk, int state, int timeo) tw->tw_ts_recent_stamp = tp->ts_recent_stamp; tw_dead_node_init(tw); + tw->tw_xid = sk->sk_xid; + tw->tw_vx_info = NULL; + tw->tw_nid = sk->sk_nid; + tw->tw_nx_info = NULL; + #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) if (tw->tw_family == PF_INET6) { struct ipv6_pinfo *np = inet6_sk(sk); @@ -697,6 +702,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req, newsk->sk_state = TCP_SYN_RECV; /* SANITY */ + sock_vx_init(newsk); + sock_nx_init(newsk); sk_node_init(&newsk->sk_node); tcp_sk(newsk)->bind_hash = NULL; @@ -801,6 +808,10 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req, newsk->sk_err = 0; newsk->sk_priority = 0; atomic_set(&newsk->sk_refcnt, 2); + + /* hmm, maybe from socket? */ + set_vx_info(&newsk->sk_vx_info, current->vx_info); + set_nx_info(&newsk->sk_nx_info, current->nx_info); #ifdef INET_REFCNT_DEBUG atomic_inc(&inet_sock_nr); #endif diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 900d7fd23..dec547c4b 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -120,6 +120,8 @@ rwlock_t udp_hash_lock = RW_LOCK_UNLOCKED; /* Shared by v4/v6 udp. */ int udp_port_rover; +int tcp_ipv4_addr_conflict(struct sock *sk1, struct sock *sk2); + static int udp_v4_get_port(struct sock *sk, unsigned short snum) { struct hlist_node *node; @@ -179,9 +181,7 @@ gotit: (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) && - (!inet2->rcv_saddr || - !inet->rcv_saddr || - inet2->rcv_saddr == inet->rcv_saddr) && + tcp_ipv4_addr_conflict(sk2, sk) && (!sk2->sk_reuse || !sk->sk_reuse)) goto fail; } @@ -216,6 +216,17 @@ static void udp_v4_unhash(struct sock *sk) write_unlock_bh(&udp_hash_lock); } +static inline int udp_in_list(struct nx_info *nx_info, u32 addr) +{ + int n = nx_info->nbipv4; + int i; + + for (i=0; iipv4[i] == addr) + return 1; + return 0; +} + /* UDP is nearly always wildcards out the wazoo, it makes no sense to try * harder than this. -DaveM */ @@ -235,6 +246,11 @@ struct sock *udp_v4_lookup_longway(u32 saddr, u16 sport, u32 daddr, u16 dport, i if (inet->rcv_saddr != daddr) continue; score+=2; + } else if (sk->sk_nx_info) { + if (udp_in_list(sk->sk_nx_info, daddr)) + score+=2; + else + continue; } if (inet->daddr) { if (inet->daddr != saddr) @@ -290,7 +306,8 @@ static inline struct sock *udp_v4_mcast_next(struct sock *sk, if (inet->num != hnum || (inet->daddr && inet->daddr != rmt_addr) || (inet->dport != rmt_port && inet->dport) || - (inet->rcv_saddr && inet->rcv_saddr != loc_addr) || + (inet->rcv_saddr && inet->rcv_saddr != loc_addr && + inet->rcv_saddr2 && inet->rcv_saddr2 != loc_addr) || ipv6_only_sock(s) || (s->sk_bound_dev_if && s->sk_bound_dev_if != dif)) continue; @@ -599,6 +616,15 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, .uli_u = { .ports = { .sport = inet->sport, .dport = dport } } }; + struct nx_info *nxi = sk->sk_nx_info; + + if (nxi) { + err = ip_find_src(nxi, &rt, &fl); + if (err) + goto out; + if (daddr == IPI_LOOPBACK && !vx_check(0, VX_ADMIN)) + daddr = fl.fl4_dst = nxi->ipv4[0]; + } err = ip_route_output_flow(&rt, &fl, sk, !(msg->msg_flags&MSG_DONTWAIT)); if (err) goto out; @@ -1374,8 +1400,10 @@ static struct sock *udp_get_first(struct seq_file *seq) for (state->bucket = 0; state->bucket < UDP_HTABLE_SIZE; ++state->bucket) { struct hlist_node *node; + sk_for_each(sk, node, &udp_hash[state->bucket]) { - if (sk->sk_family == state->family) + if (sk->sk_family == state->family && + vx_check(sk->sk_xid, VX_WATCH|VX_IDENT)) goto found; } } @@ -1392,7 +1420,8 @@ static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk) sk = sk_next(sk); try_again: ; - } while (sk && sk->sk_family != state->family); + } while (sk && (sk->sk_family != state->family || + !vx_check(sk->sk_xid, VX_WATCH|VX_IDENT))); if (!sk && ++state->bucket < UDP_HTABLE_SIZE) { sk = sk_head(&udp_hash[state->bucket]); diff --git a/net/socket.c b/net/socket.c index 3549ae8dc..e0cae444d 100644 --- a/net/socket.c +++ b/net/socket.c @@ -288,7 +288,7 @@ static struct inode *sock_alloc_inode(struct super_block *sb) ei->socket.ops = NULL; ei->socket.sk = NULL; ei->socket.file = NULL; - ei->socket.passcred = 0; + ei->socket.flags = 0; return &ei->vfs_inode; } @@ -543,7 +543,7 @@ static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t size) { struct sock_iocb *si = kiocb_to_siocb(iocb); - int err; + int err, len; si->sock = sock; si->scm = NULL; @@ -554,7 +554,20 @@ static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock, if (err) return err; - return sock->ops->sendmsg(iocb, sock, msg, size); + len = sock->ops->sendmsg(iocb, sock, msg, size); + if (sock->sk) { + if (len == size) + vx_sock_send(sock->sk, size); + else + vx_sock_fail(sock->sk, size); + } + vxdprintk("__sock_sendmsg: %p[%p,%p,%p;%d]:%d/%d\n", + sock, sock->sk, + (sock->sk)?sock->sk->sk_nx_info:0, + (sock->sk)?sock->sk->sk_vx_info:0, + (sock->sk)?sock->sk->sk_xid:0, + size, len); + return len; } int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) @@ -573,7 +586,7 @@ int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t size, int flags) { - int err; + int err, len; struct sock_iocb *si = kiocb_to_siocb(iocb); si->sock = sock; @@ -586,7 +599,16 @@ static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock, if (err) return err; - return sock->ops->recvmsg(iocb, sock, msg, size, flags); + len = sock->ops->recvmsg(iocb, sock, msg, size, flags); + if ((len >= 0) && sock->sk) + vx_sock_recv(sock->sk, len); + vxdprintk("__sock_recvmsg: %p[%p,%p,%p;%d]:%d/%d\n", + sock, sock->sk, + (sock->sk)?sock->sk->sk_nx_info:0, + (sock->sk)?sock->sk->sk_vx_info:0, + (sock->sk)?sock->sk->sk_xid:0, + size, len); + return len; } int sock_recvmsg(struct socket *sock, struct msghdr *msg, @@ -1036,6 +1058,10 @@ static int __sock_create(int family, int type, int protocol, struct socket **res if (type < 0 || type >= SOCK_MAX) return -EINVAL; + /* disable IPv6 inside vservers for now */ + if (family == PF_INET6 && !vx_check(0, VX_ADMIN)) + return -EAFNOSUPPORT; + /* Compatibility. This uglymoron is moved from INET layer to here to avoid @@ -1144,6 +1170,7 @@ asmlinkage long sys_socket(int family, int type, int protocol) if (retval < 0) goto out; + set_bit(SOCK_USER_SOCKET, &sock->flags); retval = sock_map_fd(sock); if (retval < 0) goto out_release; @@ -1174,10 +1201,12 @@ asmlinkage long sys_socketpair(int family, int type, int protocol, int __user *u err = sock_create(family, type, protocol, &sock1); if (err < 0) goto out; + set_bit(SOCK_USER_SOCKET, &sock1->flags); err = sock_create(family, type, protocol, &sock2); if (err < 0) goto out_release_1; + set_bit(SOCK_USER_SOCKET, &sock2->flags); err = sock1->ops->socketpair(sock1, sock2); if (err < 0) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index e19475e6a..349343927 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -405,6 +405,8 @@ static int unix_release_sock (struct sock *sk, int embrion) mntput(mnt); } + clr_vx_info(&sk->sk_vx_info); + clr_nx_info(&sk->sk_nx_info); sock_put(sk); /* ---- Socket is dead now and most probably destroyed ---- */ @@ -559,6 +561,10 @@ static struct sock * unix_create1(struct socket *sock) sock_init_data(sock,sk); sk_set_owner(sk, THIS_MODULE); + set_vx_info(&sk->sk_vx_info, current->vx_info); + set_nx_info(&sk->sk_nx_info, current->nx_info); + sk->sk_xid = vx_current_xid(); + sk->sk_write_space = unix_write_space; sk->sk_max_ack_backlog = sysctl_unix_max_dgram_qlen; sk->sk_destruct = unix_sock_destructor; @@ -870,7 +876,7 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr, goto out; alen = err; - if (sock->passcred && !unix_sk(sk)->addr && + if (test_bit(SOCK_PASS_CRED, &sock->flags) && !unix_sk(sk)->addr && (err = unix_autobind(sock)) != 0) goto out; @@ -961,7 +967,8 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr, goto out; addr_len = err; - if (sock->passcred && !u->addr && (err = unix_autobind(sock)) != 0) + if (test_bit(SOCK_PASS_CRED, &sock->flags) + && !u->addr && (err = unix_autobind(sock)) != 0) goto out; timeo = sock_sndtimeo(sk, flags & O_NONBLOCK); @@ -1295,7 +1302,8 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock, goto out; } - if (sock->passcred && !u->addr && (err = unix_autobind(sock)) != 0) + if (test_bit(SOCK_PASS_CRED, &sock->flags) + && !u->addr && (err = unix_autobind(sock)) != 0) goto out; err = -EMSGSIZE; diff --git a/scripts/basic/.docproc.cmd b/scripts/basic/.docproc.cmd index e725e6b22..6d40859d8 100644 --- a/scripts/basic/.docproc.cmd +++ b/scripts/basic/.docproc.cmd @@ -6,7 +6,7 @@ deps_scripts/basic/docproc := \ /usr/include/features.h \ /usr/include/sys/cdefs.h \ /usr/include/gnu/stubs.h \ - /usr/lib/gcc-lib/i586-mandrake-linux-gnu/3.3.2/include/stddef.h \ + /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/stddef.h \ /usr/include/bits/types.h \ /usr/include/bits/wordsize.h \ /usr/include/bits/typesizes.h \ @@ -15,7 +15,7 @@ deps_scripts/basic/docproc := \ /usr/include/wchar.h \ /usr/include/bits/wchar.h \ /usr/include/gconv.h \ - /usr/lib/gcc-lib/i586-mandrake-linux-gnu/3.3.2/include/stdarg.h \ + /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/stdarg.h \ /usr/include/bits/stdio_lim.h \ /usr/include/bits/sys_errlist.h \ /usr/include/bits/stdio.h \ @@ -40,8 +40,8 @@ deps_scripts/basic/docproc := \ /usr/include/bits/posix_opt.h \ /usr/include/bits/confname.h \ /usr/include/getopt.h \ - /usr/lib/gcc-lib/i586-mandrake-linux-gnu/3.3.2/include/limits.h \ - /usr/lib/gcc-lib/i586-mandrake-linux-gnu/3.3.2/include/syslimits.h \ + /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/limits.h \ + /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/syslimits.h \ /usr/include/limits.h \ /usr/include/bits/posix1_lim.h \ /usr/include/bits/local_lim.h \ @@ -54,9 +54,6 @@ deps_scripts/basic/docproc := \ /usr/include/bits/sigaction.h \ /usr/include/bits/sigcontext.h \ /usr/include/asm/sigcontext.h \ - /usr/include/linux/compiler.h \ - /usr/include/linux/compiler-gcc3.h \ - /usr/include/linux/compiler-gcc.h \ /usr/include/bits/sigstack.h \ /usr/include/bits/sigthread.h \ /usr/include/sys/resource.h \ diff --git a/scripts/basic/.fixdep.cmd b/scripts/basic/.fixdep.cmd index 1c463aa74..4f04c3fd8 100644 --- a/scripts/basic/.fixdep.cmd +++ b/scripts/basic/.fixdep.cmd @@ -12,7 +12,7 @@ deps_scripts/basic/fixdep := \ /usr/include/gnu/stubs.h \ /usr/include/bits/types.h \ /usr/include/bits/wordsize.h \ - /usr/lib/gcc-lib/i586-mandrake-linux-gnu/3.3.2/include/stddef.h \ + /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/stddef.h \ /usr/include/bits/typesizes.h \ /usr/include/time.h \ /usr/include/endian.h \ @@ -45,12 +45,12 @@ deps_scripts/basic/fixdep := \ /usr/include/wchar.h \ /usr/include/bits/wchar.h \ /usr/include/gconv.h \ - /usr/lib/gcc-lib/i586-mandrake-linux-gnu/3.3.2/include/stdarg.h \ + /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/stdarg.h \ /usr/include/bits/stdio_lim.h \ /usr/include/bits/sys_errlist.h \ /usr/include/bits/stdio.h \ - /usr/lib/gcc-lib/i586-mandrake-linux-gnu/3.3.2/include/limits.h \ - /usr/lib/gcc-lib/i586-mandrake-linux-gnu/3.3.2/include/syslimits.h \ + /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/limits.h \ + /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/syslimits.h \ /usr/include/limits.h \ /usr/include/bits/posix1_lim.h \ /usr/include/bits/local_lim.h \ @@ -59,9 +59,6 @@ deps_scripts/basic/fixdep := \ /usr/include/ctype.h \ /usr/include/netinet/in.h \ /usr/include/stdint.h \ - /usr/include/sys/socket.h \ - /usr/include/sys/uio.h \ - /usr/include/bits/uio.h \ /usr/include/bits/socket.h \ /usr/include/bits/sockaddr.h \ /usr/include/asm/socket.h \ diff --git a/scripts/basic/.split-include.cmd b/scripts/basic/.split-include.cmd index e596a8729..e1a20d0c2 100644 --- a/scripts/basic/.split-include.cmd +++ b/scripts/basic/.split-include.cmd @@ -9,7 +9,7 @@ deps_scripts/basic/split-include := \ /usr/include/gnu/stubs.h \ /usr/include/bits/types.h \ /usr/include/bits/wordsize.h \ - /usr/lib/gcc-lib/i586-mandrake-linux-gnu/3.3.2/include/stddef.h \ + /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/stddef.h \ /usr/include/bits/typesizes.h \ /usr/include/time.h \ /usr/include/bits/stat.h \ @@ -28,8 +28,6 @@ deps_scripts/basic/split-include := \ /usr/include/bits/errno.h \ /usr/include/linux/errno.h \ /usr/include/asm/errno.h \ - /usr/include/asm-generic/errno.h \ - /usr/include/asm-generic/errno-base.h \ /usr/include/fcntl.h \ /usr/include/bits/fcntl.h \ /usr/include/stdio.h \ @@ -38,7 +36,7 @@ deps_scripts/basic/split-include := \ /usr/include/wchar.h \ /usr/include/bits/wchar.h \ /usr/include/gconv.h \ - /usr/lib/gcc-lib/i586-mandrake-linux-gnu/3.3.2/include/stdarg.h \ + /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/stdarg.h \ /usr/include/bits/stdio_lim.h \ /usr/include/bits/sys_errlist.h \ /usr/include/bits/stdio.h \ diff --git a/scripts/basic/docproc b/scripts/basic/docproc index 51640ad93660a5e29ce19452befa76d58d827f84..fd219c4e1efb9b9a575d9565312dd77090e7138a 100755 GIT binary patch literal 20254 zcmeHvdwf*Km1cF{+f75a=oZ2luQj+a!b>Ko_26M3#1=?GXe=Z}5)a35npQv54Xtju zA3Wlh_(`%6GKuW?mv|G$f$^^GNgNwz6OWyE962I@H@o{|Z0Bib!fxWF3B*GZFJXcc z?e|sP+q#lHnIxP1v&)52)mP`#sZ*y;Ro`1x_uk#uvcYDv3G=cGO%S!;tGkvXPOesz z<-#wVVu`p`T!UB$(w6sw2Vo3p1_y$Updq}?02)IX(hQ_gcCj|l1bOCw7lGx4&!GE} zJ_I_#HWX+t5wc#=?I6tseJ*GWCx98K7wcefp^R&v?qcu*GnllhWTLw&8L3PrQu#fB zY&uY@Xb>%RYiiw$l&XhyQLj>js}Z1vyk_Dr+hkr>A>lQ^EX4B>W+PmIa3z8V;ol+r zzKeDNpo+9s=7U?TOfW#R1L_>8{0yS#}AD_rOl5 zjQE2HKHx=&iNgqf;13&kCE{w}iw0)hb-1>pu zAx{K@;oRQ7Xs|mdh3?KIa#0c8lR%~EzGzAWo7*5Hl1K&f*=PjpR2Dg*OfJ|PN~FLW z4ex@~Of(8=Pj5P9P=lhWrFngQur{!)n5rqJs@ZV+zxhuyI5Ib#gqRgB@7 zYZ+rO)G@}OZeWbbWFun?@D|3HWZD^DCB)|8HwVtS3WuR`;T`_D29>`&E+$sIjh0L- zzKFkU@5ExZjI)3^b7}(DVzw|&+L@CQv!!vG?#!6PY;l~^*_k5}v*mF=@ga$6f%p>Q zQHg1Zcr|gq#I#6!6>*=$v`oB?c)P^3P<$hCyTr6qyq&mCVp=S|jksE3S}wkw*e@|H z7-xgd_#~z!<9)CRC3h^` zVT*6a%vHFGW>b0BBkvIN9LO3t>Nm2NA^Q}w-=YN+>q_MLA3)v@kvDL3DfAdPH-BQq zcE~Oq`z`Z)g{K%_oEZLQE&_$FZ{HyfHdOf9I|^?qhLMH}*WcX@b@N{Dvqxt-JkWOF zs0Xr+%k%_DXWxQhCUOk*sUDULQVwaD#2Q-t}P!_ZMDO8r?Fi|NTdU8&>eAJLb&Mo7cQ8Co0xiC^m?$vMIS@jL_ z*1S&pupLV#{xdTQ-S0>n4UG-|CRegy;J9aC+_U$`#3DR&wMfpdA@jVdKS@?NT$>ZL^-@%3llNG)XZH@EZ1YKF)UUksy^#i9|v7xcNqyJJc zuWdMcx^O_U7}UkWF9hg0$A$w7&i<_b(h~1bFO)7sz_nq-=Y7#hAw@PwI9J#R+VHPN zTnEa$FMbo`b;UYb}E)hgKu^c*7$c8=^h_ zCAR2E)IGesqEHQ+-D-^Hi~oYWTt)T3(Q>-VnG@6xLrt3Ciy%S=IR-xug7U@q*B}h` zEHC`CoF1ev!bjuB%>3_7<|`jvi(lK3Co8%T9dD@cP#|KTY@8uJdWMVtE9RxHeU=~xq2Z2S^uJKxz?y)QOY*aj{(9?VtP^D9OV zEEs$}cXi=@lpKMwuR_&!)1x^ieyo}~`=m>Fb?eJ(m9%1S(na z?;*c%7xXypU_YK5#`tuwu}5Tzy`oZVfJ)JnCqU(laRSo}h7BJb3r}2tV{u~~Rz6}?CdAwcLtH)nQz3L~pPzRoEJ8Xp|CWXG52%Ks$c!9 z4D9jpxV)#D!a6i|aN9)Q&HJe{d}&IhU#2?F~du6deuD354@VDi2200r|<@~v{ zUp*vFN=1EZSS*!8mHyrFXv*IcO+_=ITq4!u-xx_$pjNSHCYlOIAv=+aCsIbE_#o)dhBJx2T((NpQi)pBv**mkS&aM=QvEpXWamo0GF0+%gt z*#iI1TA+ZZU$b#sYGdGn)(PwtW7|sjjXljJ`>;O-JUW1VGsLHW`B?R91nfA;JvZ)o z^WwAddC29{@eu?r$#IXG`{DB;muZ2R`>^v7xc5sXu(*>R8^p2(V(M`o@qS<=|EP=W z4=iBDO!K?|V_p|fw-bB4^AN5>Sc$L!VGBYGVHd(Z2%kcD4B=UXV+h|x_+JPY5S-Y{ zoriE8!b*e<2uix~x2e8>iQu@fUnq^ht zY+k^3{OdaXwSk&tfz{Q4>OjpZVe5Ygs@dg`(rrA%!1@`gpwVZboDX)f+1G;NvLDp` zJ7W7mB0H?2w;<7p;9$ZgoZT3z`ivPkJRo$3YY3UT);e>Tx!pFxSsf6kwRAJN8`;{X z`;asX>JKB$AmwSo`6SXdr~L#Xm)54;0DZJ(R*2fQ*AQ#1JZNEGqzk(Sg*}c1?zxEV z2Z*$9qB2MMNyYDe75${OJ<3wQLelY9XN;oGWmM2%UxP9}$0GMFpxQ@>l!S$IC=xZw zV%Mr-F5wKIn9Je02UOj8UCAJdi4uB&t>gk~wwG*TjU}f^F9{*vQSy1Doh5Xz86|Q2 zb(OpTo|(e)St(>y$pFn=QjRInE@pdChT9i&o$K9ukmcOQ9PNYPaqf5=C7_i15(GGJ zEkmC64tSkA$0R{_f0igpX6;^9oBV+!xU>Tl)q5Ib`y!8a1yQOEZ1zPy;nlA|6~0dV zvC+__OqE8!Tgn2ZXZYt*F=a!s(h~e}?|^XqJ3}Y}88@TQY!*6?#9HT#+HVm%^S8)K zg!W5NoV!92=^BsTIQOVtb!i`_Iv-0)nn(LK6~A2}pSzW`jTz81x`gx2FG8$+(OkEk zY&U(8gec8%*HKBB?_Ni?)?*}4edpajl7w>i31m6j-XNitQu{ARf?taf4JvIawDT-K zq|g%0LlO5Vv{cKZg!5j7sDuYNH{ z_v-%)xn*xt_@ii+&E?hEn_ivudUX=KdJ}5%>Q^DhN6%3{Fxm66`^jI*Kj5rKG?$gw zq<Bz{Td1k*Ky)b};%lRek4aCl;*lzYjJuUh)ogR~l z>c%7Fwl8uCeGL-q$$6aaggpqj)UjNr*6_Qxk{#E=KRCbocd?zLa)#zecf@Lrm6#WUu9{=l%}sUABM@ zv<<~@0BHmHR!ib21+5{`eI1hnGMQ#_Pzw4n1r5n0f8Ff&P;2*XG|#<~_h}~gONJ-N zJ1mn+$$OvFY8#UW7gH;Z3?Jug?rvtWPe@_6vIV13*eU9Izm&lHM*9Pj_ZcQXDRaXt z_MptIWbUVA6^-VZbRm`r|>avzr_`2>r7 zL27o0xnGo;tt9VLGWRAXpO(4hOnybmeVm>2RsOiRpJTCSN3kF1)fdyW_mlSbocP?^ zNc);BaXl;ghaog$=IzMU8*NgR+mP*8z$wwq^MQ^f8$Jw@W6cm~SAHL5ZC8DY6*)8>dn_ZfcnZNT=A#nb zMnnH;_dfDQN!}r;le)YastRXviNC!1!r?f!q3lj63ta~{6LjK(pnFua;gjuT&}c%lp8&EK8Q-Y zOtA^IGx4p-`yTG|v9BoDC!6RTLI}gQc0bBKgnl;y6vvAAS z1=rlX)sFM0HXO)=!~5PP6h~Gh<)wE~EY->V*aRL75;)h3{N3SfZ+BJ=8lF_|35PKN zy5%E9WhNSlhjPY%kPnnqiBve5k3?D2eER4~D48oN{F@Ucg88*Gut(xsJa7TE2e@fpP~{^A;QcpDn?u~M63 zL;W_T8=o(=nKlDsR)$Jkj{x}&mq*w4qabXKC$D9-!5j`v=Mue9nP{qSYuyrTZmn|W7E2pU_)bP zeMfV9S6c@UYfJt_DwY=6csi5w=Tq54PYO#Ed@3vgc_KZ?^WWf)WTn(_I*;Q8JU%Y# z4(jjUNIOZ0~J1XIyyBpM0wNJFvu?p%6z*pQNr#UyVwoA{Wr z2u34BneL3*vN%BzPURGvs->7|w75ID)8s(X6x9@r^`)~0i)y*FeI}I3260frP$AEL zfpSJy7-lp3L6u9ULu^L6dqOj0tP>OoE{JEi6gn_F6fZJWE4 zA6Ysfmj*LEPx+NJbS$6z6Mwk5XrY>K`1H=`UPEQWeU$0w7+}oCF}nrhp;RPEv-RTj z0>d|;mhwf_4Us4vnoaY|KPuPgKG}7VP%Z=!cuk@^AG2^4-B%UK8&<&_*llPk9dkFx zhN4AVTE$O#Ml2cXflnJXAs^{*y0<%l0fVHq(Bz=BjL%?iI%2p$DMJpQ$!JQJf^0)sQ|zY3O^}Oe#K^ZyE^7Rn}bWL+St({=TrQIbGni&J%+!@HX3P3MP1gmS)BkAC;R~nM#nU@ zwskZr>7B?e+E{fzayZ?nmMD?RAvnF76Ov_QO__DA4rEw7Y<8?_zACyPH-&;K#w$tz+^+<7MKf8R z<+6exXqjk|{3_9x%!vR;ln8LRh(HVgq_osK5RK#agtKozVU!E?Cc+{R&ZRTBxr(T0 zN0@b{QM@~gTnt>Eegiq$o$m>TFrIp%P#c@qPlgX6hYE#JJZjUh-Z8Xb}RQ4<(;`*AWCiuzB%;k5>%>Z{R48`!{^d z;Y%SVoiPK~7jVxl`M9rh3VcTpSQe4w;r+{v2)I?0eB1}($^!R)%!|CdnhR`vkK@4Sv7u(lAl*#! zI5_#(cRV~R{8(gT+PF-<&jZsYBLpj-Z;=p-B}M%)X+NLFw*q{F zmNTj*-@i=bdmigyt4yMW#`hI1+2R)gA?}caWoo@;)A;%@LA;kA_zk{lRa^{$?`w1n z<6>P5a7*P=M*a<}gm^y*#$_fMThtLR;APw+7#|Cf&pCj7#`%RqhJ9vU$&EsMd0M?D zZFgiAAe zpYx5vYT)x}Rbkb!oIey+j>vgJVJvFk;(VZRiNqZD3eT39<6B{`#Bv-XrAf=F@v7+T z6(Kk-73MCx5FCFBt6vn3Gli80a6BojcJVoG6y_Sof;>k-Bc(2iNY17_* z*QU&PEMIQnCjP5wc)>J$%{1(vh8Ip53%dBl1bxfAh)us_9`SaQXyBdGFqTq^7x|~t zr^}yCpI+Z|{^|7X#oCm9)8&188vT`NSiXd1660k)Z?I>@4 z3xk`meBX<|Ead+MFy~iOUkwSqif!U6kT_|PzW}(wQvY8AZ-;yv6rlY+0Ne-sh@o#Q zu=)GK`naoGK>zUmoj3yA4}SC88hPMR;Ma`u_X6`}RYd4NpLhTXzUXDz^I_ma;5Wa$ z@e~;i`?7yt0_N-Q)kb~)2)xbsJt6%^z z{q6()2<$f^=^nw2u&#r;i}M`q`8ePR6htB}>^}laOx<@=Zt-M&vCvB|r;U%(E z^oBoib@AQXg64k3T9R^=iPQ}u)SbZlVOV(hQx9IfyB2IdQYuz4uph!D2yChR`L;g( z?>08yQ(NrmaIc4|a+L(?hVdmB%U4;r+mg-YV=<6|!Fuci1Y4RryMjTWhAF6VV{k*q zx=oG2^^HxWkccfog%C?Mp^;(MX^Mr6cKJPcq$&l|H%R5)9?{;G-~DMF~do zy}f(Q+8SFMCMz?6s>npF#!OF2mCHF&>YujSN8p(jMrS@YG$tjOY(&SZ2FV+{{y5!oHt^yK+u zX;BII^(U(=IKEuMpLB;{RIM2|wY06r`ghxg4V{f$!LD`dTN;D%OHkJ0(rM+#q$YDY zVOT6#&YO+kV{45pM(DU4Pu$V3QH@kuz(H;!aXr?|H%4V^0JLS7plR}nZ RZdAjVBZn;l=ai3D{U6PgXypI^ literal 19832 zcmeHvdwf&Jnf6FJ5^@l>z(Am(L;;bK7Rxrb040gRHpGp=@&!YhW`!)tmOz$NUASyQ zVrpn2RBv38ZPRYrg{GU*ZMvb|Cgqppqb8=I?QXj?y>63c+1>Q3sL6&l38785-shP) zM?QA5rI-D_-~Pd|=gd6wzVpsI@4PcQXXc!9cVqK9i^U?0!zyfoD0PqKT#ERC6^gP{ zc*G>JP+TMC3J0=CTiOR6gfmDp*by`Y8^Ux5nZ8$ZGE@RHkVe@I@<3TZ8Pg#Pf#ro; zr+bh-1UiBr1^iQlte12vNG{M_pfP+6n1On+4u*v&vk-MNcz_uUTI)};VZh%yjPlj- zSXXsCTosQca=Uz)q;Ih*i>jsW>o;zaWvK@P^`44w6#~?hM;Xp+vvJHuqCy8(AfAO# zjxYn^N(2|e+Yo-&LAx3U+rqkeP;VYi6-gZ@>FH^RC+lhI2s4YB2yBbAH)8V<1#o{* zb2cDm*@Xxm;A5~S@eK$yz?4B8LZ}1YsN>~`{lG8in00Rj9?@|%;uP?Gx;)x!>tW5w z_DqFlI}nFWxDmJy{KJS@A8k4ae5a1*AwC4WM3;99@KNA-IzA3O1bhU>V);iAP6PiG zF>xEh8Q>P3ek1UC;CJctBw~TF5Y*+p7tjs7MyDS{>;XQZ{x*sJ4D zAl`S-Xm7bF0Q*7r=<@dfZw20pnEFwUad?=3Z-(fT%S9@e4Ml@#u`?LUrea}{$%d1; ztmy8EWHTZaNvD%((Ho4%lOfUF9nWQ=qC1t2C9>V3I}?d)2Y(v>A{|jYfdEiAmlEB{ zv?PXlkq*U^nFvKgo(Kd&+1;r~perDS?o7wB5fRxHL#4@7Bq0J#Ef5lpB?7rjBn);c zi=1FO8|V$j65x%5c0g)65&^ZRH<{3>0kOWhX>EOAv2RH!Ra;8cu;JEA{@HX6&R|wK z+Bsg;d`5rgQ5lP2h-%`Wk!IdhiEZNFb?lbdDqaTW(F|X7U|`Zm?HFM6O*;nnYnXQ? zq0cTdhVT5EF$XBFiV+=|+V@v?k8BfMMz!-yn4r6HMVT_5v%NP^J zLdH;Z5n~MC8pd#prHnBcRxrk(Udf|5^TD`(HZm?`Vsj{xB$gIJI_0Q}=1k z;!UXkwZTF3ReKQy#BF{{`gh0+u6hEAzgFy#AAmh6l3OivDx64sWIW;ursux$fe}5$B)jzc`v*1I0R9 zw~2uUuiM{N{I+5!GV;t@rB2iSntnGn>%YqA;eXvVxg6<>{)u8MQWcPcmlcz z*^q_)f|TPgR{dHUG5-sgZp!-pVORgNu9dIc`Ome_!5sP1(CGGIRdC?xcd$IvQ z4~-}9Jvj$iQcEi(gMeHyxR;7<6)rYNt4HW$D0 zrY@;s-xtxg&d%tQD7CrxWtE?QmZcs8rML-l3hoi>;JO2ID~=Ce(AGM0ul2nd$i7ls zrATGUOgg<`t;LgjweQV^xr4>oU|5I3mUR`!9Tz0!^`eH%{Hq1$h^78OWySGlE@*2g z@mG-etWC7Gb{0Ckv)YQESI$w=cuGm*{Tpe9bFNLrTUDOP7VYiPf0PaRk6)?oWkdE~ zj{J1J)jo$FsC}LuHAVU*oOb0uz{pPc zffuoM_l#rrLf)D|c6(uA|B%b_v!>hylo-&y=Z5wC#cNG^?E4t9PH7K*7BxSGUm9_$ zPJ0Py>D2p&?z#cvjvkvoA?0b_+UE*U=gOb$nN`@O4Wd#luYIzrsRpl$vkhW5ErWPEt#Y7I>>J9xtFX`Omt0Tt0$t=Ap5_dUi4IDf zg?4*SHiIk&!o9=A&#+-9MrLDJKCAgkvezBZeD@CT8_Is6;`nz8mJ1DjIO&UMi3?-t z-%dd$H6PG?>#2=V&-#&5rtz%CqYJ|)|I?AH^B4LrHdO5UI(SR=acv%*ar5Unue<$F z+Y45|KHgd`N_XU_dKE?bR(r3>eXHVlgV!>U^;-KcHs)W?`Vrmr+5U^`D)xN}JpC7& za-SQSR{SoCQfr~Ko`i9>@A+I2MtIgCHjU1xLyaRJ%3mmc?h=g6V3b!5YP=TjxCDO# z`FZ7_^WXB;{LrFU1JcBS-qzL$?N(682%P~xkLu^^)eG#k()2ZGjJNzxFy6q1Yk>Ye zPFuzPPr@wXYJ5|HMTc?I7kV+I61}}!sBlA|E~*s&gW0O`bfq8+aVdh7mcn$ zozow^613uvp*3cTQ+D=n-2wQiotAgY6iusAG@44WCUEc)gBJYVRH=fV`V08M?LgV>$D}R%I9lzt!n&bSd zi0XOuI7La*1wADNT|9Box_@XOHJYm|wt=lAKwdwLPXBWL{Kox5xeLW*CSvIth}WiV zPkk3xhKG6LWtppgL>oO_upym$ZOd)950l5xpn!WBf3Xv0yA>C%RBQZ!Sxw%pjn5rJ zn=-+k$SO}b8A_#-ADGW;49U(;bUP=x@L4XiDHV*%QlnaGM+Ubf=TOvY0R1 zn~M89ExD{t&O{PfPd4dMH_>BKQQs;SOJq@{XJ<5$@bp9yk#sN{OZ0fQN79K%oZ97j zApn`l#8_GCrF30o6pDD_u}s#J?3P+ktL{iTk_bg0JC=>c5_+TLJvi@{J(*BCmda+T zRaI4}N|Y_gh_qwwBKd+%e2cDxNL#T7PxGI z%NDq7fy)-SY=O%bxNL#{#TGb&n>nseF>q<9xLFd zoV*=)0|DDuaxaa0**thpSA;y?1Rq7+9=Rc^2Z4f$Ka=d`o5mVfKdw=%^6bUgDheh3ZMt9oC-_x8ikW4sB98Mz=+Au!6E?NU z7L`m)amzs|cMui&eASuV8Qel=s$)x5EU%8lyQ}5yx367PN0Ysg>YlFZbgH*{?WU&Y zhUy+}k5^&K+qa}Tl*tJ=iDyl_XR)t#sc$8`!gsx}^gRd_ta1oxmiMDBHjKfCnx9A8 z;~0$=>puZmzgGjgZ3%{-HpzMnt+LHq%bZW)WN}(=V$S>y=G=#qb&~Z_l(KnQ%KBas z7q9}GPYGC#;ci>l&zw)=WN}#epo#4|inM-=$#)(i@nw{>+N~`pWqTK;TR+c|i~bLi z8Xh+gn%(+0lwKt(`VDlpE&dTpjw07-x1OOEOU^OpItambdMnxAO&)8IVpo%BeS^98 z%48jL^HSc&SlI!YoJ@uS+hCo+T0SIs+nF4Y3|-{?3z@8BrT6iv4x0vH&~YY-gR;`= zDd@v&fc-DQ;j|red=tQSkjOe;h)I8g1nEvD@Qi_O^biXkyo+3)VYTBaXYNNO?@=Znl(~G2!1ghjdlPm0D^_TYGx?C>Wo@63xrdp1NG1oF z`>;%YgH=2tc_U1IPA0FX+(%_Yn^^2IsaXSak4nv!k@xRq?t7U0lFYq|$tR@T5PSd0 zC^D??W3i_`i#p3RuK8OxkoNSGGGmCUd=9yAo?p`lUy;RcrKD%r#w)HyaciT6dR_5e za9F!6%%40RX-#W)U0~dL7IIuSGucLhnB>Ko!ln6b!rlbz)H)nZ$kR5;O6Cj4cfhK( zzm7cXd`(yf&{(a5MeVzBa@prPx>3D-PA3}z{uSW2zn!uq|03|)=W_GL{#l&d_W6qc z8rg7zf1cuZ3hM_U#y)=^Sf~6FC(Utfc@-pz@=9o6DgQW|TFxI)Tlp`*s+Gr)Z!iB6 z(vEWeMoud4!P!~913YD7N;wK>juqwaKx`@hAu{m@%oQ-N%r!JlBXe_{(+|-@FZDyLcuNIoJ!6U&|tOWCdaoBJ93X;kAQX2?(DCBmWBIh2eZJj^e;emX|T|dUzI)9eq7-imVlQQQx z{)4nWuS6clJj&dsYVbN$#Ug*3+ph#pj;oQ`=E{E$K}M*-y>YHZDSI~K6X zpL$f9YPxh8$HU46W;rghS)cj1q2FF!c(al7+s>LUbxs zHB;_i@I?1S!(K*u8V7Zmb`i-kO*-IVc1*YoCN0w{aIWy;q$DuqCKE`q+vDVoER($N z#<_AmdEKOmsqB?0V3_V$>-bkPZljIp?%yQZevd?&<01A){GH&YyGy6)mD1tvY?LFR z`qzzGDSt)^1uSLSA*9PRdcxGRNPYlyIvt;PJdfD%cMEW4Rck5yF%DFYEGhgbxlxsv zbP)+U?M(ir2q|^te~7sV!oEWK`(}z;DSyU0A=AE!)A5yeLSxJ9kD!>v zZsX&N)5t9DMzD%mP*k(9X_vUh>B`0MRBde8iskCjT3+;2htk>DpKy7kRN<n&rhm zUWLS;pn_$pa66`2rde#xtDFm*l`xyIOtrWj({Q$xUsb-Kyb_nB)|r_2S51ERR2Ka&xIqxq^H~xjD@PZVtDix`8z|I-Y%Ik?gvnu zgjgt<*datL5zG2QP=rs`h9lj+C>zFSYcohet0!)?cs#epoIG0w(%BQmkR zzGY))plM@$%LadQV@D&B{!Ja=P=uCSkc5+E<%7wzF@(gjf$k8bK%mT_z;ry;yL_ox zWOH-l`ZdjghQ{{#wkCf^OB=XkFF`_gQe>jZbk>tgWMVxDZ1eJts08Hm+W|f;4f)}W zlp0Fru-VLqt!3ST9lKyHtHwHn}sT zOG$QjOWsT-_UFnVvau<{6;WFT`{|)XRAGS$b{16D`$spX(K)E3q;NJFNCbOngdB?Kf@5K+ zj4Iu@!QXLfsbfQY0zH;Uniw{=&k~bHSeFip3L;U_+&>+Q= zi5}#1XU5gMZc}q}pk-5saw$`XWRqZ~6Q-qTY4q+Kdz6jPopgI-w_dUC5XxNaYA|M^ zn3DogOh<7xz88%9%(%Da>a!;u{jLj^tZq;hrBOS6ZA*&syVHG!^Nw~4dlkg7;d zZyRQzE?raUYCA#J6)joBEPkw4yW_zgc&T0!@{tZDd%I#70!W$*jSVx?hzs;4!+K|D zrREqP*~l(^JO)&r8Xp{xQYmN)(NHm!)r~!FT)`8h&&a7&7SLU;J&M^*dRprK(hP42Aw<5G%YBJW}0lkaN z7J7d!lHM(c%OxguE+R<_=xs1++t9cH`IrLqeAC3RKEP2bm4K=%WFlN@qG1GPuQz*a z0`EpC)iXO`Cs|B4=f;l4wvCt%8{69CREQr!POFloM|UjQay^Y|^VMybUD-9Vyzpgq_hy4#h_h)GM~#&9n3V7(lG%uF&Dy4_Y_Lc8qCvdB;|uRjprDHJ z>W&Xr6}}yjbcWCHm_Y!vbRlr?*9`ztQZ~{TiQ<=obE{8blneI8 zLc$lyCeyf%39D#Zh;=4WyeorT3}`;}1ahP+*Aob0p!P(_EnzCx#SvV>^2g9%?dnQL zb{L%SCDtrU@r|V4_u#u@yd>cLi+tA*09T@=LtZWb%}2nEkmQr^1cKlJHV#}>$)gr$ zURF^a_d9L|-!Y^OI%9_G5pV@8`M3|l#8L3d3xA!5*Pk~b-~vwaao^-90QXCb14ZPq z9%t@(uwL$W96=?^kv8gOJ_GN{xJSY?_esuxp$=(ty?`QwfQ4>ZhWjiYFmRv6kjI#J zgK-3dkNYw!z;{&VWBUxg9MaSkw}x_koy!&6%P|f^ZVDL&pTJ%T3-IpPILOCv2ZF)J z3;7f}=Oxp#WwafSy$A*$uSYwuVe~dhQ75C`dvre9r4M|4;CsweuSc;9u6i?@d^LC$ zvj&T9h77V8X+FSCKK32oKNTLeCq~G_;QMQ&X%q6vcTqj+JyiAw5AxB@M-U8od}#8! z9+i)5c^L8@12Xtt0N)Fqx8{4o#K(7ZUIL#X1Ef;=DH9*}Ye$@}0uA$A#s5VI~GKSnU~x#tV9KvLAn zpuIeSZyES-zgRj9zF$t@tH<)|3WI2(@x47$wz$J5#1=Y*ei$_F5inh&=YI!@huPu! zK^ntU1lrCxc3^^-OM-qFNyesX#M3w6T~-W05Axd(*cbGDj!Cn;W=s%^Ce#a-w>&rx zlAzvtRPR75tZL@Grm$WE=P${xJc#p@!pe({{a2gxbT#iNItDEc&MykfNbc_{%vPxR zLSenbI4|I^>2D=-{40#51RNaa3Qv)k<5^)mNQ{HyR^bYX<@iL(CM~DNp`x=_gy48n z7?T1Hjw^-LF9pYs!d!uez9p=7vpF6VeWs)vC)>Cgko9wh9Xo6SFYcKR+qjvF{QUJA zJ8XhGo@0kiynPHHWy5>-=EEkgHbc-o(ie?PP5gY+m`9mMZ1|ypn+#^1&fgc~Ab-FB zh>0iCC(55lpIF~S{)zNU>GO#R`h0o<{+9{(ZKevS|3rQhS+?&F)o-FaZVhljglbsv z6b1LujDz*p0UQ2k!Q0&%fenAO;L7EFz=l6su;m*A=DVAeVS#`50?QXSC7vmE0}q+% zyAN30``_39SD^o}ByXBH0?g+=l>AEZIIuCkEcjZ%FtAx4ZZg;CWOKm2eOFft7qAxL;KV%mq8nMt=+J z2Yx}vPXinCnH&0lllViLvkZn}eLn)`t1GI$nc`=_d<)0W|L4G(-k(#gZt)vnzGJ*u z%6Ex!O!=!#<>vrzMg1ds{nfyHamJ9p2AFT#u%B4}Ex=p?1O&c9v;wD4o_@#ngn;=j z5Pvzyza5zKry*|-FyEaq@O{8_CixEnH<;@GG;kl}4@-GMJPteve5a1T25kI(u)co+ zu0j9S>Gi(|d-$F9#_GSOP z84AV%xYM>hlWy>332KsxuzPea~MCBG26fz9#`0G|Qf_!h+{Omq(< z9sxcN`n&YxdKK41^zozUgo2+Y^5jQae*`K+f4gwaB}G7cF1IN-Q6Gs0`*uu4>UKmcLV}J4dc*z>Pw`QuSUSssdywC z3Hxfn8cqg!;>j+ov&p53KrpupUm3yjLm-^%?cHsNZrs=~CfNY%+SY8qa*|GBHAZ?& zs$2(=QvXN;a{EGmBMU9XA`V|(n9b>o^1P4(CzO5;l` zb#=xEQffqw@5Bi#+y$aL^$)$6$@*7b#%1A?F5|HL9*j8$E86HEtl^}CySbu9WsR4@ zG9rVQ-Qtlkj3qHV5Lc1LZ;5szv*M<;liFSP<;i+OjJFlKK3(~UyHXFyMwuSR<^_VKF}Dw z2EL1ZoXD;ecDQsiW#l)00_tr=49k#61=E=bD!