From e42d188a44e6d5fc26607ac92689285a0802fb51 Mon Sep 17 00:00:00 2001 From: Eden Federman Date: Wed, 16 Nov 2022 12:52:35 +0200 Subject: [PATCH] eBPF based instrumentation --- CONTRIBUTING.md | 14 +- Dockerfile | 11 + Makefile | 21 + cli/main.go | 90 + docs/design/context-propagation.md | 141 + docs/design/manual-instrumentation.md | 30 + docs/getting-started/README.md | 114 + docs/getting-started/deployed_apps.jpg | Bin 0 -> 10461 bytes .../emojivoto-instrumented.yaml | 247 + docs/getting-started/emojivoto/emoji.yml | 61 + .../emojivoto/kustomization.yml | 6 + docs/getting-started/emojivoto/ns.yml | 4 + docs/getting-started/emojivoto/vote-bot.yml | 32 + docs/getting-started/emojivoto/voting.yml | 61 + docs/getting-started/emojivoto/web.yml | 61 + docs/getting-started/jaeger.yaml | 36 + docs/getting-started/jaeger_traces.png | Bin 0 -> 122278 bytes docs/getting-started/leaderboard_trace.png | Bin 0 -> 165672 bytes docs/getting-started/vote_trace.png | Bin 0 -> 65384 bytes docs/how-it-works.md | 51 + go.mod | 35 + go.sum | 489 ++ include/alloc.h | 99 + include/arguments.h | 64 + include/common.h | 124 + include/go_context.h | 37 + include/go_types.h | 99 + include/libbpf/LICENSE | 1 + include/libbpf/LICENSE.BSD-2-Clause | 32 + include/libbpf/LICENSE.LGPL-2.1 | 503 ++ include/libbpf/bpf.h | 293 + include/libbpf/bpf_core_read.h | 444 ++ include/libbpf/bpf_endian.h | 99 + include/libbpf/bpf_helper_defs.h | 4046 ++++++++++++ include/libbpf/bpf_helpers.h | 227 + include/libbpf/bpf_tracing.h | 460 ++ include/libbpf/btf.h | 403 ++ include/libbpf/libbpf.h | 922 +++ include/libbpf/libbpf_common.h | 42 + include/libbpf/libbpf_legacy.h | 59 + include/libbpf/libbpf_version.h | 9 + include/libbpf/skel_internal.h | 123 + include/libbpf/xsk.h | 322 + include/span_context.h | 74 + include/utils.h | 77 + pkg/errors/errors.go | 23 + pkg/inject/data.go | 35 + pkg/inject/injector.go | 118 + pkg/inject/offset_results.json | 5510 +++++++++++++++++ .../allocator/allocator_linux.go | 58 + pkg/instrumentors/api.go | 28 + .../github.com/gorilla/mux/bpf/probe.bpf.c | 106 + .../bpf/github.com/gorilla/mux/probe.go | 210 + .../google/golang/org/grpc/bpf/probe.bpf.c | 190 + .../bpf/google/golang/org/grpc/probe.go | 248 + .../golang/org/grpc/server/bpf/probe.bpf.c | 219 + .../google/golang/org/grpc/server/probe.go | 258 + .../bpf/net/http/server/bpf/probe.bpf.c | 111 + .../bpf/net/http/server/probe.go | 210 + pkg/instrumentors/bpffs/bpfsfs.go | 19 + pkg/instrumentors/context/inst_context.go | 27 + pkg/instrumentors/context/span_context.go | 22 + pkg/instrumentors/events/event.go | 31 + pkg/instrumentors/manager.go | 114 + pkg/instrumentors/runner.go | 105 + pkg/log/logger.go | 33 + pkg/opentelemetry/controller.go | 213 + pkg/opentelemetry/id_generator.go | 66 + pkg/process/analyze.go | 205 + pkg/process/args.go | 47 + pkg/process/discover.go | 116 + pkg/process/module.go | 201 + 72 files changed, 18583 insertions(+), 3 deletions(-) create mode 100644 Dockerfile create mode 100644 Makefile create mode 100644 cli/main.go create mode 100644 docs/design/context-propagation.md create mode 100644 docs/design/manual-instrumentation.md create mode 100644 docs/getting-started/README.md create mode 100644 docs/getting-started/deployed_apps.jpg create mode 100644 docs/getting-started/emojivoto-instrumented.yaml create mode 100644 docs/getting-started/emojivoto/emoji.yml create mode 100644 docs/getting-started/emojivoto/kustomization.yml create mode 100644 docs/getting-started/emojivoto/ns.yml create mode 100644 docs/getting-started/emojivoto/vote-bot.yml create mode 100644 docs/getting-started/emojivoto/voting.yml create mode 100644 docs/getting-started/emojivoto/web.yml create mode 100644 docs/getting-started/jaeger.yaml create mode 100644 docs/getting-started/jaeger_traces.png create mode 100644 docs/getting-started/leaderboard_trace.png create mode 100644 docs/getting-started/vote_trace.png create mode 100644 docs/how-it-works.md create mode 100644 go.mod create mode 100644 go.sum create mode 100644 include/alloc.h create mode 100644 include/arguments.h create mode 100644 include/common.h create mode 100644 include/go_context.h create mode 100644 include/go_types.h create mode 100644 include/libbpf/LICENSE create mode 100644 include/libbpf/LICENSE.BSD-2-Clause create mode 100644 include/libbpf/LICENSE.LGPL-2.1 create mode 100644 include/libbpf/bpf.h create mode 100644 include/libbpf/bpf_core_read.h create mode 100644 include/libbpf/bpf_endian.h create mode 100644 include/libbpf/bpf_helper_defs.h create mode 100644 include/libbpf/bpf_helpers.h create mode 100644 include/libbpf/bpf_tracing.h create mode 100644 include/libbpf/btf.h create mode 100644 include/libbpf/libbpf.h create mode 100644 include/libbpf/libbpf_common.h create mode 100644 include/libbpf/libbpf_legacy.h create mode 100644 include/libbpf/libbpf_version.h create mode 100644 include/libbpf/skel_internal.h create mode 100644 include/libbpf/xsk.h create mode 100644 include/span_context.h create mode 100644 include/utils.h create mode 100644 pkg/errors/errors.go create mode 100644 pkg/inject/data.go create mode 100644 pkg/inject/injector.go create mode 100755 pkg/inject/offset_results.json create mode 100644 pkg/instrumentors/allocator/allocator_linux.go create mode 100644 pkg/instrumentors/api.go create mode 100644 pkg/instrumentors/bpf/github.com/gorilla/mux/bpf/probe.bpf.c create mode 100644 pkg/instrumentors/bpf/github.com/gorilla/mux/probe.go create mode 100644 pkg/instrumentors/bpf/google/golang/org/grpc/bpf/probe.bpf.c create mode 100644 pkg/instrumentors/bpf/google/golang/org/grpc/probe.go create mode 100644 pkg/instrumentors/bpf/google/golang/org/grpc/server/bpf/probe.bpf.c create mode 100644 pkg/instrumentors/bpf/google/golang/org/grpc/server/probe.go create mode 100644 pkg/instrumentors/bpf/net/http/server/bpf/probe.bpf.c create mode 100644 pkg/instrumentors/bpf/net/http/server/probe.go create mode 100644 pkg/instrumentors/bpffs/bpfsfs.go create mode 100644 pkg/instrumentors/context/inst_context.go create mode 100644 pkg/instrumentors/context/span_context.go create mode 100644 pkg/instrumentors/events/event.go create mode 100644 pkg/instrumentors/manager.go create mode 100644 pkg/instrumentors/runner.go create mode 100644 pkg/log/logger.go create mode 100644 pkg/opentelemetry/controller.go create mode 100644 pkg/opentelemetry/id_generator.go create mode 100644 pkg/process/analyze.go create mode 100644 pkg/process/args.go create mode 100644 pkg/process/discover.go create mode 100644 pkg/process/module.go diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6abf71f8d..0f0ddc538 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -13,6 +13,14 @@ Comments and questions about the project can be posted in our [slack channel](ht ## Development +### Compiling the project + +Linux users can build this repository by running: +`make build` + +Windows/Mac users will need to compile this project inside a docker container by running: +`make docker-build IMG=otel-go-agent:v0.1` + ### Issues Questions, bug reports, and feature requests can all be submitted as [issues](https://github.com/open-telemetry/opentelemetry-go-instrumentation/issues/new) to this repository. @@ -27,9 +35,9 @@ If you are still working to finalize your PR, but would like to publish somethin Next, your PR needs to be reviewed and approved by the [project approvers](https://github.com/orgs/open-telemetry/teams/go-instrumentation-approvers). It will be ready to merge when: -* It has received two approvals from project approvers (at different companies). -* All feedback has been addressed. -* All open comments should be resolved. +- It has received two approvals from project approvers (at different companies). +- All feedback has been addressed. +- All open comments should be resolved. A [project maintainer](https://github.com/orgs/open-telemetry/teams/go-instrumentaiton-maintainers) can merge the PR once these conditions are satisfied. It is up to project maintains to ensure enough time has been allowed for review of PRs. diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 000000000..37902055f --- /dev/null +++ b/Dockerfile @@ -0,0 +1,11 @@ +FROM fedora:35 as builder +RUN dnf install clang llvm make libbpf-devel -y +RUN curl -LO https://go.dev/dl/go1.18.linux-amd64.tar.gz && tar -C /usr/local -xzf go*.linux-amd64.tar.gz +ENV PATH="/usr/local/go/bin:${PATH}" +WORKDIR /app +COPY . . +RUN make build + +FROM gcr.io/distroless/base-debian11 +COPY --from=builder /app/otel-go-instrumentation / +CMD ["/otel-go-instrumentation"] diff --git a/Makefile b/Makefile new file mode 100644 index 000000000..0c9b5924b --- /dev/null +++ b/Makefile @@ -0,0 +1,21 @@ +# Obtain an absolute path to the directory of the Makefile. +# Assume the Makefile is in the root of the repository. +REPODIR := $(shell dirname $(realpath $(firstword $(MAKEFILE_LIST)))) + +# Build the list of include directories to compile the bpf program +BPF_INCLUDE += -I${REPODIR}/include/libbpf +BPF_INCLUDE+= -I${REPODIR}/include + +.PHONY: generate +generate: export CFLAGS := $(BPF_INCLUDE) +generate: + go mod tidy + go generate ./... + +.PHONY: build +build: generate + CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o otel-go-instrumentation cli/main.go + +.PHONY: docker-build +docker-build: + docker build -t $(IMG) . diff --git a/cli/main.go b/cli/main.go new file mode 100644 index 000000000..b9df48a30 --- /dev/null +++ b/cli/main.go @@ -0,0 +1,90 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package main + +import ( + "fmt" + "os" + "os/signal" + "syscall" + + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/errors" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/opentelemetry" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/process" +) + +func main() { + err := log.Init() + if err != nil { + fmt.Printf("could not init logger: %s\n", err) + os.Exit(1) + } + + log.Logger.V(0).Info("starting Go OpenTelemetry Agent ...") + target := process.ParseTargetArgs() + if err = target.Validate(); err != nil { + log.Logger.Error(err, "invalid target args") + return + } + + processAnalyzer := process.NewAnalyzer() + otelController, err := opentelemetry.NewController() + if err != nil { + log.Logger.Error(err, "unable to create OpenTelemetry controller") + return + } + + instManager, err := instrumentors.NewManager(otelController) + if err != nil { + log.Logger.Error(err, "error creating instrumetors manager") + return + } + + stopper := make(chan os.Signal, 1) + signal.Notify(stopper, os.Interrupt, syscall.SIGTERM) + go func() { + <-stopper + log.Logger.V(0).Info("Got SIGTERM, cleaning up..") + processAnalyzer.Close() + instManager.Close() + }() + + pid, err := processAnalyzer.DiscoverProcessID(target) + if err != nil { + if err != errors.ErrInterrupted { + log.Logger.Error(err, "error while discovering process id") + } + return + } + + targetDetails, err := processAnalyzer.Analyze(pid, instManager.GetRelevantFuncs()) + if err != nil { + log.Logger.Error(err, "error while analyzing target process") + return + } + log.Logger.V(0).Info("target process analysis completed", "pid", targetDetails.PID, + "go_version", targetDetails.GoVersion, "dependencies", targetDetails.Libraries, + "total_functions_found", len(targetDetails.Functions)) + + instManager.FilterUnusedInstrumentors(targetDetails) + + log.Logger.V(0).Info("invoking instrumentors") + err = instManager.Run(targetDetails) + if err != nil && err != errors.ErrInterrupted { + log.Logger.Error(err, "error while running instrumentors") + } +} diff --git a/docs/design/context-propagation.md b/docs/design/context-propagation.md new file mode 100644 index 000000000..86f572a71 --- /dev/null +++ b/docs/design/context-propagation.md @@ -0,0 +1,141 @@ +# Design Proposal: Context Propagation + +## Motivation + +Context propagation is a mechanism that allows tracing to be propagated across process boundaries. Usually, propagation is done by passing traceId and spanId of the current span to the next process. Those identifiers are passed as headers over the requests and responses. + +The examples in this proposal describes context propagation over HTTP/gRPC formatted as [W3C Trace Context](https://www.w3.org/TR/trace-context/). However, the implementation should support other transportation methods and header formats. + +## Overview + +The context propagation implementation should support the following: + +1. **Reading headers**: If the current transaction is a part of an existing distributed trace, the request / response should contain headers according to the chosen format. +2. **Storing the current span context**: data about the current span should be stored in an eBPF map to be used by the next process. The suggested data structure is a map from goroutine id to an object similar to [trace.SpanContext](https://pkg.go.dev/go.opentelemetry.io/otel/trace#SpanContext). The current span map should always hold the current running span. Entries can be written by one of the following: + +- Header propagator (the use case described in this document) - for remote spans created outside of the current process. +- Automatic instrumentation - for spans created by the automatic instrumentation agent. +- Manual instrumentation - for spans created manually by the user. + +3. **Writing headers**: the implementation should get the current span from the eBPF map and propagate it to the next process by adding new headers to the request / response. + +Notice that currently, the automatic instrumentation correlates spans to the same trace if they are being executed by the same goroutine. In the future we plan to implement a more robust tracking of the goroutine tree to support traces from multiple goroutines. As part of this planned change, the current implementation of context propagation will also have to be changed (different key in the current span map). + +## Example walkthrough + +In order to better understand how all the different pieces fit together, we will walk through an example. The example is based on the following scenario: + +```mermaid +graph LR + A[Application A] -->|HTTP| B(Target Application) + B --->|HTTP| A + B -->|gRPC| C(Application B) + C --->|gRPC|B +``` + +The target application is a simple HTTP server. For every request it receives, it sends a gRPC request to another application. The gRPC response is then sent back to the client. We assume that applications A and B are already instrumented. + +#### Step 1: Read request headers + +The current HTTP server instrumentation is attached to the following function: + +```go +func (mux *ServeMux) ServeHTTP(w ResponseWriter, r *Request) +``` + +The instrumentation is already reading fields from the `http.Request` object. Getting the headers should be a matter of tracking the `Header` field in [offsets-tracker](https://github.com/keyval-dev/offsets-tracker) and reading the values according to W3C Trace Context specification. + +#### Step 2: Store the headers as current span in the SpanContext map + +Update the SpanContext map with key equals to the current gorountine id and value equals to SpanContext object (traceId and spanId). + +#### Step 3: Create an HTTP span + +Current implementation of HTTP server instrumentor already creates a span for the request. The span traceId and parent spanId should be set according to the values in the eBPF map. + +#### Step 4: Update SpanContext map + +Update the map with the newly created HTTP span as the current span. + +#### Step 5: Add headers to gRPC request + +In general, the context propagation implementation should attach a uprobe to a function that writes the headers to the outgoing request. +For example, in gRPC we may choose to attach a uprobe to the following function: + +```go +func (l *loopyWriter) writeHeader(streamID uint32, endStream bool, hf []hpack.HeaderField, onWrite func()) error +``` + +The context propagation implementation will use the kernel helper function `bpf_probe_write_user()` in order to modify the `hf` array according to the current span (taken from the eBPF map). Notice that there might be a better choice for the target function, a further investigation is needed. + +#### Step 6: Read headers from gRPC response + +The implementation will attach a uprobe to a function that reads the headers from the incoming response. Look for headers with keys according to the W3C Trace Context specification. In gRPC example, we may choose to attach a uprobe to the following function: + +```go +func decodeMetadataHeader(k, v string) (string, error) +``` + +This function is located at the `http_util.go` file (again, there may be a better target function, a further investigation is required). + +#### Step 7: Update current span map + +Similar to step 4, update the current span map with the headers from the previous step. + +#### Step 8: Write headers to HTTP response + +Similar to step 5, the implementation will attach a uprobe to the function that writes the headers to the response. +A possible candidate may be: + +```go +func (h Header) writeSubset(w io.Writer, exclude map[string]bool, trace *httptrace.ClientTrace) error +``` + +## Proof of Concept + +The [following application](https://github.com/edeNFed/ebpf-write-poc) is a test program that demonstrates changing go function arguments via eBPF instrumentation: + +```go +func worker(str string) { + headers := make(map[string]string) + headers["X-Request-Id"] = str + + fmt.Printf("The Headers are: %s\n", headers) +} + +func main() { + for i := 0; i < 10; i++ { + worker(fmt.Sprintf("request number: %d", i)) + time.Sleep(2 * time.Second) + } +} +``` + +By running a [modified version](https://github.com/edeNFed/opentelemetry-go-instrumentation/tree/ebpf-write-poc) of the automatic instrumentation, we can see that the headers are set by the instrumentation successfully: + +``` +❯ go run main.go +The Headers are: map[X-Request-Id:request number: 0] +The Headers are: map[X-Request-Id:request number: 1] +The Headers are: map[X-Request-Id:request number: 2] +The Headers are: map[X-Request-Id:request number: 3] +The Headers are: map[X-Request-Id:request number: 4] +The Headers are: map[X-Request-Id:ebpf header value] <--- After instrumentation launched +The Headers are: map[X-Request-Id:ebpf header value] +The Headers are: map[X-Request-Id:ebpf header value] +``` + +## Safety Considerations + +Modifying function arguments has to be done with care. The automatic instrumentation has all the data required in order to fully understand the stack state and safely modify the arguments: + +- Strcutres and data fields offsets (tracked over time by version) +- Compiled go version +- CPU architecture + +The process of implementing context propagation will include thorough tests to ensure that the implementation is safe. + +## Future Work + +- Support more propagation formats like B3 and Jaeger. +- Configure propagation via environment variables. diff --git a/docs/design/manual-instrumentation.md b/docs/design/manual-instrumentation.md new file mode 100644 index 000000000..9fd0e1dcc --- /dev/null +++ b/docs/design/manual-instrumentation.md @@ -0,0 +1,30 @@ +# Design Proposal: Integration with Manual Instrumentation + +## Motivation + +Users may want to enrich the traces produced by the automatic instrumentation with additional spans created manually via the [OpenTelemetry Go SDK](https://github.com/open-telemetry/opentelemetry-go). + +## Overview + +Integration with manual instrumentation happens in two steps: + +1. **Modify spans created manually** - attach a uprobe to the function that creates the span, override the trace id and parent span id with the current active span (according to the eBPF map described in the context propagation document). +2. **Update active span map** - After the span is created, update the eBPF map with the new span as the current span. This step is needed in order to create traces that combines spans created manually, automatically (via other instrumentors) and remotely (via context propagation). + +This implementation depends on changes described in the [Context Propagation design document](context-propagation.md) and can't be implemented before context propagation is implemented. + +## Instrumenting OpenTelemetry Go SDK + +The following function (located in `tracer.go` file) may be a good candidate for instrumenting the creation of manual spans: + +```go +func (tr *tracer) newRecordingSpan(psc, sc trace.SpanContext, name string, sr SamplingResult, config *trace.SpanConfig) *recordingSpan { +``` + +By overriding `psc.spanID` and `sc.traceID` to match the current span according to the eBPF map, the function will create a span that is a child of the current active span. + +## Future Work + +### Use single exporter + +Applications instrumented both manually and automatically will export the produced spans via two different exporters. One created manually by the user and another one created in the instrumentation agent. This is not damaging the combined traces, but it is not ideal. In the future, we may want to implement an exporter that communicates with the instrumentation agent (via mechanisem like Unix domain socket) and exports the combined traces over a single connection. diff --git a/docs/getting-started/README.md b/docs/getting-started/README.md new file mode 100644 index 000000000..0fc954240 --- /dev/null +++ b/docs/getting-started/README.md @@ -0,0 +1,114 @@ +# Getting Started with Go OpenTelemetry Automatic Instrumentation + +In this tutorial, we will walk through how to get started with instrumenting the [emojivoto](https://github.com/BuoyantIO/emojivoto) application, a well known microservice example running locally on a Kubernetes cluster. + +## Before you begin + +The following tools are required to run this tutorial: + +- [Kind](https://kind.sigs.k8s.io/) to run a local Kubernetes cluster with Docker container nodes. +- [Kubernetes CLI (kubectl)](https://kubernetes.io/docs/tasks/tools/install-kubectl/) to run commands against Kubernetes clusters. + +## Creating the Kubernetes cluster + +Create a new local Kubernetes cluster, by running the following command: + +```shell +kind create cluster +``` + +## Deployment + +The Kubernetes cluster will run the emojivoto applications and a jaeger UI for visualizing the OpenTelemetry traces: + +![Deployed Applications](deployed_apps.jpg) + +The different emojivoto applications are communicating via gRPC. Instrumenting those applications would allow us to view the gRPC requests between the applications. + +### Deploying the emojivoto application + +Run the following command: + +```shell +kubectl apply -k github.com/open-telemetry/opentelemetry-go-instrumentation/docs/getting-started/emojivoto +``` + +### Deploying Jaeger UI + +Install Jaeger UI by running: + +```shell +kubectl apply -f https://github.com/raw/open-telemetry/opentelemetry-go-instrumentation/master/docs/getting-started/jaeger.yaml -n emojivoto +``` + +This command installs Jaeger as a new Deployment and an additional Service that we will use later for accessing the Jaeger UI. + +In a real world application, you would probably want to send the tracing data to [OpenTelemetry collector](https://github.com/open-telemetry/opentelemetry-collector) instead of directly to Jaeger. + +## Instrumentation + +Apply the automatic instrumentation to the `emoji`, `voting`, and `web` applications by executing the following command: + +```shell +kubectl apply -f https://github.com/raw/open-telemetry/opentelemetry-go-instrumentation/master/docs/getting-started/emojivoto-instrumented.yaml -n emojivoto +``` + +## Perform actions on the target Application + +Now all that left to do is to perform some actions on the target application that will cause the creation of detailed distributed traces. + +Port forward to the frontend service: + +```shell +kubectl port-forward svc/web-svc 8080:80 -n emojivoto +``` + +Go to `http://localhost:8080`, and click the **view the leaderboard** button. + +## Viewing the traces + +First, port forward to the Jaeger UI: + +```shell +kubectl port-forward svc/jaeger 16686:16686 -n emojivoto +``` + +Then, open the Jaeger UI in your browser by navigating to http://localhost:16686/ + +After selecting the `emojivoto-web` service, you should see the following traces: +![Traces](jaeger_traces.png) + +Let's start with a simple trace, click on one of the `/api/vote` traces, you should see something like the following: +![vote_trace](vote_trace.png) + +A few things worth noticing in this trace: + +- **In process context-propagation**: We can see that the `web` application got an HTTP request (the root span) which caused two sequential gRPC requests to the `emoji` and `voting` services. +- **Cross process context-propagation**: The automatic instrumentation adds the relevant headers to gRPC / HTTP requests in order to make traces distributed across processes. In Jaeger, different applications are marked in different colors. +- **Extremely low overhead**: The entire trace took 3.1 milliseconds to complete. This show that using eBPF for instrumentation adds extremely low overhead. +- **Following OpenTelemetry Specifications**: You can click on any span in the trace to view the different attributes. All the spans produced by the automatic instrumentation follows the OpenTelemetry specification and therefore will work with any OpenTelemetry compatible backend. + +Now we will view a more complex trace, search for traces for the `/api/leaderboard` endpoint. +You can quickly find them by clicking on the points with the highest duration in Jaeger's main screen. +![leaderboard_trace](leaderboard_trace.png) +We can get a pretty good understanding of how the leaderboard feature works by looking at this trace: + +- First, the web service will perform a gRPC request to the `voting` service to get a list of the available emojis. +- Second, The web service will loop over the received list of emojis and for every item on the list it will perform a gRPC request to the `emoji` service to get the amount of votes for the current item. +- As you can see this happens sequentially, which is one of the reason the leaderboard endpoint takes about 150ms to complete. + +### Notice that we did not change any application code to get those traces, we are using the exact same containers from the emojivoto project. + +## Next Steps + +The easiest way to apply this automatic instrumentation for any application is by using a control plane such as [Odigos](https://github.com/keyval-dev/odigos). + +For more details visit the [Odigos website](https://odigos.io). + +## Cleanup + +Delete the Kubernetes cluster: + +```shell +kind delete cluster +``` diff --git a/docs/getting-started/deployed_apps.jpg b/docs/getting-started/deployed_apps.jpg new file mode 100644 index 0000000000000000000000000000000000000000..8b7a15f698e245842c35e6fd84a301b04fcde83a GIT binary patch literal 10461 zcmb_?2UHX5+U`(9K)Mt|6+*94rL%=l5}I@gO(~Ip^xk#Ty9ogdReA^M9h8oM^o}S+ zq$pCQi15dAe$PI4{pYT`|F!Nrnaq>td)xQU_svXZ=4$ThBR~aHgQ@{|cmRNhTY#%o zd|s%Eiq(C6T{Wnd>OUIrZvi+VyaNDE&Ytf2>dLntn8I)W;(p5`8xPmt_&;oMe!tKB z@(uu#LjR%t|3#75+IiUEl=g6|r#mh~(+VINOdPn^!cFMS(V_g{Dkhvl7~c>Rj?OMYccX6I~VfZIO6t;~Q2pbw}6$~gT0 zRsO1{OD+IN9|Hiv^S?N2EC4iy1Hi3?zc|j906-ZA01czAkK7;qBN;;6H$DOZ00%_? zKyC^EH^%^g)a-Ynf7$-EFa9rmy^XVB#`V($w>$=(0CvD_017w*Hh?e=i2-*2Q9$Zy z5l{gL@bQ0ra6*XtTqC}Ajgasf>GkVG#AKvoWH(4}+#si*p(3ZCrnqr~ik^!4CM_Ku z9T_FVEqdBpG_-WIzntI^;A{x5kzBh*LQ8&woc4b$SFZtTVqg?6gaD5Nz^BF|pvJrE z0a$Rm51#-JC%-EI5M9TmNPtiBt67T*0EqDL@d=4Zh)D>?7CcWr5 zF|E`+BV$Z59Rr7+r&mqwDp>5U;UiSigoLubft&lYx-Rht)`grrDjqm*AY2q&tbaxN z?G4u?L5-VO`1nM`M7TozQvna3nt+B@RPT}7IN?opF>!rV4#zzM>*_bFd&G3HbSI`2BB$jiM!j(X6sUs39y3Q=b)v7M>J8q?+|AO`W7tC}3GL=~Ws} zusW6>ZF(@}<(xO}+MdbM-Fh8AW^>g1U2CvRCW--5Rbkli;@MZ;Zxr?V=hoNj^4e5o z8}&AuEZ-%3+WxHQ0om&>hrXlZ+#@5ufexJ6 zUBBJp%a9zrqd{E>g9HfFvllUYVqK$2oVXpJn}`apPj%NfMQE=8HJOm9L&X)Fo?vHR z8Q=T+{k;9c`#uhz+-}hEpUkBrCAoEG#GH6Bs|9RaPSCUlnP%8xu2$sMt>ZiLx7L)R zRN*i2VEZ@YXOaV9Ns;$!p2%3?VJ9C~u~fH!4N6U=Cg2ee`}KKjg#*V11Zo^v$jmB^ zn5TWmV$_!(8Mm-r{WZbb<>BCr*h)pNN|c@2#0UiqCKvWSEB4;DnO3q)PG;&WiV&NG zW_QuIOEFq7tI#~#-dHmgWKoL=%l-#i!xU!8&9GgG;xv6)f5(IVkwn&-zE`okoPCj6 z4-{0B#*H5A=wyaP4G--5Sn;$dE7LU#=$lE6>T`hgKoP#$nS}V+t*MG4VSVylD8mCm z(M3v{#TQHf3xXD z*0PO|O>TjD&C+IWsO9M#a?C1^g?(rk(EV~z-qlg>^E0g4I%a$H?XbX(NywZgJ#Tlx z6%a|eR3CpII1E}>v+K{)V{e#n)K46Sz_C#TK7RBXL&j8JObbKVIoEwJd39RHu?|UY zY87`u9%Hd7Ee`$;zKUq*WXmLZu!=UN6<=c(Ehi9Hm3)F2)zGIHS!&2D(S3Esgx0EWsO}G2s)c%G0AxGc5 zcb8r0-8(kI+j6>s^`m^#g1 zG@W|T=-e-2VpDNJ3IFF*Wfl8WjV~}^C%O1jIJ^vpG-pzX7a z{dcYB1!)c?&6^G>``%a(+xl2Q+`tejB{Dqm6x=)bWqzP(FbEt2qR|b|jZxh@)bR z2`CD4uaO7bab#Do{BzLBK|&2ZX)l81gHlt6JdJd7{PR{S)2e~W@a^WuRwm;8X%V`7 z4ND%@&n>v$lTASK*45x=$HL0~!0oe21(TRPN1n2R%2)$4))Z?{BnhT&(r&B@t&iql z$0#%vor?}#7GY0ru!5&v@7cs%veP+)fq7RTf}wnBnnbIMw>tOr|2#VPVdTe2{I;Ix zgL2vu7!0GMc#vsIKZSDQ5*&!t_M9|O9Ou9jrT@wpt0Zuzs>0$5cqI5Bx25)=mh^o3 z!*`nA7@2dcQ`etE52nd2jn;en$CiH(alH7PG##Sq_=PI@lckn<5c#)P)_e(m3MNO! z9dF2Gl|to1G|CLD0RrQPxZyha2^6lzK*8CH4d!Ar?0eX-UsqpL=w%x*sD@Sua}X1H zJI;xKV;v-C&F}YC&!61+QVEJUmf$WIB%cyYj~j~7Hu;E$;b&oNG3Gi+&)jSxpR*)$wJ>Qkl%>;iUK{c{u8G>1nUY#~ zf5u&(6(ypipwX-~3^6wY*zNkBh&~AQlXWq*kV6MTDcFl>5At^x$8K_FVct(A9t8Nf ze_@nw?Yha-fBFc$VKkWR9>XC4t>mq$=4z}1b1yqNeS560$NK4IRMhd8U#b24||y0dTtSABAC==#^9af=^BQeX?TpB(bY zB=}A2_=g0(c%-Gkdau&h{0~B@P?MN5QQae{;5Xzi4@BjT-5h0K1E7}xz$o{ni%9Vt zEQ=M}5K>@Q3+u{qO{z>!F5*OCLDa=V7L?kaqNS(9@tc~X))y)U5X9F?*!iVFS)Chq z-q&$rWg4qZD0?$&qh2@!V#JWei>;gA-^VhIrDpY>hOUX-%@I+E-KTs-QFeW3H*PVT z4TNeZ@%v&Gr6|sEwk1N`5kjrF{~d4o;aSk|A|}No=2I}8>C(1b*g)^;T_`(o5_O}$ zO!LikOqETTdUMLnX4(8B@%5lWwGZkB`mg)>t&OI;tvg!4NQC@@5i}E$5Kg0yUWX`y z6N(pBC3?W?1?LSjD-6f+6vgO}RY)zn9JBPPTewBZbj3s9x-{#(lcUKUE_8z6 z+^(AMbAM0{Qld=dkTt^k?mm)f(kE;26w*U9Wn=xQw>VwdIWiEgcJ%&p!zI;eUHn$- zsM7_9HG#GO)361_Z-V_VI|5kWA%jYX5ZK@Oa504Vw=K0OFj3vsI}W>KQ4Vz?dgD#+ z!5X%jX-AX)P1(3`WEpv<{UeWS%|0^Jxo6=`yJAv z*iGq-9g@uO6-uhr#Qwr`FW4|P8Is+DoxNXkgDAdB%MTW{6GUrqF@PEuLyL$CsRetm zFyhy0LA^w;Qx1A`@GN{v!6dBSZ>ii>VC0-9Q(`}1@yswN-K4MMB3^)?mmCz{DiGgW zS~0fq>be9O4fU0Cm_DTFbB1s`qo^vLOB>(brM#lGR) z0d4*X{amH}j~1%AYHL+$hClGG&)-BZgI$NmYNs{Vp^71C>TXXnsvRjDY(nP)&5S)p zpDkKcBZSu-d-a6cVX`Zyg%hsBX)=TmolEccT0=e=2+O@hfmOQej70;LY6?o?Rq^-@ zh2{}UZZ!#SCz3lFF!?kY1`%*B7-s?B)Uc-p@gPYnG}7$B(s<2r0pYN_gQt^gVOw|U z6dGQ_Z`YeYfk3F1pbj?B>vtdGZ{p^zV~sA4lVZ%bInipyFG+)oy1A|2$t)8t+_W5F z`&Qh1ml30L>~+kux^J@Npv8Y4=@NI+#HixyuFpC+xH z{Cpd-nS2GjlaJH+X%2ta2mwBaL@O$VEEQcwTV1T|^YnlFfw=<41+IV$MEKVvtG-^* zR(t$%eZs zPtKhjO(}%4y%^RDy#MhV^UJ+ap`=GEHShJe z7R0&6l# zcaq7|rtjWfd=x2=M5omRgMtsI3S>I<^}RR*#dlRRMeb$(F>ugU#1=P<(eAfM7;a>N zLF?0pxz;@qFmW-?;;3Ve&s8q=s07PQZ3-9arXO~9d24z%j00KNo4pz;RaI{A_YG&j zNg%13`jhH3xe5}KFWRM5gPbsXwKPo~k6$)tn=oqCJ()iIuP7Ya0ovEZs&j>3y4MstO*!i-@y*mP> zX(gU>8C&^X4{G3+Fw=<1frm+}Jup}!C_Tn9-%)HK7YZ6WELVKAZ$>cuQQbU$_HLAm7gI_-LG%XfXG>Nf^*ccc(~4#QC9_gcI4tK zD}N*~w`(Wd<^#Ist#O#B43-#7XfWJ1$Q@dj8M}?Px(vJm5)WNfK0NtKwtYCtNHLLvM2D3tPI? z^S-ipuU?B_c_s%?D^}+A~#$bs4lR zN`$tKo%}9QRZqH$wwE5NWffE40Kdr99TcK5@4ef<1f9Q7L5!z9G1IJzv^?^i>y3}S zdEZ$`ZL;#s^NBhI&2_m_;<({X8HkX$D1n$yc(O8eLiMd;_IcCs-u56F3dnm~1Y?j~ zI+CKIo^O^?WnCLZO$|!(p_-dM)hH8wd`-}VS+zW)q73{be?BL|x|PH!r^_r#C9Doq z;x9y4;hjIo4VzZ-?W7PxMi-7aT1Iv+ReEtc{P0(QNW00I(#QnCaLtU|aPg0-GeuE< z6;qI;*5MX-u6T*KyFkjss#+DoRTHB$;BR>%+unSAu~?G_@NoFce~ zHT{HMv`7A@m}9rP4_i#r6)Fsa)DM@3UZ9Qrc+!d^ARHD$jR# z%7V$>HTF@~PqHw6-7q5U7uh6FTwC5Agri5ZX>0{#HfBEC)Ld?~K>B?gNS>5HRyB>B zpiUfmSW}r%vW<0YgF^C@g}9!J9;=qb=@J_=QmeDpuRwuAO4y|B4u(Y?QEMnt z)bR4z=S|x2Bl_7oQoT&Xx+vqg_|Q5@<%(fVp+1(Gqbaa^hq}Z5MUwCOoMxFSnbK3} zC^+7KA%k+JV|kEcyvy9s&!Cu4q=ne?a2|_|aZpy6Ql;C3#j>42;;QtTPmyDMExI>d z`1PvznDk11^a!JAQOcwci5j9p0(T3?Z(&dQc(&%x;$hQ*=oEJTHaj{6zVx4@re2#d zcRO!8DjN*i?nXfDhF$g(sFZs=(tf<1M@$Ej*~K9wk@Y1x4VjV!-5x%Qa31XrC$B@2 z(}ccsy0+lhE*_EYsqLj_Ho6SlaT6&HT0Z2{ea|sFb1{+| z4|{k(J=~gWmL};s2~ESvfexfo&4W5M3p0oBwtgl{?@sOHWJ4a$<%&xEw&vtwdWnfSq9@Z&B*!9G|aR+?7?uV zJZJ@H5Ixhv*AlRr5fAQP;!9BFo0Tn_xNByT zTeH6nKl*XqqsA_Dafm3zf!kzT8t7BsQ*Lp6DAoKHw)e-K$obBp@`@Gtr6}svTs--O zXsB6hd@nU}0g|My*uCWMm=k@vvK7p!HW2X=py2$sllLzui4}M7VX9Xqo~nmaPGNCck8DJhY|d#TZMF_oLS3MAx@~I_ z27y!i90kHSu(>6Tqd%;z_aDC`3(m9jpQ`d{TxL;gJ1(*O=F;Z5(RGg6l20CLe@?(w zJeyT7@c!#bq+XSRgGuY+H?lb^eFYv=YQSwGrQaOIZy%sn9r^ycVBzn7{0G0{kAgIg zveYcTJiYbvcP!a>za9Pd*d%p6mJP|;#dI5Q-AJa;?lwUB6ae;<$)ktU^&dE^s1J{A zlR%Y@L_??HRw}Q*+xn2dywU4rFi(?SA7oT;Bu|M@cl9z(9otjDvUJVpf3c2`J)K!KJyOjGW|hO(F`Fqn? z^>(DvtYcmJbM&l=@P~a#nlG2+`(?~)!NT50BGOY)JDY<11x0zOmS^q;x>A7?wzhUv zk2d{DHglyrKOQQ28|^1{-;kv2@y7fc{{VM6ngKFO`@ntj10JiU5$?hs)YToyswY%!#Z>}t{vatH=>xsu#7 zx+xL9A!mOD9I)9;zR8X1j@b|q53(J3p+t#LdarkR61wuG|3|6P^4>eV#y9KX9-7yG z6M+gZt^hCfAIqTEY}e6b6K_rfL@&1!Pukf2+cd)U`kVDoiMHDtQuPNfR4+7~dV+dt zu+Pm+lbm@6dAV{_2e}cdO>sx!LK?9Ke8uIpqg-~`8JO|Z{riIBLlgFee1$F6vz_(L z6#>1kanBL|rr@`&G2n|T-kqvux*fG&w+_yeoE!q%eGN<@rip|MG_v0hysr>&jBF6nv!gp%5H*! z{nLK+j)c2^Cs?^G)6QyMuMK*y>^qm*ZFA4PgPf0%H|-r#NfnJ^Oij2A8Vu26JNrvp z#z|xKb1P0TUFY>|1usR2tbpLku25D@guA(O5xdj1+?&X2C7g+S%Sn?zuM_zi`I5{d zF6?rib!8}bvgKI7O>C5`7{Vs|4l_pUM$Eh~Fr1^>GSnV;)6~9eq5HMW`Pq@SqE6BD zD9n*znQe-a++`kY9Qk?3K!|b}!IOuTHuxwRcPcA)52fHJz&?}^AjsSstR~K9+=^a= zARZq&n`Xa*peAi*y7q8m(qX!k(R0K1yx73oq`nANkOZyfi$85HU)qf3+-UXMQdCR3 z^buZG8N4_F#iAM$+fjzK!5iuP85t9H0{T;R_R~$rB6EB%GPqh@;sx>ytuE^j!-vKh zmnEZmPk6JXraC)}vuq@yjAp=|33Lc%1wr_NP7o5MBqlT=uq0i{=i!fd%-p4`mJnZ2 zkW-wZwmhLxiJYrQT{Cy@GU<^s=Ue)d&}@5S!L84B2-)#`MpLh0p7DgwUNayiQxVF? z9h5hFbG2RdyRb>a&8^ax3bI-nXtU--Zh1^YkyM4q?eDt=P9=zVFDOma6(G?AZz{01 zq;8ggcW8U1O<`dO+-MKLhWgzAoFv~&t34MIU? z!X_q3(Du#+SGM}C<&1pAx->tjfJHIWgEOdt-*W_NeA=&4!AI@uwAZm+xVT*W(5+e~ zcUh^F(&?V!2{?mu(Lm7s4G9qJgR0Ocra;NEtT~ z(q_X-sZP?gUcK4J_Z*4j9Zpyr2K)5iWCJpm;~c z1KhDxys^&|XXr1ft$nvj{bc-uuAT zRj8S6LU))gM2tL}+~}0jjDlhdhz@t)-%-WGNtNLx2cUNAr0uVtt1oZw&}N&sC?xJ* zH5*;#R&WM9jyJqr>OY{H0h^f&!;OvBzAzlI%CQo+v}r5DsFK1{@q< z@u^W|Ic9gylBmKokwu1+My^#MdR&EH<4T7QzANvg&+43;vxC6G(+$x<4QZ07&HVh~ zW8=sY5DHlWaxA$uOG(;hT7QS@H9L!6+p(VIo=cPLq2G3H`^OKiA0WN&cbF&ApN4sD z98RkSyy^J3GxE7K<|H)eO|JFsae}ooKJ{$+s1e;aq937Ece6?bmdQ_uqGMZUWTKmh z)h%5V3{BdYb}8DH{fn!7?=CTN3x9jC!Ts^CShjCQnYAL!8jJl4ic(U>IhUPgq7nXF z{9+2Y0R=(89c%Qn|6=s;UovO4DfSr#PPGgS>0N9%apH})F=9t6?8+ENC_ z!zlt^Z7?ZjDVTz({EN4oB@p$YVT2R{_0MdGQzU!dwiPz=WKu^v)h9j}D#xTgN9(^& zP;FZrS1;AIRP$$h2jN(SgWJ>;+7t&d=9rjy0qDhBZj5cnrmc!f_C>SV5l35?nnlZ*9{>E=dd5sEq`EJWb*2RF7OKTMF3z^>ul&BL3q>bKxoN4R&F zSV=$r{ko8LMzZA%TWuG2x})s>{l}K43u%YMB|l{Q;o}Sa-dFg%&2-%oyKiH5#^1pW zBbFC)7^zlLdSwn`)do(ok<`yO2KE?>R&)tpT{Lv0<;vB)8}J|Hk0{YwYk@wQ1c{Cy zmGcEt5B#;YqBcJG2yb$GAYyT`~>1m$>qj{ z;*)h66SA>+TlDrqo@1j(Ov`?h?