}H2VNnVA-5|3pIKEsdA9II5L@mLt zZ*EzO1?84?>)IPT0v&7CHa7<3H-yZ^rPIpK5RK(>W-wVsH}&`>`fm9Zqp>nI@`FZP xvd(dN-(~hz<|wuH}d~EmD-_!Y7=f zN}MA;j93WLmJfgjVH9Zw2ZD~EA-u}~8bcY<45U%^q&Cn5!Xb|k3@k6a1|6{&0UeIuY-zPDGX@;>p~uKqeKaRWzzZ zG11hz8UIQTbe-n)pmWFR%-SkY0!2173)j*oRO9 zyu!fLyBc_vftwMx+@`x!z2}M^;C9f@MFX+?Um$D;K7p8c4MHFA(}sPNGXPAzq%({F zf5b@Nf%snFJqC^EG6&786>3A~RCDPGQf;f|n zpu{9=r()_)$Forp-4)M*(zPp-4I$Co76f-Z8O&v(5#-YZXsDtYK^=ai7GjX>2v|c8OWz*u}){60_#9cH-3%vjt*XiEAWgOT@Ml z`y^(I#8{ytUWwTj8CMK4?aZUc`gTFZ1zG-9Zz&=p!z~5zCV(o|u zK@@m*WCU&5(Oy6avF-Y?H_<7>gDn6%}o<7W#Le`1Rlc zFZCdA;`|nr>^ZN;7TbkauO1s2*y9jIxnJfF4)5{L zt9v7VD$*}YcI?~D-9kf?vSQVWc~9r2er2s zz6#Tn11fYlquVk^|}7_a*UJVC;f{V z-Q%x9ba_XiRC1xQva_#0P>j57tO4qWh6Q;G$omq0FO0jqV{_pwn6po>KDe&lE70e4 z&*b0CoSlF6=J^9Bg4sodt4>Z#3=7X=KN!|WZgQ@#`(2vjd~@txdcr@0h%)1!&mTMJ ztRDY4bkHvJ!tgr3FaL~|@cZG6b%p#ozn)n+yveT*+b?KnYh9l&_h;)bK%&{R_v@(I z1xPh{_TI@PQo(H5Ad2X93BR6x4wlL)K&U=g(9mD`WBVH4tJD4cFQd<%s6i`zi#Pp~ z`Gfg?dFTGz*l>k^aBNoHc>XHCEAx#)KP%xHxw*{q)YDzV`kKMRuCAfcoMYfO!Q8Bd zy7Ba@<8WfvdEnmH@LoH5tGsZxa=9Z}HWz$j4|Km}&)56M_YP)w8xesbNJ`z=0*je0)&bk!lx zQ=_Qk*a%xM0YSTZL`UJ)6S94WM)L=E_2v&>*1n}jD|}RCqA?bu4jwf2mcqf`kTJXM z8jJu}kJ!><@3FP_h{C_ieBa>liTqf$0yI=@d3)h<)NSjPOm`H%2bOK)Pjcj}45qF(!M4gvS-zn!fdG@u9$z; zvv&jPpC4;q^iIc?ee3+i?S*?mJ-DvI3kNl3j#lW}*KaHA1f}qv@~*l!Grc!E>wTWR zN1?U;D$ia{jrB#Iy@wIky_x@Y#yfDKFY6v@s(UNr7`VunJ689WXYZFl&7ZhzO5IXZ z-PS8(S5c8P;v#cu$$cD}>)uS?ez`KnFe%6C|MERFl4<0P%=sa5u0H_V)#yUg#_pJu zIgT-fae)!|H4vc3)gHTxrM`etTb152rFZ=1!pq1U_O^MRng!ont9&ziwCTu2aH)~? zb#HnG&p?VzkbS%Us_Yx}McE@qbYvNwRE|#CPw4{?WKPTxq@^$Q;1;|IvvOfAa->oD zgPxlP**J$gq(i-YToMe2Iu|o9`D2ekq|#8h5ghRMLQrzj%{W{vezsE*3_m+-($8K& zJD7eJ2Fv&plWyiGd|;-VJ%wB}v$WTawCQShBF#Cmc>g?1k#Yvf>6jMAHnztOVgz;eI=Ob#dWIG}+*%Tzb|~sAQWr==V|6aD(eU-nWJuitpoHtgslw z!gtU=OGoA17BaSU6g~vukMs3s3ID!(+`jbR>c%pj{K1il^1o(QL)|;+ceh>h{FuCd zPh%Y#-M4ij=ccqHd}_}hGs@)u^-|mce>MIp%WT|VfEWzcZ!^vo502}&-)qRoy}Nar zlDpA-F8DFVVBr{Sk|si?y70&+pCwH^Gv1sDbw^kEy5hSc(LP^2{<`9c=!L#|JnD8w zvq*${BX|*uUWn(8Q(Qh={;K|XA`%XzBffYtoXAC@)!|gKE8bmQnF+)e`K~&3Q7KI+ zUggWgKM_rJRpD`ck#E5TzU97D+Si{>CA)pmWF#I+Ml+dA(_eqOFZL?_V#6W{|{|&ie`OZ*1PZkYbNVS%zFp} z-#s74J0#z4D~xxoD!g0c5nt$ocsD?N0GMVxkHB|COjhD_1YY!$lhDDLd;o#((s-N~ zXCSPET&AlK^WBf-_^wQYFe*~VAs<62MLUinegPQCKkDN2#R6u`G}jIo^ZF%pA472B zJ#j9=xdt+M1eW zHMO<1zN(GUi0|T1*4M%{2Sr_S{vxb3{QoW@D$sEB3AJjX)}8zktG~sF?81kaJG@ll zqVLgn=!^78{RXv8K^iZXwTqV~`D?*XAN?orD?Q{AVgZ6(?8W~*=)1iLGhWHbG=N|j zN8gi+VpJFiRA+W)IDD()%T}(ajwZUQ<-2>JLsaK7>FP{6T-}+&q*YzJZ0Yj4x+Rir z?dIl|b=BQ`)n9@a_dx9u=^x9ME~^e_a$I)ut?BU929_=h)YSxP0!vp4+rZ~xnq3YT z-Ijt4)Xz{2i~b76dC@L5dp#&F`#$Xj#P)qe_J!c(Yg`9{g9)2(c48Rnvu0ry6uQGT zgiKv)JuT1NP8(s-Mu^i|I+^T8wzlCGB+Y{QJxDW1d75y34QZRx{v0Bg)}~zud$eXM zgm&$Rh_%)$CDMgmgTcj)`R;PW_M3^cr=iSIaY*sIe}I0{+U{eicaU_PeZ(m0Tt)*O z_Ejk3bu4sm1JyoEq$DhuLy^!Zi=Cs2xr8%-VlGGV4WR1Ib4&K3m?)ta*h-E;v%O>k zHI}?adPxZRj*>4T?JS{#%_@oE-&OJ?cuo_=cS|8FO9t88B^8+N>|(YDW$K}%+_~1h z3t7&s%+W3YkF)2?C;_9~Cm_Iibs6%sli+n;J1Pmf`);BrnYA0KHu16~xU`!os`oXJ z?F);w(}|L8V6!ju3Xgs|RCqh^XJbQ`GF2J@Zz&6u9^v1K$&?MnN=xwP?tyUqM?)wA z8CRgtY!*6-M7{GO?YD@XxouL3(0&Dqb7x2*U3&^eoV!%7y0j~4&Lw85&%K6htp`b<`OfQpCJ7bp=aA)W z`zZ;vlsa%s5`0=0(OzYZUpvb3Lkd-C#T0RaLW{K=N;q#+s7AY$=w^kMt0ulhHStO` zNDoTRCMy)`Lwv={*^nH@ppHniC`ya?CXZzTsBO`~+Gy6RB!XOeZ z=hwBLB6dE=db1}Q*rE^7>Fo=3)r}96+rH2x^i@c(C+Bjy6ZRnBV#jjr1j;yS--Q-R z;OKHJBOA-OJ}sHfFOp2vWGZ?FG{4k_=xVZ(b%BllK;B)mA3=RnjVr44>g_?rvtWTcxn8S%VQN z>@aP;O-kT1q5ZRx_Yo#mjmRtq z$v=a|wo>7BmfGgnG}l?KN>>>=1(T)C>zspsZT4BSD`%IX1MOutTbbLv%KdQwtwd(Ud^Ai$Q^O zJkde;q~4M$l&OHw*|dfllsz7ga7%9Q>B#>`F$y8NW$&sT#3pR9XF^lNUAT! zR8EuOfy^^OvqV=fexOTt5H9S6pt#zPN2J$aeXDI$bEX6C~xk_@7R(sOyd(Qx&DBuA=ngDYbbyi+})IbB)v49H$3eeWUjJ1RSsW!G`GPPi7Z~cWYv5- zwlQsdN3n}PyTu&dhQ)lX)aKZr-==Ki`=xf8&A^zIVG`FGK;Gjj*7ciE5N(b(uVuAC zZUkrJz1U1fq6teaTY}B44Q(6RTN*btBH6xq69|z|B$AdaQ>A1-K}tLu>N~Tk{;(k>)zu|=GhCumDeRC(`%HI+whYz`!^x~clv*Y;jT(0*t~EK3G(|N9 zyZTZYgGH&P;n{R3nF(Uy&oCj!enGy`6-Kj}{h-PvQXy6&)!7r3mCvSv$xtsVoBrnF@!pacu8TwQ-*zEEkmh1U5-SydxJ< zdU7~mknBcIS7w^#^_yE-f^C~ODL=AwLN*0vdY7D`4EY_?t;elUCkW+`7(-4Kb=p;V{7nnvjolIMv&U1#2d) zg{B6jWqbyEQxU^Wl+$4}Wuv>)=;eY>!ymd*XnL(0dK~Mr2B;eBKz;hMMxRa_vT!)* zn({6n3m87$5o}r0u?a=hz%l%{D>Dtkcr_w-Oio1@PLuVXY^IrqSzt~yoeU*7eSll3 zY;9Y&766A?!q-Ymrkn#)o$OC*bMDAR)4PrFnL&|6G$~6#wqdL(c0=O^$i*~bM|ZhtrL!i4v(Cg43%xAz4P& zv{_eqpyD@LJZyHXs=hI8C(Jn+s$`Z3WOnyvL!F4TX%)xJl`tPfinD1E!1D?>H!_&%rhy=6>1cxdD$$q7iU3EH2ynQFKo}bt{6&_kHY^e;?=KOc|t`>AMU*G_N{Ci^lUYZCobb7lGL(jt_ z(vE|#(qyvG-ms)eJ{yC4uVug1l=0pSzWrxoZ`34OXgqgm$rdlq7h(^c$GA*d*$lp| z3r^iGK7+5uD4zh|6LbvY0$J)qbICR~^Utjk;yejx&YT$l!QVSnber+$hX7j;TwV zHd9jnyeT45nmBU?{?H6;o$<(DF@p{#w_KWlGg~eV-y2vjP57)3@)k@R3%YoFg1%*5 z#8y8d-fj{R6JI+6V<~0wIu(7U{F&uv>YK?wlfHdY+o|pO-VFLnGq5}wYvj@1ofZYe zGx;rKS^q!QzM1l_hd{2)&;&b9iri*VK>hN3w&8C!obLZB=%#<#@WjJ|il)EY@O1+> z6-|G&VJ80xuxqlsSNs%M9xjGHo0yA}ff%0_{l5c_Sny1HiZDgIJ}GaG;0~U7{)P7N zxS`daT41X^+~z)x^V4R1HvyX$>-)d;$4q{hJ9)AEAKM=@<=sESo`-v7N!*Q$&0|&??t#tJc9OIi1KsLzubxyc<$LDF`i8^#qzm@GixcnOqmVr z1)W>%oQ-_IK44W|2yW*;e6#MNUr^p!U~_)+qW&GgTW{1|5h=e|L`erfpD)Ot1%5QI zyDl~G9$?+*&r-Wr4$+=L!bFQ47bmpg#DKo<$1&7{HpZL#a=Jwf7r9spw9yy zg}%29{83;&R{~1?OM!WC5E0sUuBbzz9dz^inhhiv^=JES2j(&V8l!w4usOezzK7*O zUuV#-2mT@IGicy_z}q4Jgv3I871%2O+rWLGo8RxeV4?fqUoQg>fL>>m9|tz?cXRNC z)Z4%#pnt@ma}V)e;5`QB9>>GLFB^Cvu+{#L0-N`*Qk*bb4ZPjBf3bdzz&yrJv#@(2 zE(5mO9|3N;1@9?Rez8aa^Q^qd{|R90_e6Q%QP^XCPjol%lsvECCaHP(kl>M#L*z%A z{{JIj9`sc5=Zc>J^8l!ce=(!HsOOt1*2#Q))4cFcT%CLWwwgRMiADZ;lCn$U$qPlO zGrmN=xc{jKm)@@hn|G9oRRE~sD?GL&KDe!e|J%mkDXqnx2=_{8Dpwg`ZWxC>Eni!4 zw<43xb#;Lh3^rgLJ=oIRu_+h?S~m?fUL0J%am|Lt;M&Hf=2ppYNy8*}U!X>yXZsS- zY%~&Biqer(usf0J#7dc5u?U88yM$a(2u5ku~}{Td7-uFw5E{zoTwv@AO=|tIz2F!#|%;O zk-P5l%YpWM!wXWOvC=H>c^9 wOVvhof|u+JZj5%vvA>aSNQ5#OEFPM!F2DVpD!Giu%H_JDI`Q5-v+NxK2>ur5qZzKrXTU)fx+j~{|yY_au_^gWJEBF7OIcIYcZPoVP zd-gYH=0D#z-+c4UH?wDE&bg+pahb(p5yoW|HbJ!btD3V4@qy`zQYGACl$a(?7gK}- zS)^6m3|iA4(;>i*T}JuJShTG&7MdB0#xt9} zsf71jRTfoC-RoDZl4Yp}1NDYFVgf=D0xu^5?Jyc)6aw2{j8KX|J;osz7t2ycxsfp< zW*wjP8Usc&on{hc2qg&8Zivm-ZUE0V&G`hFsY?Yy74Qbc#NR`x1-?SZCnIhJen{u9 z1`YvF)ah=-Y2bM}W?Q!cFVJxV;$7d-oNW78F;R39gMOwiZx`@gz>gwk{nsHp2>d4< zFF||&cqNQMI_3Tf_#B2nRr*ATXcoHg56t0cQ~0$Bt;jq{Qh8iOLy3xPQ((M z!byKD5fts+$!I*?E|TFuj5w7Jp+teTO)+gsM$=&t-W*MX(!M#B4j|F6(hu%v+@DE> zL&&EJ$O$CV{;ohY4pGTiI4%<1xFH>kBtfrDm7hg&u<1;}Owz}Q$48@ZJDYe+&vQv^6$eSgwFCX`fOE6|?HCx1h(|$yk1_hQ zl`#g(TE=jY^^7qfHZX?sh8SZIMHpj%#Ta8?bu)&er5VG~H#3GNS24yw>tT#Ru$3_e z#CFE$%o`bFK(5OEvG-+X{!*xtKfs$GLZ2QGgL7-aF<5aS?$m#c(=rCS!5dV4vE>q2s`0ukHlfryWIvBb1QWG(S5iD{9@24c6wv`mBzI_i>`7K(He3yEo|$Y$c# zKSD+YEf(n^J_3xmaLs<@vg{vvUwYlw+8l9VJVpAyra7BdN4gQ^TTu3`9Xnv>mOM+W zyLRB0rwGxU>!q&S`qS3I!)w<)J+Ncw0_Wb;^PEmg0{Ead1&3*bpveE9@d`wa7g1yYMegP(0A3E)h%nJ*xX#|lpV;$ zJd-VNE}niYt9hz_msQ zca>+-n|GIeYk%3!{)cIq`TNtQL&cI$&we`l)FtaK^Itlkca(0gmfn}kVGws;jm4LL zQMRi@HD?T4*J61p*Xo(n?8~n~8zjLpAl1#DN_7uvw$U z%sFqESoZk-%I>{TA^*nNF9A0FEacdzx7Oh4GS?1T?a zQobgCgL2-Ze%LU39L>TKAvPY>qiUo$4|&X$%nW6ZOBt@ zYx2hj&HmWAAp7=e%ZK?LC`GFr+SZTmhGnt?)8A}rS=|RK_ie%$s)VS6wUb?9?H*1* zm-r$-XRS_T=U-F)RsCvN?;ccpLut*L5rN0#+6@o|RC zfA*Xhoqi$v4p^@HE?BBxQ)RO6Pk+;=)bQo+g_2T-rl!b$pmr!X*_R(HJKl})G`YDs z^0vw^@#RloWTQ!F(6$^Tq7@WQ_wdOk==aEbY{z1V&MjigE?v7OQu1|V%|zC<2hd_Q zK%rpS)@nKzmF!)IRL}YDvaQX`I$jTjd+V8ZfjjeOfNe_w^3@dUT3Pn^sN>pFXZm>k z(Q}ZEnYY&C^hHi)H3#2CuhY!F{I`_GN1MQtJC*(0(pirFJ)L|nfY11Q*pKw^`A+)h zo_kQFQ~2^bL1%BmLCdz^jK*h=G)pHvSrK$6Jv( zXsz_(Ur_}9FW2M$SIssW=9++kCx%#6=Bqe}|{(Jnze^F zPCO;O$F#x2IUCZMx7Mz^bbvg@^U_{Culn-;h1Oh*2PH@xadC~w=kdREtx5$t!VBE( z(aoW7w|gOO?a^5HeD^{u8#=;iB!XQbEOf)?ThF+|hV2mI;L` zgNb;1w4<^j<&8{tum9wtQktrGfjbqwGMs3ihNaJR_vwq=RqjO6y(yW9ceumxP&5z^ zr&1TVE2eH9EufFTBIRDN$X$^dJzD4jy3}e(@J|l^e@3=juCt6v1e%x93qvVGS-Fm{ z3}n&?s_l&k@5XRajIKy6K-2Uh(^1tBSTI_+Q9WB`$nFj#Q(?DU+zn-dC7N=FySmd` zM%Z9JI+wcA2>gFz;9C5Ht(uc-^j-Se^Fr)TV5uYK_hOBNI1fxwhY^YqFzd;E1w?W` zVKL;gx3?p3zkquOCn2OEm+25To=mAXMZDR zVeY>eLe9o|djY~l2$vvqB3y}Z1Hx?xKR|c{;im|{NBD1q_Yg*7o&5!bvk|1M`kI;r z?rGR&neLwBo#Q>%J#Bd)9!dr-54#(=C*z(y%R5VvW>$5DE}t&M|8bFdpTCy>pCWqm z#bg*x%>vwE5pw_T44G258HlXHiPf{B)Bor%^hf$x2(~|6vC6v#cdN)1_sa)c zdA4C0tBB!#JNj-b!ia4ON{dJ)rZoDWRIUvbdcBpYEh&z`%IKW=^D4u!_DZ>*;cXF> zkwjOxvZJjs+1*vSbX7xRZDj{HJZ56w!aJujn92w^hu^xOg! zta4~*7H$TyVGLf>{O@Rc45Q3q{RNQq*Rw#k&A}9^jj}$3R@u&2%AD`uW^r0CV9wN5 z=G=svb(Hl!l(KnP%6bWj6|BJKRRZQ=7~7`xGUqPbEDkF--fYt;(t0bCXYVHQ6_m8v ztt(N=b`GUm?`O#w|BR%D`B7+g>vt)ArmW~A=xjUp_bfSxT&LZ7gj&pbnK{!T1Y0Og zWd9<0tO1H$NTT%}=5CkC#mvo0dAG8%8)UMW3^}&JI)Sy^D0y3$?2`;_<;DBuIBMVJR3r$bvhsCfD~^ z?ai#f`Ur!W$r$y*U@$<)l6Kh|K7xD)%B6&hr6{@Gr9X#gw$4Z5(|X zid*X})NAx5;IOt?m|t9uw5GL`9B15g6mm)~WU`qAG0KBGg-i3>guMaSskJ&9kf*JX zl}r_mUxHO@c^i4wshY6%p|M&ki`uu~R$`yxXh-$-$*b8A@N1}LkDgPX8rGEyi zRvJUTz4Sq(9i{y58&%qYyR&p7c#6cBQWVe}^GnY{Y$^R6GO?XG8s>FecrvnzG#an0 znN+se#gywju(=-Lt)I7lLy<_8_ zP!sInU>V0|-mO!ej)|=QN_MYxYKh}F)cwl}xg3Yc`4y^dom%d2L%!qc=W(}Ao#c3k zGOw{onUfu_lGfvq$n7|TGPkN4JdW2WWt&3N9M4m;uPQXd(L;2-LbDvV5#69rm17yD z+_+83oR3B>LLFmii625Ck7KdJO%-l_Rw{&YM7tEy9M=)uqC`0zXHf9%3Y9o=DDO~X zYpTmp!6tv_K543Q=`xPJ$^|Al-et4CcblZSp#r<0NIQu8xTR=Sk;dwZG?lKPMJ<%} zrM%3hQOal`3;kVnCs~DcF>a0(r63h)<+zv8azmYtNr5V^tdtCMaUZ{g3{r%!Rw3$C2>(9K=J<+gNkRHcDU8KE>WRWHva1T2sR0NY2X=S*Vd2mw_m~xQ`B-!mT z@`mS1-Y?=lzMi};(!^Ny$`~+|JC-{BK*mnmi0=Lj(dE}mq&aS9kHpRfH{D%2RhN_w zcW0v3MVr0qt!NTVl=J&NRYsMG1V-|_E=9sf{)JF8ks;SX@2a%4&2 z`^b%|#He?Xpwmv|e~Pf~B<~Mx`1>!?{t+a*7s(m+DhK|Eh5cM+Q6z=f=dc`w6fc)d zb4w&sC7DXT37za!MIZ=k6K?jolw^I0$@6wI7eUzPOMhQOanm+-=TtKtZ+HTTEsQ92%vq}GX;_!ks^ zvA6;27@G&6xcGeJYe+g((mvi|8DCsXCiMN70{?uhphn?TdpwKcv9@7+B^ZjzM6nb$ zT9<4mx%ecLjFKT4@P5riDV+xClOd&S0&>qPVNsVIlHtG9g4!uP#+@m1$16SzAXW>% z9}fWwOW>~52R>3&Q1^loE0=uIF2igBJDG5c^qxv`THY@mjXP&UVflooXo2%T91Eh8 z$RX@j9_QP7rfw5>5H)%#L`bQZC*q^<}s)>DdvEhm+A@Wm`0zV*aLJs;f<=jP(GD zlMuy#z5#-3dSp!wyP7l3sQT zf>o@*eME!)`dZ_Y#-R}UK-3M)^^|RnWy*{xYo>&xU14=Du5440xxi{imB`^r#8#}c zO$p7IF>}h4DUuzn{9o0LBUIOoYd70Ci%}EQ;402mWKlK4U|4p{IoHp#=5(|R=haBm zWA|dUzhOnq%H_Vsy4E@*eXCjvgq2@HlE>2WbeT4WkZ9W99zj77WVRhdOL zHrCZIY4q3DwbV2>_*z#sgG=@jB(x_)Dw0U1-I;hQ+7S zRl07uul3?W#|HUMK{TE)F|1fgFObM(U_SCSNm#u1S^sijis$9y{A?XB|>4Zt$t}uFghCRwg=uUchc#EWF{JKLZbFr(z zn2KOd@<%Wo#n|{RyfC5nHiRqhQYH+AH$n^*bjzE{)lDzW9txxb5Ru5F+cNDY&Voa# zA{o7Hn1$MOO{J@C0$EqIU=g$Upc$p=5xzuE+zx{d_ znJsihCY;owG`SlL{sOB)2ig#)lPZoFDd{oY!W&Pd!`>xJ8)l{h9l{$4q_EE)+7d@W z6{nNJi>C_i{iiUG4Fi7AlHnNnRiZnV7G91t;pH$A-gW?x60(ura0LGxoLjvLqg#d^``C4{#XR zxX8<^9)V{Wte58)e5vqkq>Xx+&%jj~&pw#u`9~EPxI8o03n+pJ*yxsJczzNBAN4Wh zG3IJ8hG6jVyd@37cAbyyGx#z{Q&%hv<^K8yAn=UFxX8z=8^Pc!#}ipO6muJm1dV(Q zUpDdaL4Gj=w^9-PqOQEIMKI*?d30Bq5MPiKbu;R{Ugx7-`oY%^zMQFEw_+DJnfMxU zB;7c6$R=blO=i_ zV!sP~ZlsONkoP1qSg&!B?_5)ck^DIrj5K+l!l2~KcgAJ3{dr`V`4+>-6$X=u_KGP@ zau|GAFBUFC#tGyYX%bUYa1Lq8Fp_*%(@2x=-qY}|CY?vW3>wb}nC2McWjjNNz3g!P zB8>svE^Vi0i@T=@F@*&EGLno<)rgn9LL7lH+{ou*n0BV`b11McjO%BZaIP_&3YmsH zgKmyF4-%`l-qn1ku&SB!n!>6E&R+_vUgkWdu&U5FSG7q`SM!ddb4G>VW8P3$M)KTN zVKtz+WK>vn80Q6rIl~Bfbfz%25^!;xD?CPGj%S7O0xT|$TZJ*madCVqtY!`4{MIIW zMU6K_hqL11xKddCQ*it!tVTG;iNbvQU5y8YxvwyE*@n%4wD+VTB2qTNH_V4F+pw97 zbpCq{T{d~*X~w4x0inD2Ec`Qybu0UP7Xg0C$GfX({wkhxnQk8Ix`fsKpp`!xHH!<3#zee)z8&%(fbhkcFC zKNXm-7At)x3Lf+y*{(V7)alj0{lJ`g#-V?g0UPu8IDGlj2s{h=ou<=yV7nFdEsz+` zlfWBLp8sVme^{AO-Wi{#uqlm0&jHvX^1;;pKm0Y7M>KMTCuWWVQu&HBGi+^4>GqkY~7zTL#{ zz`!woQ#1kC{7unWz(ev}q6*l!+(=vq?1BCpkY@h`fbTQOj{@_>NK}jQGf{MpC@&Ur zg^7JHH&=+~fBxeo`BESD$`^9SJ3TWRKVJmeqBG^n`cvP?`J`R)N*2d@95T6>#uomk z?8tngkk5AH^@&AsR=^ViR?ZbX6bRx)Leu9^+{RC(Gwtml`TaH6jrKP-w6yyDK()ir zMKuLdw|AC+sk>w0bU5Ul4c1V?-w{i+Vc$wF{r!Q=W+8V7{Gm)&*A_!`-HO^F$p%=~ zykt4HXLJ&)G15a)<-UTH`ZpSo#{ue9Ml>`XPNmTV^^Mr##m4twvxL9);uTAlH`GAi zkA1l|#5YG|_*SXp2A`d&{*xSO(rUKSbDOCd6Cxczw@C~IB#&$1X2Q}BCem4Mrmw zjD-V91IS%fA-~e|>+iLWfg9UEgfc2JEpYpp)Qt80CdAQ4^3s;{n znu*G?>hni)KEFdWV}8wO#{RI{F|2P~xfJ`KE0-;6scZGOE?L@GhtWqLkVhGMcX2bY zpr*2c>Lb2BNLMa2cKDWZyZn@LSiN%3SZ|L1qK*FMa7Pqp2g#aPAeF)foZ)O$aJf3d=_<)@1Vq6eubrgpeANn1m0%x@`6%ySUj6`vJj^ z5}QPf0mW9UUa>{Jtv;>SuZp$R_KAg}wziK_+G?dwZEyRqDYTbseXPBxxxe4cIlCvp zKKJUif89xDXMXSd&O7hSyff#_nR9kFG_SE(EW!v@p$Vd6H`*MFkfuJRIE#c^*u_FI zPs~9o1bK`4A%i%IJYycB4N*gUixE7=Qsf!QqwZ{N;0eS9MM5yLyeL+DN&6~zh-*=x z4UzSdZ$(lC`6}=jUjSw#pLH-gAn&-r=3sOKGa9_gXr!w$8mNdyV(C6lGVZBSJgAno zHMXorPSwM@Xjcj13`EK>pn5S4(M5o8HX>yhC_i21)X!N+3K7pS(Tpt2l!1LVIZOe8 z^)s+-PQ(I42O`5%m56+#M*r%h3CWLv_6^w_%aPLN7Q}~vdvsim^jYAoI=&L=OTcA1 zX1k98J75gUuS7fvJRd1B+x;%^c{<*Ov;h9IOvj|p0)A4*bC8x3qwy@i1u^nGe-3Po! zm%j`6Vc^$v{=G<_1zxP<2ax{j9>cyO!G3xPe51c!1~!758Tgl-DF0^aj1Dcr?B}nDCMl>PY z0HQP*6kj6c?eRroupte@d#GXWQgF_xHOH7+C6NfGi%t9%x=1UPSQBG9E|%CT{tCY%NnP z0L@IX0JJfMp`A=I88$J6V_wM=6LT|DEC>OnSSZ#H|8d}?BXa{x%pBv-Pf+=b2gUf} zVn~daO~)_WHD1P+gqaK*ZNw`jW)Foo5m!mfo(gX! zc1z423$sCE#S*jU!o9>oV)kITkNDL4Ae6Bu!~Mi>NX#A$-$eYf#O&GdUgA-S*~8(x zh#v#4{`2RDe>d=lQ*E8?VK?S)_|$Hj*517si;lJoN{B0NIB1aJ@qt zX((_FRl!$BibpotMpin8hpvO+ZF?GSYU|jd4X+;@zN$ZyL}Q_2Xw)@y8~l5u;Yq09 zGbm?I+wf2dB{CNqGQ&e0Ti0MWBq26_K(gIAc2u(0PGDPd?672?FWHXpL+ID>bbqEd zEAYH)umH@qJ?n33A3s2Aw`iGH-pg88XDB8s^JHPGsFhb#P!kD(q*A1EB!>Q5dhv>QN^?}1vGQS3Ec<4${ zM(!Z}=7O4$dkI}Xcy6RLG-9hO6K)|wL!;?-*Hf>7aCsST2|!5A+%wP*H5cv#-d>g2 z`7V@*5!+qE2M11jQ!_?nMI(36>YHX2uN;>6#GTJnqR@%o4ZnKgm#WT@A&MNfSv__5 z3BzutLiS``+px4NGZ%(dzb?mgc&HEZsn4~y89l)P%G`?jH;o@4FY|Nc_3{4!YJM72djRk{Yh18%)yTz8y3`UHpf01eLE zVpO6Vv{6>W`t@o)34zOWi!RMpStWf;nptjWNS~{^!XkTXM2_^~`tkg+B6v|Ijj|(E z?c?de@RO*1_~7{BC}+xrpbyug&C;AXK+oG2usxZ7NB*!)6L7f=?QL+kE)Zmgq+LdL zYn5a3U@9B+XB5)4-2Gp=VCq*VZiJ;9GrNqUuAv6VL0;E@>kOSeJc^&p?~HQ8hh2kj z!iJGM=%0How;Z^C3z z+bhbq53hE-ujUe_d*RBb$? zhhP6Ydl+L#TgL9jVC;pG4Vj;VuDUaSPw=fPK3_fReeq!Cr=X5h4IgYX^yuSshtz_x z`7Z1l>)?>y{|`jBNYPDLK*lbh+%;0}OvCD=91OdTh6#w~#*w7VEAQwQx(4@S08bof zAFm3FTj0FPcPvma_EStMtj8NVGS@)-X>Khl`19O5*6P=n9Zb505APkHelJP&%l?`` zLti{7uMZPMher3nU?;B)W4r?$ep@dy{Oe1Gj-=l_@kf?vzwaHW8F**>8K$X%ffF`d zPc#tHZ*96l>1{WzJ2&H|A@dcsofjPF%mu88Sb(e|A?jOO)-*MG#dcAaT<#X3NGt#z z6Zfax6}*Xbhujr0Ur*3I@6(>}Ja>h>jm)X~z#MgLPsC&0?pV5~E0}P{LvCN9JKYnE zrIH@p{Fs7`7d2o;?n6?z=jXnr595qQT`a_2i+i8W0o;!vJqk<>?;-LYz8H~vAqKXq z0Q#_qi~We)FQFIY9_i?y&B6R3q`bdpIqq*9h#30#Am|wMIPExvv>h1P4;4^eUKNa# zg}IkBl-!TDJ%RW`#3P8mM|=~}iu?X)i1QF@5bF@z5xWo*h+jnf65{=cPaysf@d%>S z+gM+}+`SOn%k$l}o*GY$yQZqDwyLJ4#=WpT7;vxkrQFTjlPYe-;`4?0e_lk)LdVfZ z)DB%emslXN`r+QyD%`kRrw1xuq%YAo>7xSodh?m;fn}}YNLKz9_%3~Rm}6@QA)PDb z2JyQOV>gKCow#M9Y(JuI9DPwfG+~7vPi1mPG7#)dRz_-?TW>13iZ znebP3r6bWmWle4MqGih}q*&ehrsma^-Q0>*)Og?_71BRyt7|L$$+UpqxL0+!vGJ<) zEUWTVd8(HROaEOk%_^sl%@U^(sGqSC7X1s1D@MOqtSi89Sodf@Lu%baWJRyonvv;1 z%wxtP>|L0awkcDv`xLf3#}J4%t!3&ksa+Pr{C23*n!A|Y4zjjxH?l@S8}D2hr9MsA zA4c9{x4wYHp|xrk!5*!N6{2>H+jFhua*41Z)L?Ky-fZV|q}H2>v>&3fyjd?RdFRhD zPFm{&EcI7p^FBGI7q!>Yz&z`6lqt@e@4NzB>j;t3Fn1bNqDEP4o+{=Lb`Od<@(OMQ z*JeMja1g~rA-%v-_%>>`7OrEBg~!P+^nspN_%-D1g>i zfZbg<3(KEX6uD4l1uB_tuXFZ+WZy)Jb|GZ!TOLFS809<-1@@~-LDSxato`ay$*?)^ zAqrAh+r?_5uSteOyP2wbj)QHTU!a{u6l;Z;b$+pM+0H^0#U1#uu%kA%2`&pxpM0Aryg*%TTC@g-#)}!hW #VVy3R#KJ-UP?K%_osf<1MGX zPmQWWyPW1+6P3II?I$$+T7`<8E#$3DfTz(V?ALz_YOV99JFOJElTm<*b4-}xKKnB{x{Bzx;IGHR%`|82=|YayaRWz7QZ6w41Ov`{OciW?Ow*U~6q z-=$EMb}P}%3N2DyyjykgQgp}`lq@1Fgn0|>E8)x#|1zH@(6PQtbh|<}?Qx>Jlq!dI z4i)cHs6abTyZ0+ptewYp-~Sh>Wx8}v`vb~7XJ{+fkO$Scy2Uh`%l048TlyB2KY(Ug z94;G2(`945E*lvxTO(?7*=B-LOwUn1kQ;e9{FE=@48l>Z~}@)l8;T!k1_k{ zH^`htOY)pwU~&PqJ3mA1y1#aPL?rdVQTcxtA*n+)M*&DR=HmQO4h}JJj*~gjvvZVT1>~=}5AoVMd7RXHq`(lVUzOP)tGG|fUe4?{WcJI{`=IQSTUqRz(z5-eeoI=mgtCuF z>LtuRDyg%WeNyUukb`u97Z>N#EcVo1JjZj{%GkBHk@p=ge9leeeNUG73@iHn5SlUd zT2O5b7HP^>kn?79Npx<7w!HcI)Hw%KyYCND=b!Lf%)3Z6JGk_g5X!Y1b><`QvXSh3 z86#;AoGS@)@mstEKdKmWB@}`z*97PFsK@?zqm-pa_$<&rRltHJ zd9VfNJ7nSVbDl)g6(1L7so6%2QCw2i&_0oVws(1cL{UKrdO3VMC{RELF3sm(QCscf-cnb1vIx#TkZ$r+`+u zU!AB_i038eIs8uKn5ydz#)63mHU<%#ynw#lpX}*Ms!78W%Wl6P6QE0ODJl}dK-ibk zCxqNgRz_m}XgUyNQDgVf9ZM5N{PEZ}AtJFz%HxL#f=>&Qo-o_9-5>TPki~L|1ED}L zggll8Z=)B5LXmDjOzv)KK$hO6=1B02rhI&}TL^u6>;26K3|ft4cKPht8)sXmq6;wy z+~H~SKwNIMD+;$gno}1G1j@@Rme00Y!Q&pqD*ovfb9(C*b6crRv!H&9vW@#oZK_4b zSe0QCpFMzmouj~Jy9ou+=h%7G)_8e#mx}b@R1ld)Jowq*ZEC4+UDwv!(Aj`&+xkv0 z0=_^XAw_bfoE}0xkd#{e@pLQ|Bw5z&-R6rTkKc3Tq()J0U)vhNeVSkfDe!76s5H_dTDst<+UZN@mL za?!Yt&4_nx3Cc35xR=l3SQ>@(Dk1@Cqter`uC4R3>}dLV3LC+3ZLXr0Rt~)+Z`03k zF)58c?$wp0y>gr&CV5D=rhTfOG|qlw-Jpb$6KY>h7buj*bDrWEiWPH|&cAqU^RF98T-L0kf1Zs$mEO z>CkMNTmC4jK74ZM0=|?FD&px>S2|>p%(|~ClGb|#YhagdsdUWkVC#lv`_imF=NX}> zuNywC*91E9{&-JU1QP~XbD`X%G|f+MPduQzNlIFd*^~n2W-zc}#)B&xRpp4O6(i`PG)*U&9SBI35$?fP7Q@N&= z&W83DEUFFd?Q%WEC7jEZ6zSIeO}0_bOD^g%x6SMXSUBMi5YPvvv8A=WL22&*HQUE( z_(9=vqgtX=Du>|mYAi^mnKfb6H9L^r<9=gcRrB>_J8G=Ss7jKAC%L01MgEuD%|HQO?&B@e7YX6;I&iDxi`re%2XB@vbDO zn7BOl06W-~?)LgHpSpvTmasS7#hIGL@)Bu?c6B9!+YCuK2Wyt43^OF)3p^hpoC{gr zPvF)}y-SA__qy32?=^ttBVvCj<>WhWV7P&ezzrWmH6m}|sE=ng+~)8Jt-)u?$ma{V z=azCj!#N7Mengfe#EJWlsg2uLy)6AhCZg)ii#+rA;&YNqhRa@jeNGxkV_*^ zTd}p3=LRWMh}Vg-fpQGJh=$y5+|TWX9N$Yc0_7O5MKt8NRX7I4`>0$GhQ1qs4LRQ8 z_Tey%V{QaPZWjoYV|({QZa?JukvD={&)kaCkaOeg(_NJ76N(u6?$+fvc0BClyO!8W zWrHF2HBe|a<>b4Tkb41njt2wf*v}6kvR=yZwDTRvk!}P--=iQHasp?6e0lPN6T!&-3<5@; zvisqDd}+xDMw@;Ef>~|`4mHaRArtS^lIq%`y{#N;4DiGrisUQ-%Moj z_gQ!!lFp+CgI799u5XSyhc)Dkes=3}oU;tOA@@C#KT{tg%$9wOM20oz32^}#dN8s~ zP3DM0x3@1h4JXV-JmpjYWR73*PAd zCi%L*S>T^f0~`Ks!9|0IiiW>haP<8uFyFyc<%+=&;0YezeNp;L#R6cnJvG2)dw9&Mo{4mz19@NU!;x%C7-Ix-rC%*?ae=lIc68aM4d2OS7DKPI-xRRFO zONmbao4+3@2R;e;`MUhYz~=7wu5y{KdfL_N@ixtI1W8Um$p3WURMre*l>8 zEC+BYVtXUR(05wbcO$S_-<>Ax#+CGbVB>l+4cC*0fcK%i@%_X1fFA~aP1pBhU~~Pi z02k=~UxGKdjsvH3O#4m(Ka29l_Y&^`o9!uv-RAEnc(9e@7vl^T73;x`bS3ah(6<$N zj?ZP2_+kZjYIsiM=1%LPkN9-z%wr|vdG`vkQWcTdMZ(t=sgN7jkNV=ynYG~XidwM? z#`AP;Vev@*<9l@ee>)iaKx=U(z_S9H%3U_h_2UZ`(>Eb}TAxg%Lm{xd-g-Po_BJlzxHTBN||>a)_lo+^Qn?TrRg!2mul!6WXtw>ui|!jmGo zWB2;feM0W2y@7O3&km!uhL+X2$_$_?G7zgV@;R;Yae&nN@s0pb0+PMa2%ShC%AjZD zw=^qP8eh*;=^yr(Dc;qWwX9m#RF8I@@l{Yxu2%mDC`YLhc#iE2Z`Z#tGBfmViOeMR zHByekj^@DPfk(o(gHM#$^T~MbQ7qp`^Wtf)6a#bOcSSi(u!CNrK5fd8tMyNwa+E5b zH9?D+qJOqDfrN)+34F4|kEqOa`C*iqAiq{J6Y!)3|7OaBHY&aPS5Iu1G#d{)lS%cN z6D-C@P-lD=HBli8nL3S+n)K4Dqtr)QxiZ!A3#=SQcLmjRw#MexIy^IMU9+a6q0`&B zs;;>KlZPWAKiA3?;aHif)!Q-o`KsBH&u#Oz2fHJ9#-6B;`jSaJz%sl`elC{NT?@v9 H554{y!F_^_ literal 14592 zcmcgz3w%^pnLl&qK>{I}5TGDPM;?`SVG>Aql+qRmAw)wMCgEjUFOzv>rc7qic|fq$ zrY32L)7aS8(h4iJ59_bhqIQ+G?rxASZLL+*uKKg1@zzn2OHiNuSRv`413&Fth!ma2s@9#iE zXhwlH1lCKshG+=tI+2{)MQU!2`@-(zd*k2?4(2GRs%TW9`-P(BgP3 zk?r=TlisDOEUK2eH@0k*WvK@P^{zyii9jA+P*1j*`MfSbm?Be(f0~hIG#z0w!VH3O z7n&h2+I0Li0U4~H7j>V6P=-)~P=Ua!R7GMU;;9Ie+%Y0vs^# zBE;fmN69V&Uyaxeyxzdn-2;3S3bXtggc@MBjhJ>=13bsTw;=Wb*BbaD#Jhl*PyP!L zx`1ypR$=hHA42Q~o^Rm$5j#F@>RT?Z1NMNv%b@=l zv3YrzfX@Z#Ys*EXBb-T#u3$Ww4vVgEDwRx$&Okh#42rH~S2!VbJ($_o71lG!cyezz zrIQlrO2rbHhzLeQv6P6YQt3%@Z*>pGrR;rAgKq{km24V@;6Nh?{t}OKL+)YJvy`wXkFqm}F z*xa>FIOW$(BiMkO_Kp)@07=x>aF$P~BV>sV_#u)IoGRB}AVvK=! zCu0n}1B@}~4l>4|JIok^@&U%s>|w^393EwiL3)HS6n&gA2FX#zaKLXe#-usS7z6id z#+WpoWsJ#W>%c3$ub1RM16A|qc>8xK@!WASx~vNvqYE;)vwfor*rF(tr%#RITELb? zNjrT~Vzw|!Q=J}`m@SQRIG;WuFY1a#1$uv|D0YFxo{dB&H>!-NYk* zK*j=EG}=RaN@7|zx}W%@#I$g9hVP~V$FL+G2RnLYS8r$o^^?6{wqqdzFnvS&^>$!~k^_`q3|-?Ak)EeecM zGmo+iDsuO}UKV9$epdI}zwLe6ZB`2Y?b}*!di@|}zdVv_DC_-riM^u#HTZhYo!jBa zb(aim?Hg>^KX6UYHec(t_WVvX8xs15v+HsVk3;ZapB!7hf&OkZIDfH8AL!2jXJ&&X zcZj6c{Ny5y-jH39f9bzRM|0CoLbcqczJcSpn(bSnC73Av`TIZ_sNIok=<((Ik$%Q8 zAC4_l{SY}wkz4Xlf+W=$=#R6yFQI_nADs*tzWn9I`fea`XmIO(pMN`AafewfGsEYL zz5&VG^FRN+A*!O^hW116?fIO^SJ6+V+#yzS!alKn;7}APU#_2m5m6gNY_c!kP$<=R z8+2CLJuByBzqe&ev_h)pS1bc3&^=G&A0Rq0Vaez~e+UxJR2u!AyNk8#pM61N?hpx| zDqB(UkH>OVXVpx<%Wo8Zb_Mo_3T%lss{PYBkT~RcK-LpCSM0z<@#CO3H%oOqy?iM=$da-OassK4_EZH(lhR2 zGY3<)6WT=8wZ84G+wz+W!uqPfn1(>ZRryf(wg6i+}t6id!H^lv3|y= zfVcU!p^tv~w$UHi>fENs`=86)fsVZZ8g0vmOi`Js5ar9)nYf~FHzeizP?X-}%Qf`* z?xTB2ukz(TOai=0cGT(5!|b`sN%rT2FS-k|x91mv<@BdP$zSouq&TINfz|U*2Pi>V z%`w5-c)~Fu%A4@}8x0?P0=#h0f#c}tjfSJNBIW?_Xj)u zA1*mtn6GvG_Co3W!E^BU-Wd=-cn9wnf9u%qv`c@Kb`La+4E%U>>XBT-$c9V*kopaL zShmL)ziNIpXa7ni%@FjI6m;&`Ijw(quxm71mG{%8rhu;lh|#Iv7#L~6TzfXZ%t9<^ z4f(D9r*^=B@8hla+-Rn(_l#roWX_Is_RSqvU2~i~rUtj+nZlR98+O=#UF;Q+SRw=(BhMwC#eCrOL_CWVfzGgJ?j_#nT+d?p$T?Qr zI}qjWO(hc@oyz>JyZT9q-cS5fy_1Q*s6(-AI0SdOp(VH-jO zVGqL12zMhqgz$BQ69_*-copF+f(y?b(-AI0kb)cQ>sNUeVu^aOr`B8RUFuo5DUb-I z0=vVWX0B&FOKQ9|inO?{Gqn3+A^wkxEPwB{{Qnd&nlH^Z8+ZDOxkBdt$6Sfkjq6`c zl;Fvpo~V41K13g-@3n#d10)#Ne8if_75M+d@ZlH0uj)~ZETf4y?g!C-eF*y4Wfs|@ zl8Gt0y4sxaqe8E@I=wF)3U{TeW3?-nSBK+~YPlZswua1S3wW)c1 zbq5!0izMO-+-xPQbxPTSd zy-L7x3~l?uUgkW2o6V(hQ^S5SMQZmjdC6fC-#|&tscl9n``=Ky_9d2F^bbfnum%oxGox$tqTQ8+Q-v4hVye(@7kXm9C(m&#(c` zyTDOmzuol$fccwpu`(0A6 zGa%XTR*EzCZzb;$CJ)G5E^qDk$lNQb+h}zWbS>;JuH($%)MVGzs)Kh zlDuIiACbuwl>4Y`XcLP)CN*2n+#^!6W#s*u%>59PkIURyOnzO;4YK#2j3Pt3n#G>_ zBI+!4{1^4xMA|o>lo`WR%6Y?A_vXXhi^+T{aT7QE)Z604fm-}!#ZlKhLn@0`;{{x9O@cFt4$ACL_<`R6MB z5~1A;G0u5?V4eIHZVuN)<%=Ovl=E5KR(>y=TFxI#d-<=y>L`yR-&y`R(yns;9!@Cl zz`dk=4|qz&elzF3F%AD=`PttnkOXP9Q zrOZB6!+h5-DWzYbg|44bvzrxK+GFPIJm!pnKTH-5E zXufNW%R?3J_`XyK<%sT7$l>}V(E%l@#5I?K4=PmV%AveVjjefZ*8(>A^N&hXO_eU= zx?j1#4A(g}>kIcvng=Sd3rZa)aG$acttxe}x>AQqFQ7$jl=k7g%%)K)XdxT@U3Di} zg|-GaS4%larH-k%SI~0BPRFD`6*pH)hGn={ttEpLA+$QAT|1g3(T{rtZB#6+T!wkd zWzOR~VyZ*?2DEcsbGwvsfKt9$kWwrweU6QE^Cq<8)GP3eEc5~k(Wz9`Ou2u}8{HEP zdjshy9Mq+bb4Zptqyyf^jtP~*q@|7u+$-kerX(=sCKE`q+vDU7FO$5N;a=59UN>o? zlD#q+3{zd}T)!aWwX_l4{RN`kw@Bo09b}KhF9A2*T{=~#ln!@iqg)Bqzi!k@`O~^k zz*g!wjC84ko=|xj$xour64#epFClh)c>(UMY8{0?#(~O_C50a$H>wg7&LKgkozCAB zq1{g2uh{YPU+VZONKP-3i=1^X{16N0Qf5&kg*aLr--um5Kcok4HRr(B$co!}f1~xeAHDLIqo; zaJwpPQ*8E34K4gz`qi!stGt1tYT3-);3jDgQ2uSOp?MT8j_tPPrAS&qpTRwrGR7vblLfcRuH%lF&GvTrMBF(W3fp;}q6N+}aIAq&B8PBlTn^a1wwgIh zR?WT8KJ)$Cw$Hh6=MK#VAw1#IM7wt5b zY06g@cO>zE#eHuxO$GyR5AcZ7`uHLAlP$bp?h+)`42}sh*xGS#7qrq_v z`qOKT^Nm9xjDctvm}`7{t!>VtIos!iq+MZkF0SnJkhw~8!iLDr1A{|YpGM;QA9qUMhLmsY(3V^)~Zk*piekd)a29w!DCd_PEx4tJ3 zM;iAmRZFBZSYAq%5}75-Wr@x}x1I=xL*bAfNhLeMr5ezlN$w3AQj(E~4r_dww;BJ4f0Gh zhQrgM_?FG|0-3$XI8nvmGVR@E2+QiS&%h>Wh_A~AR6SXo#3nkB6G@M$dBfJ`W_|P4 zHsw;54#_0JOeahkc7=yUvg}bd!f?{v;eC>t)eVPG=3-ZaF&)L6q(?Cw#o72y9QYc& z4dKeWlnFy&x+oR&$eYSFOfStI3SGUD{kWXS03jMNQBs~T~A2n>Q3xq;SJiNQm zltRnLZWc*(!l^_c&M^*dRb|WO_3Hp|{vX^eH7WMDZgi2=Lf2)(seN*|yvqX?H<4tO zMjOo9HZ^QQKBfR8-!d^Y>Kvs~30Q8WOoR$eG>yRQMytmr@Gg#0J-ruplEn;jwzM_) zTQDCs`2BJ!#1A2-Rmsv}IF@X=kw&$~FtE0HY=0-v^#$uSHMVT_Hz@h7$Sv4jxdn1K zv{X}+NaZM;8_gNSGKj`ZnO4U#dLn3ALm9xBbK`14<(6IjpS!UuyGE85-t@lCOrRZc zCZ*!2nS$=&RG083l9{k~?YgGLnLvl|Mg!@n@P_s!P*BBqk;IFq3h$n9D$O@TtUw1X z6^@f%CA#7n;pIpZUJfJS#W_L@q@--5Hyp(;2j^C=!YCK$j0J@^m`SGa91~K}wL#XI zMDg}CaxtKJYyfh&J=>uNFi<duO+ziv5N9|wy_a>N02t@ zj2TuS;0ajr@yvtodki7S2Y-Xdjrd9gJitjlo{{VaP#ea`#DyaAYQ&xA8?2XS8@Hm8 zrAV9gGM|B~GMwkKMFpc+nARrw+k62-$}?j3BFxsBS9k{!}S(EKFHUga~_~@N%dypm{ z`;PBB^4&))bPAWr_c`QHZSu)?AHnx5(rC84$VWRrj9|*+A>ob+l`olaGvz&I;oAki zU4Mj+2a~2ezEctfpDBYf&Gb_iKAyeB!51QfagmQ<7=e1S9XyIZ`A6#gXV6)%d693a zCBsa97Yt^aygc0NHVY9O>7OCC^7VjkfrZbcy)lmOLGWR{Sh!5Sx5n{(4HLvllW3vw zeKJe7ID^Bc9nyJ}NR!4h0;X$Jwy3{Qi2E&mN*V*yk+w6~#H(n;91@JnOft4qBNi%`+~mDG0DC#ud+HJ-XzhuOnD}@#+(O<)mwP#om+)f&79X1RyA<`Qdm{M zc}ijB#pYS7U3xlv#W;Jl%NZ4%oL_L+jb7zEqA**b<_m>YhjCs|m@|wzI#XDUFphJD zG1z%=Jma#X(A!M`7;3t21ha z)yXx-gTmZbC|>q4Ga&VwQ6wT|mv0{zv+QGLF4FnyRlMwiC!WR2F5X`RNZIk8xAn5i zH*$+Pc6gE1FC5}mqvkwHF5>a@rebkP=kJSokzY3fV&d`i@$$#h$JaNWe?0x&^f@$6 zp9jX_pO3@uvs6I+$MajrvVHGWzwz>TG{6lJs-fW*gXd`G#roF(oBn9STg@%Nra#*7 z5n!sRm6b#t|4XEFf()l%NGqLo-XzQ_gL!VyV=7QJih+Vf_}B(&#eDpV7}v_ zKIU~|55L%)9o-f#48rREkq_Tf9M+hzGO@fI=4*BbJsVanzf z93bRR6tjSLfzIb2*0%__3z&XDd<8J)FQxBv;REgg-F!zs2+Zd%u!6r#TnjwJ`i%0| z10M!nF6r<^;3L51JNt)#hk@rB{Eq>j1m<%G>puo;ZSRY~d_9-rob|m-e#8H0j}hPz z=wriA59z-FJ_UKN8StyhP-XS z*7~mj=5rFr=-+7~4g3>}e%-)sl%H>u9{{%Ma}e12jlm;h=x%Wo*t|SQdAD4K3@7 zl1;F|zjhP0Ckzs+G1En0-@N-^vtoXi;_-wg^&zecZ62 ziPOpArl$OK1>0AW4aBiuy%Z%u5B9zK@TQo(#P}emm{Y@(6-cq>7$4P)$&%+v>JuMp zzWi**njt@;v1VYS0{`Q3us3ea8PjT2lkt@fn<^WEUB`4;)e8w|YAPZT{ z$n6@Vv@)IgsHj+GiTq-yh+)96+SqDr-nsjx+-u13`-S%EeMAQu-9&`xNTck0ZlEb}C90y(F}+eO>6O5h4>;X) zN01}Z@K@l@GUCpFe>$8G zZYfuja)1OFW0;|6{fco}fez}LgC1^$kq|IMIZ1l$Fm`P~kuBR_b+g~~R> zM?v2tu%g6)D<5*Y*_Ot`(oX`fvfx9&JHdYjDwy*A8F)8vrIEfLcrS1xeA4fRyBGM! z2K@@eKM8!lq2DxA{5;498Ex+U+~e>MfSxw^3qXGh*evfqApK$BB?kRf_}Sac@)Rjq z&_4zJb%Xu}{I!tJx@UP#9+ltk!SBUb^S;6V@9_6MI9#8z!9VMthV{D*{8Pcd(BOX% zxYJ^vKO=q)=xmcL|5(tM0pD-f>nL!^Uemtgl>NZ9pkHk8zYcs6@MZ9sehU03@M?oz z3T$2~0zU)ZNq&UMzho4BE%0v8&xcRCg0bh)mUyf+(uR>oVJMIY2SZA-t0T}B)&ogB z5s9@0wgsc9u+kBZr2>&;U|S>^X^w`Kz^cu4E7sLiNdnnBgNblV50Fua0CS5LjI{;H zE~JAaX#|-d6mAWsqI!U|Sg^yOY)?dVh>ye~x)75DClpEQK|O5fLIv|t+atObi3JkK z3CUWKPD#Y$x=|wfQc_c+EFD3}4}?QO zJqSW`GAZK`6$>dP>lHpuu8+SuQNZUbtAh<1$l z$X{}~^50+F_iyQUj?`~x(E2gQYM0=4ev`KQ7N??L_KzN6^@=iS7)gZb#x&~pW3 zwY|8%@2G66ckYEDA@da4hQf=}hrJpjvrixF)-vlxbNeamwdRVE2n$w&u?tX{stw6px#`{x#i-( z{_JmHkv$iko$GrVax&vbNczol4&}U|_x5a4phsr1h63~+OpQ&Sa|uFr-I;#YyPq1) z!c3n{LGbg=67_b3|186oFuYZUIeKQ_M_A~8QAsh%FbRnpv$fEm@A*ts$|HW<=$lCA?7p5Jrjw*ydC~=pQ5v(Ud`#U>IhFKhUpb!3-3sc*xrWBRUuHL$ z4Enq2&un@*Zi$)c&+Pi-zN6BXFzH>;Mi~r2duipap?72;HuRK*QiJD1y`;KO+i*udcJ3}z4whH`f>$Peo+lypd0=aEYt(I^PVBdn0Z1pGb_cQc0 zgxJIfe7)C53!>d$ji%>&O0*=<(#Hz*8R=uo_0>OReaNm-KETfM+?99GCQmTF_f20< zisd`(hKT)AUp73B(`fyuzw&{t=)c|Pux%Em9t3Bm+MDZiYYkNH2vjM56B!OY+)p9e z1&n<|Dmd5-DSb!TpLe1^Y-gF*oVd*QAVp?1I-Dp~9cD9Fswq1j8g05zw(0gQ*}KSf z@g$b-xXstYmjDK?`ivdvI2zPj2%t>8d_4n2KS|VVQ}!&W5K7j|Hzn{&lD#QAZkSXB zQf4&zlG)K|{e%AbM0CRJ7WCv#zF(ZT5YOZ%XN7 zF<%eo6$Gx()5p4ey~oiO_R*F-1CK*}MW3-O?CX6OvEApettNfFuL*EBfa2@@82}2= z(3GwIv#51+o)V$t0=$f-d%u?qdstW=rMHrMkHI}h zL}Eaygk{<{XKym%y@+SqGYEAz)llcgRV62H%pN^znBUiX1BRo_#!2Z<&;~C+7=cG=Uf)%1s8ZS`rDU!<-5D$>&f6wnT^>-Qw6;< zQ{_c7?fEhCTfO9%ujh6I>f6=aLNS_jGLwzSq;G0Tc8|!+Ti>MVj6N3-sWbJWvmNyH z)*xx7azu%HPD32BY%k2Nmw9GRWw+u8c)^I`?4-yc$%FCN*K<&G9Cwp;H7PHHlG*BJ zw?^{s8J%i3NsoYZrGz?S71d@A6bB8Z2v}5~EG3;8AwvdfA8X5G5=gd<4nC)Naouz1bQ>W~zi8 z2U10%vB}YSE1ys5(*>+{d-e<(c&-RT@u6SgxeVECD4CU6=^eU(ztoh~Hjk0iqUl;w(tKG;{oroNIfpWdtZH)M%!S%0DSN5|8 z?Jg32DG4a#;2oghVZ&M9e(vCfCLh}KhmxhfeYVkV?_t8*5j)riHsm4t(E)>PM8gyP zC;>|O0E#;J2dSjs-;GhQZ%#?}d!VwLK3fbP_SF}`G`JpPci&OY#KoD5N~Shu|MG!Z ziOEbArk_mGtB*&;;2Fo)(}$LmKIYIb?>(xQWmcn?IPv_3F}NwS+MCWgz_h&*iZ*7a z$=(jWF-CP{wxH4I6J_7cz|5Ibp$po`9|V)Er%hWfW)(JOe~I)%Pl;fgoQKm_OtR_s z5B=JF99=GmPkkuVWs}t))3jaQh-QTL0F7BMxYfaPz`Eo#6)Rx+V|{oyMYcl@)R(k_ zUNW^Q`=|F!J0vm}d!cz;&auA*k9-oaja z0lN(CzZxQj$0O(V`524T@8UuGoDx{AH|Oj5H?{?iM2yIO|A<)+y*~s&COu}?mr$v- zFv#--EIUKlZ=p43PBR8OG=Ry^7Z6~ORh}>4TL;x+xs8OhCt{TBR+ubPM97x&qHesJ zI8v{Gxn0S=Y$}l|x|0v*d%_>#k?qC(@~ORjal1|1$9I&+P&hGapfz!(WC^rGq?Cbz zfs+bk=Odi0gUGu{7w^_hd#bOg*It8-+a1{(^0`fr+28d?VS~Y(?0uSwu{*mCTtoL7 zbMPYV5bNhfnR4)YF#4XVw57Al)5n%RK?C@9B@hW?FMzS7U8v09MJzfW#$+5PL!s6a zd>8Qbo+Gk!=N4%L$aHW4L`X)G2TuoeIGuP)X1Nz>pHQ2xK^v4AjLP7cd_ouD?@&`R zA$LaxeZc2pB9jFpnT9fj_5mSi^?W%{R)JS=@lWedn->2QvnrEjuL5 zhF95lXh(bYjeNu_KV{*E4#@ntD>K-LbZpa2joHFKpc+dcY%Xt4AG4RgxnzIR*Y{k1 zZqn_Hs#@}40xjUh{o;Lo1Z(fWo=v%whwt)(iy*h}sF9}cjq~u*`@zt=Ow(}ZZoG}B zkL8}AkN!F2#QQ&nxm@a_OY6oy(qy4BtFHQjvs7$O%}$mkRb^Ib5~z@rEv3n=s#3OGDeF?oI+U`Qdld zb1D(kBk`F31R501o;_QwP9)+9HI(AcfXa1d`tep(*TU+hSjP@WM+?eJLUJLZDi}Lc zhXrCG)z|?TnM9pYnw&A6tofv(P-gng@sz3sw}sVMTvxlodOmeHq;|zq2}2Jl0g2T5 zXgHV*s|l1p8Sk)`6h)a8_P6=f86)j7Lyae>fDzBV1Zgl5jL02E%vq@8*|VV`>$fgG zs!Xz`lbzv~NNXgF7Nsax@4+68;RfJ840rL3PIsN*zIT(;J=#5mxFfep_nP6qfwi~0 z{@&?+2)@-dogmIi|67H7jC^kxmH&x!{0Vptz^$?HzKL+of~|Vi8~b`++`5M;w_wy6 zMk7NU8R<@RHO3Q(t~qE`suqrRs=;l+NR)e5YAfm-drV0+-pRhfHfQz^QyzWpPjJt; z48yk02K9qwq0Tsqp zf!OEfp1gjI+(WK~&wadEaNM6~p)qI0ry?FR61Q&^%pvh7cYU!vz;eP1>2oBQKEvkT zHp6$JY!AUb19uSaw{Rc8*|Fa`0d59d1>8!w2DoOp1l(0{*TdZf_YmAOa0lUj3- z9s83L;AX&8z^#O9fNO?Jz+DA*JsfrT+_k2vYN7!2dGqI0R8*+5 z8Zb7j4eDww&sj+7+=bW|`TsnLFd@%)h<2uk)dF$eMm*RU2A(76>R5R)MYd=a;o4QwrLSx}s67@R!f`FPZ0`=PzHZ*t&0lYIe~Dowhi1 zVE%Mv(CF`>T(J{<)V>T9w|$S}U*X&L5ZPfBXDtGaa0Lw56jw94wsXuFZ0IV^0(UPW zosPP(eT;3k5f(N;oTIjx!R?54tlN#Cnb5fxVLBntp}6iv*yggo0MG4M?>HCwIBJ+7 za(8f1-BEX;Ku*Q(fWqE_X`V^&?bi}HoQ@L*he$OkYC&&7`nd(CX3r-s}lDg(o z!2DdCRJwqfVOrJoJ$WbJlA(OckmmkU81>UPcb-KOnH4h^@d@bQC$; zi`Fs6qW4HI3L?Is=(`BJirB!$6lu7-i=G6}SjEfp7EagVqBPB2G!;XrT^Z*?nq|mj zl53@B2cle?7~?nxJg)X1AO(wc90FWhCnC=ADR^C%4hVwNa~n~Z%#K~mHp(*>_L*+S zwG`Fy9?15YUdLpj*m|(pXBI0y=VWA2+=!cvh91w*_z-xvD;TJ$0n5O@QWLlW=|WM-XeDImu%u+j&1CAxv{z@vI`a(F4?YKi7JQb^(2CDA;`bwt-n zv_P78w>0r$7^EF3#}O7my%JX?8Z+2$7=!%TupT42Q6i_~L84ovD7S-)_^!PYc^&Uj z?|l*#JGh?Zy6X=@$|TV|U3bgoImNMz1^I!jS5=wd^f~_sxf4I4@Vikgo7?APZTg(d z*XJa`=Uju_e9lu4Q_Pkl+rV(mi|Qx;c;3KS1#c2Fv5EG97`EieKgP}Gb8ZB|=WN4$ zBD=Luba0<@2O^4DTcexU2^!XTmQ~!4{6QvUZQ7beER-Ejy+Jxa66l5ahUr4N$070k{tp34!o&)UzJ{{s%2%d-kO+s_iR9$;|xArhxj zlLF5b^u9{z9-i5=&!JsCuTt#XUIwc`vR81_^ZbJO&Y#8xv=A_!obGc$_)W|751l=~eK z`!;hE-OckJV{a1-y^Os>1jEeYPQiO2gWngy8z}b&!X(!***^%)_A&NHLbFBWy-&n) zq27MKh@Hyd!$R&4SV=$TKe!X1{&MOE5)wywh13E`p@O-{Svyf&ggpQ*&%t7ko^C=#|T|61_ zXL^}%d;xU9Sx}NN{hT4tBuU2vH4&1Qc`=kzWwgKrQX5EF?zQv9RoG>OO<*SrK3}xW zGIH9Ek1NDoobI=s;MrZliAJ2JMCGAHz)JSLc)oV{ZS$s;FP(Av^rj1@oxb@3JH7|7 z@x-@Xyep3sie+#?c^dbT6iaq(;aE5k!HYozhb$4ly(QVvoRpmg?*wISEiLE(&El0} zF4onwpl);s@j_V^iM2#ip)ix0Zy#+q?FtydYS1=C;i*-B3sg{e9y96JSf1@X|A`=m zOT67+%?n`+4S_Y{-f37Hhz22=TM)x-C&4bg93fr_f)23Z8 z%{~?;L?!SI&oKj$OYJTh!`B{%$6yPE=FFM9bebK9H*I`Ju`7RbjoG~ojrm&Xm|#Qx zI66vg`F`mbYcnuLWvImU3y^oZy-w#fNC=zb&1-%|04HJtJV`48Yp{^q6sW1ITEDKo zwt7P~g7q6WfFl$Pg%W~gIF+a;aXdND+5$0<$eI&eiD;x_(E_W?+S=+hIDovWy0NOE zrhdcv21qp}w8oXBhP7-p6-!3iVpyW!TVWoEQ^Nrs(}ny{Qb=uyr+8c#LPXv?v5c@h zp&basa7wuo=aWSt%NL0h9l;%eSU4OChXSoQ?wrrQS&wgTF{H#>TLmwcqrV|7!h^%% zPO~{9wCk+-^a$$R%Tu$;_v7rLamZR)} zfKe5O+01&7>7wxb$7(lt^>{!W8;6aM*vKLh5;{sb)$8gvY|hta3y(WTVsQ&Y z-FjBNh~5@&5li3bl%|b44PmK(s3))q8vM&rL77hqC$3{{h-poZ$a(d~S{ysyxIwlf zOC{)WFtg>!b|nnmnu>nOiJOZSviL@uzBJq=ikITqd$tp4I#wA#Qp4yLz@hvQPw)pi zaBkjc8&FHOMOh7@FdHHQ)H|gOWl93BO zRsYk~Le!fOAiEy>x+npP20c)oPTi=}5nUDyPBcw13y1_p8*dEMu4vqVq_X1}?YA{K z0z!G&BQMJjMd(iXa_7x7a^*~@Bfcu&@Bwa_W!?H!D*;;Yk-()wli|jJp-vq7x0>^^ zR5;OP*fWVF(Qr(pLQxH6O|k2$*Fi3Z5hLC*xXAu*rdw<=!20u$#w;%5*NA>>G~^gQ ziIYkux5FZqbTxGwsvGJss8%;Li18FtxcE4PV?vwJ-b5LVu%MDA$LY^C0t}pJ4`47V zW=-AthH5Fj5wUq2%j!oAhZ|WEDN;5F4zK2bWa(KWMqO(IGA!O=R;(<(F>FW8F&SBj zD8-MjUi4rye0(<|e9a7jC!FY1{MZl+`&X>2nX3oe6u%b4wgR}2ZIuO}2go>%Y1}QT*c58h;`#^!A4}%qRS4$1gF`1v?@w*zMHg z2|Qedq}SfUJmW}?&q=ry+JVh9pisCu)fNb%F52)#jR8AT&Frap9Eo9yG+CRQ6X9(p zLgQf0LWrq`05A!r{r~ZWPb$Ro1Rl-gH=^+Ited~Yvj)&iIJ_V75l()~34)5SdGUph zS2-LX;K;}Q9=_&mf-~v#>A1dtXKumAeV}e6;6fnNf?e?N`DHmA9u);2_l-Ki!2Kfg zA}_BsaCp>-lf?a=C!s9ABQx`5JlzI3?h!G}eWIy&pPYxVHD5r5kFaCm$j5!ATJX(6 z*px>fQA!lfk2)2BZTMa(eT_p}xRDw@O*t}FD@Ll*UEBVAX#H##$nDxPnD$u0&z%gI)@l?g` z=`tQrT&Ak`1DSj`g73yJ;CsZv$8RV0g3pvefoAv#3m^9*_kpjU48}!1x&b)qDawnZ zMwK(LPXugUsuB1X_|(t5$X8*BFoWDgF~j8DF%!;A1fO~F`Zb)D?+Exx1x4OW+V4m4 zO)kNX6W?Kt%jDxXn`W4#Tm6c%*b-p|`OTOaCg00=%iU>drzUOUD8Bj%xtGf{yi7Z* z1|Rz(uMqeiXTvZq%A>=lY{JGyv@&f8z5yq}xXd7Zi#p0)3?xU;m!>1W8IJj~yRh%F z&dh6f4aPYRbjD@MGqKg@_w>Z_D}B@n#yg2+&K&aEVz8xgRO9tXPg85_2SyTZa;3Q3IFxt+2!R`kVb;(#Hw9ivBIJ zPhj?AiRD0J?uR=>t;l{U=@SG$`=7*eMqxjbn44Ql{@Y@QvFl%HoY-@Sui6ERxH(3Q zl(hGhVIo2f@n!mOltX;sZ^hOTkNh0mhA)TsYTkrI97$D?8tFpEe zC%)a57Lshlqv@AeB#?gTD2%0){B-VMO!#q$1l^)Z?s>gF$||KHZfXnEfsrO!VC z^GrQQJ{v~fhk<#b)5HV7-N2Ye1pNRo596Bj*MVzc&&xn(dAT7o0DPW-hk(5}N5-9L z(*F#9AI6hzA@3yRGvKNHPB)J$kUj=O@}t)~-ACaQPlW%#%{Zq4Ll92^=FwxB|4GUW z@_)zae#OXdE-;T2oAgD%)_-MG0^f`Aw+j3m4L1T?|CJF2Hpfr?D}^UQ7OQ%J+c}gMX&M&)s6{zchXZ%)_l9L;Cx}HF7=rPJO}u=fy;rH0S67tJ>Obj^WPhFz!w4Y z)Hu^$49w?X1c3{c5O5UqO-B0dz?=`@!5$|meF*R)N)z9Pz)tXUdy(?)1LlEill~I~ zc7tAN$on}kpOXQ>?^RwU2HpHO$GgDy0`rSA%KH@fNnrEe9H(H4F1Zfv#YkUDY_aEJ zV15!j&!Ddbo(Fvag}pZb^IPFp(EgbJX5a&mpBDUB7YBX|*tBOquvPw@z~=m`LgKx^ zhry4>AEED4z~+2D0rUB@z@LKtx%TuH0#611LW7?hlKe~-W)t!k0nY*5{P)Ld;AOz~8}+pj*jhe~*wUW21J{C| z?{KUS?wDT$%)LwEy}(i6)du~Cz@~kQVV_5U%}Yh#{{ru1dW4z&-$&6u0NxGy`G$OD z8Q;{gPN?!t``jR zP{fK#Ae8Fp=rVJwu3I&nnF(Y@CSo>bcvz}f4iZxTx;4O^Agt%nAUH|RH6`qVV8KtE zA5>y-p5YCMg{wqZPbFgJ&t34}m`qgyQvQku)t`(H?+5T$WB^+V@-I4q?}Y#9;g4jnyI{=)3wihvjWtFj zmw%!Gf6_`4yJzN~aI6H>2$uOr#o$Lb)|i0&t&KGb-G{kF+MqZ#Hn_WDC8MITw=Dm! zV~yu;gii2xq0jx9$C^fz3X6>R>;YZFVp*Ao@jD&bkewMU!++5cf7fB2U-0Xq(SPEx zX3GVA>}?EJA{Skaa>>5~jo=nbwfygoHFo%~NX8$2uxG%UwDO$zhe@K@$bS-9nMMDx zM({fc@#m<{6aH9fL?H}&joh~|{%2&BDSu{UjiCvL|IZ{gE(}YY_-9R)Un32RnUAXZ I@BiZTpZQ=U{r~^~ literal 20591 zcmch93w%`7o&T99lMph)Q>};>NHii$cngRU2;rd+h9m?Kb(mx(nF+~EoClBAYIG7M zj;yJ#`rL+skN#V?SgUoVt5K-b?Z+)^t?O31#kShXq86>j6k7BDe$Tmgauadwy8r#( z&*$88zUTKlzw>~J=?aS$@@2D^)HEHE8uluaiuq!n;olZBvTdf`#@Zs6|6?Jl|# zNRYJ(nJ?)G3eOa{AJ|=VuLILjFXlm4f;1(_n@$6!GidAIP6h!#a~bJNn;HJaz%2!_Q&iuV_W8lW;VudJ0_-wdo zdffT&H8?k19$X2Wah-|4IdIg4Hf6q(;m(7b3O5dJ1l)yiFp;t;{NWet$b7+E|K-JU z@^UFJcOR{XXglL7Kwtvg8G1w^{7G6qR~xFQo~a3b6VaOV=>`U>1A85(+{U5<6y zT_3^lv?b-90Iq;fOdE?^?5^8%d?|dk6Go2~9}KJ{2K{3AQNB?k3%U>V=XLt8;6DoaCGc6kNyGAc5Byuf|2v(Z{$EV>I}7}~ ze>kY${oro}|16#Vap0pSd;J;lZJ@JXQNKLUyMTS@B*cBd?a)`*yHFeg?gqVD=l^%$ z1Hc-5@}CL62e?e97XurYhQQB&kAl7xVe&5=MqdSd40QUW3yeqG>SNJ{NFzog!H_>5 z3Is)BSBt+fl=LT(@kq4Mzdg{L3W=6bH06&Z{M#dmNL_PC_?K_4T)K93xgwCgH4qO) zlYTNv5n!$l2cnGuvPMv_uY0-R7Jkqjh5 zx-L{O7qugj3`e5=IC4U=2BZ`5SS%^k@UL96ZrRc`{&g!>R9DpaYnCosQ{gvh9FMiM zs$A*=&GjbfR4=)!6#_5Y?ym|pBKuIhyg86agc8EG$W99AYlmww`1B ze9@Xp!VGbdNCso6Br`$TUIrgoq>p$>c84(9oPpghfLu z>LJ-c36ZEsMqnufLvhGNse`c=2&<>I{yKkitX?$eCiL&5(L`t`Ea_jp&QDEbKnn7w z5}_bcQd7MwEdj`fTFs%T@P~qdWB~NKL_(1f6%C4_bycfZuC5d-*Q{Pv?w{?QlM8X4 zQkQCYRym7tE#Y(I1@{xH+ylFsX1nbD;5a9B^PlV1IRBvU9;70l5YADT_Wb9Y-JY!I|_i zu1=(n@k*nQk*bJ3Cesr7n3$*2$0Rh9J|?WW^r7Jb`k1g5(}$vE^f56kr;o{X6@5(J zYv^Nw@X^OaS3@6@^CtS3xUQs+NqsAQOl(2=m;}T0C!oAP zTKae(XrqsTvz`77jBE7qz_6k7?ex2@?0T3W`!sL$Q1YciVql&C$3U?iciMHJ*o9D- z!QNv7xQc1HFloI4^~BQBGeH4)xKJX2!UNO&u;CNXO!%mVd#BrYRvB^DAd zC*DbX;!{KvuOe%(k zB{^}=50O%cbdP->BL`l|(Nf1>bdcZj(xJ{iq+h>2Grk|wH&UHNyD=kA`rU#sBePo) zr#?v^_86INtgX&mTja@(gQ}gUGM?j>a`&^gzU9j-TIypYs?JV>6_B9w#f7JmZr`32 z7GL$o>`zd1M0WJ0>|3t(AIkm`Ona`pbfEM36b%61=(J7W>pu_b-d z;covX(2?au<0u!t=igBPl(%=Dp&yj0&EAZBhUN_gm04Ko+gWNGQXsZ>11chYazwH* zebSZM{~X8v?Dktn_4773}Rn zi(9omyq~&+AELeQK$=aN74|E9;qMWrfjj3GWiLb~@H-D>C(G(^J;X1@V# z+|SA;go;Y{=O-tp`<;OIUl1=>(}e;@lP-Y ztAUl&2o6&v^@B86NgZ2|E;C+sk@ZzgYmevqe6m7)O_kY~m6YDqlr8OnTn{nVJ9Nr6 zU6mIZd7U1~QB?JxbbqD0;}Nucy?otlo3mbF8~z2DiU(Mc*;s1Cte$R;6dgUiPf}w4 zE_X*Ol1ct&&}amcbPpy8rC!yOq_c_CPZ72u`SIs+%5UzyG}lS?Y!~|cu>lP}{qC8W zHMB)V(U#m;f9LX|Gd5)J>dV#NLDt`fap{w2&v!wQr&-lRHy%L<_MO#7 zX};|9pU5;mHCX6<=Ovn@5tPi=J*W;f;?2}&kW5XHhEbpIu_AMYtK*H7yZ0LmpUr-M zGxOmLn*CT;CizaLya3I={WXwQEbMo;uYn4_CQWAP3m;`>C!u=h#G>qMsZN2fHvB51 ze}`zKh7K8@z2g;k$IqBinQ4-HNafd*pZ$Z%P^!_f3szJ`+NhW5P0G7NSqKw{yS))+ zsjjXKzeB=TnbBGoGU|BA-SHzOH2f|}evtOcd6MIw%YE}b}zyF&Jns_+0KPwL8-7xbQ^m@{jNrmxSA!9dVCy(l{k ziCCY9J+pdPjU5-Vy&W#VV0zUdOdob%)1|%NW!$?3O-r(Gd?by}JY^Z~hj?=tZd!~? z&;Yc|CRKs|iB_vBkk5Cr!jgZK^{6RPcwG2RW$H~<@w4EdWI0kuqI+M5qx94xA`U4No!3ifh3^_iyAGm+F7 ze&2*Xx17WB!QgGDFx@eic9i|6Fmd+RV0AzHi;Up2p3B|-7#{sa?>po_j*@6a? z93y!;*r?8CA9^G8K1C_ctm3?S%hi0`ttiwl_B9W!`=l(Z);k}(3(sjo^(CL~#B=iIEmt4cpN#fAhf)e< zpJdU*+U(K~bo(TmGFKO%D2+1b%W~1>nd+j>qsB;^x@d0}4X11$@2iptFxO^BDdv65 zQ9a$;lFLBxWfSa?sH5tl^lv@Mg7nu=PG@J|7MLP)H4XQ%F+Wvj8_m`u$7dcVe{uqb zI{?99jm14rW!t+G3H5=+7`@6mSiUWJ-hN^ zjDfPew?OpZ0Ab&;1_Ru!7~tH`mRZu-B?mc|rTZ7{ID+_Y#AhyPM`1e#-0dDEA~TN> zwb_6DqbxBWcPxhHHEVDY|;M)?FH|%r7 zL5m|osI&`VSy>fqZaqo;t;&{q75OxY?8!kjIPA!W@I9fAJ83^Ahy$9 zlxwXYe&zX)`8U6Y!z&k z6TmlRF);2&ohK^Mr2De-OhiLnxi(UDFpHImy}YIS2QW4qw+|f6V8k6reY9!IRfnKM zPJ?e@t&C%zR+Yg@E}tZ2lK%K@+{Kxbsh%AwESsWRYetKuPDr&K(UjKree(`Z0tD`T3z!=dvlwG*wO z`ba}01mk@El|OCTG_4{YkHxiMin}lx*YxSf8nk3Mq;12VL8y7SA~}&rE=6pPrL=Hh zdq|7MlG?6NGM69})ON*Eab3=2GRp+M=1?FJ(&8w8BGzIqDO4#5c^kdjl%aN+qQ&Ae zsfy>mi!vAqI`d9F<^t65v}q_d?lMhzAbNfhc8Lau*-E#qHl;W*MQJD2-)47B*InP= zVai2#@7;FSUAns#{&2SqasPaua{r+FA7V{1e81iG1NdgQ_cU>4`u|q=c0J$pu>4P_ z<7MEv7;dwP_Y8!Oqim)0ZZd(zkj8mX8R0I^a14o*m$$@PXZS7sI>ZbHB3$4!arhtO17p z*e1kd%HX!Q!2BEQyZQ9C0Qqw-r01)@+#)cTj57hm?_j^Z56+2w@Ck6|!Oe$T0apvx z0Jk0PCb+xd9)^1g?nSuQ;NF4jgL7ivb^_daaP#3-z}3Pvz-@=S3GQyVhvA-rdlBw6 zxOd&6T1?@ zP-~(zGH1d3(ol0lshoPf)uJ?vQNFaXt~B1-Qo3xz>NU$t8@VGq13SCkIi>Z9lt3fV zmR4)Cy|dc8z@0DdalL#b0F(4XM%2c25%esUyQ)?J=8*bJS*6$&et%#|tSCClD3~XK{U_OQhTS=NR`*E{4 ztvsM*yMQ9C_cA!Go5c5!((16TLn_;alx}^DDX0Gvf_7}D3%kSm5T(zM8GQlWe zI-a@QDtW6J+#?z4$oqFP$oB=?Z2{ix5C$D5kk}zVL&p0}|+!ffwg2G;ke?VVDuD=FqKsn>CkYFpxLu)gG4=7&d_MnX2%h+xi>|*Rb8T@Bv@v!9OO0?~}GI$Z?eoq#3 zHIsc`YPOuQ2c%~6$oqthy^O&h%Gk3Rd`il#XYD@|MuhcBCOh~YWd^)1A5qDSNcJSnhQH4lg zcP=PAAHJpVbwuJgM?TE!Ty++r^6WI8yNXnn*u#+LBCvU$;jM?apYir@yh#?`kZ=wb;9b?TYUrz!J#o0K`x`95iFMG|SwDU{i+awu~Cky1Jo zDsldrn%$((bY~mU%?izQ-bZwcLUWxfDCO1;DRTh|c?t3uO-noug^HYIPK_$u@vl-L zq$9dhA-nTNqI;AmmvagQKcG;7GlTR_)wia4oW(5ix4$P%HBL4e=RVa0&UE&(SdZK% zX&T!L* zyJ@+>O2?o;71xzYhIzP;T}lQiLRjY_?A)|Q602}`(?)}-Rg+tqWGZ7n=%9EaoBj2atxWp^>9{sT+(h~(Z1jr zr!E!2sqDzS1@qO>Y(Dgq*2j~P|H0#tQlSKy+b#d`79Qtl%NUEzb+)V6 zH5O(QmeCfEa}4gb!m|sD3&-M-)H(qJ|Dur>k6ev+BU=%`$dQ*K9xI79mkK(@S}bEn zjwBQ6epHTs0p7|+;FSMZCdFgz>anF@$a9O4Qdqt&*+KHiGfXlH24$f2+f9_h5=fs2 zDem!zJ->iSJq}1l`=u7tPU$h`JQ+Jy@u34TTeSPJ5U{ua&6WC~jm*udyQIL%*GOrX zAvS@XOt@OMo>FpJP8H_k&e2dJu$>GGx3DAUO#Utj}y0f@f~M^-zT8 zOR;w4l?S|dvNVAp`r{6sWJM5N*S}Jp+r`=8FyD0=DFH#YvU}jHq7wI^Mg0=}Pzb#v z>IUZflx>b>()39iCk3TlVRgP-*`^|Lk=21L5yLkT+en>lQgHh88IvYWlI$qu|5M%A zLv`Kw?q(ZfF>-<$e2cT?Syaw27+yQ(%=Y6juAhf^Wnd*1WNZDaE6dld^{uI>sX)-T zp#~g^u!a*jA${BDVw< zd+TwooMzK=$wlfVPQ>cB;mopRscYV5a4UN?#{yI#R@a1eUuxLU8cXO26$d3JagsX0 z1J1f)IO`6J7}c;^H>OcJ$Rww5GUk_u*I_Rt(FI3>QW;f=6>EJpn{yRg&qLRdXw1Y= zxsI(sMsJVR%SB~$F2mlfy0DaA)*09&4gNK$fXXL@bKlWM#55#^P%7noXnngfkIzprxQadsNBr7nUlfS@@M$3nd=n1U^_pkCRk!JvO6Lpu#d6{q?KJET+! z+Cnr`Y)$IM9@4MS5@ef^L#s@n4++)&HA|~&kW{s3y&_J= zSMs5YMN%F4(Ey|GAsK+-1+oUFg_3hWI$ZVl&Qla=RX`(L}*tv)#v((FA zFC$ zQB@^}LQI76ixPJ7M!jLllIvk)t9Ju)nTOVQ6jhJpdJZcq*Hu+0`PGQc*J4is1L$LJvl>vjWLN&TF6_#xk?DmOU)Cf8b@1_R ziuA)q2)c*jt-_0qq>y*%veh$^fkxpC2k?E0H@GW`gvw9Gg%?j1-tD1y0viBBfFHDY zsG0mK(Au07UUo0xWj7LD`T34F9+QRihQgRR_+gM&VWbPRMC!3in2g2o91~PtQ$6#H zAvwNP;TB>GHlcump}JI~KOnyhBDaLCsXF%H9F9aW85*p0b@9-41EDQ3XPF9Cz=Olz zcH#33`AER`7x}F!o)7ROn!DuV0?<@Aya@5RN_|rbf`+hh;i*bqvvB8Q75TU~vI=}x z!Wne>bQi(l30U&&$DYZ4Cg4jJJg`e1K7TGz(TWdyEc?O0y%pmkFRztw+#ex{dn0{N zb}Pb0zKo~iTN(FL80MbJCcKaF^~{_vps0t#LbpuAJ(=C$D*-m-(MObA@ZhjRdt zF1@@gpTU>KFOwz6NLT@j?CsG7FB@ znc&fOyl#Lq`1m|pbB_9^R1$GB^1WH-V^(e8YXe__K}4Je$BV1plt;c>_u5^zP9Btj zsGPie5hfq1RDHt?K9-JT)#-8W7DPW zjO(d|_+FX>{W5~|P1%UQV1PKrK7#nIaI6cqefCMSyf;@1amTQH!E)M*;~)v@F92%1 zQ&{E9aZO>B1II6gnLGA?F-|G$kl5I(waJ#Q#vMiHh^qE{6_&~5Ua-O}g&HpuRu#r^ zL1B(CYU@m4EG6J#KUa8^#O%)s9WZ$@CPGoxv%V1oDHqWXlIPE%&dvnR_42}l>AHCf4Dr&G`Lcq z^MQG6nIjwR=LO~oQ3EdmJ_d|wLef_N^J6hZpCGD%55S&{ptHQ2fwet$*X2460k;Ad z!Y4fepC{Mb;92nBgPo*z;cSRbzXAT%JM6BR$bkHNfV;kl?R*%5_;z3((>3yc0QkT? zcGoL2-PhPs5)` z2mi%7zY9}@2F#I?>CXb@c+C7qi$b9R&jg(#Bk4SOPzL;_jw^t>^!CgDOwt{$ z2Y~nM^wCz2hywGQ){T;0Ag%-63jP+I{~q90;Nv>}E^r&L;>U(Oa2K%gUyh#wcLQ&Q zeW~B;z~=vQ{0Hy>(9hE8ACTW<4;u=~PYP9eCkP%Y=mEd+Uyc%B9*i~U+*m&fI>$NY zw-T7ow+I3kh)UpNpd0_~@RJUFK;X3Z+wl-^8_weWLDCE4#-`c6 zhe?P1IF2&ESAn~rKOkEF2Ls25`JFK8ne?}THORkF^5Y!@cqXutk8kkt2w;{!1K5~v zHAq|lTn7FN_4Jnk8}s)V{Q1QP>;wIIoxT;Ar_W1(+1?_+X8l@$w}St7I)6K``M)6d z0h|8|@-5(2@bkTm_Iezc-ZwHz&*faI-NVOhJ8G+&oW@+(h#TxJ_`P=2veWfF#2`C$3W+MC+T7_ z->|Xnr|}K>(*OSUn)>BPSS;qwTXIGudMVB+M`p;Cg)cmjblTlICdYaN_8;^uj4xP` zI<1huZOiYpNwHVL9TH~F6%6d5;C~{`rr(5c8zYfSH8gu;BPLiqCOnL!lPoP5Pu-CO>Hp9r5G8-btW0mkDxOw|MyZ6O~!ZWB4niEf(A11 zC4Oup&yM@K!fN_s%zyQd8|*Cj!#j-MwUm_^zet&>|H#E0gQa>j6f91~1H0sZRiu{c z2RW$cL~L+noyYO~SVL9+wvl|N{d*37?}BxDb1v%lFyT#g{0TEj?kpMqr!f;y zBUmsW7K7iMuB-|BIpFf6Osw%e7SO8w^$}7cTXZ zs=xRQ;g-vt{6CL5cJS{-`Y(9&U-y`KPXA*g*^tz~gUrmbN0}pdMqmEnsr9r!KpIjA u-CjdC5cK~JnPsY<4w++Ek%RwHk~;{xB~JfSCDSjA2F1)l)qL^ami{j|Pd0)8 diff --git a/scripts/kconfig/conf.o b/scripts/kconfig/conf.o index c191a8a72cd7dc86b00872d436f45203e92698f7..733910a56021d4b691281def66d200cfc1d6871a 100644 GIT binary patch literal 9940 zcmcIoeRNdinSW;zG!0`X2o_Y-3r-|P2!s!XCJ`$EC{D2&L583ASXeh8lH-s#I%Mw_2vJYT&Cv zp^*K|s`BnDYq!d;s#b|IeF=W7aicu_@nD&{CjZ~NdQ|Eok9AfBg2)_6ek-+*(YVd> z)B(?aNWvtwqeJDs;`ZVqKC{v~yBYsRUlnqg0OMB8%pS5DeJ>4+O?~1@z3W1J>3(ne zC~T;4aEt-t%7bI30Bk3s@ndLMXOWvaUhds-2O0(6k4YE1OZO+|3^bq?a8{T{sqPce z+f=v@tgtb{uVQ6(XHjG{a;$TSyLY}{NR)>wVNv9-Fs22JeE+UxU#EuLJ^iWUrhu{_(vuyumR1$IJr9>dHGBa+SGSCe(FT8^r#w8(@sgeE)84ZCofgWN z>Gx)KLIcrb-rxCkq2S%8XA)$op-OXVYG{$!^r8V3d#Tj-bFmz}{d{oL3*=|s@}`r_ zPrKkm(8J?R-=Lcwj9-2Krv2H$zJ;8dmB}ZeX)W~>x+}snz|cX}zXhZG&v(;Fc(%g@ zFSi9=vV&X?w_rVNW6sOIIcKX03r=U%>}FOTyTWVN+jFpEgYM1RJONs%6E1IhBGu5i z<0Kc-2~4QB(Lhd_$2G%ceg`pixP~_cEV@jOt!s=Mla# zr(O~AWhflGfP5YaDSH%E{xKav{ShpkN3Mu@Gwr%ZcCYexrG~CGU&H6N%G6M^`Mcb5 z2s8cJ-+R+0Ck5tIUv3_F7;jJba+nOybH-|~jqrDi`Hzk8uPo*#9X{53QGVX^l@QST zl49-Ynpq)}Vcl@A9`HH$M9`f7P{-iV*XDm`(=8**i8Xo<>m@sAugOW)65n(y?73b$ zU282J*{U&R?pxxUXiH$nDfA<3N7nTdQpYg|*PxBYvn;Roj;$C{)}>(jraJ+)j9TH# zic+#}t+KB38TJ-3OSXS&eMS9X<}K`?+!&NMZQ)CwMf;Q4Z8dr@P18@KzorF4-t^z0 z(b8cQ=IPy}+36%Z+1@vB6tt`kuX5P1wp#RJJL1hOhpDxARL1G^z(bcEl}-}Yxm;G< z0oRO5XT9T+Yw{%OaRi0HV5|-Y9f`H60z#TUs%4&Vha-9z4MoeL3h$2l&@T8gyb$!= z;v0+1uYvx+mLWYCiq4^LI@g>P`HN$P!Vk_fY}b7!7J1WyXs6%8fn09Z>x?Yr-FFmM zftG58Lm!t4Z@LN7s6%yBb`+hI*@FlUbHlLKR&cAF3LWbjPv)>WzGOhkn$5ASQS#l~ z*O*vT{sLIvU$p&l^X+?%oA07zHEP6BSd85!Ip$dg+cJ6$KLc|pb+`)&j~#QPu48}l z3_aOU1?5+gyW7?{$=|0gnJzZ`pUh6aP4)rN?$h|b0nF22r^tY z%3C_Vn_KVbjm+nkj#`k_U53NjfJtMHx7V(PGF#^&7R-@9YbAS})^6C$A#5FZ9rHZD zPdB&XNP%YRwh1otiTod&>*%6U{b0(5;nS(za1k9w_-?0|sRKrCAygNfw+AfqxhyWH z=r&)5@v`e+`X(3czh>Op>_OzQ;{I?{G+C{_?5o3-B|QueRcP<=|TeZKy*6<4|eqY`Jr;R^@&+T8BAloqA4o)M{*YA?Nv)c&t1R|Y*EuA5w zJr+02a3o>Gy3I%|YV?N8I{v>`@&vZT;$|o~rBXGnY;Ib<%wL_TRMiPp)4X)e#fDPV zwTbG4p=zoVpeiZcP@ULhDE!S_q-OT2nO$mT)K-IGZJRQxgLMWxz_KkIi?oH*hWZ)R zLA9yDP}M=$*P~Uh4BZ0&o@oaYZC@#EK&7g!tTk4J5@sN78f~#?dt_@}U0r3Zs&X@(gylHI|88Irz}@c_r*RQ0c{t*ted#^V^R zU^0%-jcxIWNsP5){6fZ!p?EaZS?Xvw8<=Ysje+Pi6E%nijbNxfknD5{CVd-Is}obF zP<7Z;C*|0$izSV4peKZxWOA+ycNhv9y|H9m;;=oy$Y|*d1ri}6j{Fm`uHsCQN=>M4 zYn?H5bX}$zu{Z+|epe`(veiWN8-@63w_9(Ub+qg0Ui{Hvq@QUUCU+wwQ@3NBq zPZi@$(CNc_0=YQx{1EidN^Bijxfg|7*4Wr!)GTYh{$gWJ-R!#A#_UopoktyQ%6h{R66QOCq7_;xQ7` zuCJ>fP0pDO8aB2H*L4@>g{i0JU-aScDi~_T&7IF&yyKadJUmwToQoI3J^Va4S*e$C z1dIiT_SC~vQPo28l;Lv&d|hWZ_1BR0B|z#sdi~IQRAdB0+OvT4&!0{BP%m#c^_Mcf ziv)-Ds+2lNfjkC~WUC-gAwE0LRBC>ao|ErN$cpm~`jqO15%cBA=j6Kq?ILs4KVGRh z;5m;Y8wZAyD`lTSFX$)%9X+BG8^t$#N2zyVh~=av;$^=`O~+R3Z}B-wtt&Eg{6Tfp zQ_L?{|2yj79R15P<1Oxibh#cg#=w`qRbx1Yd89c{47@Y(lAZ?S#mmv>{Ni&HUiWa; zngwlr>$3@b%P=b&fSk_P;H7>OupjSP$dxqbmVvhquS@rWhCF2$sdZ?-iZuRK^tXWS z#AF`?kM>c}+yKX*Fr*Wp_u#eTEmyaq-HAaz3Z#4|kdGs`Df?T7QMpGLl#fFO4;CqK z-2SPAeyW82w-TDSL+7FWeun^(ezk;tuY?{bp+7F6zbK(kl+bR}#d+9YWeKe>#-c#^ zC6K>~TJsl$Gf}V0O7vHh(18-VqlCV_gubVQez=6@51Y=zc=SIu!XW)0CGvMbFUI0J zikKPi2PN{4L31qa@%*&FUs9ci{wiSSJfz2!(34B(3rpyQCG^q~`gZFy%T z8q$9KIH>G~+(fCT;<1>yG-}3s#f4^S4{eA*Uj+SKv0zB~{cUD%cgVlR-x+IDU7@b7 zSWigdf|yXW{-qNZ}idNg~WWx^=iun{?^|4+#V^is@gz(vOha zv+VTPeHU%_*-AANK~w0${+S};P`a0hJ@hA(;~e5I z4leAOkC4WJz&(%j6C!_si2K8yD}M8t(<3FU@T z*OH#16n~#}mSTM(_X;{T`+q_4$}I;`&_pCj@bPXn7@& z`d*xS25ICsjdZP2 z3xr-SxQ+<@&6Gp`79#3$KN0iyW#V+DUIQ}z*NM>ogW&s=!|qek$m2`FvvI+6&roV1 zkakxQVYiHY=&vNg?>gac7XB_`9qupW!|oqMzE|)`%3*&{=wAu_p3r|1I!_ww?j#ZG zZej%xb(jovW8GDgo`O3b5pmBYf2vZK3*98>Cm;L8?Lyy4dM5S*BJz7h_B7je#mxj@Pn3kHbLYo{D~3F1Xc?I5BKKN0zZq_GYk6Z)S?L;oeA4+@1kc2t$U2`7 zq~ChdkT(ckCAf?Tn-xI%Ur!o!-$ok#?E^qV68 zQ1D|S^8HHW?lWxtaf0U);qMZl`!c02BMtqfM8w@pL{6=g&sVCAG~x;izl(g-tCxuL z<~HI2oLiJb?_MJ6`T+S2n3qK4@jUtP`yy%7;T6)*J4zbQb$Om4(|#5so-gdiScyv z97EjyNkl(jc*dZWO#hFen%n>=f)4GzGT{-Xhp1m=@eAc$eUA!TSXNM({zw zJ%W!4J|?(V@LvUgF8HkAF9iDq4+y?2_-nye1%E5}rr_Ix?+Sh(I3W0u;3tBg3l0f> mCCK}f9)H0KL62aS-~_=*f|CUeLH@5tKQ)5W1!oD)75qPdJ^#G` literal 10348 zcmcIpdvIITnLm~tFpfb6!lNWCH;J4$CQ;&qg%HT2II%+$f^6q)h^koEmi&-h=_-kL z32`f_AcR|5U>7Juli}UKl-<VCm?}Yf6m7XUPvLTeKv3xGHnx$`h8`H_%YxYuV&5)1!&9 z)@}Y*G(B*`vhmDIBV|WQ)f)G~bF(F*D}Au?5fw6{124{|Lzv8-SB6IV^~4#;rDVCR zvgF~)S0D+I)V7AoJcaEQ1$>T9>)bJ5%~Fj222WMi@=VD`n;Am9*?P}Q!;_OAl{{AB zPW==5KzwA9fkwrVNz(x;KeW`KwK=QvlssOx^UQJ2-4qY}oBnP5GCAgQe?JJf$>XQF zQ{RRA&G9Mh@egV&8Z+KIjqpq&1vI^gCupl9;< z=~hSbczNQXL#2)^^YTl_FKPPQcvI&0&4rP_ll-d0+JT=~L-H$EVzuq3Z)Ca8*Xb%y zOuU~QcUf0&+BA{-+QyBY6EZPi8;ICRLat^Y0+qV}VZmZafko@Et=cp4Mq#qkGpU-b zFZ1nV&(IY7`1J7hao$%v$lu(Fug1pWl`tchw@S_E}$6+xuD)pS*S!vH-wy`R^x>857x+!!Cw0$T0Y|b{6ZS{p%nA%3> zGLM59yQVQC>A^&6Q&Y>v;U6Iy_d#7kU?;~atm(jqf@K3_{{9yA^4$esO5S)LV%N3)HU&CS^r<-X9O0)^Zh^v$oQ zQ;m1CjJKtDycn(?kUM=h%h@T-%{o0>eVwg3i0rm09N!77n}?}}#`hlA4VOE0qe~Ae zJ;#<<=dmaXhnD`it*Rxi36g$DvJK_wL3jEs42Y$_*cq6U`mI}h8;55jQ`i9v3R_R; zq&bNn+u}|=Mh|0K_RLInFJ!pLsQ{qmKq83KJ#r+{U7ICKgO2^9Jn$sx3n}*oRM45P3o6}x{7hj zWarM;v)`!-ZKhsE2Wl=W)O?aLH8mB~Bd6j2oTPLs`q^uusj0d1x{(T>z4CmW>+(@t zOWQgh@cPX{uU!(#%0lMVVA|^^IkwK7eiW52H`oQc%F~+P>+f3Wxxi-IOD+8Z=WoN5LIj{ z-?~v+v$rVpv6Hu2)=ndoZ6~{{AhdV91#*I9*Lw`?{@l=1c58Y1PYHMKM{G~!y1xZ2 zm@nKh-_O=pqWn|8hp6GoF?VV$LhyAO`#@u3T8CflEHlmCh;T0YHinuVHhLq5tgkHn zx;y>v;AU489C8nX0e_tp&aCS&(%gQu{neXfOj{j$FouJ}o$5eZT3R-Sf{q}2T{&dw zU%AuI+D1d2j!2tg$FXwvEr-D!_oTVSpRE7rmo`5fszhW+&XQDMEYD(#Nh8UJL&A)is&* zo-$m5%6zDoWI;5!=@?%BO`gfhIySs#REH}EsQ9uE3t!Q3>TJJne>OgT+r=CoeD|Ng zaYrvHjQv%lSetMkd?TxP*DH6Yp2W7-sX8k#7IBO>zptGVQZzIh5aHpso`D0e!8DSf;r3Z~DUx*vMk`l@W4lY1T<^NyFglfB1E-Kp=Qksh_YqYa*_L?GKxnH(;K#?Ccx zo3{gnGwsDN=z0(xRJIibWSygR(k!Z}NE!Bo4{6HQ9JV#LwQl2ew`F+Q7|y9*=;loO zoJ-z3rNnwjE6C+|#RR9=Jhs!ez5{jEHs{xvcEGjv1B4<|YveA6?v)qs1$VZO84Vl)SK0ZoJktu!C#y5NtrA1ⅅe~ug|u4GOsy1ZQ_c39Q*oKG#o9fjGW#wo9p zBTvC_=mB_=;a25#p`&a>&Uuk}PoEgwJO)(q-H)<~%H;0ylAFtM8R}m=&#K8zdw@&% zYV3je@!GS+O|ER`T5NELW~R(J$e)H}G7O1tCl92w>!_ay9TMeQc{7yGd2EYUnYS?<&y5E3)(DrCL_<{>@Q z=WKC^1)w!@om?CGgQ%sYDYO^-Tr*hkd&-Aa_d&Yz~L9#8_h!Mtc~E=n2Q;;Yi0R#?DmKM6g}P+*6NO0rlh`3`2#=!+&|VrM#)bq8O!8Hk%k4C9YSdkRO2P-;wXhu4@fF)uTW zXiRst`8{SNVJD0NQQjq-Ihf_zS_~V%x=(!|GTTC4BEh0uNp6i9)$tj2bZQ?qw43B@ z0N#Q3<1>_cPu|}Ei{BT(yXY+Y{R+#I?Q4JsfG%L+`|&Awh4TNe_B-PDjUxZ2it#?^ zWbr;;pxc4=RRwfmoO8ifjrH|QjGD%E8|D~`yo@w;Wco*2B zd6)MDyXGk6jra9ff$cymW@E@{#msK6W$v<+7fT_ayxZe(<&8y2P`l1sH<4Vl5H$MO zD$0vWG`$FB9@c+b7uS3bYR3BdwNNbKJ)V0f&mcZ4@V@G1%YLc^rvfqk`RDM(N-f4g zR|yXL^Q7UqS1mNp8$JdMTyHmRTH2Qasqg6ZL+>Gx5e#WB0MhBwGYg?)q7OF2+%y$8qps%!T9q0t4$sCytlLw=>>Wv2&mn&KRf{3=DrpDUtyYjhs!|I#6Vq<>vRA1$JXi|D@=(PtDC2<=rB z(H9ocmlV;nis-pT^g__DVJ`j~w$DL6mlerdis(=g{hcEE)*||zBAS11bsmoAsUlim zRYigF-xbN<2Yn3lKa7|e??{n+6g217p5IT#Cqd77XwO|lUsy!XETS(hq8Ap?R}|69 zi)fzt&O`r-mkMv2!sUVI$BsaEIOvaC!Ei)HqP#Zy^)VGQtwb#1hd5y>98lq2)fO__ zx@a69?EkC>CQiboaJE zcboX~(~A}D_9G9t%m%vcj?6=EAch(B(~#;3Abg!-aO0-Jm6}wz!_UtETM{z^K|MFR zhgRlwnbWX~`BLF{z_R+374AW{B%kfJiq@u6xvTrhhyz0mayrDhN>QtApK4uMAD zCx9i`fAB&m{lr-)hj|jbAx-|w+Z#GC&C~9dqRI*!jB22M9#k&(Er24=}J9I#Gu{)(#|oVx!%b? z9qWuZ1xWc+!5M;Fx0G{zQqKQ9mCRIXI}!1OfG&?xJtB__K0?Hu{C5R&K=$KC$$2~t$Z@(!&qW->8A=5N_fQUhDbnb7 zI}!2UPd?uLg04w6eF4xlPpMkc@U@tT{!7V6|Mfy|5xR>Ae>V$1Dg3*HzE|jniHLVU z`PE82O&an3O6a44e-{3yq~Z5-((ro*?i!@e0+OyHjo8-;1_bvAW(DseR%70Q^na9y zI-h(x(2KeQa-0_tVc!s}rks9A!_Q*DAo;kI-9j4u28ihQWAdSY9}#vR68_`De~Y*P z^+rDWeJJuz1wW@8{m;ZkKzru^N!JKHPw0iDu|8K3u|7AD4}aT8!)`kf{kzCV|6M}w z7J5MF9}E4j#5$$^LPUHYi2P%bkCKMJxw!0e+zmkHV-0E4_j;j2q)|6_5E0M43 z8Xr3rX}o=;v2Wc;8gbn#{0GQKJiieBpx}Q99u*t`a{P<1$GYZVKLXNDqhMI@JA(HU zk+;Wy%*S)We_8O?g0B-{`zVlcyhj@2oQ%5?{mmevUY7#NuNS`M$g13wOUcm>6$kQ`K=pQ6P|5c&iBEsG~K-ZN@eIop_v%p9ElYy=!SeHcj_mU6& z6@u51e--MVH2ic6e<%4@{707;bNF(oyguj^lWjHrU!~S~G&SO9OBDES<2(A=dEx1Zx_5n z@Gil71n(EzEBKJ$V}efzJ|+0H-~quG1qTHW3%)A&8^PBE-xU0V;M;=71m6`L7W_c) yBf(Dv#{|C+RHz5$wM?*Fuu_oUos{#toXGD^;xs`+&?8tQ$nQ<+EfBm+@P7d&TLYf} diff --git a/scripts/kconfig/libkconfig.so b/scripts/kconfig/libkconfig.so index 0916d8ad410d01efab062ac382e326f6db84144d..f6f9275bb488f3b273968b7c2d772615def8b441 100755 GIT binary patch literal 92727 zcmd?Sdwdk-6*oRfmSn}~E;O}KQ;l@hpeTu@LWI^3Awi3}T#|56!z~yhml$RVScKqg zkYQXK1(mj1X|*lhsh~x<7%nDYy#%V2R#d#tx~S385Gk_1@Ao`2yBoCqect!qcXe`} z^IXnzo^#G~p6d)tM~*H_OH0$-Uxt>U5z8*pv_XKQFH~uRw0xu#Xg}1>kaRacVZjg5 zI!eiih7S9em?(aMVUcxg1&r^7=!LtBQDW1FVxW76#;K17f zAI38l&n_qKL{M^KgoAeg-h-#j!G}BWdrx4LVrrcXxiCM z_$PpuCuJ0Z%If`27vf%Xpq6lJcA7gtr3T;e>w*_$w#;I|u&N zf&VXn!T+U^m!`xIObP$5;Ke5-4m|x72^Ug?Ah3R1$OQo?TV3MVig zupgf5+yp?l-X6bS^uQD{H6>0*_!2y~ro=5x3A@2DZU8Wl5_W@O1R7lg@G?9j@hrzP z2hR*Vx8doJhrhEF(5?rp!L!i83064as~vbJU?rYg@H~m<&v-06{EfzQ4xS(4`6ZqQ z@TC481QNkB56=K6VTuFS0xrfg4$m2Q%JBs8{1y*?zs56LLh4Vx6RrZR$MXc9>3Ckn zs0JP9yXn0o@OT2x6#QjJDH)m~ z{JLXA8Jbtp4<+!E1m_sdUxwCO;Qdbt0DiIrS`&D--~o)&{AFmT2$b z<`cO1M=tIcJe3`n|DUhL^b^`u`6Y$&<@YA&@ zL{tC+8iFeNqWxEhNYg}8eY9-the)>eCoSGp!%4T^^$zZcOI;^#qyYX_%^ zrut|(+U1}-`eD@vn0~!dk@N|+b~*BoFVi&k8K%FD^tB;nqr_haKRGvIx`TM)(@?($ zor1PT{AOhW8v6z5J)}%XyHVPM`2g_!pkD#V{12e~b<5R!f%v^BUyF`HKSF#y>hZ&v z?{V;59!=|*qQ+RJS0bIii}A2NYR1)fAMMNdc$n0dht!;l`Cml-jc_bOB!6%1S>TIP z@GoGJc^IT9N9JFL`qoa-G-^(8RFH@K93zQ0gZ@GAH`u`kqg}(+YT8E*J{tM!Q9n(b z`3sT%akP(?M*JeSAI@WmBac63AOXKi@UT6*5Z?`9(kC;27w`d?e}XO0I92-^<@q}o z5AzR({BoaEb1>%r8tp4+RC6Wb3sIiGAK_vC0_5lKdyalCK>Gu~RC7hx}ur@_a%naVe^d>`r;`aIpqe=_)6 z1BZT%gO@q-_>a^Fy@8)0lQr@EEdL40uZ8^n?eH@J(3>Lvdyt>MVmy@R)1co8p{*CZ zxArLbTYaAzLrL#9kl%_aN%^e;eJ|3dJNYLd|HCQ$^%C&8E(QNN@(1Q%?Epx6Un1T0 zr+p!e29(daD_P%u(0%w1N&7ntd~pii27YT-Xj;sve>33hhg3fzeG}=k4Yl?lewNeT zjUqpcZK$sa{+06t+T&jk|9A?&(;?sWDforpn?K5t@_NFdH_5?YfP6Nln^N$r zkp4I(s_P_wZ|yShr=`?i=Fmen>0|YdeqFpT_}vA2IV$|4|0Dm5iAjI@2I2=yS8Erx z_hr}>qh3|M)bu9wYs^;AaJ# z*>4>Be|GpSbLj5}A2Zgd^&Rt{jPetvsyPhtbHU#xEbx{)Tf~&a)HyH(ok;o@6>vU>Eo#H zFnlK3LA(*=N1?q#obsQcd^d!7rh|Wke1Vky+T^tVOG($XW023Vsmc7$fZqaVeD`Dg z_$AWorzG{c4edLK{%Sb%zW{$FDfSnEy!hJzzS#c9zz=_qIygk7b^l(i-O0ZP@h|^D zt*wZE59M{pdpPnDU*z!X`j>%-cjrTWF&|nAoWJw&u)dp6zBN_8tp7o^mL$Dp4u27c zpFe?r{+@I2ehyxRIMVwG6Y+Z-Pd_}@K_25_Pellm-f+lk`L zUk3dIz)!uy-)X4lIxIp~J9q}m55v9=0P7zIeEkU6u#-Lm(cZ2`dpE)vh9w>T3H5K9 zlC-}ofb(|+9_ptA`T1jXA3O%=uY*(gA;RQ;2JqFG5B$x+e~kPk@IR#vemm@A!YcGn z#EbsW{@Jka^PKc_#22RYpQ*qLz^|$=NBbx64z>~ zvuo6Pj`GL{?*8%-pdaL~5D)7=6Yb5pU(?1&dtfcqBPL!m{OT*O(5lNvUt2nSboI4m zW#dMUuO2_Vbo9t-t-AWgIrHXL&)26m=+!`H&YC+5k<%AWWpL{3S+~?^)mJU39$Rzc ztoeFP!xgiq&Yxd1Uz9tcEv^h0%rq?gh z<}aF4J$v4~n?m)7nH#E}I%7t4&0M`oZ^i+Jc$&4YTIz zGqss4stHnkb7-DkGXqjV(v4d6mDg5FBJk<84cg4chFN-z6hMV6P3{x=QUu8uqN*3c z1ci?oAt+Env*s!|FXXV;!>DFLglG$Gc5Y3h%flS80&Qx2J?+e4Oj(A5pgkarzX`I{ z(;I50>NVBVLNjO9G^jdf*Pubdg$@fym=LmPGpEm<=k^X1q}8E+K}K`up-W7ks?VA? zSEJ})|I=sJOl_d}gj7R~^h$+P&u^Rs9aQV{dQ`0FNp`eucFhTV&1|S~ZE@!8(EQpS zW$Tj>v{cAm=+w`vcd|LL=)>q*E*mho9#pDng0AQkBN8)hk?!i~Ms&#?Nc z&8V3PhX^gvGr2KIgfYbC!&DmPLaX$lbVk+FsAbikrp}&TjV>Lk5tPkSM&?GMAE2NR zXCkVc8k()6M=IJNxsZBNIbcgOw3*0*iNao97M;b@R|-RO67EGta4C;uG9RshRT{<~U>* zB4RoQr<+++)s&1%l&VSa1A)(1`Ji5X>MXFJDpZk>BRo>iICvJP4wXkS&Jhew!=aU8 zVvr0QT`<)YNp<(Mm5Gd0}O{KCWx)~$mW`_ zSfN{1EJ+zAqu4psxTB1hIE^AT4x@#5r|KTY=$1~TCOeis@5UQpkSC;wnd`6(3@kO6 zU?{d(p=0Yw0x_=le1%C<6Xwoww>mlSN)LdhFs@0Y^qSdd zn>KsawCNYmpLg-4T6N8gsrpoO$!YVUd(O!ag$__Y`pVKPsxP_t$B9r;YB&+gS>XTq zFAek0kpaaJ{aDoG` zbKn#Q&TwF@17|z1-hsLU7dmjU1DhNecHjyJ-r>L&2d;MD8VBC*z_kv1*n#UD__zbt zJ8+`|H#u;N16v)q%YnNc__6~#9Qe8e_dD=_0}ndzLkHRpJmkPm2Of4{w*!wkP{aNc zmX(^vfnEn@JJ9dI90%q)FwcSc4h%T3z<~oCSm?k(4jkgZVGb;D;0Onfa^PqO1|2xw zffF2fodc&haE1eG9XQ*8^$ye>xX^)%9oXc+ume{(u*HF^9k|AU_d9Tx13Mh(!M+&f z=y%`<2L>G&c3_JG*P>k7>o{M*{#z#C+H(Q1k@qm++1S@09EQCp!tvO*A;dy`BjIH1 zlMrIqA0p0NRAum^nm< z4c|_}!H@?bHY~ddFM~V?he96MEX(>S?6nYLPpgpdYV4;GUW+|p!XUQ$2*+qz3E^1WAtD@yePhB3oJSGj z5I;zWjnDCf*pr_?cmuYB2(jlmg>VY?Iti!Z+=Or%_In7YW6zOr2KH|WYq94=I1A@3 zgtIlRiLf4fdxY44T0z)=`!R&`u}?^d4YAdPjo4Qt#KzhEgo~hm!dsw!!e2oDgttQf zgiD}*!llqZVH5OExD5IyG@yUNF!WE@4E+->hyDp~hyDpo=%3Jn{t0nba)2-b{S)2^ z{S&r8|Aecdf5LmAf5Q8qf5J7;KjE*Sf5Klw|L7N4zk&V ze-Hf=J_P*}J_7v{J_`L4J_h|0Vq9c0m7xd!c{Aeb7H4Hf+}r{vG-!+>bMJ^CRPs*S^RL(Qo9RrBL3U zomzZ@2f~d%gedvNAIb)V0cu+GU>v`P{KT0Y?GQYNI3uI2g69(FpXhqQ;bgSheBx^b zXRx+_c#Gfx;)TSU1ZPt15aRWM4li*~nb`$Y>!Dkb1B|b%PvRb>Fcu;Vicn9$k!O42< ze&U6KFD8DFc)s9G#BJh!!NbHmiEDzdAl^;9^BcDR4&quG@PmT45cd-A5PUUpKk-(< z*AUMozFzSAiRTkvEBIRC1;kqff0%e7@g~975$BbaXuaT%6E7h?Mey~+M-dMSzL9v4 zc!}Vfh)*D1DEJoQQ;6pa-b$QDLs7rryNK5l*950%YZnslJjV9FOuUKsLBT2N+7-k* z1b>})3-MOLDf-$q#McXcfcRSCYXv_@d>!!?!9OIvo_LesR88$B;`M?bBHl`Tir`dL z?QY^h!4DJfAYLLkRad*8c%k6Oh#w@LFSv$atxeo7xQBQraZPY9@owUs|6%*HiDRvT z_6zPO?j_zKIB#Lp`iZv+o=ZHJ_!AU=e6z2F0g zmk^&Kcp>po#DjtlA|51OBKQ#E6NncIjsqd+pLo9DCB$oq`vo6Cyq>rw_$cDM+7j(N zD*c~$6Y+zB2Z^sB-XZvS;w{8m1)o5C4e|AYUq^f`@wI|aA-;}yi{LYeuP5FlcrEcw z#Onp0O}v%(6v69>?r3vn;;4#8Iw_Y-dwd=2qj;_C&!pLjm;wSuoDUO>D>@P~;P5^oZG z9q}Q=>ji(DcnR?-g0Ck&ig-})jl_e*O9bCUd;;-8!M6~fLOfsaR^qk9{etfzUQb*T zd^hoh#5=pC{}XQ_eo*iZ;wy-E2>v?p7UHdf?6cVuOr?f_=m*T z6K@jSCccSyz2Jw4w-TQscqj4Q#Djt#Cf-53MDT9n`-v9{evJ4*;`xGWP;ISE+%LF? zcqeg9a4+$0;+;pN{}b0dzz+h)ykT6BE=rrcZ09Xs;c|zu8X1~f_4Ig$b^WnDJ6l?q zXRMp25_y_7)4sLPAj_B{nL`6DLx;Dq{LTCH9~iA3Q_%RnWOOLnX0TM65H${E$2ZU) z+LPg=ja~lOHnXb-FQ0!