{#vwSfr_ix51xsSl{mY@jU(x{JfG>D!q9=$_k>l ztoPa=jU@HR1KmT7^F3rux!0Ez0=>2O^JDUp`3H8>LUqk0)G3oZRCRpvKWLMLRS!wm zYn<0LN&6Sx=*ebvrAS@#%4nAwr24*~@{Di|eaiuEEsrUwOeWDEOZC2;@~5~23iavJ zX^*t|wbdtYnY&U}6Fk!j86#tjD(Rjuj0$f z(&(WRH8n6WaKs{vf5=3&Axu23)8|{zwOuB?6a9!XJO%;rxuGgilYGvw!o362N3*~jnID{SIkYLn-B{r3kKosnU~D|nQr z_n^P*&Vm*qdy~E)+ldgWJW-cFWT2Cle}>u_(kA z++>gW^8U^zww;(ug6y|~V=S^dZ0Mkn7$I2AzgU*Qyq|7XuRYFG)9~_F&Uj`|QwmJI z4ib-hL-0mFQFQ2CHdTF;xyT&>CR{I)b}lsa%UjOW&sRI2em;o&R}?+OQ>1h-^!Spi z#Mt7uM>U1=!rIbkj2Guo_?$%XyN)M9 literal 0 HcmV?d00001 diff --git a/docs/getting-started/emojivoto-instrumented.yaml b/docs/getting-started/emojivoto-instrumented.yaml new file mode 100644 index 000000000..bfec31023 --- /dev/null +++ b/docs/getting-started/emojivoto-instrumented.yaml @@ -0,0 +1,247 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: emoji + namespace: emojivoto + labels: + app.kubernetes.io/name: emoji + app.kubernetes.io/part-of: emojivoto + app.kubernetes.io/version: v11 +spec: + replicas: 1 + selector: + matchLabels: + app: emoji-svc + version: v11 + template: + metadata: + labels: + app: emoji-svc + version: v11 + spec: + serviceAccountName: emoji + shareProcessNamespace: true + terminationGracePeriodSeconds: 0 + initContainers: + - name: copy-launcher + image: keyval/launcher:v0.1 + command: + - cp + - -a + - /kv-launcher/. + - /odigos-launcher/ + volumeMounts: + - name: launcherdir + mountPath: /odigos-launcher + containers: + - env: + - name: GRPC_PORT + value: "8080" + - name: PROM_PORT + value: "8801" + image: docker.l5d.io/buoyantio/emojivoto-emoji-svc:v11 + name: emoji-svc + command: + - /odigos-launcher/launch + - /usr/local/bin/emojivoto-emoji-svc + volumeMounts: + - mountPath: /odigos-launcher + name: launcherdir + ports: + - containerPort: 8080 + name: grpc + - containerPort: 8801 + name: prom + resources: + requests: + cpu: 100m + - name: emojivoto-emoji-instrumentation + image: keyval/otel-go-agent:v0.6.0 + env: + - name: OTEL_TARGET_EXE + value: /usr/local/bin/emojivoto-emoji-svc + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: "jaeger:4317" + - name: OTEL_SERVICE_NAME + value: "emojivoto-emoji" + securityContext: + runAsUser: 0 + capabilities: + add: + - SYS_PTRACE + privileged: true + volumeMounts: + - mountPath: /sys/kernel/debug + name: kernel-debug + volumes: + - name: launcherdir + emptyDir: {} + - name: kernel-debug + hostPath: + path: /sys/kernel/debug +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: voting + namespace: emojivoto + labels: + app.kubernetes.io/name: voting + app.kubernetes.io/part-of: emojivoto + app.kubernetes.io/version: v11 +spec: + replicas: 1 + selector: + matchLabels: + app: voting-svc + version: v11 + template: + metadata: + labels: + app: voting-svc + version: v11 + spec: + serviceAccountName: voting + shareProcessNamespace: true + terminationGracePeriodSeconds: 0 + initContainers: + - name: copy-launcher + image: keyval/launcher:v0.1 + command: + - cp + - -a + - /kv-launcher/. + - /odigos-launcher/ + volumeMounts: + - name: launcherdir + mountPath: /odigos-launcher + containers: + - env: + - name: GRPC_PORT + value: "8080" + - name: PROM_PORT + value: "8801" + image: docker.l5d.io/buoyantio/emojivoto-voting-svc:v11 + name: voting-svc + command: + - /odigos-launcher/launch + - /usr/local/bin/emojivoto-voting-svc + volumeMounts: + - mountPath: /odigos-launcher + name: launcherdir + ports: + - containerPort: 8080 + name: grpc + - containerPort: 8801 + name: prom + resources: + requests: + cpu: 100m + - name: emojivoto-voting-instrumentation + image: keyval/otel-go-agent:v0.6.0 + env: + - name: OTEL_TARGET_EXE + value: /usr/local/bin/emojivoto-voting-svc + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: "jaeger:4317" + - name: OTEL_SERVICE_NAME + value: "emojivoto-voting" + securityContext: + runAsUser: 0 + capabilities: + add: + - SYS_PTRACE + privileged: true + volumeMounts: + - mountPath: /sys/kernel/debug + name: kernel-debug + volumes: + - name: launcherdir + emptyDir: {} + - name: kernel-debug + hostPath: + path: /sys/kernel/debug +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: web + namespace: emojivoto + labels: + app.kubernetes.io/name: web + app.kubernetes.io/part-of: emojivoto + app.kubernetes.io/version: v11 +spec: + replicas: 1 + selector: + matchLabels: + app: web-svc + version: v11 + template: + metadata: + labels: + app: web-svc + version: v11 + spec: + serviceAccountName: web + shareProcessNamespace: true + terminationGracePeriodSeconds: 0 + initContainers: + - name: copy-launcher + image: keyval/launcher:v0.1 + command: + - cp + - -a + - /kv-launcher/. + - /odigos-launcher/ + volumeMounts: + - name: launcherdir + mountPath: /odigos-launcher + containers: + - env: + - name: WEB_PORT + value: "8080" + - name: EMOJISVC_HOST + value: emoji-svc.emojivoto:8080 + - name: VOTINGSVC_HOST + value: voting-svc.emojivoto:8080 + - name: INDEX_BUNDLE + value: dist/index_bundle.js + image: docker.l5d.io/buoyantio/emojivoto-web:v11 + name: web-svc + command: + - /odigos-launcher/launch + - /usr/local/bin/emojivoto-web + volumeMounts: + - mountPath: /odigos-launcher + name: launcherdir + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 100m + - name: emojivoto-web-instrumentation + image: keyval/otel-go-agent:v0.6.0 + env: + - name: OTEL_TARGET_EXE + value: /usr/local/bin/emojivoto-web + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: "jaeger:4317" + - name: OTEL_SERVICE_NAME + value: "emojivoto-web" + securityContext: + runAsUser: 0 + capabilities: + add: + - SYS_PTRACE + privileged: true + volumeMounts: + - mountPath: /sys/kernel/debug + name: kernel-debug + volumes: + - name: launcherdir + emptyDir: {} + - name: kernel-debug + hostPath: + path: /sys/kernel/debug \ No newline at end of file diff --git a/docs/getting-started/emojivoto/emoji.yml b/docs/getting-started/emojivoto/emoji.yml new file mode 100644 index 000000000..0e26c28b2 --- /dev/null +++ b/docs/getting-started/emojivoto/emoji.yml @@ -0,0 +1,61 @@ +kind: ServiceAccount +apiVersion: v1 +metadata: + name: emoji + namespace: emojivoto +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: emoji + namespace: emojivoto + labels: + app.kubernetes.io/name: emoji + app.kubernetes.io/part-of: emojivoto + app.kubernetes.io/version: v11 +spec: + replicas: 1 + selector: + matchLabels: + app: emoji-svc + version: v11 + template: + metadata: + labels: + app: emoji-svc + version: v11 + spec: + serviceAccountName: emoji + terminationGracePeriodSeconds: 0 + containers: + - env: + - name: GRPC_PORT + value: "8080" + - name: PROM_PORT + value: "8801" + image: docker.l5d.io/buoyantio/emojivoto-emoji-svc:v11 + name: emoji-svc + ports: + - containerPort: 8080 + name: grpc + - containerPort: 8801 + name: prom + resources: + requests: + cpu: 100m +--- +apiVersion: v1 +kind: Service +metadata: + name: emoji-svc + namespace: emojivoto +spec: + selector: + app: emoji-svc + ports: + - name: grpc + port: 8080 + targetPort: 8080 + - name: prom + port: 8801 + targetPort: 8801 diff --git a/docs/getting-started/emojivoto/kustomization.yml b/docs/getting-started/emojivoto/kustomization.yml new file mode 100644 index 000000000..b09dc55ec --- /dev/null +++ b/docs/getting-started/emojivoto/kustomization.yml @@ -0,0 +1,6 @@ +resources: +- ns.yml +- web.yml +- emoji.yml +- voting.yml +- vote-bot.yml diff --git a/docs/getting-started/emojivoto/ns.yml b/docs/getting-started/emojivoto/ns.yml new file mode 100644 index 000000000..13491ee22 --- /dev/null +++ b/docs/getting-started/emojivoto/ns.yml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: emojivoto diff --git a/docs/getting-started/emojivoto/vote-bot.yml b/docs/getting-started/emojivoto/vote-bot.yml new file mode 100644 index 000000000..3de75870f --- /dev/null +++ b/docs/getting-started/emojivoto/vote-bot.yml @@ -0,0 +1,32 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: vote-bot + namespace: emojivoto + labels: + app.kubernetes.io/name: vote-bot + app.kubernetes.io/part-of: emojivoto + app.kubernetes.io/version: v11 +spec: + replicas: 1 + selector: + matchLabels: + app: vote-bot + version: v11 + template: + metadata: + labels: + app: vote-bot + version: v11 + spec: + containers: + - command: + - emojivoto-vote-bot + env: + - name: WEB_HOST + value: web-svc.emojivoto:80 + image: docker.l5d.io/buoyantio/emojivoto-web:v11 + name: vote-bot + resources: + requests: + cpu: 10m diff --git a/docs/getting-started/emojivoto/voting.yml b/docs/getting-started/emojivoto/voting.yml new file mode 100644 index 000000000..e4d8c7958 --- /dev/null +++ b/docs/getting-started/emojivoto/voting.yml @@ -0,0 +1,61 @@ +kind: ServiceAccount +apiVersion: v1 +metadata: + name: voting + namespace: emojivoto +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: voting + namespace: emojivoto + labels: + app.kubernetes.io/name: voting + app.kubernetes.io/part-of: emojivoto + app.kubernetes.io/version: v11 +spec: + replicas: 1 + selector: + matchLabels: + app: voting-svc + version: v11 + template: + metadata: + labels: + app: voting-svc + version: v11 + spec: + serviceAccountName: voting + terminationGracePeriodSeconds: 0 + containers: + - env: + - name: GRPC_PORT + value: "8080" + - name: PROM_PORT + value: "8801" + image: docker.l5d.io/buoyantio/emojivoto-voting-svc:v11 + name: voting-svc + ports: + - containerPort: 8080 + name: grpc + - containerPort: 8801 + name: prom + resources: + requests: + cpu: 100m +--- +apiVersion: v1 +kind: Service +metadata: + name: voting-svc + namespace: emojivoto +spec: + selector: + app: voting-svc + ports: + - name: grpc + port: 8080 + targetPort: 8080 + - name: prom + port: 8801 + targetPort: 8801 diff --git a/docs/getting-started/emojivoto/web.yml b/docs/getting-started/emojivoto/web.yml new file mode 100644 index 000000000..51c0b5ca7 --- /dev/null +++ b/docs/getting-started/emojivoto/web.yml @@ -0,0 +1,61 @@ +kind: ServiceAccount +apiVersion: v1 +metadata: + name: web + namespace: emojivoto +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: web + namespace: emojivoto + labels: + app.kubernetes.io/name: web + app.kubernetes.io/part-of: emojivoto + app.kubernetes.io/version: v11 +spec: + replicas: 1 + selector: + matchLabels: + app: web-svc + version: v11 + template: + metadata: + labels: + app: web-svc + version: v11 + spec: + serviceAccountName: web + terminationGracePeriodSeconds: 0 + containers: + - env: + - name: WEB_PORT + value: "8080" + - name: EMOJISVC_HOST + value: emoji-svc.emojivoto:8080 + - name: VOTINGSVC_HOST + value: voting-svc.emojivoto:8080 + - name: INDEX_BUNDLE + value: dist/index_bundle.js + image: docker.l5d.io/buoyantio/emojivoto-web:v11 + name: web-svc + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 100m +--- +apiVersion: v1 +kind: Service +metadata: + name: web-svc + namespace: emojivoto +spec: + type: ClusterIP + selector: + app: web-svc + ports: + - name: http + port: 80 + targetPort: 8080 diff --git a/docs/getting-started/jaeger.yaml b/docs/getting-started/jaeger.yaml new file mode 100644 index 000000000..86fb3fa36 --- /dev/null +++ b/docs/getting-started/jaeger.yaml @@ -0,0 +1,36 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: jaeger + name: jaeger +spec: + replicas: 1 + selector: + matchLabels: + app: jaeger + template: + metadata: + labels: + app: jaeger + spec: + containers: + - image: jaegertracing/opentelemetry-all-in-one:latest + name: opentelemetry-all-in-one +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: jaeger + name: jaeger +spec: + ports: + - name: grpc + port: 4317 + targetPort: 4317 + - name: ui + port: 16686 + targetPort: 16686 + selector: + app: jaeger diff --git a/docs/getting-started/jaeger_traces.png b/docs/getting-started/jaeger_traces.png new file mode 100644 index 0000000000000000000000000000000000000000..2110dda9c84ee6925fc4e747eeef4e5f09df27ba GIT binary patch literal 122278 zcmafb1yt1E^EO?Ipa=+ppoG%htxJRIqmAORB+n&dv>{=6xi1THw%PTxO-oaS#ET>srZ257d{Jnsrw@wkdvbwz zCCOM#H##BZ&dW)>vl$xL-F4<-)Yx>GbaXg4YVo%;0vgcIDavr23)X>M!VLOwHf{1& zu#V_QqLG|K6{1q9?kJ>lSD=j8aWZ_rc}^;cmvsHcUk z?ro?YP!AYGT##Ex^xNnE=gF@Te`~4pt0fmVpWyFJe|z+IQ%x5O=UWbTU`$u>UrY0& z@$V0RG!*4PiT;}^zU%qhUxA{<2}C*mTQqTk=LEbwXlRmX^0%clJkgiOaD6p2cbdME z^xn8iPkiA59vkeV#zib_Qc{iOfQve{q1b2U^&HQCC}rKLaWB!nt$}rixE3$_k>q@R z@c2!9e0-);AA8>^dZn8;hodKEcsk+QYljWf7PFnzyEvrr*DhiaOQNCw&wtr>V0wJs zuIIwhFz{#t|K~rgKuKx|ynj8x^Ms+nggIX0X`ugauV5q$x1+QF=n#)~5*q_+v2OC3 z8utH81~oyvzOOw0I}b2}Kyp0d?9Kb3lBE9>1doYGN>5MEOUu#_^qba>b%BJ0rQBiF zlJtw2*`Fi9)Um?1cxm&b%E}J;8 z@%r{>EN0UGCAhD0pk#89A=hH)|12KRbsW(3(MGAW`oEU2fl)H8Yq0Rrw)DTGQ3TTX zd+7=>{iTO*Z;eT4)#hxp!w#1Dszm9KRXb*4kCsEj4>uS0~!WNyHXlKg66f;@-Nz2JetZTv!%8x%Hp6*Zoiy z6F?}0`9sI+m@p3Q!dQta`>4^z`%W3jk%XfOthE%E`4#-7U`dgm%FFw8|C={9w?0 zybfF4MEJg{f;AhR%qXLjRLmx9%#D+gSh6V(dp5C0-(`b9*0aD$x(p##GK^Je=c*y? z@nPqe3GvZOrWHP%6k^4|+ly-&tWLCjZLu zp(0FSgiGX?*U07vis_d@z`!h1v0uJ?neKOZktFO4AFSH2@UCHv>x1Cn;MVc_LwXh# zeHFnMp?!sh`Vd4STS*C5?<-k>T6q%|f@>hkeKeYboi4t*$;i9QL}bOLz>Yk5_GXwU)-~lQIkuj>H~z z9cU{*gO4BE;OC<_)%=v6fuW7JV9aVqd%}GDK}S57!%)KtZ%3haQOcDaUDtt1JCP?{ zjy^Nc1jx}Ha57k9zwKP}49B096s0fH=KsYOLhc(iKU7*1|WT3@6H=&x?9iF30!wfw$R ziNG&vlJJH|p~0Fi#tS+<5#8=PhOc9>T9>9*vN>Fw;vJ(NZt<$TJbNcS&V#V z-$DSqfFDLn0=ij)L3NEfGnqYxTN}jWGQocbOW+y-7HPctz+zTLhP&0B`cc}9CQMOHD-2hYRP=g`Hg_r19p6uImXSW zt;&Y!n7Sk{JbsKXTPidHY>ELd-F}4qu2QBgM5XKe8r$0~eXlzs{E-*OCLis-dHBnP z#L%fd?}nTAX?F3MaG^a$3<+YKx-Pa->nH{g4NX&Ov#|mK_DFa6baOFy zL#wMOfL2iG$LWSAh(11sJ<2c_3{E5%9SNQQdQfUW3R4*b5lc+M>ez1fOiZW1Z$_wP zJ8O=LBv`k`EX$S`GuXDXHNphBYh3@46H2CQJj@>!8!udOyx=Mn_YUv&;JG+|yQmej z{#CJ3md!va*4DW72$LR*g3FvH?@jS^!+!dkz5J$$)N)2VVG~Xh$NLMpfN39g}B~Lm@YrhCg7D(3$i0f_VzT@)6BIL0o)|+w}cu z`p3_*J*IK*DW+bOdtyy{koGIM#(Egojk8z@v1ps02#Avwsq8perh=X)Wx!NdHxI;r zLFR8hl$g81Gf=18Y3OP%BAn_gc(klPh^ z2*LR6hFjUHMz1}+EZ`222j0ndqwPAk$Ev~5Yo}MqH0RG>O%`^G3}vs81A(^T(&CB# z{tP(uE^v7Z$g@(25$sXfO z`c?KZgT?`d4~b}0(z*~&9$>XsTb9Ph{qIns_C8CArUb+1l|T%WYy8+-01 zId1$~XJ=+w&fe&=Tq

3oG`Hyet}`gM6smBel+QU?qi^qh2Z1{I_rii+EiXJ@srK z;!~+~As>utF6gOIVlt!4qAE%JK4eUo!sTGW$f;rrGdA|^Gkv2w45`_-rKIkZY%dLV z+#(XAr*yn5>RC+KS)fyLQ~YGlta>iRXF5jP==_SBewELc$Jfn!UP|+?yZ38q%VQ!% z<$~NPBam}oYu^4cHB}Jgk`!m`uX`on=<7A*eX1Ll)N>VwWo1gw?$(uC_qSiM{8ViE z5_u8pNXlffZ_Rx4b$92QX1W#G*xuLFjz-GkS zop82xO}ik{tA&a#`7+-|eV)`)F@jFGKzCQ;;cBfNiMrnl3g_W1&9b#vc0*=r5%=h! zGRqO#WPTpMNf@r}y2{{6&#Mr^*o7K!o<@z>*D71qw$CEqc4XrWaRy%!wFmGE-VIr% z8h%*>(F~JQ!XXCX0d|6T&J8@zvZm>_yBQv9M$R8dALwR6p_gY)4r$1!3AKVeqD%3u zB32V7PI&`b&Pn82eigGuep-NDrk@z)QBkqg^W`e~6^?@7sRbLzST)9r-n)^H-&?__ zY*aDoyw#)LfhFv(q8L?>kZ>&kdod+NK)adE=vu8(v!SO|c6$8exQ}HrgWKsMo)~hA z&V6RkxFgbTWI8S39N*?hf}6Pb92LBx*mc)_VRy*#f`fQ4V_y+R83H$*GpfF#i8r*5 zNMX=_H~FX<8fBiC8Chc|i|lmE#~-z74!X;Ww;5pUYx?ZP$ou|h5vm-o)xIqDIca^a zz6fJu3{nq`!k^3c&aFOq+UYiMvRK}kDls8WM8W-@G`)&(#8RCAT0z{+5ra@wrI223pRE~mof#{g& z=OiwZzOWo&zR=1)cGh*Fcc^0bHpz`%DTYeB5&5*P4ClSayJYM_FKLs@EC~mWYoKN2 zp-}p#6y|SDKU4e{)Sv;MzbBG7eJktkT9Fi1VS=zU#9?GHcR%7)c%&2K4d(&l3Z>wIge`w6c~{|X=u%(fv9`MS%6?_IfvxxYOe`&7RcF^mH;l9hM2lyZp6^s2BouE$Bgg{kD-`G$+Ty!1TU213i&_LKJGC1*U6@;;D zwLP4A`bi}df0;^h>hX#|$Fb+ycyE!LjgSe3{n&VbG5^Xq-IOwkF16>iKJx}B$uQBu zPK*rWr=2|fY(vx1iP&1~VAt!zHp7S(j~EeQ8k^mm<7qZtB0@Cfy1jb~#MEpe=cpo5 zAZWpeOo~tUc(`-&;@z6zQuyUUs~(I&i#Q}uKEwJK$3Oc`gk7W)-X_NIvT5eBM$ z<+elW!mjhQ*OOf%^G>ToUF@`rjM&6{c37P(5paR34&Jmm@eBFkP2LE;!B3K7mW)27 z>2K&nS9CA~5}(c)@y-tp9*I&H`W`G~xjUX+q3NcWz8Ms`R<{{WEjo3B#50q2QW>La zLj1POGyj`c{I+!U*$|nvvxzJQK@FaF4eKk|d6Z~egkrWHGzo83$-sML;yI{p{0dq? zY)FG4PLW+ZiZyj%QMxsX(X(vSJP+DDl9()F(btWfvEVUjQpLn+KL|U^qn<*++#Su9 z$&?QngyuMue&$vV8I?$6ETznbLu4@eU&5*gA#l54+kuO_Fy^fa$U7k^VZY<26qAyQ zA+H55rz00Gk<7z|9RqF0QkmG4d1SJz?rLXs*Nr0*-qzNA1^oW32QX+OnHDl&OPq~l%DxMtGnr&u55WW3RqGJLq>c%YZ^Ux&Frtr(N z74-4Hxwc!{iiKBE&PrxwqbZ@j_1TEBkA0Zj@byp}&Z0Asi_)$i)`2Tq)V^mJ1^sOr z?*iUdKK~=n1TM3ORCWi~`y}D~Uj66qDKbMD1@khb&vYZUKr-!JeY`WWa-(#2A|OD% zmWkUq$l0Os*!{Veh2Ll1H`GGT(^uhEQMv>e>a+4GQ`pMji*nX8-4}+do}C{OyE9Lw6v)LFu>gkdiv{ z+ydie(~X*nNVTdIEBD0MD5b#J^v&)#|IF^!*o;kF9!px)X__pxN@asa9+zY8zH=J> zR1Uo@CeNqqX{H<-+aOLSq}#=do|L)0*k%#MIOOGy%WyQvEUZv2QS?CG z&OmP;mX}zJ71DRVW~nfW+}QVyxPTwImRrx}V@^7WR7_r!EZ3D}p z$YEXz2UZHoOU^8mf<@Xzg(FmqiWgcrVSFq0pFbvzM^@hOYd8@bS-N`b^;Ut-lb=B@ zDykf3opcG3pTALX%5{t!vpVoX&K9g%R6(C)Fl5}hwE#&>w?i?=ZcT5=_!oT ziY4W0jxwYoRmAZ6CoBg==HWHN!9qie4dbB4(d9-Kor7=acwJO5pWVrPChcb>>0AhH zSTP^bY^M6Ygrx++#Pb;b9d~Sl5uDXu2Rmt)3Mzlr;BPw z!TT`bw_Y(!kk2MgociVu3uaymX=@W_u^I8=n=v+>aRTa&%zqZW}jj*=39bWw@i_}~SR z40I%ElIKHMcBmi3+csRf8%NFPvou{|mQjGuTEK;X?!qUZhb!dy^&XeMD9*9a-679j zvf}CE=$xeHsNafA@?Ol@m`e>9o{UiunF-_RD(ql&Z z4SYAQkZP7!H`-h!k;ZcU7(z^vpO;;CXTq+7au-vJ`6!2Pa0lob*!PUHcv)K7{C&VXOmQY~qZty3N?VAercLiQWAg zzr{ksUKKcdY;S(A-{s6ug5{yI7FYGgv2gF)iKz~){Qlx#UHVL3yGzjZcHC<^)a|7dSlVY{@7-a5!`7A4} zqBvr8g2T&+=sg41U+i8ERUYh8VjZw-740@ zymq(pAr@?O2l9B~ZG9xx&hEATK3dO|HiOJ)YuKXp1LAHv z#Io{R@EZ)KL=izoOq@PD1`C60zC6y(bqm@hRR-P*AKcL{Qd`|u=ZDq2xazF133*8u zsh!Tt{pL7|MC_S~;q&8CHUP?IHpxVZ?Mk>jGb%O9GQT2vgEAfYa;!+uu-JT#tjpM< zw0A<@kiM+Swqj|W=EsKfj04onTFsR{9H6yzJ=p#GzVa&e46@YycLs_kXf0E`Y7m+F zWsv&8fuYMR11u#8<7u{7h{4vg%XetAUb)c*}^k=N@FNv17QU?MVfB zOa5iv1^G%7hM0V_5kHJn4X|1@y{X|tHgA{BwCk6;xXes3 zbXcqotjvr>Z~w>!(+IHlTs0rOUZz9|b{$r`)-Z;%pjU3iNG)6*mFk~(6(k2SvzbiS zGmbFgDpgAmCN>EtT148`A;AhG@eiGiyGd>zN@t+97xVh~eQDW?=`LHmO#*fZJt33( z?mxkV^>gT{SCrn0;N@Tgl@edVAQIb3Px4vSg}Bb@R8NJ&F{je=_E;+@mLDsVOt-i} zxhKpkF2)B4dF@}YzVCsHXr29h^-ZLS42wh?)