&Ug*KVOK;0s!HV{TvZT1#1p*OC4cdD!%#p%J*64u88Xxek zOka^!Iy~GO>WU1H?=-u1Miy{>R8=`{*&*J6ahqbHib(SW6gQg-;43U+G%AVQGX!Bw z+3>R>Dn5+(_T~YIXRLV-Jx_acF8=NY-rhXONojAUk7Ay78GOx10JwQi9{yVQF#q27 z9h%QDB{HJ-ace6}7kADyf9AXW8x-yT>fYmJ%eFGN4=XYA8TvKf?H~9xZP`&jV}#Oz z-iiapSkDOUkIl{u;VLph>uVhB?7z#}%EIO!K7=dS`^lK9_%m!!{2AirGY9#1Yc^u+ zF#cH05-qYYJB`*1! z)Z>v6{$rNZX>FC-nkkCNh{4C9vEtoIl1fUxoctl zRDzXhbRYMH|LUWO`tE!Z@TUdn5K1}7pf#TAdp4X~cn4Z03bXE^+R}u(Wy0$o<~q%a zkYD6I-M4+Jr(rtp)!2Wu0EswPFUVPQ_A_mKRFp`PKi5C?~KIbbW2+Q-PTso z?V#J0@C@5)bWbrOIiS+`Ln~~oTaC*1#}A6V)_)q02koEq!Bvc1eyf?8AkF?F6GQ%b zRP5e^R)lo>H;ergS)wrCvm4KcsyDTn-Q!9Er=Go*nLO~+BGoD zq~S-;kyLLTRLLg9>yO!u|BlC(jS6TGndu4G`{9=?BM;hw7`n7{U$_%}(2`yfZ#agE z?2#yG?8**uO|uAYYGQRTVmvI>y@b-yEhu15>2m1^k;mu<4*BhqQp)}mWhYHU*=JBT zwgcqAmxwlg^D+C~!#((-zwOBveS^|)yixdi0yg9F^&YCPo&?%$6w!1v)iRoBqncIX zhttY#FY&_dYSD47ygHQrVYFy?bQq$82_ePnyX!pm^^jD%CqP5C@A?)yd+00C!t+zO zm<%qYg>R9Ix502#LXzdUK>`T8zdagtIWsI3_12vEq!GBKDw~2VO zL9iP_?I|bD%*oiDDW!LyS`p9JEIq<0-OGOdTcy8(muG2?|8Cu3l$K_BK1AtElny5J z7QeZ>F3m25@_KUds6)q_LT8vur!VPj1E0Z!LgS4T&!_)7k+ zXMxah?YmBc^6b065^2?C+TMg+y7tYPIa@e4h2rmBiUUb80E%N0ii4J*yLiLlI6vFqqgeQ=2E(iy$RqO>;db~d0O1Db#;`QE$;g2E3-YuHvSRL1*PopnXrK(hx zwKVf|`&zWIXRB^!&w;!?0#9zMPDkZp=CfG&Z-l*U7+9ZgmA=v`{il@DZ$WZm7>ih% zQcHS)Y{%&-9;Ee|4v85lB-Vh0h;;=?oBq$+j) zNeQK10aErL(E)w9G;5$kK9WLyJ1UoE{hrOb0u9GJtm-@U8iZb>KXP1zX8#3@(J&Kg zh0DrF(MG=1xtTVPCY_#A=hbeVPqEI|$mwN}om~NGL|39fRjr3@%V677|1GqSc@u5B z5n1dB5JW<}zVJAwouFZS|qSCg_tmj75^IzN6!nTz|V^CAXc!~LUgQBWH=?l%V z8jktGQFMt)WV6dss=CFk>Kzt6Cd_0fI@>UaD*7b5k{H3QXn#-1rQ3TF%`tW<$t{!o ze*0a~xEf`@r%Wtje8Fn&p&T?CP6hHNgc0g(Z$`doi9_JGDFpT*w{(Q#AP}^F1Wss8 zuO_;K47*k^+e$M_z0q&j0S;v+RBZnqa#9t!Uh|)l#cvNusbw~55yAKV2z-358lD(L z?d!iq&&OhwjZxIPPM4n6`@;*#T+Iu01%%GUm#G(j& z_U2=7AVKP;FN$uX%|%aUi0(3)#t{2h^ayOXs4Ln@<5n}t!O;(B&yb93p8r5aW?OU* zqTLbV5;d}4dkB-7568Ooa$M{ci#miFk41kal)Nq_^rD}##M42?O$eDZX>aTScYG}( zne!Iozf8M##i$Q=})v2ixOm2A3-Ob!l!5c0^?pQBH_o5_{8<6%pp@%{Q^j zML4rm>nz_3cl?}l{J3WBHd?3s^a7-tYKndPNX(loLni$0{GOXRn89GCc?_O}6QtCc zKI7C%mii)M_4i4$Q{Cdh*C#tC`$HMtcj4_d5H(Z2qAeG$Y1P z7y_ggj6Xx%o`W7xZSI&*Io6)0I)ky5Y7+7PR)d?np_8QoO@dVc;>F)C6a&qwm?Z;!v8aH;E zESe%UhbP}qjg1AYN3P&{!(C=AS!KuqEnP2gS3|}CC6K3gMSyZr5(LB^wpIm9?z$^zWsuUM9-KI1xMQtX3{?}aR` zq1Zmv+Mw}8y8RSlQLAwN~xg#!i3i8qO$SLV?Vs70bxy;A`kSl6ECWdHjC6;22BfO`Y zVwj3bbdWpd$TBVZ0Z`uy8-Fem?^0{UC1V_k`@&C?U)ANfiIb@|FizBi_$V{W?bUi_ zJVMJ-i{I!@n0a%TFPw!Y8OOKy!pD(z^E#s=>!#fDE>^CRHsFZTZPDf zJ_dWMhJcKj&XF-k;F5!j~aa zOAq*6;yQ>A)dRWK;y{i*7>rce=YbCno>i6hnFz`N+yPe)9idT5W^t;isFf{*Y%D{j z?|#cDq|CJ9(maROKcOJf3Rc>$At zvLr3Gx1|cz#TZv%_mX=2u{YqCDyr;z!OjiU6(GDt+K>mSU+?gcjrs%DyliV^V7u)x z4yL)R+>ethF3S3lbv=+@m&Hn_%51Fym0BaS!I#n9%Xj-PVQVn0>m1XP+`XB*6YR7E z?emx&3lG?Dmws~bl01F782!Jk3NM_;#TYH$R9=eyDKh+c(=dN;ec+gQ2#dJ?ut^{} zz#gbXL7%M$3ZRiCB4*VZv#ZVH*FbQT6#go<-73T8n#UK$F*>Z@_3q8gD3O~HW-yGL}XO+Vouz7g5m_vqMZIvrEUQ0Dz?x?W> zW_3PnJbDwP1BBwDnFZ~s_&Z@zMZD2(&jiEO6PWdwGRfGBNmV|pRQXgzok-D?!ZZWe zQDb(6ebT#B7z@9k3PRCC8U#6->Fvgc-@_#rw8S(H zAk=Og#9#h!hXlJnaO*h3=sEbkjFV{yKVV7TG&`~|ZRlo_S$aujh1kyqlCmEGSC&vs zv(p|UT~&urcKaF>XKf%aRq&BNKnXJw+yBffBvlE@|6#LBjTbqQvNZZ$GKsUJpMjg8 zwV5RBPelLOW>zKG$PL=(lY^`_PbP;54iGr&>Dd;3FUm6Rz`UWkwH>1!iTc94s$dx{ zDppb%AL`vMaqM8$hVisRT3BzKH8HH2nbxWnhAwFSjIkvuHr-kkCZ&D)DVDJqA#2!e z80F8iE4Uwj$XlzGz%O2EuOzdUWRL=;XC=6{2jX-98&GdaA}E?8aM-kY1?a3a_Cii8 zvdnL+4dgYF)8%_ME0R+Q59)uDco6fhaV>DB&0S0SnO)`oGsn_{N8YgvzQb%5nBDzt zGi_zo3aJ9~<@v!k;&Hr}Z%WO^(Xz&TIrZ|~#X|-q7w$Qu0U!{iW7&;$6S z4&QS}<#4S8Y7!Uva#)((ve+7U`I%cy|{_KQkZalL!S6*2DQo^d}! zT$21IZfr$QVm_|HlL^s(!x3)s^^ALuasHlhuQ0Ap&$#Cp$1i21(E9`9`u2>wi*Y$U z<8Ec#_j|_8V%%vx<0=^UgPw828OJYJq||#6d(3eF>k>%Ymu% z-bP%C$*7u;MT@RxZd^sxqR%me%V=8kDTZ)eSBw6Ep?rpZ!w?VZqIWUGH+ZABGxS4- zZe<7;eYNO(gp>t}{h^b2?LF_f+RI{<=O9Z82Sq@|Y-#W?TgQCu4EP|+pgXcK3FV5= z^lv&7b)W-8v!xm}GesYWzLL_7uQj_Zi`~y!MUv=%{jua!Jv|FGslJFl7{4T5q~h)K z-u{lt@=#gqF7mcPc)K*g+mQn@mYH8hpT`2p^&kJU;zX@hIw+0`T4^P!?qF=0qK~6d zNe}^8T1hZ=pS4Qbk&d2R3`y#JkfSaweu=#R3`D;|-QSWBnNG2!50D4z6~DdlU9zmU z3hlR?X?wkRm11dpLYU%EQWSItj7+(sqPSI5w6FNctvQa03z~*qaFRZ`ytMeM#fL59 z5Zn{S{>?U^FZ>`@x5e#?FYe!N#J!OXzs5ki^_#})AZZyg5OOL}IsmQLm>Jn5F{9K| zY;dUZE#HD98{b&K1UfBL=o*MAscNVlW$xJi>Dg%=d%GjS(spA%i1Qcy<=1FuciNJ2 zPP&?Z0}R^*WM-9&l{qbmx)e408E)c<1!Ch+L~LE)j7xbaO_5ZPigdP&B69;dw3nh3 z@+&J=r3#!<4{_UE2xeU3?R#?)&60_a>yW%eP z7}xXMVX$Cxp&x*V5+N3KYyQbymgwJLKlXZ>(^)hpo?3rv-ZJVnRw@G6Aj0t6Y1Mih z?uVFmhRDCfTE(^%?=Tk!uxy#hT9L7&05zX>;rM{3sMR={=DVl0#2tuR7<&~q#&Dfw z$?2H;!8S)~RgD54(Plshns>jK81<1?_T7R-k;R7NwA! z<;pJ2Qopr|Jq4247y2RFf`!PO1V=A`O|89z0|h#hXwxsuwqqeiQUHip@^|wd}~M@yFm}p zUx0wwvE9yyc>K{(Kw8?%af=I@3qeWQB_-6uXk{uZ znvB-KCADB`?#}9Kaa-20=0eq%ijP|sr-SqRx2!xZyidO%;@RVSc3;FZ+*-X#rn{cf zy$8#Rk7Iv7mvi2R{gZDncXQ54KRN+V%|<$Ny$ z(~DZ0_xXO?I_jJqW{11Sl2~!PjO?mkbDAI*ztl`T-FhsgM`k~1E%HRl(~Eb^pR6pv z*pY5_M{+L97@l2xG%_lEL7v%l)s-u8Yph2>&yz!gp2m;O-Tgb#u!n@lYk8i;0hTfc zGw6qDpwDnIQ`I*;5XqU$Nf#5#3oo-JoY>sS&QXM`%;yS zt;Akk;#Oe*ZE)9K+-Jo4OLQv(+yRjojY)t%H)e(Cz(Tn<#n-d00xTCAQ?$|A| z_gZ~b^OX=WA90j48GQ#ff%fD;18#45WjA&a3hkfMM{Vpvu$DCD}py$BFnd z4|I6Q+g`?12Y3E*D{aaPr6!x5SdEJr2E`0}sl%h#YbkMG!pqP!e-E9e?h}s&0~llq zRLkH@PgV|a=%5xvmgPXXm~dhXeVsCuiP&hRZ;LPR*!QTY*t_kX7O%K{|bUY1K> zKm8i4Xb9CLe#aH#a?}J9_^DOuaXcsXMS!%Gum{PQUg~MygCpzqQcjNHUk8w0qQ;zM zdivy@lcT57KRbF#?4=iwdR)KR?nDvS4sn@L4KUfuv1j&wZhR2>saDQ%aGh0R3MHE3 zop9Yf&C#*L4(x4v-R9oM)=7^-ad#uca~pKk%h=_eOj`)rH@?a-PC9{P75i%U+$QbL z8l~z)`B$7wEU&lPTva7Gh&`1YM$SR4K_yMJc$~GW30*o;8ZVYg=4VcjJ@`n27o0{s zcpVGb$JkA;(6qDb@>PDE-Q={4HKiZfhxdxvn;S?e_5$q+ce#GH4?5VcvY0!}{Tarv z1CkGWBh;N18RKc^=%X1sl7X3wYAa1gZzeTSvM|Ps@|IFtx)yt1vc=v~g;q zjfteQjY@$O+7~G?iFX(kDL;-_vkd?H&AA?PE`0*qsE*>Cj?!MH%)G2XlFG!|EA5?7 z1}+7|4?F-O5u-)?#T&@OxQDBFEQgUU*L)La<bljV#^ z?E&(fsSsWZ?HPc9JaG#1*-jXNJsUni%n$CZ5{t*9w`RAj^jxsQb4h9O(Z&CUy|j(M za;D8Qn4ZmFY5(TsWPv`8&!bG}>8@9M7%Na022v zI9bECe=u?QQ~wg|-MOs!I=W24-(P|PmXQmqvb4!NTN3eSNW5C8rN*aAyzE)_$p7gM z(pmg1I{PG^gGNvK&oiD=R;klYwnRZ(ujXd;Bo5?g|A>w=1bxooS(^Q!h zKQmB@(S5=-jCE$l*)8b(BiUDr_8>aL%5E8BAKgP|BaT)k*UpGw-z`pv@uGh?D>e5f zkr2;E<1(zk3Um@%}1J^0v!J@iJQ6L(;eJ12=f zf0xI%TJZ+Jp#Y}$k;i_|UFt1?AwX~*SSd`YNx&(~cI6?~G5Ds-2kM`Tg}*LKq?g-W zdG6=&;sHiR^Z-WbQqaH|NTq!e0%jX~^)qG{kK6qigcE|Q1QV6^zp1oUv?SFz)AcJ* z32v(%+RX&6tFaTowqs3&`2)~F0sCxJZmr@@5fV$dNrP1Gt%3@VVPQX&5#xPf^aIto zm}oct6{CfF{*g;Z;fiGU3uwRH-Ug1_(G|VSJxf@i;V1^AEe;pWcq2s?{a#-fZ{4zY zA)n>B4cwcTLHo~%rdsJZb13IA;v?kOyd*U8 z5j0W@^;4}icBh%;e&j0mw3kb>&C8O0+FKDZx}?otpmMZA+HBBPaoCG92W&IN-md_M z_QhhHY8P%As-MKG?dLIl2jqi2i=V*nrp|-c;gw~}lD)Y;*ef!2ryB>4b1A%8q)_TH z)2uA35HpHlpr4q1-z!p(-n(ytJ~$zzpgkI*uI3DGgEAyV2xW06tOP8ZgCPYqt!%;N zoL3XJeik`NY`Ew?cRS50$sUFNio9PZ@_x1TzvV^m;XQ^c*yO_;Kk!Bm#O0d9b0~=O zem};MY-?kn5J@=HgeuzPFAr@v#i$EZ+N*Xt9l>nZZ!x+D|WF1aZBS) z$dQI$37XKA(0>VnGx_>Uv;oSZ$xAfliFs}AvR&N1!!-5!ooJqMXtvw7x3P5>-*5*S zV`reC*&Z?2rCH4pw=Mcb$xgk2?~qm6H-QCIW*!_Hti%PtEibyw{z^|bj~ctCV0GS6 zEq4c&9U6eHYTXfFk9Dh^iE5ko;7l$L2CV_gY}yyDOZlD2Ts8!GqrPT>p!M2%y$sIfd&6ii* z5XiIpxJ~zkuYzcN+pt=Xqdi9V6=)XfMqINDwwOpnHZOyXJ(q>ZWB>YNXd`^&`Lvv$ zR@xJ{yCQs1zn_Z7zZg;1yTTss#_Jh~f@~`7pV2WvbdU=7-o65BYz4R5x_dSD!vSH- z0d;$4;+N*9n=hHcyk%1Yaa>l7zJv9OFf%I8T$mesm)cl1 zRnppri+FLeFdlK!R9tBuU0Sq`oPaBbOnZsU7Udlmv>|%A@Z_cFbL}sbM8d85+2FIn zt_Gj94u>SovNSiEtBRohocPTib#lEiFdiDmER)l+#Dpu}O3CNoVpI(%p}LX7`uUpo zbKzyL^oRGEZNBhIFzMU&lJRxF6&?EN#@E;Bjb$q{!NMuNZ5_tZemW#_UFZ-s3QJS-_`8}k7 zFR+zw{|eqCVWfIMnOXKIZ2S0bUkv)oW-0?H6QhXEB2TJl^jwHS-o<45>?t5*8AD(u zmYNp$nz;}!>SAA4cjprQe-YzgM#e(ip}PU}a32HKOZOpOA;7K9la0I`m4OSo#|5C-Hnb?N2 zHUufuOrs6k@n%^3voE|F2S#Mm@xY(+d?FkOq6H>=!8n)|v`UAJvFiKQX)L_YTrGt| z?a@jp?M3NPV#R)3Kn>b+(A?+{B&o4Ao7HX%WN4{Fz>6-J0DT_l0Q>UF8A4FU)^z!5WD(179;w(XEjz*DUYI z%<-T^4s1ikeT{}$j0NaewXeGO>C zAiz@&9w_5;=B~8MP*3&sO7<71Jk6~l_t2?s7a>DM`k-4IuD2`FJpKn{M(cMo!!|1+F|9<&O&tNswN@OoYhGOVP&C6jtX~$P)4!chO*|2{4 zW$=ovP*@u;-J z?Oc6>zHOP360l!WDH#7z?<=TxPi(o=nud$a)12x?qfhSfg>OJ@QXSLER9f^(#6ecp z1`cYt8@6pLtTNLo$$>)H{jY_%F?WzGFR9O{~`_H6zwG*qA+eeNTCY`C^A+ zj|rl~7l36<`2VWZg)x8(`iV7b>q0KTSW+ zW9YI9x)D+xYgZz3TX;|lk~q>gEltDTV>wQ@bE18~h$YSmEapVhi8>DAldmZZ4mqU4 zAwZGN8Ee;|NfRbv?eB;t$9@RCBSDA0Bl;Hd93|^b$K2S3MubBVJp7~8KSOVXje-`tfj{GE?$Oxps40^wVelhb$q5l7spGTF6 z1A;7+;LI08^KQKl<`sQ|W5(ju)$lW-4%sgsw3Z*sSewo4Snm2xF z#Q2c0Uk17 z?@{>f7QUB4v$21)ICoLeJraBD^{f{g?66@kCU^xc(3#ijZ50)N?hEgtrDa+E;!i`T zkHN=IIPmx@Y)C$CU2e3)F#I?`JD#QA!rBIdZVqmh^i!HaM??m7)fwD@ZVoPz8J##; zv|oD~+XUE1X$K_p-=yjNjc?LJJdLw9j6$cu`zX(fb>-qt8YI3Im`QEL9+Ny1kSF#} z%HwEOXqh#}gClHTa|oOrDGgwDhQYTMNc0x`X{oG=4ENyWf@5&2^tzVc*x}`rEP5G| z-Fv=%>oj-nH|cSnl|ddk`j0IijP)Wbo$G`JL#(vobUjnTIBU#?tIXI45}ABe@N1|- zc%DP%~V)JSPQ0p|y$2~{d>}U-A5RH|1d*PkO@K#E?o~7O}X)(IJ zjfY_h+S|_Lpwv^;RXp6I!$MD_PgW>{&6A{mT&J>SO9(p zOZ1@pu{MYzmO}xkK3`t^F)qu}&ts#wi7?>LG%yzLhma}RamftssRlBms&V-|v==u6 zic3AAJ#xb%wnO!o1`pP^_8AZd-ipPQtl=KD28~{TqTrG3h9$YuKJ+MO+L&R(?(rfR z7IL_>m9C$pcGr?N|0^(yJ|<=#k+9b)gZK0E8hjmJngB;HSqnWwH`6@yqM@5)s0cK9Xu16BJbSE2+&Q-YH>0IX{(4Hx7c8RCGOk8j5jbsg{ zIW-tkLw~6OSMZ3%o>S{Zkb92;bohQl!YO<&BCfAX|DFi6p|{bUv7iw9FnTXKwVjmN!tC_WSC&CB6_}!`HN2`d4CRJhzUZAJ?r=qE=h;LN`|?*%tz%__StA9a&qP{0##VP$nazA zKBpO9XX$;4_8DJiVAp0B@8rw$dPHE5RTwFgJg3s3oP<2bGeQR-!>{pbC;uTmtIC5e zn{B><1Yh_8#;_PJEx~nh2rk+;bao&ow9cx?HakWkFJ6*BrH%J-rk$==5~S&#qJ6Pu z$w<=r#jNHKTH!S=&kB72{zCj5OkA9hT@EXQEX*BfOms9A1P;(mLVLhuXjkkF^5+Tt z!8q>mg|S}Lh}{QFzmA~@LZKDbQm?gY7$yBCuf^#XTVkHYydu|pBZ;CN#X+yHc@mJI zs=5N-s+jl`I*_5X1P%ukmwQ7yWA9-7RfUr;nl>)l;rg6@p|wghiE!w4YZX%xG<8Lj z^~WAXTO4xZL9WyrYKwiqxN>kP^g19&k3P`h7xaA1{mG%!hQ_myulY1Yjg4<$ow6UM zvO87kAH~{8Qz-{slKSyAH`DiWY#B>6=0vX{Ugfbah>WD#MYZtA3r>d8zRB`6zw?a< zCKtC1qg#1R<70Au>QF+6&gn0*W|56@FzpgDB>`=ZkzU>J}uJX13E3dM{#Fz!GaU-t^V zZNz)|!uV*bV6Oqwr!)RVghH)&lgu*2-e?`!IMr~iBRlj^4^@R$k5SfEi7N%M$5U*b zF9YlA6T%6z%f{UoW!9)9)O3Q0%s~sPl!?TC*P~M1j=e&8k4&|>Y}lOgM%cpg zHFLY|1cH4LRT1C7c15pdvNX!ExzG+}$D$H1`0OeTK&TyPMOO(!Z3q>2=viZf^6^yZ z;WS^n29^@_f*wWM>@3CyS!0C)c!UJ8USH%83T+nagRFhcV!%oO6|irE~FTH=WgAgu6Mmne6P_NzX59C`SO9Y{Ra zs`o?>BMe?E?D?>pC|_E3`($Du%6SOA1TzTqQH~RsTVAbMeTu)r-CUTil~r6AI&Cbc zl{kyVzD#mX`DXEU{WRQ~;dEd*H-hkjxIWf6p020NC^6yWCE17JBxR_F`kt7k``e59J4v`-T6lWKEE?7~4SzQk8 z#hD2OWo}t%Yiz(A&3MrpEk-ag*Jj%(gR2u8i{JbXj=P8g!7&JWGzH-c&qfH%_FH{; zLt4&kd7_bMaHZ7zN7k(P`_H4;Oq_)GyX`T;Jq~KSA441Ah9;uz2at?#u1xy;ob>r| z-|0`nIP~tp#RME9;E({5zH4#Oz?t~v*gr-dPW=3Ke}qiTz0XmlqBkciKUFfRL9!of zbtMb2#GY|X8uP+GK8I#$u?I0n5&l1h;W_*dP4IsgBy8}Yc}NQXdEdoG zSH}h9ephxC_CJ}s(*6M=qV$!rmIGUfIc@G*nS|}rN2r;0i&{Xm%lZc*(H2}{S)77n zalt$JGUwhzfn(Y(^NrXmYSN7k=bwaW8~Q7?n8QE0K`bWjWDnexos2`yJgmQNLtmsC z9!%IEXYs5PZ!b3CRbs4*yY%xd^e_x|8NS<3;jnZR_PC5EdhWx7A_&NK8e`aL~3 z^f8VJ`b9$@qeJ&KU#aYX1lG`oj<;uV0gJ*%(8%O5iRJE~tgR0bsd)S)t+ z^ED4chS+9SQjbasJGqI`fJzdJn&>>$WW{1IIsqu}EpZw2h+D}L*==xeYr z?j^vnC2p~u{{UpXIDkt@Fs_T$7DhEpWkkYMyj3I`cnC`U40LclkiC`qHf<~ecw>zj zymkgMsN|1h?_#cteUHb`=Azc(B_6$3@e*&SLyp{Idw7>(m&C(5V$ZAbCzYpF_bX#3 zUurev(dXlZ`o>bOFVza$t=MC)eAwX(8@mo?pZcEN5&Ngh*(_uLXGjKTTu=GXA41P1 zIQTO-3_a>NKdh=ARDAxrh4FWbnTW~S%1mPKK!m(>#LpO@i@Im?Rh81E-5&cY{;>e; zlZ{rDqmSd9JaiKHaQCOU39$r1Q=1SvL)<7~&e(q5k@^3xqmFf?*|rk>f2re)L>>MU z>iCX*rCd;Cqu|cG82{y45iRhW9O{0{?#R*qbQ%0P)>PWFK{K(b^mm9{UYYs(?_Fak zfOqv;>1g{{kRf8?1wr1%xoxfF;q+j@HOT=JiI$Aom39+khY`wzhYB$$`$%s}1}Y@> z_E-$~aOd5MQtWqC?q*k|{W>^s#&yohU7zY|r|{RRo$efmM_0dvRkH(leYf*HQFMYC zPA8xbud4H~AI$z87=b5;f0Y=oJxRrI%Uvz*^%7?z;~e9gUa7tq(%}`Ci7X)Z*FNOV z9KS7r?=IMvpcN{5cQQKNJ~I*hh|7b`s2)80UB#sEaJu5b*Srv|PoWpPFNvht+a7f5 z?2x`{d_#|oz8k^v&4v?dK@9Fgt5s{eK4|D>@!ID&Eks|G`v%ZSrF{-W-U2DesSaX- z_6vxKeI|(>1aGM3v}Y1{jqP_t)#ecFtq6vmitR;qX94m8c)}-v7vS1kFBW1DX<)HsZ1nr}NZg|9Qj8|nj$uhUhipYe5? z3gsGKXR6St&3ja!7j~@qksqhO4S zd|iu-^7S2+O9)uka+j5p?1RT)T$JqC1iiY<*m8;Dx2=?PCQLe^_HnrIkW6CjLYHlt zfKu`gh@g)Onb7-)xEJ+ce|%gO96e9);n)7#efuX@b82-fd?D5l>b^bCkno{U^j}VS zBgg;}xtRal1U3-Nv**Ip4IZ1}{VjG4B)i#fKz3}0WW!OAOd8T~AZ_3O8>s;H4`rBT z@Z0KpO7I=a4)J`@Eq@luH*J0xlXDyuF5AT<$1`A9&knX3OiHt}L1y9&c-3RW^^icN zJq+~u6;<45#*JZ~VBj5I3|Jnim$Ri)zz+I%hKi6TMm9{7!tq~!cj0!#Q*(*JZ7M<) zHs*fZHb!@*oO#(!=ZqNjXj==v^R*BG ze&?%+5a0PS2|tb)cM-l5G43J!JMYWh&(O;tjgF0%j`dSo@ByA)x>qVcT+~W^k3q8E zsxNRWpM%OVXFU~uZi&}}H;(vKv%^LE%nmNQ#BuuVC+>43X_n>S^}4rW@1d=HPpl`c zb5dz#C28F-+3ZNrn)+R|+&L7^;_$&Km$$ume@)(S?t>jhZf9batqFr);LRBQ=HgrP zF$=|F=GOcQ`*fHTv@PGma;}i|vqla=`PR^2X3s0Wb%>LFNQM2W^Z{JvPMpzI*ky{u zsL&honsDq@&<@(`@8xg?(y`}^TeG2Sm3UiHvA*U8xUASG94j!u`R!X#1O^9q@BatJqM+EPkZ{3>cbkP>Nbp0%puCl*8j#0HdAH|`;lX>W*IBbDnpeX2+dMZ_V zLWv6dZ1f4M9(|JMr)P2fVlDAj+3QjWh5n*Gzw|--$Q;NJ!&K}~4zGLfN$OUA1d)~Y zZ(;N3f4E*YBZY>3M|3V4;fzUn=m~|cq6*jmILQ8-@ZtJF)53t}Tfxt8nA_2-nouJ? zmTry7!FX-(8cp>*<7PZFYuvv zz>#(h7u4{PBYs>f6pOv6)~H_lT;&a8A6sMbu?_ke(;r*yiX=;=Iv3Eh$J$Gj*h$651#nG1=0CnLH&_H;Fr@fZ6LWX76TM_NE7<@6;>IV{4?3n&eDZ?m2vJ5| zUUAfXX+gUADKdGBJ5ad8d=cm9xT*sV+%`2T*FDPDT#VSQps7U%B9yo?`kb3{tJ??k zd`8vh+MDkd;~|&ki{RTT8v;>yW6Onsh9TBf`D9$a0R~^_lJqq%ND=Bxm#i;bjc697 z@U9Z!v6c$d0>&Y^%T=*Tdo0|eiJo_ca+AgNel?Sg4A7!ykO;*)DqsF-1ndt`s<^IE z=6Bxli*i#O@vy@6sfOnx(joS+vixW>dhPyWnARFh<~RZWb)^%3}o!ID*1baU1h{;Gr}R^gYI?+%&5% zF3o;{`y`kz6ya;F_+e`Dm4(iOF*D_Rn`Z)-?``5k6>vl&RR!YfZ1+o>uW>?wd}_?d zg$Ou5PWYnxLABEU1xi|#^rA(dVXJq$UK}am&I?XN2VSZF%(`Ys(PzakE%=d@ylKxX zpRw(Z2`bU@OvghSW6mz_~{9P9VuZ%lk+(Py8v3e1bdhZgES znKU>|;5Me+38RVOV>pn{xgbkp`D`^{eXes^pDNjCcAd-n|Hx*R;XRoDsQ!(rV=EJ~ z%a(B{l;C+P<~-&R9ybiepN0##sc;S&fN%Ysi5fr`7y3NKM?we4j(XM7>?-Pty`^qo zyxy{noh!Lk)2}eJ(X>lNsMxyTv_Zk+$S{btBvjfjqiZHyaap03iV5w#h!o) z$}E3N3VlphN&kriec{O$o`s$idvj%FTGP>mdatIV6GB^!w)B;mv1e0cPn#)A$mgRK zN

QYwQmOIvfU+{oK)lFJ(O20SzSV5vBmy?~8T%wq-ete~EH-vRqwyrTrtAQtU+# zsY{D}NubemXp+Ss33_6ZkBc?ksC*vo2DXXK>G$AEy1nagqhSvH6sJH|SuWO$DjMq; zdpr_kKeM>~*50NK7NghGi!dAiF$$Dswu=*ea*NF zh)wKVjwj|9?suNQdJ->pc;NdyM|i2B3hu;vC+Xk$o!fj@Pp!=uzCPoP zecpRtnFVipE^noV&X%`+=K8{iAY0?;T;DJENdWI!ZAYL5)3&4fsVlQ^owzjZ#g*yk z`-hi(6sIDb(Ptgz&IOoPseSs~`zl?Adw>if6xS8HLPKU7-;4KwuzBQPkFm#4%VqrZ6MD9Wk3Wqv4u0J$3+~@q#Zed%wLFjV3m4fa zgk9Q4lc!E*msD!S4yh{*v5$?Ti+s%kA$PTxh}&2)(8pfE_Blvu+E$L+(b>o$`+EE~ z3ZpUFhQpBE9=R1-Cz3l;B=>zKIei|aw)A@A=o~!=o%WE|c1K?CrOIms>DY%pV5xA$(s=Hl06l7=M>%hl#HT95f&nShgIaT&Rvw#-k4g52`+h z`eXxf584OWVm6X#E%3%VTDVr_SqbmnIC+X!x_RVa9A_)%tC-k6uG3^sZ!HWnXjh}J zU_ta@qHOGScRdQ*v#Ju;MTdjEqShljv=R*7XCK)?iF3w?vpt+I)yw%(Ul5aVZIo8g6qT3Kdkb^iY4^2h$Pp(JDE-26bpl{JBON` zoIhQ68+L#S?B39*?4#2`^+rQ!&oJhEoL;&w_44ZyW%>3}c#!7LV95Gu)=2C-L@Elf zU*CmKvvI!IZC;X`Ezt4cJu6HQ```DO=_99>M>*Dn*DBNtmg^-8Crki0!)f42);?F9pcjlu#=q7CD6rr0h z|E^I_y16~+o({VB)G)tTenStsiT9;i??f4BbC@ZxIJ_UaoFNEh1uKDskhJ zr!K{1p3o=g5Nd*r8v|1yn@JOK0QL#Wp%A}4?f8&qgpwz=5xRAG8Ah%*uyrKzGg^fm zK|YYMGUN3ae_04GF}Y`yDP=X5-7J#Hvg&y&95bqHUd=*B$ucXs)5ATtvG!xI2Gb+E z8w;}S2bAXuVyQ=;r*_=&O@Q@uIXDFDk42xcD?iq%`g3AJ-?9YtJtp;yq+=ZrujkBR zfIWcZ+i{d=mgm6$hM0}nW_d2>4@2zMuyQ6{_?Q7c$AN&+Sl6J7MHeB)T)(!w)*yd|K~a9&OI}^3AE<@eZTMfyeCiY z`Jd;U|Jj#&=iYPQLs#M7D(}LjCbA6gbT5*wIYBm%UzJa6Dv^fdaCr^p1}@**V1LrD zUBvIKSN;xhzBPZKwLLv5JsEAgE~c1!El_biXNRHwi1`nLs2yY@g3v88T$`eKeBGnZ zmV3~?=+^5L{4S2qkJ7!*52+61tJ`==7mW?WZnu^Xv0$SIt>2aJNqtTQk3BSGrVl<( z?dv%TL@%eNt(io=@hiks`W0ev+iS8!v06FNR?x2ii`yQv6)ju1H2;Ruq#JW6*xWBT zhP%JvVm^D39mS zX?l8{9A>eeVD6WI+Ot}GKMzd-H^vf0T)7U-XKF88KToIU0JG`R9`|T^;EdN|r6i_wGe z(KP z)pj|ujuy-fcpx5qehAs8mlp=LO^3~XFZr_Of$=_+z8;q~%U|wVzCu&MMNyBoa>^B+ z{O*B#;hiNs1BxluySCFwgUn=ir;yr0pGZ zF3QqcO&+4pXN@~?PKZ=bbI)yuel$6R7WdE>R-)h|5Eh{-6p{;xUshC zVNxw_8>fPlp)k08<yHN7s@%UJY<1gC$%&ToQ5%iTC=Gmn;B;gH z&3FW+3M6VkTY+lc;R~euHZ=K78)Z$x8xnaIKbqzVrwUN^8L83wrjz zAl>J}9x{%_Z66Zj^E8edZNC8%#njTPZM}-9J0c>d)xNfmiE0Lw)kiO46x+VO??-#+ zjC+)c*=^hLm@nEsr&MR3LyeXi>wAC{>J;)#H_}U}ne;;4BWt}r8b;3C76u&r3>Iz? zH`~mmfcB*dHB1VF>sx+OWkq)`lu9ZL6vSAS=2cX&MKf%FdHBUeh}&T(JY!7xR;G+ zTQ6x3zJM7=eVJq%U-KW_w7qP=NALd&$+o}6An*AlmR3!x)zZq#@51BN4Z5~{3Wbl- z-M)a9F>05W7L1CRBg;_LwCQ6ndN@)3G=*`cr6_#V8TI3XZ}DRd zyxk=IJhl|~7U-A6eFtx&@r4Zl8)rY%Tt6 z`Lk~L&OFxcRtvrg_tMYk8}Ny5&3_!j^8@EoF6cw_C?z~{DQ*5B07rcFwF@QCrz4+W6IQ$($Z;kOfQ=;bJpxRbLPyQJGZ=i-n{wq=T}rL zSWqdCs;bm@ZJaLB)6&v1Aaur&k)8oJ92wnUGBUb#>()Iz9nS0sm-KETJwxFPTaiI7 z>Es7Kh!P+z4Hht@Ly6Jf^+=~%Ve~r-UFwRX&smbu?fBlu_c<-U`-EN<(|gS6TX9Uk zti@+QHwv=60sodAd)(+#&8edNs427O_8%bX3gIY^Y5`MSjqM~)5GT^6B-Pb93Q5$0gztu}idyu=v)hgy_tlG9sTd#0)VT zsXv4?=ps`$0@_(VN6XV1j zF;}cbUT2{Ub3_^P+bYf#x#ChW9``3Uh-R@#c*KRs{l$WEJ6+r+CbGXf`TrzwH{zZw z(nW@tf}eZ4=(ni}#dv4cYr-{r#Q zyI)+%u9R023Rx$vLm8|RjgUB6-Yx7(WivyRi+N(cs1OT8rKl1M#UjxlR-z5ZFb0I- z7tcP4#axa{#5w4}ei0GN(2{nG+tCj0759k;#X}+>ekdLmkBA?MN5x|zU(|{TNfngq z$uPQgA9B>pS($_S_8Z!J%%H)eMwiVPws_E-xyHP)6`LxzTxeW8derFcqedH7Txp0j zBQYTi8r-|jAY<6@yG}7ijUGE_aQUU@V=U1;oMZIvV+E6SjnZ+2?yU!@Zaf(r3^e!%%VD>UjG5Yo!otSD0iwx5!>Sc}?DJP(!6HFuN zIIdu5Qnnm$nn+6|xObmZjB(>>0`lb-PM9=hYAMYs6%~U9&zm>Tm^Wz9puxk&R#thv zMdsu=)8BF}$*JUS&D{D$C2u2UQ(|ILgZ_Dk_Xh!|1(WfkA(WWI+`y200Rd2=QTG z%i7t`vhIRB3i&&*o9u_Kus?p4guDcC^Rw`H%lZbot8lJ3*0LHQ_d(hqqwpeK81guz z=W&)5fSfbXvYy15xCS7M8)pgJiI+Hk1?hi+<1ZifD;54kbGLc2z)x{BLdfk!b++|% z{tMg=L2^&DtTM>;klP@Cfaw1I0X!Lxq-=&TmpYUEJ=hOI4ry){>^)AltYaakLZ(0} zAm>06&CJXESt}OZ^hih_5SVtpm2f_8RFq-6 z@sRH<@n_53n5;?mpNz_q*#8W!KUwa^WKDAD_Gm_e?@!?R&~i5>YfM~)NrqX8Q0*DX zxs5m zoP=!GBRyw{x2&!*S>jErt4x;IZ?!jP;O^I%tfBLfnf(~Q-muym8JgUWjE8)^0j}3^ z*R5+zmiU$RE9)%&Pqy!3vczjvdn0p3?s^{2?zH4yLmq!=wKtN1+;uM9zN8)RFTwSy z)ivfET*JJ=>-$%%SFpaP|Nptk5-(d_Wx95K-<8)2FIZh=vc&V2yD?egzKU>jeI9M% z7nZv*S>qN;x-CttN+kXTxPFc=W4IZUH63&LQ@DN(uAf=%#$=5<*D~DmP1XDiT>C6{ zW3omMQIitBHVN+o*K@ef?`BNan7FS^e8Hq}dJMMxIdDCTFKxIPlQp(a{ao+DyBxl= z#50z=F{YZ3n^+jlWp;sL9xOqRIc>MA3zhwkg5 z>!EwCt}~H@yeFm_4RJ&_IuDD@3z_-8H(IH53g(Q2G?CySD7qvr`6ub_{d$4 zxpVuSNY@=!dm}@Ud*|VG?H%B{-RdfnC3aix#$-+M*eOxmb!6R*blqmT8C-I%PA{?=)1>tR1%!_o)&&Js6b z2O>9Pvc~r5cD^8q@kVgnV7VKUHEta4Za08yr{!);*0_grbKME9>n(ROZ^ zhs)h|aUzB*!F7e@ZcNs+XV{tuovgb8T$fw!#$-*he>b#EabFIu%dGZB&Q;{D&sv?^ zF9X-5mb)=o$(oKh zu4?aD*Gwt#Chz6s!FFyg^o=enjt z9`dyrT$?O+gV7iohwIu-naFpR*l4*MlQj<4;cOehwZU>Xn75#DXSmKKjT^vqf#q&Y z)<~}FUBafuasjx`x7-a@Akd_SaPZC){`0}L-f}l4Yn-s{Z8s#btq0dS%iWl)aTsn) z3hB7pwsqh-&vG|d!$D*Fbj~+*z)t0-#)de)T`e>H|ch1$|YO&mn z$r>lzZHM7(0ax5|HzsQwu4LQpcFb{b#VmJYvL>0~_I3=8J_fF+pYi zSYf#vlQj<4{p~_KI*#?L?hv>dEO%qFMh~sqA538)-&tb0Ua(53Zo)Ztxo#H0{GAyZkVb*C4p+EO&!n<)BFp>5d*| zzB+K#TJFYVjT8EjL<$@?-Bt^(8q3|7tkHd&cv~kK>!=1?0n6Q(tTFMniyoq5djMR^ zEO%qFrlYWrwu@mIxcrv8F*EyEEFtXI=%qz zW=z&N9G%&o1pn#as>XNW+>FVZju@V5m%3_jEwbE=$(oM1o^Hpr2wV#-cVn^!zvQU;~vhteXk08J4>-StI@b%(aA)xn_W?%yKs-Ym)tUhRVP--Euc3YdQ<<=zflLPY2gD z%iZ8j1!x@qcuuX;oK6E*spW1=*63We{drf;QgD@6?#5(|9lqo93yQe}TvIJ~gSSJV zaX4OdO^u_U3a%-ZyD?eg_X1~YaFhQZ7*{ylfgB~ayKSx9EMj8ldehN znrOKjlQj<4;cOGZHNkQ>CTrR=yxKwfCVOZ^moOc$7lW(F zayKSxj-0CqT!r|^k()7DV~SsPkdD+?3c*!ixf_!;rg-fLxeCCQZ@C+jHL0<8jPt?e zv)qlzn&hy*>LiUmaOGL<#$-)0mxEq!$C?K&ujOt`);OU%w!Oi;UT}FVcVn`qV}?|X z2VA+9yD?dl8lq#I3$7f?-I%O#!tQTZLXM7XIpE5++>ObaWdEI^?Em2X^%Crf(G5Fu zq~qP?k$982BQphidQ8S1GW4EgF?OfO#e2m$*t;d4-!b-LznIftr*ppIqy2P}+4`nn zTPwLIfxUp=bsY!ZQOxDzx0Xk{gd2i4&F%2|*@L&yb!^-F!1X9sjqSre_tSjQyWNh- zg#DNV9-6QX$8I~ru@}wJcq4o`-h}VPn&a>m{BZ1Z;)Fk$?LF{+0Cwp)fl-#y_r|;P z!|^tK=SLdUoeB05LtS?6r?c>#>4+OUd7`}t`s7R^9rV3e+7I$*2yLCDb7TS2KIJ6G z9HHppdn1gFkCfxP`lC2$Q+7LUe7J$_{c!FN!A{1gLxFvk1nQplcoJN9C*o|!jjf+} zznwui4~7hZoB}Z*Lm|T;!y&f+5t^Oi9SO1H|Ni`aSuDkdqpQbZFBhDnklBz+AP+#E zhP(#(Bjj^P+NqXx9AqqH5~LCmgtS5~gWLvr4Du4>_mD3j-A}Wu6P1j|nWO|#4GBTk zE4d2i5|xfSVSfhl668(D?;(GId;$3e5+Ppr?E~?uFm_lwFBif6_Yey*bv$;mh3ta7 z4+&;tUmeIk$hVM8e9K^Mu9R}%hY<(KHq)|pL+*xbfII|w9P%7w4dhkG+mQDmVaTVD zuOS%|5C_h^an7!dgzH1gMIc(+kTasBYTB%vx?sI>L|;6)4Ex_exSz zLFl|^8SIcD0n2&==P@{wkoz2*7u2HMYNYsJpQwb~7eP*5ZdqIFktawSeJVW|Gxj?|BxhJVNZqBYnqQ^_`* z`>sXaaXt^S2}1fKk?;}vI}$GP^Pj~3TcrIxNZS$0Ge_v}NcsMg_%FrYth7HX$udZT z5^}!-vH<(*mO*Hr-DQvlNHb(DWCLVGFkB}_w1hDzgu=l(vB*EKWcK`dW%H}aDoWpxGfRnJEvINq`fPGtq9VOn{` z!ZQDYlBzPIu0VnvKrRc*%FCuv%Bo7{&!l8kRN-IAe4@Ac=2t8dBLcOx!RELKg_~RA zqBhdh6bbul8Y8tUMN=@`BFATcFdUDz`eX4xG_E_x;!PBW#&v(BIUYjL#!xK9Nz^t( zLbXB3;ea~ZDoLcDBof`p_AFBtss~%0z=;Fn?4(%5Ly2ckY+-L~lOAJ{mS}BI$de?Y ztRtIT1UO5_hG1i}$~IX=U9cGu$7C)Q5Y5p@Q?m>}rJ%3~H~J${e=t%{=?t!Ij*3`o zQ%$5%w1k0zweet`F&b>4`q2hTHXh{YW3AzMV6731Mk7%%GG>mfGi3oABV(D$0fD5O z?Lawe=L;RlUlWNm1_NQ+Unm^6tqsAowlx-yhQiBjBy(dUkOW#96QN?kMkL%;Mg!sH zK^w?gwh<+f>(6#T9GpoTr=(0)e4x=*hw5z`myiu8qqZFi2}9x4fyPjsLCBCqs-R^3 zY9*&C*`}a6we6}ljYy)jl#A^l8eG*9iUv^&dL4~3wCWV&3|X}(PeT}ys3DpI(O57_ z6l-6$#Jq~>)#Vsg%0uCnwZ`0FG#qR+rg2AVi3X@636(uM%aRlm|`NdC%jWKGyW zy*C>p>xPn>Yy-$as2=}};W7aRin#^#Z5XOmkZ#J9Ddgf*uVJ8-1(ye-tTqr1qXbt3&_B`VX`Dh7Mv}5V5Nd=n7Ojm( zgF$3JXJkwu;OMx4*`yBt8iU*nl*I@%MuUO6R>fY2JVb-FEzwwLb&%bRF(YGR;VOHe zA*murv7{O{GBzwzObkcD!O6m2+2#b}wK*%fF2~E>C~{Ed@f-=pkEotsGOrAC3g&}_ zWkSwIeme@g70a?R>LZv6Gesz7gd=ey7L3DRcD$)sa%GRClBjKLsSD;bQX9$%w8SH% z%We>ww+0FoX{^Hu1)^dc8JpCKdo6OJH4=`72aXzaqJ}%q%Z@Tr<7#r@^2-KJlnMSx z)ZW_1>h7AmmfW4NxKq?Fy~D(kk+mXoc;;{eo`+|O%$!p*jZ+C2r{-kh{+X<{+DLP& z5pQiq3qXlBMAjJbh*6JrVmqRqX?*tA1{!Pq+{jIMg)8mvH&HhJ$zr12Qxw%?VXRw+ z);ekwZSp*Hk}#GU*yH&e>;f(5@*$e238t7?*&yiNt*Sj)9dqI>Z~YBJ;_H$%+fuPabi|!O-!rCnoztUf`LO8iW`&a=}nZKfjA0V> zB$qriKhU^|xuZT9#R^A`WbuYTSk4`GLOM9t2jYRo{evZi)pO_WobWqbmd2*)Lx}J)U`AQV>!uF zU5-6NCdZhJRQs1}WVzJfc4-e*+>>Zh=-^P{ah*cl7bAQC9eH^e(x=y*H@!!OtxaGLOH#35V3Nm@Fkdpo3JXwMAF!5EDvJcf=b8AG_W#g$T7(@>LRo( z3D$+;G-o9aId^r$FwHGE&2sj%SW>;Hf~HGcPEISYo?bRxqvkl&{Nt2?fo4I8qw!^Q z)95LT3Dv?8;ro)v>atJZx|(hi*zu_~Nn&26;^?U6WID8788zfQEJulyi6c4H4oVJ! z#z%7?3Y|+nCZ`>z`rEG)^zbe#CXuNIIgA(X>vGc=F-BWRjm^wV#%AaFcXIN*?fVk= zz68E6f$vM;`x5xR1imkU|4T~1NE2I!rwMx2CiO^lOU2~h=$0n3k4h6Gan6NIfRsYY zA=QwjkQIQ3o#ek9#@c$?hQOd6P>R z-6~~OcH3fGIyir##jo3K?;C7O%9&!l0}tTQb9QfyksAg6x3o zhU|gtgY1XA5BU<3J|5vA!ysNrDWnQg1BpU5L3TiPL-s)SLH0x5hkOZ1&qjF2Fo+jY z3aNtBK%$UMkR6cSkUfxnko}PNAzwn$a}XXf4B~~9LaHD&kSJsmWCvt7WDjH?WIyD6 z$d{1xT!e=VgLomOkSa(GBnsIC*#X%N*#p@J*$;Ui@+BnQbEGZl|DeB_)25lmn3?md z#~OLr-fXYo&CSir#phFvF;%$ZF)I)^Ld8q$L)vMAN~oN1ck_HiA8hpLuyV8iWJdP2gXDxK#hb|gyB>&RV+!zPQQtUSoDl@CiNV!= z+9TeiQ*^T_sdWVG8IrhO-1whjYty#z)tyf4Mh0>0f z&Loo|w8kMjt#e2gz)tZJmmIkS_Rf~?Kajr%3@HYbgy|rEJt3znajjZxJSU z+n*nH;-~c*HF^?Si`fVHqvI@y?e7!#Au)QgivN*667B~$6CZUMk}J;#P>0R864>UW z9!NrUWFNM_Rd67GlfQteds9MEUK2o#G{b>#(jR(TXJz?+u#2E$~C)=5Lqg?^5_7vC|G! z!hWabkJi&9JGFdJ7?S%S6c43u>Zml9ujpkGbr|Z5V&!}&$o_bttQ;thbnJ!LcEVFf zr{U}0&SB^21vu&ccEVqs=3rajO!4>am^5KHbP104Qv3}Xi)&t+MAP+yo$FR{EIl<% ze5&kpvV+iBD=zU?4$5Y@z`IdG#G$0Jqkc|(Mdur^5ZA+62eJ9!t=&Om3>_INRvJqr zmNC{}AkDoSu4k{AOZ9fr(p2EHdthkf0Y!EZ3h_D}8^Tyhv+(IzFPS`plqCGO9d+N{KM zl_%S$#HwJ}mH4y<3%3k@6G|x=YZbyc`R%q0ys4)j89b6ZE*VK95AhF5v=j2xO?+W3 zbi6aB{%0Sg*V_T%hixU!gr7;lsro(|fg9gR(9>8-M>?*m(X0~(`OgQYv4@T{l>anX z?eb5<6?P>sjfql!4EIGETO{r;R>9g$)i3Uph!$WPFUUt4R@WP0$<^Y&9(bpQQ`2)h z^cxcVeZ|ATbk9r1*H1hRtDc@$fc5me4cwsGC*}838I;3Qeh*h4ss2;T``@jPRK6+N z;6dq`3ruqph9#6&FR>VSD#~*KrqF)ox(qcb&b+rO?r^Mtis;}yy3?V|8C&lp#JEcLMq?;fjV*vxr%QL@K)elg^Pg?)S*u)JQH{q zChDIlJP&y1+2B;z54;Thoia%ITM7JP5FARsp7fZ*)A~yNR^Yy?(SB5U-3+`zOW!@f z%^R?mR{E!b*KHKyGllm9KYO{rJKQpV9|8LeyL@|#FM%JpN{BxzeUI*F+dG`}9}j%b zt#Tbt<#Q_Vz}-SrEB`*=W(`jU-lC;%9&ns0kB>}I1w4ilqwr$j0u3(#p042l@I_kq zdf*yOzY_Qb4L1Y-Q^PI5XBIf|oeTUyv4bxF-mdAl01q`C{Wjn~YWmB8zt!;7z-FQ2 ze<$!-4c`L%xQ2HF|4YMn1J5XO!ao4KQ^St{f1%;Wfj^z#_U(;|7@Ue7J$VaBg2R=i?6M$D~ zxCHn-4bKF=P{Z?puh8&9;OjJeCh+YV_5=S!!$II*X?P{@A2qxR_)`t90ZyCZq<=l| z@fzL?JW9jcfahuW3gG{m?u5S<_zxPs3HWOb-v<0=4c`s?nT8((7G)0KkAQn>_zB?0 zW;yz2fITxE{0rb0HT^5Vztiv=z@KUOZQ!)oPWa!GzTCkd0QXqn;E#Ym(DZ)=PN$1~ zJ~G82;CD3rH^3)p`n01kUugI!;CUK826(B4j|Gls_(b3h8a@U1Dh-bWzEi`e0Y9N( z5AZKFTnPN0h9?0Z((p9kqvt#Mn+-fz!xg|D4Oau>{XTVMinD>w)NlZ}NyE#5H)^;E z_*xCefbZ3CEAZ1Az5w_Q4POZSCk<~0{)dLI0zRg~N#FIrLp6L0@EaPw9XMaZ_X1aF z_=mt}YWOkWS`9x5+@#^>fY)gF1>lVu{w45s4ZjJDkFX`m^Bv%8HT@rfZ`JUhfcI(m zAn@^8`~3pANyGmO_zDgGH}LBk&ghBz?;1WDIJeSCPaoi@hK~b2q~Vi+3utl7N2VAG zT&3aBz?W)xJn)Sg&I9g=^_3mI82DX{e+uwaEx%>JCoXmT&jt2sxDvQf!;69YYWN)B z$r`Q&o}u9oaHWPLz(;Ag1$c>u&jVhr;f=si4POlWuXCLAUIx5g(_am|Rl_#`U#;O= zfe&fn?*#sVroSKf{sxEt5#TfE;)ah*u^0FnP5)EiWt#pMz%OX{72x8q6MjGNk0TC# z2N-Xisv}bz0KQkle*sQk<>)^Hp5Ef%L%^Ff{4H>uhBJ=FdQiiezy%ua2mGyu2LivP z;ZuNL)$l0bgBl(W{PY?pJwD*CG&}(~zShx~0>7o{X9I81^b3GXw>bV6lU~D1fgjRv z5ICUWM&P{~jsgEx!{-7YxX9t(2z;rAw*voM!&d;ms^RN^Kh*Fo!1rI`@X<2_12ud< z@HN{U{T|@8n*IskOEvr~aIfu-{}+H~(ZvoQnc_9zsHXol@YNcA7kH0`KLCDF!yf}@ zX?$M*pQY))27XG@Tfp~fxJM?&PYoXfe65BD0B_gu$-qC-Fy5&Y&6hd(84J8k!@0mu zYq${j4;r2f{0|M60S~*};VTC=HM|hm(EOhT9Mbdw;ODP&!Z!dvt>FmpYZ_h+{9hVg z5BvuWZvpy!@Gd*y1~)k4P2(_9|At0=^q3BP}4sJ+@|55 z0iSr2!}l`qE)Bl{{JiG>H^5n%{*S=@HT-Abe`)?d1zvHp!~YfVDh+=FyjH{MSy&Hf z_-NokyPWWSf#15-!6yKJuHhlTUu$?Iuuls=4*0-rPWU|FUu)O|ZqslH@aGzy1^l&! zD}V*Ax8;#3P6zI(;d6ldYPgR4<9eTtwDjI$74VqtLKMNNKd$FDl3vK)Nc!P^&egze ztwO}$O8VP@cU_D%k-|R){>p=E#C}r0kM!z#zaQ>rya`->2im;ye*l;ciSg_Q@S+(Q zL*YjJJ$fNL#&4Q}2=@gZupD{lA@NDT-L^XMj|ZlMx=eq_RE3vwey}zH{tfu6(`9%+ z@DhxVJJ^4whyyp=BE&R>w*mKk5MzeIHvqrBO#Vhj>A4q}j%*0U_av}=KfWLCNB*4f z?fC7D^_k*L;78*qUxnWTUZ>&Dfd`?#_?15M803GM{4J2;8wflI{&SUnH1GkWk8T-| zej@P1UGn}H;km%gh<}XIp9%Z`@`vhS|0{r(oGZlnsyx;J)8U0sezpOBjlw*Qai+Ky zcpTbGH{gD_zj&MSKT`Ss5%9o=1ik<%`JVwEgZXo{!fz=5!7?YKL1@Max%6;C5Z$0oQXzX@*UkaQ%8*{$mzYciWrB3_12l$?PtdSJoKHznz z&l8pZH-UFz{V-qQKLOM64TQ@3Yv7`@1>V_~`RUaM^^fv9r0@XXo?7{z3`|Ecgu)jB ze~$M2Fk{p|@HN*9fh2SJ_<^@BbIPv~xF__rO1}a44z0gl3Ve@-ZvY>olrn1Y`H{yEyqKUMv|3|x1nGoHQ;JPwtCCd~Q&vkFi5 z;VHfU0RCi|GyZg^j*J7F^sxR!;1L0*e#ZcRg7&@#eyBZrfw#=XJ;$CBPXPW6;=fYq ztAOdi&#TN=3;g14dwk0jO~B6%b;^4!@XnyqKQ01(0R8EFa8P_ZfVW~WqbZs2?Z9-* zQ2dVq*X`t=Oj!R4@EJ(|cK9Lx?*i|ggL}LRe+>MT)*rtGUUrq!-uh4>;h z`YXBw!e@&A2A-<5zoU+&khn(x3aG?M3g4&jIN+~QpR1sw@DqSvMSt`uJQp~Q@-9*M zbQRtnUmAez->duM37xRgk7obqi@?un<$DR~vHrPB@m;O_U#8M?r@~JtyjS7Hitkm0 z9{?T(X#-w__T*7~{{(*YHq@cQ#|%LK(&9e>_(cs52R=X;9hBB1Ilwz_#64S%KU2&E z-i!W+pIEqjP6r-?`W>S9mjTo94us0L8F=d*&Uk-5@Cc-*ne~}s8}O1PXhRC`0u~d~ zcs{21?*)E%I@++(KLLC*+7E(o{4W6a3^?uMEnvNU{0?~M?auu55ilKg`}%KS`}ciX zj~siP)IWg}rGGfE59y(U+S?f5M==;~0jBmb5qR%1r~S=Q;is`4=~NiSiSop~C*XT9 ze-36n=1<^j9>RRA@TI_0G5(Y)d;{n`&z>R3%qm+IxaIV&WUIHG2^vd|K zo&^37KXUH{_<|xHdgzx6;T)c?h)Z7@v&Ij2ZgszMDmp4Xg0*!utP}3i1Su6N?PJdlXQ&X!Q8}6ZFgAtDNttZ+PbDEV|izhY&`9XQfY0C;~COeBlephJ2oMqbJRosy!c12 z&)3GK1&^UdU~85R%?g4CZMn6T_Zq@E7LUaE)Lh%#3QHZfi-@*>gQIQ6j$X=2+wAey zWKtuyu4`>oyOmG{)~@u&BhBDQc54dYzS_oUP zR?t(q{y;2rZctjA@pv!0u@k2@7>>0>?cG;oiezH_jgdf|mMShie*?D6^4B&5q7)Zz z9OJih)x!HE)`z08xIZ2fjRAR9nr(BZrSk6^29wnDK`O{g&xZ*|<{77G&7hF836qM!Cm;7up}w8ax` zYt<}mT=v++0VP9Ko?Y%Mq<=;9uNeRGbIDdfHV^${w|ugZzhW=`737i4M>cXRATNdF zxsVivm|`j>SWF5}E@4kD#o);$5>GBEJ-OuB<6(CX z6L~0ZkB7A$ipk?)KVD|=vQIDj^fHf^{dn0=9{b6oRC)5)XCC{^W6nJGpU2F394e2~ zmd9az9M;ESeH_+DVZEFaZ!x)hIcr`nCvUOT60^6MnDe~Emd9z!^OAd>m*UFf6y|Yi z^EqB0ms5T|#gfmJ;Nz6|I3+$#iH}p_?@$W`wA#MK5hWM0``w5U&w{Z%2&WXi`bnTgs+hO zbGz^rN_X~O$o$+&e1#l}8;h@qW8pUAE8?(Ro<1&NAD6I?%htzb>*MC*n&80B&A1mYO*ei{eh<_1U3Lms*umUyvS)@+ zo}$D#b?VIW*`?F`UQEMsYFyP4!TJ-EJ8g?9qoDmLWpZd^(st2eGhp}**9PJ`8=Ptz zqPmOZSDRPK+(xjWa0pYma-0 zkH|m$OzdVldzze?dCkaK<~V70tXk}TEVCgI6&%GKk1WUjT3E-({eV>hI6_KRW6&-U z87#ggBBLNB${h2(pHi!>5}XABm3u;o>|hBOUe3!}PS%P@C`_rMl}R|F=Z4kw+L~77 zn+mw8S@+4Sn#M?EWlOWFBz@5&DeCnANOv&2T6dvRkS#>*;t8x6onnyX&h>(eFYIrO z)h(yeUY9jdVaOIEo1#|obcrMD5RHlI!YRTiHl&qhr1{4ddD1(sc~rKD0ulIWV=fsB zRe;)ri}wQM?m~HST2jbvxQQ~sOLSP9(o$M40l8GI!_HxeEfG~=t`fEU3LLsER@~tT z3I=T+@962lIpwHztbdc5H8ogdS5`Z=ZcLOW_BNF51)E_<*$eL&E!1{})CPsx5log1 zZC2)A6AfYQ?dNL{yVuwSK&wz$s8o}bAP1?v!#I^#_N$RY>XBr%LAg{X3X0a$qKPX@ z&nn`ri8T6y*kHU>=BH6lEHD4D)npTPmezySQbtjLx*NZ|Xy+KblFqMfEJv)59v&_!jGP6n)8Kl8FV@_DEfd-~9A*dumCYE&LQbjvBFdTGeyL z$;J+oc*&H~#Lbl3E&U^=n7me^NK~9$jy!;1o5w^0pgQBrR-z%_@;XeWiDN-6Q90DM zi=GO??yq>S70IQWH5`VB5RNz#MMb;tVhH9e+x3CjMGaCqI}NM@q%j!NJ6_pEKf#?0Jr+(V_X|oUJk^Q%+Qvvs>q{P*cT;Cst{3!Joy+g9 zT^k?{9;+RVCp%AXRbZnzpRZ!6h-iHEb2F4P3x7UAZca#T+Abx2hnW&7!~2s;lC#0L z7?IWuGK`!IW*DI zIO`Acd(a#ebpQ_UpIzZkZ9x8+n9$*yoKbnrLu)VpoYnrS;BwjtH#!ZsPOx_;M&?>>e>F7CIy`w!@8YOAPspy* vKB&tkEeCnv!Q{xTgZ)!mkO9?N%CFte#l2MO;mN&`5>KV9nmFdUmZ13G5D88s literal 92510 zcmd>ndwf*Y)%KY%gb^Y$V$`TuBaSU7*2GdJLTiYSAfir?B#4)Q5DXDX3^QC>g~T(X zoE%4E!D?G&|9->o zWbL&tYp=c5+G}6WVa24Wr5=yRaDM}g0S2*#Lch0 zp5l>bAd!Hf((_SHKRMZ;HQX=&Bs~jY%?MBGX#>uO>0UhLAB5)ueC_9^KZlgR;<+2o zy?E}!k8fW6U2hSEf{QV5iJP8@b_W+;7^9G)39oG!_KRP@Ga5)iA`|xy1DE;St9UKdIHlB5OqImv?_>p1 zf1lE!^{E)cI8}$g4|pM-U3f0R^Cq4f@H~s>H+ZhZ+k~_zM$d%58(X&(8%*L;?Kzl|F__Gk4PMM1pfbmR_H=!0bZ`d;{h+$VSZUrNd|ra z!jtgaj^{=^bMf4YXA~a(zNLV14PXtPr5Y!&bof#Y?*gpE^CLWe!1G5uci`b~DxTBu zoPwtn&oA+0{?-Dy6Hh&!(RlcqC4UX$*MK+UxdP8gc*^jE@car7f4{)9Ktk$Iz7AIb zHsJX^o;i44#^e58bpuDh$2G1-QNtKNNJR`VvLx_vu8R+l!24Q217zgG_>%9Y50t>i zDLh;7oHN{XMR>Rt^Z>&r31d?DQG#9Sm0}V5E)<$5nKi&NzV~{F2-{H1{g;R zlrdcJp@MVV=5K)E7kKsQE*=nkZVEp}@C7M+nBWa5{8+*BzwMUSf{|F#KTd}f7+@TK z1b)I1c-|5CiAFa>RD73VT#71&q5V@J(&B87Na`3P#|R?535LOOmg)1E-^P4K-0aMzGBoz&9eM`s9+ZI7ijzr(C-F+^ubI&8|`X%$S^+C zIQw7Mdc*j(#?MFowP+tLiTTH%{d92epd9fhRTnePkaWy@5MR7X`3I(d1w4Q`D%e8% zVBc&weiQMq{Xc~K3LbamkNyMtYhf((Pb|Lz<@uv!GXFWq&tC!$@j}pRKz$bqKG-Nm zd)pp>FBkm{Hf}@3U9;2jIF|H&2VNjY(tjKE<;M*p5AnobLAi}!?q8bTeBiAa^1BP| z?S!KW>hxuhPbcK*%I7!8UyzaiUC<3oflLrj`h%#iRyAKG{uJ8NTC4mz@v-150LME) z=O0G?F!)@d@$uvzza$>E|6}m876aEcf)6%6MfrRP?~ul40Q&ON@?WF%^*u>9jHf`q zsYT7(&ir~!zZ&`1W%SoP@VPz%pN9M#Fb)HfelOBp ze>x1tungs!?lBDV$@Hs`Uc5og@rl2U_&^5!BIR)h`m@g82H3e?^&{qQMSACLYMdf| zhHmd&B0uO2_058Rr9YuPBCGLe2ETQX@5T(gfc)ckqAveCO>Y|FDF1fI=kbjEgHV2R z23}72%~ES6@-qSab)A;3|58m4*}xCFy4J6Yp9p^G3SrSC_27t&pS@g~|^41cp-)7uR?O;h1Q!3XQx zOMb6X>lor6==$iVS>JxZg7xYC{}4>?2@d}a=+2LZVSeP!k8jfHjVRxiDPQV$om%^gyflBaH9tQB z|NK3r@ryOC>Q{U*o#XKcJaZtA&RJ>yG8ys;{3h*xehqwAM*TOVzTFx4X=qOuanPYY z@=)I_Omgp*`Ue}!0N2(S#!!um;^wL~H2JU4^4JbuC{NmL;1S4BaQFx4XV$~%@%$9> z3+H~HPCpE~#(0mcZCL+I(Azjk&FM-129)n!jr|>+{~svdc3s*&o;boj&H%l@Zy{ry z|JRzo_XLOE0d(h+oS!7LeD~_~-JmxH{P0J6n+|z(!#_MI>F`&me-`RLPUBO6^H+<9 z?Jq-q{uoXF_b}*h+@#hZ(jMZNAAE!~;uj!)0sPTL8ov|v5rA+)h-dn*(f&@1Ps-i~ z8%H7j>WuzV3w$K_RrTc>e+RyCPFg>sK##v59`ZK^85^!uYa7xZjHZsxC?7$df(*P4 z^4N&};LeB7)AYWr={=(5n-4mqKMnkDguaR;eXubV{-Fz)%G0^^ZV%x%itb?HPqJ-59P0I&c2M`G}mebT)&t7tH@rjZr;iarLyC>*p^D*EC+VVD_R# zHH(Znb8D`PTyOknPW{4p4YL~;)u`aYn#RUODmbThcB64)&5d&!mZ^vZi)SxD#KK7R zqMC4Zcv*ukQ@vpR!kUHkDpU2GNaMoUH`W-7!i@`R7OMO;3+GnXEDSd;Q|RoubE`=w zjWsmZ-`EgN<40sha)SZFjfmHTTr5q8m83D&F}J3{ShVcM>IL=nH$)oJ)Dd@Gy>1Hg z)humjH29}__JRfVbE@Zn8Qq$NHA}Rr zmKqdzb%w;Np|J3xIkOiEt3(u|5^Aik534rS&y6goSyT;bDmkTGMZdas_M%#$FsHU= z&JAq(BBLP^79}D}H3AE-uR+ry3&UU!wFpPm;rbhD7K*}LiAr-9h3CQ&jK%XB8s{$z z&okzcmLW*>O_BO=&0LrqlCC$ZFTT8566Y;xoF5jw&c0^oq9$u#9H5>^DsDWa;E z!4id!xe-_7^B1a^`iN$+pLNZH2+=s2?!uZSE)O?~-i+A|4KxDHn9`+2&>j%R-xS&E zIgK^5!!^~{Mdr<`X;gK>V0D)WL+>ezLl$G+oCWo6CqY5l3A!0%w6GrbHD`8se*HpY z&VriRjg%W@==O-l8nGHJ??p@ILn#n@zls$-rIEQc3u=zwYhGiGYk~6?L>ATdE8CEc zpc{Y+gib?!gU+U7(Us9}T{d8F{isya1YOZ7MkMCCWnouG*Q3{GDucMIErwH~m5eD- z5)*L>Rl1H$BE(%H4EH0F;iH(AfhseAa_hBos-9O5FKJkqn1?%o4sI8HC$l?wvLX)<|!j{Bg2g>D8!kF zDrZL)gwgdBZIE0_J*gb9rMbpDCqUy!-7tOy8-cfKiRy%T(<*U#$u332 z9E>qHRj0DR6S#3M*EK1AAkamsD8w3`Js&Kn3RNWJ2#?f1E=@0!agI6g9hz2#i9wQZ zjnZhHM-9CaBWCV4u?9ovGEtWr{KV|wf?+tyzeGgM)F)LX131JY;|hm%CWx)~%jTM| zSfN{1Y)u&^qu4ps0HchTIE^JU4x@#5r|N#@>XuHWraM-+{`%`-kVmA58HZsT7+7jB z(@<=)!nC#Po(cOD24>SjQ~f91LNVIZa4F4Km^3wI(j0>`CKh7l&=kfsW>LLn0orCP zn19`z?=GtU?s-Oa&D`1H+30fDErRYjHA56SK-tubOD?KD_q*Rqg$gsnsaP(i{~vxH zBlBNY3d=ImVNbtsW_~wCjd0d)=>3r!h<1*vZG*qmcmM(E*4wsj7 zPM0E2FS4*MNtbZ*9vP!bq$#+ebUvPpxTRI9VGNWQH?JY>;J%sH*nl~FKoi=i;iDRE)bMc)H*2^>!!`|fX}DX%7c}hD@HGwJ(C{q{yEJ@XLr24p zHSE@KzlOaU9@5ajUKW<9hF3$MhB+DrG|bg7Ps8CF=4%+#aHNK#H7w9@jD}-19Is)q zh7&cMtl?A*LmE!kaE69gYdA~8xf<4L$UQo?E3DyC4R6+PorW7Vd|$(E4TIP-WBCFN z=W5uXVH5Is{)`M*TW14CvC)!!GWKZ+PsN!l;dt!-5KhN^8A2@D?<2(i$r{2M!&pl= z4}0u{SeLIStizr);SJb3AiNQK(1Z)I_e_ZW_AP{1^tTaO*wZ4!qJ1|ZHl1D|{3-TI z2(f?l8sR$Jn<2!0*jt3_u@^!3Tf=yt@G--12)E(ffp8c0dI+DxzAxb(!{{a4i+u^g zPS_3G|2obf2;aay3eF}6on#nIgu@{h!c!m@!f!z?g!zyQ;c1Wy;Rwiu@N~$9@C?X> z5SuFN2)_fl5RQag2uDFKgl9r7gl9o6gl9u8gxG{^BgDA1i?9%KAshp_5Mnd7lkj}V zg|G;6A-n)`Ash#}5dHviA^aiaLUyWV8Fp3Fh;T(=|Hui4_ufrVxLhOfy2B}2Kp!5 z3jGs43;h$eLH~r?p?|_1&_Cf$=%271`X}sw{t0(O|Afy&|Aa3<|Aa3>|Aa3=|Aa3? z|Agr83kY9<{t5R%|AenX|AenW|Ac>m{t5rbFe6sSjwIeH zc#wDj@g~8UR6CYMB)v^4Z%seb}8}h!-#lrD)A=bU4pZ!+LgpR1)om5m3W)rth)9-;u{6On)q7c zYXzT0d_D12!RHd+NW4jKvR1p9c!S^zh_?}+B{*5F-Az0sc$j!6@nXTrdhHv;3k1KJ zco*?}!JCLX!~=pyiFXq>1Yb$Kmw5MAZ2uj^4G-`x!CQ&@h<6IUns|VCo8b2m=W%pm zqu^_Z=M!Hm_*&v4iMI;Aj(7p_Cc)PeA4|MJ@JERk6Q3pcM&jJ|PJ{%1oOp59 zO>m07_CDep1%He9THU@NpPyBb~Et?!9OP6MtqjwR8{S6;vvEJ z6YnHmEI3tH`v&m>!4DDdBAzd}fncpeJRrE2csFrFa3Aqr;@w}e{W-+3YC-!24-oee z?-V?jcz}4D;CaM(ts}8f@ZrSsiLVtrpZG}Pt%AcbL;u8^1RqI!Eb#`xM-wk5K1=Wd z;**Jo1Rp~@M7&t=vBYN(FAyAuM9@F+e8G!}*Afp1K9P6>aYOLQ#FrB9J}CX4coXq1 z!9&DX67LjzI`LNGZGz7rejo9Tf?rL1E%CL2&mz8_c&p%ZiEkv{BzP_H&BPl7UqHN# z_$vI5}dTlzn7 zV*v0j!CQ&@h<6IUns|VCo8b2m&m+E3@HNEqiLVuWE%A}WTLoW7ynuL<;OmKxCEg(T zqr{7e&k}qi@yWzPfC)!8a41LA*flEyQOL&lkLnIFBO}0l{|>Zy;_6zMJ?` z;@!Q{|A{vd?-IO|_)6lPg1<(*m3W)rZxFwa_(s9sBEFXRTEV-BuP5Fr`1`~+5^oaR zA-WOc`N=4>8DgLTZU&uD;@xb3;+q^?KjSLYoam?^= zSNP+cxa0^q4`FBoF-c4{!k!xR+S7x+maLMMo(a*mNKbr1-_H1AL)W)6d2}i-188qm zE&$E75)a}20 z01Rf-ORpR*wVt4dY~IQ;en`-N`^5p)PrUhH05OXPD-Ia8pAg!T>gln!vaHqZ>GO12 zTXPtGq6_{dKG7Ivc6E>1Wj*vh(2y;yuCliZR^^OGP6|3kT#3Z$Hroc+Pf!+S*C9{0 z{R9PINe(;4YPNS}DFW8^L)#Ns|9r@Pf;Fmk+V_x@y;W+TI`puXpU{g>3>>mzl#G&6 zeB$|si+1~O`==l65sCVr-EvX)J*c_w{_sqD6NPSPo4tqq(E-R4YxCdv;ZRDSIzpQ9 zgOQNl5`W>omeqN!KLOo)m}1BI*Yk37-yY;ya!g@cOZ3!+pY`>PlY-%C_B~WWOZ249 z)qQP>s)2_{%4PeWr~h}AWHFD+o_flsg|P7@X-|DcxXOx z5`2XJ*~c%TG_5D7r^L~SN(m%J53KsF9VoG2yUgPnPQ2{8AMiah|Lwez=XP5!azI}& z98NlDIQBP~4$}&II%2($A#+2QD<98+BoAM)qAqTeQ!Bn7iOOHu_ej`#Zi{!2=m@=e z^$zo}2Rb{gbG;{AK=&Bkv{C%y13hd58G*RtQ+M6D)&Jv^)H7#Fn$C%50g6x2T z*>;kpVq8*HBz2EVYGS~zd-x&hKF+@(=r=+AmOJf?d|a5Yw$GSZS?)ZJ81P_iH@C8- zUjJRKXzY;<-!()vd`aAthR4|0|7(*kvhN|yxH;e>Sns}YcH9ggG;JC<8IJ_8pd~UB zF=rx1IB{i>mcl)hT};~I>|}r16)?B5OALs7*YykRv6H}N2qOzS6TBPyeaQJj8FfcC zS6Ch5pfSK2$yxS2bZbRoxc=zPC~L=QJ*rEJJ%)bX*H=|l8FGFHBB~##K52fGWhT6q zGJ3eoCxR%bx`zMR^OU9bw?#U!c$s!W(WWipf;|4%VzKbFznBMH{6+6zFeKfGW3L2M z%T%AT4J#}0C2ECi;^uLXYvLV_Y6rf+pJAT^{XR?$iFH}d0NO}~AMi&{l(c~JGdKYH zf>6lW_Rqe)nODMAMv&HL6ok0DkX>>JPj3hgVlDC{#DVaWYuThl}z@murfLk)l~U-KAJeiqpxO8D)<)?BX0d6l{9Q zV}*i>F`;pRrtx%|#yenLnm3g+0;I8Oq}WN8U7R1X@prgA*%voEyZideL(Zw>Rwe}E zSQ0XjDS_1TqGRpR^gLN1X9WAku0Ry_w-YApyelA*5lI19=1R4@)LZ-bT=Sd`?p>>j$yYfPH zgPfMHk?zL4oP0N=N#Em=zL%uiks+g_z_8I(oI=o~60)5?p_To)y%u>G3%9ZG^O7M4z4(Ez72d21k4+c8#x49j3*U(h8FCW` z<8_WgBRjl7*pwmm(O+_NG|~5zJ&QaB1F+6jpT3Bo+H2^V<*-F z9mPJ52+kJdQx%HI{);`9?N8VCbEQ^{r_z38&`k(I?^6zyJ4GKO%5_LI-SyzFe>^Zn}aZw}OMLpe~g)#0oA(1#cvesG#g?75spu)OZ1>!3s7(Jz9frppDWm z{2-J#3R#gsjUORr&>+r=IIuz-M&fh!Ri=heKIHHkbmDC{E+6HSA4zg6l9TUzgF6+s zu@R|>N8xx}x8bGR;6jIP<9*0qyNwt~JNKoUBRaTAstY)uql4%c9PhT^2W&wZGQ`8* z)(-Omh)*?Lh8Q#-qhAbVT@|Py=44Iv7ip?(P@KqRDye=>A1*pV18q;pxf_HNe`l-= z0g9a6cu1Ih0r8c{=vfYO0e?L`IRRGV1SC=wBl*$#~3j`NQri44_5?$kuk zsWzdk2&0um-lr!QCP{?j(1TwivWMLqedXdbk%caiUy;bKNJI_V%JvOA1j$+@zC>J- z+yOJjw~3r%AihKx3C?$4Y$>c6V@uA+3N}Braq=X)lKod)PE* zJ%uJUGPfuBx@t+e9hhb}^j5+=+R+%RJ>gAP0s8i0qs-l=vdN^6x0Ak5kwFxvH zO1w&ktKALg(N7O_<}uUnHMcG)Z}J~$Wx}4eqg6>uQ#v=%0z!p72@_x&Cl`rj3~_u- z)FXs#jf|ZLbVJ0Sfo|pO#kAhaPOx`ieS-By-xmMswxh7#@Wr6WXOZlX zEGpA^Me6=%v&)gcC7Q>XbGa;priGmPRJTMOrsEP5$rZ_FK;u)g&UWiBY)jn4c`z*M z04zcG{NZS=m}Q4BehXv>dWo0SdN*!%qp8??LR%Ppww~)enI`a8s7469Dg?%B0(Zd+ zVspsd5Ze4V5P+pm4Gu4NMxuyw1uAy#L}*6bd>ch)*1_N|`w)`Y#CMwPReVFy%8HvG zAd#Mj#xhju&9_Pe&Ybs=Rm~;G#`+@5LA|iA(isj4;Ix(g%QhQGY0TzWPsE?RsI}>Z zVyiT0pBL*1pJy)5$qw(gOM^YT@*^LjaHVtF2U0ZF78!{6ZGVh>GtXS`t*%O0a5x|wr+yC@7zV$%|ZT1dXGQ^HH-?0Y! z8oT?t;>`vcwKLxAQ(%Y!Y$+nyX94mQI9WhyKQ2SQGeF)B2Ltxa!Q64-U|zTg9922X z!4MT)Rp~5p6IfdtYP=+0_%`p_AQB*QK+$AK> z(j-HbPCkNHUW-|5NJyT764v;ja}=VhxdD<7c9W~q`-f?B_$>~RzyoZhSO(Ldiry!q zDsme)zmJk3x}>9_<@m&4kkJrlUdSF=?)Z>>rhvTp zaV`oB4>^NVwG@adN&g2z-(-axFn{wNiHy8zXZ-PRqYI&z zib{t^KDSGKX0O*D{Wq#$;C9wE*&m$WrIDOYC6Ao`YCu&Au$J+&LXw*`)yrunl{HV+VyVi<{3$ zUN7?waPtProdaEB8Ple*p+ARA5-(x;5;yls_M@2nHTHoA0Eh z^Q3asiK~zc+D#y(PQ-RU$-~@d!cK1b8{E?jQaoRgPs~%<|H7JiY=wkLxUbCzSJ}B z84_J_fo+pyRRvu3NNgCM0RHS%q>mFEBzQjZIF{h5ZmCao1$z^j3x%ra2v?xPsB)GN zwz8pF>;emsHmq!W z)oO;aV2_BMsA9A1Rc|1Kea@q8vy*Y&Tan@0&fkxr5NeHL5(+sVQV_OekOB~c1q5t;wQ`WXiA)x@#dCXF2E}tL;Tap=MlZ|_VRQV7ZaB$U z&+^mC{(FWM?;QA>ZO#HAJ16LWcJ-o-e}#t|Y4whBEKkdzl~P;#Aj6W%&4Z;&=G)O# z4X`qLVD77uJB&e^$jAz3Cfj0CO&or??P>)!pUjy9T)6IoyoCshWCO6V#X(cL=H?R+ zo&3k<;|Vxi$IVt5ny*8f+38oYHY+!n_>6lVdTh6Ab0%4}If;FU+x#6Cy>By5eUf+c z60wnN*^E1=M$+7jt5%prqYrJyB}~ks*+pF%lXE6mlXKEaPDDwKn+}QTl22r0__rAr zjKvuU%Tt-LJT?+@NEA0-4LO|H%;)nI z>?}+2+G6sPtsUDxI@QzpN^d+=lK2grjF|dCxb={;1V_3MTf&QI`x)v3y=;)%zaZh3 zx6}Z*AqW08_6cUJ{#X}RV5ScdmdWVE%MzjHzF1V#P;gu=eUee_wrqL=;g6-aaa zLvnCgNzq<^{077|jX(3KNVnB%cJ;=W`jY?P(r)-WY#nC&Rn7#sBAK3diVt`IJbzO! zO82qE&)I4by`2SXEJ9E9N2^ei>=2w;;amoiiA~J4NlP|+a!RztA?LeDhw!a2!9*NO zMI{|Yk%q%Ems@9Ay-GGm_{dO5McW?G%mTHpH_7o4o^Ut?^*M;ASx9k^_)(@yTAEX4 zEzL<>5260=7^zfzRN6lvB|w>bZR&F`WP{~Z^?21a$nHw}ehn0>zG z$C;n`AS_>{b2^xZC=j_KS%H~a;#p*M64dp#*n~nhK^m9#GZ_wFnt3$xuut51H~Ii3 zSpL{|x#@07w_7E{U2dzL?og_eIJ?+`Y<6BX=2`7}m>C6=N?b}3O37z>KD9Qn4?1_F z2s)9~9&)nL5mjkwa!0Jq9u>J{``HW9>7rwlgQZe{qx zz+;b0v~VY0db9Op)gc-ZlE0AXkVIGVP*&U(^qW~VJdy|v1GG1>7uJf+j(psS z8Tc%L(+I}x4KpCs4%TNRM>*AO%UG{J#t8zdup>IH((%47&9s%KWbRg8WqWVKL^FVS zy{9u|Pl7Xk`&CSru%%z2dP}TL4IWF^CAv^WhnO}i>nMR+2j8oxatLEzH<0)j#$D0D32+o4XCIFvA$`TAl2Pt$ ziVdqIkjRD0v3fG*?@OO|m8SZjZFhkwyP)WB<9Cx&-E9l+p5}Ks;f{MJ*sE8`Y}Q-i zX)E;S=lAw9Z@et4Xvd-(lzt)U z9a#e=QcI=DDrEkmYU+>*7@)331i_v1p|B_CS5VGY4iov<#SXNRZ5_Wqu| z7@i=A(OYTX3eoV;4>_zg7GW#Whu)iiF=jG8mIGUAB0oJC#HAO+v}9S*A=E71)xM~) zRl3p;OxB>rEIk?;IxCtlRP=)Cr9L**^p(=wEZ z@DVTZDEH7(;!!+VyIrote{B#;Jy2>_7|Ioo`it`?HHL)0g@I%_{$xe4dC6YP{)!%G z?~{&d?(R!&f&*EJKI}U3WV35n>b_xm|1Pl`a{{$C3d zD{!uVO>`zZG4l~+Ezdy*3OSdnczDrLZ}_y1QZ7IYtS+Vo^U5n7yv1YS?%}QgTS0pf zOWr7!JV6~99$BO%vq(mEel3lLZ}!_CNZZFA>{x`vGJ3)zl_W6K4N=Z@+?ZBGmU8e4 zfM%t0pEAK2*u({HmwH1^OhqN%>G1OIl#zTH+sGO6s6_=%*GsS`m>&y`t#mwSJ$iId z*(KPsvO7w-kmdft5T&wlV{Q!(?I`8C*61h=l5|ID9)a@{P_xETHmzE%DSaM%4$_B1 z5Q{4D>cI#s*d^ZfVh`6kBmqnYVjYEo_yi!?cXK6 zSvoB!_1lXXJY%M7uh0YT)4T{RsBz8hX> zza`#?$$8xS1bM;jxcnEus*r*gjpw$i5_S1?#x!SLr|M#xSQE*2P@P7++}nW&SpSYA z16EIm$;@I}!WZ-XUy9BnwRRk@C3pOn3fhtWz<)^>D#@lJ#-E8h#irzZ!0huZ9@=#C zIfsqNAb>t2Jh-sU9Xlwu0%w?RF^?-QLsY!%uvMCaqc&@y*IMXQ%{pU!`Vc7NnuZKzQUX2E_=*-q7rZ;&`%T?#pvNlRlo6n`my zv3EP-;grZx-253%YB3bLhfNpkfu(zc(7WOM9-Sq9J|+#rS)q;McJpxLunlq4dVb}m z-yrE6Grl?f5=meEAJfm0^rruqK19+vm-uG-$u^{5Zm4*)0`9Sy%ir^rf?5p2iQ5S<<8B! z>8_YjWzyq~6BIYbcvvfPADclVvPJ2eDwd)l=g%;s4hb9hv1{RYAjQwq&(a?BdE{Qy zD9Np<^q)(50QNGRr<^#nd}y!Eq-u&I1HRqsT7F$7y*I^zQC*te6r|(c%32WVko_!{ z?vVX073xB}FoYZ8yHn@MuKtFgxZOM!c{-Yz(}SGYnrJRS7}D-H-*5gnh?SYk*el!M zA~)pY^wHiD9E$`TZSKwJVMjOb8je`2Tehp4E<7jvsdT3?vMMTQm%a#Tzrlmj@r;az zgP0*a2^!TiDk_~@Tw=*5te$@UqY_ms|8XT%x@rcP71dc;;fqiSE+vLKn83|XE32az zGgLH?e++9(&@rE5;us`$6mv5UfV;!Us$3Aa|4P6SE-uedJ(#J^#|XRQrSiWi|FjDe zF8Zbl=R2T{F7G3`4rdRVspcqFJ2+GO?1nRr5DD)4?BZD;XN%uahNDP> zb?o;#J5ka)zu$b+QL^3a2KxqXF$B;l3XsYZ5R8Y2MF`tNb-^mfyF+ZBQ+j_i zhWsJk7{D)a8(QEeU;9aAZ)c;*kd_{rC{lMKncnuWsH|fbc%@;NCACeBKBkKLGYYWvYkPj zg=cEsH5v_&-rG;VZ#+#8x4^br(W-Li3+x_Q9dVQWnpIb-)%x7)!KIi3lN1f$Q+1`P9sMsg|=uOC1*wd=-3yt51S@;hzEOXngH#>Z` zT@^H)0ZlLEG`+h53uvn{FwyJ6&oBAxXba>V3a%r zv+(`%VSj8s^b6rsIKPEdAQAO~)(CP~oHLo*&bJMKqHszS{UNgAdP%-NIz|<$a$W=f z)a)8SyNVJu4|>8w@u%@9^B{Id%fP-pd3e#@MOoHfD>R%pct1RV%jaJc#WL48{IP$* zZm2M^xzoUxZH}iHpfB_}e{2L8D#X411`?;9BF80uMsdh`nWFbcE#T$~-0tcIr7GuS z`gJG}4a8>L5VPBZ7l+R1*^wW~x6AUe2F-4I$p@8E+0FoNvfsuXL=$T&Vuv#VH=zXNx zWVEAV?jdIZHs?`}BOP7}(vjoP$K5^vOGGc*jHyyII2O6kDZ6E2yBO_FypAQ=p$u!Y z#{_9Ng zZHL)A!XMpFE9kx2A59`Kp~b^jN&X<|o#sKL-_P`eS4ZAYtU^eU9e<-g`Zlof%luL7 z-5KK-`eR>lU8;L_eX#k1KHP?fq7xq=UX@CALVopmnCWa(?h{qTwvyK>yhKCON^Ang z7KxoL%1^?=|FgR^1MVX&y0qGXQdJ!++W)*%y|MXKZ({zh5Laoapo(kuQXPFmc zbA{8gO*CM2C-$TFtn5raCw6qY5^mx})d1L$A=jkP82B3_@m&~X`y`nsPlRi#a!RE7 zK(sAJt39CYe3ZVdJ;*Fd8;bkh}hxw7~a(Af{nC4u* zMT#RgE=TSFEl8@&3oC0t%i)1@xeCjzvL6?TRJtX7<<47tpI-sMP#v1+@Ka_5-%EjNf$^qNSg=u=7zdsE_-t=4&Y{kuEut=k$ zEDyz32k!tKWXqf8`~WJ&JAIG_#!3Uo)2suYapU= z;Wch8-RoM)6OV7(^*N+J z4btwJ#7lpp$Uqq`borwnlRdm@8+lVHab(E(A7vn{3c@K=@j=X=5PuDB-=4(fRtd{Q*Z8BeJ0oRlCcRA+;x`Y=18c;o%8(;vMWPQyAp>UC>JX{ZwB#cC?1 zIZ5=4_UM>a$d}_{6D|jYbIUMg$W5Gy63&-UVB$rDY*7vxlbbjOs5JYfKas^8yTWU= z$IUAs`f1byjAUI(Gc=MDaXQC-T21931FXeV8Cr%GeiGdiKGVN#JN#^T1bl4x6fN&b zEfc?Qz<(U=-`2*&fk=#e1XGQj4&FVVwhV3h_tn;mxKrQs?-BY=efUZ&9Z(DS^jRN; z;J#U3Kyx*;A6F+JIa?>=MqP#TnKUO*`b~r*k45+RW0%t~*atT?z(-faE6drvPJ5qTZULLZ7m&Z7D0OjBaKLgVg$N?1bzHM$MCv0b}0O;K*|43{6Ic1%LFM zG?|ekvkNWFxZhs)J7^jARdbwMAbq@QM|a&}aA5!`C^pf>i!X)A=PQ&pCr% z%Re}k{}kl!ml4QFE9C1>|IJ5Tem+4v{&Ri|q4;65_qQm(mb3a?93<}vA8YN#czASZ z8v3Yn`zA5JnOC|e3wr-6Ret_|EAMg2zPWrA4jQlEzOT#12#~>mS_PYjEDOQA?8w-I zxMAYOAsR1-m-_5MX78XS$6!X9@A`gOZ(uf)4O^cG4TYSG&{eH5!NMNrV&$}ClWV7< zll+47byQrWHaXAWm3L>P%Ab7Xi1z`~=Ob5c zpgegJ+Y>HA4*Pb%muB~p1o}ba9B|+#w9`f+)Af$Bd){QCroqZBY=v{uRP)L=2uyfcIsu*RCG@4 zFFr2zn`dP~mrgw}i%wWlOFFtR$aM0rYk)72=J)cgM#=aajC3t2!P zoZs5V!?M3``(fqh*jZdzFFwom6lI08CHy^B59hTHvbC~jaPO)EL8+G;ALUh*d?o%a zPF*0b<86O(J6`DF8nFoD*2V~VOZ5f4a zjI}3ti%Pv1k>%wwyw5kmi=z{qA^+IwOzwujCwN2la&MJ$tzs{LvpET!=h848vmh z8r3N??E5nGuNmNtoxRjI6a7(H2fKZ#7d82#x1j6r-51o_W-s-Qdxkm>Up?*_noQ(( zY)Pp%8CLz3+mSxDbvZnTcSe=->bZ#Y%7T zs&uA_Zl(oprZvBF`{qv&>d598U@iA{l**WpJU?BwQ#0HIhB4oRi?l0!vNw#~SG2x_ zuFlF0I+pUD@;OMo{L=S73fodg5dU~s1e^l_pCkfqJO(d+EXJRK;j^`TDeTmV{;Ees z$k?!jAGr+(4ZPHse3N2cnv)fI#WpEe=seP{+Tk|hPnw?EUk|$8doEd65F88R84sti z1J(nYTn@BTW49RbvO}B{-HTT^2f0(WA%*+Qz5)Iica2bRj9m~fb#om~2eq`o7}?1jOBtMuW;Wu%vBF_xe$A*KobOfvzf?kuV{7YbqVD?q^{dkNJx|EMB6T zupJJP4c%S14}1Mjp}*nMiI;?9m(tj#qrKBuCI{Q!V4Nns3isdWVr6r{#K&r46|}9x z*n#AJiNsvw#(d_+6zZ7RNYcI0XRj)T?yLntU(uia(UZ^$dxK~bG5**9W`eMbLO^S2dP+TPq1LlwMwF9vtsZ*NwHlvOo^hnfGkMFB+z&j1rka8 zX;t=}^4!q}#Y9JQup1q6-rbP0@7I<6<$tsB4#69pR5`i_r-MQJf^Y5!d!!>YQKd9$ zd~}%IDc`Q}icR7?jW|}s-oiaaJ0dgfx}5kV-bY??Ih7;5fTEB7Sx6wjy*7#A>RL#deMsskBxOGWL8gZnu5i;P=4b zH*3~olOT5P-%kbi7|Qn0&VPXcBk?^Xh(%ANVwkK>ag$s01}VNm&#$_I8*`PPxj>q6x>Or;Xh4;Fx_OMN{Pf)GDv z4?V>U#Sp?L;bO;-Eeu`S_CrMbyx~Ps$$VrYz356&Evl_@V|KVPlXOgMJOZMci+$>? z5Md1OhxnuKBXi0TK$gcaD}+@T- zdYo|Xk6ptgwpFQ;T}pCqA{)4Oex>C@kzQ}Xv)ik9Il&mdW`-&3bQJKEtL{cTE zwV)?Dmg>qAZ(=FdPfwATlJBYdQ(gKfvRs0C^}zMb_hZ-n3blv92btqs`6PQ#Q9-0o zX3AItzepC`S#pJ84=(yV@^-w$TV93zGE6bxcMbD7U$P5cX&AoLh@QC^-OCfsHxFlp zZ$ihB!-aC(b;0~`1q!e`9ri@J)D)WcuP=RAV&x{`OEd>YPJW1U3V*qCAp$eCg*ext zSAc*u37e5Jy~gRP1l)?!RL_UqGpihChFP(u{OLMP`2z$%nF>g*`w#00dL)qzWd!-y zml{Qd;Sm&4cw*6ZZ1Wz&GpA}fZu&dTQnxsSbp&MuF2F`k6&hu>`4I67EdzI@z$FO; z9Yr+Oc)M^(-$z_H##H-K!yc6UX$bPeT)UcO(ToUI3HSa+PEfJu_X#9q^2B}JdiX2M zO|PZgmLQ#z0+|5^I0FuZoCmO~5uv~*`ik0hJR!+=hqjYwJ;`!5S(XgzVLZ6s2Um(J?5qyS0T~)xPc3-~7ZzyncVfQ>It7A4Tr1v> zp34H7VB`;$RD)!>5o`5S6t-n7AqIjOR(W$UAA1C6*eA%KGhoRw^B_FiTI%eecge}- zL5!Vm0<(J3ZwRPqvw3h}B#9Nj`J)_9&$H|nJdG(KOagzZFUfnXI`$lL9r5bcCnlvdrS`Wt|HFWg3zJJ-B3c1k z!OfSRaIV_c;RhVnY3a-2{hFOc%Tp2)hhNx+nDD@&<-W)}a>XI}hPDUn?QAOigqJ$F zOnvNE(jU;Za<)=#mLtU_8Edqkq>?{Oz9Z|6io$&v{o{lCWcU(p!QZju&l^4qf0hj8 zTDuBwF!JUGCUsa7o(uDde4FsP@d9Fq*pM*fQADzztG>Ab^aHR<>pzBnqAg-aAeu%b~I*s!4haeW6VL?AA_ z_lpg!o;9K=&P#@07A}TcR#Ov9<#FrBx%YlaPCifhia)7z{z(~6lB;=+D`U5uWTSgY z{zY$4;Km{sT)YvOZaZ2M)wcvUBFtU7BWZc4eo^7{Dt1z}eFcC2 z9_Z_VuS0zTWt=SXaJENhCwoHvXdS{C_o~10VmsB{R*Tnq<(;rlRUNjP(EplI4Tomb z!>G$}?7dJ$<-(BkPEYhpRP2)H zsa2m+Ee!rxs3cK;#}vik zrwF5LQLq2DGaziMH}Ne1H)khOVV1~T?(9nCG{1y+ldoZYeMMoLbor^lRG;ho2{v2y zhA%b`W-pn*!}9mlL_x+68H~(-4+x*BLs{W`9rA>a*P-mNzL&QrJOD4H;RGmkKUwwf z(e7+u?Da$$RbyRt1v<~wa^=QZEez);#!5CtR#hH1A3za&C_pg=>N8Pg z@>Wco`!oC?nM%IFN*+pAG9dZ0x-5RkW~zLj$vF!Zp>@AuW<`?8!p9O{WnvNP$02Sy z|CcaSg6!IQkVhD&5jTPxlV_*2hkm0;&s{Q_zS4 z{{G#a5ML+|(cV(_ z%L(#K8j7BOr0HA#o&KOS{n7sm`tYBHeW??iGf)S)cEoB_}I6a-<bn;aS%rMZ=g}>{7gEDh0D;tAhpXiwLQ4Bt>?L#EosLuREMz}aP=j8Dvk+- zkJMe=c=4kXq9xY)%H`m5{^OJLdad$W8KzlxN z_+y+8H-Fgo6`V^XC=L51!f?TP7?Ouuk$`net~EO73|I38=+S@c%~A>DVmJWtu_wzZV6hG0$R*&f?l|Do`ZCEN@R63|HH_} zD#LkWwb+2DFmhD#52CE_daPva+Tc-NS+&6f9R@CEhWTAlnb$w8lr9?%70!JMOI!<^ zMU$=0_4(l&>`U{_f8(IAoQy`sT3-~s#GCVQP8HUUuSw&i9w% zt%5<#vw|zg7Kf@&N}3PyBJA?Nsw=8CUbMh*;dpl_^YR5dR336xE1Myn+W*7=g7F6? z@8$orAOq3yb_uQ&t|VYElSX`6%U zDxL3Z6Q!ee+^^PhHzxCa(u%@QGPWp=13|n@hAuoBUAUmqnGG8DW#Y|t;O@$Vc(EM* z6-|+kBI6)iPOu}R?8>o4uPh$XQ;N}iAZ$2%8g`)m(wJTJ@{+8L9=TFtJ*WM>-eY2~ zUEP*^@4x!%=xu1B-k`A;<`#Vw9)^9LN@tm}oWgzB_!({U3%L_qQrz*#Zco!sN?p$ZPuG z0483^HO_4yp4@Q6e#2`q@GGNfu5}=JGW3D%j!Qzkqu+CvP{ED<(~Ay-Pvs#^5PufE zy$!|#Q$vP3nrL$Sb_ z>n?B>%Ry^Eec#3Z?C>&YAxaeP@o$?R^xHBiUbE(-o+JE~T_NSBB&l#PD`a~A z3K7k{aA%DwS=4d!Dq+S4X56$UH_d<7B9N0k*aTlI)7{#?ZIG+sS0Hl8ZnBnLiWI(` zgM0B=mCicQlK*fPsFC~(e?7^>f7j34Tl?up4u3|c>XiGM{MxL1_(AS#X6lRnNCft! zYJ_N}OM8>W;E(eS$gawna)-#y+8(dNeD05O z%8Q!f^9NKo5mi~cQBd4&EGa!GTq7G>RFdz%S6wC4 zAF^@Jzx$0h4>i$c>GL)94ok}*xb#tcr6F>^62dGJPm^Z){C zy><}UhqeqV!TScD=UTGR&G+LCEhM`G<9ZB#rzXp^Jz|8yMIo%j-T4r|Z+#}U$i2MA z+eL{O)&Ifs{n(z!%PfFT3dw2*{zc4T14Ihj;FJb<-FWBVO1vg#wLj$t-NH8Oz&|%2 z$zH{gxuY}(k-Ya6^w4N<%??|AUH=|92$NKdJGS=`E880LNO~*RJh;ps3qrAKuNhuM z#sM`WO?Imr3P}f(8%}eLt(<(w2MTG=RfT&hGp^`OTmeDgAQ_9Dn?Q(eP*^lK4IyIh) zCTGMjI)9M9kBQwux>{)VRT>;F9sX77=UwMJB?juRXK#{BzsF9kbiDrO!T-WNP-ez? zFy8FzX)lfp@7dv_IIvF!&N_Rri{y+4TRaD5w-(i*Nb_D_KJ?9ZOvm8+imD>(Iq)+b zpInED<|M9&p#M*WQ3_N4r$Tc>Lb5zf;QGgm`Bm?aA&ZGvVB%=j-ZYu>`%peki-+6t|M3)p zmi&JO*O-(xuAE>IET8DU8n);DUj-W>MW}-PLF_Ms{(av-KM4ByN6`Q3R!yI~l{|_( z6lH&?o>7j^oQIB}@6biydotrl{BFMXV&fZBu*59;?x;Xqc=S?YJ|%!4%jWNd8m=HuuFNka!aq(tb0V9GU_?pMmDq$N7J@ z{GpoGY%0APZ<6n?+4*hTL^-7#s$A1198ON-&jW1vRU|LV*FzQuOPAIjFFWH)AtbQP z9E~s-!8|m+q(-aoZv&oJr-X-bN5dfS?qrRtDxC>C@%`rAh=w@WM$6WEh17cJ$)xp+X78I@Ho! z?dPIFw)Uj!bO_)ZaXB{P_Zw*YQ2d%C-DAgSmhmrY(Rjf9FTT=K%By|?IM;h;oxo6QkNCA1t5BWoH%3)w}CAR>4Pjn`-LQe|u4Igz= zdl#MexNvkgpVxod{eQ?)R`GixDiTay(f(+XJoeC`E`$WW*nqO)Mn)w@dklN!?Mq}w zw9{*k#-m~)R_h(Dex9NDn2Y6jKk&dsP>c4|GkPK4a*ffT|3&Wsmpq4Xc-DVFZS4bl zPlA*Im*d_ZJ>25!0a}8oG-txR@-sto@pQv(a?w_@0Krn(G~rdsp@JgcI=if@g5Ohl;K$heFCu@bC#Os=tn6JJxYqVQ4?9#o+lOa z-7K`KW$mpOq4IG7l!5H?qI`JU47#B_fxv*v(xD5pB_dbgW%SAeRgP}@f$sz5z!>yZ zav=(uN>SwgA6q_(-|wtl51ZmcTePZdG`+TpK3JF0UX-WP{lqJwrOe64Td z1}K6rU5@*5c!dE|-zNvwlb@nMd?AfCc$j0atgt-|vV2TiQ3hQI;4NH!uWfBFOo)S* zw!d;diinou!-z6?8NT_thq^fKE&cHVWWID%ky;_Pji;|)52Ef4yn)w{q_)9$gvU*( zJ?lK#6OjH7kx6b_+$7P!j)NxHkgiwxQHzrUZhy064)~`W$En1t5CsX3@*xLcG32cR2o=#6>>q=U4ia2czJu1s)^Q;!Kh(m21S|Mws9O5y#oq^ zLk3*(G*v9^$?~bJ_U%;5ZEO3`UGlqS@s_s#1xmrD=pV;E=ImDVIW(p1{ES0SArEL? zgAdF@K`4h<%r9>ry-C&_UMcyKOh!$xciX_$l-7zqa*I4!x*3w0K_9XHjf#%Z8K01$ zRsM+(x5-Q1A}{U$o}aO0FWxo8%|Q8LJQpK2_)vvyAB-21s4UUxcuI@TgcquUL!#~I zP3R?fyuG~r0dyZvF`%&36Hsj1+x=wD!EM7}D7+Y!`Q2Fmqw@2f)c@pSC7<;!tnpm+NpVVAb0R1dhY zDer?9@z5V9bCW=43gL61*x1&$4jsesu}3&;ON)ozn0r3O$Zo%**Si((J5w(ma4G#x z1I!BxMnh!1x-FYViH)<`D*ICF*{tk~x7;(L17uZkJ9`BTDkW#X9z{c3x|P|scGN|$ ziOm=h*3wJYba8YtssCs3=#-dL5W*T^z@^2cKs_nI8-Xz6vSs+nsQq)O;)ZtMEXo-* zj`BYI>kMsj@<#Kbgp2yNo`C(Wsd;8nhaA#&4#vjUq#@%u>xW*1*33H+DOI$yh#a3u zYD31d_PJ7M6qXlA5BCsGq&|SYP_~g{%inXAmZ$!YV#4Yt;I-2pQMyRQeqbAfVXrs4?@cT$mbQTsfOGZt>*xI%c&(gL*58gXq<5YMn+e5&r znp$VXAJdTfT3!XP`g)~)7}O`NrxM>!ED6aLz;|S6*|((aeEKaU`q~%!ZJ{F2EYY!1 z6229KCg=eh3mH@%HmAj#=CMAAb}Hm?e`-CKiX}0#_ThQ-L;a2tm31~Q*0$rm3?2?1 zx{tnR!u=2$k$Ryyyu1x$@BZrYc-gydKMmz;WbWqeUWrO(@RRWG|+fRHpxcWc;$e1-rHlc zc*tr2mkhrp(Rc0O_MvECwD_mD4&>s$70>kUr>1s2DdJYZ9}();boTXAQuWXd%1 z?twz8Shf4gg{WV&Tr}<5&`e0{tNc0;z1D-r)Oa)JN=PhUJCL?Wc@`qF91x^p#D*U# z;`@2DY{wfg)L53czkzya%Yz8YIh;qB_t1Pv;2tUPm?IE-51X{02`^telTuhtjUI0q zf4_wq=u*@p*58Ao>V^XbNx4LQa3>TUn2dR08y`zsKXj_>m1fE|1gxtK9r?ro+KCIYhtIj^_ zIW{f5Z@>NnG6oJhZt(FZoOsg7r<^+Ew4uX{;Uh+l8a-z0xbew$v+;z}PoJocNql5x zW#@S4$aN0yCBLbM1xm=GPbhnW9Dx+(8aqL;EQ+uA!|AYajPwsU_-?CY~ z=Vz4l8<@U)1$bjX^$qw}b=>h|CzwT|^qA@M77Q9JYV#2&kEH@`>C#h#I8mH@62g`) z&6=1w37)+1zEyFbUYLvWFp-ySI26fX<)T2g7*Y)BCaU;h+Upyo(6IY2VL@U}9X-$rK zt+}Dd=EA_M>K(=XnD7DDA{JVC>0CEB2gyFMTMvoi^UTB zsKYw6;Rwcn0A#V3w^+`0TrJK*5B7i%jP8&0}WcG;VL*_3q7LG5wxZ;vajmyW5 z8QV5ytZ~gYL!=n-31P@-{Ra#&MvT07m@#JT_#vm2UU>n=5>4PNqyGS7$Z7t%dPLq{ z-mh};l3_?qPA9&q{sVgTHfUxshV&mW25Ag4@{In41!tIjjbTQ{z_IbECcnTije@@B zsL^r)Dmc+J5{~2Zh9?xu0jGxV{+!rG8Uvv$}gU=Xm~|MWu-B)qGDl1DgG)-OG}4T_Cp$_rDbJhMulPYFE2Of4~dlH z78gzkBmfd(!w}1A0<8dI3;EoJrRLbxzj11Tv(Tbp8$JFHUsQ-UGj1;an};)^R)JDUG{S zxh{4o-<_vfRs*OKBtX9(YFR%9-3_w!(Afuk3g}J95Za3d8V^bX{TVv18G*eWL4MFhpiRn8Sf>bZ6X?BBmi5+X%la8;H|P=2 z4v^Cr|L^)}+@mqCFVBMX|J%Fn)s=yMtA9wE0tkbv3ysTu2wzYRS(5a$J%KG)=MKWbCOT~Cm*@d>TKh#&)utwRyZ`1 zkH?IDI{r_@Y)!Lc7UtL-K9k>Z9_7!~!ieid8M{vxt=ziHrHjw3?sDnkAJ$~7lK)}- z!^-FXfu)-@%rVQSnbWj=zgLzcTUnd9i1mK4|FNZ%poI%v5& zlR3#TY&^Y#=7Z36z;bscbL_Y#*4>WZ&36F0+AViyGDnY9tZAE}`K3%dbp6$GcP4X8 zT&qagSsh~Q>5z1~_>1N4Oy(rYC!&%B?SFx;4=s0RGAA*1M>IRG??dSNz;bscb4*-? zNey%3u{vs`kPo2ieaqdM%yHt)OVTwzju)`+edzkLpTp(s8Z!p7owpj`MeQ>A32n>%I!{F78*@|H;=8*`b}C)5RaH?sDnk z9jm)sI<9Kzx|aTbSC=l{wz|uui~q5@%cYCoTb;S3UGUuEq>JBK-R078_h6ZL%cB3^ z)uoF!EypcSKu-A4`O?L2t?qK^;x|@zxpeV{)zPiM-LEs5L+7J&Z(#g--RkIMYzjX* zJtXxybnU}kx9)N2;@8%%t(E+reBZ^Ti(gqCoh%uJ>t$TkrR9EwGQMVYbW#I_>$-IR z>JEBegRWm%-Q&)}HOwz~eg6yV7g*oZ|8MWo#a^qsT=%Z;yYpJ%Rja#Px_HHMcP4Y( zR}pTZub@r*)N*$wbKGLdu(RW<5{Z8bT|cqhoynZeb@`HX{RFyRw%nb`9Cuw+xaXV9 zc^SH1vfQ1?96iRGr1&)n_$BCi5%>AsoXH#$_q9o%KOvr;g6)41y7pM^&SZ`)sh{gy z^wvW3|&96+?~msuH#E?1LyNc(Dj1l?o8%%)Ya%xLXvs`x}LY( zoynYzx@5@O4jP|_uIDUwXELWVU3&OB*83cE?Y7*V$s9dSqQ5CAXS<>6S94EG$FQ93B2D+ZM+?~lBHw{5egTsFsx}LJ!oyig@4ux=#BcU#I=h`tFXd(;l-P z>!$0pT~>EF=bG*pEO%!zr=u)6*L9Y=Gnr#cc747SXoQ@i16t2%&UHh+st}88fXEMjh$<|KFW=mWNU2WKX!_Aq@k&qhtU`uN7s#AY9i@$agpWjOy)Scj^w)tx;9(x4)Yc` z?i#-5lE=-^b)n_%Oy)>kH@U=3PUS-Ay1;UGSb>0(9K*pkC+WWcy3V)Uoyi<0Zb#oO z3EIwwuJbH+XEMjpustEB6K?y?gRXNecZW3`IJTs7zO@sb=R(&e%iWpGkveYcB)*dZ zNvDez%iWpGkN=z6e2Y==j_wb0dQxjU0NiSjynC`orCbTwG+ z&SZ`rTlYVlq=}@{MZM+jOy=nEJM%xndh4O9&T@Aqb2^LPF}x1C{Fb}JGc<5I#z_o$ zG+tIebk$n!4o~I4NsQ@^cCo%%=&G^Yoyi<0_G9rJIAOZ42D;W*?#^V6E^Xp#okXmo zHPBUUxjU0NCcbvjV|4DXhOR2h-I>hkEbbE>QmBG1pXKgM=5(g3W4I5x&bHj0$()XH zI)*&Sc|04s&a&K{$()WcI}14rx>j56&SXw!G4Y%#$zrRaYnA2hOy+dd^>mUBTVfS- zt+d>o$sAjhkOvCdXa<>$^mRRo2WKL(gUg)4}33M&C z+?~lBJjw46%U%Cs=&H2boyi>ccy6JU&{bi%JCiw1tREjCe-+SGZn-;?IgYL)`O2ZI z%yM@obB?6J;g>N6n z=2-3yZ>59NRqRCG9O#;DxjU0NQvPLE3nl8B4P7OcyEB=SDBl$-fv#DWyEB>7Rcwd% z6Xbgqbj`Hf9llfm$C1Z-YF(CeCUniP+?~lBU6<{D#Z~7F=qk3{oyi`mF8mT zDze-iz77G$(eX3a+&KIq=$dZ1JCiw%?9Y#&YdUmIv)rA@97k8@zP+5vH0YXYxjU0N zj)q?xAzxFWYl`LWOy)Scj^vvHU1wPC&SXwU4ZrLpe`i3KX?5Zxr<0f+(=ef{&~kSs zb6nzdqP-Bh3M_YLGUw=Z6+ln`%>g|1x7-I>fu)a9Uk9kk{`m&bB#Ay&mYw zvD}@>oX#~Qb8?_7+j4g%bCP3pjXO15Dc6l_uWbVvO$DSV3u!jtNCs~NyDYEfhaTfM&natl9d$3>3>G0Ee zveHNU=_G2)NWwN(>YfVidHk*GMCcvEy1e|=@>rL6L-D1#9bZ4^;A?ap+x`IvJ;s$| zOW5auniPH8?YK1f`^E9_xNjtO+ZlH;&;U(-PjTo?M2WJ{lxP@zlV%nlTdoO zb&{?l9bvS|J5j%*Bt3qA#L@B5>iDj5l;!{}?F{7~i1Q#2{YD*jZ^k}L0(DP&JPEG5 zlX14w#@0`~-_8)6PXi4F4FegV;h+(qksw=sl;)@OM}z46U;3{Ns15vh0`@Hdy$-ta zbo?IEM9W$Ong@Cf^fKsK(4(MxK(~Uf1ziq04rC$D=b%HNKY@M+dJXh4Xgc_(fu4bG zqQ?|H3*MukdqCR}MpO)cHO`cek?@}k8UX48N&$U^@PB|d!hbAu25?>gx)?-p?6^;5 zNxT>5J3z&tQ$e3+Vm}yA3^WpCO|q;PK|4Vf^!-jz9e88m_dsv<6xx!|vK|1{fX0C~ zgLZ&cf`)-MfNla+fKC7fKv#q2g8G3nYl4Bg#(Gg5u4%{`Ra`l9ZdR?oP6fjLz2;b! zG2gNdVyoK^aVEMR{)bDkM@_jTKh9s5!LExSy9668D%y;5ND+n20__9grW?~|@PD9) z!pZ;sGT39eq+@XY5}1g>52$l?t!2IKM}2|XKy`{Jd<6VE>agFAqJ20&t%$uRu?LVxUYAg`Wbts2R2d)q+-n$`x(I`7mfj5cL5% z0rX7(`vZY)1Z@FL2kkuvZ4mT4=tIe~w?5C6bOO$Q04~SbCgL9rk^Irf z9j(l_N#8gRHa=g{qwvoLO$42buo#H=M?-c0f$Y)f`!?ynae-z160{F_IU0KYKaf2d zecvYiZP>-lK@ZcaeXKWqk@d2znp%4(LtLuRyPYM)?D^VpJ@EL7_3=uN6yt z3ybG1T3E7ZDS73oWYH|;TU@rZa%KrQGv}7gV-I+7|ID(5kXu6RvPHA!%~2ZSU~Wli zIl}0)q+|uj&6|yXP{HR}CFStqgM43QNyXB6l_lgYD_=6NY*BG3yycZ;3(F}MHccyD zT1vhpmGc%aDPBT3LZA+3l$Dj16faT?2Q5aFMU=C7oYA=@E8t&VRyj+Zd=*Q}Sl`k` z$ONZbQpUL~qdd$kEn8gTD=)4rA=PEbumdP$aY<>(Ov+hh@uE4Dt+Gn|D_%tEZGDT% zmWWZ+H8uWFR5S)cv8bpCHa7L!!5o@v^pHsgCo&qibLbN zFBpn8B5G4(Bq>PLGz1%K{8EPlYHhDnB4rYk=s~uy%voa{wABinI5N&oj#WC8c@|<1 zi?L4%MuM?$jbF%lEzN6!O=5J!99?U!2?m?|)qymG2BOs)4SzTs3{Ny-0f_o*qW)S# zOf;mwF;H&^BN#RkWR;$17#6RN`qLDaxv>$I+4f80RyWxgC26d)0lHmvtSM?k@MN{w z0f{JF9jK3|81XkD!?s`q84A?fsKLL{_BICMGDyr9FTXSgCCClQ7N?xc5My-24%7lP zLyhHYJ`W7r?hfU0v_hk`~B z^%$xSNBm*RM9n%QxZWSGYYJ{qYN+wpameNi%VsSt#jsM^7>I2&7Wl&ff0Hqj%O49@ zQ%4e0qQQ0kz%;>SqyMr7$Vb@}=%OrW1nZ1wgWniCIx<$JX4q#k+-hu;mN_9J3}gEA z>1jB{0_y_74FLlUC1i}Q9Zq4KKaw_(e_4MNh`KWj)SJKFA11HU)(j(Fe}*wqX3c;R zV`vqIp&An!ZDSq&QBvq3L!