-C z&B39GT`F7%lfw$-oeX4F;dh1Z6`**v`tqbpU}&{!4B^NPfGdEI++6@+$ijc==FC86 z)h-$2zO!YewJ8lnCduB}%@_M7{;=B*A1DMl%2;fzS}0zkO=`s7HuO7if9Ep3v{kSjH+*V=Y+qZKJkah`lc z0rbQ-luZU{9!p^?+%k5n=`EYB~$*PJaB(GqweX0|Q-`|isQ z1Qtm!S;B-`J2?ztVQ7Kg13%%q z)B?a9cMD;*|GOXscSm6XDcrf80D2YqKH zVT%om<>LNfX2haFAc2^3!xE#)LZ&9>>hPN{kI zXu#>aQuh_%$Km0zt*tnv5QLtH!))h7a=)hxN}Jgbm`jwt;%4iCtZyGqg-u7ltcU2A zl_BD90;6Lw8wZBfvf|UX!rT(p^hASw_*j6ExSwyj@wiQ^~(g z0~ji-QhP45y|PoOjjaWZ1cj=H+Z*N#s*uK zQZk?m$6$pjdr!xx0+#;a@y97172yR*iRmA|2xHjL?(G4Sxg4B4kLOV#QsQ%o#ty)>yH96m$r zaN~0@(Wn>CBR)R{*a6J_Z8g>k*vU7 zJPLYRhRVt?WNGQ?Z)YkWj!)s+L=ApaJBjvuZ_0?;KtW&wnZ6|Y$@}cZqNNu4E_vV4 z2m8etCLfjAP9$-}ipqxbGCAtj6FcEmk_1Y~SLx{k-1pwwUATCWo&n)uH_t#~)-1Zj z!1sdk`viV?m%sqvT{hR2I)=d6#)sd@N4M&Cus{!>?y|ljn$N4`~68CFKJ;vs1- zN?qpI2k-nw=8A9#RadkXD#ldUyb|pqA|i@fKw2tj4WPGmc1FH_t%DRWNYB?P=?%{x zZajV9yffsd)I8o%YVzh9JR{4m&RQq;tfsGB2W&`#{ z-$2*-kA)GS+y1KD7vLy44i_TN(kR)_4JYJM(*sL7)Ulz)e_mr_{4QGOTr1 zTp9kX-s@|4M^@d9qo#q3I`A!1xA5L`Uw)yW9CH-{Q&68{^uYTPfySl+hygf!2VWFT@jPTFdF zv4Y#Y)zJAZzTpfE_n{)3zl{-D$T_JMyP}KxhlV7ZM6g@4H@lW@767-Viq$2urj)=n zrA;B^TrNguH{d-JgDDL!^iDio$TFtd=>((+6F$DO`QAD%y`bPH{*3y?T*Y&>)GWWR zKA5m)m82Ss$)ez%o?hZ@S=l%@w*ge`N$zb)Tx~ferTmW#+x}WTe$iPNhdUN>_V$I< zAtz$R!S=?zN2Sa9RsF2>dwZ{MC3eJG_!zc84-(_!)drMxi2j^=+C|tC-*Ng^g%@?m zP_93QAuYi*ML~X3tU%v4#a{pUO6b}%)SCR#AQ}cAizJO3-%@wa?^ynSW>XAKjy@Zh)2hkI_I^Fkye3-)#NYkpENp^5?jGl-VQoK2-qwH{Pnw?EqmM)7>nUg5GyW zJ0lJohii>KqRnrDaHT;iym>McXPgu#iaL}378>idq?~fnX*jjWbhyZBgxBV5^|^@( z8*MMZ)uG77La!L1uLny-igI#~wpK=}xILDJ2LTO0&&Q{!BKR3=P}K5fkOyTv(s`v~ zP@zDtf}WYV9cLSmRw&|9H|AT=@Rwp>Xr$TC!-NTYL4T^_zMIPXUt4Hq`n8Q?3iPYm zSE?qAEaEg_JzuBsMNCdBVg?=`)WXJ&MpR zgODb4pZVQm{Lmt(WyszMs{wUXaCwhSgg_{OhJ?PpCz%0RbQGvzkdu;vVPRtrHI0>Z zi`&3Mnwy*3z2=gy2jLKwE&;Bs<)yMNpO11DI1g^3NXxz=W8>AvQ~%oVlikMCV^uO% z9oj_Y-A1a(=H+-ya=(dXnS;?ZaUs9{CUe2pU%RfjtY+2JFjGh{Knl!>`Lv&glqj}WFE4M zr?VQ>edUuO#pP+Z0n!vM_xmQ5C&H9*?9ZVX< zvg&@}Qj1GSfNJOIR~6c9J2dP!^G~fHv!2wtoC^sB z`xxM+B-d5S6P$Su%gCqA{|IPF~$ zr$=A%J`E02@$vHZO_e4kQHcQfw5w!WmuFGfeR)3st#YodGHW$Fnw8T&-)Oodfj?DN&gZ)H9eP@yo z5@#!kHi2Xkc~)@6rVyZQFJB>rr4Or+v!y9dc#IFbLZ3V-J?>o)nwgz#KiFPcVN@Yj z#m)NIDMIaeb8g{Pxyy#D=6>175Hay^+smpcPod(&DQwVHyuhjDaev z8`=g=4-92x-TbDX%PyBg@?tc)gyyJvAVtGx2kKutATt!nz4ktb%zPj>j#d@le_uEN zyxU+2FKzaakMMv3OJ&b2)l_@ju#e~M#7M8Zbo(XXpjQaeA!|7P zU#os!3EA;ByuaOXJQ1CYn%eLoUq|H=$N==N8a10{*+)@QRZKoly*0VHmGOFgP@YIc zA$W5)i+5pRp;9O>OA>y_RWY=Ba(rmZh+ z?yj(y=^aM1FyUqCdM1u(_d4%Rr2^!$#8n?)p7>4U9p7$Ov75@wY zez$a5M=WbzwK>(!l9G~_2$$ruP4AN75UhnXGI@FV5dD~$zfWk?LZZ{Et@!ormqEc< z(c$aOux+6|OI>{Je@^pn8EC|vIqkTpsK0{fZ<}ph6ICwkJ(Df)@1`Jy$?Irq`|FVT z_I589geu1M&V85vv2&Y>P<7S)Gt=h3i~3W1Uri7J6&VRF{;c`^UBpRk5UU+6Iy-a! z{@0(8N&_<}$<{8S+WwY`|K%{&S%5VDZbCv7|LaT8(2Ys)avndiw6yFPDA2b6isN(g z41WwFM_N=S1w8YGD_4v#W#@ikjX#IP^K3+=l)Q3P0Mm!|=f;41=gr}RY+yvox<*}RK>VmZ3EUJZ+6@FP<4PGr|5gy5 z63lw-l?uF8nC25^R8pA?tt0l9M=IkQ%;#9h8YTDjzf3j^qCn0G9z?Usn8`2k+oms%#C;a-ntXE_&2A{%afYLgadVa};{JUM z`TvTcr3$y>|57|2D^NVltzHNu&j20)@zqc@kKseYTIrj&&Nx&9ZXcC@wj~K|PJ_@f z7KiZK49Gj8zfN6mZ-Sj_BlxBrf6n=b&l*$0Ya5Kzcv0v7TfOWv-qu#2>~5GF z91@a1JFZl=`ZLvi92OQ0LOWC_njUa^W@fqUu$8B~j`a)~Yw3{Z^XJmhfay3wS zZ+u7VCkLK&kQJweT@h2Sv>#&xPHAIr>J`0^kbJ|*fym`8MP3V0?AT@Ly4QPeZxwgHECXl!9oL5= zEUF#6Q_uc7BGmlA-plPy1c;j?8UYqAu6)Qjrk&1;1?zkFc!nxi#`y1!m01=knhzF^ zWy;&WwhQZUA@eV-YZL*k2Y5M*R3f%$__WSZ3DN>Cy;3Uw z<43jXy)U6GzS5BH6gI^;_869;y3)6Yx%t#bCx>f0R1S4to7;yO4uO{?!WcC4$PnF| zeC7O(uxcc;U^sX?(WWq>xLECH4nC#;uQl?Tk=(?7Lw;pP-BoL8fQ{kmi^peaP6C12 zM~;o$`Wd9PzmWdvmIJ%-zm+EI{a2d2``QSUf-LytgtS=jiQPT)w+6+K$CI@_yY~9Y z+1ZUEJ`%kLVp|_?aXWpv-7^_q6%BGIMO3y@&5c)|Vbu5T6dTfW1O=lVcJ<3|=R z{_SW4S^P-VTJ)nwHR@R^$=Bd3BXOp<@JHe7r}Z*b{XOPWQ&Y>2ilyBRn#rNi2MM0w z{InRo-~X3GQy@XHXhrr1xym18!l{_9r}~yczqs9B2v|7BqkivU#mB(ZE}z4dD&^~o z^|oY5g|)!V3W1uQZ>@ee#YQZ7ey}L@2*_EnxrK4|il~ljs@@<7okr}l&a9zANeTZt zL?7~?;b1W@WURSx@^d4o|N7)IUhR@)nA;7Ck^oE_Fi}xCFa^WCQd|T=81~b>7K!`^ z1G|7&buO4wLY1$&(|}sUlDV{m2N$tMu>r|y7T`ZNN18egYUlv(nYCwYREuxLX!w;j znSDU1h7P}1XoTO6GT^}tRgv+8SU z#hODP!?SRZj9wsYS5D+@!^y01UtxatkT42VQ^seSzBBCf828HZ1qHYK5n1R3AZrX= z9mGF@PTH)EzwH_Wxdih_l|vOB3%|qoC}|Ti892puaTU?8w`*54wGA1D=isZGZ_jW< zgM6sHplaOu*$4>hgl6N-mT{qk!%($5&$Ng63kk^K^L;r{VsjJzhY0rl{kc?&i3Yz7 zgunzy0=iQmD;4%*dRqB9rUkAkdbed{hS6RkaZ~Llw>q-kh`Pn|ScXGWJc5!PJX!oX!gTCn znsDhBbAE$O{wYr4cq$;F)zNU%IV#ESC6HEEap;#@UELk?NJS{Pc74!&HrGTd zr=miJFzKIkP*C_hpAr7>#Hhfie)ufpqs-z!!BXe!??sj0LxOP0CL5kbUd}XWS)+PT zd9ZRTNJ%frLU?6-Fa{?R1eg~I?+NKjcJWibcUBmww6k-3qdVKlapJo(WH}Nhh=@kM z?6ypDdYGIwG5|t%(sblZ7Z-2fYz~$EWkNM;9^Ks#m(}4uO^^z`9C8_^(&96`K(*!UU<_>rYhm6mlKvqOsds zVkUdIQI1q88}b<@PsRCC&a`qzmfE5WyFx-7F^PPMAgy?fs}?S{qtnwcKN{-eB5hfd z?p^E9;%b6##i@rm5=zcdnUI*Mn~N~z3svFa`lEW{Tg0g5gkD70CzRj}Hq(womUP(^ z*lesIxaSYb7tLB*Ry{Ozk@4=E%^F5;C)<{h@ z$|j`$rp!~ynPENIcGsd1_K)IA!1eL6sD|!5kd;b%9mrola6(z(Ae-EUK#*P!H1IVv z`k(Mnav!@rHeBoESj+PaA`vNd-WBVv9YOBUJwPp;w|kh2p0z-M9w^OC6S7D!_zQTFxSvF9_{1!(1yl%SpDIV0CJ z{FM<^8ez{691~DUI@v&gMCEgqdOZ3SjWWkVXV0B;XEQ_5iGN0@%#4#26mH&n4)xoy zqn=YwU%sla?t!?2%rza64Z!c@WbLEIw6wG@Wd=pb#|vnrdWpQyd$@)l=e}g@`Imd; z?I>npN}avL*;G*j>8U?CSaNsOrRLHMb$@*df|J(+fO9CS1KVz6;`BsYtI&XnP9{un znZNLH#mNbk&O)jK}NgzsV*%@5)4o1 zdnthH6)RDN={;&4WgLduB5wvm_%FLX+1bs6vDyhQUU}pa8#kkSh(Lx3WIe0-GGZm+ zRnu9oTKmrKt}l)3hIdOi^#uwF-Fqg|eiin^YnQNLxn%J|E|7#oc$^jyBG)akIIhwN z+VMS5s0=XHjg18bh?8vqZZS@uyP=(=mAr zTo8QjAHhzqWf)6hL1zh8w+J?q_l6EsV4I*NT37t3bZ~SkiDI zOYLh0pmm}EA~z(((#o9o`nu1b>;Jv+jYg2Nnt?-_ry8J1?L{qQzn{MU<$D^DfrH@( zdh&BE_Wv4`cpV>PJK|0W+4O&$-rw5?HlldHU6#)Me_}+zU16B`4Kj5w|QgSCRmw z2JngJ0H+=%TG903-2vDA$FBjR=AgD{7wspj`YXJqVn$`c1^4~c9LDRa{iyU9W`8~W z?G>>nM*sL0-})n=zpmK-P}n&R$+XpVnfyOdnjalV#sKB#Io~_?-&+3Gb70eFpkM0o zM|}TMFLAarSXE7xPV|316|4hP;JeEue=&DI;x|opaNoE6vC!|~+ye}3Y;3jv#%CZ1 zj(#1C{ky@bF=6QMti^T56-9Oi;bz=f8SX7IybNm4@}m9z`>ud>8o+fP&FMKa{%UG; zBTcHtL!G>B*6+}~8-`ixy=(6^)2%TCkD7W=k)iP8lWI{I=6(I?;w`^Yu5}-nYHVR~ zg6rz_#OG0LByk1NEYB7v#o^HJzU9b>md>nk)VZTkEXA_O=z1GKsIP(4rmioSG``vb zYf<#X>U*ukcawlUIb%LIt7z}v&_cb^B{b!tmOT{xwjk+u> zdU`aqY<`ZE)TnlYsP)Q^9?@ZG zw8x5j9!^G<5J(%i_?WJmdUvKrHZ`WRQ)#HwB5!(jR(`Ha7GR=F;7+921xiY0aDDq~ zfgYcLR09{c!#G9{I()cNIToY=D{It;lNu(o=MN?yylnq9g9awf;#(p)mnj)nr|Jjz zFy*%tp;Pedw+p^cBKsOTBDb3%#8U-V_qff$a)6Hhjc5;R9`~c$W3~2=g zU(1p5MRnCr&&()#dd9zR=C3T<77}lGe8?;=pq$n<$4)_tGE`<+lZ|%Gjip?-mt(hF zB_bH+D&%vMsLRM3FL-WLNth3XCr8>P()RHTNhmALHJXugJns;$jEg12;L+J#C?zdz z$I7ryNV6!mn&j5iljU2_TQVAt(zQ5vvTxqzoZxT}A>Z8|$+?+%5IVy$v%sUmqbwfU z@Pd72yz40uJ>UG~69IS@PX4$M4(U=zp~e46ErpL0zNcVpixAnDmrqs2Cy{%)guH@}T&zFqei8^^(n?xR*dqa@>Y^fajOab=8^ghb5 zFUXD)bnWgZoSyjCh&mlGskiXndOlYeHtq>26))mlwZDjrDz!P0BA{4^GteH7TllU0*mXVALYK1g!V@r&B_~NiQAD5 z7=(vAkWYzy&%z>1Hk&g&I>>sni)ElqGxrfMs7GoQHl4&LshA6(g}T5mQ!l>$+Bma8WK(MNdZ-180* zZ2Q>4UBisTqMnN@XUEMK?1!qlwPa3L%Xt$zDiGZrk4S3!eX;$raVRJbrPmmGdQKAd z>xYsiUVrGAHj!#DpP5w{dD!Fpcz+}8f+vRV?Anu)d|8~nu?%M&M%V*vKi%k1mKnRbDc$5tQr^+lQK6fVVcY%^jpUL|sTu$B z5MA}`np&Y(K;b?wLJ{L9TL zB++lEwU}#o6ZF9AoE=C4;_9FR1vQNP>Gn=`>!iS=4Yi}izdR?P%%fAPZ-XS^@zmDlz-J2*9XdL?^6ig+nHtC2&F)5fiLWcfMrrx z-qwjH99U>+aoqHAF^Cde=&ws?bcy!%=Sb-vIq~h|?jiHDnlNMHdfF+8zCGQk#ilSe zKtmpGTys<0xIrPaz=+N`agIaDSpVYl2LNlDH0U8xTzu(AY0pV!wBxv%Hh z`oj3a3|wUG&8R5UT4p4ZHsW~{U1Q?10ix7Z0hZ9kNim+oxYziOblEL-gX$562$6Xx z;?BC`#xNHDyV1LKB_MWg&byfmVlWuDY= zqiV1CF89pN(JKjm;ESD74&2RVEa~k&N-}`l*E})Wg6}agwnjq5@vssmE)r^7;e8X# z<#N|TXSc97OH*-yjE2K6O0UhUt>8HMmD1eqz65*ZE9H;e42&{0^t>fOm>VvrBw7D@&3mMJf0VegDVYTgFw{Z2!X&DhNo4beEKL zNS7cDq9Wbh4bn=tfOJZWAl8Plkg%}YxGZymy}L=g)sN}{?(^;VoMqL zc!0?Gl7hBAOKXZ<-h^4({Kk%!yMT3(Fe%1_EUp)CvesU1b+0rT<^rfDhe3q2mKo;h z4-Myz$?))4%+2S1$Y*kxnL9#)gd*sNk5wKJSh6mI6P@6rTVOI z=(XFan7MX-3G-loyw#By|Hc=tpjT^XIj3uV)ILv!+Kakwq#1`tX51YWIJ^Xx?=QTllrA?3ijF@&U<&!5ss^y zt56Z`(NFvdOqyH?LDlNht)g60x2Y?+jNkU>T~fG3n{Nv`VIw(F3&Rlk9}o_7dV{HBF@!A zLJOGit1OwW8f#mOhxWy16+>lyW#KmupULOw)_ywA$J!e*{iN*F}GUu-4Q}^WLdo0Oof;p z=%Z-7&CM9&3qC8o7TBi zjiey8l`69R-g<)=Lz^mGarGJ;kI8kl6fyoeC`M|vqK+5ORY+GdFcXqW+Yp**>R2JF z03A)rwOx5X&;&ibdyw@j0e=x8x<1+Uvcm8*R1^bviTz`|17;97)3Pe}d1_{mJdN(W z{1ONIu3WM4oM!5hQ7Yn}b0V;WvT%3aEg<)*xgm`4($%Mu)P1Gv7a4hfIG&GqV<{owKfqCY7_JII%EHmKmBikqE!iAo7fCk zt^C{Z*i$aE3(1*~kg(kB8`TpxXy!yO%j;6nu5d!t)sssggERX6>E+YN*n|XAFMvP3 zGHSjI1Grl6*7u@W(-0dNp!&&}PviXnhJ1fqG{9aNv7W0+-(11wSCdTB%fue#-=|Nt zdpqMg?-i4nxY7UVy(vcGcfjO&bG)G+CE|W)L@40$S6^sq#`h3papX5OiP`E5WvLI5x#bN3jo9;7Zr;wgCp8u&6uPl zTIcQY_uC~6viz>XpUzC+z$q*C>oS7~aE@k*d0(b`Ec63_VJa)aP$)!6?&<>Dp^xPq zX5j&_+F6~yX`Z+Cj&8iz;0!8~mVmOv%221G_~5v`Tx^L_aliX1YGbt9$v zap>gU4S+KJb(~d1L^tsMRgIQ?r|8j>%4tgH>$Mc})mSBA*MX=AYi3|p&{Q%}f7NpB zT;tAaU)dy5_pnyMO+$K{%YI31jnlXqXtA__99QvDr^lL;4qG%c`L+d3w#{09(i&2a z^GKz+D%=ppcx$Y1ZJ=kFXTb?Lob&*qRZ&vb#^RjMjn}t@R8=_Hix~Rp6Ga-C>A_Mb z4l%Li+`{*opesNhFb3ER9CIN~-5$veGXi`Lz;)exA;%S+e*~}GZ_YN<02V+W(0QA@ z^Qa$@p--c^gzYEf$|clS|B{-ZNcw?~^vw{vCbPcVKH?rZ9U1BI2E+Ai=$}8V`F@s^f9#Jk9se z;O1&CY3J?&<1!g#WtIscBVY^{ma4D5M@?J2ym|fHXuT0E@Gn@y6gQJ)8Oa^t%d3k) z`w6M3?+#}izf9H(-TWjV8LL+|NL6>Fd=e)~dLr@ucn6!WW z@r-|a!nV|z|EPadVHm0#6JP!9&hAW&J|N$H(#@3O*n)E*Q=XgxVrcy!A0?%jqR`0; z;P+Os3OHfW*wj*A%Z>Z`Ywk%5@J8S8*aqsb^G0%|u)Ay**T6BQ-Rd{g9ss;p1#Dwp z-UgBDhzB{TNN}Yi#G|s&uv2!K&pV7hLZpG)>j##FY>iw<2}YgcmZg3J?L^wahmBB*nl> zK8Zu&SYjVcDzm+822f+Ncx&IFB?#WY?L(i=(N;$+xu1P8+2EQ{w{MbiFAG`-6^@0m~H{v|3_*C)+d*YaW7H4A`yw|D1@00S9f zwAHv}wfAP+whID*$VZoz+E`E1P4kWb6GQfs4D&6=R+E*^&Q4h)qa4%+pDX9z!uEZ# z&ON5OtH^;_Awbfmo`#uxzfb6pc5YBr=GD9!@6(sey-f=oNJv~~*h}VZ*PjukPM{~U z8>Vybo2$XKJb5P_ca9n~bn9JjE`>7kFM}_Ip6#=ykK0G8{=8o5pD?|O5#u~JFd$0a zQ+Anz)xT*0#E7HS_tNR?uqgSXX1Ahqy$sU|JAfk6H@NPX!8)+1_o81FCpYXzf+}Ny zZ>w#~K$%bWU5xsfz1395!Ajkw&9H|o$tma!W=Bb<>r~PN+*_ze=d9C}_XrqLcx~A; z{9+ZOAR|;7MK(xkP;kwpX z9Q^#fo`mNMl$Vb4yraMmL_ITp{l`mQHKgZ66pqOs>d9qNu+4_$kSsJRW!6E#PvK&> zi6=N8p%y?~iM-Mh{WZ4(6r$l=7D8T|)Z_hm-RtuqpI%_FpkGccRqs-Sz>2ZryfG{W z=Z#f zvSJSiIt1%B^HQwzlrl~RA|DE^0jDyPIj9rQX7^3`dX`^POz3D!stJL`H{N$sGcP&M zxS*$C^90>pTpX~o+|y}ujIR--0&~dwfzx!A^%c_O z-*3&7t?8sLOw}lETmuo#uHdX<-_6y0-KqM`=yJ>X8XC{Dd>{NOna|#CtUAXS2iI3g zJnzujG*R!p;hBk*? zQlcO@D?PI>R;0>r1Dxu^+Dr49m2VPVu#dCz{E>4LR%qs=Nyz z(5LM%d(CrLj_=diokm~)b-dOhzGreHyGj4_$5{t6n6#pO%iRx^k#waS30N0%Ya#UM z6~*WvIoRE47v4??yUnnTc&zVwi{Q=LF9QU{vQzN457kD z%||y})ZrQ36}dT&I^I^BoQO8bGFSZ$-q7$?1L+QWsn`7G=|!ON@y53`&0v~|!`mjM z!9WqRY2b*&uMKBd5Z`hv|FQG7<$5$P2bWI1R7`lFdDH<2C8m8dcsAk0^EB6QPw|t8 zb@VIl?5Zlhdpk9sI{wA&+gi~c@5}tneK>!a7wh2Qfal#Hp_%x0!R5$EPS5;&@`mNW zJ^PE#qZ1chR)BuNFY}AOYKLogapRP-nmlHk5QIT&p_`vmS@pxhG|jo*OQP7;WF8RX z!1=ez%dyC-&m7v{giiXV$*WMEUF3=j(yV_~)Sv?UE`Mi+=zRW0r+i=)EW-Jx@lRMU zPK6*QP_u_hKvH!Isl0<&g_=GZ1SkrnJ*|7zmvsQ@iUGED{3-Co@!^s3&*m(#(wNXY z2PauTMd2|yZ#W?Ot-pE^LSCB0naq$+9uqbXpJiZ7PHP7j_gME%Mnqfg;9s5y3>lqY z>2ZcS*WCe=CMB7*{M~BB5M2)jFM7Ej@<8-ARz9F!2J&8a_kgSD1Q-9X$NckEXJe{L z9L0Hx6@+%+7As^(2u(#`=JOw{r>ohMnxs=o-e2!E_gs;^7~!A#`O0S^8P@U&_z?jeiDBtv_}OH}jQZH12$2M>5{=XThY^A%jG)Ia0{A2+p0(bU^OL?b zkBjD9Hn+F8@6?c9NR^-Qa@7mNCF3Z_e#669M~iL^+b=jdF(*Y6ETtH5+uFqFBp!E` zWWiLf=-ektoJO14l&Uv30Xac`zv<157tl2iEZa=Xarx#S?KddhEqvrD;XSJ0ns~jD zUahbs{L`+{n&07QU;^(vezppUbMbn&!8_6ABAvloX(I2DM&%|d_;p4#3P#3}Jv&Gs z%NoRt>2mS)e2Td#)R-apX-eE!Z^hKX`tXQ|@ zo2Rgrt&gj1?V`(NLlYoA9-Ws~YdOEve;zVdBxs%vlC ztPIvFv+|Jm=;)RTGey2TFe>f#9K{?QoD&A5{e z4=s@Ao6MYaY|)e3i=L+VYSp+ zavmX$zcZ7%M8@ox;S%2<($Jzmaz3S-@o;wV$14%HO+DOX+AQ)5Ck>=`M2SwAR$ClR zi~ODEYZJ4r>Rp`hoa+%{a?)q=VAi@70|Dr}>#L2CT(;59SU;0GPhbjjnz9{&n?Ff0 zkE;}3PF?^gR)&`jBj^p`;qA7eJ{Oz#)9-(RL#2spep+9RbqdYR&voMxlk%yR)il?x zx8uG*L$ScV^_jg<;n^%B9c+eAdtdBjFd~Er0w9XoXfb^J4;e|-N$aSJ=y=2|DQ|erW9)4#FTaI1DV>fcJ zxzE}Mxtu#}H09|u)sulVYU>CbrxMWPae(BLSILJLKL26hp@n)iAyu#Ggk@cc|?p-BX)U+-6($vpc z*X}7B0j|EeE3)I8owU1+55E5h!hEVy=9`&`V$d1N!an}mAR?oQhR!0KyQ@HjJ$};T zX@t<}oPpd<8B9m4?4yCi)3SF|-bW;YDRq5w9= zZgPHxw=glDooeF{V04e~_>2edJaMcR_cjkuCh3@@Ze9akjih}h1x0iSsFfIgF8Et! zcgm(q8use>77^d7mglFxVH5^$vOUnM$=|PB@ z{q(aU8Bs)>4S8gjsZGqqXo<+4x8(bTDNV!TXeR8s4-4@TY_mg-cy4|k8A*&(N2WV8 z7Owg1SXG>$PFvT!OkJTgZXJMvtV$K7QIX_R#+6m!nO^Fg_wu*yo8_nY+I)hCUvb%4 z4Mq>z+_HczbAB!}nw(7}phib!T(`jPYua9=xV_VPwh)R;GyE92ddebe#gz>tF7=hQU6e7za?%=;p&}%s#ptE-~zxKX^kRii>HGO@QA#m^J-Ig4rLltnQtWFV^ zN)zeln$i7Od9Ek0??z$5#2d|42&*akY}~m}pJgT?*Bjw$EWca!=_O(R1XNZ7%v(M| z?8r`GEY-m}`e3-c9xMV2_9SM$Rr7C<-H&09LnQ>ThpR#ATRWJ8T`|C;`LOozm_R8~ zhMM3)_9s8x8$Q5dUWTDPuB8aI18hm%<4?r=PG&qF1B>cd`w<4W38?zm`{}}lT>$&K z(;=zjtzntO{UIytO?bNZio=L|0z}_nOEn(Sq zu$Y<_-Ap3t>7f<*UUbg7Hx{TOL}6kgpOQC8~>W>&Cmg7fdLzb4-XQ#ofi~v{6{vyJj0FT2u&G(F!+qb_oet)IOqKMdb%C*dFj}f!*tQnoO z`E<%MJGk3*uJ?28Qt0jXk=7lhMPGDwCTJ)SP@U)ydoFXHSg$F#<$iYK>5=^oaiAUk zfoi8T(Q|#+mpQq^wd!mDI6V@!U&NyX#HPh!|NTG zJ8O$rg=~dnRGEp^j_3wS?KgWPY!gJP-L3$gFKRBdW2kQ$2vzZxN7&_gMa(6IF(7_~ z55r*EbHOlIP}}U*ZwvNIM&`eVAhg9Vt27nag~HZv4We*xMIm?m_!UmHFLEdd0KGSE2vnUN3lv>#zWihj#9M2A}69$b|iB?Kc(9xfo|h& z^7+=ForKurau{(0FQHN%Zn|y%h<+wL_0tIR+%TnL5c<-fpR#uGNkVuCI}z@WM41Go zGWOKO5LzOE<}dyPrBlX%Gtoe_~C=L1> z5uq-A0j}bRc!U=kk4;UCW`X~kY^d_;nhMiqyl%RBOLJ&N?OH(n+IR+ULB|mFX*viL zV4lP85B?bc{ipI3GNbTu)djY?1o-YL6u#rCsW%-L|9<)3?-ZpPj>-C>txES8J{rHj z3ja#KUTo!pA`%a|`2YQZf4^PS&sSUlM`L)( zwN(HA{P7K)kdO3=sRUh-q{LlO9R-QN#L^r%At_}Ha|K*P_`qymYrw31N@W+0&#_u2fHP148!IOKb9`u^@ z_ly5E6a5BdM6*g9PaBH=K5q&*5brs^9H)FG{r7Ko#8EETPQ9`z`un{66b@$H2j}4L z@BbKi_$1y)MSifwZ`v|#@%M{kq*ksFpZ)rt`j;Vgt2;Q02bgAfRYPa-{`vs~)G-{t zWW23(x1|t%@mY1#G(5658(A6#w%UKcJ{n~T@C({mw@d!Err-|?39G;&YY#YGAb;cJS1HVC@&>G{*Y{7N2nfkxK- zeG*AO0N6YRs7ukeipZ?eihd5cQ4KTj5Hp`51Fa6x?ITbKWPdXV{EfBPTlSkTAKNK_ zJwEj|d(+d~?xlas^JW9Hh0w~N3V;U17Lp##BRC`A9@V~WRK-E@n1@rxx;=G9=JulRGyRi=u5zvm3} zPCn>*J`fCEf52pCt&Rg5YrT`Xd(nUxB90jcLZkX!459}@TIv~G=FeX{eS4acs>Dq? z42rxKpCX-q|5m^Iq6=^r4Hu?QE*v3Xuj!P6t8i2Z_%?H54VXWh)Qlm~QusZ@C1BGN z6`e7N!C#Vg*&Z+MbWisCV;n>gRZ(6POV8e8`iwRH+AzXyGdH0N)4uGXuIIsqv6}As zrnMS5VU1ko2@0D%GG`kcPbf|(d;(AHe+w*FV3tw)UIBLw2(Uqiz+>{o@uq5i!!=NM z-4X5qop&}Xx1NJLmOw;V3U#tZnf(0w8p#~R0gvVJ$+IXjAw=@OOuJvxn>0!Edso5s z*J10FzueHj0y+pDxCagY$IFbOU<*PVW&s!T+fDo{ICX+eA~fVo`~P?uk0Mi94PoQq zUl!Z1z-Rz=uujRJkN;eYzh1tF1>)wdzr}`MTLRD~1k@W)d4rVW|Bc)K39GkJDjSq1 z04@ST1^J82LilC8NWL{8e1il|2!A}6ykFaSi}zJK=+=O@owtWp^DI*WS2SmNYTd{8 zFF8W%7;?Q*Q=xSY*kGv92{~xO!B!w#Sz~R!2JYwu8iL?v?ddsr=3k}&8#g?*6(C}6 z0WDo-O$4xj+pj6Q^k|cZyMyn#q<~ZC(-*h> z@^px;Uv3_j^j9;^dj2s{7*Qy`HUcmz%jf1=AG*-?QiY!B+XZr01Tp@ld#f)(7JJ#C z(G9dnCT-G_`-O z7@RWG!0`kYHH)C-2on=aNC708QleMUR{W1A`QHRC6A8N(_})N(4KE4Eh&0W<1B?X% zrYDK_X+;KJb=e_Mumvth3OoiLfLHoJhHOu6Fh!SQg;NbE@%-jtEy{yn-w5NKxb&*u z%tKQG!pWw~S<3%?R-%aCC0et-d>_Rhmjt<%3gUXIqv9k$qql;cxK;s_d=Gy1e6aF- zlujv~1RgK#u1+TKCHYU`wjhhZO9vJ7IFgWs??L~&?D+}dhXeJXX)O>?oKY9VT)PNO zJLE4Ib#JyJT(@HoDH=UqS#* zN(P#aEZemr+?8D1iL+6PR&;X83p=ryp~xet!ndTCyOW+4vLQoKt%kr{@OPwrjj zr@2hE*Z(J1e!+{-xR(J=j8HJ7{@_l8n5)K~BkZ49RD&LCl&`)3X%%fzk6bUg&rkNT znwAwYmdV7e*z$$zA|RpOEb6<5^)<+PQIKLqE_Yw0s7!IyX#gn72uwhfV*_f;gxE&y zQBQE#*9VLIo4enza5%x%w`}Q@@kIbg2kZNPdM_YC?36;< zapah>TWp%o*YsDuzW?SJNsQnvi8T*TBx*CrCxKR&zn^b8Tpv`QFi9>GT7J^*Nvur2 z*)CSCc8;H^JnGTBxxPXZpB<57C0$<5y~^;uFmL>^57z%rF&}U}5CEW%zk%(MzIv@6 zkQh$90kCmo?=yGNMCRoe_Z~RD$4^lBEm3}x~%=|O-Dbd z3{}nrMTX$gcU`;}Id8Kn>wI{0r=dC0?q9*ci2%{RqjlRGWKIXJF|;r=Q23R74aOyT zc5pdLMEEl(sObY9g{=!225Bvb{av$a+RiU~=3RBDnt@RLz}Q%hJP(!daMCa;08~Po zbg~S9Fgg-OS~!SudnRKSnE4!B(_4QTI|Q#{%tU<)95evmx&1<6_4>rMg&yA*?&O-8XdOB^Y&v~D2wR$If-gIHhgY%wC z$_JH@a5<5eFF(@7!=q2;9n{7TsLDO@!04)yC;{xcjGpTQeC-qP6s)GWyq8fWM-KIs zhIwwg!Z}#bnqQO?MiLr+UhVsk(`QWDK`^qPoeue2bCSu<2>RE9>tuqPe>n#(<~7!3 zt;X`s#Q<+p=0;E-I3LJT$`JM=UcR|(xhbl+0zLwfo2tysm9cN^v)eTHjPSLcRQQhi zIhT=Sr@C;;?yKN_LHs9z4`ZWxp06h8*UY-05nGjtq35>=A+=NmTL}iw0kYA+=`&!= z-S?5#TNBl}alz236-+{caUfvhpM~_vO4g5a=rE>(1;~DFEAf#W_7a7#kr_@Lg21at z*FbbHO__!BQMvibP5yAHnn8RPo_x5K0XhcfdIjTWkbbToq+8@AnJ`)vRpSj>U--K~ zsm=rNb%N~^y2A-^Ygs@0zcfr^Y|F|uo^u*iSOkDEI%t$*t=EAy=d|1%6-DV4Ts+{2 z$huW^i27*k!%%M=d<)5=YGqTisXP?S zJ&> z(134@;cLE^h-l1Mmq%ZzqtJ_rt2M$g22LbJDnue&7&>cnotH?&ojPji2=fN}pd!}? zQ2|*^jbp&B>uC8L*pE1NJ5swR+V47ei~NK_4zwhKS1)oh*h`pn${oq{a~n6d3=xq^ z?CCx&Ypn^V9}>33rlQt%)jo7*04E{N4pSnxn{C~j&=bmVC4;C61lI2d(W@7-T~+?i zYJQlcbZ&E5uixO2@QI*)gEU=%(;unyAjR6EUsx>C1ZnrtjOdMHr1IU7XxArKp_6EG zQu}tE>H43Pidh=QH3Ev^$9g{tDqpP5=s3_Yt5UHF>jP-%@~t+4nBIHXts*X*{EGp# z&fQl#UawM1Xy@y)n!xt8)PYws;~+=LM1~xk)*VI18_hs=-?lsUKnndm#6Z)tS z2rQ~GZk%liz${Mqy0m;Sf=Mv((eis~vXD7MtMx9b&TU8-8=-Ad$g1=Y;00$tBVU(m zb2`fY?;2B;{H-#CgSYC7fXQadjMxg#P(UxXs7E7w`6iEQTb8DA7nQbYd*BD~{f_ z(7|RBh)iYhprtk!)r@v`p(_92cbTZNM&3Or4%{^}ShMqFz7!BK-(~C)fr> z%FW*ZC8Oi56jYy&7M2V$3%y3$wNCc81Xn1kQvP=L?H^MP@^mIYrx&lH5T=y;Heva> zOzOesn}aBy4yw9*Q0B!z$i=M7$RlSjAxx*nVsHiL`*vm5LBfmpo7+&)T7z097&KVD zr&nLxJvbq6{`$1$EB3d<8_X4@*W`oN?Mo|PO!xXw z_*)9%v!@4O>7R=PJ?fG3yhvO}F0tN%I3mf{D)#NFMFz1988c|zLbv>JTu`(+SFs05 zn=f%{k4NOtYzwg)vD(_F(c$&AKynVce3s98D4MUMReK>E1Vlf!Do0eP3kG-+r`x zn*FdV)E0e7>gJyl5I<;Zy+i$M@w`idp4_U3HX$5W=^%5UkDV+OyFR8HLq`S$xv^iC zOdCZ~FqK}(M-s`q;XoELvhV(LMAqjl&D7`?>-0#DT4OW>`bv)V8mj`Uo}xSNXP0p?GN=n2O)ig-(4G!D7%u zViNRu{(0eIO1Y7geGf4Ff+a#?69^#Eg~U`(Su}`x(TI_y{fj(X*cOq=TmiIX+YV9= zQty)@UA$V(b0S1s#H~=K5`vT{3jeP`Z3)8d)Z8NN)O%J7N~&9N<%FmB@p5TKurp~8YqI68MdLM-GIruw|ILz5&Mo5#8IR|U>2t0`56O@SM?(jdt z$tIIoSW~CzoLKWgN2IbZA4Pj3$Xn+EJzi-hRubuz;#zsL=A%%SdkLCc^>}yGaES-) zYncYm5r|V?#cxTrEWhk7APujFwote;mKT?K7e`SxT6}-7Wl^>Mxdxd=*%=wD;y(XI z=2^DX>RFb)nQ6WL0GeLz+~G=1RrNDzubA2{eks8xHhSmmD?#ZgJ_f@FLb~`PYx7cv zhOey}PX;yLI1ca#ZiY53)?&9l!ZqZRskdJkU?2~ib$B;OEIg+?&a3{kzg6U)C`m-m z2F?>*K@Nd$uqPt!E`xN7r@7G}m~@V1Mw8}!>YCsG*;jkq5M>r0{^lq;>e;*D&Sw~q<*64m>{P(O{M{5K2!v`_e-9ml7ApI4O>NvjS8Ov=Xh$>DW;MXCo#{59za8_+YWh z2`xNW=Nqt}LRS1GS;lqF?T$FvN{3gnKErnc?Nm+abR?|g0)4rT0PJ|LGnH)8vp;DM9mB3ViFRb=a$5{yOhs zSW!|oe4PNz%ZW-@pBh?L)3#ixF;ofEjRRmIm zx$(m;MpUhzdRX{~QB_9gX>7+6 zH>x}OGM{C)!P&=$a*p_;t+$B5^Xs|NMD8omdEU<6VpW{Xu%Qpfq}cB=?a3r=2myy*?#iX*m{*mM6L-eNq2yuxGwv~(QsPow{C!4&?vr)QH z20K1>u`r=U7>oOWjmGDKh?P%jV&&J;(-)4?