`0&MO~ABqY8xBH@~7*zZU2vqnb*G>nZJm`!T&ugPyX&B&0fAUd;TjTjvnktV|a znpil}xZcmH8{p(s zqFEA58ntv$@xl_!DVPrymk2o<`9x#H2n3@>#2>Y*&2EmeDvY`yW<_c}nbGEu)Rj3J zqhFw=DOT&xYN9rjRUL~4iI>?RG_eMX6>O@-2?kLqj*d*ljTbr38u2h=gjhYgMw20P zb(G59=pIg?aa~he+@j{7u1BVgG$1+>-mD2}#smV!gse2&>>8=%#jyz#@tVM4>ghDQ zq~nvF%Rq9nnrnig79-jcLJNQy8-g2*XwaxbJFx>%l{7y4YO0%ReB6jlh$3{Hm}2)9 z6@MD``dfuvW{tD4v-4CjTo_}R2s-x9SiK8yH z;cx(n(A7+`xxNKL$hmu7|-4-INSi^x_)CX_QqhbRdFs{i3S zg@zZ5@YNV->I0Zt(J`<@rWP+3;G`}gDgzZ?iSR7I{lXqBd6aRDDRoi)i!li|V^xNU zq^ZTI_hSKrO2@jgdY#{pecCi?gS0I1*EU9J8jK%uI_yltOtmq za%Sn$StYYH)trW!UmP14XbY4%8lT2CkDbn#Pz?fMzp;U_x{m)meoI39<#J*gZp^0T z45lS}ttFR){yL%S7#H^ zx1%)m(^Au}N}4v+)uRyctRNOff)>@_?DnF}PQxq=9luSZvy*d_h~Ym(TXZp~unvdK8xx53c*^HilguwPuRXyHs7BwJe!R zni}LVUbwHzO=HwJZ6P&2EiDn7UF+A&@?ZadE%5)`0!E5x7?~pU=cRfcs?t)#mHkqL zALkJ0T+qc72D%Y+2WThg3D66my`a}Y?|}XUIsp0y=o`?n=_z6mXb5O5C=XNwS_E1S zItx?-S_|3$x(IYR=qk{yp!-1&gPsEY2=p@O=b+a?zXQDox(q)r`615#1oeae?>HZe z^U0uzpo<2i2ovWypi0o$pmRVMg3bl+N}R6;-3n?0z8mL9LC=6*0=)+MEoeWe9rQU! zz&^b|gFvT%CV&l06o4JF$6!rMbG?y z`=orI;tBZaor;g}LIJ&3F$FJF&`A3)$kY21^zK0_D1^36_R8of-#wsr5$L^xzIai9 z{2v+e-2?-CdOv~Q$@s>yg0~?YPfmlB2mIh#@B_Sv@Dmh)v>UV+^fu@q=qpfK7UF{@fK1SQ&`Qu+&?eAU(00&H z&~DIP(A%Jcpszq_*@zFC05U=IK`TLPL7PBZLEAw)LAybFL2rW&g1!Q!}i- z2dxDCuRi9?oM{^4<}6w|-pI|&&GZ=K7GlvFrb{1rn>!~vGh4DId7Eq3p`HFGQS$z` zMp0!!vsL3Q1_&H9{tU#K#-ntcL#V&u#8Ag5oO@uu8aYa#?$vme19^SizL4c8QcoTb zvKoTT{;c{nS>aG~){Ld|N@r!&NAQL8=lM@Z)PFtD>GlDY?fKb;4IvR|3}c%Sr!7{Aqy$^p_|^ReNOE& zy3cVmnkVC%5!M605(ZAnzx$`*e+pSEULnjVhKD4$6CPmEQ zJ*ZYwMZ)8W6H)=GggHr62kTGgLsmG?s zltm^kW24n;aE^xMxxx0~QWTF0aJvd3@*E9|%=$nq6OXPU^aM%=KJdc+CX$z)P*YT7 zHU=8;KkDCz|9H;Q2v)Eb_X$O&zrj}*u5R{2Gh=mI4EKto!Egkj^0c;w(hMT{ng~Me zXRw*I{xz|BUo~HIlQhG|KwZ%GSFc$U_OG`Q-A06wkNTkB>7!Oe{fyQJL|0&OVD~%f z!9>GB)ORVI)(u3v`oX}!^!_2qP`7~1IgI3Jok2wF3;W>O0-zzB)(Rv?>ja{wz_in) zGto2kFcC_$gh|Md{M95Jbt4+((8aTAvW6gXCzPvJ7O)(Rzl6);T0c;kKL) ze$r3tBx>PAv<9*dlA~iK$d>a$hA5j7QU}QqQKi^&)IW%7FHu4`k?rVM2eRd;yAhFn z?ZZy@90ZUYm+vWfK(+O@ln{pUw%}~b)t;6jh-@7sV*6?IB{{OIFyI5-W*d)!C>%#C zh-^Y~v@RpsqcBdakBWaC$kw+S>q#QbEb(-2(d23&L*yp6Lz8QQ43V98u;TuEG&x$w z66xijI7B-^ln#}{7?Z*@_yhoT80!2e&QuQjAX#3ZssNk!46yAdmN7O3zl!P{c9~v9 zkS@0oa=otQ=g}h6ugO#ZXCydsTT~2i^}3Wq|m<1CHj~`UZU#|M@N$9ub|rolIE4Jz^1lb(ai$P&DE_;^c!>qS zqb%hQ16RS`R6r`<*Cbyr#3zd1A9k(6oSlN9ocJdLZ`+9b6p*L#Oak7l<+l)c&lY^M zqxg$}_g^B!Ulpza&bS`-R{A#qS0g^ytbYq|(f5S-v*Oso-lXx52fk2C?-bzC8h;pY`&1|XDBuS* zJRUfp;Y{FF8qNhS(r^Lr$MH!nO-u#8PQx>RCu?{P@J22F3xVG`!^ux2@N*ho4*U~M zel@VqbmXgn8#MVk;A{;y0l%rqhk@_X@J8T%8omJdxFSdYCBT2z>T4_Tpkjx=4fyw( z{P%!g((rA-Ar0RNJa>jrN1C`FI7`Ei01wvi6TrXL(%TKZRl|FLOEmln@B|J264=o2 z8^AMXI_du&xKP9I0(&(40q|%I9|Rtx;lsfA3CMVP{t0|Q%m3HFf6#D`-a@>p;Xc4m zYPdh}EgBvSyh+2S09R_*0Jch;^v3{yq2Y4SxfCm4;<7x=>pC;mgg*K7EPz(EZ^1DvDb9|51D z;h&Ja)_(T_&(ZKc;I}mSw}5Zb?DY=toti!V47|hV9=~X%1_+H*kg)zc27!jXwzZ8V#QW{8tSR1wKZLKMMFojXweSG7ZzcymvL62mFnO zrvN{r;Tgc^Yj`ejY^_t?MZnvd9lR8HrG{4lFAX^SHNdGFzXABPki!oG4~jZ?J@A_m z2cHkzq~S||r-mJV8}POb4!#a}kA`mnKCIy#!230PAMg_zegwD(>tT7Mi6?Lm?FVXN`;KiGq_^$)EY54cR8#MeLaHEF*0(_>1KL*}$xufqh;Q6f%{x|S&4fi-! zh<{(<@Q($4OT!t!*J=1f;Eb(~{7~Q$4UYyc((pv!u^P?=K2gIa@V!?#`ig;1y4t~W zfnU-1Wx%^MybO4QhR*`7(r_(s=o&}gI^c$F4h{oP({Ky$C=G80{!oj5Iq)4Cz8ZL| zhHnJ^REvKb@Vgqm3;4Gh-U+-{!;b;)(eN|C?Hc|uaMiU={$Bz9*>w(n4ftja{}%W% z4gUc+py59Q&(-h&;9eR&4Ezr*J$knBsD{4*Hg9y&@0Eu6Si^mRCu;aO;L#dB1$d~2 z@lBFAQN!baGc=6vMMTjZPI`I3ztZqj;L9{jFT*a-@B-jH8m$K#B;NobjeQo{|7jP_VpKq z+kyArk2R#i{{-HF@*St}G5z2?dsd`MZGkAit|s zdwc|Vf3;(eA5r{=kr!Ndkp5o+8&_dYQ{{ONco#DFxzcwKc$;RwuYmW}U=C9JWBLQb zp0<5X0nXOs#{*}~hfP#|a)GyDzNl02O9(dz`ZA64<0E;Df5l2Z1Z#sLpgz~@Qj$o6KapY1b#@% z?_0pTH2l7bPtRe<-v3m%5`MyI8CY*>@&kaM(eSCjMin8qSE(k;LW8NLi@<{eoygN$>-^m{@)1W$W`gVs3IHnVfX(u;2m0dj|UE+ z@!0&4z}spCelbq!&jJ?Jcn446BEmRq`&R((NBi7`FiO7x*g${Wrf`dre~vNM>cBe| zIQ(0Pul3Idf%j|e??)*ycK zZ`bc8;J#G(I5IGwTtg(z#;U{$qIi3Tn>8|E8L3)MjWSuNY#nJ_VesPc!TFO#Xm>!vw-(#_ALZ9?#4ZH z=BJ4nO1@gfdf3TY&ZU zu@yK2>kUK6-waHL-M$_Irgv88p!La1ioX|_^8W^~7x|%s+S~7d4`Y0|3z+hA2)GLA zAFuG2Dt-fFtgDEDL$+_s4Zyn|m;1(1{E390z&&Hg5IzGq8{^STh35iiz&PcplD`~y zALb|7-qJ)p@M^99Yy=*M{L1tOi;IDG)j0KY6)+v6KvcdvfJ0~F86e{{@dWThE&fZu z*&6;O@Gdk~dp-OIU^>QtNZ%(48!#DRdeFP;28_AzQu+D;@4pasRpmJq*ggz+vJ|d@ zpW@F2-i-FMm2sL_1{^|r!4$#z8kM}vKi1*Eb9<+7ebD;+GT;@OeXap6!uUL1#lKC( z2jn*Lpu%m;7vcrNKY&gyPujPB1NA6gf^~g)6<>ozu(1NY?ntjWX4c?ie{2^+-{jG& zhtvM^H)8o?GpL+G=|v|sVxtfGXw+9v+wb7BZ|t*!w@@QdeAtZCe7>1W$|`-O*kj1& z1Dch9=Fg0?LYdk4kgYk?(^_ z9XXn9FuRiWtFRFzWBVPg{5~gZ{T8p<(u>LTHY)FG~vTp^5bi2 zI)`)Up9lZwJHVQ#^x)0WAbcSi5K<6&nkWu$nt*d88jSEMR1<1}rxxG6hGWpd$?_NF z(o6dV@vbWphOiL|C8R#PrfR8K=ZgkI9m1Nc@hiNEa)fIrrjNz>O<4rVs)Z+jcV=-? zyD!1#uMzYjt*<)LxXCZQA-s{xVH_lL8;Hch_GjcWM=I}4!RlHqr))i61NQ##)ihLx zDJ}j2-Y3i3(h}nhpC~6RKo;`V`=dU5Ege;QD5$p4(TYt7Y8rfKptPw`U1K;B^+hA1 zsal@pckVDD@01irw0(-LJA`+38-uY3Wn5;Ewv}46wA9CSjt)kfP|2udF*_gFfJg4j z!Oa_A(_^axbUqm->S9ez)J(X&^F|*2rpD&R0DW)oKLNHZ?|DoG|&Vsl>E%2XFu6qmMs%_bean z^+5Y`grtuxh_7K`3##(WQg1%}E1-Xc_%}J5e0k){p?|sbZ!-NOxk3;AW%*pz zoXfFtId8cf*UNFe9M{Wny%g6onYf-j;(8{NyeE%jJb5JJVRL!%NWZ6$CE0eKLQ2b1 zNU3<(0vRtQTv9KW)XOFH$~v;=U zrhrpt8+zHQUbgDwY>G9RThwH3U6Z+`dAVhJ^C?z7x1xNuQa;--pDmov_Q_`(=Cg(K z+5Y)#y?nNCKHEQ^YbT#=o6q*o=eC#6wVBVBFXS?!8&IPuTvQ{D>;xZSA+nIl_R z4i^PYn{t?w!^X|YW!vLK#m9+a<0PA~Y^Awu(41VhZcZ*&0ZwEEXqF9G_9kx*NB3rP zOZUo-md94k$&<xLQDd5(XQ^11~PMntlS=s^~V{!_(Y2d`k7Vuz{Q@{fg0@)5nrbr+3s3i~WVW;LT+Tu@5o3tg7 zue!FDrZDW1Mmmd%=9JExG1KS4lq{#ob7Da(Ix)4={&6x1+GI;+hqg}ZkZcfJB1Xdj z>|>{ELr_gaSPzl<)s7spv_b5d*obLe1=4Ixix-)=S{HDx8?kbr85(xtbp^Ir!|sg% ze;_CjA=Fr_C*+%TCbnpsH&f2iynf^&bDFf}M-8@gl*N#U3`c24gZ0=n1gjXi7o*Am zCrH_9^4k`X(V`oIG6`a0-$2a$KFY1OVsI7~tlvGitM?k*)f%SR_SwXfCxf>Z_rO`2i zv^&=euA{K!B38PbOM8vhOvaEchPPAHZB5rTvJTOhs4g56hOx_@w2@v@0afL=&{4%A z6-dBGyLre|r~>GU0=rT124~z|DDO^7YP1_}+$Q)24(n7}R_hkvVnP{Rd)W(D&JNa~ zHT(q|F1E1x4g_Hsxp$);okdaWSU@K+KM-{gwHhhxp1>1;*S%f#S6lxD9 zYJ);;vm$LnJDm77gd4H)_VM)yl~XqWtw^O&sU|5y4pJMk$O6Sj4#`KB)vl|O9XAxM zuSGLgmR?k(yC&G=^J7oQ7FnJqJ+pkpfc>+Yv5BT0t%eE;1L|S??V(*_=#}bx+HP57 zBT5ZI7;S1{H9bB;k~DG=v`&L-5563i)k}6G<*3SybP=QLVhO6Q#(-Gw(rMx~CmRDN zM0*n|6JS$7nMOojXGMc{E2={!Mf8;9$VMMus=~GSBPud#oZGNeRYzM~+G=?RG1|;a z)S>w%D1;gx<=kxm!)}~t)#wjFT;W8+7-jUVREMa=CXD)WjFUOz7D{c5Kjrjs3yUSs zA3lm6MIG52%IOJkL9me)z8a-ma>M18O#etzL|#czA}UR`EDtHz%_`m`s22Isl+=*4 zyh@XK;#5#?WSN={$&+d99*hrFkzKk$!*NIv;*rj{@o2L?49Z+&yM{2|s9{Ujj&di> zeq6QO{pfno>3^zd0sjWu*4#!DMrBO+_y!j}2lqMjR5+vDQz)AdsuguLO~HuPyK<;% zljmKo7xZCWm(N$Tv6^)7=nm5skP$ZkTee;a#HT9#GWEZ7cCd z$&^VM-Xmdz+G^_9(@y|@G$g%{5#E%D(N zoL{qkHq_Zmu*97Lokk`{I)5`V;8;DIhP1|n4#_zpldBP%?aiY;ns7*{&MB*h%BL+H z+3<+TD-3(8@zKVIs`ax4crn91X;dC#oGj(YEQfG&LvD7cjBHOue4j(g@Qo?X1K%X! z!6DMIS=VvyofJ@LV=CK;|4l(RW=HZi@= zxp)VqsUv54KmQoY8+q!z#oo_<12mN_x`+AOX1%W~rgnRFZCi&nJt11+HkR&n%G*?1 zX`8CoA}L$8LpRc!ymN0cQ}w9Qf3wst`D^vHO}oo7r!kR!+MBLJul5#`jYPe^8KBTJ zB#oTi7Qukr_E~Ls(ONDwY1$8K-dhp&`?1PvxU1x8R z?{qEgfdPE&EiOWT_{v7`f&2+fUt`i1(-;kv+C6F)e3dzy+A^i-r;{h|fLL`GV#vyu z)DJkmk;X>dOo48nmC!d`aF0?0MyL%c+C`h8k4kn>X?Izwx9A?Gj;Yai=y>WtO7T{X3I5!jaQy@y4-U5lUt9-?D)-eWy*4GI_s?Ci0Wx_bPx^-EBoe5mr~ zvf+;E|7E&&<9MB)!Q3cHmYDqhCsIdFb>3w7PepUCf*oudLXH;nnh}#sbOj^hsn79h zW;DG@t6xrDm%-ev+Bf}r$Mf~;p~WeFj9y6ZOV&f7@hZGH=wI|SIl7@utq`|Di}&F< zzTz8p_n_YDwM~q-(B)8}+ecthow4O$NoxP~^`ZH$p#S&TAHF{@aJANEh8kI>@J>uH zE+hT-n{2Ith75YPanOZLgR<3Y^*kDw(qkRNfbPS~5J0JeBQuU~;@&yFGQ@&}5L)W$ z^>&rO*vw{6dLXm5%-eNZk@o5e-F9Y$uX~PfWcRaAW{Xn$3#7u6tgyCZKu^c?%b8di zddyBZ=fV#Srr*@dgvOf+bFzLUwo(oV|m%uE*aIV>vneIyuIB*+-+M|24dTo6u$fkNQeCTkSwioH_ zUVK1XrpT9>UxJDK7^>B$bi;+&&1fuD!PW~=rvJ;*Lf)Yag3`NJ#P<#%0^oVsKkv;IVEOb?78#L z+m)H;dop`!>QI3jOwI+5ZPV&JONNbZo7E8dJT+YeO{v{h-#FcMPfqAO_C@3;e}vUx zFnX5j!ez&GE1Jkr;O)vlL!PU5y^GlR3o92L+sdIB)VAKpx^uCTTB!{sBfM$n0}hub zq$8ybnFxTsqehrxhv~>y`tM}fyJ1q_IxYi)z1o7Bu7{xk)9RPU2?D)C>xw(*yLqT6 zy=|0vxO&e?VJ%WjZSnGNkLN{Q3fOKx%)MrXYbnkV}O=Bs! zk+YD7vlSCh*(Z+-46H!hQ~cnN_}?Jj;gKa7p$e5Nv_EUwtoqDcA5J$@c76xt>q8IY zGdlt0;o0mew;tPD$cfIf-mY0l_MME6oll^6|I&8a0B( zzQ&B7A_E%!#PpLUjikzc59!8L15$v#6AU27|9nPS*_29Yg5_MdL!Hf z;i{F`(?&`Q?GPX+x@Ty;=OFNR@NfhxY04BV@;3}H%iC3jbap3-r+d41dACkuARNJr zJ_GU@EaUAu2}$o072LI}4yXU*?K&HUw%_zw3c7l?&hee>jMkpWpx9F1$t{_p`Z3B< zss$V4h`Ig0NPReVUGWoRp$x+uVl|jLs(z2wAe$lt$cKd<M%^7 z@9l~epve0td2hT06Mn#V_Z>K~ZmWGLb!43P#_P2x{SZVta?to07z@1-UV^;7Mto$J z`aD<&uk|VKZN1&Ie0>Wb%=Vmw@xFqoD^Esh3Q}&(893_oeS$UTVsYX&hZ%NKYIAv^ z^HD0x%qla}S(!>p`fqWoPQ{4#y@Cn7J$*P?n*BN4*!Pl|-`c3tDcHsQ)CZ0?{X?CF z!=8I?&DJT8uJrdzL|E#;7yIo4LJg}=uS2QVY+w2 z9au*!)`E5PS)aBP;i%`bnd8tjitnsP_hQs8v(|XfUn>*xWRfN6!{~DfR!-QNxvmI@ zj%%v+9o_n@bhG=J?swcCKmX2iFnU|vsi$A9JG*=!Srqyd45;tkCA}ZnfY!_rySvDj zjiS}=Px~g}ax-Wl?=mIJhZUP=jMD>;7hUvdAm-A3bEr}h%tv?dPSDif z%yeUJ{lT8jf;9UmK422Z^>oy2$U2y;eJeO97$mO@(v{#VSFhD0L{GYVS&mKc`ES}T zXe$mWw1{Q-VjLm*yt=F>w4YY&dtEoxw-Q3kpCiTI^diZ}b0yXPTa1q;A8X`qZn3;FCQm$a07K=-b0ti3ulxGj0=^`z2WcB{YYR=_~PzvptC-hym!f@4HV z_ZIVv45>a@X|v7KMzsI-g?l)l0vX$r~OG6*}_IEO}d2g zPnvWo(;q=PyA2=Oq76^LfZ6CZe5dy|ZRRJ;GnKYhJl^Ydd$5xRX4V{iT0aP>p)RRW z)!Y9^sWF8$+^qgrXsmwq2p$hA1F>jJxb=A1C*&tQaKZy8JaEDTCp>V%11CIi!UHEf zaKZy8JaEDTCp>V%1OHDv&|@9HBQxXi*m|qo-k7kW{&nG2zhhfY$hJD{XtL6>rq@Ot zJ6>%i?1&w35>_JF%$$T(QBhHi{Q2S5Py}zs4q6f0LD_`mkK0x#=1?a})W_{aA{=eC zrmw8F!qGq^8MG4E1YSh9JN#spzd4q4P#0#z zIw`3f-i!K(?MD}E4x{C_f_5O>0Tt`~k)&N|&5ip5ti(P}%}K|h(qeL4*rv4`mU84I+%YGg##fgK*p;O-Nf3O=2quP(23MyZSPZJ362mG<`!=R4Y>39J5GIo4U*``;I2-ib z(yH3+c+`%#@l~2Td`hnmdeEc(4%>})*Gvz`s*2!qVjywKvl(B;-qnEY$o$**RVqv2drEjcc zf}M$ADT!jA815I{4KCO#Q5hqdxI|+Sf-`h5YWy1U01SjKn+{*Mn%f{9!Q zFwmv`Xpn=j(Eg2^_x=QoIqq0GN`4GnRF4};nD~5D4Ra#n$n*oL}sSl3p<2a;a372#Ku@qF6 z>M=i7mKDJM-->}-&+UBC;-zLE!)86a(HvGDs}}1%nlzm~mgY)RY=a$0!jEG+ z{O$Hw4iZm=dY^Xtimt%#ri4Bajy-nVxF(eTZM~T{d-gPI+`L80##w1;}P>;VIx2@J+&R2C~x}U)H}9 zSOfkg;ST`!gMUTZ=a1NX;4fF-&%pV6qYaY(J8-_}D*ip-AAmi0)2RjM-)l%(co%3s zLcNJJ{~pXO&)?4Wuz-|DYVb8eNAw_t_EVJW;Av>T5G|Af`KwB!uUL7(`I}0YmxE8o zI|wn$TS)ihlphPu--Em5F9JV=_k1bOb}Xc~;LZLl0Pn$@u|s`VBmE-Y9}&I=Y5o-% zW0v{t;QV_kSAP;bg8XW{nSVWa5Bl!*pML`M01A&rXfXdaaK7C7JHYuvCzpQ*{3i(B zIL4Ue9|2!_rc&QQ9r7o^OU@eN&#?X(O3ei_|385>UZws+_$$Ed=}Ik=`mcju3jUz* zcUc~j=SAWCMf^zQTf)o1`E#oZ;pc(#$5_+B>A&392vw@aBj0_|4HxF|sd;>U9$%ct zm*?@-dAvD~w}aD{e4nA-7>MQNJ9&Id9=|D%e=(2WoyWhL#~;Y!-_GNYmV)rgKObX(tW9Q(p?{RX_ z7S7WuVLN!l(WDP~(HJk2Ce0^_P3C<5mjV`3d=fOQM6N)WXim0tI&lS1ykPLLi}J@? zDFY;6SlDS=pTHLr3g49^6z)^_=!9Jkx)f%gf;>6m`Co*_B$?LP#$iL(dn2uKD+h6T zQTXy85Ng7?KNzv&Di~|R!%sG4s zGAZ_3QpTq&)D#HC!U0?H(JNZ^2hn$(Hol{jKIgT1P^<^RRK|TXn(S2JSfVKwZv_UN zh-$SRJGxFaHSu^Ji*VTaz%Zf`P7u#ER0}Uj>>ym%VRv9?)w+cCSBvTl2UR=1iojjE z)$ZtYHZm7!eET6OJTwY)_!I4vYNg23!HBw@w!+iKb`^-k67n#msR>O+WAH=3T>3k~ zV{x_KA9mOnwD6g`jjfd3vfmgMls>wS}ZCkc4Dn~7M-7?Z_mnjosSl%QTo;rw~fhEILsnF!1{TV zPMO+H0OkA+W=01d?U-ol^vB_BwjPPa+7S&*2K-GW~g+(|@vo?%)3 zSt82+Lh|_^C}_t)!4Cy_rYwL_XAwV&^9``@GNnEta-JC}pD6OF#A!;+qa6Ac60xrH zY)Hwo?_K05_cC!d?irM${nrKGrF@Q39};VEZbcs3`xvlrF6<+R9pi|2^DIGr zIk0dZ&g>$u7hFv_4)P)4>xuC9CdwD!FE&Mfo8Z4tj&{CIj&>g;zf!4($kEPk$*;os zn23wldqnh;do=ZOZ!W|=c?=QpP$lxI`Z2yqSphw+h}2Wck|# zzeG7E$Nj{s@z?0YB}%M7PBQ2tqPlHg1d<*|4YGQ+#{*)Okm-1jI;3bi70oK z@J8mN{h;t`$ygx@Rt zo5FtuWIL}4?;~G!%_$IJ$CE^p`nXsL4f|bC+Rd}984*TYdd?Dql@oa}2_H7cpLGo)n$p19{Nrzw? zkmWunyqCBJexMwB4+$O>EWtgN>v%a4`Ihi0!fnAeVBuQ)-43xysauJ2u}(<-!-9JR z_X!>ld|j{v_hhy+nuz{?N^lFX@EZJw1i-{<=6i9iD zi1E3Oi1p}R=EL6alEa?w3;(U)A;I?q3-FwRgNo-SU0&zK>bul09TuOu; zGbl&=&LKy=1>{q4ZVzwAF4!x$Tafz*%l$;~S-}?sUljbc;C{hZ z1+#(&1rG_nC3r;es30FYvpw!l#1cV|V3}aK;7Gwyf_gtgJ)iJ#f)fQN30^FCso-?M R8o@b&^9Ab!>jjqz{tq+^r%nI> literal 20532 zcmeHPeRN#KbssH~F|wQ$Ac%8t%A;B14=iD04A|I;{2^lp*wZS?An0_O5--6IBgsbAu9yINvLu8Qh&dh z`=r&Y-JUk5|Md8s^Y%BtnLBsx+_^Jv=4n@Z8=F>@m6a*?DpTjFai-MJLQ`_BhFQw5 zs$5Zxx!0-(RtCz0v5Pk-)mc`2cXV_#ceuL2-}gC`7it0>g_Qx{oiB}!Dm8;2`AgoN zr_}vwzEb@^^!GgusRNn}IeQMUD0ljzJEjyaVP5X-^?Mf}iL0fvwzDk8ly2exQ^C%; z$ZK%(a))bN1B&JMQ`NxocXUI!!&Qd{9=eisj#jW>nohBaAW|cDd>eK%IX7qF9@%$;)oD3bV*qLgwMcuXjA%DLg6~~PjR-gk9LxCFj zEy76=SY$>S%f31IRyGF$m?nj#iYTJG_eb;sfP#nEri} zwwT_BkKEzuhbFdHRk(!h6)O9m&YrLRn)hKyYg*7*TtSTAv|zJt)C@)0Q+YikRJC7M zIKnZ+)o?#Q4^UlhsQiB7p^>TkOE36Kmm5|2YRH*(w6t#b>@6PgDN}FxxCLj>Kbf&L zp;Hzv^scLBHRIQ!Ubv^Bmqq@NL zS{of>t{*ODis5x|KT>xzkg!n@rV_ziaJOo25%zw{-gS_-o;|aXm~gSZd?_;L*F{ATGbGJ=C&)@fbK=3}$TBo$It3g0W99 zZ-X|?+Rtb!EM?OehqBY~{Pg?9#@3=ArWG!Oo8anSY6Teg^4TYigjncW_695{T%t!b zRI~g6E3ebe1v&Vy?{8=}hs59a3S$CEpL2V2^QKsi)*N|zbTq#tpa+`nyo;I3kcqbQ zhjh!cUl?dB&%cm6Ir_cRmtS!Rf%LuNl-$X(2cYt0h(E?B0X*9>VMsfz*4O}*z4`A{ zW)G1h@C~e&M1fzUY?2lO7XxhrXQ|9<-@I6DTb0<#ahUVn|7Wzu#tM5CI&%f$_ z@~PI=VC;`s`CjN2dk|4H$;q7Aobd?LMum(~g;mwL-5A9F9k2_{#dHKM*M(e483@A} z(h^f1`!brwjO(9_O2h9nh|W~Hhovde`=_WfycQ%sJurNbvjL-zJT?4p?~RT!UbHiA zkd|eV~?@s z+i#&IjQlm!FqInmpZ53N2m1<}0^Fi~7Rli^@o^@5j$xjRO{B}ALKcwWNidZ0t7q6G z6u_9VSs5H2fIe;8X1$<1MN4|LCDp^XqVM})KYAk6(-yT&toe0PeCRBleK)@&p*}w zdUjdynSU$k@R!j0u@39K=A&<+`f!DIsdJ@yYWbf$R#2x_2FtAMlvQ_snacW(XJ5{} zKeM;u$(fKp@_Wov!THC7F{aS1>9UDI3MJe+A+tIdW9bHhJ|Uih`D z&{j3_`P|_q{TRr-=lJ^;qe||*Zh!wN31pgGHlI)2kJFr{ zz_jM#K^QsQ#PY_6a;Inc@A??hqk;a1;HOh70@co>+-)^JXK!Hxy0}~xzAGUE4K2fU zkTui1A9H*f8Rb3^z;5E6p&1O7{PMu?Db7~3$bDjQ5tgvw7m-uki}Qp@Eu4hZ^UV7@ z+H=Inix>V^j|6$l`Chb2XqiySEGf{s4f>CGThp72+a72)9 z<(o)v*(Q_neqC#$nW3LIwTg9bLif<_FJc|HSjBxG=j& zUAu)wT?tXh4fHB4%BNEmm-sF==|%+vutWdX;l0Q-tMcnu%4qvhV6bF4<&x{pkJbME z2Uv^~EObwU8E))U>($__^_&aQa%=HsE*)4lBT#}2vj|;>OlX^4*j+X95^`fv^kR6S zu{PFCG7AL#;c2EC!#%xZxQm+jByX$b3R27Bx9E2(1{Zc zJ$Sl&*N)t2Y|!~orzN+s!jI4ZD&N8MGf0nD9vhwSAiKB@iqSbe&%I;Vy!@UU| z*s^WMq1@?;?4MCH-fXG;#oK5*&T)Te=8GAK)$AS*7LfS{`l zn8wAQn)IFQ_A!(0WBMr4ZChg&>@ySSVPq7WO;6ByXAM5?n4&wL9psF~3HaW9OZ7wC zd4u+qh7{JS;xxk+pLFE(jy|M^Hyu>TY^6hDhxGkE_S`evt#z)qjMD}?XI9$82;3}xzJ>F-q=^FMD5=3YKoXskll3k~Hah9L<-BZ-$oD)u9` z#}zw&C@<^%_(QHL7~?Xb2T%*4`pa$wxBvt4J1s4-H<2|qMKFSuM=Q7;N3KFRYOBo) zR#g9HjkH(%#H%`hv^me=c?W&Pheyl^DMV#4|C$!q#|A%X(vz8gt4UWfZ6jS&99LSi z`$@Du5B-&wT*k!uf?jW1J9px(>yT^yqcpFu{oSYKRaa3 z&K~&%?Zq{yKhOSA7fB^M;yceSaIWN>2hMrmoCnT%;G74}dElG}&UxUR2hMrmoCnT% z;G74}dEozr2L`RPcVk&Po!Vt}*?TfpGTa;A8Fp;TiP=`Soy^u*){@4gW2ft_jGeF} zPR7b)+gXyaYHMrjQNB99GnT;Z*ikECJCMy-;k0eVQVw-OBAB)_nRs%iwPZ`Z6;DPI z*{GeFYb{w1IG;|ZrWp0uoO)^@j@D7xdeV0xKJ|BM5yREK79$L_ZFq_Pmr#MlGlPne%bq;|n~ z?R&J`lGfm|6^+*NWi4>7_S{%6!_jEmiKmj`1iXlDcZbQWaC<82pf1cv^)RPyVlRRT zJB%*a97Zc_MeRtu8!CFkiL6~`txAU@ti(Pf5>_(hSnakIjzsJpj3}Jyc7Mr+Wy|Xs zCN#b~)oWWF=~TDrTe1fhbj0mMl!XkQ_N?PjX}gWyS#if>Q>ld>`(pO)u*b&#TN6C( zXPh)+RowG`+q8DW29BJBJ4UAmA&im4xMD0~7_wclcqC@U!gQvcw9MN)OpU08tgx9h zc3tH%5(Hm1fr+7`!PTh;7K5s%#Dq%HzK!V$8(wT2+^wPTC1K zzA8(HPwDkR4|+1(ZM*UAnrULRBMxn)(Vs|#8C=VBoQ+q`#8SJGj3IQyNx>|}(nM9% zk_cxUh+w4bULB-Ob{GNKo(LzqSQ}F!Jr;76t1vBlv8<%9Xr(b15SMe|V61TAJ!8|c z%eH$kCwuKQ=0-H$(E+C<9mG33UOB-8IC{)O94Cv58~WEBj>O_g3`OOd4&B)pjmqEy zL&b%mSDP?F7iKcbw0q2GJFzev5VI>y%QG_wiH@)yR6T(&Fok?IRN#Z#% z(J#6iT(GyGGDb4X<$z{!iN+!XXXs$^4AaDDnh;u=nD{bI(!EBn%$(5LCc0CaMYN0G zF<9`hYcP!auR`TNH;$bDLHzu-aihD+5tfk9-95v=GR70|e|l^Z%;h?OfvyZEqZ}kU z-ilrXqJzWh8Bg;#$&3esd1f&J_`u;uyt^dcCj^pK3eP9Zpm*D0 zJPyWUOUB8Ku1ars)K#j*Q}M?}1cwFuA-*#I818T2z6k7bAR z2mxZed%PmKJnL81z75a}t*|b@oS7CiVLsgx{ z`mLP26RW`Z2@21uf~$dEO1kk}XPtNw57&5F8pT*|KCmQhxn zFrG?DZ1yq^q~XOh_Mj=&8o!$2$?R_HX7hyVospSnr&23ZI)KOaUF-^$w=`BXZhQ5E zZNd!s=(ujCDk~eY^TQBk^~PXV8k;aoQQ6m>NkLtu9`iF5SrM%7J27y(xLmJWzrn0i zSd1q&TEZ%SOKp{vbLPyk8nG_GWaF$eSypGncH5CG#$jf6xXYf&2<5Ipuj8(-;0lbJ zkzg*NUDv9b)~su6RdrWqBI$UKles#vI~orsQai^Isni&2DxDanB7LL&)T z2RTb-MCws#UE}826jj@1M7FDLU9VnUbydBZkrBm~r4ypsHM|ZzNjTkX$Jh+LwY59} zsTonV7Eeq)e-$(?W&@ULQg8q_Qgu?z-tDxfcEd&MR;{@yG$XUPvJy&M54AKdTe-He zZhR4dmUK88PbCoaYW_lX{XBJ@TEA+QYHe(4T(O~XrCPrZGI4IYsdxT7bv?daIbSVY zs5l9&XbSPgjl7;WS13LC&oc9sp4n$Byt%PuU1L)V+FjP#sMa>F+bEq_yMAS(GTWYz z_C;;&9y^mvsfFq~d^O;v6)P57vu;|qakjOfZb98O)~vO7E~ODt5`gpP)y*?Swbyk= zyJjm@m)XItNZvbxcLWPFU5oXEKJSQzpY8YtOG+a1F|IzTxv# z9o%8p!JyiVgXmNEn|L?uc1ot%f1A7<68uX&zNVqC27E5M)TH@|Zyf3CGJIYjX~OL* zl$td~DLxWdAKwj8{Jj%8t@(LCUi+YHma7EZVkWK`xJ&hYb)9L8`dHW1cQw+~>*^c2 z5_0(RgL_$$xB*Bz@I?ZBQLe3|0Za0)1(sy1htTdmRAjsKf!l5a($seiZeA7w;ODM# za@;Hr3c7L?3!tk+jxxMMf&hJ8q<@#-G9yFAudq|zy(kBjW0zZYA#z-wu&@zwyT_!) zbx^*<95s!O!WUsa0Jsh}`^({>PfGPo!}B7{Lb=>_UG8FOe!2S9sGCom_=`dE(iX@o zO2xq^jg1Yz=355NxU-PvuLsEK=M&&}32y@O+asOAJAiD44}Qw$fcwC27ybu8cA9a( z@-G4#z`r2;LEs7SuSok(fDa-tTz$`h^NU2grTnMhyyzd%5d&vM+fXD|35`tJ5W4_=M1SdE+I_kimLB;m!DkzZSY&L&A1z5 zO!-H^Phv7ZgF57g$r0=vU-IX`Ph1H7K=K!X^DZ{=Mb58Zoh;$M1mEw+_j{%O+bjov z9Z2~}=*JNB|E`qRfb%<8wZgApIsCl@oc=4l&QmbF-_j&l;9{za`|B{D)&BGt`@NaqeBOd;^hd=A# zKlJbyJp5lhymXDH|6li%pZ4%_#GQLleu{@zd${G{wH{vY;p;p+;^Cbhp7HQIJ^a%i z{s$iZXC6M};YU3DSr0$v;V*jlOCJ6U4}aIgCovG^qJJ;+@XNqYV7_g^e7p!V%<`09 z<>A+Pc%z30J$$Q&t8SjE>LQ98#85nmty$K*YF1*_7DM4E} zqp6JT;I&9dZyu8=?#WG>Zy!VE%=e!&D5m)KXo5s(hL&j0cJw%D1yDS+@>Purr*|?B zkbz-wC$uYrKV~TWeI=uCM#o1F>~hehIQtak4ixVU6Er5vv@SLd8$TtP-1%<2uw)5fX4SB2QFlS(iW_}(!A2X$j;Rc}W7t3&m~qpAykzQB=Wr`_G- z>|rU=_=}08@S-Ww9nN$yml{~8gAsLmY=t+JT`H1DW#mj63c;3SDwIe?^a~Od&GuZQ zoeOicZ9Nc3rPZ!*++pj`#~1fH=;Ax$8CckkfpP82IvJS;nNV*$6X&0raNr4{haqPV z3?PYTLi+81{zH_WG%SYY=+T(88G?}h^MuMK@fN5H@s)D)DJ&F-hQp)jNY5UX z$wa~&SF`|UgfKI326Ajs!E7hB6YsCRCHjpFl_0p485O>@qGIV*N7^=)Q||=B^f>F& zy-u0hP6Tpc2NR?l$7T~HJ>fKbP9qYjR2PDR$w)X6am_;?@Ykyd4&Y7%?$Fg?J;MVR z*Et_H=L>*kSby}{2G}Tko!}P1DDirwl0=-hGC&_H@jSr%Pf0%a%*_8RagkE|5ia!~ z5abU*$sZTw9;)nvO8q_1w^*r{h&L*|r={FUkt@gAOF90MhjRSa29yghA9Aw=uNT}% z#5&J4o8=+l5#cF82k67bi9h|I{yQbVAoxYe|C(_AG@g2&7yK8&VW4lRQf~-`#I=ojQ3j``CCuN7P@*eJ-~lv9p-D(Vjlj|-*+_XyrYM1Q|RtjGIapbs1Azn1)$ z$QzV;jkpZ^dg5{%*U*M<1)gs}+B}mSavvqG#JfP|<8Be$&U^$*J8>1xM$AWhw-M3) zKIY$~6!!w;pCjV_g5WoRzST+{B(714&v=&eSx$S3#E&WU8zS_)FIWLx)Hg+t&uZVz zN`07!gW3${V;tv@uf^G#9Ceopt`J6ONcmd@`=$JAL>vV8?^js= znBdFI--Nv)IqIE~{L67}Wd2MbgdY?B zitslDr<`xvxl}M9I8ShiV3-JfNuY1DQoX|arTpu{A7MG{IVAig!SnHghJLvmNIi=L zS1}**>&emIHp$Nlevaj+_XXkK6#l62X9eF7T!5Dp)ZZYu7RdTt!m~uQbDLmJ@;@W| zfZ#VI{}I6_1fQ4kcZ5&I@r>=&2=WgZSuzd1S@e) zr@l3USt8o|d!TOz_WC$i)Ba0=zK~KMA>M*@gBVt7G4Up))&VKEO|VOFmtddZX9d45 zc$kRxo)Nqd=X&bDOmHT#9rG4Q{fo#WO06Jb{B6NIS&n|(M}*u1g5M!R|3TqLgg-0% zT_E**2oHSLnVSFdA@mn!LJHFAo!plpEs1}zgQsZ=MM03;X{Il1-~!&1HtD7|55M-!Ji185PVs%DEOM- zNx?S-PYb>)$d}=?t6XrhV3lCCV2$83!RdmQU_fw|;9S9Zg4YV(Ah<+OKWEYYO5v*o Ln*@V`8wCFYs}fe;i08G;ZY!Q@;5RuR0p z>fsoTQ)k<^gSOVUc5o=gV%K3h4?R}=?1nevS@A;nR zYj#e~9)El7wbx#IJUcg*&#lPF$Pm^~hR70*ONjiG44K5QQQ|WqB#gO{fUzi&yCd_~ zjItSRo$J~5DeyC`G5IvM;>Go%{@M=#kIcA!Aa@7AZO(Q`8 z?e|WBy_>AUXm|X(lVjjdzWTjkijgeD-{;}(PEJxG-N^}-O#s%^+aqx6_ZH!=aWBPx z`AvoS7=^UY8hFguMX5{PU87$TyyauSjsE4!$11k(qS(Qa$nCKZ*=~6&B*gZkA@X6Q zO#>wb*nigF&0?zBXNgl22j3mN*Vsjg_50sGimd-qU1vT<1u`EaxBl2c`nxM1 zK0P17*GRHA^Fn_&(V3Mv_)(U0afp#5u-ykU_1(KunZ{$pg^!F~l<1%L8~4)Nc#P0w z5!>euKGr@f^pU}N8oM~RB(b7>*5qS}y`hrlB_}19f;Yc02qj@&2A^r0c@?TBapXRo zv)0xaj}YsP?8K2{!M2|Vg-CV=Z+{r?i$_5&WaVTcM(g0<<86f$SLX^d?xkwWVCuFr zt@|j}X+}HIi@0YT%od_#f3WQjgMoi9RYvgfd(JEcSn`0*>4I$+<{?a_xb2Ki?Swlz$?{WdaD@dQfAs89WNYjqU+}2qwtx`9XHL)9e=!wG=U6&( zur;69Ad9AjW#t5)xo6>jqgXl@GQrrHsns7-&2zEA^-{DCiI9H7ra4s!>2O>nZda_Q z9)jrzerhO(<~E=zsR-uAk65_2S4F4+>w$=rHD(6ba9Csp+ulWEF}RhO%^x8nj*{4$ zA4?p{W&35zV;1{JQd2)e0v8U0JOsbQp-`W+mtUsRruP62bTMnqYd-;9q#I-no2|Zd zEx%l0r&fV1sXz>2l!lU>T7GwFE@W7w7BWYi`iIb>;Hhcwj@e8yHy&vSFzwxe2nn*Q zcov)Xp{kBs!qo3UaGlLbv)P47@|ylWnA?!$1KrpUw9WX`P0ZeWMWigMMc9OXQakLK zrBV;@$@@K2>G6w|jnpx_-pp%{G-UYTeE)H#U5{IR`!GAlx7p-Sn}N< zP9*CPwXv>HRSjJ{}e6Ek97{IKj*9=_6<^^ z5>=6q)d$hH0=PDH;i$a2FS8Feo73MsjI&y*{rCzcqWpYzHkf3gDfXbFdWs~i9LeEF&qm{s3 zjVQg#w(x}cT#bB=U$#mqlTw0H&jV3O33qxZj?w&4ur2k0X)gBb{_I*xeZ<7%+l>uP z#Y{bnbdC^sIp=K!l5^WRe&3$bX$ALMd`Q(It|My$B_~V!0k9i_BTc_l1y%aNh~*m@ zdRcDj}^2xIl+HPqzVX`Cq~BKXX0 zm(m#D6#Dat&XpIRhj3jEv2Q7dza=+nd@qoYdW7!eN6;j_NBZO^XCfcGrXShebB-J_ zfAB`t(5}R>h26>b5rLBHyWWNE#$j?q+}?I34UyXmCIlbPEO|HBrUSU53@Nt$&A69A zALV}NqvB5egC|fC=6er+@UoF4YTD=Kj!OLT-O<0$?>_=e*|x#8nE4pFdp7*TG?(jp zmMpI6SqUqoIaMhh{i7Z+a8!~O+o@0MDAVSSp`x1 z2MCPHb|OaboEJ?+vx04JFw@upn={h)&aVnfaeDU7;_H;fhNxs z&Btio*CU9oy`gRzL7J)esf$rm@&sJbSHe@&VB!iylH>y?_)HGXp{RVaw6VnBGkbpc zcLuZ)?xOj$&J(ic=Tb#TuOChv%LumBBP*kw>N~kliiVc$h)7M(0^nS>+_6&=nhN;iZX8t@AEO0|)l8cmhuOqAE6G47<6P7LV+ z`P9cQUWgd(6&zEG6fuDFXUXLaLh@SnLvqZaXHw6o{2Q{Q)X1zWLW#X$wkj4(Nt*HN zkL%VB5E5q+jl+v(`LnRX(BgtI$ie5@Xr&S_PcgTLi9Osc6VY{t=@o-zbml?g=Cg zX1GbAN!buIDHJcpcE~RJd!Dg9%H3G{&h)#j#}7+cYAi1&;dIN(W=d)d zyihd(C4s<@Rg?Ow)VWf&JxW(K>y5d|!w~tfR%Xo4Pwvy|!MDY>w4%PC-inQE{5{{; z6o9Op32uYY*;p6N($3+KAsiC_GukLiv3{7EM*QLQ-)b9d8YNp$PwAgS4{r@6P3@aT zCBy-Xhj+0!WNFKdN?DBys2ZoMYOGaamAVGpfx}{#B?`4>tE|A~ORT7r&2vswJ}#^B zhqVnh7p=r*YrZV)W$whO7S75hKE1!Merb@IT0K*Dq5!MHSV$FmA|JNyLxVRRTILds4pjde*S0t23lbL5%s1epvPw1??3Xq{pgV0TL%WyV2VbOt9@X{52A^m=9kLCI9%qZuX-F<_!Jf1Ffz`&sJ*;=Oy29 z`DPk-=M&NaZIF?`y16i>-Gp9#L{BX^g5s~G-dh#kFgOAy&;vU_bV4tzf-+_ zcamR$*Y5`M`>fY*9r>N+^{XYn)4hH($nOlV-&pcH)9ZHz`4xKo29V#mUcY}p=kJVo z{eBNWm&iztA&N-dL$OD|ntFn4!^!qTvJEBM{bUQ1?W<&?jk?sGWE)AgTgY}6*=``) zFtWA4X5|F=LnD(5;4(|h#6)T+qPQq1hSM#!N_>^pLjqx_L8uF=Le5i(2PNwmoc=|xu4Qu;BZ z|0DGzCP<$sV>?$P6NptYBcoL29ZPSwl%Nb?1{k6=mj0sBgPGuD2{@?@L5zkBb0QOv zdJlOkUOOBjqFpWGEyTfmMRry+iUtCwc1;1mI}1lx3dL1Hw?W7xLyJwLxcETH2R9U` zY)5UIcHSx4(#o=u_pX26NEAVhqVIpI5bt2yH!!;`>Ars4=+s-W9dKwiVcX8tH z*0x9pVK@F2zIBUJBS1$-&o`iwcjl8UjRfubk;K6x?VEGcU$eO^^VW~*qelN#*|~D{ zkfmo)w~9b2k7RTD0m}=S!Pg!}q<)C0H#*M=ZKZJEyKh zdDU>>$oZM=8*RCeospg&F#-|8pgznf*lv`K!Kms?qb#H+0)Vur(=)rv#-Q|qA|o0H zW|aj>64X@%Z~htn_Dn{E#F32n1WQ144wYSPmA+^9U(d7vS`hy5mEX z^GL?lN*Z(}zX}%y6$miy=DxC^!_G^h^*n}-NEN6{_LRnXQV>!_NKGuMB^2&Xvx@ac zh{B#5kqQfqQi{1^j8Q7pw`tk@ZXzaYqKaLO*y!M5dRNcGlpSL+zx6%F=y417eg*mI`4NfJ*(6S{BX|FCiySOG!psQV zZmbO`>Zj;ESEF!qCNmW#^rIq}14Y$CHOxIJ;*7>t2G28Far@WFn)JL|gq_@-hk#AsQ@ zwA&44t5I2Sero_MZ|kO*b@}aqQ{lS(A-MF)e4{cSBAn>VjG3)+j|n`~D+5L)r=g|W z_JVB6z@0lX<8tZUM#1gKRoj6jkFXG%20TMA=A-ct3NE_okBHT&fmh&WjIOh0MM5z% zE~7a+k~A@9rfr$R0EsDqcoAwxLRj%Zp1~a89c^oTQ;ER}g~;KZ;?T`fF7>hyBo)F8 z&K!uJMPovt_iej7KR9_C3pg< z+(q;PdH0DQ4 zL~9QuiO1>Rbu6UATJ3=Y?#$W)W$kSVN*8=4mRa1HJP`bPXVuU>`hIJT#WUlO?V5%O zeDF(-#50YDoWdFT4;xzo?Uk7&ds>!C2}tb8)Q_|mM6+h(mmF=c%G^|>AD%ON2TqN7 z5(XZg8Vj`kS$}@?{tT=k;mI`u4`TyMih~{tK{U{2sB3MWWX?tKtVo#XxHS`hF)u?g zQTa?+rtH9FgRxq8&Bdpz7ULBI3jQ)4wIVTPAct z964t2@gZbq{nuWVp|j_X(hNnJR!}JByV5IZ*oXhe59_ zlv0u)cqgRHOg{-l)?oxQ{vp$*cVMk9=B`$2?nUd2n14y(3+zC$F+H!c4wv&U54?(Y zHz`&*3xkp(kys4P7T6K%`8nE8VlNi(QgS70f}n)iF!RkCT9OuJc| zkD1^Uqu?gIihHxzB|ZhWD;X=p)QFlo6p8-4KJDh7vyi9kAE_BDK4M|wUowyMH+r=q zZ)XX0G$+^Hck8*vsY+zHjxZikm9!LXhvwW^k3|i*+1emGE7Sw6nP_uJpei%0 zDTYv{c~SvRozwx(iUL$F2ApaM9RQbMp_O!-xykNg(tqd1T zfs2i@fYO{;7lEUzlv)tiSy>>t4_nsVWi&X3ejP)wc8&$xwalf@E=>(4{jBQAvz88# zxVGnAB(dZWhZ$uLm47qV%>I4h1Jef^1vi80oKi>-kVzbGhwAosg8X7z;1fMyT#Ydv&0jdLNP4<5<>^S65jkwPplyB{N|Z zF?AIbTvw(@zsb?kzm@6Jzp`=Ce{`%W6zJ*K9N$;^v05ahU$Lq4Se-RLTGMw|VZzLy zb=OV7_Q3dUn~#Zj_O{KY&<0{4sg_ZRAztlJ)n0iFzIp|ILwaLCZzP>SWt3ZSs-bjO zNHMP%#X%J;?XvaZP%!kseE_jWT(2Sy`F*F3w&l>%6=LDPxbq3>6=>;ycD0-88dYrt zOL>n-t^v|M(*$TOlxGY&a?dV|Ta9&Ti!pgTdP9E4j=*`h1}2u39KHTuke9Amn9g(s zCX;3hNjh0xp$~^Boku(&O?RbR)t#wG|E;Syv?WQ!`9g=!E@Oczw5N}9AJ*)p?}>ee zSo&ltpUPz^O|WSrlD)?ZF-wRj)AvyA)>*~;A` z8Py|5?av5YolsVCqDdfe+8@R8HaN`jx;Y*(9Bbv+g9Oj}+t1_0bY71SL12p9;>m7W z&2Zv)q|qnbqgNFvw2VPNSOalvaHDGldC;+b@?fvPI4dXin!lUI?S~>5|F!e1%J^Ai z3LI)b&=UGV+xHg1R|)*K>EpG(xg=Z`59(Zd-QHeo*CMKy#vX`j>0Q(e9@7ugc6$iD zzK2m(UreQx*=A}pk%>C3swVxJa>~|SNAQNj{!vdtw~=;f{voCHEzbtX)o3@*rFWd{!D z{L)X>vEZTwRXyOWe0~+$E8>3m3F4yl*ykADr~U(9^nm4Valn3m2>nRD@n~cMf+TOd zScCC;GI-YzarYD5+I9Mo+R^XEXt%0>`APzhadTvAopzbE^A4{5`5H^jjz+^FR5lyH4u5*8{^u-?R#nY z4#U(dpGEN!ht|8xCXY7tWFev6ElXx)13<8Ktkb9;p@EEDPW@m_Y_U23$WbvF%G8f0 z_FjeA`Tpg6c3}IVF=(pBZ4qj*?rf9$uqQ{SGX&l|nhv(DrI`Y%{n5x=icQi8u8#pW zMgc|11AJ&B*!Ca-ix1mtZGj(QqJqlNYQR(MT;&_p`H7?1+J(l9$RGiIKKw=knh|L) z`xsNs);wcIAuSZ9h_LG;`Q4SAeRm~O1AgTjv}BBT{KpmTiz4Ce$Ees?HVbXNjW$8U zYXy?RBF_kM(SvPsFe?l`joG@1@+6MTM6swZ5y9m3Xt${SP&+q}Con4)AN})z_@mH~ zBS~^DwmFJypVPiZ6)!}2!$5o2n>seyTD4|AAdX~-*52L&X;cbYZaXrdbr?1Xufq70 zw(fS6i)kBzZQnwE)3yZLNL;5iYS&N+DJAV{fvkKS724f10Eas0AV(2AoouWRYZg;( zSWeUi;!pE{#L-Nx(5NaZd7&j!e?gBGZNDmF;;?G!4a`@Vn5rUub7A@qR2$n@a9H;Y zW-oRY7Qt_&^eZbOm6mECNso=v2xT(xD&` zq?Z+@3S|=HUtnGvkUQ6pMi!yklwS0xC8%C?Fbdg~Pa76YzD^Ubo*kjK1A14mZ3l=9 zKK(-C!(q4X*Um_Mc!kzlu_GHK3<^HIKXG)J298`2KLq~W(;0lcvr2z&=pJqSw&*Zz zSd312zUCUcwl`tC$C*&W4jp2g#q+4~KN!mp>$|+rvzmeGxK#Bs$hV=Uo1vAJmP6KabE?Wi>gx&_-!vyIq$HU97R9a5G zn0O3j0U~=T@m zGNmZXmVhPz&<6z)2iqP+$Z!*S1kHi_!b}JWczh>96Iivy2}C+3f%=1Z-Mv|Lk=Vnc z_2}#Iry1G_n~>`fiFT}1sr#}z*fzUQ6v=iFlcHl1CrCaJQ5M@dq@Ss_?Ig`k#j>OY z+kT5OIf&^F){T+@I}=BS zX=f&mT%mooaz|jY>}uI_06gPqw4>zB5T1-;zg7AAIG#eS2JG z@#7Bacd6y#Y^)4SRiZXzPu5X`d}DQL)Li^z9h`ex2GLmgy> z6rj5)OzsP|EkkacohvLg8-C!GwYSgh$H+EH3y_eS{{pZZV@ICCrpn+zWP2b;L$nuY z6UFhPjcP{(da*j#_BF(gsTpu81~|?zwTeN!Q)4t3K7OmTWAa1j?9_6w4AY-*bqo!D z6dIFzz#k{|Ghw)R7oW_FQYa0L1`OkSsRp#)Zf(Bab-q+N(9@*nX&bttmedHLN{!vs zHmL(av;eT}#tf`IR$_O%AT6AfXE+;F8N7)~IP1 zYiQt*?nwO<$$4F;!LtV<6=o^AS7^pXk#M)5LAxFcBAtpgoDK5x)PP7t4f?TB!U z(qp;D!#`ep+N$(y5YWgMUGwwW5R5BMjaApEPghZBUN6%3r$0bBK0!M9#eh4V+&A)M zhaEIiD}hvkFVx0x+9HS6F9Lc6HvDt-id-XyAdcj;o`D%khpm1og8nY;ppah6H7`>2 zB~jG+PVr%+O}`F!C>9w~5lE-q@aZSLp-arxTop4ny_?pYynBb3j$whKlcB zqdHJ$xyC@Fxa4oaw!I{2IYy}Dukkag6P*Fli=o<{$G}TtdZHVG5yA%Au^jC>%55@m z3!Dv848{;a9(4wFz%9T*vP2k5g-rD2Y9WP)|2RV%o%lF2PP=hZ2T4VUM1?q$rZ}!s zZKWTw{5YBu-)>X~u!S8=#zEN!Wf6?d(D|-~BXu4AbS$oGpAm>bUqP*s)-^(j zJ-IX_OGOcEo%0PDr+LPH2f&X4?E)hRVI6B^(mY|)6eFV~Q_E&M_8Rl;GsM=Xf=nYx z4n83@E6F+5){OwH7C=BcMS-)4#_ky<|pi{Qaj%L8af3@*$^2sL}9cs4#op6M^2r6g|d&j7RK> zK=xt&@Fx+?(MC|AtVIMmoUf8|bR05+da4J{sH$=JJpM9H29%Tq;`{i7M|zKJFU8mZinBoDU_V}uR4$A@5;$l=gdrgn;4UGvI3TBa@b)PO6X z{X%pMzJWfP07Wktn*&pMO+zb|@AywqCbf#WIKWGoSPp~=C?gf17uelr`gSUO@5a@g z&1!aQpu2)qZ~9dyhtpIJ30DreX{?px$I?&8`J#gBm+mo=?qHIRvDnDLwkkL!dNBD< zhz)Pg+2PvlD(BtlyGW1FT-MD_sJ_G6XPBYQ0~1HGHch}fj5dIj+Ox#7&H0(}_hj!? zQjr_~i!7v7!q@xfIk*j`r5{(igr=lZASKh>nOh?+9y!cHKWYTqXM9A>=d{F!Iogoo z1Bnl_uxi6!^YHL`R%DVfp}m6R3?_wg3gR5givJEg{1BgZ{tDu4)CJIF^YvE|5Nx}T zd?*7N?DqOUWg4L@s$XfubBGvD{$tayVi#>sobJMLMBo zYu6)AWp4c0^c$Fe)v28?9JIsnIqiIf4}1I;X}2*o2Q&SBltsZU0$f>cyes_{`BhpJ z?gt|S+IR;qm>f+M${D0g6il85uNp}wuZMZE)c%z2B1~C1Xp&Sv!DNzjFZC@oRE-6x z`Q)w(80WQ@Q?+x|LL+a=L#2J36HLB=Q6Vr2amp}7lM_^ml&e%DT-N!-2>Px*@@EfB zY2>;j3xYCFC;`MeS&jxtp{gI`2%tspl=ey`gQk>0Gb{dUC4+wF!^r`W)WCu5( z+^|*K6@SdYUNc0nN=n=V$R*fz9U>)6SgOfFKBFxk6Vl5*2gpKkXg>u4T0n~bKx!oz z3;_zZt>K6R;^~A57p*`hJ{%DLeZm|NYUH>70KiSLne%vF*LIuDmcz|{RH z#oCJK#DNhC?>8HwKR|#L+{#vF;S{xlwY>V zV~9gn>~Ndh7)ZSjJJ=}O8h^BGwMkD$gpMhUHcI^j#+LJhF{I=@oXv&k8aX8s;-}Tn zuo8Q*yQxa8G39F|yS3ABYKDdbH`788J`mSx62~$%*N74WPS+t>Oy|0^H>qCLL0fA; zcA1nJIqWVMasbMkclc(JMy*x?sCWjUQy-R}1+qj*@)NPzT8!!nNM6)PD8^&U#XW)w zut6lA%T1NQYLB(4?8Jk4o`uDdVqyrkLC~U!5y7_gu%Xx?V+fs)<~>{5(Xb1=m~(!B za(3ujc6rR6`KpatQbU(ndz8?hJm?G2pfBXCJkv?