&{QiZsv@gs27C5*>}TwXBN61hxwV1# z^L)AF97NGJQqK*8``Vzl!?Q4ot=(;#<6L!es7sk`sn6|Kq~iH-8E$cJhHS<#qlRt@ z$ocm^KuM{wuHBNvO^>z79%QK3hoos%fXSc+g>3fNDThG0M>v@K0F-ARAZ} z&}3@K+xD9=x%0ZnG}TAb;q>zN7~1x!Gmg`iW0a#0&A!mKY|4kX=HR$>u|0_Q$oMIw zWI?RMBh#q&h-6M?N5WHdMwCYHD}z>WU685LTm=etHc7T3y4X`@y{}AEYM+p(%y2ZZ zunuy>Un~lT^J%at!5o4M#xQIdbY7RQ+_vV>Xu>`x?UL;wn97=ld$UXV6iQQ5* z?fJ8ZgR7ojiF!L~@$(dBmT`R^6Mj@9l1i)opg~pZXl>_}PdU}dr^LR6wa}~ooYA)W zy(tc@Dv?ey=SmzKw;hBSb4Vw!1Q+%tj4c~;u4Ln7L1MnGTQu8mEok))7Z98&$mPB)M#!Lagn z*=+=xee2hQWegZ3a_+pjSKn)m&KMCNT}37eSWT9?mC&@|M#&3i2alqt(V6Lu+#jTu zWDu0Yepf3@AloBEmCX`^k8i!!*oGT>)xptGg!`r8;&ZMumF`6hHf69`s@zyeqTdV} zCmP3ea7FjI>?ME~Rtlx+;y#hj#X$88ZX?SHe_k&pp*uf5cTVT!8$#uU)D5@~ItPfR zhdU42b{uiV@$AaUbwEj7CMnC;p7?J2ChYYW^m}wBpZ?%lmC;+i%RLLlQ%fec^5^$fu2Wy@4kE7rr2v6zzVdYD8>FP_ zs#P2Wbp6N_VQ-o!U`Zx!UuZppY`@&AKnqa;bm+zn?ym!=Z#6I2bN7PdD)IdycKbhf zDKOYOJsXN(`z4l6y;zY3=Dkh!qMwnhAN5%jWo1qX{nw1s1(^U8h*ePpVY;cNb=AwpmPO$^ zi;P|CJr8M?C7oBPK8Q)i46Gr9Ij8pZOy5%y8$|X0?1Zs^kmN5IsJfKp474wug0;M> zt9;pF&%feLuI(Fc!koyu-i2OQRw^0=J(4bnU$O5x@4sTX8Vql%47fBgpmHd&6N&Jh zh_+`IOx!@Qf1H+rj!7G3gu&i+R89GgD1py)aDY5lkUh)dS?kIBi}J!NS>erk!={JDa;L8ryB(MYQ4_TU z`-Hlj;LA`W<(A0ErgT%Cd(HR_r+014v+v5Cn%Wp&jaz*@4eQt@BxpV zfFd1KXV;p3)RwIj)7TcCWA_ttK5F{V#Gu%vxpiF4XKk1ixvD_Mn=jMYm#lA_u zC!Jv>G|-jl9xS0fhO=F3h2s`6<4t1U>g^HRN*cs3?B&@s^HkxVYJ18Aeqh!=;=1%w&J!uDfDRy`wj$WciDh zVOZmW0`+6Q!0mt}f9wM{sfF8IA8jnlSzgjhK3!trd=a-De=QGjQPmuYS-)Kw_k8`i ztm=HsDaG)Ir8f55#IXdm1DC<&argRdqtoPU` z^uvpLw$(}e&4pB?-Rp)zIX^=aa&3(4N9o6<%V|aqOqks3%UG?~rS4Nk*SL3frCftk zK<%Icu5F9`jnYSpdcw8WbCZjB(FW@WE-6{83@qk2nsYBW*n_A@U;GOU+SovLOI*)N zJbSfyomD#!j8M!nf|u}Ze7=siP{}RR3c2(-jCIG*!|QTVw?xHT!daBL_zNc1gN=6v z_SrM#*zCz3R&~Z>7W{+z7Z(BELt##x*8WU$F2w`YS^O$@OQtVCeO-0^VvzQf*C^HW z3=E+|aUp7Bi2?L2p(J$Gt>=fAjy-=M-RB_8qo9Q@YZr|&LdT(R~ZAAXRnQjB3^ zVwDNr95xH}4koA+dJjxwJ>S0XRs6uc?}IOLvO*@UO-JGIIMGG&q2qr+L5nm|+Q28{ z{1qA{K2IQ*g7g-3LB$@9sBwFT5xQv}+u-vK3f23ma~1stwbN2KJ*=v+(Fk z0UWs>JO&)L@gh0gG^MQj!_V{>tAu=>3J7aUdtKab>yZGMz zvwuNt4a6-R)8$S_zw<-ppLVUQ7J+NuebCBI`8Dt(HLL?(u9nPOqe>ze zUz$!eY5~#(k!31=@KDEXvHH{7b3p6(+pkan47mnW_3J z0}-9Q{uy+UeHZ9S3GaiF8x)SW?9Dbv+tz{#AnP&kfW6Pt+ZOwnbp%eI{MDv&%p8CW zQL80oT||q3-V!CDPkKl5Znp0K`?&uNql3U0BHDoF9Pyp_+b+m*&;h()8g2}1Ue^PV z?(X(#Gs+bLpZh!Q%Gc^luzYjH-Q`Y2ZECJV-kn2l#5_rMgfgF ztisuA0QqE`Avw_r(5=#)vZbRUsb*OLl9PxpP65#a&0BFsqvH+XfDQlo*_x5XQa+ki=GO;a zvHkQR+iXz6j-S1ACG9r*+f)P-)C>(#dzxxAex(kerT&2A zB+>|A2>Y*_t$s*oKd? zXy+Q0AJx-v{Xb@XW);ed57MM_R`Q5qo^^np%~g$UzXvWpbQ@^V%#O(e(kEJ<8C|&dX69VAWE13KipCA@cK&J{RYqrA^%GNt@#rvIJ*Ad z$@QNDvKUjW_X!3qm z?;XZc^mowqX5XIUp1~AQ(LbVPU_KZFY3xKE&K5X8#PUlRj3VR=c))UZ|6M!(eQ1Y? zkQw=p0YuHv>AE>WTb&D<=Pm+SFa{=Q<_SmsAfR6gDbJKywzzcl6MV@Wi`aypK2h z8~p@65S6$69*dZ~vgzuN>!m@nwvMG&ip1qreuZ=J=m-oiCLB3@un4Cdy~b$9Bo`Kh zI}kVvE+*D}AaEQ7jrW?qdx4exi$Z1^48(6rJx;++pfQIU0U)ZU_0Y=FxnzT#{4p{# z&$=*(>1OE9D*?~JY>(6OC5D%R9<Jjj6Bg`|B72$l%qwH$h&V5be@opYnM0?@W< zZiabYQYdD|mVl1?B)|&Dv92G!*7Fk=?#MB$WlDGIXpl3{@9n?pe6v`jSoH5>0-=Br!lscg4a%<@;!P!^910e9exf3~OcO(Hj)q+06=m7z)G?Ze< zZsLK!mv7bmh_}HfZ$J1yiHHs$!C>s3i}{^<^G`%krT{D`(M2Gy_{+5S1$J{F zZaVC+sQ>@-$7j(jcWXJ!M{?M_f1W|XGp;c#d`Jr_lQE*8gA$w!BM#fcJFijg$3b9&F`-Qu1$U;J>$- zN&$F!DQ)BT?|=NpJWEU#Z5X=XcgCB6rwN%?s3e{f+Pk_1w7*}EXg-DA8IdJdQQAG{ zf%Y{qa9`3CrH~47=|LO9b6#*(kq1m#@1F?-`z&>D+qJnk_4uHf(cyHRmJhymgR>MI5 zFVy3-5K#rUG463nIN=7){@SKtsw!4|`_TIwWJ=jV6M&!OGf>8|o=2T8z8++W0v z8OR*;LCm=?GPD!`Z1D>tC+1X@gzz-sKBfV{)}Ff`0JLygY$zg`05r#AF#um2EFK7B z(Ptbuf5%t3+uq&&OFUNfNu8z~^XH;J*AXXn0csRKKeE!}js#E)WDezUb3WM|r3YRi z9B_JH*$|vgy-|D$l3v9s49w5cWbQQm!k0V0afKHf8<-fcpN(t3H=@~I{8Gb4Y{cqK<%ux28bm(rXW;wMO^a{@wgqFJiBZPXH6LB z^oo!rUP?^sf_xzHZuiJdWfN%Iu$W@oj0)rg@;lpcyoi*LFHa(m(IL5HshAk-%+B(L zUTRyOitCTpaVHQm;0mB|^Ko@k3@D_4e4Ve6Z-_ncK?_K^4t{3s0OuYyj!=Os>OWVO z=u7MZ!mP+e-(c=w#$Yui6Hc?wAh}o3Yezy=xsw&l6)e>`jm3`Tb++IYVD>Z}y{SW! z303TTPK-d3OB|)maWBnvE<}6)D0j%8)<%h3^MwY;JP=!GlM8>N=Qd2a!jA3;xSJ|t z;+2M^V&RP;LxB{D{`~$_{siIm9665h>LwveXm9&KMnd{DxiRx0F8&qeJXpMfq5g3} zt-u$SRhr!tutC|$w`6CrJ+M~JBGrhT#YiOk#rt!FDsSHj)+cz2_Yup0^jwwfBkA-y z7`2Vn_$ieaReV->?<3woWu&fAl0xXcLUZ>&Q?F1aQ&k%jq6_ZEye9*dUH^KnnRrK3 z`}_KFKlw1tFs&Egl?J$hLbFv0C`}l8EQ;%Lb(D^=yWQmS=U?Q}z9li{aoT(Sc!z*W zKCMt`?h&pZ?y_e9(mJNsGjhj4s>9qP7N5`mRLlQoxL?GJ4xl)@#Zu+F=wthpAL(9rjP5sQCWEx8jO9-kX zTQ&?GTo!0Y2~3RX5JF}^rj!&P`Cup$-i{W^qe|DV{Dl1gYl>|uH1VBsNU8rbe}bpN z9lg|DWT5TX%_DEBwoY z#ZXgVhsG$YG0Qp#ekAO|`4-|W6Mt6vWl}SyTGjP};)8_tLAV?u{`qiJCADqvnHFNbp**t61FEvk|L8f_CWO*jf3gjW@nuzv{j&D8=}mGLzCUg5YV56=}iV@ zU{!}1y>q7rR+LBwmn2t5Mi)9JKQd&+{;9CY<&U8y{lfo`ytfRCvR%VQUl9eQ22i>i zX;8XBIzv-)^krEQO_fqPe;xsxYJ7=*VAMyHywKzLhtP!JHbtA>u6j8DeAH1fVw54z+`{*cKfb) z@i;E}f$~Q_gY-%cEfBTX&S!gybl8?BT>A;QZg}O9d|X&nG_BG&F?ipY6J8&Y`Dxt^ zyHMzTS4hkTH+@ZKqp}>0d!Xz`;--!pIFKXqoRfU66QVSj#IvUdoex;#2)wyCEsJ%Z z(f5lkeloFYD(o7;z&)4%hD+N{HV1LsvuA6^$IH3m=pMwDcsIFE)9Pr$8M8RHpU@0W z0vcNiKSJY&yH)qz$JCg$NlAZ^3YL0qBG1}kiU}<)1mH~#PpLU#x&T z6;-}SJC#s2%wLgEWdc{0evXInkr#z7ZSXxhR#O1Qfm*8s-a|n`JLzs|_4nzUYVV92 zaXxOnmy2K2_LpGXeLJ)Kv^$q3@WY<*$XrJaz1SKsShfz{`!wq2O?nAE-ZSnIXJ50&opUmN7gy5UFbM;2H;`!!2i(?yeAa}w`@3squo zZc3rmyo=wiL~T`fB4h7kl+j0%?)itF+c^rHp*?c@i{}yri{x3;ZIepQY6fBGFZbyt zyI9kAK2rQDeUOKPqR+Ft=wtgZVi=>8UR=2%W{JUdasKt&?=yj)UxFsnjxxN0J!w6% zd?l%P)M&@Sq*T7;2PD`OakB$leWQjxq7+XZQ;5pDE`* zt|Kvpi_&Mqj~&B676uPvPNB1M;Oe(uz_)xqVmw+3NkKaRVQ$C3f4=a`2u_H~Hx%7D z9k-kvq*a74eeD`g?}odtec*br^ab7pay8ekqXpKkrt`C1AToo1u9E14ghlhr$H|lV zvz?%*a--!jTIrxb+xy#l6#ih+(bnWs0WRfH;%~SKtC?=*HT&lX z#V4j;r(U;a9*)r!R7|{JII1soL#3=)&EVRdv}-LW?;}jqaT#ARd$=g4@ALif{3j*O zkiwd^3=e6L8?~x?K$qbowprh~U5Xt<>FTNNRaiLz6P-1envw>Zh&?GjU!u7N&Jjf2 zB8Sn^Emp;i_%(r?^}8J{E?VnM>Y+N);Y!PZB(kk!<8ZQFpUk$(ZR~8vCu&2bFZa>R zPt?zUrue%u$jH3$=&S=C#(l}(aNk}(oZ=O^+T?X!pY-X!Hs5+Q8#X!Pc2;Qr*}x;P zRZW1qpss_|dGO@J32Gpau{(Y_#bor+%zMNVpv;F5Uu2%?tz5Xb`D*&V-MXw$qR8U- z;4sdEQrKQoxo4?kCGsac7%(UV)K!^SA-5qDjeWmm?j4!B@v{S5AMu6YlH*vVz-_=L z-gvs#V}JNDH_*rMs91h+&MPorW2c69Ki%t4RjSim@og2xIXfcnjFw#OdwJ?mN@2*LjzC&Wnx;%10Dh;S&QL z5n+?=X02rPrrbLQK;sME3^G8qD;dIU@$CarQ~Tq9`gM{U;t02Z-}rMQwgDa-)h*Jz_;no)}e-n;FuER=o>GVBjfz9Z`M z@AAZIT&Tn6k1&~WNAz)-g6JP6j?E5IwN$Obb`5t7`nn?z^sGy{Yz|+|B+s`aalkif zjAkvA)`u!}tG`4XDuZGLyhMDlmp6#BETtpUYyIQrl3HiJvA59|li6}X+&U+Q-n$Qy zLB*iuTxXID{|3Y$r0GC|kRb9Urs;*u<-s@;mDgz}e)=rbmV?CV(7phWsDQ3G#yf*w4_7n2g_L{O`F1=J?KSZMSWc{Z zM0(flV0((mCPlR^(E&t}&QzJpL49fIuZNU{ZMK8!@|QD4-!Ho7=!cm(V4j)TLmR)hSuiDoUDs3s5@pTA%=;0JRLL1;!o4ThzLZq#^XSq3X#!Ao zK`m<7ENj7Q8h76iqSc>hZk?e59X_53AtuDQsa+5bTL8MT-{Y3cRS8%g6gT7}w?Cf0 zF^|6cY{+>e^6aXlHFExvO>9!vP8FkWpabytGNidKC(LJ^ZDU>u%pXgM6|hx&c{jgQ zK7b?2JAbYIN9Gk<+kN35dD*RaKH}82YCc~!f(g{Hl+5CuEp5Sg`_V^DZ8Es#C(l>3 z53dDL5I)g%{$3+$INES1PCdeck$}Z6lP5hUU^?ry`1QLdsD+%=!;_3!NpBlQepz@d zdI*;eXqAP*J;$Jh_f14?0bIlWRDmf#*S3zE;OaD}$=rn!N4tB z4HpOx3K@4MfPQ_B-qW097U^8v7GbBg4+x!mHQt>7+QPxyonOPLCb0L#{%YE_-7_%L z+2wfLvFCdi!mfUY(BKQ|v&|7S%5dYy>8RpfBxlWNrB?>-y8$0vu4X$@{Tp~!PD0q9 z4$gjjwE>DuX^xxRYgT%y{L}lT1(g7&)qm)CW}SWC`|)ZGD`z7!TnF6Otyus7e>ml~ z`q6lJ3oxuWXrC327%+wM5nUkCgxm^hx<8d>BHm4g4TuonboUDezF^AU_8Irsv0u=T z>rnBTw!13nvh$8}QLD7xgvr7wyf;hd6UprIoY+ZlC;^OnM zIGqnRj{b{}_AP4`{sd)K@S;h(u(iQVY`$qWEMfcZQfsSQJ@G+GesjlTx7es|m zB7N+5$+-h9L-zNlO%Z%|3y6xTtLAJvEhaac#mB{YzAjK8mnovt^zFuE+SZn*lnwHD02QI zkZOMq0|vE~L8o@jC~^PwYI zwk}5#wEQo4=JRP%Sr8(MYnnohi%5ib?^{c0=BIWt%5hzM0qV@yR z^TW!U@`qk456UkRbqQsJh?mD{*S|(}L2mu1rXOs^Xoh5~xgKBaU>a|Ux=!Ks3oS39 zXrg`}Mr-4r@)*@uI`p}l4|Q8nbGtvBv|&?WG+%Nx^F-^_XH1rmm%%E~`0o}z)0Vl> zGIi&*5~rzlHDYPpp3wQPiHH0o>0aF|poZG0xJv2eG2D!1wlL8iu=i%rVqazbEdJVT z56Qaw5k00*+QLLYM<0W;qdTa1L_c^3KdJQLI;=z2 zuA0J?E%;@coboGQ2aYXxJ$q|;N~d;N&c2~gPHj&jSAWvDwwOxo;oiw0+Ww7I2cDwW z*ggmOU@@9jFw8y+rWc6nQtsIYH`W3Ek7W#y`3wI$wGwjDi)q8gr@rlq=#mKdfBwP?4M zU8Y-W2v&3gG%6?Sn*CF!XE#z4oEotCLv3K2fn==&Q6l&O@;G`X>CUa9Y9b{44GW?6N{4e1>Vcxi zLs)MMc=KQ2Q;$wQU$k#cca^Qun)XzZd{lqAp5LN1&Ly;2psfCms)V3lfYT*)2*xN?p6Y7-&tL6RWGS&j^ITyPTLYYF-Bh%Tq z!c;Qaw5ksb(&zYb&X;x@mcGZ5?OyeNz$0U8PG-sd0%Sm#ivkQK_q&LAIrlJ-3&AVTJPjK^?;8u`GqJAf_ zL3wTlylD%K!tK$MoqFTb^GZ#D5)9T8#A#x4<2M}A8slH72zo?MnugYGznt0qC$6Dp|2wh!az>%DT8vp2};{NMZaEU>^7GCV$$lFmzqYSmqC=Ii@l}3P+hDK z%J1-6*+U8wt25cp!b-Z;$~*gG-C{0`+wWl3YZ+P8hA0lPA050>}iT-G7pcf(rWp{{UgV0yE-g(2NX$KZAY~&(z#p- zk1S;lUxmp*I^gmP8%AxTWQo|8DwJkgdM`DmW(LKvjHdV(mC_m|bv7HsKtSU1HBtX) zA|EnZto!5=OUF|JE2_m5OQi#H*DfeF4s+kI9ZQs$-cUN%PRz@FE5pVa1jTkkhrH~FR6)kh@Z`%8GtmCy+xme|R z89$ViX1H;APdOfO^eu?;uBq3k8l?-mFlzzK(a2+0v2kX=)Zi)9fVR7t=vrJ|ro()| zE|)P+RYj9s&B`08J2<_8wEbL*;k&}ScTzTK#v{hRY8SA0B}Uq8I}U7;tCrHFd=pG> zYKv@}@!6S%clU6%JIiF=AJye7LaZj`7gG{5PLZ>U6&LrlnPcsI6~A0l3&W8iVZh*$N>iO59z(i6c62HL8=benTutJaEJKc6DTENl0V3bHyL z$~5c4PXWk#!0w0=fBjC1mVqu-}fm>$lck3~iR9Paswd9mGL{p@!^mk_}3 z;t3yg7eTnY3tORi%0-at5Wh*rk?>T^FbQKXZF@wZUyvG-<{3-lNAJNArr@$KsR@)f zs*cLLq+;>%A-l0g@5U;V3<<@tN=-(dwT(V5%W_pfRqVW9!B)-r5wT39f;V{Su~DeO zMce;GXclr#dN)ZYY}eTHa4q*8di5xWPpE+|riJ9OV3Jl(o3V^e!Tr;-h$#qS$b0V= zYrAik_L~Wd4|^=GWPUhTXt8)vu^1v5?hCsWEHK2%j}~{9T>@_Y^y>lsW(7+FRugFp zk9l?_cirS>89nTJlcASMlRj%TFARA|)XE%-8sZa|J!`MjJXfzQLk(-6^O4Av-CpGN zvKWuIqVY-lv*z$t40Hh;#5f?+j=ntTy>Wf;U~e)#Y=hy+-PL(BOzkzm*#x4p^HK9++`DhGVo11g$D9V3 zd6s$G!@||}VoePVUYQ*ZbcBz4#nC+Dqc`T!T^a1*AiF-ot01>mw;;0Mbk=tj;?S$w zw}3L@YVe_KuxzTa%>$iNVqK1Et~7<}u+F7_gLPRSCUTdI(CaeA!kqh?ZFuiopnd16 zU-`f-UArdfv0YA|5Z!_4Eo^d8dTfmW@6r0>)sl0_h*)`F;*D&dCN61OX$jXajDnvxtooH< z?&6cx2aIH+f?`)61emWjFLIR&BuLFE(m&*FzO+8tE<_MKX4AW*Lwu1^ZV3+QxQaFp?l7Do*YaXP{P{y5GC7i&rF+c#`MC;n6kA0iJn=)%i~8q%{nQ> z8BU(Wiu|-;bjO}6AwkbO+O7w4fN)V+fSaJLyVUWNXBpw6Q}CIdUJTGm253Wr{jid( zdy}6VM_HTenzJ*^&~ig|)lF}zZw?{`Fj>vE>>@6=M~e;9AihpJ{zGcT)h~E0q`$6p znlA5;TkFi&SYE6qXGdSu3r2NU;6?SXXkWtm!;V?c9TQ3}IO>N}&6+Zcn!rldYgy-3?TjBJK+@19Ny`kU-6m`Ava0|Ls{s5U`n~49MIKG+1qJCDX zrDtIAr2P?BX&i^(4s5@Yt2aSgUOSv1QDq^T-@pER3EPs`NKD15a5l!R`;Kntu4P{Pgwd4bd)({DA)a&6uq_e6^Fj^wENNaS&YL6Zt%?Wco7dOZHk%0dp)4{Z? zL@q=^RJF4=p){A<{zaYdc-T-Wy5n%_fabXR^R_hhs)@U4FGqAzv@fdT*}}U~VIx26 z{2yWM;&XHCnkt-g^%IHF0dg&zaT~?VJ9p29ZjBmPJ)Ozk&tV%eFxWJ{Sh0Q>p7^v{ zd05pT30+-J&P~?Pbk*G0Kge41G^(y|KW=ok^ML~g6G*B+HzIN{4GP-@GSxJT8xncc zI{6dKg!)1M%YUH<`7y<`#}=$DxjuZpHEQw zP1>`5VYvJj%MO%Tk}l9)V^yw^uTgLt@7YdawZD(Po0%l~d-h=rGLhNaF?YQ!m((;*@f&-!L%9iT${Yh5 zc-(FstT-w1g$rW~FTvzDmiPq-oOH9BMrW6N2sp@NLsGjYU$SLnpivU1wA^>g;QKI; z$K(~Wxr|3=OvNixcR#$#0NPy3{_t3%f83(&M40;Tt`< zA4d(YKeibx$|>FX_uu+ z(g_#G!(94C9Coj9F1JW*g~;Z1RqLUpmQl#tN=?Gm{KBog*SNPlLv3f?ZZMcHa;Y4Kgbn@z+uJ(+Oe0rmnYDiTEZ!s#(QZnT|7NZKXvn!n`#w5sp z{}Rf^a}BLUQR$4#!6Un``ir?!10&AphvKkBjH2p!*#MgQG#{0<^2TxacKoafuJ~>5 zi=Kq*<)0|sryM>CvOl%GS`|lQ6p(!KnikzocQ!8X z9KYxL082I_;T+4^r|P^EBBQ+gEb7{64Guz^a+)}|na*KZB{6@znr2Z$8S9LE3s_Ei zVb?!8?S0?Mr86OE<$MY8pN)-Yf@2pcd_Z;0;a&WNQD=Hfz<5dZg3k5ozCavGw?Vjo zrNpiSbXGsHFZ9hq=bg?HR#n5PkoK2S zmO>vhnY}0*R~QYRJmD2fbuKHd@c^?$i1r~!qEFV!;vQKrAE92VM(7|T26zhk< zrcP!kY!`t)9$WWTxOD^&1>W0qt4(-D%tM$Qk4!^%G*L@N^- zkI&}i+Qhn;n74a?a=|!Ov+~W@aH!WZ@#=YL$`Rdyb{Wj#&gwP^k)AsIk(Hv4>)Hf^ z8A;tTqxrKh2L@+U>dy^@ES?`7)}IS*#<^uNTD{2pMk&L#rl2>2jLPdoy;YX(N-JY$bNd$EbT|~*c9(s82D124&#PxiaPmLd0k#d+ z>a4A4Zz0Y%-DO!K(@g&@N4-L&{>nf`sNuqu$ZgW$f3EzB7TGqaj)8*O%VhghX>-n6 zejNuuQa$u82v}f$MiDI4@_HL)s|(M>pS^Ld!Y>$xt1M2?8Q>hKwJWl8JODkK1)= z*RY-sHpqlm5N%2W+h0PaI}HNtHUiVP;DSyKM4E4#z7F< z%V#qSt=wtuOuz~8PC95r!QGtC!*;JjbbgzgSUp+PT2(!WJ$ZiAgxg8!@_b+Kd|H<5=E9)YJr`@qx7psp z+owbi>J(k$m;bzJfG&-?){XRMcaUSM;P)LN9UPrGsDf3|NLV)p27akh`Iyc$YG@JX z!sUN@4to0IGMAX5r~~J4#!U&{fBStVkoDKOuUZ4hB>W1J{n)uKoLDXSo&E;A;Dg=_ zrKphSKIr>Qobtrv7+b1&SvfrN;uCADeu%^It{hc>Wf^h2lc@vxS-)8Q=(GFIvA^?k z-uPU2_&XN>DESsj0IIse-@dUSfA32^lv^*;3p=kyXKGhdnBd&Vw#R z_LQsZpsKjtc(xsT_O!0Fv`qI+Q|JGfVm*{Qc%>QI490L@?t#`EaG;*CIwg#BIk^GQ3skWq%!rL|HEA~kI8DJz9M6%<}0}(q8 ztadZ`ZJ@11Hll0SAaw#DMSAHb0Dv}80-8(PFOZB$fDxH#eN)YFomF_t_4n}ikNx(a zec~(g*5m2N#O00RCdx|yZVJi*MSCRt3fccl?y*^FgrtK^wJuY5Ztc@Zfo#zRI4Cb- z0sCjifFbMY*n_k>fM=n$^+2-00YW$896+R40x)WU;Jxmrfv!xW`mHKVK!@iFl4e#d z0BLp`Np|(MP`BD1uwDkyMGDYb1BJ*^vG=n^K@V<?_c3Q8|N+8~LUZ=c@8B8C8( zFdu)w3;tf;!3{Lu1|Vr2i_`#?Ob<{;YUD{%!;s)Tpx8iq)CWl1zIoUJ$dv<9FoFDu zzVmncF{7aN3+NIBXo%L3NVCXrTd3;jjtn^mjk=HGKZ8aXjc9C=%tz z*04Va_y8010WaE5>O9CW>11YPGbWDoTq_x;U9df%emO%@2DJ+^z9zo+TpbE_;^J5B z#wPG)yXxH;0JwL4nL2x(6Fm(EY)Je>7)XQGG-Q=wqSgHx4oK}w?)xcB;|O5MI*jsa zg$Vum{L4BHSEEeQjSAYIuuXAq-bv*$k_uO=1~hIr7v}nq^pP6TVBw?crVDoW?rHC{ zElVdo{39F<4w4hP84w;@k@UNdnx#&ziKX)WvXC6#G+k30L zO(|Nf|8bb2>D0NifG+1u7{NU*1?f}J6JYVPYu*mFE1M?aS7Q(Qp}cPQK?X`X4s)ye z0K*%1)zllSA`%?250fIbA*x5GG=>j7r0 zQwXnf8vsDDk;I__>v`FO+cnmCn?e{D|7+GW(O-6nv|O&%jiCSZ*#P>MKlan^bZ>Gf zv6gjf5H7Bj>9rX|ly-mjpNv;|bv;pLSa6+bh<{-FaN}7f#|0l44-;u1*Z;DE2 zfBp3I6kuU3w!J2Qjp|gt4=n7b9M*z=qse|+SPLYFaEixl)vs;SBW&PYd|JE3`s?lX z_5btGr&+%p|AQAg2Lu?`Q2tA}ervj3YiU;X##8H*b1Im9gLKj~EU@`N^cWch44*#^7&y|qPZ}a~pfv&PnLW0*H%Tntj&T)TC zR@)_f?_dA-irrOvJ8d$|4Tzshv>H!Fz#KkTL(x0KakEofNCYslzkj1r=Iu1#zVb8q z1v2O7aK0LV<(UYpSpNI>{ut`pYhZI=e|GpcEDX7NAblAIR^KD0iu@nH`1c3gLlT}} z6WIPmBmK|i_WH}`HUc6qx-273v;eo->eLbiCYu7_{xcy$eePtTMCh6FJvQu3W zIAdh)>H_|l9|@oJx_l}sa<9+HJ=<{lw9=nW#xK~pd|bNO%R5kkbgo7i3qd6b^2?8} zH6C+H;cx&O_l*63_!UeaSc8$blCPzn2tSrXb(H%p>Ko8Ke!4YLX<}aCuqdlr`62;m zakH)*J~9-v=udmZ`L3G@g_ip7pXeM^Qa{y~(S+;;c`4C9nOv2m{)_@teJUddT z8$jLd(MmNZ)ZoFAq&Q0sN+q;Rdd2fVE`U~qtmD<4=ve>ZEn z&=ztC(7fZI53>-QqLBsG5`ItfGucW6iO@WtHspXY1ls!rT;hO=qr zD0`dq*~6B5k|uL*CGZyXtVyL0GC0=dAO3qbpH%$#5;YXvkasSO~Gpye=pP> zEvi|#Wi?e(O7J;HIc32Gi5=Sn7&O;ONF#tcF?oO{;{wHmyCc^`b}Inr z%G?4j{F8Sw7?Xf0*9I^X@VV`oR@(xx?JB_NtCPf`PtLf)Z!=*E7O5OKu%8R1A0ZH> z+Wl|t_oxcY`)jAtZh(#`k9@t_vS~nvt@`KPV=Y0aAvcCk5IuYp#qwin-aruh9Sbk(j5AK9r(ZAiglg zbF72z8tc}(6wVt569-Ye{3^*&kWexfNg+Jpi$?hawq52#ipRe)l+70vG zj@syLpaUu>Np7Ua`1ig2 zpRFD(f?~-zjOTX*Sfz)647~+Fl@+H3?xs0(kW>M>gbBbVzX^C1s)2Att=Kxy6(6%N zQ(nc0YuDtQXn8jUh!)bSH3YC{xI`mmv|L?QwTfrE8*!>kW$YZNj0P^DQ&^xRvuu)>-7Ba6^Zi(wNHbD8fDu~kk3x-8L54n07H{X!mJhWlpn zTU;S2Es~G1&1CS#R>&}95R7|e5R@Q2rCu~0FJO9rGr0xmgvI~$;ZUbHvoPPpM7ov&P8%X={PD9e%WC^Q|W zYKgs#ml{42`j3Mmafwg;jwg4Zz;aO|>CVGb-=1C`f)4l#M21bua?Fn^aObqEJO%f} zBHjNQ4aAqrm%<@w{{9=He{a9v|K^J;Nq>HqOb6w;8(~h%P?|s+M(R3?e!y7Efk?zCiurH0a9c5=!eq zn~y@IOs5vTCzMJF`O6x;zvl~dK_)nAm+I}C#Jv}K~IHxKbg(2QRL%^4@d@ZG-Zf-JT=b_wm5p5lHdxEs2ueK zssc3i(EBEwz)Y_n6M@8Ml_6u`Xk4zc}7yYwBa+`gkPVNo>2Igl`NxGw|* z7-FB6Bku(O5HEc6@gd2cez|#s?m#z4Oo_BswN$<8WaPIo%2wF{f~&T7-qG@V0|QVm6zcD7W7k@k_=I~PkhUDyIb_x*b+Q_)YCSoB3hSPJ9;;5-dk^*8 zSczD$U2bEeKnH0C9k8R#GC#M>xsUIB*V>ENP+(rEe2KJ(ClOoM|V7n380FJ^EzG2jd7fhs05xuEtTq%hhj5DDk(he7%Tuao||u&F62ym*7n8? z#~5k0qis;8PJ5QSD@}CY8?uvGGA{5Y(rzf=i9QS zpX&H3J_vGJa)G0y{MaBbl%pYr6*CcLx72eIY~de@Z=hH2vh{^bCKA+F>}n9zFTUSh zjp-L$BA)Vxk3^r&l~y@#JYlM%VSA8t-S+(?0I(O@%{Io++Gmu2^jORC_a+~o#Sar8 zDMhXTz#@-40Exm>DNsnhSuIwM;C9{CTYa!<*xLYa!HnFYaGjbzOc(cQw8|a6qY+*u zt!pO6iQOFTNW|G#zKR>U79ixWT=l@?68~YT%huDQCwxp&6e2GN;*u<$xP|?G6TD}= zmSM<6>q^L>_k7m-tWbC5k}Gi+Yu+$#&+q=k(`s8APvSXFAvQuhyTi@#LjWk(1z4Kt zA}C^4suGBIyMPo#jYR^GZW{q>DeijJ*RTuHLpvFTfjAT|08T!$$=^E%@T{=orM}0_VT&&ZB{hZT6wTdJb@8pF@hu9JB5dN5M2__UqYp@m=9W&R6r*ka2#cWdLCpkALp~joeErwO54BVIYMrSuH0f8U%( z*F&79GoW%S@%sri_UgcqN{~Q@U@HU*$rn@|QFV(7Raj&MvJb%^xG!Tqp<5tn2p#I) zZGAV1^ac>! zwa0{xnH}(m@lV0uA}BpY5O8uwKw9y%)VO`B;Rg^nSjr&yv2qg#s;KLwp?`XupSboL zVJ%D2tm`VPS(B{hPY2F7o))e=#~u`Hf4Qus-Ne~g=52^maZ&G5Uh8B&iDuUjlT~n@ zhYXYgYhI!Isr#Ps%@{-TL48`F86GbE-s;=CfO(zv#scXn6Drtp84qkwJ_;T%N*T!P zFW-3zc*}(6aU~WH0z^-UZX=3dt5n zJ9R-O<}W1f$hGRHW={Dbei6vTISJAZ8$pjXeEg-L)X@zVd)plVK6aqmi^xXI)mw<0_6lR?QhH2G+sj53&Y2t=Wu*<7w zslg67yZ8*KsfZS|X53Z;wk&y^OZ#m+5;}jB9Ti(tAgQw0FT8=5)rGk@g`}0R%}C{& zxWRAsO*UgG0*#gCwgH@;Vl~jY!g-wf1a*6;&fiH$pz(x+hPX+h#oUyB)$9>Pr5k=pd5qTqC0iCvJ$I?5S*N13 zLKog#?RoHpX~vXzMjPG6znwM`P^d&XZ;pMtn4?{yrjDgrIiYT&?tg}!axQS@4xtUt z3wj$cw{~)JTAS|Y10^+vx^maumW6V@wuQV1t@+X!1gZ`iSCC}^;38e^2Cak{~xP`a+0E8`R~dje@l0Cc;`JQ1sBf=u62H>attG7Is z@EZ=Q0FFIX1an7&@KGS_Q6DSfs6ot!3U4XtBHp9nY^Q0~`FksG3;1CtL(*RUixO+} z*HKtO^d2G7_id4RWr5>Ug=Y37b}LkPJm@3_`@!_P*pq z{h`zif>LDaB!o0r*gw#nrswEjC2CQ$z%%2r270fZmnw0iXK9GWpPF)>;Q=XZ=AF+y z79wTH95b0;8qx9(f`~Flg1IQ*oZ=>l8e;|qX|Zu~N<9>{@>dyn;|1A&rkb(;E%0kx zu-i8_kzmx-u*)^b35@6&3|4kmZr^+Vx*rJqM(2CXe(L$yZsrBGOwflSWP)|pT*@7ff~KJCA*J}a}7qm((1){A%Jk?8)>jD>t@U1 z(4kL=LWTlM*L=GlyX=oXn0;A&wR))^sa|l5L$n3j+iUzTd*O}?1l#=aX5m{Q#4}1_ zoFWMj+2iJ|soL_%X^;K+c|txPa@1<*$_?(DX6R(Jp+|S=R6v%A_Tufy%f@r)A+KEjX_@&1|d*x;<1W}^l4O@k1IoR*s&IRc&Wv$u~UdpfOCf^MN;&W7CJW<#v%#{zQcH#lZD12Mj?&%de{m z?5aw%y_{;X!Ii*_j>uLk0;B1)d9b-_y95>6y{@E9OR4C+q#PN>&E{S)zw19X-;e_- zgQ&q1Ti|cA3uekW*!pEwm)rS7hPb4(F~%R1&>4oiQC)`RQq33d2e<&Iu5JtJFz*`_ z-1?b#27Z&CJ^>;Ze%S^241vK5q|^2Xk_&Bn~R8skz5fw%-qJ~#%?IL`R<#Lx5asmXmwjYSyByIK-cE)TL_ZMj6v+X!O zuCCj^AJj>owG16R`D%06IuzxF{=uAVE5NK5GuT%0>d#GE% zXM<7Y&Fym5m|lauQyXu^#(B5IavoZhn$DaZOFQ(i#!12^j&V&4=Pt%i=g7xUhoCCn z$TrP%u?1{PCl*^&S_Zaqls@kYF@<`l_O~R6x?SBf5suCkN}LVDK)bA&Rs3V$IP;_wnpyI?0+1nquIw5G`Dar1#u9w@x0D6QWRA^h<=(z{nx{Ng3i zO0azgdLC4c#{c-T_lF^8K9#Sb)A>)`0liC`bhzZ#wuAIb z_?#c}>J72OT42~Cq932eAZVGS8_#?(L6%f3>Hc-hHvDx^d!DP33p4kQAC;r>8pco^ zCiBIYe(x_iX2n_VSd)Hv*;$(tbzg>8d`uQ9Y{!cyaZ$TZ)B9esjehf93__BU__Z%} z;xy1jLuO<73q)|GJni44;+OL8aj9gHHS69;I=6QxxNroeV~IyPFwd7E8_L3S;YN zs*rCR#9Q~Rr-%ZF;B23H(K#JSpne{GFg^@tHx=y@5MsP%zt%?OpHvd0NtT^7 zv$t!hDz;(GAEtfut$wG*4Yg3IsBy%dvQ`rdv34<>L^GiqyyZo-&4x+UG#tala+rK(6C5F;YOr&LQS&rcWL}qDei*kX< zkLadH%frQlR)*8FOd>%RivlNQ!L{oCs47tSEQW7mWa9d>8$M~f>n}v*t*C9c4;K6r z2@YZ9XKZ}RSpWB@b&idmP}BwDcce4~#5PgYWyC1lepyt$iHGg42-4^{hfj6_Cu!C* zXJvIeCvWcvo48GS$na2zgAZezc}8Xxuj+3R>C)q8Udl z7hiPJV)9`5G&|TLPrhaidFcx9r5iaVyYUHc=%@)xP%mzoLv;&G+Mjmj)xn%2Dmm>$ zSu&5-F?Vq34nr#0(>P+>`l)6-=Uvv1vc0hw@h^)`ZT@0?KyyyCH8~-Md)*MPcZMBbxy6h^yem}26|HQ$Up-qq6Anwl zrB!6xy)lrhZTtl08CyzO%0+HK%Bj|tlSYg}kqHeXCb^))C7T_1y6=rHtrKyNOw`!w zC1nT)lcU%%WjlVGc2sgQS`svVOXVDxl_;&_P@G-5Z_G*b4GfbBJ0m8 zfqDfx_1BZj@1PlXHS2LjUS8E-V>#r{(fp`O8cF)P98Q~vX8h)fLOaq+{Nv+Gt0W<%A0vA3sRsF7Qa3#R4CrIsUzC`BnwUy-`8=inGhTxs?0Lgu8|2KF1Yi;oiUg=A#XbzY zou}|{JxlqoH}%hfO=CPNe0sn0akP4p$;$~1U`?knDnRaOI{)q7ABmnnCjLFK?+r}C zr5c%AUVYp`Tg<;IF8wSqb!!Uu%*`as&}WN*39yzkAE zD(i76eYMA`|J=(DL%@tb5+b`B24+qXh>NF+dQ>4RUhAX9nS*A1HuE5-JHI}Wr$HCu zTpN(``l7Qy&#bsN*(@%Rv-(!M5}<8*!hQVcu0ikJ1U5Y76i(ZOltlC#PrsA0X1OQ# z&`q_JXB!<-Y@YIU@fGTuP8Pnm!4%Ui^tYLAH1XEuYBJF;*&Nx@o}nyAx}%RWZezi^ zI#99JgjHdNFn<~{XjTY?vuLdESgtt=C%*nT`Q&bLBF4y#p#=t|JNjP&N>;{g_yZum zpXh&P4`|h?rKUmcTR%%FKG+LUZ8OQYs0m8TlZ{^g4|`|f7WKOIeFelpTBW2xK|n&3 z?luWQLb@e}jzLPgOGzmS38g!RPU)_pyN2$3@7d>h&b!aqd;bIP^6->xxb~+%m9q5` z1suyj+hYQ_bdsqhlRN_&%i^`cOa$oOtQKig!K4>6*qjukmzY3^=DpddiCxX88H=em zHQy4{^y_&tJ_c1Brx0~$szkbg$EN=pB0A*l@%qn;TYtRx^;vwccShRjEZ={w6*#>B z?}q_DC?y9KPHCW6_xD3IXCBa}VjMV)0*OjFV6ct=WZ|5O zp>v1VA?O)w!1p2Q#tD)t;H60L9NX z-6pNu#(_u>If7CsIsoY{0_c2a1^0Y$$mSbuwPAC&1OPd3stVXfG_``-+5i~sxh@31 zF%`|GY3fJmpxXS4U4!KAyJS%CLm+$0P+cWtuSn=Aa9kJz1$o_}X9;o-BaHqdM1QZx zYLCyWm-D#uudpcp7y?en?MhG;=Zgs5k+<9!%`XQHls=RurLN=cN_V`m*+`D{K8s3T z38=|;0}%baY9Mya1!?Oa@)Ka;{%rH>Fj`9fSaZO=DZBnuDd~@ms17AIoaSs4kVmy@C(1%xxGE5%I$vT zvhpJ+W(WABFA85RiRB!8U_{H7)d9`Utw+T8FrbS{2jEhE6)A=~CE~)BoFSDlraVo8)ZYUwWD< zO6s9#RS`vuX>1W);?Lmi(sp;q*#m&=l;N0sVKjzGu@z_{T+cy&`tm28fZ;4(o{D6P z!J&{W#@*2;J(gk<0B=2?By*QlqGHPGa{0^_DA6k(Gi=FS)C5etO_hxLV=1zc`7U~v zwJ*h>bO0PF9H>kW^gp*vp!z+{tjP=`kvC~gNAoDhhk$bA9Q3H^IscN2mmwi3)LPv24D%?31;iwtN3QA<`x?$50|g>7*4@zzkbBFsJ_e&w9JR?F}R9B;g->As$m zs|+uxa`FUHf@Y`M29Fz5IKF5rta*(wRR)YP z_3U>)E^^}cIM_j2{z4P&mvXKR{(Kbkdz(vDBL~;U&YQgg?vy%7W>}WR;5d-1FliJU zy*&r#bgG;4Qf&)Fy1YGa(t&)2LC|oo&btA-VNi!^9&4(T@x^Zp0wC6!_==O*XU7?E z{px6_lb$}n*H!DM6e=SL>9Jy!L*5fRtVg^3QF5OKvk*_cmQm&Cs5e<9IW zE%NkxC#X;WTvR$k2zp)M3wy4a&e&8sWIw1B0?s{G&+qSjCdq*V*;|(^|JuWi{xm;< zXzkue=QI%4`0Bre&T z=}orL7kZkv`7lSH;K)5c`VqDXgAP0jK9gDH6elC(A#H2oyMfOm$t9_U`CI?HkmPf> zK_}@H^%N_myK}?v8;d_gLC8V^9CoQHJ6;+BcP7pKYCn0a)?>jo1lPGJL$NyL0whfy z@J9s?E7&QjA76=nBzhH7#8y4rtxU`CMAN9nYhzPucz;WZwVyzDCEuKggZeIs>MD!< zf{YI}r9}^f_R;-ltA02)mGWsyOT}CRXyqC|GwQP1zgWQJXOYlZGzyHrbiY`jj)?!c z<0gpF%xN)?Wrll<-`IrRDJb|Gtil6dZ{WWdq_FV{g|y;2z-u!qoMi6LN|QI>T6>z^ zr9US+d^++iAF+s3YchgY=y6$h*ER0&qp zmz4uq$_j3)1Z@)WLAGzduxoOW;H=G?Gu|VPe?g@X4jh_jjgxCw_%u`bL!ahpVq;IP?i-mSua<@8q@zX}qyrNrv z`ao!g+zmk}Gy7%Sx-$7Q`I?}FTW4Abl!BbF9+Bj{wYJ`Z?*4>6*O=JMnK|dRa(qV) zr8naKT$9E32#&fI!7FK*xzetAB({S=9{8+qi@ zKmF0Mqz*PJR%YAXNH9@k`jt(0NMyZn{|39%<9q1cv@i5DWME~p{OyO>a+=;R);sqj zQ-45NyOv&99ed&DYJIa9n8Rj%6)VO`W3}l&ng(2Ln z+e})#f^YVme{VD67fd4tSC%qiV{_deJ6+q9Ce`*E%YxgmtaNM$T!({-+o@u4`t!|5 z4k{OuL2rH9yt$M{$DnY9qm>goj|TJ{p3vWpzWSw>Gt&Xw<_pdqD?~FwIQYWu=36&+ zhUR@}+ZF`^Abu~%wksgd17b;(2}JL44cJ&lc0>nrOI>oB-QHby?-RStm*UB$xC5E@ zVL=ko2F1`!I}`2(aX0b3k&d6QfHl#k(iF|pwmD)c&}#|IoqJVC2uPC#8A9y*>0NfT z=7ouRg)+i~&$65=J8PJcl)DVk)-JVm<4*^QwVBnGXY}0!YHri5ByHShC*#1dtZlm3 zGIVg$8%{ow1nz6pVKN=o?X-Rs7tgBkY%c3zv|+RlTg|>ge$TnFn$U0d)&R)#I^(xy!zF(B0?m{qHgN+^jyvKBwjS8_-rYMRU-2}s zd|ECLh9bE8VWn)veVj*2xBIGdZ3QhRb{(+%zV2`bQon0N=MZnKRR1*yn{u80>da>#F^6Vf#C@6v^dt=~6H1E3{6n9FHCyv>Yq^R=2~z z_4fX_&rYM-+g*a6x$>NY!nzS+Iik~z9EOgF5wOygj)Uu zvmsVY6NLEiSh-%oc^PFdX#zLj7=pSOe@?;YdJv&Gc~&=Y83Y}=rX-lJID7S5xPEHJ zhu^9xq{3G^i&!GP;+e8MPIaib=2`EO;A@4KcZJ4h$*97aJ$NaHs@#&g$-<_H^?morU4PJ2SC&d4#rCfklNGc(^xDRAL zCsWTL4RhN!pOoXhx zV<>ff|IbJ!ay1^;mRB1G1LS3^+cDx?%t|Gr&eZz3W}7glO1hI8fvcLZ&0d;Gd$XN) zKP>v*x3tz{b%-SAVCSi~VQ4uG60`=MftLCe9-K$E`*Y+GgOXm!&>VhVr_Di7~;MfR~Y3@5n&Xr*1}T5$IL4TOhi zn|!lwO%oGZG^ty=~P#-=(`LNuV8y# z3tajDuHPz+thS%#t7=<1^&OyA5naDKtDF0B_U(obf8HYv^i-eQRE-sGedQ!36)COG zq2&i!!Ps?%nXQus`}M6&T1;PddJO&e`Q?$< z4e=XEj4&G+^|4=UpVVRF&ffi)HKUMoUmtI)Pao`!p=!B@+{ z_AZVbBj>jb%IQwpY9SBq=tM(kl+ySsnN}|RU|0`1` z+P2daOFpfH9dmDvHcnqZPV`=HO8iDA@BG|3<0z{K%OEpzT~v@svV}3EZrqUMhfDJ@ zMB^b_iIh<7+dGl<%c8K2(+Nb`BZ5okt-|W4$68&OvPpVv@cv!~ZTo;I+`OlLHK$3e zkdpAwkOv>Un4^$EGnr!*nRth0Q$lYSlE; z_t42nr!t#`3{i^7xys{>O};Xj+0F1R;LXMozPY!rzciD@_>IS6{Ypk)L|Bl*c=@mm z{bk7u5*BLIz|adC|K^f$I~NAzJ_5tbESjmv3!LLqoz*m>B#Xzf`>)PZ6P@JB za`LC&b6Dv7i7IV05LURKG^q1u^3#4zDyFqnm|SNMYEG+ckEYBrC#KVr_{(U1>Buwxqpz_9>9c-D z8FStzY_W$G6~K-0NxFaWW^nm3X{xYp_M4|7vpBk}Fr*fk>Sm*ehQj9OB7*wa-_rT= zw&C))dg?+LYTffBk5s-LFo=?;y3$6^6}}bN7|aYaQxEtwBzD6Zzu|N3R=bx630y_N z$oqv?7ReT-r|<#+vCHxO5}6r70jK_JQm?m!RMHQ`3s?6e#8hDw=})}<+n!Oq!P+*u z!GvMayrz07)rv?yvVF@@{*yXi`5n`fIlT?+O5+&aj9nH+V1zrk9(LDR@F?Wke7t0yzo zo%8lgut_lilc2Rd$o6+B_MGsf3dIb$;QCta?IwX<$F?TUr5`vN=N|?7316l+q#|&s zKEZlV6~34tT>J_-Bk-&N7CgPJ^^?tlg*XLW<&=*mZ znt2D%YPs|TT(20)>G;s7nIxycLu~kt?D@&F_*#QXRvd33OFvB4g(%zvYRro(zo{~J zW9P&2UFDw!OafJE_mUq%Gg~~V_bHz~!cy`eN53X!^jLgFhiVZxiGPllq*Aug*XXUd z*%P`uyV)dMG!bUyz?L5XYv#CdD@oiN|ICjC?z2kb+vg_!ro!YHaZ%{x6?z(PTqpdC zi3fSGuu$`j^R-<2`_xM-!|1TGN3!2fS7sh2@iH%!q0n_LPmchBK(Ev*p^T}A z4?0wL;(z~n>`UqRJ1ZnY)KjvJh-`gj=%WOxd@~Gkcx8J`ge0NIDn8dl7K!dO)?5<*KS6moqiI#%iu6<}y>wrup`9tV`|a$fPFM?DCUCOZ_(TE7n)@ zMj{e*gt2x}UiY_&jW(*e;y{5VslshNI*U{d3)KQ0vCw2SqO)(WPbM@`tuQ^p*;a1C zh)~y;Z3r9pXVi(>f?_`Ld#XIk{pT|5`?KE?Z?~*omL^R&)q z_}2Erk4Rsqr#+#de=<aOuC0pW zM#a#3+aDTApA{dq@6MN!PnedxhzUh9Fuo}Tl0i`$$aDO&@C8HAK~PYaAS{8d7}%y_jk5lLK6Ft;^5P`%mxxSV|qq&`VUWdIAGQR84<+*JMMY zaX?mx@y1}pNN~SCpQ(mCE$omV8wC|peW@g`iMP6zOFxq#_i;SjDGHKZpSz_dUe6gH ztt$Ab|JLCMFhdi=JvT1MHQ|6s`qX=TzpmIFDKRzNs8FXoZ*%m*v79Yng;bfumY7$D z;58av^Vn4&o}28xTTxKS7kA=$_e9I#z2`?lk#FX(YrBLP8BP8qE->RG`CSyUBPttf z>PAZIbAYWFF0FZwi1toV0>6VPLH&MemcJcAThOEG8GJ$Yy8yv$`edP0$9hc6cLrUs zw&?DfV4LIs?U0o7>(fhH;i)yD=zYOG_ufU@_G|u!3;wr8ExssxTA~HJ_*WS4XHV%S zBs@fANH+|{sBKAH4@@{xH;AiOb|eyC$i&UyiyL&_R(ODq`#>-AaKq9TO)Sr@ua}}V ztKgi=#C%^Rr$j5i*09{|Fc&#ff)&3hB678uaUozfGh%U7QFG*<^ZJ;~Y3Ro}nbIlP zs_li`aBc5S5<*b2_ZN(~uxNb2_kID!7Upr%;EzrTI@s_$E=@;E2!o=V$A1pf6?_#< z)%#SqhiiUbRVm;&lmIdC5=}+s$Oeso{@jWAVothG9QZ*7$20jU$?uQv#@b#+k^OZ2 z^lK`lcaqCYv)yc=gN%~!2rDU{LE9~b6>@f0tH%0kDNdtd(~;P=KJ;au%m#eeEZ08w zfij)^O_F?d%XqKw50>tE8b~9{O}PGj)jHwC%)9FYr<>WEAjqG-x*M^C!G?|MFO@HKg0N3-`jO)&|vT;RjZb^2H3 zK0(MO>wBAn0dyRB;=caG`Q?g8QNbzzTbe{Z`Zl2?n&#kW?%<~_HW4>QoaK>9}Pq) zOTK}Wsnp;%TIJ?_$te3bfAcKu#2zm0deZ4&aySV!y#DRE$(P(l=0Xsn&hDyK*=3)j zxV74PnrBJUQ5t`F0W|nni`DWV?$K$6JmA_Z_|WkIw2y`%C)8;(|5k)z@GyMa zb%=0loqFsUvD9mDD18!d%((i%Nsfwh&i?uEpRWD|0z=BIQ*`ds5f`E!FwYFUB8Q zT^@Tu8ylsL&M$6ZAp>5F*6N~f48u(xUW(yvNG->W6Tn&$kLNPUMhwe#Haw+d)3G!8 zOu~qj3zf2Wn4RqpNLO}8tCZ)c_JL;1cQEhP-<)rhrs4qxH*{R@eP?tj=J2oaNyARZ z?1Ln^Is>AP$g&8M1pS4WCxu9{kDG^@{NvMHKh;BQ3>{zg27Wzr*CXnPE@VY;`W8|h zZuxOL&FPUlS!@5IGH>IyL>L(#Uyn`PnxC<>U9PgfFw@Q~J3k@H#Auvp?T&|zNx9}~ z`Ruvb8=P(H){Xs2YgIj$J~VIc8kg<+^)4@=#;&n{q|$=&T=z(@TBqLF!Q$K%nLE=u z?%N%oBi#~s)Uhk0o~(1Zrz7ZdwPK>?0Y!pqwC&XK39BIGU!Es0EvnT z35GcNJfdK&I7fZo$e}sOdF&@H`DUcsC3LCvZ5cPgDeuwiy5JJFw-409qFK#NW+`El z>f8LgyXmg#>T&g6+sJw|{IGh@=T1XJ4_zt$L0R`MvOdR*JuK3^d9rTO8)v5|L%IUat2c4l3?vK2t(=6^9=u z+j9kUlWULxO`j@Gg_1rsj95+>=(F+lMrFT@Vm{iLP2qOieYc@hUiMm%;QHYZ5r#db z;$Py%A93tmg6MAeX9r`NNY<^so=?wzZohJs$UGWZUn4=bnLL}^3lRHgmisDdvj@Gp zIp;kuyR>)BLi{$eqW)`GpOUmoh~YEkyb_;=+xWcfJ1wtPMyE=&WkfbGe^jtRj47!P z8diL&($t>^nX_varN6(^=;m5m+OZAEp4wV$eo^F-93dZbYY)sOs_o7;N8`$BDVNb& z{nDs)skBApXw_6jv1#)E(k!ZR1#*cpKCAH@(&l$EQDrlBt zR@KWjxTVij;c5#MtKW9B6zPsL3!@n5W)*qvk{+)$o}CzPbeOO7eMS=D`<+_YQY&)5 zv&E73__QT5_ElDp?E``@K$XM8Xc~phPa}9T>$Q+RS@>zWEA9yR4ja4}taWu}j5Sn^ z3-ST7o{59CK}|fAA_r3p`{p)ygk9nA6#>wSm2;Vo^|4QQ-oge5^rsPq^YvgR*VJGC z6dFX#+96Nueqj|im@8Y0_a9>4|G8U5b?FO6pRubQ>d^Snt^jSp1e|6vs$d8+ibZWO zt6!Duy9ac*V|)FiMB8g>Gwe|i{i*o`up!FTHa2`6Q)KEfwgP=Yvlzv!*5NdDY9IIZ zTrSaqvDAF)%j^$7(y@y5Jl%@8C51l3!=V;lbciHyB)3j7d&<3CbcdZwvg(`1m&rU$ zf%2IG-6nHjZa-3N+^acY?08Gd5R7vd1LXqqRvx{~mV8{b-P%0-S~`ph`jz3Wjks>y z_XtJl4#gDlTN`7AX)FssArx{+ut9*_8{83IjO|BzY!fd-P1>ttA%B-LuP>jC&ea2=yP4OvpVC=&kP~RQvFYr z!!=(0I*hk;vzojJ4cKwc0v8r=6>`rzEypycs;k1^*SXn$ryR=G7-u))t6^I0wb&Se zT1ZZ8)Siv}sB^jwJzDADQrn7W#u^aMlE`X|#|h&QoC35LeZVC2!+sfZ%Vw_8huduA zi8@*H(|evDfY3D_%sf+C)!(!}##$+6AU#b};+VL-Mp&)d(*>D(c;6l%(rmOWye&q4 zsq{wO^awT-|Hvqt@DboGIGVFCaUZA_8wu#AJ?l*7SHu)NARzqBXzs5C)cR$h#s6Wr zE^59EikJZUHp*fkcp#@TUj#i&@+OIJIUt?TxO^;vMm0}2S75cjxnm{a{ZJ#?#x@uw zDWVkSu}|&tzSoA$BrBbmMUQ3-kR9|IkDt*Q0WyJxtBs=H4qqSqFR2$8lMwK*60sRF zRQpbngDd^EWmHGU=Jp}EsC7xg>7HxTk0T(%8h$&;X^{tjn6h$-*ET}j*5HIauhJx~n&3QC zhKJIhfYmks0R7Q!HW&y#r-9);c-{^*8_J64#+~m$HCx~Zk6&A?dlSfLe@bBKAzYd# zP0;T;){cqir+q?aMQ8CT&0S=K_WSY?{6vro^g#ZVV*TIG9(D{?nr#lPj1xxMj#38i zTk2ERR%(sMJ47qui(Gt4@ul5Ew)R=S@W#eDbsNq}k-PR+l0`RRcmGl@*cDGz$w(MD0951i=LS1-IR5-;U?FMhZ& zS`Mb7D)99v4_^#rDGKhVD)X90mcSyNEJZVRAfveXV!=>_SrFI8SUrSv#^($>?i>i}0UM5+YiZVw&62;7l~6{iWJT5W)K zdAY+9yYDnw?BeXB^T|tlv#x)R`2cthnyY3d1<`}^u!fMnkpd`|G`Cnz(=1`l6#Fx@ z93J+u!Z*B6JmZYlZYPRkW2u$u*ZDk=q;yAmzqOv6 zG?jMwmVn?DoR(D2&Am=I!o*_Z0FcXo)H{unB5>dLHVxW0c14TzMJbsx)&t_CUMQtY z(%&s|D9tS=WHZ?5jkJYR`0cp>|2GHczJ8==c=Nc8q@EuBA~XqB98y~i6vIn;41xyBkIsuYa`&&Fh{KF&S;)ii$^ z9nWvAvEBtKJ9yN_Cjq<%qJ#NQT?iPlemrXCp+HM~PpKhxAon-x7wVb`5beOWw-WtK z{>&)&Ub3pRKUhS*ZXDw_VBPc$e~07Y$D!E#{H#ENSASi`?GbJ&Zt4d*Un^qPBx}Ku z)7mM5`Ny}3k&paDef#`BzaWEuej#EGa4S~leJfO{3J2Dcty%8EZ+UT|9s+%7=Dk@` zqUb8?E(hd1pV0N7uP1c6=ev&vF680gzEv>77;hV4kBvhCyKUB`}DUvu5>mJamFE!2l%=C z_Uq|vhgn~^07S<0?HN09EB}vcH3i(i4MFeXM0b_g5<31Cz4piJlJWtylvJCH_i}$( zl2DT!;xBbx_8pFnKD&NmXP>48>H&}K4m)zh@2+#ErTtx;27ffX5#tQxi^wFW-xd@n zu6JTMjit_ed+R=I9}9Pk_n1_vfWiYxpA4$28BAhZ1qbon z=NoiWAnncpz&R%Q2Sj53eWSihu5YRfEo<|`D~GyczsW3v>f=)nu)f>*g?XhTBAd7z zjS#;6>FV5L;;@LI9`lT1$yF`Xb6DMC-JFxCR<8zaf|W3liBDWmb4@L`!7_~0;dbnv z!hUR$@c^(Fsnd2UjAE};q~pKx3WFYO^0Ccu{&=N+J@^SxTWU7JMD1qUWQ>FqLgj0| zU0U_5DObU)1+Ff`PVV?UDJOvt&Rfjgg;R<(pX z(c-oQu}|$zzBB}^h`F`|5^bdjCFA`<)fDb?+!S2*kL%yyDk& zS3SaU&-uLMk7p#R#~Ve5zLmOE;tFmk2_Tz#6Gq2?f8Jext03g&u}IOj`t#xr57^O& z_YAUtA!IXOv{{0psd_WY`d;oU8ebo&svjFXyb)V-X`jY-S>x5pMK3;?FMdQ+8{wXF z5p36P+Gf1R-`m(-S9jIsX8-6&FT?6eEg>M|KBOHE{pd-UY?@OjT?=}O8 zO4HfM!lBy;imfenT8QEO3YcwwS0RwpmitBgV}U3Q)Fgpughd%2%S*F)mX8@2ay-D#+}b2Y~C zJ}q^(3zN8C_;BSZbk_=AK0Jr5<5bTD` zyxI^#R>>lfpnFz2-|~8FSle}DfTUQD+one_o|0D&sg+q~ZzkWHdwrN{3ss~kOC<33 zt{%-^fS-)*%xL+I#cjKhV!f{UE}{O5G;-;uPM|!Gd-sRaI+zUOwZ7NYmIdDl4U5XpbnF@=A*>9FT@}ni0x=WbZt~hYKo;afu`mh; zJo=WPMze*-8yB}4<{e06*GK7nb<^8^VtCRicU{ix;>*>2@gQBzwfiWn9OuHHQGUVO z%yzwKi=goLHbxegN3p4OKr<#0ULuy{PqynPc=Ae;tn@)p}NGc9g+)}Qh0 ztO^LuDuyf5q~zaH)BVS~VWQ|cf2rryc*i)cSh6V&jzZms_u%l$U6Vc^+7dabk8N>Z zi>2Qj)3Ne53KK#enW$BlX_CTXbZ_5sZFQxDd^EmAhQI01Ft&9jnYstzjjC(({o-yjM|BG2~pwXr!plWb5KHFchUMl=qz%hJYTa3)8Q>a zpnACS6DyX55L@Ri(0voB+ii4NC6~6g$s0%Fp3HCa_Vd z1)PC{YxOm>JdjAk-2&!~R8E0MLANy?W~I&y%y92C z4+k@}{$3cNF_x|-DTSlmEbYl)LZyRcIl9J-3nS*`WfY6%z_id6X^Q zXHZU8OBcujY%aQ(!>TkskLLYDS{sA$0aHA#9MeN5#($VqTR6fXE<^0`!aXR?jRwXE z(k{AaT4E!abowyZVXz8=`y{i6BQ-V7(_$?e(;hbMk!h?(liQfOB{->tPY9^BMNVOL zLGgDVBrr3iu)Xi`?f{+GKhm`S{v57^rs?p@ERBtCW*X;g!|X1^hOx{%dg$V7Vw`uC z!M*ox|NR^P`)8OWK66ZM=mlHEbKb%sGB6Ie{`kY_9~)s{M-l@P#EYfew7=$N|C6bT z0t?@DJ-z-{f4|y*$kMJ29b=#|4!>*zqj8DmseSg|9rz=wEtlr2oR}i*2AE;`Cmtx#t`fA z0hgg%$en+>UgRSI1cBw1vAX@=l+ylKz+R|b)Q5&iMyDGju$<$=>p@~~}qb zf&u8?f^U4`I|MGE3TeJMRv2*zh{07XG6p{XIpF-Krwe@IfkwCvkC_B8tzzsGAPaYl zvG;cboShW=t;umvMdCOIz;b?rwq_*8y9bo{KXu zVOLos-*Zn+upf{)g<{-5Z3=V(*m>M%T#v`W@cr5{wd;X`^LlpXq~P`AbJp_7`DTfA zE7Uaja(DccgL@YMD)HLj#1@3T`O6*lueVBbi5jWD&F%dQ)rzXHUZA^A*eZOnBO!3H z(?q|qBiV#*0Z0xG2x$2@YB<)LOK`qmzek`Kwc?}Z%hcV#c$sFMCFEnkhd55d1YT}1 zA6<^UBzj|C4`jCaT2N3$vqkWjkIj~e0D}QpyEGj0>h+($a&((~9l((M1Q?OGKq3Br zX@e%;rZ2gL)j1VtnK%FPs2 z2QY6ggXt;yLQ>EiQI>n}4k4X8fVz?keJc4yJ-+}TxaMG9EEG2CgMR=n(lOBSOXR&x zo&zAI(lt9p`>28T2?ZI-C1MhGt^zNTS^%(h3}W8p{% zZA=1?d|7zaZYy~r~}2yH>LyoO?bx{U}jH?Dw(J(YMhVD0G7BlKpQk0 z95*^+*pq2BK^i$_1JJshIdXP4Q*iRDzC6-5i-8?UsqfAU?DpqV&izbw*$XJF1&rqY z-_JCcA4*drf*^DED30z+Hvhe5233f_Lo0lr?eddce2^(KK@W%KsbR-`l;^|#V~K-3 zZkH1)k}qe#=t3<`I%LvRT9y^)6y)XwHwoHTtC8U6_O6pYLW6Wz3ta>budaeG0zoM3 zdAmEiuUiR-@Q43Smj8E8_E-?Zp~{;`K5^%}J`JWfr?_rfEr)k5n=jo6L|X% zV~)X0Ut4ESE~rymmdIbPABGu-zkd{qT1gYE74rwW+xy;b@! z{dh|)r-U#7allV1w@zXzSs zTRV9^eGi7Mm1zC_p_lx=L-2T~Z?w_t9TyPH{YMh~?{7U4Kspv<>oD;TN)m8Vzeoeo z(||lP{XhH(klORz#Iolz&J_CR#N7mAz=$IteOQ$YwS^G%#323QG+tyF9nw&!*%N%X zTlBdaF2z@!r;&eMr@s3WfQ(U6w&W)YC*z9dZwHzg1wfW-Y_-87 zF$NIQ1|Z^>0sjCZKP&yv{p-!d+p+gsMtt%4j0qwW6g)qF4h-}seL@%F8Q$Z-$41ScA7kFf5W}K->1h!DgzVwkjHOseO>uEG_!qIg`D`$|s%jni4Y`%y zo85?#6=s8im`B+<)7VCn9uWO;?rrcrKuTG4b#|c+>=z`XBFjIb#>USd zGWX_m+!hPj`G}D%If0^>7Xg=^;wUCX23@sGpPo&#XjYZ5yg#sEV>V4Q1RW7Vo&W^TQq z)`sXr`7Xl8^QzXFkBPsO$E!g>R+zRiQwU|1thbj6i@4X$9eixiMxwYDJuwWB-ei`x_`zc3mPyJ&1hi~%r-uZqc^0|$*4 z25@*J5dd#6BxXnzWMbwQC%dx28{kI!qT!S+cLp-^F{#snLhU*?Zih|P1>rrA!*Xpw z^MOh7FR)%9V$Q2T8rSPT3Cv1Lg}@3Udmn{aN>2-F?~tgYYfX=l8RU&aUolj+kaL!}pM z6|*(KBtf=am5d@2KrTkI6&W`GYUv^FT-ZUpH0&Ws?+&MB10>OWs;bmlVV~P(@dYZ0 zqs=&x?*XawSZ#F}iFrj9vu^CwiKR|vzd|qZCZ#jv` z)&?apdSKHqhx_0VWhgPZ`vO=+>NxJM=(!ENWUQP5o+5K>dyo%T88_sfv2_jAfW!qw z3frfXJyA_32ew~xrPA#dAU&nuItCgXTgzK7;R3f@slbeIuj(LJ zf63-56V!t*<`e)o?4heLT|z%Gvr-m;?&7|e$O;PugIEpWW3{#yT_r-8&buqIRl0Mo z7kpR1Oibf!2hszRf0ec0{3i*FM;GDj(sL@SX&AQ}fTl@4-rtC`*$z5=OubAvJLYFh zyM>?ZdZeZ-pc``DhuWX=J8Z6Qp*wC*BloB{bUtI}KBA1E`N}Bgz#c#d2KJnGTS$<= zTF&u!X7U*9ng)f`t!F?kd^||RqHJ*dq>zGe{j=8tvP(>X*QQx-z`9{`>n6tMy`@g| zxkkP{OGXur_K&p7z42z{8oTU{H<=YPa*!V?8;yFunJlygm&s_se*aX?UX^5SwY}ldwHaO+#qmA?2fJ%_FX!x)?0qq1k`M*sH981SDm#P7nJ9t zJK1Ac)kgy8QK~l*L3UHC{wCH$;obriyE%ZpOOd!)NEpHic>xp*^wTJh2o;CuN>Sne z!`oYiMcHoe!wM*aAPgWS(jX#8N_Qh5SabsIxwA2}++&SC9%Xa6ll!Ty9gH4ZAx_g97ki5t%F z*#HcLY~+EqdBfOer!V_DFD2}xFA%%+?koh?OrEuV_)-x%& z(k^R(G~1C=2aj%%}Z!^W6gs0*5%K8>)h zWx!L1X?27a0dZ@o5)%PPhBYOd;FReszuywE z4=EbuzTDTd8Hme;ez3K?1_x``!n?+wf(e=RE>0llW?n3oEy*At3G61Hg@Ka}zFn^o zf%~j(?+iA)FWn{tP#XkOLwW6j(YhXEM1Oknn12M%7u}CsbYJ$K6oxO=qEy$M6_td} z$TMbHzQknNqB)_b%J8{44jAWp6DE~IQcOTrjJACsp~rT{eA^1>#z6#QkD$^kn1-f| zRyxH?h_`;a&NDU~8r&pZ9NcWl@cHXEn?m9r*qjkp74M|hqPlP^{Hy&9?DV2z5}++jEI&t_9($A~VMlh+Lc#W2tyZ0cbztbvBKHzQ*$d{r$=YP$% zmd@$UWDNpz87u7YJb(rAD2O>);U$~Qb1@XX-nq;6rh2-~B~C$(mCeeg7RkfdkAGL; z){R~@4YN^^Sd1_9jodf1Rg+Xf97J{4l?GSO(=)vAR^V!RBDy{t_am|6`_F)b3O;C@ zr(VrKC=$-=u%GLJ2< zMOko>%4PJ8UgoYK%K#S$J;aeTwb=8a+LR1UkG^NER=^3u@FoqI|5k5>@6Zwvnp;H}fZM-1oMO+0c=mle`Bb3GM;h2ksH5u-QmfBVbOH}Lr{Zz-zfUK$ z$dl+U3HL%_+s3eNK;uHL%8qgwz>ZHmrJ&)*wv^CCQ%TY#NMC=Y_m9w$4Ds)<{*XF^L9z)q|NzSdrHy+JS1OsW{^2?9<&-rr$KS3IV(@+Q8=05p zm!M%{_Qg6fbg>bk@_Tf|kZdZsu$_m`BW%%6v)q&*v`rgw7!ps?jqsJTtzS;Yjp%i| zDihPnmaT%D+@riQj=sqYsheE-%L{;If+}@7sedn8%i8W76Y=Q+T1S(@aiS_C)bq0C z^4eHD3D>qka}J3kBg>~_^-IxZIw%KjQ}1w~$M#%1g4ghZ_w6CwZUP%jUcwK59qO=+ z(^89@3S|=*yJnOgGD{|p+4jp2^w0j#yNeLa6E8|!XYce1GvN~pp&xx$+30i~n$e9s zwMlax*{J&oMY4-NRt^lTYNUC4QG0Bw{H>1NAjMfkPT6xitJ^7+b;^e+@sEa9W7OWQ zZelrpqX&~x-Y-L}3GM4prpdKA3|)D51RA81bbOuzaToYR`OTJtAZdTXpTZ|ww%GBa zxFkO!yRZ#l%KkS~Tiv1}{CIU>`hMLpRD~=sffMC)OW4w!nLqyZU^UX8Y)2QddtpB@ ziEXhCJn-dLq{XEMOm`O%Dk7BW*0z#c^LHD`69;#GhStwiF>R$s&GD02nMKiQE;lO# zJ0_%;U0;Au1#LN6XF+N7F`vVvPKG5X(t5+B$Z4}k#v#YjujpTp_7M#YBsM)CxvnsF zeHRtyD2;VUhv+8uOCj~(8Uc}^OA(J;9#Y247U>9GKws7^uXFar{G+KC%YuBrcH=Mx z7G;n3GbH9SylZjs0X~D&PwM(ve%VS9MOQ!S5_DjS?sNCHk891#RC4N#mC;a|Jp9a$ zl=Jl;E<&oa+s&?EUhNV!%wR0s%K%b1O3gotEVLZ}B-4runL?~}o#$rPM^=8^a5p;%maD={7qd?D~zH;i+WmordnP3$}{{0PFQ9sA1;+=10K3Db+At}I-YYXz& zSX&k(P1mB*E%{N%!DeB{lcFrRk$P;qiAruGp;UNN@k5Uy6di7=6o#)NeoRW=L*7Tl znBrNr=RNc;lAu?UvV2sk<16ZQoDwoP};L%i@U>4m+PT`(mdhkQ~V=n^eH^c8Gg}5?oAZuJ?1WqO-l6 zcmfk9nfx{r^!+i5=0nNlbkUpFO=kRH_1DfjR0AT}A#TV_Rb1z{9(oBD*N4Rv_tJO# zDzhJkQMbuy6{S4av3>?EhKM)9V`y#oI96M`iBi*;93krjS=&UE$59zLB8ZR?{v~=m zOvXK;rtg(ZFzs(|m)maMUW(`3m5F}Mhw}D)I2W!sND% z5cU?1#Ea|b%CK7awi$u&gV<%9s9)sJ1rju&96ET$@Cf6B*?YpSNuE8`P8XS%_9SWg zoAp+7{$6uV4eOuQ@?OVywG=H2d62<*pSaXcx4jFvdKC&=Mh^}mFt|M%o`>h={O&M} zJM8VeB-dBA2^(~h7c$DyEQaCNLVZnTYCzUv%JT2uRaDDn9WgGjGSc3=C!X=d4!4W9D$QTlmb z5;SA`(=JU<{e{EJ;3NM-I$DY}3Vk?x=5vDz5C!O5(47dPvS!!0+5Q0>g`;CswTBX~ zAX;aPoQ~c(xoEvvs*YKBXX6y$5ScFqr7Wp5spFHE2iXpljG+r0AHRz`=Rvb$1Ixi6 zo_ZR;(e0i8OcyEM50NvD^y96|V6UprWO#cna~bo~8J)QJ-k#V7ft<7RPs0*358hC| z8_s^%z<96sOJlmfEdm`FyiA*U4W_+&HpZZ{#)P-e5XpW*3zPGE>!0&e@KjmtXKIU! z&um;vYmfgYKb~5R7NveWyPK~Uy2;Xr9c3Z%VJ`_if?Z-<$=j*#Me>$k+_TMWM-QqX z>t-uAWs&?nRatn9wil7mXQKM99?aMZK(YYj75Y_-G?42sYP%fkfA3c0Qi_=S z*ZY!tfu3Z(F5(T=0TQuPncQ4PVr5Mq*|;U4fei1dPg)2{pLH^qj?a0J`!jpU;CP2B z%Y#SQJSHpV-(U!}}RV8Ft54UrDfqN9J`w~jccJwC%Cr+e|)_Pe;SzV;|S z&(AQ5Bm#LU$g{FOe#5E>*Uw6Qj(sJN1xz%Uaz7*4Y(X&sZC8?F_YDQ9t*Gtr&mA(8i))Y}*| z4dF8v&$%cM=xZ%;{gubc@RJsYCGkHBCczc8uO=y+F1E4=oHjLx*`^(9<2doM{X^Y@v=AhK8pgmAr>ee5Sonq&>r>%(_) zp>MR!1k)xXpg`o5$uN8N*R7c4N1Y#9vOp_`#$CBVhz?ZpMQu5t(?Cf@d~B=We=ghqE0 z_%g%iqy_>7Xl+qaJH$IqIs+hr8yaNfa)czKcmH$w{Jo9>#Eh{P0-NX|;yM6An$fbJZepUwy)f|!;{LXD5*;m@8^RoabNBVwEE6##~nqw1MQ5GDk% z1T8H^JIb${&fs=x7Har6r*FQvHQs^V3y(yYdg$5ABJZGwabxgWg25VS+Ut(@)|JWd zPoX3$4Wanxz?a-2T{g_=bO>CK6H-= zB@+25T>@ao%oQS%9=cNf6o7dq|Ng{mG7S#siE9US(4j%D1u#QD=hM?b&KiYRqo|MbZ>ow^7h9wnqr@5U1uHwyIfi;)=;y zXIVJfEK1llFTT``?ZiTe8}#z0#)&v1NP5xA2Dl&jlm`skFmkc>B|FabPO%(?SBVo> z4cv_?a5+i_?*IM}JJ`LosZLf~>7{64bRrNN#T63PF=z{jwAI?PchRC<8qU{3x%?K{ zFM^G>#Z{68Fi+A6Gw)I9!}m~9u0SB=f}OsRR7{_mvcP*9?3l#3vURT+ap(E&1h(6} zQH9bT$Fj7*w?@0|pOV3u34wXft9llY4@w=kj!pk%U>Qgq4m<{@vu}H3a2#Ewl8^@m z6qMV<*g>o38#oR-POlNcZek>7_$iNK>t z1i9UT>ppz48ly^NKq9vZlOk}z57`TFg1GByzkda7$H9See)WH9j`f+Li`WS^3i4Q+ za6<yJ0_UHZ$P{I=@%NBPP`DRK4SZel<$HAR0ZsiZbh&JG z=0+OZzdRCm(W-TGe9_S+z}O}6sD)GF#dw7kiXNi`VTVN;K!jj%v{`-r6bQ2CGM@W> zroK7EVKfQSK_+*?9P4d(VSL}brQN>Lgws5vrG9pujk+IC3#5Tei0oDSo8I!cQ^~Q~ znT_S2`e6YzP)C~p(;1yfK4b96(@M~<=(lax#oRvcD>v;!P&6$q?V2#K9J^p=f3-{m z!#Cr-R9V;KaA#m;k`G2h7q)Q)gk&iCR^XQ@H)xoGL?pkirenY@DX#z66#pWP(uUu} zxPjrL;tu3nq`%}_!GFlNKS< zwz%Q?eYOjpVk}<-SKEV0SsfZIqDs4ZD>ry{KBHVXL3KBd?kx#Jnx%0t)L2wqL1uUM zQY!7b!&g(Xoc5k)MqD*+uNuBcU*ZqYF?0WOJo(4rhSOmLyy{x!vPjy>!G8W&L7O(i zeq*8(GNZO&(YsDpV1La#X7nw!u7$Vo^bW;TYptBLgGTu z$sT+L5%8gRc$x7&QLRNr!6PgGuMGUZeGG6}ZlV4D$wc8h-U*C=&A8O-E&umT{htqa zQ-5IcAljCtFOWnZC+#KG*UTXC;6;laFe&S?Vu$ zCQA2LrZZG1C;b=d_1|w0J+Qv!tDH)EnkB8Uu7mPgig>BX0=$;6iCIg$ zu1qSM$4xnvCck{j{U=?5S`8nZXs(j~4X}>FnWFA)qi)Ml(zy5< zR7FBRWE5?Da*%v0z`-Q+oWny9sc^0}+(R~|EVw9)wsIU|t$q<7;;}!K^1&;+Hf?g_ zPQr#qndAmTc#_jcH;dE{e?ISG7k5+CHjhuwzBqv^heZ$WDyC{D2?n+Fq!yM?