+eVB=LVUqxZz6CgFpay<&K1u^W zxhbftu{Ra>T5slxDPGPZUivX5(ij&$@C1q_(%--sh3Wq@1n;EMKc476ht@Twd8u2j zbj6kMcIf#ZNzY6AVN389fg+j)<|jIHNf7z|E)3BjsyV4^WIM6ycob2;H@^<+pA>s> z&*|_;k*?&q9Ga77OiL#?wOMkc-61Cs-8}yROT?y$hCxGcOfKk5zCGqf{e@Wvr(e{0 z(2WKcx*Wqcv{$Od0{T-J!(`%iYJq$69Y4e@!u;zdv|y@+Z`d+Oqj<_weZ9zo!;uDB z7&^PG;4OowTRMvV6}+6 zF`Xt5&=mSHJtsx;I-?;lm5+vKG4&oR-@&9>%CZ3TW8FD4fR{3WVYpPTP7YQCy(y5I zBW1`*D^p1X+^TmJIy;5x1~U@Z|HdR;? zi4-L!wlrJoy4;jhmOSf7zw8;9r#2u3>1`gtBl{~U`^EV91Ms5csCLm*?klvx@*PZ0 zLxl8Gl*vX<{GcqWac*)J7CVuopBC{O9x^FxJJo$3rM{ac9Za zfHt6HYi@kMyeDBFou$~z{*aFJld}KmO%u^WbjjIJKx@GV^{r(zzmzj-qXDxOqx@5mjqjF29 zx@(6j&l=;<*45V`)zkoTgSXIkqG$w@R3jiAUe^$?+5wn@4cC13k>W+YHz<&kd#zNx zhbBHA;MT?9j&;OEYT37GWsdHaz`YByKjvd?&pY1ob~G9L!GDK_Gpt1j+VyhbrN8Jn z+!Fgyo*6r3NStV0%v_(E|fI5*Z?*JE4w5tOjIc`b6 zV+St7?UV9u&-CjGpi8|6%6I&S>6Z~*4cndpO}G+xlREa6{x*WtWb#);n^a|;LRV(zsUKKJqRLEeXV0slJ?_jabAqIIlZYssjsJk$+; zUqHtg+^qrX@CB^`XPsK7(VnKoun)6X8){<`A7)D1u*8QM(pH%GFk9LNC-+IqfStfM zab8a9mN8J0rS4pkCR$uoux%e27?C#_!oP$?AIwg6Zao#AYSq5hTohRZUySmwmbw(p z@g7AK*6K0kK~FOkv13-ePY9RTJI3m_WJc*-)#hZCCyuZvLB^(Z`u>ItI_)#p+9Bb}qTCtRDpP73V9`cx znA8{Gf%Wl)bx`!QgAcv-Z=AQMJtSNdN`oRbMNPNj{fiYQmyU{_5L6GyzDOkjfRbnjEoAeTp3&0}!RhoE`nD_^bSxaQc_PmJ*_Oqxk735;x?du4Uj& zvO6c<29tEgH~kmtE6~B&{3W$G zGR*AO@@UgZQrH2;prTNxR8M8Ho{&No#n^~8N&BZ~)BMHQnp@ZNJr_{?r}Fxxx4O&u zQy|P8zU!qGt3MS5+Jo?vtr6`H$IDi`FtpoJjVOfblZwz1CU}Gh3UV|J_;CDS+vbP} z-b&YS=)2LXwo$c}hK%Y0jPOFn3>=H4CGUdZP17(nq%%G@U&EY!S!?UmuM6o71==atu?@D}k0?-VG>e&# z=ng%R3-?EQ7mgBNrwW0@B_Ui|1wCpk=3)f+tRrm?%UhX<<@#%K_Peog`(H#h$mF{G zeFvsZr)-XV&`qbCamf)~t`$$GpObS`drp@Avr(fi+t5Sldn}ehy4uzS;#l3(f=yX)_wl{`3`T%}hY^6k|@92;sf&j z3?pzS3S59b0%vn`aM1fkf~S7!owDsm>A>OE-$@+PYLOJ!>jP2{pMIwUR0WLKDC$8W zsaW{?3}`4T0)8M-RhVI%ibJ!1$9WQr7m9IPD}Jnh%z{3XX*Kx1&Ck&|i0<3OMHNaB zAp_QRJ=RT|FVTPk@noM-2o})z*rSUi8;!-JMT_6TQtxi9q`lO{$_sWx$IsR-G3HMx zey8MxP3IcUNqagno~eBfBlwq^vrArU&HPbD@bMn#bXLH657tV|Oj>J60msaUKb8KI zH6I2IVP42+^sES#e5`#2%y&+q6(7Lz$t2|YAe|GAUuhk7M%E_g?I5ywg9b$ePGfRt8kgZ%idqSa4&5Qo{8N=YsvjOs=l>B6SCvYB5GQd5=?i1 zJv8ed(00RQ{AoUq78Qn~0M1>1IM5d;`5^u~B1e8|sUI#roc^smf$>Vm)6~e)zo2^o zAQHGa!8=kqG60+^XuScmkXO_|XGeC$w6V9&iezbVS#BKbUlhs02RJc4cU`;>AK_@9 z+je~+ru7YwcgQAh+63()io(=Y7@-aqK8CA={{tJJX$rQ{ zne+5(I~HebJGxmLus&Q5hW%UIg-;Wx! zBmED02@;*&BKhC8G$9At2V$Ai?!`^I z0~>^#Rr3(Ys3^poQF>z@!#v^j%#!XK2I@T^F?A(r5sF6ti~^~xXh1IMzVWxb=$U>6 zeCR_)uuc9`8K>dfqy*ct0Smy8KRNKW@=@djZ=+3En-KXKmZ!Z|h5mW;$W3|o- zK3y&pLnncu>lfM;VKG$JgwrG?d*71m{T=G$ZCKSOmMAv2`j@R%A58ubZ3Ki-f1>~0 zy65@5hw*Vo0J<;m0Uc_ngF4B@n2>Df zI&tfg)D*-(J<2)Jj6U3KjbOls?L0X{!ACllwRtcUt@6z>W`r;gMc0TENmEM7!oe@n z_d1S#r+aS0?s|eg$BBJ9_r4I0+&BkB@TW#AP4GS?rejj zM&SE&!$m$4VU_m#&aRVwm@_rfha{EhKPQfE2`0yb@5-KkY7NY}&oSpdD>KK#li zlC^B^vi~TLkt!PB2k~)rzgqe)%JUDjcj&o206j#Aw^7cQ+bE0B2E&VF8$^D*fVdCk zlhu=LY|2gV@1VIV?Um5k8x_YM(Z+dW+}T@6AE0?!pEbSo+jiRYE7p7zvS-wJj*Av| zey~TBqVqoIgFVD?8ZlyT&$GY8Ck3T?xRUQe+5SRq7~nl$ORvNz zSK{i(2YOF>m(fZyz5>ui$K>!~6h<$Dmv4g$NOppDn?){ zs1tV#MTVfAgD-SPho{wBwTVKbK8s~utfh3m-5lJr# z8=L`7$Me7xmz~{B8D1vu_@MgpqtjAyZVJ8exCA(s%IFwd=(uG^o+qFlj*4gLF4|h1 zKsq5yy9$3=&xi0d^D$&=FTi^`7G=c{Rh}K7txEgEXCVF;GzeJ^bz&QP2lg15?w)q( z5Ge2Tqo`XqEwT~`vdxXM|JCskleI_LJFWaCKgZZer@}EJ&!?kVXec@Q zVp{2;H8-_c9^loDP1c0~p%|umh^YR-gmrB^j=PM;qz^0S=}y_6Jp+1qH6QI7VxnYj zq>+QX_Z#>5VOOxS2m&xgZ_U>$3u*jdeXxYJBwS{I>o|~bBOLLNPIG)vs2{;c>!@$& zJ=vsqukr!tTavDFk;Ymi%{c*9$e+r4E|swPl~CVpa6B2;&0_y}fbA7Ysvi&*Q+Y|f zkHu|jkLdrPMBPasL}z1eN_Wg>2iv{}`J$!Q>DU+72C`~>o9aM*x{Xu15H_gYK>TeC z*yy13?_A$WE$%r*7CPNU^0k{1(Z{J7trt^l>_U{%E`+@)h0)3xRsih+xB}vsaVT!m z!kop}#XaApkAg6tdzfWX$|w|TB|h9mKY^@@jWR5aYG=@){NT-WqCaLIsgO6y<2<_6 zJ*DVewNnE3SuI}AgD7BO%)??#;V^%mMdtv=(bOJmG}(CLvsn3W2k7&se`P@ly^4P< zfY9WVaNsDI^IfED9)O^QB+em*{~n;f8f^PA#wxO{VGc_5hOJGK1ljpm^IGeTp_X1= zApd;6-tkAI3VkvgC(E+~` ze@CtaDst$GX~;DR4Gl4W3fbTm>a6|AFZX3Z+rCKQ@euygUYPd1`EE`o=PbwGG<-#{hI0K3U1CUIRvY%XU}3%31?3Qk{c(0Zv{&BS-oBs%mD zF@tT}5sp$i1z3a&8?flL4c;sPgiG=!5pv~vXdWZ1rD}06jk*pnLOMXqG+c0EZj_TB z(z)QJdF>Kuwq3+XecI`dKYpgBJ^jJ#PE z3etarg(c!^7IGP!)>MTAlhR;*`v@ck|DUoiQ!Iwejg%Ur5x0=PJEI2uYouWL4z`^^ zZHu93whR#UzX*tb5J#GBD}S3W2*MO_vpS>AIjc{7z+I~v>^JWN6l74knCxt@BA^{B%-*&OUuT{x8{nuQ&U@__y~Iy?(<-w7s1LJZMK6*6y! z7}z+`0w0)YXUneb*$_+$n|W|neiSpiw(lSy$9 zgCOC^$bbb1nF#Dpell75FnXcstT^S$E3yKo4L&V+{)Gdk<}a9)Jtwqa(2%^kB?udV z=jyfibJb@)JMz3}shFEHefFiN7Kqi8;VFM=1x#%%u8cfgoIw|l)Ygt4Gj1#_7mXe@ z?UIsI3MPj9xEY1`g#OK5m zQ3R~GI9o);IU+2Eiech1ak(fFOGQGo;YzY|#aG2dae)P_-uIak#C_%nF%ITFbDVg~ zq`!a1{`tRP`*+OEj=rMPQ9pb;l7SSj^GOO{pk>6n##jFq& zVm7G%7ie%llDY^&?=zP(?p2_-K~XKSMxX{qaF`pL>>EA4aohDTbEudB?qrBo{(CEI zUlv~hpAwwYeP#l-uZjEY6!mQTm-%(^4Yqv~f4`+dzm2%x5%(+CD)pxPA5ivQtY@dB zwaJeC6Wg}bwz&5wEjF=-X6`N7kD)4Z;C`Wm>i0i}zahn(`Zp1)*qqs>FizG^ai=fiZ65kZlINtsI z_hRu~1~!w+jpJA<@CUR91Q@Y3<@u+xA zTqstFsZQmW?C zi%eoQu!PBz9C#e^|6}_P2RK(_Uk1ggm*&Q=c*)MSUQRpO;@#JCA$n9jA zJn_DHvP_=%r+Fbp$^SI}X-?+9Wc%NlJn^1+vP>RE>r*f?r@x=pyln+oe*hD1M9D*zlm~4?-Z7MdLQJ!0xN}E7yV3>L#(t>jJqAXpDhKf9@F1M zImDf6h6}CCWtVY!fb|#C-$Xeiin)r6JF8D>cRmz5PyE^RH&G7p#`n6)J?MW1)}Ks& z6Xg(Z>b|ZD8}CoRdfW6jQ4Wb>7A6s@>{NXb$>(igy=D5FD2F)dX7|FHW4kY9+greT z)ATn{4so#jZF6nJH-R+|=8q=*{j?@e95iW`b8o-C6merKL6lZRO?&1>oJr!{%vH|EJQdE(dR$ufE3b+bQH zdz>)8GJTAxoliBjbE9S{EdE!^*$ufE3fZ5k9 z!Rps#9769;W)47qy=?Y1GBx>sG8~HaGO+ez)$Qb%Jn@qGl6g7*CEKSldE%F5Un5IK z{_Zj^Juc^di88)u_B9fL{M}e?`xSj~Uj)`K%#&lT#2n`5JihF@vE2IPO;y;S;^X-C6JZJiwD2Mo^l77qVQHgXv2durOzlm~4 z|5(d=VeJLhv!=g^a)>|HRao=w9r7%&_L%-A$|3F)D|@A1<#F!;)^4ox`Q^0!C z^fyrsai{Ux*Y~3ANnkx;`kN?+c+)$s4ZV;kcAnU2`kN?+IH~@#SYH6vy{5m3a)>t#xo+x1k&JUMu2IPO;$ZpPZn1Od0M;F* zzlm~4UxZuj)ZVZ=fOWg+Z=xLHjqm5u7544GYB&2D*;kRjyVp9ty&YJ$nf@lqAr2)w z`YD?g<2GO!roV}Dh>U5R0Ec23z}jK@n<$4^xq`|Q;OzjGZu*-jhd5Z4t-T*i9ay)T z{wB&Hgm8O5sV($7IQ&*%-D3KiD2G__kN@rf+AYAk+4MJ24(Si$&OWr>46LN-Z=xLH zhjmvU9Ez0$R-5T>q8!p2>uz5hiq!_J1n&L!GthYOcVpetFAl{@0P7~x-#{B9#KF4v zxJVQ`Pi!~+O_W0%tP|O`18bYhet_RlVO@D(i z973#^&ikwVV16E0*O~q%${`ZtYyG5ma-i6GVvFf-q8uV)-}ecywg79h>2IPO;?CJ^ z|9T(v&A@6k{Y{iZ-0AzXe}i#bfwjr>H<(=@1hbDm6!>Fq0#@AgH&G68(tYy;m~mif zroV}Dh=b*|eX9?$2CNp--$XgYi}39}2u^qlu$oPO6Xg&mZg1Ondf_$$>sr&_U@Z_K zy%Bo5@3#@J1=dE>-$Xg2cUp2kV5fJ7ZUk17>2IPOV#WThZ+a_~-c7)2H2qDKL!8*( zI{{iFur`?fCdwfWR&U#by|6a`YrW}jq8!p2p?~*!U|nPSn<$6$m-hR;sG`_;qQUex zQ4Vpi9_o|Y2_stru-2LWCdwh+_-@yK_rhKWthJ`UiE@ZLwcGxKUPu%>Ph4&Kn<$64 z)Awh8m~pQL)*92_L^-6t^nLx;0IS~gH`qf%NZ&MGpC8&~tq0a>)8AlM4k6x@{;nS} z-fCd2GW|`IL!8tlfzZOT5kHAD2Mci)z^PHu$GzrCdwgw)AaRujA>j3tSe1_6XlS; zDf{!e5?EK5{wB&H{iVb{RWFWR0j#B_zlm~4U#y?@!mwg21=i)Jzlm~)74vxSos51t zur4$GO_W29hatnBP;_1ftR<$uiE_w^v8)(NfK`Wo+U94X9Ad?E-cRDPSiAaQEdtg;)89ln1UvbC zQu*UA1Xd0Hr=p*Ua)^IAKi?W)Rh#}M${|jwXHGz0HLzm1FUQYBImE#_ku3(S1*X4= za>$7gobUy}ns54>D2F(4Ph^`9ta+xtiE_w^5GcHpIXMqlb4`B}<&aN;CF9Hm)}^Mu ziE_v%$GQ|)b4-5|2UxRBe-q^pKP<1`9)&y`SXHLKiE@ZH-SJ#iz^XL; z4Nj#a2IPO;*EbiS2?g|nf@lqA;(MYgzW|0 zvw$_z^f&lY0U=I&oKrh)NoNA9%=9-=4sl~y_AXz{GGNUx{Y{iZtn~fAyA|>bV3nHw z249CD#KCypml`L$6j;+ue-q^pC+@xzU`+?sC8ocLa)^V~zwHIi`$C0B_vv`iLcQEpsKmY)=oj&~u48~Zg0Uv?SIZ-P(w&Vj&8_tAcQL+3 zce^cn5WYFSAyy3QJ;W7@zU_9*K-dS_?xD8rT->&EF7Bc^1z&`pi!b5xIpnkW3jSQ& zbK<1`9NV+;w*a^FoX)O16+Rf>&Yz2~>5u=Df#BmkxU~{>dHguXOMkpD!p3c#kQYJ! zR>r1-{wFNm`FIK*x;n{?kq0;3MNZG4Px!dg4@Mfd`;%gP+IW;FUA%7PjepL-cHB~o zS{0~0fjShpXGx&$>5eDCb$15dR^GV!iSOGf!uu>dXX7~sPZ-ZoJj3vui^qx|aoH)~ z;dre4|MUJ2FCY&8`T4)dfpM#v8rQ75TC8YZwRU`DM$OEs@vH0CD9`_k`Ths`KOFcE z2mZg$fk=JhYEj?Z+|(>0@kXeIb&d6_#iHf&X3U;HuY7(jS>>yI{w!r%xS+OXW;sG; zRxOy#7KGXMnG5D2-XaQKFu!7Ur9!YBRpoPI@T1qF@+A~+b_M-V%4hpjha~3xG}DYmFt^UT_aXC zZP?J%xZHA(@?Kuws5Ng{-lDB&))3BKE!qZ6Y^ZOHE4Mp}%bTOAC`}u+bwFOfuEj=? zUSieSrgf|8)l25)I96L$iN#Tud$8PIR%A*4x;0|m8UU`Q7pKQt1`&~50F@uPIVM}| z;;GmzP4Q+>C|?qZ7==8S2SK-Z#iV`TP`AzE7bBp9$ZMv-HS3Q2`koH!Ryvo zHs+A!pn_U<1W4z)#!V~MuUj1^S6IoSWR$FE7w1%MTM$&amR(hAxXI?0^06W`*Iyf7 z*IbWUaM#h8u&X-7n6Ru`@G~sJP0eAkaYb`WeKS??s%yeco9dg_tZ!-+^A^mioeP~b zcU@zAbNJHw=EnN<;hEefR!&Eb|+D;gWY)`k^my-*9J`H)}O6S!u@y7dU8;-T#|uhN?9 z>){$d9L!kJI8qCvms*WK>+8c5M_Ixv);HI$SiME%u^Po{u3r^zZdtdfp8dk3hPRA{ zuN1McglYoi5^C7+mSF?Mw8o~!`b&g0ZXRE+tr~v~SMyj|crhN;ppBP~v60&OGv<|} zuR=ewuw2MqZn>3(CE${M;WbU@Vh4(KE#bx{E!KG`!$yfUZun|kpSrGb)%y7A z`tj>Yz{anLYfTh7Zmn=dTubSi))R-o5|!uhmW#JwEk}0YVcRoY3{RKS$sGRN<2!)^ zU054@u$D{dCrBIrVyc0@x%&G~*i8OTTC7C%p%?cFLiUHR5(Cd2cy1W+&mAZRjz4c; z_&joi&l^7wOLVgCRyA$h64thCgcyLWYnxibT2pupgvIhiWt0A1zG}t#Rm)lUqlgM$ zxX;uqTP?w1C_18mmM~t9*q%RgjFBaitVO%5~#znVVaNTsH5Hyn#mzLMe zFQ04Gy;l-cTScG2ty5U-3l+?bOQ2;5DHj4wP%LQL*fKO+CCjjCZ9S9@Q;I^P7h_#6 zq!Jgby;1kn#k8(yZiLQ?LSJ#O7H+PW90fx-UKkaw#87FH@P>Gc7GApotzv~z6a&RL zCGaF=)N8gZmqHniUL3w+pg3iCi+Uld64zB5R?G1%t)0=D7_Au%#WM=eL_BoU?<_nq zJeT8Hg=Zt4Ry;T1xdqQ1c)pD1J9y~-Q0&CB2hWRmeuwAJc;3hJF`g_e7@dMAgy$?g zBk_#Ia{-F6=*2THhMT|Whq=V)jv(%Gm`a^9^-t)y*VH#-oGJSXZS9Ii*>PKh^z&Y`LR+!k z+q;nhXl{fr4;9CbZEOm!SVbcT**|!JdbRQm7}Bj9i@pIp8h6R6D~WI1*wl=1skd-| zlKFE^;jwn_E4$s5aVnEDw(;gHU7vt{R5=Z06dFka`flsT)30xgx2zqz(leeS=|bYw zTN+nvShorz!3|B#TZrM;kuWY_g&tk2UoNrz{>j4$($jF`IH`qLxni|Nxt*y@v_-3L z@ypRFnS6hu{Eq{LetzZn4Na@#>+4&_dj}Katucr!xGxIz(Q$72s*`GwQcP7S`|f@+R^F6;1_n7B zFeFAVy?#sh>UxY1QR$c#thlB=EOk;eyt;`7e)X%@X*3|Pf8@ZRKZKcn$!Q2-4LfGk zE?Pjt5iA7EoLf7qe3lEE^HANm!-Fuyf`}viGIGPn>Fg%gDtLl_Be#rnWBmK+8$Idk zWdA-iTtQ<;^zPPxRt~xA8&_??kfz1vM{f%cY0$t}kJ)1b43e5QNIxPOI?heA8$;D9 z7uV_@cruJsBjre9C5>-Q zxV5>71Qdh4ap942AT$zFJ_6-Ml<;9IeiYV0MD$E7bkWolQtVF4y_el zxkU+#Ro{wjq$a^Adx6Xy+#AvB?#(mwCdjD;gMXTjkAd#N^hYXjOH`=aRC8{OnRsex z<)?;rcE3#Q=&$A^9j;c{9G3mC)Dpcq4lmV?%bNtkM|~ie&YW+N-HucJea8vz^gaVm zF;FQv=nMaOPc$4E@lzP@3-I**DW*+a^+R?H!8||PJ+8iv z3tZ{Rj$xwb=O&MaVuL|#5nS7Zjv7IO(~1V70VzBP;ti5y2pBWb8H#wf{ET}UYC`^TIuUuy#Cy@ zA5C>c`}y=U3C|rju$BJ=l$HK(jElA6HvA9F{o@7xQ-DlQ@#qYIwP$S&(f0ytEc~q> z3-5e*P<$&MuF4Rj2u%Hi)tl%c`fNEwysH+eK)k}rIstDteOD~Y5KC})fFNnkWzjbc zcEY1M7yVpyKnTon?H>xGXMuWK^!*nmSTPDvKVkL06mNIFkFL)UUjng|FO|>AcO~rZ ze8n4>Gr1CmRrn_Lw(^bqMV>2wH~(1tYlh2}T+GGfjpmY+FU>EleA{5Bd@a0E;C%$Q z^%GW>ZFsx!G~kuOkMQVxf`xYv>@GHlX+6**@UwobFiL0TNnuThcb^prZz~?X?Yf0M za0vS8JbA`~=9rW(oxLF1+<0%FmLVRXLl^4D!n54g+wC6^|L~lT%Cf1Dv9mlmP=1uV z^OFThB3{tXXaHxhWJx#u&BFO2_fHlifX;)^56Mmj+(Th6g?$~~lzs%>oh~=Ei&8M; zaTQMTPh{07_a%5=1vkWu)0e}25M)~6^WZLpz~7_7YbhL!`vtryzboI~IJ$ssoB1%$GA&Q)-W~Q1<&1fbSQ4xv|a)eOsmk@F-gd8D69dSfCr%oXWg$Td* zXRYsUFZ2KJ*Q?(9z3$Ii>v^92T&KOIzXQ(+;vc}v4v(V$GDlRt{)S_{AYSKZdQ;yh z%l|dL7}xeu>3>stR@m9*amrcABz(iXA-8wqs% zqj<$Jh>Gun7x!d-5vF*Z7s?CTI|iS32HPx)pNikl#&^5pYVBsQ)Hw+O`o1G zIuDik)Q_6u$LtNujSk^^-rfZD-TA6ML3~@jpBuRHjt;zl?~?=X!uMf8c_-pG1o5Zv zePQ5z`MxOdfqZ{HaMk^0;1}?HP2i<`|4-l*eBTjxHQ#>^d?MfXQ|Gu(Zge@mz)W`o zUWK;|;;+Ly27VKMeBkr&zJcF^4+{K2d}C1l2i2E^v+IYk|+h{}uQ>_=dnA#5V>0 zIKC_JC3uwnaUA7FOYz*mU&osU{x*JS;H&W?17C+98@T4mae;5fdj`G@?;rS&_&I_9 ziZ2iPKTB=jJAU=uTpJdoZ%BMa;0NLt2Hpyv8h9JLdr;od__V;2`0~KJ;2Q()j^{Dw z{il9(Dn2amGw=n055ngM^$%5i;HCJzfser-4g4Z}ap05i6@gF1zX<$ld}rX-DSIa?sW_Y2jdS0UV=Xx_(=Tuz{le6 z240I#qfh*&esn3mJn$>GE@<2k-*}UxXhL_%nE3 z;4k5a2mTtKIj+o&R^n}g_z&=-1OFI5Ch*VkV*}rWXU+-bM&IDYLHrMRx4?JfeFJBc z84U?M7atz@0eD5=&GGSpx5O_A{0RK=z&qeq1)jh&=b&<@G;AV@z7e?0JU_>#aUD1YEn@a{qVSK{vk@z>(h zf_Sa#>x1}t`0^nB9$bCyKlP&r`K~sm{c*l84}1yVzYWS;s<^%Lliy2t_rTxAGwWl0 zx2;$n#IGa19>-(;lN)`3HxFFflFSM8+-MuVG06WT-YH1`D_#(I7HM_u*nhI3eenT% z$0sY=5C41Mjqu9Ao8!9XoX-C@{MsPCHU3@TZSceQZhy0)_W1O`JK?G`U0wm-p9$i% z?K>@q@5cAsz1xqh=ww{`*mV9=@ezUd!xscT5dR|ZbMT|~j(=8kK0Yq+VR&YKWJTrp z!SrdmzA<=ae6pfyye5dBfUgSt5`1^yQ}Ju~mo9Gx-`@#*7T>=O{6@a_-aFs2qFeF% z1J}0ujldV;ZT60TR`d`)E%3+jdjfw3e?0IP@vVWsivJ$?n|ObnFms-HX9TWo|AfGM;D0p9EdOcvzMLQO zpRA}qo)`Ea{D8pE#}5o#`-*mfkHYfm_p_=|ymioX~52K>vwH{-hk{|1k@%q-vcc&osF#uI`6j-L{EHtW`q zz~lJXz#HPz1J}0a*1!+J9|@d0G^3XT*S_P!z>mQ<2d;g^?!dd?`?tz0kIwZU7WgT6 zVc>o7(*hre?+*N2{DQzQz$XS?icb%`0>3WsD*V>KxzRVeC-6)0M*^RYKNI*hc-vt4 zuE$>v;%~v<3jB8b>%g_GJRz9B58$^3{uusz;7{Sd1pYkUSQm}lCo6gx9~}4__#J`2 zjkn6Pe+5#=r~lI|4r*KPvE(@CO1v z6<-|q>G;yX&%#>;u6@}*124hXbk6igIXve0bMP{;Tl~ z-7HxoY+Ul7EP#g_zLi>HQU(qD>K>xNhN$%?MP?+D^&;Y$Obga145+wdKM z-;EapJ|yN}MKKOH|e@U!vvM`hyA$HxZoBk+2GSKtjQGU==FMuAVn zPYV2Ud}ZKQ;oF1qX5$4x{4Mx#f!~2275GB@<}sQ2AI5JF{7HO4;LqU`1AiIs$vyD? zlNGJN_l(W>yLgKr{v$ju@K5offp5g?aeXRX-WL4#s*G>P8wK&Z@D_pZ!Se#oK7ilX zf!D|L18K;m^Kx zd{CYAL-DN_a*qb*xK-XLJny22zk}xeVtj6azXquIEAi!czQx~!r$4HHp3;+9r_7c9 zAv|o)v-qkSe_y`h-@q4-XP;#0Kg913;=jaq;wg*&91IMxg8JNcOSm!V6L&$^X*@RZ)zMxKaf`SKaZbHduEyc6Q6wn>zw%q_>O9hnan@M z!}2%ddBkaX8%IC5cbj6{5oEU zf6|0=V#KNZQ}D37GwY-uQpbna@iBG08lTdP-+Wg7j5_hx*YUY^{LVVQP~MztpfTUx zC-6M__h>8sB}?BGZ_Li&O?>b{9An!0@&T^(QOl_HbDi=Bz7cN|_%>W)kxu_RKEDOq zSi;m_y4N86Au4K!E3Hre!=JjhVk7C(^Y!pL={w+~nNLhXS6)$__-=K)C%&Er&9L-? z@vy!Tb-c2UPr}n5wRbAsF+a0D&aM-GR~^5>cNHqxqp zPLU5_pNcn*_KD8Ld*iHf&dV%6QyS;51el|4e|BjdpM_5w&huH>zWjOk9QI#2#87>Y z*GazwU(L=Vy?=SXPW;Ds*Fx&r*XP&0SLu(I_kVc1v0UTgyUPC#&*S%4y8pA;7A>pt z?;TQnQ~Z8@e;sVwhcJ&wL3q0}`Hg4k%kYlpWR`y-zH(5;ufyjKjG|ktJ@?=<&Za!` zC3p+cFE(F^&!N0;%s;`WaJ;t0#`7C|0LMqg=D*?TkNP`yAjkh4-<0xQ%hL?shW~2m zTjR@#OZQhtydN946D)mKIh|c?ekz{+sQlCMDI9OmrLO$*@NoM+5??|5P>Zj{yE4B| zGoOXe417L5m-%y)#V^8_;pz0t@p>a8ci*Cx=im5j{8>x?J>HY`Lx(hq-%lGR`>4IG z@UHy6A85;;#MiQZv)Oj(d*JI?-ZJxZ@J$zG_6Oy7yV}g}w_1D$^IzSr`mVw2vAz_U z&&R|5h}^SYow(h+Q)x7LaxKq{)Ku~WkiPR+m^eP6|C0Qt2O3Ii{g+WywN-qp_5szV zlvAlZ?jc%OQ(INzP+eL*nJ;BLz%zaVWw>gqd9dBS>h%-uNqryV-{dfPvOPbh*GiOL zSW;V6O&Na;8#|mo2l>}9d8tyBxa1Y%D%56sH3eVBaUVUf7l81syfo6y^(Dh=DlRGa zU#s~M?ZRA;Yi;?snhE36&%^l^`No!1Rt+x;TIG7LWHb+nmz0hkK3;XXNBK(9OEtm0 zb7W-2_?p_1+M1|xxTk;Yj*f7z&rm~Mesy5UsPftpo(ikAY7|sfk*So2MN3DQ@P-k+ zKEsk%k1xNtqH02on(CXRH<_F*L`^GEca)E(g%v#f)hQYAn1nr5UQtsqqN1{*c5)`nKlI{VPjdTK=_wZf#uGhs ztLL?=OWZft_dHfZ&uGXy_3Kew;Qmj!{|nv!o!$RM?*C%ASe} zU0nJuE`1l5zKctr$afhM`8=S}uSX)^WlZF|`ntHVF7A6G-xZd~ccmrrU2%zgS6(9D z6`08PB_@1{314EumzeOSBz!3eUrNH4lJKP@d?^WEO465-^x2a>d(vg^Y~l(jv;@AW zq${J)ityzoy%qQZ3w*QmqzTJg;EO8o?J4lBEAV9%`1YiH_LP}VlJXf+zJ`>~kg~!o zgRdy%D@s}IK0~2TX>Bj`DGPm)LSIp#uc**hROo9c^w~T644o~5udlPO$U3L9&)(VR z>+DPEY}tJcoqfI{UrLcLv&iQw@(nEVWfuAD#Xd=~FSFPJead2=ve*|^>}x3YHTZdy z=;D$jZL;`@n)GufX>-QUNuEk_gX3pz!cX0VpSuY^d6Rw~CjA6V`stYTlQ`)oanjG& zq@T+Po5p^fNEExCNcuUN^m8=nr(Ducz+}=bZPHJS(x(2#sa|`bl&n=Ey zY_~+NNv_SVscvGqhPlyo6}z^$+FT{B3fBQenv-rOyN#;fcDX6-W~-Z)ZpOKZ<~NUi zv*@>de$(f-bqP0d5^md;aGSP-+oUDj7A@f>Qo_xugxiiK+=wUKBucn>l5kTf;bu_6 z&6R|kDt^P1a1$lrW?RC|z=Rv-gd62Vffgm5(eZ3Y>DYBvqtIoN|*T zpVJn<0g6h7`IPQt0MGq1(C?x?NtO zn=>i5eJgT3U*!6*$n|-V+h!EG-YarFT;yg#k((z)u5XK6{};J=Qsib)k?Z*)H#$Xb z78SWUR^-N|i(7A*`r3APaf`|i04;GBzf#!bv^ke>iBqR8zVfJ<5AGZeWQkSKCnr9_b%_e7B!+C-5X&qT3X9TLTU?Jf2z zbg>&R;@pB2`!%@O{ftQz`vog@LxK4uzI%%Onp*4^y4cOgM6sK&!1YV9o64B$&tg9` z#cm!airvH~&h=Rr-)CLi9xc(u?cab~zAkPTh`GV(;&y>amW*CXCR`6D6RtmjI+8f$ zV=w2D_`Nc_J~fFQq1u9JQApwg-O^$jG4@>=TcDN!m%;Dm*vq+m1wKiEo5lpXY75-d zP8PWJ2)LpP+}eq`CKb4?45mc^u7L%ta;0VEBPNWp!!*5(Eh;&+U;mR&>Q~agSFf{9 z;l+<9o!sw~5}$yVMvSlVU)=!@ZxYero_?oSR#ja%q1ylS9$r>vFC6rT8G4nJ&~WO$)1Pbo7P^B;0{CdE`(B! zOL*Usi&sVZ5~b^LvNtP751DfR8l@u%TLK-PxkD+xbR2b!=M{6j2r;Pg|7`^C`Un%$ zPOOUb7A;?9CGX9$Z@jTe?;|L2ug0?)bws2WrnsJVhqspz9k`!W$k&+wqcKO=yQ}L~``011NXw#H-@m(DGuE^bxx|Tz6xZ?lrgcHMM0- zhiIe?&F*pK6Vq)N>!yS|y3Kp7~X=T z*%J9VV@+lusfGXd*74WZY<+#xcO0Fe%j*t7L=*+^>LpUzO)n3+X%0&bA=R z=&DnsyF3#0dQZh*=dwdEvZAOxgDp{HJ-p0Mf`m-b@ZtLYvhPb-?n^u)LQ*A{V z4MjO$!#0rj<6i7G9O)E#OIgLZ68EYZU#(wxDX*HWys<HH1n zp4?VTEwF92+xBR_moSI5?36?k+{QtDz`iBergAnaRNkiSBK3ko|IN*G7se?mza=SQ zwelh1>8d&*lX;)0PHFkGSb9Z__c2v0G1XX6yg@1m-`g6Oi+2-^wTdPYP+H4bF=h2N zWrFtR%A7va2{NCK@va?S!HG0qp%0`V*+~60j2)2G;nVnrYd6QH!^#S#7(K}*(>2A? z_+6+Aann4#h~>Pq*YD4@*R^Tq&!YLQ%mg>g8aEB2-x1pmNV_maxViq9Wa;VaW??$7 zn@N6RDoCp+J0A8+e)7sSDZ;Sy8+%IrG8xmk_r}tY34ZR@R*m9?NsOz1yRNNWZkpFt zRkG>uFNt%_R)v|h!3tpRx(2wj-Fw%c%o4f@y?5{F%JJqFb?tN{%)S{;5>dd7fW=DST+yecjdZ4&YrC3eHh<|dnKX5_v8AHyvTUEvBIe5 z;1$16ZoDi1 zGb_?_&pA=dy(=i*hwF^;teATiJSP^5ezNqrT%1t)rXuO}taqI2TM0SkcNZzY7gYJB za?)3cq@M)i{kR^Z`0QA;P<}ekfG9pE=ANz2;Q{7)BVOe?lbv^Dxf!KRw5nQ!f^MDN_CxsPwy&#hAH5fmidq?Fg_a>2k)$=$?|A(A@(DO7otc*=W=J`P)FFDmSl`1b^q`WRL z&PB-+Mv zP<}m6q5KVCoQskN%4wILlTf>Qi`07tRK5~9`7RX6$7{@^_%PNlsCxe)AI>#%aRm1% zD4cxnK;`>bB;N+bmvV2L{D4@Ly&t5Vy8m76)P3*DmynaMn@GN1FkZ$rWjXCUA1a;h zGtc4WBD$Yk=`R;ae+`V6N0IImS3k~!8b{s7t#Mc(C;umM@@*2y_brT%B(8x^7l%sM zN=~}=BI%MaK8kxfHgQ8 zCb4L!$ULePo5rFm%^!uD-%mqrk5|jtzUw|rdEo(`=Zeg^X<`NUAX|8+hCcobqwe2R zz9q)BFuPeS`c?{bTVlJX0oK$bEYv^{h9x;6k;w|3`_W?*UcLP?2(8 zf;r7&(L0K-J8s;C$xjE}=sPcCxoO$-E$UMtwMm#qk)rZ+_*v`P5BV*B# z;!*6k#I~&0Q27VS$$!2`{&E<~7fD~P_$zo9g~d-6JF$I$*~iABhZKJ$&qi9j?&FBh zV7biKilpD7@T<5#MZB74zqo%QeoYkRi8HzPTb#xHhvK!|n*!CoQBcc07HYoEQur}! z2Vndek2dy#Io)DWKl3wrw`7I*p?lwMaTy9(ivrmjg z>*eIzWZ~b6v?Kcv&;6n5IYfRV_h!l24xB2I|2&10{zBsv=eStZRL;CPL}dSxFH&xIsDAG&r`&-e`7cm7?Hg_J6U;Ax zImNMP8dP~RMasKFB;UOvIOTs~@!y;OYVo;I z%=n^s3;hR`{zD7@RHWX`#$PP_52*FK`C-1iLq*c1pz?P$KiN1)q~7u7lZ?|X{95x{ zq4M8l{(zk2c)`M#TljnCYs^2BlkR^OzTLue4)^6XhiYFdV>@F~@!dHN5?P+!Fy|z; zGf>;X$x!*G8n1(D->q_%XTF7RHEuT^bcD~>8|IwMe!;xbSZkc4_#XV;fU5s~3x8hW zJ!8?U;wk(-Q#kc~C@1|Eu@}eZ3eV;pGvZv@+{Sw&_LExg?PLgPdW zzruW`aW2&IKPb}P$6?N?v1qBqzb5AJ47zwL&z6}VbR_-{{{AUc{!Vh*oid(aJPWGd zhd`wpZs8TiE5v=c|JAr0D*Zd=-&) z4XXaT%pWtp36*{o)c*7%3;)EpUpt@gZ&2+x%Ggz;pH4RKV;o={VjLloZi4Yz3%?zz zJ@=SDU|b@S{w1j8S|QTDcPxIb#czkozYFG^7K`?8@7WE;=S9&#V--}o$#U9%rEwn2 z=^Kk4GrkLzZnd2CWrNr+7Hx*g_owmD4nDpRD*ahd@fR6yvG9A%7a3m^S*};j-!i^u z{MfibB;8NuIY)bMB2rHqsCqk?r;Mk;oIbIrzxg2J7-OyRYLW8qfGTI9g+FFoVq6Wi z9s10Ci*cL6`^TbP=CO`A{a+udea*yuqNs=Y>BcQk^))@lr@uh#%{+zi+j;jdRQ!Dk zKQk7+Z@yMe`TKN&17cA-7{7yiti?NdmI*4~2>E<|_dy-^R73r4pCWQxI14J>jfyYe zJfitSa^}~I=C8{6-T9&UIyw7^ugt%bGcU7__2umcRbDIewsOkrV%|eed4tT)m#0{6 z^NHrO&2NV4$N9$RpvHBX`Rm5_6@CWCYvx}Xzc>D*c;@#W^A`EOy@x^lKJRLNik#o~ zL(R+OoUfQ-K3&f5xoe>2%}vHTMcVlkRKGqC_50^lk>5XWS^P$e-zL9{<1Uy}!tq`L zznl3CbB4tt?!1ZO_wZbRd^o?KMbec+m4Bi9@BDs(>faf1mg8DE`{RZ35gZ4~`JM9? zj4xonqHum^eJU~!euOG-x1993Nk}>SLoH8RsPedv%6U)4Q*R%IQ}0MQ+sP`C`8z@3 zq`y_9-lZ_UkatWfo_gOCsdt^i@8#V)a()kP7o%A8v%>G=G(~}L*TGQb93xV050QHN zK>f}b0M*X(jb#dFevB1q&&5#rrpXz{yP%f$J_~%QArTRVEh5zZ!D*sQ;j!^Rk3J^ z;@Lj!mh*?FvWnnEvFIjoJo8AbiA8H*{6WqKLv2sKR5;s{Z$!rP++tYE@j8q@6h)Uq zrMpVuq(*n zBrfLsjKU}JyF=tfwcDZEvrjkTpJKg$YRBOs=?WD7G|xj@crObd3{`K9Nd9>Wr$5#~ zjrVWjGra5e1i~4gLt%Ug?KVG7{w&8!<`>AHV}Bw(&+}UrK3o0**T>|{?+4^BGR_vi zQvMRxTP*%-i{EMS`=3bsQqBuOU^k>&Y$Rbmph=W#byC za=wDfpWTymS8$!h*g_=#(J;P(>zQ)O?F*IfZuyn0mr&cW*W~1X+qePh{NHAIBlb(i z>{AGz!Ep>!IoHFStGV82{M^EKLbdC#Uc}S>V~wXk)z?RURV*qKsdt>Q*5V(O)4mU& z>iJntJ=v#v9uC!x4kGO=R5;5!z&K2#+zR6isPwZ%(%+_V(myFu?o#6yiYMLIBI*7x z-?z8-L!sJpnw)eO!klZ^&KmEu_=R%XUv`?$R{_j zsCJFE_$d~Ctw=lmVg9JaKW*V}TlhK)-(voo#qWE%udkP}FI4|rC#T%Uj2~G14r9YJ ze7lY{UJtcg4?&GfgZ}unu_#Yu{M#9ig<77JoO-%J&BKB6ne1;w(vLOPLiNWhQ04A3 zfOzU@C^n8oEyU~C?^}2maW?1wM9LXutTJ98C@juQx%h7q=T1 ziq!wINPD(ecb&yCq+Ck;-Z1Ja=ml-P+PP$u+cZ%e{Po(`XK=sQS7=JU0 zK9y&&o>+X7vwi-SBKg{giEeQ047}IX7_~>>NnHwlofeiXSW|{$dNCX1veh*INA7BJ1M; z=R(G{15~~Fa{A+VV_${Sj=^&FFO?$YUk6p+Q&7vdLg6=azS#I*sC?gul$$%4c*gTk zk#Y)+y+!h!XB-8UuSz7}%?c;|QVV}mq(9!X_zj9@{(djg?mg!F4#BDK0I2c~6v=m} zNV!KFkB8dc^b*Nm0<~P1KrPoSg^%WUuy_mSp^dK_-!pz`{8=QuZeS91uSHHpENW(K zCC=r1w8i%@_OtkNjl)FJO@#5cqUbU?^Xzu0_C2O>+V`jV!RHfyE7#dzd}S1M7l|Kj z;gjTVN72pVJDgt--{m@*;)kN1gWy36A4gF60u#kfN8cW}N${xQ#*%gMJ*&P9(m! z;y>ZN1r|Tf!e>J_?_u_Q&Wo6T4%OdV#7}ufUHmui_7FddB0V4%?}zz`~v2y@jUTP&hLoiyB4Zl_nChLRc_XE{{(B=e7<^8e4mcPe~5+oKAf?ii?cohlMOM7)RniTD8hYJA4{ zzDT-FBI#mde7Zx7XF=6h1=Wtr6;8V!6*)fsS!DZC|3b)d!GR*jDS2X3?ynH(pZ*p< zU8EltLY4b8jBn&!f8v*1j}uwHf3x@jm3}oo*;H z{zXvrOp`ONbD_$4Mo#+WBI#F(r2h;m{f|(~+jbo3TXWvg*cZnC!|yLS+tEv)($7=) zf4S~$;s26v;(ibFk}98WBviX+K%FnTNzQqzuPlBSRK0(So5@oRS^t}e|6@HDi91}} z!u>VkMciK_Zsqu0{EEL-0@bb&@~_!`LwEib>Ueajcogfo*fthD0hRtGsPxOB(yvrJ z>DP&*|Bp!e-B9WOggPIw4{gx>I{S;+{LX~>9d`^=x)juM4^}+sN=24`tioCT$x!L1 zE1dkZ%ojrCf5^h06v_XR#lLOwA6WQ03;)r=n~$gbN4U?ycs$g&pC+=t4p4X_))R3m z$3-IPr$W_x6;yj}vG4^V>6TjjYZkv*;dgPoY0Rl%dEQ|^Cw{~I6;S0RpvvnBwLcmr zQs4D3zK!cMQ0d-KIQMP+$NU@f+*%*s2&&z!MbaH-;WJ?TTh2Quob~!$<7W!r&i%yV zcf7k$;o444z;|$-O#Ghr!H7R_pAl3$o`$MtoyhOf|BBPuK8p0ikKzp+*If)-GGCyU z?<4s>v|r5Se1gdKu-Qb|nCq3|qg*$I8joFa>dBo1Dfd8e8o#e#{72d)?&O`f;;tyV zLi~x}AL7sS8&vz=5ozB?BISG`(!SrsYxtcz8M55%MA8+A)O);0`d%XSmO?ED&qlcA zm}*?BaJCa0e;K};-y=}J#}0%lH(%kuGQSkg zcBHTTH@2U0(hU($qF+SLLtd`jHr5&^ ziLJRVA?C3k7Y}3n#lsnY@d(CWY?Bqu5s%D@=8Cjyo^if$fyf`1ykBg~_>1ire~Vu% z@<&FOn7?3LCU)RC1o3FzCo6Vj{4IW!akY31<1cn%{KaD#e=(o&7ZZ%Xm}LCL0>)oV zG5%s9<1cn*{KX>1U)0OO>ccLKzjz$uFCNeNBe82%)X2h{8Cw`z8uN_$+aB?5jK6pS z<1e1b_>0}yUyCO({^H4uzt|%y>Mr(VInIEmupDA9mP0(1A?IaZ&BQaaq88#=%wzFv=CL@4c`Tm8a){@$9O7V> zLma|#i082!;`uCxIF#iOFJK;vf6t0~8~ceRJRf2_TO7tb7KbyB#SzS7v6StvakN;* zed%I3f6qmvKWfF1Sn8)H6=CODo^H{889*bj{$Kp8Vu~?NA%@?b) zq6Okb%wv&y9u}#0k@;egaam&if;c`aS|-*okHuQ%u{eQwEMClZOq|GeOq|3#7AG^0 z#Y>pS;-!qgIEC>SFJt`0%Nc*;4sj~uFHU3pjeErDjQ;?51>-MX$@q&i7=Q69#$UXe z@fWXQ{Kc7!zc`EW7q4af#p@V;GUeEZ8H!%LPjTiFYu5;+>42IG^zo?_&In^ToRvKk**M&-k## zFA^899}*Wbe&W46Ph(sr-pBZf_cMORl_Kd^nXeWfVEn`f89(EC@gc@fe3OiKvi=(TiKHJOzQlW)%?FE1S%1Z4jKBCY z<1fC#_=~SH{^D}RUnG64_!{FczRviIZ!rGi3f5ooO~zmRC*yCNBfiD>iz^v_@om;$ z@g2rre3$VTSF!$z@3H=h?=$}52aLbCn(-GuWc?LCV*JH5jK8>+^;i5C<1c>9`YWzu z{KZcgfALe+U*ksc-;BTb8SAgOp7A&CFzyt||BG>tF*?(S=NRi58yFiIn;BaeTZ+_^ zXWqux&e+kIZ%i4Bja`l1jXjOMjs1)RjAt7M8;2T)8Ow~Ljg=zpt2WkJ_$1>L<22(8 z<4ogh;~e8$<2>Vhk@6RapELgA7mUAgk+^~J7dJBg;+KrS_#eh!{4e7#l7EG9rE!&U zwQ;TS6XSa0M&l;qR&f*KZ@$C0)A);Vk1;yS*PmmoXKY|>WNc<^VQgv4Gqy46`iqvQ zqcPu@G8T(0e^-&^?{48ejlGTij022k8wVSQ8iyHmeMj|<7FqsEaWmsD{*U!v+`{^A zoMN12oMD`4oNb(AoNJtCoG)%={LSw-K5SfMTx?uoe8ITPxZJqHxYD@FxZ1eZ_=$17 zaiejQajS8g$nx(HS^k|C{)=&sF*@7#OOCOgv4OFXv6-=jQP;n;{CVP6Z2!ft+5Q_l zir=vP7q_wfH@fR&r0**Kmhl(2v;7ypWBV`e;5bD5p6$Q*1KWS`M}EJFJK6q=yV!s6 z$;#!J)5zhK^9II7#%9JA#+JrBV;f^TV@G4YF=Z?^b~Sc4_B8f3_A|1Zb?u?Kj)RRu zjl+y(#?i(~W3{o?ILSE0IL$c2IMX=WILA2GIL|oWxWIV7@nPd4<6`3y;|s=R#^uHp z#+AlZ#?{8P#!rmvjT?=dj9ZP{j5~}wjlUT87$c^D8-HUxV*_I&V>4q5V@qS6v5m2v zv7<5Hm@*a{yBfP2dm4KiX`XMF*qrM;<_(OE#4?^|44rx0(|mw&hH;K@g>kj<{{R&^ B`jY?v literal 95696 zcmeFa3wTu3)i=H;8InjMGhkHIs0SPbEVm#k8Bvo!55fmpH-&c7m(cIi?0DVrk?=oDu=q49R(y)(6Uf5U z69K&I_m$w=xR2sXyq-hG;{-9Dq?CzSLyxV}FE2adyFC{?82`erk5%iB`vKYUB&G48 zM84bS_$hyS-*MEBkPSm61>`p#XWR_+^cqi6TK$N}^c>WmEF%BohmTS|Vnp=tk@5TW zZ@-4ukin&HG@j(Q#-0yBadf}mh|{}diGC#7nQJ^wyoetD&~wCioEV^U3?ok2>^Ynx z5$Jn9+>^}t=eLc=DMwjO<32)VJjuDw8+J_bkMSjD`9IX-#2Lw@#H>q>l|Adb?VmoB zhdJtd`iYs>qk5v|{o$p?qf`M#UbOF+FP4iq@lM~JuMZ>cQyt|1c-c5`Z=XS zUB+YaF<8i=dvYWnllOdt%6hY?*~1kovqZJ_ik$G6=$n33%|)TwTJ~PGG?d`%Lumov z;&J9wz4wu*j^AU%DOl%VPv`i(U`jbLMb;rligtQ;{DnCv17DOJ^F1BA@(wTfI#r6j z@9EPZnOw)0ai#e5Jyb1cP_>jD44+I4{4Q!Ec_u{C_w-{|5;yh7sh*N2Bgke*{9U3z zakWy1>{1*{a1u2)Ty_B>_-_9_kjZG>aW7(^z92XPJ`x$A0hB4sSl!5nA)Td!xrZsIyTAAM%8!ph}Dw3$bLh zksv})F^PEvK7;cq*Evk*mulp+^&x}FH6AB&fFas>rY=J=P~B&tn&tPY7XBeMyaauR ztop6(>7u~LmgqzZJu?6R35p|25pn@Sm=cQ@X)fGHyo+;LdiGI!+V77(NlhX*GRe{l z)MBeZW+)`<8QP87eW>T14;XKE9x3E*R?xX9V(NP1K2mFCEV#bdEl6u5NP1+GWO?k& z7oxGTA=L9dAd&4rw#n!lInkt7mqHJf`8YKZ*))7lUo0gxQx-{yC2Eusifw;_RglLQ z-@p={))%Yr&ibNnC5ApPcToj5gc91C;1kr<%#AYF>VC~T? znuSsEVW>GbgEWmv+j=~Vi-|PZtqG`pF@-Wc4uUl+`Db=E({5jHb4+-yehg?SlwAO2nl6fW+FNb^CET zPA#D~O? zRL$ItF;kD1RRKpRaut^M-ak&!f5{PwvRbiJFuRYJ_)bJ{@QoFWEM&Jg0GU!^z%9_K z=M~38T1H4+IR~WF)2IF`tvUSEW$c4t(Oq6ZJ%XdESY+SpJzn_{K@}l{dY}8DG^lKa zWQnfK(kjGPDHW?hYP1kV&KKex>L**xcGM7MFz4fCa2cgyCXmt?G=q~66%nM;3-#oq zyOTX6*ddbtcrOE*gvpcqvokF9hMhR|vWq%RtBvnM@mOlZOKO7#I;1vU1OJuUhy!(Y z9o)>>`3GiE4I(7M=Q|XpEIM~FD1KJ&C%c%lj)(Oh?^<<)0vaCKo|Au}P}%v)j-l;C z7L;EhykSs2e*-aWRweI2BYujwko+uRlvU-gLk$zb(rizL3B+PTBtTLetg%FC5u;6W zr=LklDwSQVf5)!K)$`tAYh~rf6{g8Z(kVvjc*%w9#oYgA} zk_j6`+>Ga=oidrpFaXlmOi>=EP6rLaW8}$l=v`Ll2tgvdCwT?MeeH zwkP$Hr5^ls#`?YnB_4WL(woi#_>B#Kc~Y+^T^oW7C^eV*jS_*j50k%n$Kp(_0eqyV zr4~+oUr}qJ@}~Zlu1qCQDP3Wjn(P3g(%xhgKTnZyk=#r^>R*$s@L^iRF%yAii10E0 zP|VTulK(h@(V4f6@#y`3jvyy1)g0SVuKIT=Je{n-2elbneHvgbmsaJ$jBLHF$@ z-3X~lG`)NEb<3{ZXU$F!$D?oOME~y9rG@(>g~$PC8PAZk*QmJ6b>Gu@wTRyl8%dUP zEf0k1LOrc-TYN$u(H;vK3w{|-2DJT*$Jti?rJc!}$qsfH4A~MTYaIBJFUs+*rNk;x z77Ctt99t)i;4WxEOb$6GghlgV@ViEJ zpm)C(c^!%Er18$k5QL|Gjlkxi7D7rDc@AR@no-;OZHc;@r`J%s`zWqdGL*5JFEeHZ zyv%^BcI<&bh>4`2qkV-N3ys*04`Gpdo;43Ac97`p`xk!f`M50p8sUK7xFt}0X*e)4 zTn37)*{7mVqb!|06bbdLN2an6r3b(-V@kC?MSqrxB13-$Qib7HEEHvxCE>#vC_@tE zRo7V~;hwXRLZ2Zm%VpLCNb277{9&dzNLeYjJ5yQj)MqQHvs6-IRvm`}MAPXZTG0$oRhSZyK$#)mw6vdb+l@ zUdCOr)WRCwU&1OQd%l(FDaxP+ya7#`v8kxHCgAtQeof?a!RnjyEqaWaBGhrTZwN_V zbOJ^dG^19p+E$(&ZR0pZgPa$o=5qU?mQoHb2Fj{SBL6U|3!;5qU+e>9L7v+wui3uX zEQm@7z9^D?ySltn#avLJcWs}MGcNqSlNBBbAj}?I#9yVoq>+et3Zu*P9X7FXJL&U7c0XdH9}aZ15uPIYu?nJ`_`~xxUyPs9c8n7#ev6Er*4Y<@p`P8~L8G)erPP1{0%w zIpJ`$4=KMyDQgJTWMV^^Rjv${EmUkEp|_Q6W25zwyb3jtF7Xqo*DNeHcfi2p)#>_d zwgF2Z?n{-NT(!i)NYQB?$P${o)Qj2rqFMDS-1T%vr(tyj>jOfMPJpjFItAbK(Q~?} zHyn9&zx5E8_Q|QxLIa+j#3s+BzaXUBf`&mT8|$I6$6>;d>@4FR!f$Y1o;N%_I={=j zIX~GHq?QbY8ZAXA)9H*@&qFCO3(QDTU+UjK6dS*w5}++6s+F!nwd(l|SoRqSqk;$l z3M0SEn;tvgCE`as5pc5@i_Dm+)pvNhD| zU-Ud{f`sDQp*hAqgc$RjC#x{;t%z`b&tJf+P-wL%Cn1$|8wO=16QB&bx1;AK%xlVY zx;J3_0yE8`BRU#M^^bPu8;=r^rJaf5-j4i4aRW5t;ki(r#UV_NFS;H|GTys&RL$TK zw!QrR|0v3e0=}p3ZP(@i`#8OCe2?zw$luAib>$14Gmjpv-nhny-E(+>)WFufDh6!| z$vD|S)tl;mb^q?Oz&I4jYJVFneH#5xcP$%DsON@LIJxAp zUK~jNo#s4L|7WZ&s?t{%B@ZEN_gG5$h26C3le&AiMn4_9N6}Ao_Za*nH$y~rpHIG4 zl3EML?4k;Nc2T;LlQF_ZlMcznj(EPOgbrb0L6ebT(~9H@LOPlvpGm&6$>)bJjnB>~ zR8*;liguq%QQo3FMw0Ic`OYNY>*PCwe19U}2=Z~sP9fj36gHfEPm#}0zQ@StBj3a1 z zyvkBFHX2hJ3<2JRdUiwJWyTZzS$aj=-;StRd^3k+m@^$hJ zA>W_K$3x;nF8qmU*U8>DQwHG_mf=3CK_(H=s1Fcnme>dOgpUMX5#lZfgM% zJw7OlXdlK{g+!84!Q+64K1PntaSc`?v-Q1u-ZKEvJk~dj8G8B@*h6gxv6gEY1S`(HKqy7QpX%cJ-lAm^#aZ^!^zNsjABMSbn5z-*( zXfRHy#dJq9%t%Qr^k0yO&=ltnF!^29?YrX&$iVpS1al*57HmB=`u74bt3Wm+(%5Ff zwp2ZO&g9dG+LNTZK8K1>N=4whPU{(Kyak2N#XK2ts7>5?H<%3r%NL(SlkQP&cCwy| zcNyshB^yc4eriFoH{@IpA0D4!bCl3u#rUv=? z-gu`mKC)0Hkm%5V6aWeM5FbjiAhRm-98<_<0U7d?d2kVB-;0jN7?Z9RQgM}E!DDp55z(yNLnvn{?e`soQ+@4Jo= zqlrY1n0j~ar;EZ%lg}Yfqp>LA9RcRtc?=Qs8Ym7Le|6@Bj8?C0f9o|~qs9vxc>y+n zI0~iooJ4CB-^rLGkx~-|dag0!P9!q8%EosYHN_~=uI?H(vlv_C$Bs^aT_I~i08(Fe z1UDd9vJ3U=%o-YrnT8J9n|uz^ipdTQdt!z>O+V5|eFOzm`*u>}rMWoW>x+|tKpjX# z!EEt2B+FO`Y8wsjZ7?+buV{_gS#?2}?QFHqol4xu`yL%vj*8R}4%FI&Sd$Z_i6kAxmCUMgtmux8M2lw>kCcOUSd+1Lcb#RE5BN1Ox zsl@6wNrqnOPZmSv=)KwYyQ3)?2Jyp~Qg*CuQfi(xZQ(tz;}zOik?>X+_uj+SthdtB zS?zoJj*(>0mK|%?I!