_q4(Z9lUWKmX3sG^k**QKl6j{TCH7|Q@fR|)^uJbtSTyP+j7+0Y z21}lFVpVGw)cwc1GCI3%0fmJY)}Jn_H0MmM1*od4S+*}^)XsV6c-170I*rk`E8;C# zqjACD=a02e6!sP-!2J)4pN?USg~u_4%7yp;{x{);pi$^l%YGgOCF8Kl6zp|17JOcDC?rgW@Jce;WkH_8gevGEkUPsxep;@ zj|uK*{)GSwp_1{EgdOjLWIQoz`YkZE6|kEF9Fj^9uH7jg&0VFX{XqpLGutx*r)QAwk(7L!dwQ&P%L91_(OmX))ju(w>o=e35 zqmv0$Ko5m%c4gDI%<==nlS9oWpUa6iH1$GYGU)_30=4JD0O2#PzQpo$^-4P7xrYAp zm@1yEbA^Z7eBd5Azx}HTl~^v5P*g@apki`V;vv^i92`{icn|;59k-Rtn03H7u^%6> zo@@I8`|}ou=VIOJ8O(e>i+W>GhvAz}!K*1e_WDrVPPLtr{WV6{D|l)q;ECM0Iw|^g zyJ!kN7ioEzxJV|e6tWXYsC4o@d__k(iJ*yRx*bGjmWS8J) zA|Ajr!xyy~pBx}9z!BS`&7_F?u7l}HIj!`2^%z#2JTN?(r3Fk3PU)Fn%vX|oPa2_V z&1o-WI6Zf}fhTyH#Jd}0qr#nsfS(%*Cc17BZ~T_h@jwbx@;Iu!l6h`S?$ep*JY@!6 zmO)D9jLGgLIu3o(PJk6$Gi_gjaoTqS1itKm(5sl0PfG_pL^@5Vtmtxo@Pn%#pA{T6 zD4mMkktq{g%}JlwltSM9l=PP=8nq3Pc;DEY@;S3ndr#ETt zbG2QTf)XT~8Cyafun8hpMF6G1PS>H~;v^Tmp*) zodDGE<$fA#7WJY=D?wn+p)JRf#A^fJ_S>zI9Ql=i0}{uI#!-Gbq_kHM@zaHXdms%g#LQXWDYdtUajzA3g5Z{ zvsmptEEAcINf6It1sJd;-N0k;Hn;hLC#FmOcBAsqU8^;e!d&Vnpc+jjx&9=h+baO4 z+>`6SWj!>{Asc^RyUJF|QsPA{aC5VWcM0or+Tx+RbJjwr{18J3je?SB9EF)7WRst0K-XI@*hn)2<7mmPrOX~mf6@PV0bcYyG2pI?j> zAU5IH;mvDroyy2v0>VQ+pslKADUwx&Tw18x^Bez}#;2Sv4z9YFkXiC)p-mid75vA~(stToPby5ToF9Rupr(Ft1DpH2MY3q7s zGRKe?pr)`!;?tnbUYp%KKb&@6v98-!<;_f-XOhy5yta*399Q8682o~L%?!cY?;2(J z_~*#xsN1t94M8WzvkGHmZYWKa^cSEx4Hew5O*=#>CaN-=v^`(j`X-wMK*_8u=SR+T z>$XobbOSyV2bU#jsD+CTlARt27SIC%FMsW8-ASQdt=DF*o<_lD24m>I(ptRB!zaoCqhE8baJ@JE8i7SRg!B6f=p-I(& z*IPf9J%q6y-4h-HH^If*1&iiAtZz=d{mLys7|)sn`17L@JU3Dr^O+DB%`y${g!^u{ zUksIxT%Lb3eViH1G*s-4m?&hZ9eWbh}7e^O98=j1v->~Z=+-> z3BqywpIEe99lPbh{HBSXm_*cI3glnhC`QnWO) zW28Pfb6itt0T!sdZbJSXS+I{J$`bhC8w6fbzt_KmUC1m&4im<(Y!S18;n=T(NhhdF_&ssiz;@|*ZBU%FQUZYT|>0S(>0S@YaSawEGh43I|Zb zz8JXByt^534L|e=?+H`Q!I(ui_C0_Yc<`BZxe9SDZ(^nTVm@kV0Z@}*1no~;&A37c z^dPYBs>g_WSPb-M^X76hw2;9D(gUf7VZ9U)-YuIfyB@;#GuF^@Yo^Hw6c&O{uZu$^ zmz$V-$&vVl^~=-P<4la>9(p=wN$zjps@ueSZ6^RX9l_$iFMKoi>$ZLh$fW-J1yEDUT9C9on&5MoRe<87~+w4reDHk$xueG9%nOCnGL! zUly4%f#*Q9%$ImFd8AE|0R3BqiH5df6Y7>xi4U;h!;(H z&koW;rZM$P%hcfc&C#gq{VOyDyvD%w{)TzTW0lK*oXgfOo{MnY<+UuUK%XueY{KTs zd-l1Xr^?ycLe*@uv-4&X*VEoZztK66gP{!de)3>>%Cx;eCt@kfO1zR~61@;Uty*Yz z=>P5paoN;^Posp10_wXlx~1kuog-={$&}tMZT`t)dBAk>=OT&B&|)hY2sq!)``iUK z_3G#=NyI`AX%n`Kl=bvnTw&4zH+q{%&Rc2PXf$W|Wg#r8AlS9J*2n+h$u~r;zq?CL z3v-9)9$obJWF2@q^#@##V1G|2A&u(BWYd0>4HmV!ZO`^ha7B@t&R)e<$st6NMJBjy zgm=A_Olfmz#Thp>?xH#t#KZPm(cB;?_J8p=HQv_kH-?! zbZ%nd3#CVo+0A$VIP{hnF@_sZnEexOfu z7}x>Sn$fleaSk)idQ4;dBg+quYU4U)D)PAg*7-|Ov+~-l&5#(LGvz~{H0Jesw$ zv7Sd95nfu5lFP2J78%^Z;(2b?;61e=nKOZ5r;RBiqJx`V!-wg;mQ!B_hXh8ZIH4HR z$s(Oo$pYOQ{Hu^$l~nj+t%?brjS;iO_ehUoZo99~Ebd4#EIK}4w$K&zz25*1p@3G5 zZ>nJC0ra`V3A7Dj^_~Y75N}=cb>9r;Pe_yZE8$Y1l@6_W%>Wg|MFo#o&PlRW#}E+O zULFoLY_Sj;*s*OFfsxWu6C5y(i$b9N@<&uj2_lM{AiTw4ZI0n>2aJS_;&L7-z07j# z>P?&JzU9-L8!Ap6`=*fZKr&dSin=RIoCvxP$KMff-q1e0PGkq0CPw4+)uq<`kwk{% zW1z!{=nGpJkMNv>s<}6~Ga(7dYauB{jOy!KkVzwU?}6|)dCA_Um=$wqvh?E z+87Su-My8tv#lj@ zHt*$DW_Ph&wo92}nQgt79U#lyw&~{%U;NK|w)GtrsFZQ)+-|sDZp}ExtfN%qro6m> zih5Yb_!aeV;J7wY^uuk8i}8-hv`*~99Yclhht40-b4S~o4leI_WatbSZ+FSIE--I31fb;0(OQ^fAhv@}O~iG``)z~>>N znaTnf5cmf~k`%-#_+EfN2946J)n2U><0&cL=P5%7J}iv)L~JKXMhHSs^6v2Zl&3Ds zwi$Q#GzJuXIT>0U96@iUhho4JVj(C+%$|x(q}#BxnC`qRo3)KsF!SoCUhQ+L>r*B{ zpv{huB8qK>Sq=f=l{7!9NV=b$y5;Rv^!4&#-Ph+sPove*Fi#BvJonIDfq<~uDa`qf zuWCm7Omx59N;50vd}UCT=N?dI{<&F-LV&_q&a*7WNpxy)e=Psb}a z^JiPpcF-!$Z?`qxo8lbL>cG^Gz^|*kORxxFYQQIS2kvCM1N5l*uqjcfHmoYml5 z^nk9q|Kc-d8#cvykKm@m^ZMnm-b?EpiQ2$h+JEAW$DbM_Up`b{|1#vJ_lje>VYJEV zP%YhZ?3)Tt#l%$K#%ZNx&s`I4->2PmycEp!8*YAegf6p*$J@5?4Ni6WC}V*3;R3T( z-+P&1o{5H)RHHrD&xIxd{lZ{!b#VL9&U%^H%tf-hOUbP-z9ta7)L*=(jz?%hcl=L} zzRGDFdHKaizX`^qh83=}!|wuewtn!9*pECmQ$kDPQ6G&)rbBfuOA9%*7pH5SLM`+V zE6|AMIU8+3KLQ#VLIg#R@4+`43_BKKznpHQoC7J9Yf%!O{?ydg&)xH{$Bv&Lk5V;_ z`=?|@^ORflwHu{iNeRKz46q)6%WV(*FOf2NHw(kKdoLMV7*5g@nP2cEO)qbqp0o-m zYOmEy^79oq1e!iC9ut=tzqORWvnm|f93>|O@)lzH-8GT8#%AST!Nh7zCl|`~qeQAQ zzAQ8w`DeomeVp=>uvfD)<#JB>G{Jn*r+z7m?Q$|&JNaQvPS3|)t@9aam9Vy(>)Raj zmfy{UZ}xR-t;JxDZ!{c?ly$Ne&HKY`Ui%jKKsRr{D0n69bJ|1&z@*Bab*uIlq8$Zi z_K_Z(hSA+sJI^eR=fniFbalul=3gbNynn8H%fGf&jzj-0&kRv=pUIHd#v87uSCD_q z1H#qO93nSPwdE~)zCFh13PjiUen6)P4M(_A-=o&%@G*aLGlDr3X$}T9s9cqP`^60S@`VWfX)IWG5QP4&_lk z>g=MBrI?Loqu9>GF0IS-sHGp@UGM=HuH0)rzs?Nq5d?r&Uq-$KFjksoPeb)T43!VqgS zM7Hd)du^Z!Eh=H?S3`9KnHamUCFk+T(m9&7J=Gf~%(rEaZ7KIo@tefA%+)H$i@H(s zluW>?2KZDAjoncnv_3a3TT|n6hee625tm-5+dTKN9nEfgY#VQ!udyVwihEzBKjcBd3AgE%f^)?fL|s!C>sw z${@jT*2o`8L-}^)++!vp=0l8H)$Q$);6q-`a`95z16N}aU0l~J2{M*@9#`Au%gNXZ zUB(|@56YeV15G}7jpi*`%_UVPi|!rDKGf+e@{^V902M-DUAx&b4?+mi4t=4cAH*Zu z($m|=;x=*0Grg(R9xj{U8on55UK^+&0#;0qeEmkO^xUmvhw_{6y3N#XPDU2K#+`Ia ze*KMx36GulQG%@T!qXU8rO5Xvk=ZT=>AL>c4-5s=)gBMqy87qDt%0;p6*QP##+m0o z9?kg4>?6AdEq+wTeAu+X=-(x`8cD6pKe3W|dvDWq5NWf-ox2tfFwa4wrx$-L!Q-&T ze)0nOXP-+yJ>(SWtgv*XDJ<{Ypb$eano|ntb=S`sXp!wPz+KywEJ$IUen{UbVN0v; zyxTk7TKO7L@~ZcqTphLqnbtlaejtd~+NqSc++tpB@fal_+|7PM1ob`-6H~f*_o|tU zq7FF@CZ)2Mxa)D(3=@oAsUYwTJj;xB*19JKGeQ_V58V^%PV7cEZ2d>FV8Q8bpoTCnES2ZFm&$Qt@yS8vG)yN-5#G2~y)I)Q2?> z;g+JgeCa?~elNEhLM=U#2#-DF5g$@wDtLT|7>T_BjCDbhS>LH#I&CS>Rx04ln*;p3m zG(9{$cBH^obURZa6Oy^uSvXFmRY5=M>69ypoDG#_)ZleGz9D!znL70Osia%o>7z## zt(sM*r`rc(Eng2D!U~3R^@VEbLm`5-ueP>ongWVJ=k1x+v z9jwh9X~LleydM{OK$x@&!yE|WIHc$=R#J=@-?|nVN8}%{04{%!@Z zy=kkK0DPyWYb2yot^iU~v}=&E38;hzf_U;jck=&wH+h?)1r^lNmaMiLHPjy8RmmN( z6Q{DH>iL9(&lHgIf79LQA0@V)c!lSFSf?|w!ET|R>i$YplxtGS%;I8+g6j`HJ?fD)m>!4%6;xq21(Xos&CPWEZjbf?+XN;#4f z5-nq7IiE(rxCPlKOT`WQ0>HO1KoYb7?50W`@9{YxxiyTsuTp{vAicoRzRe*8FBhM9 zxCX{5GL;2D*yl9qI9z?~QV*1)vmXY(l&jfEFQZ0xA>lewEhu-24fw87j4^Pj-#9{v zvkY_r^=ti0Zb1pkmZn;nmd|>;;(@*TDp5i5boet@pn&y^7jXQN%e+s;Z=WH2x?bwZ zi;CR+&CW>OiS-csBvY_JwST$YFN(P~{0AE`t5a%5Ji1j@t3qLQ??&T_S=ZS$r@3(| zdggKArknydpL-pfzUOjY-^L|%K8@GkF~YH(MfPERoLE<}(mGc8tQ3TS&@MYC+iM1- zu6Lf*GrCJ64YABw)vSBm#8LGgr(+B;+H*YJaa`^7XFCdRK&U>Ef)`+hN{^_a-4>TvEbtWT@zc%hK^M82`{E47nXww~(FDy2o7QghEl11Kv+oz#oM(Hs0x9 zPWcE@c89&=Tl76+!;?g-oA=f1K{CS`^3cgMDC?jj(T zI$pZO#!HLb*K4MRJhDXyOefpJACy(dkvTSiromI)-Xd^*n_c0buY^C#bPM0 zn6}B3Dt0p{^eQ82HYoxza;YlT&Xfn;gJtaQks0XT*qxMVn`_9JHuB8-{C}~H#!nb zn2S)p{W@6b$nUAX@v@e?=QA`5v%<2btjT(w$E{%WZ304Bf^c4ns~7N!%K7Pqa^H-J z*&3q@6Y38YIWZk(n+8OHP53#fw&Xv>7yqb&;uvf_;#EP2LA17)(JPge##A%+%h#4* zYvpl1zivShd~thnNsHc&y>x4=vpI-o@k69z@X2E5D5^jDQ11>!Bd=q9$XcPYf!RvOB~;n#m(jxY7jV8-h#WZEcL%588!Rp?Pg#RLKj32NDVxqzJ=pSh{j; z9G6L36vN6XFc|~fIeT9bsHQ@LZSdavBa}aVwKx4%&NykXkPoj8aI2W?D8!+jJebyyM{+o9kYO}zG zL^7)mjHwDzt3~b7T;663A-S|sBs;(EW=)uQOiS_BqU&x zqEZO`hPA-nHd!C675X~d3Sb)b`MpuS*PI06d*@Sv)6cg!}!*4Q~rgw zI1+|6z^XR%ErunI4RQ-|qO8Cmz-LAQ7z*aVrCY9s6ORS|%X{Zfo6fB1(s$_{EuhId zB5eUQ3t|2gb2=;_Oa)MBr~6CP7boGarOcxG6`c4Z(^%A=T+0f^!Ivf|Z%{?zF}2@p z4Il7- zrJ(I{>kX0rmnHm}fKh40YQj`9%#=&53;_kL_r&;4bry`CgIZ)_MKOK*VjBvG-E17ilWGQHNDZU ztsem&;_Z1s&0G@9vA0Q+>lroW$N;tJvPo}K?v*r89-~3?wfzIkgEf^H&98_{IVoY$ zqme8Yjn$n8su?*qg-a_b-iR3q&NnMtA=2t-D!A{f7TKI88cAalmnCg_Sw4?>@Onjo zh|M~AU$}WShRvkT-_wAQge@?SYNFO3)s@{AJuFdqpw&j4uVdncX=DZ_M>hrQvL8%T zeN}Qb$*~%#8ALwMlEPxXwGfv1;%+6!kwk*v!G5LHK2Q*-d^KpbT)(!YnF)lS?Wa_u zWk#KoC-;rMUH6%!WVG}wb@_b0_M;csnCb(!$aQs`_$EMl@q-`8pq zQ-mBZUlLIB7NFkGGUYYExH{ix0 z!{n|{iBdUk>qod1_rI$W=j++%CH-jcIkT`6{`!U|&x8VPd+qC^=Xqwpt)2tA zDI(fXsDiU2X#E{p`>I84DC3#*snM}Ld4F~##hn0WitBYoF(F6&0@u>0X(yTM-i&Z? z=Z@R?P8aX`?wr4Am9F6W{*LFey4m;|+AMQJS5bR=@arVUB`;2d)8=ufXZ;ziR<%{_ zzRRu-GsPX|OwPKY{gw___g4sdtxBUH5RHPSmOSLm$4@^~4nVs2?b93Nw*&kgQSuKx zH?ET2OscS=v8ekaOD2iNRJ~d+c|%Ff(9!$0(ti3&^}jk)tiW~*aOm_UR0p|FxzDqe zoQBofL8a6|gN8D8X*dV-Z-uk10Bh60b>afws&J_2UdjDTX#<%wy_ ziL}h2&*GEx$8+9(Y7-Ci+>O{C7Z{j46dWnA86OL!+9@DnQST@?p0kLle@j&KNFiqY zLnD6f(?Rq+$q?U(lfak+6G8N15IVkH!A&aY9Ih zmh(nQAu&tQU2*=cg=QtIH$@%~ch%wvah?^wK4f*vmnHEvOul;)Sxj|zq`h?MXU>xt zq{qPQBY!!y&(AVF?xAeXMyMbta&hnFmAL;w&cs$RmN5$^JAKzt&h5m&xxM=7`GE6C zWx07A=g|7w`x~$2spa?iGXiyn3(Bp=>bqSBxo=c(V*%&(;pz&fPUG6F$GNYLF9`OW z4>t|NDhQ-+)P5hIN9(O<@L`>o$3T4QJ#9%5I>!?naKiLa?-N_zsbJq4iLWv+Dmtpf zX53%HZ)Wc|TtpMcXP&7)^qgH$~%r5 zr{J77`Fbznzzlj)Z3aLh5*!}ymb~lP6}E|x-J-e0(O!^~ zV*YJZXDpcIDXdj)R_d6e(^-L>&>zO6w7FcH=)22$DSVVy)QrYfq2bLgdufmJ#?JV= z-lSkdPqCr-a7A^l>L^?8a1C&DKQ#^}V$&S>%hBBz9Z%wVv3jjXtp`Q0X;9`1;OK7X z%RVju9NpI@l}jZ5a&*5BF-j!dYvuJoYHAU?AUySc-Ih$)l!6uj`_EtdkMe^!^B3pC7hVFyZIOVeJq%!kj_gYAyXkoRH-xdgvrvk!Tl$inx@L_!&w zx7Muag_l|6D-c7ankw<`;j_$o*X_C1p|X`JnGbK|tpIq}5rzQ>$!6ugyv%XM`{J^n z0fg11NZfYGC1Gdu-~A8ZlXqdCJQFN(U>Z&)r_{%czHjypZI+cAylmqMzaf03GNMI> zDnxynC_VAgXvs0r^drPZcH5S}jH9RK%6}#BjEbLoT*(-~l_^?XG)qx=my|TkiT#@e zTt=9gm@WEMIQGHg&x#_`Ax(|=E^{1nEHrt!KJ!XgLKqEtHC-E<->3Gwhnbf*3#IxH z2iCnCp1fL6*qSPv&e*;RiAG#t93br(AH}IqI>uco)cJi?2q2(`I518dZnP#=%3Rfw zS3+N(J@$P9dK}U#KFVbrvC=G(EQ(=rvXo4NT$!B5^U>Jw)1#LGahTWAet!7SibPT; z9CT6#M~gqafV8wXWgqUaeSjD)6a>UPmI!?_4AfyYmaX}|fnrlMMRd!s-Q8Z<(dZPy-jB)~uK=;xnmP{t{B_jt z!o=+T#FBP$#wmj*IKbc>mCpA(qulJrU9Ea|*Z1S)AWMhZ3Qad-9PSzvbwgnKY%b_& zg%k3m%=yKQ-yM-R4q*o&rK8vReoP&300x$99dgp3Z?o_?*$ZT$n?f}~D3jXC0$>8^ zv_Gh(1yBfDvxg`x1CMu++;C>+Hekduk#o$EGY)+%Wwr8@|DB^g8ACXu&?-QEtN}M7 zaT2i64?wp#o*AQSjw04PP88sNwuy421=#k_ej(uH<@e+eh_J?hoh{v8Ul+%18lWsTOClAF73({TPX z3s62QfH+g*^5R_Q6Q~fzxren4!Mvgp*gYCUf}IGw&!fcFhPw0h8h(7-d*rV^oU2A+ z82`U6nyB8?0MV&e{dM!>tY$J}Qp^4!XeutqO;Dz`vi(0{G(%#+yPu_v1;nKUjYE`JX-b zuQApFCz`8#&UmRw7&*HED1e;iLwIGL5a0$$hh48VY{z8=K5+Dj|7y-HMO{hI@myjO zpc*Ju0m^_`Ys75>7)si^0}*XJj4R1$PmK}OR{_b5kxW03-Ms!|W94gff*b_vz@Hoc z>>^8c$V}#Utps&3#!m2)LtyMX8h}riAU6z5>gjKNQO#eCW>k!YYKQ^}25+nsaMPn* z`|~jashYL;x(!DLk%Vi|6_HE#NOG(S)d%NE{daS2{r4*ov`gU}Xs!nAfsa1k9R=h~ z%kFsIN+8bw4t_thtvbQ-!l8azX8IK6(F~wSeboj}55bwY=$4IduL8w{um!mGZ5^g; z_`t)G9RX1F|Hs{1M^)9WVc&`%APrK|ARsLvUD8O00@5I%bT>$Mh=d4;q;z*TNH?Htj?a6}`My8C|K2eegFP6q_hPNN=A7%kuj_YpA-0}#1*ogl+SAdFIBeLu zM}N{gQ{m68{4b~f9U;us9Zt+Ma{mi}`yCuifHc~=)i}+WrT0IQje&)-1lFctq8iZ# zwDvckEtaAMV^MP>`*qazCsutCtL1K?`_Ii4Ko9r`f5Y4az_JLAJoOAIELsRFJ)^Ij zYK}5>zefyg02;vsIW)LBNb`7C{yC=pdi^v8_6{Q|h7vC0QbijSS>^xb-2Hyqtnn89 zMkq_k)vQeTUmpfxKP1mXTH%YV&4kfbvKvQ?kMI{F; z0NBEMz~X`2Ew1s`f&Kf1umKDafGW8P=&%43HwKI$k+JF>|Jl>(-h&^L)b3kVawsHyh zL-zZgNB{4Ca+S@XRbBkLNM{xxY!^r&pYf&5zzI5}g5_`R90>{k*D^p(O@| zP@OrG)_Gd+UzVhQEE+K7L1kd$u2;}&!~Zsg|NbqhM9}jtC;W#G?%(J0U-JR@$vYTE zSR+Cm@qd*}Fult`{)bHBC*}Y8_rK3+9L%)08su>A|BeIkZq@LFC;46Ru%++@VR>t< z$~jX1c~@L`3j>7;yDA#817T|xOqy``z}uiBWYzS=M3Jr)pG<7ODq$`jQ%ufHMcIGM z3c?1+z?n|fMo54BqHVqWFH_wg7v~>m{AmQZi0vh+^8a}R|NKdmKDd+E!sPk>kB8WQ zUoqh&*d0VHv-_psu(lGJ+ug9}H_fAz(7K6tcRP+X$wN9(c@+Cmg1FAQnN6M=6Yn&uO=O-t(%T zUagSWFz?NO&TK)#=5V%WLH*)pu&r&g%SfhL#si|Oj7b!QYH@Pe1+e;8`J>=NB1rgJ z^UBO&{A)ZGog||!#m>K7<0vJ#nIf3!jBr*!VTU%dmfxXPRULMdbrZr(>bMp3C-Y5` zf;0-yOGyxCq0LqGBeEmT2P<4~4<{&ggW@&JnE_m+3~nHU1KTkS7`ilybQ-igb-ivX z0G5@J!UbTQVf1WVHLb-jz(Tf#%tM+$er++|IQwC;(1Q9^jFfs~kJKM)HgE(BmyZCU zoRwi`n2iX`L%IWy!VM@e{(GOb!D(g>zr0GT7K6IohS@*>)WeAM(&usdKy5DqMz z4mT&j58sQ+?8>7=y~Z>J{=>b}E0A=76KfH-;`_a`zZo<|aK7Hbh|@6a%0GzHutWWe zI4$?2u1y{1MFcJY zRK9t7?^Qgr1prUmL_5HU5y&_+>h_SQ!M0OAezjVTBC5o{PjxsvEZ=0=0uNt^(UpfQ zj;APY15hq)#D!L4RIuOr!&=&~PA7wMhE%kBmHE`tMA;!QsmYcyaj`78Nb5$8{Q$l; z*pr=UU?ZVcG=^Mj-AeFSoP2$7KO|he&Mwkp%c*K9%=b zr%QQ)rP0pHwvE3At34Exr5o6oYdNGHC;r^&3D+W7?~PZOshI(c@^q0z_!HpKNSOlc z&gft(`7(Ti#5a73=Vez9YCGHotFrCeB9`{yz?^@d=8EIeUHOju<&$Fky`UZu*x)Gr+MFv);A}Ev#%Z#K z%77Jw(XUxi$v%L>KNzxmQtb+|29lldEfVqjZ~$NoWMaW#u=fo297T#;St8I`L&Hr&!dGDa zFb7Qf?_mfRAAgM1YXAwK7P)` zWjO<*dK>>nui)KMg3@jqYS9Z3NARe$)g$>8gwrJ8&v(ZkeTt?yBtIp`q&U_iz6$4> zvxZ_EWP`HrF0pMG%n|CUNX9<_+{DXbRRE+;!+_X|w*jn@?_j<Y0>4Dc=+xtbBNQ(+S zv7U!)rdZo~(Z5i=+)cy<3ksf>RtCmhpvlmP2V9#So=841IY8$C6KXo=W^nvDfw6)i zNl2Oz2}KIKS{)0!ssVODo|gXkNSnyYcR#U-07Uv^cXoOwqH7KqtCO22i*$v~@(;mN zS#5j;zmQGjWSNP=nK`VF4(;!{vF`}MRpE2bs+7*|eJr^18zKN2AGh^2j=i{dwjOLC zSAN2=Kuf>Oq`&;YP-6PKnvP@IBT9VA`yO8xH+&bG4}lML>GC0!*yqqGV6@y4>g7-0!5IX)-h%qul@Q$ z+#Zl^9O);=AlO7=Y+*)WW`I#f8y{Ch=6OyrQbdT~4Q`xvi*!#gHQTtr{D<;>Vq!8s z38Lm7lVp((IDJ;7oHUTmGStnlNQc>ePl>ozpUwFHw=NJ0_f zHl|JWIn^!9pgpi0a@5>G3b^>K5g+R8?xE~pF9?cPn0{z}On!KN6cHO}_u(-ZnWKQdhh3$ZL*+@$@`d3NmZ(mpkx0N=QN20+AI zO}x8Qgp85hC}B|Cuq*L);mfc_KwbcVL^8)gaKy7 zoSS6-E~SYLD&aD7&Gam7NV)$DhC2map^aYg-%pIve^H_p|3!%|Hsnju1B~!xzhtw* z8XDVfL66JoP&^7R@UZVBg5eX;B)q5;U@Cz`-HCu9x^VDKRx5iy$rad0lhjn-dORmr z#FP*1Zb$g!NrCzPIXr7ibq86YU$ZMk2&SrTB{*o>UbYI`r!vI(`*Ze4 zzPD@esaW@MQqiph+xdSjzV5DBJwHgoU~%-14E>H^M=-jF=wcXDh!k0#YVC%;w*|%O zsaNmhC9u2YA*n|5tI<i#*qZ_qT~;IXK==q!ATeTJ#y_rrLm4*TX~ zHeT11Wh}`l23iO9 znq%ridt>IJCZAbEM4x+5=<33ZRDLh9!VVK$FnO{2hH^X_sl#uOG-HFwmw8OQNX#eC zMc^C6n_OB$kws-6C1Ox(*Y2G!T9m9IpNYPEIYYtmm;wdlEL|)+V=#dJ?O|634n6e| zscNIFAPMP*Aju%gjFv4lmYiZG<}c)56glhj&-IRjB{Y7>CqF^H5dd4H8BXSH0#col z`g&{sv)?f3)0f|Uc#J5uqK9*qSXsXMBYs+Nr+7kfES|Ep&Ob^oY40kr-{FgWr1P<_ zZ9(YnA`)an-1*5E&a7Lj;Ot!lIUFrb-xndH{7|0xx@-M7D9bP2)=pegbm-|*?_$mN z7c9=DWKg(0DgHgoD8tOvhp5bBpA$v0kkXLC7CogF0=m0vPW5pb&4U)|y;pso5!~Kf zaQuzd-Y)s^s_M>akAI>3*?`ckwd5Ysqmh;XpAdwOppXy)t~VS{I>f?hI=`&VtADi5|S(mfqn;mxc zAba4j)|et5N>C0^5=;o_GVTeCpRBJoy0sKMeqFMLqEh(oRf?5!1&V|E2*n86UY%K^ z!<$-q%8#Z`3Q;CEI&Uy?)1qSvz;s;+|F()QxhS+|!_#AYT=S{fJa@y-GdyGi(jbf= zO!u_U<+fp=Avh%&tLTKBgomwcsCh5^$~{h}y1G#CJo+N>98!tlt5lhh3>bSb9gyf+ za>KY8UtuvWi_|N6`4Rfn4yQ|A)#?)lWRjql(5gEk3{%Jay!McOqol5cpoEF_VppW$ zdF)`P4UAWvj)O@oGk7!+LD6deNF5bEaP{4cQLdyGyx|=Bb+yDW0#EjXG-A9E^+9oe z-X2tQHtk5~o3!`uiBQRc>dvS8ot?QQWDVtCLU3I4cjDf);4hWwJ)8)t_gIxP|Ki5t z7s!;%Dkj8;9Ng3f!74P43cu&M1_2d!{(ToS`~X8X zKb-rhEhuL6?HSKgh?B#z$)6k|*&XTQ;_(vr`PaY`z9EFKCr|P(*H6qLZNX-4$3Ri@ zTWoJhVLDlGEg?sO`cS|7(n~eHh1DNv7A(5pC$oT)zl(_mwqC9*V#cH2G_t+@6{`#N zy`xNBhHvz4ByN2DO*r^#Bkv*JS)*mMya^wRKm1}6sb9wURYcvooB=qNm&gZflhc!b zVybEWQTp=UM%s^#i61_m6ipGxSm~fwxgP3D=6A8(Kh@N!q+wc*-H}<0BBYXAH)KDv zw^rX^wUBvT`vHHGv$ky5dNQ{@19vcStIZ)A)FZQ9;KGxhJ>Sk>bUZ7#0~)r=MiQ56 z?juZ&z^(2=Sx90H~D4)oXZ&Xb6X z6SkZ6L(cG;IT08A7I?<{gqI<0o6Ov6t^f}x+C1Ze^i^Gxl>?hO$aZ)D?kJb_U95iW z%N4P{m#AXR7o#b+D`mz?{!ddQT>7nThEY=^x%@yzL~_-op*l4jHToy)hc5|QS+oU^ zFe1$Qm!1R}>njCdcH%Mc!4Fw8rNiM<(%3;$?WbQzEb+2q&00I`5g`2rS^jwP)X zCVtEVfw3CwJo#f%Z7&urj0v((&E9+n=YA=ZYJ>ahwTDQLF6=RwKJ*^O5fV#FEzPvM^k-@A z9!{2}WcSVlL0*GdLkz)%GpzDPrvqx8@7WXTCb#1l+m!&llY)`1w|CAtyuKUH*u*}SLD

8c+t(Q*C#-6zklV6h;gcUOR+r*azz`p;CThP z{Te_cq<)58<(zda7FWVobU{qGT^x!aTZ^Z@OcBOb|Dq?XT>XfGqlF<~F@!v*`{%Sk zy8=85@it-H*IZJ;ku0y5D;eLUC%?F|S&>{U2cVPG(iv^gOmDUD+ou-xVFfDU2L!O? zb9pjh>9f}iIbzCPz)KRLpztn85(Q#KP)xjBI40fIEsj~?b|=$AX)>L&$HaNay)ALYKY;O~e^f6gV>D1|8K zoFaE^xgjdv=<-Z^9B19>s>yt;SlQ0VBtVE^>cK!vZ zb>cC?{!nCg%+nt8LhlQTPiC6s5w4lD^9!5olLz^E=XrODsjkmS(UNeVVZqbQ8LQ ztnJqN4o+5Uvuu%+)Ln-;?OaCj-efMh`{)re`JQ(17@jK31(okFy6z{2Ww&1gjCGK% zdT+@u1WMCfSKyDLZM@MZiQi31JCTA6uDSZvz~{)QK5kEO{OIt+K#hYjCx7$U_eGoo z>W{1fqpj*US_+IuBmD{S7M>x0nx_=`ke_G1Y8=cj&CW}n)T#h_jO>SSNMh1$kMmO3 z+bKh|J$U&JGINR36t0a>k8D|2Sn?+b-@Gr7BEd9obvMa5d|57yZCNZY10dF`DulN| z{=Y+VK zD}R1H@&`3`ks9pWK-e)nCcnQnmAkpxg|c66_Bs}GeFQDJ;5BV}&)@3n!UD9441tZz zPB;oI4mj_-gs3gCp%`oZ6;^_`*>YOdw*PRj6f~jkGiG zHbL>A*XQMQr_+iWMgSAn#TZ?#z7wS01c_PYqYAvWX?; zIfHBU_$g&SkJi)!*O+#`f19qMD9SUx4KdmXks^|C(Pg$-tx2u9a@^8KwBIonvZEw2 zIyRjih=2KztBEVuT)u8ulK-79qmDUW`8?#*acSnT!fYGy&aHD*$>2z>pp>j}Kfh>_ zOUrW>QeJ@p?W?rYbsm^p4lJrSRhdzozh9WNJTo+ZQaGdAaHZ1NuK)+sFXw8C%^#q4# zrlPK2yRlF6V%DRbRq(n+L8y{w#s{ycFG)YW>FbVo=T?&cg8r=A`F3w6ELWRG9U&b$4kAwtsBizac>lSOSNIAS;BG$Qd{&Ci^fg||QdL!} zl5GC{Xog0DX{YtbL;2>ftBjlKIk>%5+I)`mG9zUUW@h8n@0Sd4jXtq$lV4Ljdgzov z6yVzLX1HD5MOtZOHsQR*-5OV@VG^luGbTwi@xv;}vdwXOS;+bNs;y-1F4C&uy}LE) zVh58giVpGiVWU@TAm@4`UxD2gr=$Ad-05<|L#d1-zvKTg!aiVlzhxM6Fdy&v#ytc{i?-!)Nz<_^-nf+ZP(Hhteyd#y?ON73(Kn!mXP>4fwFtFtwpJX)Y%;&5 z-|mflb?lZ5ewOL(T7`_Q8RvM3(dSO179vj0D!c(#%L1Z-E19Zl@jcF+?cHE9h`EW8 zGc=IwS2~$OWtECLewW7|W-nXZJnz2DO;33&cR^GvvBFv`zwylYAsp=#8A?ob zxa}D7S&X*`+O=uk39cZuK`^)`ndn((`+X;W279K|AUu`4)l_#bL@1v4QzC_8Q}f>wz3TWgFXofj9g^hYBv9P{d#HOhK+Z%xw* zw5sNI3C>;uej3E7c+E0)5F3zVa%wzsd4Fa_*xBhOJ_9f(KRIoxN#d!?m zP{v!>d)>Kvg((O*p1U}%jYiht8mmorJUA`8owm0}(a+yMb+2>yRhy5x16Gu$IA8dj zENz7yE(^64Q%4>xpwg>)QU9MZNbg#S@1R5HlA@f9v-#xLTFv5j?0}jq%HyE}TF4M0 zS#g!I>{*I&_>-&DoV>|+^ia82=2$Of7yMnGW){+e$tuaqcYOB0IqIT{+##!_1gC7bCZE2ViogX(RdD(~^r@mHHdLXDyn`Yfu-o=MMaWo#2xuR5j4i6fo=Cer%=HkR>W%8CU zjQ`t`nk@^5)ujnG17jnnrZmOjCT^kgxNwHD}%i*qO~@?O!eoU=ublh z*dN7^(Z1yyd5;R|{v7w)wlt{|XLR zyDNeB{THCUs&wX{+=ofI&`EgJLA=9O>&80qzYp^t2mbvHEX|sM`7=Eb`zRuTc0Me} z73|zA9Dw8&GgsBf;T+H;Z)yNiSld85R!Khjpqg4{XJ9aEdZi<@KwPQh>am8*+56XH z&2L{YI%=MV=D(OWs9Ie`A}luN-{bXu>YQr~dH zGkBWi#I9?u=-4^^C_b+V-qylIrtxwnE8L|8um5r;govwx@{G>1{QY#b#zx8XWwC_i zbo)h(g;JZu3BD}}|B=?T9EsR>mEY;ckAMwIjl%sE=zb}tAn5@e{v>Dz^LjxRiFu$f z)ZoPtQwEOvV6c6gM8rVeE0xG6(Q3TZxgPMg*rSt-#nCJ&HX}(IqBI%dwdXb*eLMIk zf(&cvZI@!?@s6h_`8k}25ey{XW=y^dUQV8k(dIkcYT3Q#av%+m|GjfKBnK2}7hx4_ zAgs8Q{eE!KdWBe?nq(Z;x(Lq(&}dB zxWSj=j&c=Vm+mIl4`f4--c1jz$tSB@I4HmLS0JBuR5>^K2meI)1ZQYya?_*``!8AX zCY^UU5yRwC&^6nt#wSYlRc!?p!v?+`bBKm`{>IqArt#;V!r8HYyGf1T15A9^yEI$n z3MResenL|W$k3YGcxX{L-Vk{`(5L3~xU~0r0@~<}tO`onjzC9Q24nleBtOG9=RAQC zPeOpKpB5k9QLjDC;;eeEiz{_V0S9%`t!-d z(Ehy>s0R$oGVC#xgQagBCk4`yP0Qf$2WlS;JGR|~UJZiJ`_LAMakfKqESH-x`%YU% z{I~Y!QdC$}cWba>A^|+RsXn;R7zEyjr49t4_q;L#LEclI_E4ZAsbbcy{q_G2|Q2?{B zg26mBhJa!k+M(AI&cbio$J%v%{@@|%vrt_!r}KfsI-nUW9sDF~k52AS(6U=sdiR@AV@*9)Vwqym7o;W-*{4Br2$UhjUwq>X%k?IPh=}m z!Ls#ki0o2QZ^u#K*i8mFAot<~>b6TmJD=N75(8iel5h9}m!^5U)WP)*%IVK9NE+;M}7J#t`rA5!fjo z4YR#yY+KDrv@8WFAg(A=L{{~~UpXym#T^z9@)ls?3LY3Eq0@Xa}@g z6291H>;f?+al|-fC*KkdJ9D4UWmQfY6A5keyiROA{Bjy7&T8=}kO0#HaUKlbn;Z7> z92|M>mZ~o6Js&<1Xyvr!)+iM!yUPvGv%CXhnaVCwx4!BwTa1;jZO4H^*Qt?2kjIms z7P}8Paoah_cuw~eye>a`EECNa`=ax92a-28oJ@d~PxqSANJrg_l^9n>I$yS^dMTvT zF14}gX2;4yVBY;mPRQ@;-eO4?>DG}6_gd5K2}>f7p;4exoeuA&P1vM{tPEO7fRvJ( zGgPnqx@;oRGOYcyNgPghmJ%c*ghg5Aube!Vw@gebb6TV8X9NuPja}|V=ly1Y7O!7X z4M53HEP!s>vgG0jI(;9Jc%fjt<}9ObLcPwGsn%&v=TyKGs3uT{nTk6<#5phOfLdqO z#bKMrev~NsfzeQ-_1J;i{M9!vm-t*c8k_b~j9w)O7dnd2ra0MsrJXLJ+ma$lpx$YC z{j_PLeujwGJ{x~nBeW^2Oc=Kovp_=U1v6tMdP3GZsHUwtyU!