=oniu^9&J%C6FZ=9IrfVUl%lR$F*Y;orNRl<8H;jM&~yW<8R z(+|cEZObX`#Kg-W;{(~yAP1W=XYoV!NXUc| zO_ylUq66tEfV}Q%8pzW8L7`;wrPFQ=59_X`ajodC4iM_@YTnq$*!1bdn_a3}GwTxy zfhDTa+bugI%*q&*-mY>FjdchU-sF%7veaEk7MzG5uyZcn5ze`K-_^;N&=m|+zciV4 za}SN#q)dZ-&604V=r-Ug{g(w97={_ew}J9}7+XXoNp&4)$dqc<9}G|Z%C-Dx&D>~# zDPt~X=#r(DyrLdt%_)+tMjr3%_TEZahx2Dk8i3?kt6aCDT)*h)gq5DADD^PWlPym? z+(hit4W4yMRGMW>ar;;j9laO%t4$aB9(}LQW-|A(MIkxgl4yf*p71_Sv|x7}kBAr* zv}mGumrT*DH4C}MN&4wgGOh@HH&v%d)Ox$A%M{VQ*&e-DPI$3sFZi>7lZtTM9e87wq&- ztt>lw%X?k3F7b#i?tkFnwN_~CAifw_7)-Ax{yznWZ76Bf{noNs27R9t ze!TL#;LqScSsw*pA?meJ8TCcGpgiWHVoDDnG}kEFrF4K}K&|>4sT(W}g4m}xa73Pv z^-WdGQKZ;)v!AMsniiG^GU&lVBIH4>M>2R<7TnM9tVlAa#M6W}EB@g4)V`H&p3kDx z-8{b~eKdGL7cN+L+v~|0^~e10-a#=*qhV@-Lr~ip_Wq7H1Bk*YRU=NY6>2;Ym=1ti z+O%5O$vgI!AXGnsZuZ)J+pm}$e%sNUNFO66xcvuvp)?T=C<|fPl6p%ept+_V*Lw%i zAF{R>nVu7#iA>a{LN4vo@sIfDuLbQG#Q5-Y&1KJiAy#|_gT|_*tkq| zIycl={iW2unfeL3NsjrEfW%SnR^1N2bb&%if}%&MiGtEjbde{iH}9>WU$0P;2bo2y zkG?rl8rZh|r?j9Q50j^PSdY`EKIDniKa>->MnRtS=r#WC8ZIp2)OhuvrT2g}y@js9 zR>_tw%w~YaoBGtNmN)g!{^M6^cJm69F&q=c(Pwj_hmT>r3&TnG82QE&SS#hS&>+AX zok+W5Nft|FH7s#ji}vCc=6jjT`Xw3mu2a5C4_O)(;#Oq&F<6|dA9U4cEd7bQQH9XT zNK=?jQ$R_erm6mM8VXY5Y!6*gjS^uOgCC7z3ZS$ClHgGIFg?^9$k;64i^UN?L^}qs z%!f@6*jXUUgZ^r8!Cvrz5Rn_;Uor(_4U}Q6%G{3 zs?)o4HOFE}I{H__EYSjGeF^VgFIl_VDT3X*U4Ywj=&TI zVGWW-Q}oL%8z*~WPr$e$LAp0E17Xsr1ItT*9Y#YDZ;y(<<%`{nc%{9VNhJivj32@Z zzZ~5%P22V5g(n(~foMw1pVLDnw1fBc_p$kW5LU$BgWOPsrDcw* z1lXy~`QoENP^sG2&-D~JHTgwihdeI?*85^Q-lN;FyXy!rNkXXtVdG&kt}uGUgM&k3 zdiQD(&8X2Z2F=_4LIJ9jD!V6_CfRSJ8AK%66@A4YCUehjoknOR)bbY$Ocl)5U`t>^ zDPXh)#t10$lb+FA14f+}QPdZ1?Tz-0_Ql>MDd@Y#7fZoY(cz(^BtKyI!RS%I z?QKYb3w zY~LbAhk0BU@mOuPD3spNqaR7Wi`KLAVCtC+IeK0e03t1Tn-mHIeIt^SAO~GlsB_sK zZ5fYshOZ(aa#osNGt#IDY=7;2y(W-ML8=g;o-sg~c%_q~BqL}oQ!C1udS#WV^lZZsZajx<;)3#=VdT57-3{+0b}5sH$b|6>6SL0z%Hb}ASI z%nue*(Dv!V7q5p$8axRZ1F};L(Uj*R z@PG`zR_(scX!$Tzfkm$P5Uo#e(MY$JQjs7TiN^xeugU#r;VEeepaUUb;bQ@^DrE~N z_Qe9EQ=Oy~li1mN|76T%*ET?&M%s#jd5xkBlcg^`Bu(WV`$+`YD!{JleCij5l6KwZ zB@&0gtMsXay^U7Eu*lz&J+gn1?Z>F1UZHnCIxAY6-TvA~dR4%vDnjjIuOvdhj@~AU zX#!}ZuM!ekx{BSiNol1777yw}V9q#D)2J*LAOyiQGMh3+9KrEvQ4XCHivbf<;pA*a zpr%Y%CnT(iOzHH+t|8raZ2U|5-s(^T#EY`2mlD|(o3;!5rHPd7*c=cpu7Sx=oV)-j zr0Ra2)DMdc3R9dMF7=PCHjH|&-X$xoj_RSGkeq?lIjfyg1SKuVuVYy0Td@P-3w%%Q zfu0SIhK>!Nt@vHlG3z1${c*DIsZIh80Wk6gL^XaMX!pF`F>Lz>*XYk(6gtVn5I zCT9a`XN0wPC$@Qk>9!iQC>@!JE%igAs+bJ5*dvez^4xkgd$3X9EokWseEnT>zObXcvOg>DZT(P9ntZjg_2hx~bjAZdEfD;;- z$MMOj#60Sys3FxRpyk0UXnEC7S;r8hd~wy=Er|3)@>kgMQ0J^6H;!&VQ5TuNguS$5|Dvx&>csau%BXC~5!w?agwGj-z&zLARiR0l1{;A#c=e z{wXs)$D|ws$BCa25ijHPP{CmM2aX?d_S;l)%Dxy2$p^xx=+B}*JULW{HfpuIrB_)i z3u^xBUolDpTv`ThwOEd(nhZuhE{vAPq{#LiO3`MJkBdS z@=SH|dIoKIm#C|~sfV-917xp{$n~}|y3Zqj;|P%ZLyO$U&L;`!M=#0>nrwx59cJ3G z**o>~^mxRcUcp3*A~tm(bG|Ec|2g^!T5lkA4o;6tX_(gWm%S0W0tfE7ukmAN_CC_e zS46uZMkE0R#!#cQ?Cr>J6BXWuM!>&CaA;)1AKhC(hFI#Q=&}6Bkm%9;@CK9u+xgI~ zS@T0cf<70x>^XZQT8;(VauzQ38dGHk$aOgwzHF^)ck+e`XtmFpT{vygJfT1_#owzjT{b3d+f9f&NY@N13RcqHFM@JPU7;#*OQdn_;yQtzW7yAv?L`)gEw_`I?^mF z(pqPvbldFCqdq|2>g}%PJ|T5UI_*J4@OBVvAur&$Va&cl)m4(J(~E7XPacGHso|H} z|54hRu>=7DF9L(lWCphl$Kj6+_!<(PsQ63F&REeWj@WvH1RQ$rkHqFpMLCgQ%kCC+ z9_fwu5KD{mvJo zjrek#RvAKk@mz`oW|xKV(rcSU4e0FU+1}*Yh_Q?4g>vx4|3P{UwGmh2H7OZVXp=Oz zOtZJqEdnuKq^PLgco#f4M_gr*f({6`9!*g~g*RV(3XwrP;E_>TC4wklHSG{ewkR@X zVL)tT4^AuBTl;g+QI+ilMmFcl@aButu>%$a8AiqXGX=4VsBcV`War2j*V-ghA;E8u zAeq9~E-Bxcnj13>)Y(n26%)z#OH%$cci}C>iB78W2PqcJJ0s}c5Dsud*iKbSLj6^W zj;`CN_p(erCEqb3_Ld$f+Z$PGG#4eRXg~7Cg;Y7*3W)Ww-!Te!Xs(SzX!Or)g-HuM%YY!`Jh#u_hnxAhnJ0}%M#iu8CD z*iQ5J^H6wnWd}&kzl;tec_9ESzq6=f2rNaR0`)*5T_37bJ4lk-C@NY(e6)~>d5NHz6zxNh z5>7rL6FmkjKb7&EViUOP92#W;7gLT&Trf7ub*6kbs)gF;C>M zG@-5i*9hh9FE5ZdSb<9npS0(eDhaWT;VMi)%T0elRoaAL96>z#E*H6|5rv9&79iluiU-z6 zfrcbtbPT~5L{Q`PtieYNc7e;>Sb0P2#w)Qeg3kF5hv?f+i?KwZSya79)_&SSk zWE8Lk>?aG@Z|iRyjKJ0vIw`r2NJe)TBRM40NG_vYOM_HtI$Fb!Bxx)~%5NcACz6!# zt=#L9p{<%gCE9AUDsWmNxCNv}JK|Kk$4M79Ei5c5$y1TQ-ajJ8E9mr{79GY)Hygho z0mEXaALB<(h>7c3$s#pm!2Uj{Qi!gR)6Fr!LqX%IjW2{S%L9SG6Z1W&Q@miDL1V@H z(Q+w)LKyjh&e;IWJ7V?T`qIvX8StT*-`Jtv!X}Q zcm5G?dT;uKfHa$x(oYtWW9Exk@x+o9cuiaO+)#ey0{L)T@gol)EEr`6#TO3kvvFcq9b(<*wB_@?)8at5op9tnOu^)in)>Pru0wGWG0(02;a=M8@fUmJ(fSi2D? z7-{DQj5>@7r$T%pZ%I;15AEEWdR6bmTLi;Dt4CMAk#3$NPVFV|FC-H=ghqysq#h}K zs}?7T8q_=*D8!0`PZr<}dHf}HdsZ0`rce*t*~f zxS<@dL>@usz&Zl;=$xv##GX3S^C_l^W%XwtKR#STued5rE1}n;caF*2sSY+$iV76<8V_|AQMxZDRohL5jws zW5a|3*fkaqdI7s|?l(;}*(D_l!sSrQ(lmi7k6k~OX_5LR@t1Xo3`6U;8abEQN@qt) z{a#H_@cu}*@>2yX`wB}9u_X|664Zi?*bxz(rW%sshin)2vX7nHN6`1LqJgN6uUlS$ zqNZYEF;aFs;Pb_r;dkt-{>Y2zRBKu-vD(XL!a|MBUc3E~m4JLGXn|VxMo=+IYoYvK zWNi6qb3*hZnB@;pbG3IVGe&zND~++CK=mU|jNxq(TjVEHs|B)Z)tq~(%F5{*j$D6~ z_Q%hKfPnk5deSCP@_D7@xhi=QJ-G-`vFu|TNiZ^#vQ`Opf zz*3>8OQXCv^;Z%~D=as9odAPDZ-)&>SY`rge4t|_5A(n`2n;D21{a>&*^;?Xu7nOE$ zlb;vJ&^cw#h37<%=54H?#d5_=?mxIQihhtAzCihM!kY4V!lx-;URdqRI}pyrp){-j z+53}a`<~#m7NNY$(Y|NX%K!6dd~ysD4k$jOy5gN%hs%Du7MBN^ivx=hNGm!88-1wl zdo2}!`D3+g2@5`y-gb=b3sx#1zoY@0GR=-Oa;QTqT6F&e)saes5^x=sd%VVMZ!Jf& zR~z|_VAxWY1=|%$#VJiWjtTo>AEFi3)umFfZV)%*t>ctr;_;kkY#A!f+I%Z>Y|g7k zNxi`GV&#;QJAV*`%Z z{=8qG9dPuFWWqrJZI#l{AXEQaiB&6Tuc(nOy`&`3^8ti`|q&38e{b^ zZI|Zy#r%#I&Wmo+a?(4nVLcpXYY&l7C0=gq>P!qa{Qj@{H||DCJzver)tzY!XT z5$7pPkA5)v>4G8Q0%HU=alV6-%~|m?<&DObeq;SOzAtSW6`OAsydb)@z#Dm&bm)Tg zRbTo$Iv;o(#&@FqNy;x7$V*93l>PCs@#p`0_@O^b&5RWsqLL=wB2Z8R7o{4yj=D zZXG-9zf9N`Dr^U^Xx_&D?Q7fd!gjP-qu#H-Z_MX?L$@A90B?Dwi-maW zEg_S3E-fu#KDXGwx%t_}c%#|fqW8Nr#PG$*9^Ub~i76F565xV;l_o}^Akih4=n=oZ zrC6U}FD9ZMeYf7inP7u84bwR{vX_l2?83(K19|JQV>SotXY~PVt2QRAInGEP!Gw8N zK@m1)%N)Wd@wNU*M4`R${=^pl&k8^p?Nh!Rzsh1C=ZpP>u>>CSN2XyFjr-?a1{U?U z1oSGuVzUL1sgh*p0B)H?diRdMi9GDVvxX~Ng^`m|Kj6v=KLm@)SRFX&BYkz?{ceHH znPIwD)VAv(H9X;9r%zr7nMINHgAZxpn~eEd^aCsu))JwS>H0fmFVN0;D5rXTZ-1`P zUS?xU3HJRJ>Ca(7v1kMR>z*S0NZCtBb`abu!g3=fe`1FbQ;H4pO8$%lZN8TJ3OGUH zYg2<3{{kW)2$>n>BT)yk9Rd|?@8_23jQt}-O}A7!KlwGh>xgjqrTT%_iY;}dA$_*rf3CU5!p(qLf(J0pa$snlb)T4NE&yTuG=2~Gictu9D zeeqM^qai&_@+9*p*eWQsQWdXkwci?=c{-E71eOfdh-(QB$t45Bdp8PqD%STm;Z#BX zj_U*4fRfZs-On)XikFbh*il-^9ZmqO8^&`~*@O($V%JV~_G*nYw4almJY-dQ0}LHH}%ZwdH-_)Z|^T&$#xyBHI= ztVnn&FWNId+Bd;>JI_zYqHiivJF01;?Y*?oR$aUu<4rMLIY5|PfX1h2NPY%>S<`-$ z&p|ovE%T@2f$&#TJD3_eoIyJfctJJGzH_TjOa7|qWXeXGANYEmWT@Ut8#OG6vL%xO z{X6%jA(*Yql-cKO0Ygk_>yq|-v{{tC)$DH;YT<`wwTnWdYXsAnkIRbivTk2u zH`Sb)@#JBZO#&iN6mhTGImSS#m^3 zNBjJiHzzy<_IHIJ(=(3o9-YaroL*L``93eV5~_xk;$InvbNy5DR!nXt4hcQ+#fYiE=U)hi#(TV%dN>zBL7etB+-q;`vw_LEHVgU6ZN5 zX70z7HTxS>8O-$5e=|PX>wG7NK+(}{wldQ9F;mM8Z@~3nob2oEDvy-(?kym8V4f^< z8+acHhqcMz&7vL86=;!ZVkqCK>27xO)pUh6zQW@J=!IsT>iG+q_< z{7^p650#V9{5$hQi5-N^o{!10uaKQTfu&iwu3&^TtQMCT_W$Fd#RA1`Y&pRo*uJ7W z^M4iisXeg#9S45^__cxX(`==cp)qXPlG^kw>Nb8SZwwj^3xf-YH93C6)fSxv`i@z{ z>HklV{>W^Qq~2uJlX|1G<7xE_a6$x1mXg38 zo?pwLmnl_L(u*_OzXA zDFGT9W^7W1a8tuOaurR}(Gs@OVAvcVNy;KoT6MJ1G2iURHCkC%Q;%oaGyVCkL<`h4_RHy@@VOMxzOCgg!mCZ z^*gBs7S*u?sC#ELM#YM^&ti5L4 zN#OC_PMa5zH;)I%Ft_bem_RT@r9qtqh(2^lkY%koj38Vie}9}J-p z{Rg>fv=uoi`T_P4@t_QA8FU1q5$(d!&82?eKzy-8%(GdLDrw5|c6E@?M)@eCk|vZd zpcmh5g}^1ds9J1BuS;H^iJNz#Lg_oQOI}7vQOT|2 zxD81J%7LPCMaSv?3_yyky|uiL8=3-B3icQlb*#TFS%9SFz@S%onWggdxlu(0iqr5L z$5WG3-CRQzTu!>xQ?j8*{~hgu#Refu(8U(3 zp)y|es$$eIh(S?i8=J<#==GJgmiS^nrHZ9HS^gob{YzBKMsoqpl0SgbB2!fuY-~aD zw<2#bxwQqU8O9cW>L)?+$?gk`w2pYsyybX%~MfKg9pk?6ECxPBV8o#upTkgCX# z5W;|tH@dAL534xTr&^O7^w0ck9YJ|jSt(Uk6jqH93=;8hqn?< z&}0*hNl*gnxrEe4*TR@t9GC&!YHU(#Y1ntb%&DCwO%qj3dZoQglZF09h5lTi&$6fb z?@y%sc}AAZzQx8C`d>(N+E+GUh$R{}xTPj;B2xi|A%n`p<+Rvo9w|Vwvk>1_ejF3? z3(bzoPx*|oH-e}J#Mr2f~ocIChv~LtqHGDC(h2HQe)-W#*7$Neq zmBUOc2VLzlzUsPq)T6S$dBVXOKg){_lNX^iV7v(`tp{HBPtO0pKc1Xi?~uIwf|G_8 z7M(oI=N~@el;TrQJALFCXP#AZ_BrQjqeh<>7<2yEapT>&C&UGx`qTvVnaH0>lc$tU zrO$=w&$Np!zT}eW^eLlHFnH;V%PzYdpDW5MDl2EwXI52p&FndI=gz(I$}8v1n?HZS zf&~i~hC;RSQ-?`v_fL+<@pwGBc<2|O+?-s5;gjoy%gyzAy+d+x5X^xH$?=MuT=kx7 z0dgrMhvFaxp~MTOIRQoj07;JAJ~=F51wznRT%2_6HM!o?hMng7)I~!sEm}A$Z?1pg z$-@g9mjFiQ)Qzk0b^R%)j=dmQF6QN5G3Uw=#bV_p2$Y|C0asstrVyu#Gw9Ny`ufQe zCQXFr;_>5VTwZqB^xBZ9s;R85SkbiVhUN1Cxb8asBcE7sA>PDQORt_S7Gb_coYf%C z7NgG901~BB>z0i^ujHJ7m@;h)VCrL<9x+^u5T}S@ajG~?OcP6x_eiluoFOh2H;7Bb znPQzdOH3Cfz!eeah@d!EXkwHYEv^zvMVYu-L`4k$3-mnkWieG;Xdza=_nTA1{pR^% z65RdfB=M?A-+#v@h4#Mg&1H=DdeGafsFt|SM-86OFeh&Eug?gL*l+KdqeKO` z;}IMAdnbHf6kh_LqMXzHW)!}!i2LmnP3(Km{HpjG`@VtiZz|}w5cdJ`ZS}T7{Zjr9 zDt{L1`Bl=|YRCSu?Yr9cIm^?Y5&Bv25Ni1>VA?87^Q-1Ta}Q1BJ3f_SrU-}@#- z)QIuoGvXHUDKSCJ6<3N)DC=zSaI&aEc{htsiz(s`F;Q%Tt+!s>DoRBhrN3QJX=jOV zh#4I3+x&f*_zv>ET;$-W$Q9VQF$CK@@^Po%NoZ(=kOIPbvKWSYKfeI1Tg8td7k*Az zD#oCmc8CYX=Q-?2vrUwXC(R+Ei7~8F816#doGflcjS#MT#J%D^PQOKbSKKBNVyDm{ zQ-n1;<=x`5oRaX}DJ*=Ch+P~?Wu=Ewt`wgG4{jD~@q{6H_j4%mrdrGs^Th(OP=rLS zs1u9CVzFA>1Q~9J4roDK+{G;#nUB|qYte$2iB@qvBQAOZ>w}4I5W-_W5J0sz*1L%)L^ZKYrn@ zwXwK%``Gix8t0GI?%JgZk7joWC1(%wm1v{Sd+=QC{ITOp&YpM2R_GE(gln~7KCR^J zrd2m0@s~m;*DYFnE^?FI$+GK*`G(|a)U#+M!+hr>k8`z)wP9t`FAWxH=W71pW9_cy zlIdDdn_d(QjFBDC^wWb{#^=svQCo}Boinb;Kinoq3yisNHgq!rPS?uj zTsfq`H}T>H6EB%jxj?(pGx3s&$_1lpYwPN?^J;77*UrOV?Yw#OO6pEV9`oicT)0rH z)wE%ukVb#VB!np{{2-8C@TAHAkMBPm__!P(y+=B)ht8;&R2jo^?G z4*P=qWM7PceK7*I#aZ|!%iF86uu{*x2E24GWyt3{w06fO;!F29bp8WhBBTw zTx7YOC|4-nHBXc)6#q0Yf|dMF^PlD={7t@p&lQSy%oF7bVXaSxWlrCp)D?;&=81BJ zu=`JxD->^=?k>oXAjT;l&%JFHinmO67i7r5crMM#<1OHN({y)1hGgTKVPm+=_Q^PJ z0$0j(cR_}vab2F3HVu)!6mY#^y1O7lvQt>^SMI$dGipIa#>o+V5Ag z?^WP>#dLQ;hNN-1`{vmgUjeT9aDOrB`;)ptaoD6$)?xFLyF!fBUN&DgL-_rqt`MU> z8u!(T|G|8P^-aG1Z&v6)zlGw@=81BJ;!oy@a)lVx(zuqsKdCDee>6{&D-{37JW;Mt z{J|W^)ei!5OH(L*Z=NVuh}nY%@sdg3pVSqK-^-C>({__5VLM4#ubVe%@@t3{7t@3;tItJ zW`8G3M&ZsfUOg!1UO*Y2H~Tw@fx?}*oc?S2;e8&ser28*cP+*+zhwLVm*y{F-_!TM z?+V3p=81AA*1kWHV})+>M7cuIWxBf{L)@(hx6m%g#51P53o^tll?=Piwo2stGr+aq zbaz3942)}87Owrkwa;{SL58^Fx*l`B*^qs}wbyiaL54U}+>n)iMaKJH;M#+Eem56n zND%Ydgs&+hoihi^zX!NFO?MY$h!xZMyUGRcjfh<+o;KZGkReVSgZrNbuBS|Q7i7rb z=_PbE)AHpIerCG6AVV_Kr{C6PVWQZDVz=q;f(%KgcJsA3FzyDf zpPKG2$PhOStqu%n_)mfBC#Jg#G9(>$FyDG${|RtCZo0c5Lk7b@u$yff9|x|-Om`P# zNPk>ycIr&nW57kDvqw+RIPJ$gPW!R>$sLW;eq{dW1dY>vXr3sS9`pTx$9(eJ8r5aK zS)l{{7K-niC(0Fy@0s5-7xOpyK8Y(7-!)H^D-@5IC(6n3(8DKaJoI1YiE@SFA+x`0 zXUmqto%ZhF{)f;Wzhm}yG8Kgnp56)l4sbnao+wu+zHRn*GCvA;<~+Fn+o0cNb(x ze_Rx@!3E#ff$M9gy9+YJiEE<^hBW+Z!1Yz^CvkH@hHS!qk#zjQd|w4F=MEO9Kgf`D z>Q5gB=l#I-71P}X8A7-|a~v!(zpnt-mrZvUWQdG+iv!yh__sRVWekd4D86L6yC6fX zm~Ow@GBAD#xV~t*yC6f{aJYwk5xBl!y1O7l+|#**egU{XZ@Rl6L)=nP*!GO_QOM_k z>vN{N3o>LNT$$lJfa`O>b)V_(f(*$_LvOeCqe#ZN54i3%-Cd9&{c%x9)CJ$Yz;%!5 z?t%=-#1(VFVa2!yxISyTyC6fXn1lbuk;i9&>u%HC1sRgYaoZp?QLMXxYnSQnf(%LH za`)YC=dcU7?lRq7kRkms?6gy7!tMgDJ56^NWJqRww>Mqkz7x0-W`8I9DhhY@T7&x& zz;%b|?t%S2EeHU*G|*j1sOsZ?i?Vsh5asu?*y*fO?MY$h!ubE-(A3VJ8<1*y1O7l2EuW7 zKU!}CuDI#$f(&uP_1S)SC{`S}Vy3$bG9(+UHD4jK>PPF(j6h=*cD zf$LV&-9Z}zlE!u4pqMCjq1a)%yC6f-xQ^%B0bJWncZYrp5O)lpbD?oNaBVZ)U63IX z*XLc*X6LdExVD<^4i*R?*(uWRU&zA06}YyT?k>oXblU#DFJ@rd0$jJ4?k>oXG=?u_ zq)dlfzFUCnGp4(P4F`x7GyVJJ0dRf>xIS&VyC6d(j;{=mKAi)_E)<(hcNb)cjD7#d zz_l5;Hks}&$Pj1FPXAZ?Vc!H?8%=i?WQa5UK>n{W-i^Su!E|>RT>yg7M?VVOac%&v zi0STv3`wW^#&K{)fGcdeyC6f-xH5g;?1woFTm>EB1F> z(_2vbZ3V6t)7=Fbl8*h*aj>-j*E-YP1sRgYmF@elEZpmWYpv<-f(*&VF!1|Y;JV3l zcR_{>l=k5)swj4$Xg1wlkRfSYkMv8OhLNusxYn5NF36C~_|CWQX5n4~T&qoY7i5St zwbTE-EKC%;P~2#`yC6fH=?C(EpYh%ZT&qlX7i7pl>HCMT0wxQ8)7=Fb(m&-uA=d)eHKw}@GGw5XSf|S3*fqd)wdwAH4C#;Sr&&0x z7*_+=Qq$c98Dhm8>~}X~UkY4TneHygkil?B*v}N5R{_@&)7=Fba(rA?j3vO;Xu7)~ zL#&wT-=7b_uSVc%Fx_2{A!!_g`F;WX4Zu}zy1O7l2Ey<}KkDj%Yq9C>f(#i5*OUEl zEe5Vdrn?I=1S|RdQn}+_1YC8dy9+YJJ)K)<9dOl}?k>oXbgHM1Ltia$g-mxBWJns< z@q8iRT4=hvAVZFaAq`&$TnkKh7i35}?(uvJfNQ?#?t%j zaLG9Hfa^-r-31x)@o`-VTysr#7i5SVu05{OF&DVznC>pf5I0qaEy1O7lvU4B!{UYF+X1co|Lo(C8I0%i?fa^lj-31wvi7Wkfupib7forPi z?t%9mLXaVQNV z-(=vLWV*W`Lo(wJ_BJW&Mvsqk8odH{Vt8>gM-I*|kHJaif!r0i)8lg7Aw%aR%Wylz z6r3xbjJsPd;xoomabL`*;HTe<6h697Cli}L>)nD%+?N6S#eCLv0`Q*CxTf)`<*_d5 z&cR7@E4}l#6sOUh@0Q<((0o^j6~p=+?ubQayVGtc{3qM*qio-KxNYY=+(mN|PK2L_ zlki0hITfei&%-?@>GWr@KM&u4zbW^Zn!E_@wbDPr7m5 z%G!HCaq{~S+(XyvAk`?>dAqMx|y>luWVYS0{<`O z`ybT*;lO`5@c%vs0!=L|MN?Z_Ynuo}TA&)%v^1?0in6qGh)q;BR%AcwQvy^Yq z!uqJeD0JHrw7tTk##ROispn6V?!eGD5u9_D@82v1+T0-&WRO1UM_;*%S z2woh^UshLDTR*3+io6R$i{~s{P%#hQP~F1$Axed-(<t?B+WwrGS8DISZ5W)FYEo3Se5)CuwEnHN! zEL2ffMW`2o;PeZHEUKDUHIpc-t5{G&WG$@2SH%KCZ{b_8aIpw1U$LTTeORn%Ssw|D z8`ie2xJj&NUAL~aWtsIt%6nN;OSoy6l8`6aiP zueIJm>6%s63)<}R$l9>=3Ye@;DwQ1vYmS0u1g-c2SBVW_9VforM zD>aI(DQT7{+L~^TtZ8eq2~d@9;ZUzyE9!Cm^0xM-HX>rhOELxrYYam5w%6KT1rrFCPA27y_xjafO0 z!kA7<4Rhk&eRU%fcZQ7)@uUOvF0uDDXN0VKN`%N|Vk(v)wX&LcWEnl-1 z@u)axdu=PiZB0#hn>+^0Sl%)=tf7}$iLbRy8pV+nu1QcU8oUIJ9@9P=2%1(z+S=D_ zXksd~abw!YgNZ7wwtQ_{)AE&@6@@DSnbFeP(sa47?B>Z$;T4l_;%c5KSt}-kTj9y_ zWn!RyLB;$k^i}9*7F7w^%PkXY+O?L}u-4ubwy3itRaS|%sujKMP+XTfrhQU)-Fk^_ z(ikYpmKAFwE1M>-B>|hfJQ8jt*re6M5p6Z4YF$el0!vh$W7;pn#E$I2H9JfjEv^}} zLVyu=&}GE4{t>5aau27_blS~sNlQ`j=M6niL)7!&oqWMi?E-qyE|@$N^J(Wf$VoE> zh}hsr1D*M-bIE6!Yvu0K8n?x={d z2pUO=E34`jRL!&MK2s9VR)wrjwZ2O zwdSE>k`j25GU_$kmr0S-f|qI63>7DhX;(jps)TjLx|PztrMWYj6Qen!QFzATnTm&Q z`kjR*gl8$96?oR;*@)*>Jh$Va|E%~$JP+Xc0iNA>_TqUS&!6zTj^|xGAK}TxgwaWO z{CLjBGZxQ8JQw1rz_S3)B0SgNS&3&2o>n{?@od4v{}mj+cjKXd9sVOc^bbgXi{~{w z@8cPQ2|@ZF&}ZNY;F*GFCZ1Y6*Wp=?XEmPncsAqNibu!uSv+6C^Bp|j$MbVMd-1%8 z=Z|<^#`7kgcky^JnOTU(hvy7Dqwt)M$L*tZ+qyOF?PN??9p)<76yepV+Oca^Il522 zIhr4JiL5uX75I-psfX=Y&cGw*wU&kUqP0G>=Yb{;mvC0>tN}vnTWmt-5K}o zs-KChU*FmW(=(GfNH6o}oV1B{N6Z5b?S=@IDQ)p&<}BYn2L0&#$&^vps3y^OTc3=6 zeSM^T^~4)8tSqV>Bwo3>W%;@_D`3a1Yi-+12EnJPGMBAD_Z)6oCULv{lZWG^C(C1y z)X)!u=P%Q54mY*CWsXALuzaOea+~PmCbF1=U-a`gOkUTzGP1U*eR8HTG1;;~9MSuE zsoRaPYEb<`yObhgq3n+PCCLa-?GNKiQZMK}mqXFq*aGVX4Fls7l6X1#A#@o@`9-By zQMilcc4757tYutNN?b&L1&o|^Fp1GiuidQO*aTA%l@6nR`AtolY|}w)Wh)teO)J-g z$;Plh($*LV!%Vm2WR+OvPeuLWg=E}dB4Fmc`dL-89H==D)lH{)pg|UhIMPpJ*Nwe` z-|1}y0>QtrEn}TH{`K^mGtxK8{(Y2IO$H-+cgvcU#&=W8ip?--+HHPhd)T@`17kgA z+XgU_TGz=iA{mO$NwX7&k}58)rCxb3j8tQ#C2<4U5hQ{z$JIbNjls4-T3b-JsNmL( zig{3jG%|*9q*A#Sg6Uqpyj|Pa)=B~jV{ei+R+>U%F?u7UJc*($Z@V#qP9WUQ%1DmU zwdLTMWpZ)iG-cA4T_$t^k@lu`Snf15o`AL;CJTy;d8;a^+f+k$*dP`uNCi!>SqYpa zFN*D?X2EECg3SrerYQ4WcDQmh)~=!QsSiS-x#aCq?Wfr<$7W6p4z19pWg_DNiq&yA z(>VRkBrb-dHQZF~UzwhEzf09MkYveRhAJfoec?Xt32K3H4tsR`(4m>{!J%R#7Hbc~ ze$w!JA)f5dI9kM2AM(Ql%lPcbc|8kKdz0+^Sj9H!melKyP zclxd9+bvJ_Z_Uh^L2X>kg8K2=g_ACvG*ufn9}S|7)T*4nD4jBCiUdu(c-_jI#tShC zH5p!h1AfD8@^`i6Yin9NDcrOvEGDglQ6nbZ(B3X4QD9rE43NK+vUF0Z1Q9^RnMCs* zYZ1(`WvmOQW=6|=vr<4%n+M)fuht)2AFyFiJl8p>=Tj z(EpKfuv+Y%<`JEf<=Qx<_u`>F0oEEeM2a)c2+ z+OJ^YyBB^38^oX9LV)9A!5%=E%%q40rN|QU6@@{FEFolV>{-jcg=EY26|!&t=j-!%-{xcfzx$x) zeSWs{+0N(QbM853lrHc8NT(ss)J@T?{ulALaT;HlGDNy{+iS!3QIx|Z+L@5wiB$bG zSJj5Fygxg}qK9;`hP^W7Wjw<$JUjaSU)NP-{i`J^Kiq;`TW@@2G2_%{dL2N)F*gIf z>)$M{OA23E%oJTmqL=1a4Bw0Q#k?uQ!*Lh8WIs8v{=V03_i?f(B zu!go#)CVg4d2l6zb&L7su#|ZIx|xf=7V4#*jPdV1_CDj!;FI|1_Wg?I97TPs{c*VQXrDpx&G9soGn0R3ynEnGt0*_{{qTj| z34?0yVX*jsh`#~l{X~3k(gXg_cIRMtOWnU3^U*2CI_|eieNr}Dno zSKg%`hrbxaSMYvA;MKhUD)2LS|4ZO?yx&ecmwPpf&c}BS{33jhz%R!S2z)W#EAZ>^ zV*+1>j|u#Cyw0|!_O8UMgZKyVh9F*T-x&B)_`)Fl3;6Yczlz@#_&fNTz(2xY5Bzid zlfb{le+Yalp3VB~U(KRF@D73VhcMm#PAS6?ivX z`(S4KNqlq=Ux@2`a3=mxd~y)qAJ;kHO#DE+R6C!0wTOjEE%R|ok^@%e#Iz!wHS z6<-o~Eq-0#v+$b&KM!9K_=WhrfnSC{8~9@U)xb5@8v?%t|2*(J@oxiPh5s7(BY5`q znf5n}p2S-P{yd%&_Y&2M7KmJ~Hs%@rI!PW7M@Yh;NS9 z1l~$***2anqFwOmL3}5?IEe3z*9G1UpBFiDV~}azZMf!q##iEFg7gpK^+EjO`0OD58T_2UU&1#A>0ifl_&-zrd%V9aNdGZ@ zd*GY#2Lt~Oe?0J?@uvd+3ttzw=K3dr?|^?1_)hp&f$xU@8h8%gT3`6wt68)^zF*)y z@VvnD@d1JN!iNRk7atS&(Rf+lL-ARGkH9YpyaZno_;~!mz^C9Z2CjXljz00P7SWk_ zL*VD)9|!3#z<&vRA^uz7SK&M8;Kse0Mc3i~3H)ZfRp58vZ34d!-#PGy@m&Ld0`Cy` zTD)W6>+n4Se+%Cy@DK3Db4ksjPw}on{MUG4;6LEK1OE*l7T09v+&|z`{&^=1o0Q*8v@t9UKgZaj5h>+ zJ+40YuNKiQye|#>PTtoCzDn=6&CeFmBY1J(PvUifKabZ3z8?QJsNdUobB@pat6B6R z-Y)RZ@WvDI&7yDc9zpz%_{O08-|@U4K1STU%t3h+i?+vS1-=75F>tLtM+e>xKY81D z#G(%PmpTA-uUNDvJ}mIg`24^Rz>5O!f$vWpGx@cabqL}M@jZj>^~Rski5>TfMSbx3 zfggzv415s2W8g#aKeqKpEII+-82Bjs;=oJsRN&+AH@A&fESiMt+;XNqRrstRz7`)9 z_!)RvkbXA)PvCR#=0W-k@b&zkDgRR5tIUjF$@{*6Yi-sX&BWh;-xrMEt@!1E--+ML z`N2&3`|ufoKZK77d=1_@@MrMNts3)d?Ozx8tN5zG-^MEg{{ZhA_$T;hLHS?eF9iM_ z-Vpdt_$NBS;a;)m5B%N0WAx=~fj7gS30$8Y_Xe)dhWfyF!!HPYPyEcl_r)g!-VGlf zcoHuPT<7LH1g^FJhoJp^@#}Rm&)RbozBur~cx~Xr@yi0&T)Qyv(fE0RPrzpdJ_Y}- zUE}tu@y~T~%e`Xmv*Mk=XA}QI;B)cE17Coz4E!>Dolcrtc~{}z1%565ao{)MOLgOz zrN0dy+o{p-#-{~-KRz<>NAM2D?4i2n!g6ZFS+e6|)J*toqN@T&uFgFh7bu6T9eo$$iI_rVti zegM8Q@PqJ4f#>4~1%3!VFYv?hTLV85A07BH_yD|Oc_`QcW`qg-C;PrURz;DGrIIJ=K zU3hN)M!z2~4g67jVc<{Ub%DQtbJvT#V$rMk#=zgfTOZLF{}G-Y_~-c6ApN)ak4HA9 z-->q|(CB~Qy9OTTyI~^m1pZr)zcpSwyfOc-_*W-1`X2Zbf$xhi3A{T#J@7m{75KsU z$`c#QI~@Nk@B#S7zz5^c1%3klVBn|VM~rGLuMA%u_+)&1;M4FSfzQNu4ZIF_C+A&} zv1lIN`jp1ec@zNl^7SEm1m|w?&L#8(RdH9+j{zCkOz%Rpl1-=+x5ahoepBwls`1HW< z#5YwoZf_O7A@E1=jY0Y+@t1=5=ka=epYpF*v>yK{@VD_Tfq#gv5BxK{A@FY$U(;CL zk9dsVw=(7bj{hFS$981>3cNY~P2jEY&jQ~C|1j`Q_}hVJwj^fpOMYkK_0lQKHiUG; zb9tY$ldegKMLjKEX>?dI2v=I4{)c}~Y~rJvq@UO%ej2{=bj}%3hRUzQH>UZHW_~f= zI-lQw&6nVrm$rXn6Tc0wn(lvZRC%lMI($FU%Adto@*{ay^S6|r_;Pa{3+51iq4|$^ z*uGe+fBTO3O7iDe`i^)N?dfHH0A5Ptbp5}!pT=9yBr#3 zd8{Fp|1`WI>3_dg{5g2$rT#cy9^}6gU*ET}yk&TO;1A$A9cVwtu_|v3K7_IUiDKk0 z;44$CiRSMresp8}CVV~fH8Vcn;5nr2!vAfeAO86X|5yJ}$@(*h;~bdEZ-py;Hi?ve zcf57AzsExHUDYUi>1~RC!t(kyi64Lu;dt`|(klOmCh5mDNng>#Ynu33P5eB(bvw>s zTKQKsiEliXCmm^SZ4!T16JLebQ{E17U*9M2jirtK`LdF?kxcV$k*eELmz zTjJCwZTR;qynWz5;tZ|DXGQiQ3-i+e6;>9d3`idfN&c0M1#P5W+ z?&j}3QvAMn6~5Tg_fkAN(=7Aj@XSl?8;Lg@=&#jM{>jSUqj5bu3$MqoA+6#s!Rrq4 z&(D!xr})5c#~T8F5Z@U1Gq^qgn4+${*YO-&*G;LsPw?Wvzr#xd{}ZnZ^6$XDSs%oA zz#H&|R$ezeH^p~2^8!5cYR#M8O}t+dAB3-G=VVEB^&5c~5Apjzn`pae5mo)LE_{wpNd6qAK1-_+{-+)Q4{%B~D{y99iXXLKiQvAnF;=jb} ziQl@N&;MhS_}}n`(>Nz&<;U6CxA6UJFY{gSx*Gp{BbC3O7K17Nelq!?a(k)&j=)#) z{Y>|!DgMMJ@wzswp2g;GTc0O4iJ#WQXW~Q7<(P-ERo?t2@eAdAxK6P6Wq3oKzsFAL zS1CW^)yd+YZj%2+ytE(JgjxK1czxiT@s0Qs7XJgjlEKJ~|DSjR$7_FDd^Q7L$9tN{ zc>gEb5icg5k0e+B9K2zGzh_VNOW`?3^Bb1M_rdFN-8-lF!OBluro5Bzx??y8Z1ZCx z9u4Oh#L}ORZydofgq61dA2PDhufwa3=QmJ`zZb9L_-%>#b9fH<*OJ6dr|<^iGVMDIZ#|l8cP;&3 zJgRa3x%?-|?WOWd@gZY;AF2E)csAksU!V6g@rA?>#T7pf&l$@(5A&sXUEp`)Rm>-r zOqYHQUXN$?zt{0C__-GUt@2M|PMBx&*_q4yr^+t>9(d-Z`sU*GQ&}Udzxw0FRsMQc z)$as+C7CnzE63MQXMZEF;%DGPm@Jw8o`+YR)0qDnd?9{_rN0{w`y+DqnDyW?_a0-T znKNs+SEagwJCF39+tI{nN&S=JAKgeXw#L7iP+3#SyDA@0WlA{}%HwX{h1E5c)eco- zt7h`1j2nlh)l!DrtbgW;zsrp~=-e{{d`uPh>}x}I-p7dB-ye}?kk z>EvUTv&1DYpIYvUq70rLLfllY-v{>K5#Eg(8|k9{lF`-WXN>c2t7@kCH!jH6c4~F) zw9I{YzDB;XB^8yU%YvG^-Yc2N&FLj$Cyt(`ZMjl=7*%VR77P-0979;x6i12D3?QS#4Ey^8X4<`9L=VO4Nc9HEP^6YFN%q zXFXC8w`bVh?B&(vW6CSaYi2fv`I~jT>ke{XE8RWgpR}TzWp$r;Rf&7&dXU?R=nD;b zk3oHl^7L;qS?E#ZkjfPbd+OgJ?(5*+0vD0%ljWwpS)fm6QNBFBWT@C&mpPg1$}4h( z7x~oru2fe}kxN_X@)x=^g|6U2m!{CADYR<3f|9wunn?@v+e-RvC4HrmZZpZGD=L^j970?|nG(FEJ$@5#u^Tp@+ zTBUtl+HWjvrTB`cePL-|O4`b_B$mNaT48<*X}<-lX1?D-zAr4_my++Z=lksWK6}39 z^QH8(41Rk(eZHQ)F4pLtK0{B-;7jT0%k1g5(9>rx@P!rlQVM)21-@nlzLWxAN}*3u z=#v!sd^YBO8YKN}O!^6u^s^=DCuh>npp?zdB9}eoCrK)4=C+XX^D>p|Dv|Q@IF;)v zk>ZOa1DDG6P4Tle<)?1ac9SAsYd=4eMZWTWMkj3-DRNzq^0P6ObS+9HU5BLnew9l3 zy7(!V@-rmmr$)-po|KvgDCMVA z%1^gc+BGwk_NAnK7x+n(^7Aw0=VvO0n zewL;DEK9i>xpupjxsGtnah>2=dAEJHJ-0Qt5m&ZrWr2pk&15%o zlWsb?Y3nAfo0e{_xGCZn#iW~%NjC$NZUXwnE$Jps(yegGq-I^xt!PQNyd~XyO1kOf z*S2Iz1D|x`o^%r=>1IUIO^>9TKuI^Z{KAxUGb`!lUeZmyq#Nd>8|7r4nv!(WC+TKS z(oLSEn;3q;{0RA>^uy$b&X1!X+mzdhQm*e(Zf{Asy(Hy&AmutE-|Y=)*P?t^+k7_* z({9a9yLP4Bu99}GOS^fWc5O_%JtFN|ns#~9uBB<$(zM%&(ypax*V43WY1*|k?OK|4 zEls2|1?8d5rgddQqs6M+wO zoy#=U`T<;Ao}ZC9m*tjrR2FGU}C#{#!o9Y;L1$9&jO~kD>LmrAd)>@ zFDHBY&GvK)eX^%p;ep#iPd9;+zAu0lyQFVBaGUjgkSy?}6!<;7z!z5N_whov9wZC> z9$e__S?JqW=%!n;(9N!7p<9%I+oubCYYW}jCkx%81Kef{-D1RNqia#2n<{)ndh>ND zv`V;7Oybo4z-RXjEA+!r=m((44@Z$-6^i__P~_KzBH!gjejJM2v`D4gyh!;^H~v+v z`HWMS6R5iIueQfWmWLb7l>eMarQBx^aT;Qvj~Srx;}g%Dt2JhUE@hq%%yZ35<@x0$ z&#y0ee&O+ZaVqV%koKGPyEB2V=(Ou{>Y#oB$!KiZxG}X8?7&RViHk~(95lGk;e$#B zA92L6{ycp0@IHh3m-qxcxMEthf9no@c$$e0{oH{?1<%It-@NAPa>rLh zTwPPftcb?jh)&PE8Lu)q7~@#KS3O@gr#RYGk| zwPmobaEFz?z)bCDjuzETqjj#c++zeX-Nea?X#CiUO7<-mnb`sd z)zhX;t>g@Ye_moVmd9>RbDhbNF}sW&-IvMYPjL8=sP-oeYAQ3w@h;d`+ovew=^oo2 zE98rCbJ53+ui!aF|H`We7g>OvLvSgpIFj~{CbCd=cs=sZ7ZW^tC=9VK3)ATNLOzMk zgoMK*&y1hmZ|h%|a9e-MT%Wp9wZMdh$TNlL{l5wc);Glk>L&)(t+XYqWV{}(82NwM z!zS zBW_#%p|478o7LmQ%BPmNXWFoM@Sxu5ZrRAhv&5H|(GZezipOu(@57W=MHCNj(RoGJ zSuTP)v%J(>3Gg{77J6rA52Ykf1mB8i+e}^@e=hOI#>w}49 z#L5b$7(L07X`SWL_>XB9;--0~iQ{+xsz2@KKOy}C8QqCBzsl6QVb*wRsN9FWJ>yHm z>ZYBW>;FoYnZ9loX7akZ<|n3tw2S%=AU}EKnk->h=HWyo|C+9u+}mQQNUfi}HI);1 zb`$49{qu-z?{d?)rm}*i!#}UiRa+ahy`iyya?W$=Q_-COcioU_c8P1Do3!q2LvryFHPktkSS%1acZY_evnZ8_kv27FK4@>%SBK@O#!xDqI{72qA9_ijLrCTT`-4c;> z%V2`v^zM`MK!&v{vBq#WH7li&xm*P!A*Q#ke1y(-x| z#-raw`sE*ye$oAg**r)>&%w!V9e4K&D&L`U%GEs}D)%^;IF9?#q3Wl5H4?-8{dTI) ztqLdKYN&iqiR61p>5ljJ!D&0X-%R!SLu|uSA6oc)x|cxtazyeS029NxpGv+{JUT%n zJB>mekaU%D>$SJq&4v_iL z0V;hDIq8c;()WQ0e&`!2C*6rq>2%Gt(oGjhHybAS4fYZ_=@vnyTP`QveIn^}t#g9k zX5W^x{ZB;Fe+iZTFFEO(xAf`Tzy#OY>Kb9CKLlz%9WQ4*Pm-%Xa@9vvePDv$e6Nzz zFUv*x|1PNXFUd*&wn+MoFu?^YzsgCU_>WKD3M&19a?%%yq(2-c_>Fk5IFQQ?M6OXi zM=a&pCgNzGaRW7PZkLaVqIaO?jjoAQx!=htSJybI+^ii*HdlJ>BhsvM4sm>C*65a>8_HK?naSxD`29WXZt9gaeP%I z-A9UV%RCSnS6z6bacCp9i$`6|j}~`{N44Uv@#q?n{bY^E5B}S?fjlHw&qGN};&*J3 zwN=+BsUBNJ>hYJtC$nv?&Cxp37A7jVhDc7je35jADtro;6Us?93hMK1qI~ywG)3$f zkEV&8;?Yc)m>Nar%BlZ+n6*dTU4xXhXFU3^;w!mkQ}Oiwo#G#{=su-moqJl&hvIAU zy;!g0d$WFW4NUevtmiPRGxJZrFY5wSeWpOQ^K`L_YlpQ)?%>#f6U}6@ZGx8pMFAxu6-YWbo_Fp;q&J=Uw(Oi*ycSDu) z0!(m0)|(0^{}*!l`v-A0*Vb5gpIz{}C^`zNyfGr*19Xi?;vBBSu<(mT+Omt zh2JMXk863vIXrJ$oEt^&i{~?s#d+)=Tr-iF&$ID#?F9ANPkuoZCCz(_DL%gxej(T5 zS-7s%Q22C_?VqFg1oN&JoYQ7_CF(M9)G6zBdr`iJC~@Eiy8bt2n+S0w*t#b3&OCQ#eY+KupoS(jnfA$;F~ z3BGgfX57;_7%Kg6^D<+FaVFIF(Anm5jh7m)G~NQWoqJ$*?|Af}g+FF|!T3JZ_CAA3 z|2!nj? z`_OoFk(_>5B=WuV9;p0phzq%ISmEURUS$2q@95bNy6wm*Z!*j-ibtne_#)$ViYH$i zE|ydJB4b~ua>tq1$SLPS^DpK7SRX|CIeQPv?@u{U>2jdT>tak9k20PBm2ZOiG~-1I zC;#Q<*BO@?*NB&Ke+pFnJ`_p+In3@AkG@kp+tnXy6t_3FfokX8^2_;Lf=Zun@x2vK zIRiw>9b(}p8A}yT{&Mqqa?)KVlJ9A#b#$GW6_4J5i7U8ILeA&hr%?HSRXFu(mgDp7 z4ONc=<&;-s;e9N87*zU^7Cu@eU4@0uFrH^z2vy#Hq2|qXBJ*aYNWMoz>bq8?J{zFQ z-(=xmiKP3m(At4^;h&EWEGz5Q{&-!ucaJE?tGO)_9iUDd&2qb>(IYUtzq* z_!w0EUNP^uk1ua;<2aao1naeVo$-9*ZN}%tE4hAB{4e*}K$ZKG#s6W<>g>zk17;t| zaTV15k~AMA4v0s?q1r#nSgr7*_}mqbW*xEcD~!vGtBo%kHyFP(erNo{xc$Cs`#O=8M)A*OM<9U z#!HP$jW-+bGCm32{4)PaPQU&H)vqnP`1*8(+J4gfFyk<&^rcXrW8*En!ngt|-^1q5 z8aEg>8NV`aG5&0fA7K4q>~1^?s@%cm!;NLe3aEBXGe1L4J?EG&fy#dy%swU_Jz@Mw z@mF)tMOV+Gq0)_%GcIF|Ghp^$KG%&apwg|Bv)`-{hwyzDD&I%Ozb$^ZZa#f~sQ8h_ zGcEiQ^To!SjVp}z86PsPF}`TrWZYtmclX=b4XU1dnRhexhuO!*qk-l_jpL0~#&eC= zK$UZY`3mDI5UcMkQkJl@l^k0c=w^f?(IOp@kEWU5R#EslbDyJS?apUUITj4ixjlZ~z z&ts^1jfN^`f=IdZMYekd)c579q3U^y@ot4PKOPdP&y!I3UY0YCo1x0xV&Q*^l;1wz zhwlNEzB5eR%)JM4;*YcV5ejE}Q;oBrj@z#lCoylt$?@n-u~j_!NUY%aT%5vwD^BHn zYfnhN-9`KmsCxB-SrgeF)O7Vc4zv)$L_xAL4ld38MMUI=TL7h-KZI$b2+r6T=&CDi$%+eONKQ{l9$ zLlGq37^w3=bLI5&74mY9&*ju7`(U=WoH{~{`|fh;la^DTQ;bz2^;xKR*4g4i@aY`S z!^CZzPl8&{W-FZaY=yX8JbFMpopBba*Wcm{)`MPfCdUOZaXafHRQ{m~C;zG9zVT?1 z;#Wk`c^1FG;_rp(*Y_1Zf#V~EpUL+Mn7D)UEaIKqOVXQg#v?~$KOG4ZcX2*K-h=&H zes>hjF~1n9zpfQIkMXv`>F4i^zre&w?)eh$A?{HApB0ZR!fr)#0mbt>& z{uq&TwFwR z$9XQPNPm|qoN-(rQqSea2cY(YC*<_sZ{oRecXMrG4d*fX;_S~mLG{-GFwwv~S2)`_ zR{jLvlPtbc{v^*6v-m6JPesvfQ1k9Sg|i;NYyOFOqMwi787jWWys!Br^9$s=u-}?L zZ~ndcKXUT#-Jk6;4+_Mm`F#*-KjqI7yZw2hIG1^4Tx@(8s-CYx<^Mu_CW^j=%Kw|l zdeHs|cs|=P9tK_eQR6TM< z>N&u|hZ|>De4WK#s&M+{S_{9~!dEGr?LKaN*Wy36_-_zc899ZDe?uZW5#o! z>T|cnKdx~4dGSCpz3$gvA%vkL6y^du&+-JlpiKi?ofqOuX6KwBK5jT zB;DQSKU=)+FIM~rk^IX=(ycUaFkdHPP+!mY1fHR z?K;(X4phAtm|taF4z>S0WWL$>gK@{06E@{7S}4q@UBqQBd)-EdFW>UuIlq@$r*<{=JO(BKzk_BJ*LU$mhyDsCr#2 zXFL`g?@~DRTL-nh@1fe)d=%+eU-pK|mn+hqULxr$75`t_X}nb7q+4R~PgwXH#*Z!j zON;+Y;nZuplYPE6BIS1yDZe|^{O>6;e*Hx1J;J<3B>#=Z`$f_}C6ew{sB*SKwQKuR ze7klP*Yf=bY96FSz8@T69AZ34oWeXaR*H-1Ka0Q0c!R~?X?#E=-Am$C9OoH-Ft$F` zhj%pgg{t2$sD8iO{1wGt9gp5u`19POZt?LF`~~j+hWZ}aO(b2R!e5M{Vd6_1_lPe? z(S_nGQS^+sj^FQL_BEWJm#^pNgHre^zY~bB@jE9}{2=-3Jg?4tmi!H_OAz1W_h0d? zD0&#G{x3s)zkf^Qd)QYN{wqxIwJU41FSip^`UB+G@_k5b#qqYtxQ(*-2~g|PS;qN_ zzmD}){&o~CmXq&Zv5ezKaVf_YihqaSTP^-Oi~q;sn~x#>UG6uB%AXd=cQRDH&W2g_ z@o1^}a;R~+SA37>BZ}{HU%$A4=f#O1MA0kahiq5;h<+9~(ywEExyM7zhYQVDng7px z*D@d9M_k75QN{}`{95sP+6z^`kD%(?d7RHzAl8ykbFMD_C69R{|k|P zx`spb+8OHj^iZ)gpNk^(IvJ|mJE79ur*P7}sBr4{w}rQwgj4>dQ0Z=!-@^EdvpH^t zD(??D`C3kf)T6CPJ-UiF^F0MB|4H&&#{-AlQDZZTj zpu!J_I<6gMoFd-D_g(Qe&J!7*w)pof{&x#+JJqMlHI9KQcb1%X-VIgn*DU-eg-?%1 zyHrBo-oB?nj^lfZly?kN{3Rlv4@*Vn-7=B&ejQXf9jEzp2SJrHOiub! zMACE5yi0!uRQfBR`eT{+3D-qJt>$Ps`2SM zK-K#YsPjqv<#Db*v-q`8+kH)B|9)5eob!v~7aUiK{Qp03a}@m~PUrYr{E{+j;a6OL z0o9HJpw4p~tnjZnJcT;`JYMX|_Z_ht->0C`UjUW<8mRO)DW3GJMAA2iq<;r0{fAK3 z-Fzx?{^A>Phj{c0)cU#ubyK=_Q0>lxN`I(G`v)kT_780VWM z3qI$}V>7+)4i(>BPQ80s_$Uj%OFo0|^TxMe;(zQ{XTa~Mhqxt*j)YpLD&*gDeW3UQ zpTFXdd{2PdPNy@eFZ)MVsPAKkhg&Z zF7rjafb(1;-y>VjA|LzXo=|?En8Wys?=spKlb-=UK;dU>);VRvA|tA2l`@pBDMUh-<|JpI0J(uy4J%Lo9kjY#EE*5&sj5 zHi$dM+~4I$w2DQa%3E{)f!K!e6nElx32|qhStqvTJd@Zi7X2wwFa1%^#4h}mKoQs9 zi4a>FTN~RN+l#yMIVe)!9FcnJI`c$({!Xg68|#WlIl0EP*dgZrPEBI>Sk%kHi^Y!o zPGLU4ILJ7}c)Zw&XFZCv<79D!cVt1~K z6%S0Aizj!#$L>2om{$gLo zU+fo)ipBo4<5+kE?GTTo9pV7mAs$6L#G`44IFNRTgJ_3%4DA>UkEI>rVA>%Lp&jB- z+94hni`t6AVo`gMn|3;i!k9XoonGc8Dj@4sjIi5KpEZ;wiL4Je7GY zmc*g~#zA6fEE-}wUL4Il7RNA;#j(s|u`Cvq87GS4Vo`-Sp6iN5`lCjiz%$6iiOgfM zoOvuxVjhc=na5%U^H`k1JQk-ikHt#nu~-$0mWrpvqIz)}^H^j%%SE<(hxtment5!# zTC9mhkBYU-V{tn3SUjD1EY4sZ6KArHiDxj6#WR`5;w)pwkntB6F#h62jK6p><1b#q z_=}e^{^CN$U%ZU*7cXc0#VZ(paS`JuUdi~0|79H#uVVbf#f+b^M!cHw6R%0 z`>*&2`>*&Y`>%13Ncth-W8CLwK0FFwimi%&8BBI#?yrx}0o z8OC3Hmhl&#WB(P`GXCQ8jK6WA_yXfEzR38CFR}lMFEjq)D~!Lmj{R3$&;BdE%J_?~ zG5+G~jKBB>`>*&W<1fC&_=|6||BCN0{^Gmrzv6q0zxY1mFK%G}HEt9?VEn}o*?+~4 z7=Pmy<5rRUzZ(BEM#uT^Y@>efP`Z}J*2cC*{r;i&jw0L1G4E{bV(f0rHKvV)#$Lu^ zV?W~n;~?V@Yu#xmnXV}(fls*E)jKEpW6SZADLoNv6yxX`%BxY)Qsx|Vm#hB!g#W=)L3SmDAN84aWmsDe#!nXe#QQ8oMo&t&N0q6USwQoTx48qTq=Ie z_?s^?E;rs`TxncoTy1>R*kF9xxYqcRalP>k<2%L;#*M~Ljhl_%h_ru;Nc*>1_^-x4 zjnVPGU$TwOjV+C>jctwXjU7eWpCf+5`Y(RV`fuzm{*U!v{EqeCSSXUdm$-%T7r$ry z7k^;=7k`XJgT$?@|Kd-q|KiVle-nRU{TF}b^NUxk8ONGN4zHZIG`2RjHMTc)H0BsP z8@m|08*`0mW1+E^vDnzpIKVi_$j7X!57l)XVLaJbYAiEOG*%d^j5Wp?##zQX;~e9B z<3+}W#zn@(#-+x3<1*uN;~mD8##P4E#z&0}#;1*IjV~G38{aU#W87feX#CW;+4zld zi*c**SL2_?h$-O4-`L#P(%9PA*4Wcap_permitted, cap_bset); + new_permitted = cap_intersect (bprm->cap_permitted, vx_current_bcaps()); working = cap_intersect (bprm->cap_inheritable, current->cap_inheritable); new_permitted = cap_combine (new_permitted, working); -- 2.43.0