} z8d`ug=L3~DLZL3V=WT1uYpdbvPdn2&hCTZkAEi<7>jZ@#OxI{nXDqxrSgwk^ef7G| zdatj77!4S^zAV9bP{L2()W;62r4W<#sZjl8UQCVwd5A?29RGL9Y6|&%%+5B%WE(~b zf+t;~BqXb#!#H?*KYR&%^K$JCYr0-#3D9ftC6BO2bz9QkQER%41&y72^K61vk~9Pi zEcKk{WB#_Qn~3)z4<{0lh{|)ocq7W%I-^U(Y8Y)&&al6T*^9X3_>6cU&3W8cAe z?o|r;UCfQ=1}x6ci7}j}jN&hLoEncvtn?*x#{2_E=WlkM8fWhoF}(JVUR?ws-(mi8 z&X!mg&1TZTFVps>oiUH^X5LuR|koxs^o`%pp!b!~3c()!v9yd+#ynGMY5)}+`y?!Iv)KyN~ zt^&c2IF+bNzp=q&LR@(=Zd=RMy!zUGOi!9%#)t43n zlfPcy1D}+JfF?*PsO?pdJZD6p05Jxo`Wiw@tJ|h-GVRBYEp5**?A7CkCY-;c`rNx$ zyuEZElc8v;%p_jJWE%uV=$NO69}JyOHrbMCt;(UO-h=ajY6wGXNTbACo|GQ1dGR^)z)NG@-sF& z)lQ_~{+d%R0NW)Ut>(>;cycWn;#LB(!uxR@-0d-@iLD0o)12Zp>K7Dg)&uI@HgiEw zVm`&-Lqn>4GqH_mdGebv$IkT{{1kmxNi`XBfnIT~Ll8o;Bp03T-q=*bz4W<|O$#sD zMyJDX&!(8!NM6!&@|^UjVX2B;o!oY(M&Tg(e&9mC)0g=M`$^gygPD0#wZ6dsT*8xu zIf7l^`gLJ))U%hnHZzEAFV?;;Vq&XQNc*j|yUjx?w@d9Ac*|(=I-M z&f51=EbbyNA)=Y|V^7H)1x9_`{ z3;H;pz5@m3Z3du}_Z>Zd8OXQk{2UcU;kkQQ)ndE2RI~oZN2x$6CQ)4iSKnnOUY~~| zA~X7O_{7QYNuSy9KVxr42!#(wWJQfUTt0d9zM?=A9#h(yAH?0=qQj$B-h^Zq* zEGm~%kviK@2wnw|CE$hYofBdNqw0#sAd3oMxwbywbYV52!c&)?$KRCZo+l#S;cSPt z5HJ)h>~}qiSTv4lc|MVilID2+4ZD-)NRjmPCgKYJT&#EXI>!WaGu!Ii&wkjVICpg} zs({M!d^g&OH=cDSaWu1+!a=>ZUNrI1B>M{X7aQ3`%E+NC5l><}@D={$jNZ?GE2P>- zcLebOg@J~V2usn_uzE;dL?;N9d$$CMz6FbP$)KNjDX{dt3aT9%x>rOE3l$vu( zb{KcbmL#jD+Jid>jfAx4X4p-s4%|Q)ksE#}>f5~RuG%6u>WQpVLHZ=Ej!FAV2)+*) zC0$(O@Ri=PK(oR9HEUTxeW4hVh;)l+v!4yD+*w${vZ4g({JXE~gPP&K#^at-;C;r2 zqfA+s;er@E3*;3)b5Ux;TpubzGRpeEh05~7{gOzXfens)1`#E5*3WL}4HyJ#NaZ$X zGYx!kDT1kT%QQxwDNGt4uI4<8`lmUT(mamv94CXj)aMIcLCJKMbkyCCQoGDM(>f|! z!0Kc>sAx9R5Hhd6tDiU1aI20lXmJbYrM2x@rtqtx=w@f(LH=EVlSbD>!M4|rWYvdy zzYG@fUd@osLE&c=T43&z%T7XxhkyLgb>SfRGt`sNMf_}jdqDpM|d!*McQcxNa z+;(RqLn-uR+a+>GJ%PXqWz6L?tEr#g-zjJjH|JbsOjA3^aoiZz>B_;)qU+D}MVCPb{uqhYP_} zk>nEAvN~g|m)giA#Mf;P*lcVv#K#sWcrS}zJrPv@rgzXfG*OLm@$l~4W*=i!qD{2s zT>M7#>v>$DIdL1OuQle9*r?=LuuN^XuGHrv&W3?_J4cF_rYidD9{VOl5Y^htz+!XA zOAf13tmqQvPM@Gf7yWGeY8?teVw-cszVWzigwWUdx#^Uy9GVcB;-rYnAJc&fK-4@cexSej)+kIJ0jpYfzwYa?z(8fS zd65G5VDakNCyKKf$>MWA56nE%<>4#xc|%xU&IPJ-eXhc{ zJ9h`DlLJ**yQFsK9vD+vXCoFxyR-Rbi4&(Yk|_|#$yWYsR^uq40>7CGbf8Q?%lS@z z`WF=r%{0|==d@L0Ns)uuwTZ5DX%Q#!jc>}M?wRy{kcm+tU&Ir>04O7Qz*8&h8PLPR$pMpBaa}*`U+zaQ({n}IdldnHg`e4 zgEypG;d;rwuQ4vzWa)_{`PcB5<+$fQY6>i`B&Rg@XyJq07UJP;ZBzYBWAXIv2@XVf`^@oETD1EQv7hy zt<5P^U)Ozp3Fl6dPrUDfARvrtpg3CpOFYYK?E?&#VsY~CGhpX75#M|LE`}(7Bl?g+ z`xuAuWJ$!3!{QnHITpT5sx0$2W|iw6ROr_s&o5gn<#ddWpTSsjr9^seVq8x0?t@Aa zVw^bYr%dgDD;hf=oA6@6rMXv{9X-#2o|V)2v25ZrRi?^i)>X#zT8rp7f*5aWavj1W z5me-(&2Cm(YlHW1nu2sq9>zVfP;ABw?46-@F4n4}_ORpP(>gSqo{ogKS(X6QXrd3Nd!aEAJ_}Izsu_)$opK9Ww?2Q}#yep?lcJIMhUM9t zgJ_S_Lz~-+7VahzRwF>s2)x?fh(uW=I~#TvTD#TBhr`}44ShIr z@9F1WD(j;tqBpl;ouRvd{H>flOfjKG^s51aO6wm#DM;b>f8OIelBF1XhwUvw8YJB} z6(6I^v4<(Ni!Z>eK>Z}zMM(Ps30v!dj=Z(DDMmTUwP<2U8S;gA6>7^562HopdY`u0 zdMgU_3Rws(DJ9;9D7OK;=+hbuDn)W;Kk=vCfvFRHAi2r_+jFZ_e!eZ7LXh!}_`YkDTElW?l(QSfmR7G_Y<|D+p zG0W24v|{hb$#v{}Ve|fmUFd-Mc( zBYnC!a{Q@Qf(i4v4avpL8tJP#llxDWum&2u-3WJfL2>Dz)v}h85ZcG;GJ+`luG3}! z)okq>-llL}*P$SzqK^aVsFk1frVNRm#58iK);TKG-O|oO6alf$=T*#S!iUJBAq;i1 zV!3JBU{KbI=#5%U|C+M9CiL)%>_00kyF4vn&~Y87=}R!Ps(8QJHVA3ZoodL-b1NBl z{QQFCj6I-2@cidvzMJ457Le8=i*IF(M+5#OBMo^k96B)+xEUIHAEFo6b;%b?pb<@d zYH*ENReR#nd$&Te8?PDgCPG2{&}so&ZN;g=c0jlWrUw#!furY{GjxBTa((}MjGX(L z+|udSaB)-=MZFSHNq&B~PMJVsF@kgYp9&pC;cEnMX3z5#GxeV#Jkgwcl!w-Cc zHy@v&uW^19{5I2|13Q0Agr{A46=~Vc@3qQUrVLIv{;6mU1qntOe={YG@ugtN0*VMv zUb?aEOp5v{&H=;d8DHYwdcga$cl2yV&Psb$KTty-s!Alj`heK?q8pA3sj!B-5X<6m z3)L>t^5-16j!`2wVu-Y|`v9woW^h)z1qG);zj&jXmW@BYcQhVkA&I$mol+DX_8N1@6uTEcp9&{kTjb@cHeH*@J!t%~0Q%yT{pnNLv1{(G@JEv*rc z=NVmx@n$5upT>k|)v&vg|2mj66Vn7|=+)-uh-?Dw7= zXWijO$o!01d*?tUqH1}jrvPU*==-4O@r^BQbvu0JRT7pQ!+fJZrW<}F>G{^$SCTcJ=L!hC zFAcBT=byfs;4}9!d1^DsD%u+xZ{Lg}qSN;}vyCkQ-~6IFiD~nYPVD{fI(Q>ikdygn zvKI|2%ecFkbn>D7s$X#i;v{C4#SJ+oe*PiPmh%;OqT~sSeuLW=-Q$Sfq;8y1{+q-WF&wUVN`1w7P z3bmGu73ja&xyV#9iE>@}U8!c(n#-50>R=9tkoKiZC$_#~Ik!llufVY2c+CqD<6v~P zP=S8Yma47i?lP@OuzgqifExs1kpOl$MG{Y&^6GsC2!<%_C{H^{K$HPi0)3J5rTH=# z0d`3ibLC~`%USeXo*rM0!V&3oUafxRnpe_NuFbd-spU+_ZA`eP3sg`hF@+u+$@Q@0 z%nrRF#3Sji8iL4;)N}*M!S?`U^G$o}z4h73@D$PAevL89aGF0W`L+Z3 zHJ6+`UL1PYH#WGVXF?Kas8c7-5T|KolF=-Jt&+5AeP^j{;YV~CQg?7;b2nYYK<6&go-n_QJ1Lxe2o8)|G3nal3B%_^lMo% z7o&=B^!F=F4l&Uj ze1_^CQcfE&=f`XEr`5P!@EWv=ZB12H?5yI2o{#5Qox7}w#QwC3NX*hN)x>p7B4TzM zolf_-j9g>cUz)FE`l=~uauMo0+1b#yG2LiiaTe7`Q)P|BXj>2n%%#C}Fk^88b#tP7 zK#p3`BIIg{N7Cn-vNoft~wS-Yf z;5qWV>_M6yTbIQ`8gz1k4N6iVy}AqSNwt+>Nt*dkIQtm=!MGS0Aht-=DFk;{r4~oV zjuklTo;OPjj>9U0mwiNd_!mG7QE9ol%x^tX;&_>^0C{0m{~B-ZR{{SHTtTqg&l-iu zUCy;oLdRnPjPw1M(3&SJHo(i^Y2T0pa|?#Xx(&G{zdEHl=wuScQu05bNh5>V%_UaWiW0ONKFF$ z+5?x(oZ=>zGOaMvUfcF`EVd5y!qJv3QwIMVJ!7m_&7(SB*#kEJuA@*gsw_Je1EX%) z!tB|?%G4yq_>^&#EZfIAXGkj}1C>M|JCqMMRemRLx595`;90!mXU%~SCeSk0M7FmP zRUNH~u%yQllrC&=d$^3F6=u%waC!2?36I8v+nZ1~@PXr;G70>7$Qz*?g1Pf+nNDH3e z)iGUJrdd^5BE2*dv~0?`8WWGVlB89s4e>L1MN}wSc_89mIhFBJ)@pA~#DpQsN~`SG z1oLh8MB$gccQFPGB>`&_WEIijXg8kH2`PMYQqJ#*mwLu^;c6<&sO_?*p?i(*LX8!w zmOAAMx;;XON-UNt`(H(JUEtR&FLe$??gxZ#vaIkruhmp0@&*b201^X5GyTz$x0n(^HPUUpMR5=8F9*<2uSmxUf~V_Pi#5x?^yH z#g$k3y)ANNXTiE>R;?7=PEnYV@8x2f5~jUeW;=emp?y_ z3)khB&ocbpzMOF=165ETqh2LMoBW$HTOTJ|$_tqO^>sDJ|B{c8Bf?21r&a5|CJWr` z>}?VH$TPxZ$SkjiZ;|E#pVx2t@4K zQKWU{oGu?kN2pw69?>#Zn@+VTfYJSzn1&v1v{A>P0a9L>_7IIeGpOiIVQH4Q_(b9R z&-sT}?mv~cW=j2E&@nUPH?;@r^iCF*O~^foKVn&VaA|XKy83hs_b~SLKNEGtzJJ5) z&Z7GKn3kx?IceQS{IrH+_*lBD<{XQw+PSes_s&z^4=x<(hu zy|9aDeh`AY+Nv;DkfP0Ms>jo$q}yL&C&_PwXg)t}N$P4^Q=H+OH|H|Bd#9JA?a{99 z*ykwV5rZJV&ey-nYVs4?Yo^dh=IVw55wc*Z9bNkDnb4)}#VHgV=vd|-87|R4TrnKn zCF4Zg+8SqTHyiom=NdO1x~CF;f#jI()xXu1iV5(ZH=Wa`!`BF>KWAzLH806GE-6CQ z7^`OM>?=iGPoL#=HZv#pWNI|%``#@4g!Zql@T#p|sTl=R@{#o=TispgZR4$yIo!2X z>Wc>7=rwud`vWM!#ty6F#u3Z(x?K~AwDy;}=Zti8Kl5w>ET}b0?5~fH6(`p=iDFas z@46W!k!)kzF?kd@N%usEG|oP$2g6H?ze!p5=HGXQcMol`EE6`vdKI^x%I-vdc@1yLk#-|2RBc*Di2+G)DUok?5L z$vmhCO>H`Cndjj#ZD&zol#%gY`FJ$gX5!+%D8{)wspvJF@HV1NXhY{uleLxlfW2v( znpyqt)ANda9$l7SyLQ=BeZ;fUGs#(b#{Tx;d4$cd`zw!EcRvmzJO6Z4sN#9&Az~bA z%<@~-&u%kLaPnd?LdY~~j4R4MFyPMUTo`2Gk1%^)x@a!@G0zkZ)b17B;fUul5<*&R>x`j~{zG(}wkQ+>C&s)9U$4;wU#rmm}rele4S6MSM$f^Yg7& z;lU_0OYvV5g14(&bFfJv*U}Z$FhwF+lF*D{%ifKKoqH1OvE`*e?G$^8YzZP3Td=g%;|lL_l{f$N{DM0|Exvo1?EZ|ILK zn7vv;Vhfq6Pv>pO-ZokAsjw#=kE=OuibhWTKUH0eQ_=?Pq zl90OT(2PmxQX(jyoLasJ0n1l4wTvh)FHF&l9-5Yg$h;g>jBm_v` zF4w6)zg@X>aofm&O8>5+Z5*$+Ics1G;L072k5J7xx`9c!M^ks`x&3KNRyyP*4ZJ6f zGpnS;J`ZT$kDuBO0*`xsAX~-uy6+2y8LkZ=z}8ejNfhx5!Ux?;1_i|i^tsYGipFNP zi&Y9T%%(={9fXUjKWmD4EKo4M_iLq2vBKgGbN3K;O0~lepTsA=w*~#(8i`6*J!sr( zUy&qhZvxRacTLEI=#9a-royVXMb-XU;-6l?jRppf7|#`i!<=U^Im>(iSLGw#RRxin zTH$3@218_tJ2hp8A1E+P)tZ(&#s^Wv)SIj|+CJ3fQDnDwk*YR+OJvJ~*6l`Yl%@Pa~UB4m!I^tfI; ze_zY<^}uFuT>f9#7OVc#kEul+F|2y<;W4F_fI?KuZEGucM=^adEIj$o_0xk_1k};` z)baonCW@P3p@ddRMZ4e?;C(PbPES6RoV)1qqz%AEN&Hf|M0dFC2_v-%$3|M!gFtaarb2gaAaCpL_ofj-CQA+>V_L5zy zaFuyOXHu5P5P2b8qzOlUL0#-NX0T>2t-oYPDt}1&!q?@pkMt+ zQ_eF7_?EA>uP~{{*fwb)iOJeG#XV&x&T;-|d^UY1ZV2q#%ZQr#OBz|bt!bw2`L5>Y zbl_fo;0d_m=}@WJaB3mJVvbiJ5~xgGn=p1#PLocjo<`0%d(s^SQ6@Y(@ppMcl1Xw6*FOg1zS+uO8?To$>JR zA)kue$j@r*km}x`&@ZrCj!#;ZBcbKum&*!uv6!sk+h!%{4M3}pI@rVM=?VyvxBzQ+$8S*%Is249^P<;rx z6`qrI6O7KJxKr3aw{DKkdt$iA&?=W?k6^Jem3MLq!SwQU?oGzI#5cG?WFsi=`kGg! c&hr}4H!$YJKigk_T>t<8 literal 0 HcmV?d00001 diff --git a/docs/getting-started/leaderboard_trace.png b/docs/getting-started/leaderboard_trace.png new file mode 100644 index 0000000000000000000000000000000000000000..ce7d68f342972ff74d6daa2f9c9a56f3c4e2e5ca GIT binary patch literal 165672 zcmce;byQr-(msp@1|KA7a0xQFyF&;r!QBb&ZeehD3l=0HA$V|i_dsxWhr#VPx%b?2 z&wK8B-+#WfzFBM5^xnI>x~jT%b#>R%6QQgqgN{Ok0s{ksF8fAO6$S)jMGdR66Qx(4xujs+jvh84s5a$7voVG@!ZEr*ly; zrebg0_LM}Ok7$L@FizgiVk*e+@TMs7-}MYsVN5(=<|w5^WnkxAL=Rm7KJek$2*zZv z-;j}=5vv?v=HLbhBSbj}3}NQ@W#6pty|Mk$Lf(F`Q3l+{!QLb|-dlg$-a;LmI30-% zJo;#;teu>Zqw;ALfL5gbVyxLrh~xzoJQWopqH?-~dO#~IhMY7T23RYI06w?}EpJr< ztR*;(xv)h*aB~kdc`y2m;>pJPYEd&@D;eMcv%!o$np_@hd-!!eijMiV6CuW zXMJdSdVW4RdVYS^?`?1QjS5<8=Yaud8w=h%Ac;d2t6{DsYoVY3!vHM7s`i1I0F%$*~`il+yO6I}+>nQ>x5B^_ec$421#ndEZWud=nrq1T(_AXWquKEHm z5}>4Jt<|+$wG`y}O&#o*jm;cP%$Ysy9Dg@~5%lDT7VXSkjmbUjZ0%k6J%uR$QG*{^ z{(YN;lKdZ4Ty2CXwG@=eB^;d1$+?+XnOP}?QOL>31)a?-_*EsP|7Z@q5~8$nb#>%t zVe#i7gr}e*kvUmAIEU17izn`$MF|)G#NgLW!@b_JQWou7! zTWv{eJE(e~eF*b%a|`~X{(n6AcaMK*srB!cZ0y{;e{K4gM}Ken&c)nW!od#Or>pS4 zhvtvQe|`8zLqV3`qW?t||J3t8?m`tUj3UVL=b#Cr1ZQIp!oY~a$V!T-d%_-Ozo>uL zGuw-VaERA~z{ZMoC@EQ?e28)QfcsJatLKi`C@N+tB4&w_mKKG90TGX(cI5$a#^Sj3 z^GU;Xj>}0?&dx{u>etH|Le<;ZTpUcbi_T5Y(rp)INdQ<1as+T75C|tO3i$hl@-3jI z^ns2c^nZEw?^XnGln^vzl92yG1X@w_CHZ)j)JsWK72N-=n}3lqLV^2E>;L@Y{w`}Q zB5sba0!6>geAjK_wwqTMQ-3K%@h=+xDa5!S76I4$z4Y_{UF;DYSS;@mj+K=6|F!2J1}RanL5ju4PfY(+!BF0S`Llu- z`v0HV3DOwhn0x!rJ68Yzg7~RettY8@%=&>mCf(uu z_cWMbQ5te`@p5cuF{i)VLf%)bz+r(kFpgf6`_bZ}%b5O8Yn9CqQ8h`U_3nr@Vj4Tj z%S;mto;FVFLA#3~mm;mdSyB)?RiJrJe=~b9!wFcF5G&AXhj>dj1rSsm7zk)7j*og9 z{CCD(uh#DZ=NORE$v&cIu(*VN9za>Via{eFo1_Q05#`kwI{%RWU zz|f8v20>Eq{>CcoU&a$kgz*0dBBI|IBENlN_zxqoN(9K~2+sN4tcAsHV9SBlwsU-r zX)_dQ-u{#4!C=u~p!Y#}TkHMP{mBxvU_dpa-{kHlEU zw`a4s0q1ej_U!K*&`W6PYV-X^s;+fW$|4vUXYq?l!Qz5LoBn~9GZjCfkax}f{A-4 zCz@vH@3kxO%DJCH%mYLXmQA8<$gs?r`(dm7B&#Lza2k9MnNlM0R*%ACLWxk!UTnVI z&a&@#f$w@T%%PP1u(oCBf7|nTy%Iq9X#MkRN`c5+`uVJ30G~g{2&YbHxz_KkaqHrbp?2vvLcDf5QKD>lAz7sHjIvTiLn-tiJpp{sokzSqHJV7)%LT5#~F z9^uZ?_1-I5TJ||15pk|tbdIuFYIKY7(G$G-Woo~Z?SXM!_say;fMc5zn6))?fPCYGJKf#-FE%!Ndd=IEKH5J4O z&+EI4aK(sS*0`R*Dks1dO$hUVN{5`EC!;E0 zg7EJTtCenM2Btz&i5;3Je%Q=115csq3&{RpXd1(X9m1X@gO-!0JS=e195i0g8u%;N zl_iW-^djK-I^cLSNeM#(W$RSU|6kM77j*=3`&fZv-q}_^ACIjRP1;RtzXYF?mRS4Kq(@CR4>n$w=KLRQEi7mfR=*}XFrL|tyEJ3P1nN#BT7@|)YGHZw!IuFpm zBe`s6STNAmtakqW z@uw(e6f@G8B^)I|EQW?9_XQ^4>)e2+27!%ejzrB$PGWvnE9a2`jxj;CjmCiICu0aS ztVMP~4SsB=%_03^rA8E&jlRmNlG)0vUBGA$FEr0poJ0XSd zrsXE_f#c{6cSV!=xaHAv~ zxm{dKT|&``x7#5_X$D`-dpz& zr+%okZN1$#CW0Fy^WM!jqQDg?-@JIdS{PIK$jc_L;tPH6mY{xY9TAiCkh$rws)9R` z-X`<_iOd&x8eEZM8p|g>$=mvHJ`}VGL*_^z>|5WJ8QGklVA*&phD4&?C4@kE?D#yb zrWE4PQ(?ln6H09Fc+zs6bAPiD*G0!lyAU4Y(eqLhd|hE;S{T9}D21mHLie&T|CJgA zNb%CkEK;O%7jGt~FanF}&7r2D-%n$Ohe5`2aKb4s>8dn87AU~b_e`oU5Vqj6-~AQ( zb%_%9f^D^9tRc7l&vVYHI=GT>L+Ds3_QRi2KVLzE0H8?mkJHBlr3N#o7ebqQW8ic2 zqXHb1Lb%+)pU$b0N=F6`(rW$!zv8u%&H4+gt#2A*vKt1)Yox{lXJ5Bf418nC){bk@ zS&3yoSmU=5CwLw%H`{mhkyAD7qvv`=M;kl_FS!<%O9#www#PEzu^O35dAc&jEh*HM zmpd|QwuonST*G>eUQ=Sh{WDNgmIdT_e73~wK9fLtIv-*QW+q%=*?RRD;+{sRw2Kau zs@(J;Z8A5)b+$eHRoRgl?LvImMS=*oc)t-R@*(HLGT4C4d9xoVd}dVpmf0AEji30e zr+*#l0|2AQNNpK!Z9arhUbElwb)j+a-m}3EkMfz^hL&|X%k91eOU(ma-HXLs;%<8P zy3R4Pvv(jKo@u=4j-%x4V{Zg_UsCPzcVja4gy0+Sg4lY5QgbM6WiQ0Z(^?(g8%?ZZq<6M3)8yKyNbwJc4w4iD3$-Aa=7um;E4U3ouF9qXykj)A+>*54I`mH7U2qUFg^wukEOEM4#4HA>w|_tekvr@X z1hYsYq3=P146d`sgoWlJA1!?Tb^A${^mRz;XHVz?;CDpmcc6H`oj&rG52btR#U6 zSfEF(jf6RW?o!M3~oZ^2T8C?v)vG1gO4 zM}CfBj&1kHOzFh(DK-;b)Ro3wWd6q8OCQ^p`w)l|ESEtpo7TKlXT>o1VdfUdq$rGTLvT$Yhysi%7HQ6K5^p~r zl%&W{Pghb%BF0u6D>kVnPnYD2X_1j$Vi2TWWMI7cI3YuZzL&oYgBkHh%pCMq6lRHN zauBj9@AN6VaHLxMZN?(5b6f}0yjHO@Ht8BWuXF&~z_lO-d^X-=LMzb`gN7*tnfye4 z9J5}=6Q~RhdwP?JoGXmfs3@N}*W@l)N9kYRC*sOiTs&FQ>i~FzbBDYrLB^~RPHc>Y ze@AhHx!2MD`i^w1AV6Y&PF)Lv>q_U^S8KO`C`85{RPzA|f!ax2Q>;Anf$FgcLjb_LAR8M1)CAiHuVL^2fPymfXnie(cq7UHm+Sl#jsI(I40Fy1-O5K9V!X zIjTs1o@Kav#3ZCM#tqGQJynsu6KUcjf(<(gBZ;j)=O>^dGzhY9CyKVN(Nc@^6(#s# zG7U46`%tKcsSQ3n{>;m+kB>?UcmeJuT^~HhNQ8xpddLg<@McqDJvcvKhK>;!2G9_w zfW*JFP6Y9O$rI@(r_RE*KxZ$+5XcBx`{A!*);+Tn+%8!ns+g+?ln5m*a=26w^VWSg&O(BW1P&Em1nqH9D~RXa>F zGzQ?@ZHYSWY^Tv5lo9CrfG&VSyfG%BP_An`bV=5NiJ%&jP1F~sU%!>1n7@L%|79A7 z?$4H)a-fSG`#^TXrW0y7tM8#tu5^omby~-cYhU;jPUePxE4vXbK4|gMLd9zImUQGj zkWu11-4ojZK{bh=AfyA~6L5*W*9|aq33i4N8@{&DaF4f;$6WIpq`Bk=Q)zf7 zbAf;=p>{<4#@GRauQzETIh`obquKEoGWK8Y`|hJ4goHSto@1kG|7qF1(t)wGet7de zdRe67y*&rIY1j^~Dy1#sTja=l?F9j%>}KmdV(u3=5d7QNgn!vhZd3mCn>MvCqMJQEnOX{uWI#1WSH~V5$!oVTRz4cmr2i zSEf#}zFudH7GmReoJowOoF^PG4S({HI-1wpMM5y>U3BTg-sfELS8p$6PTt|eh3wx$ zva|=$I-Fx#N&Q^I9q%@GFCiWD1v4y?ES50BY065;UvsnC8hGJ~({}bv&-KqodLDu= zbw>g`KiGP=5yJI6>iDosB?!OrBfVqj6evRM2j~(>O#gn&7q<_iB3rRcO<{ zr3_(rKipi3;Ds#L%rPC*_Zr948rN1VV|J6yDx{6>2ZOnTPMkXTX}&u?2Re%l!t zb)z;)aZL`<+K7ihj+X@J9E?z}=$58cv`Q!H*Omv_pZZM9c^2wS?9Y%Y1!J8y4a%e{ zzK=@WZtBvUD1#_^HkR7$B0+0f!o8b|#$hDA1(M2<-vzPA2I0*Mft79urjyYQi{V`S z=-neA+S_A0*9zcsbwk8K3UpZt_736SYrQ{4Egz2%CD4oib8UfuU{zPS`U#!m5k$f= zFFU{42o!@f+)U8dJ>eJ^e1ooluh+E8cAP$zI;ev(!pP9hd)7?#C2r;r*hc`|vGKOR zNI)Z<+$Yo;wHY|enbXJ_$M$?9^RMhG^x-oZ5o@AB%>>8TP7QhTB*lZ0nyv{LAp6 zutIsFs#k(LpWR|QG#5*yz9=8M{aB(wA!O8!Im|0w!A3K6o`glK`x>s=m57^2{T%ia zLLxk6pmcN`2#?CF!SYEgc{7o~bWrLCU<-q-lR1{hJZwT`Mw0`ZS@E;6cm_Ay@Daa( zMAza1M=aZn-i5GvRz=Bly0@Y^M#l$})YKclC@L@1jBruBNoBKYQTcmK97FxW(?ofjAPrh2Doia zcbv4j&SQ6+1PMgxYS`i)XBz%B{oaYg$az@wRg{(Q={RYX(htGB&xf};YjU?gvR_O+ zkG9F#^09yFmVs!_UuzAM9h*-YPp(NEn>$=2Npw?Rk-R`gQStpg@!Apuy`({duSZc`F@1b(^fc&K+G z-fce__jVwtM}#NZ+FOE2Wh0N`G*?j`&Q1t;VYYtq2L+Q3ToNgsOikjKPxa;TEF@af zCb*)HQ8dgP>+5$+EBENP&E^fzoD3dy>~{%sJV8WZ4Nt&JO3-T&c~LC>>E8BGV!o&0 zuUnjLS^_5&xNxBN!1eg!az-wPettyIiGtI1u zFCrRI=^2@U`6C&hfms>!Gp0bI2Mi&Ivd8z_LBuCp>k)5kpq7zobp36buy|fz%UZ9C zBN&TkM(9zIOFx**yi&8=U?3D0FQAyu#0y}-Js**hf_y@rj+Dj_|BaT8Y7_M~A_Y5z zGBtTgh%Y3A9nYr$;XoLSg*D_O&2pnSJkKzDAM+UfV~=jdi6j`iA8rV!phjx4`uC-0$CL_k94e{{(Yg(aBYIqjR}|W0u!w7p7nN zkbNMc3Gx25-kt!9g5@2W82iVn1sO2zUfqm%_u>wh9~lgsIfuB6kJ)B_QQe4Y6-Of0 zUqWahJ>Y#9y;3*~dU1aslRH%sLaE_(|r|uy^ zy2ww*H^zUQg}Eln*?t#xwLb4dR5@FLkb=DA$Nk1DCrBuWu|PNDUN>wKK|xYogUgJN z@G}JXT_6+puUuM!bA5cG)Wvrga6P;C+;XA6IF_;;Lf9h=&@!ZQ$H4v+ev}8ncwcQ6 zt}UN_B@oIINQ{Sx%WLx3%;>!mYZaz#Min>2SPm1GTy*%t(vnLP^(9F*YorkstE8f> zN_Us-F)jhExOSqX@LXI=61P%(;JDbS4+RbhE__ECqrFz=HEZ+XvzAfvDA|+5vN2z; z5DMdrTkmR)+l=%p$^F-Wm-3I+Pae7(uKnx zycWgK$f`&eA>&9D;?yaGJz(S(%S-rhSZEy5ZtBO_Pfo>E8EW=jh)6`3-90DBE^eU1 z)-#?(3-?SI8f1CJzpkBftiAraC2TR7j6cYmrCIR}L=4Jn&qtdp`$6X{uO{gvN&$<5 zi_5@9>;>W;A!&A_-oiJ5cQI~NkS4bM%=AX$9On~D*(OIw*P9n7l{3_ZFH@C#`=rf? zt#kL5-q!cksLe#=HCMX7dP{L2mseQX^%2>O>k`#G{;p%Phx`Se*P`jt8!Ejc-PbHw zcY5Yc%YgI*$~tm4%WthAD*q$1-~y2pBJ8BbP>+EKdGZJ<*pJ0PaA5 zx{RGHMnyD@Ph{Pl5cPf<$lG}p2yeeozeE;y=1IdXQhs+SNi^fQiuF_kajGRa1|y32 zPQtn)FPKmnk_I3{{p1&F3+y7B$+KcP*w zgM}FiNgHv-9HXA#GWu!^Q{}`~WIQamG0dnNk?Qjd>E2a*EOVt7$d~zyCjNomCf*7_!uN)k z!PedS(}&0b!9}AN62VekA?9Hj;h8$Kor|~ z7CdhmKvXVr3T?JY>05FZb}aA0Bt&SO@g&P%;wX!sZH>cmR8z22-c3~qV@8zT>(YH2 zIQJ4apDh?SUk#0$6U0dlQjG{iGDG}zW;_*Sc?23lg3h7M@OxtLeXi1PRQo0R5dp%w z9*i3DCT*T=lOZLUMpFDSD2}N(&*M$un>!J&1Z9GPfHa26$zPJ`O=(w+v>eAq zH>wa5!ZKL#yrMy(4D3H~jWcO)yDgAG%TXWt>Ldv^Rrm#$gUF4mF(!l7d;6Ka9H<5D z8Q$G+55R*^C~APotkSL8IAh>DG&Qdoo>5Rgs5B;VH(d@{nGeCAO5*J%s-G_Ec z&}^N!f6uM;O2`(Ku`^5SHmQjl{iTKc_8HoFIzIp|x+<*OKhL-7o{d*jS$r@lAQX1% zwUGC#zLcG0C7gZKWUB{B!a!G3v&{41UBV{`onR#Kf=ClZ&(ftZ!|9&d5=1B3aw`!} zGVzo8jaXC^HfuN^#PBbSApKY9B2oA&7{(hp-Uy`;-%Jj21jL&uZg-m(U?>VnflF@jGzBymTgcwO9TXNT3k+`4AIEnY;8prwDX? zRUek~8|$HMulGmNM>HQ`^uwYl2k%ZX|CqdQx1BvH)L%v)Jo+6=E#m>Y4>Bd-&N9`6mM6{~ zhz>uZS77;)A>(0FACa)*RVTZFYLRjPs#6-%;mwk-{kc%wm467Bh`6GhK9Y{$3}%>l2{aH%a?C^vhY~! z+RdN&By?#t#{@y6>kqa?_|QNU;|?w>XV}&4Qm`xi>OXIqJT$Jme0# zY_WZMH~%Q^#N^TJ;ulq9VzBSCrKn5)WKQ+u@jH|Ads8}rN&0J*EWI_$R<`Y0+J(Pg zFJtb?ZO-Q@?NT3~w(09bzd!TxoZN6)-;7H%F$Scz*8*C18rGHjn|k8C=GMEC4G=Am z%NM8YHXtt(bN(T9*Hi=W3nSbuWLa;_MTn8w;MOxi{6VS7nEPewms;l9p5Pz5Q)Z-N zlP6jC#onbn;^if9#jeOf??qwY;;biX*(A8S8?e{IrP$PZGuGR6(6IlKSOo+%QoscD zRWZ9QEmFn4KzKcsnDO4G$*gzGjTwp-m=cBg5NrKdN-^J2ju~gpJoKVcxUpNQ4IcoF zm^c*>YBaRYZU^V>9;p8rL6QG6`>-WJzM$h(6x!~}@p}Vd1RnNH%kS){7jegeZrE(PW{lJv47V0{Z#34ETi^n%chApb^ib|DArP-~2TBhdBRkQ$Wf3J5g`k ziICtOlZlF=2QZU?VUKf2c6djLkO>Djzg7F++Ch{1K>s%XM>y;8F9|BEP@2=?Fhhd< zg7+FWeBUwV22B<|?G%+14aJZM%((4Omkboi zA!Eb++1bCV|6_2h`~lHqBFiJtJYAXjP->aE8udk{VJbt#uu;(4R*|Y-(6Au zQ_twf`!(C_r5ZjtRO|vGP?3jQw|m`l~dV zPlf*$_L!jz7B~H$UB%M&=(8hCP7jSBAr<3{)bv#M#H3f#e2Do33;X@z;(7P9)BKg@7h8mM z3r6WhdQ|PR&`lBayusqIYV{Tj~8$tBpNDZD=#`)n2ep5!KsV? z-QWO0($b<$i`>qLbe_M}@K?k5%Y`x;+&pdpLCt0@9$eeQQfTuMbrP;wHA*(>2^-CU!==CZ+Ocl`FkjV4h0(!vK&(o(; zj*(q&_aoIR!;t2i(|#5EDnoGnrR!9~^0)8nIyF`*{WkA*iu0Ym^9SM@|6Ldcj35o$ z$g?q#XLY@9-28pf)eDDKw*^utp7l_$dTg6^(ZiCr?P$+(sS;lwZhamQk&s^_P0z`>CvvFX*2j_(c|RPD#R;XKr0@%^oZTcX7Op%4{C%D8 z73>qd7G?(8-ug8_MNof*%kp;-z9I!_pv!J6WO5FS@E?@^430I?`3YD&?^Zho50wF| zf0?wnEs?-0e%Xhp%Wbl>1rQBP_iYIK9n8EWyo@?-d>t_ht81V0@!;Rsn18;2LEAy? zQ1`bd9YeIW%E0fozlo=9mY{?D48=n%LJ=7otfBjpMNwIHwR7(qCeSIy2>>;jqe?~Z z0jdtCs~yJ|V;Q!XuzOG}#G ziQB>LDc8%n)U_)!y0km!Zi(OJd)ERUH{yJg@M@r21Tv--`n+I zd#5el2Od;!@7w3sUf`k+BsnziJ>A?p)J+UBzI?RjYGaKf%dWo#o7&JAXK$ssJy4IJ z2Bj@Ox5r!`yrw)_7}?R-t1%0PkB7>JwWiB6*QhyGA^lPRfDYlDq8+A}scsSbqubH^ zPq*Vmz7U&djd0G&{*Vy{9vE5)}J!E`86L2oQaC^+kLj`yG+ z$K}0z+jN<}z%0}sLXJL^$;6S8NPiEww)sl=UFQeN+hZtlYuRj89|TBeaDhNUUFNS= zv%R)6NXDR;iSI@!tW)wFDaq`JZf8gbNdHK*hHP6O zARhgkCGpw%ar|VN%T|9izjOB+kurD8>nRonQ7 z<1g9njtlO(0$1#OWOu6)_BT;1O&-Fpa2|AB6GHUUXwqDf>?$*K>3=kIfXVzF!}L65 zJv}O+P%+EHA3nSR50^ZPq!fwMuMwkPZTS6?smxurWSZ#w0lHJAKVzV%oX0L1E}2{Z7Yi}AjGJbhxwVO?t9xq$Wa7HHFV!iXIih;6q_y5eHP2Tcq|q_+aL4oxH2+TCoeSY+}Th4)ck&CP|Hpz(72yttpN^` z^a3^wxEk1!;$~T(UhK<|y3C>l^!u$|z<+z)I@iK|bX2QngYJ@esb%#_Kpcg%HH94&@|Z=|@1 z8n)MDmWauGcY6aaQ?knK7UFjnJkPC~jt{yOlP*l0s_z^pZt)#0k6W4wgxfYpo0bsD zZ(da_)gG7nT><=OU(8ZFm*4;*osr+Fuzhd_pC`%JMs2AoA9S_f)|tF;S2g(!kNu=0%@Ey; zGy}2+E?;VV_OR+GTxL88SiO7Y6`i$-%2BmrZQ1Dcz&ULKy4MnSOd)-5U)F4r}OzFkF%($R?e_yUZ6MfjBoAYaf=P(FqNu}v%9r36^*Tn6t ztI%*!pDG7MaSpc&&@wATZ+88B9zzXY-XUG+Gw`RWf4mAKv%&Iq@Mj;@7f3-c(;WF0 zw@4IX#yQ;aZS~uj3Uj?k6?oo> zP)>4jXb=Jt>uoU8LUK+uay$f|%p6ftjRJjlh#N;@`6gQU@0J|x0=ja&md~0xl0@P@ zx)f)PoOoxZ=KA0MbelKUyv|tMj_DpN)Q*{`$8(v*9q{_LG4d|*8 zuW^nlDp%DJ`a+gzTRP?X-i9;@Fodn#CNws#zCSDL-k6kQ$xayefkKvXOe|8hEs#}Y z)~dF+2pVh;B7SN?kxb7Xz^0v#D#}zB>Ha2fsUw*ssYqx*fUJc#)0dAI|FIVNN<0RJ9i?#2Ak^uuA$Dt9r{9jh9U}w5+5@CuI7mO z-{udSe79mZ>yI~z34lgH^WR0cNui*`%UDAAQ1H}Z;X6N?dYyj3$+okvj7?0B>yI8H zd?C?+)4B(N5{py#xhG8B+e0W=h3`(f;+#d4o`jsL8|tj)9gAKj9f&K&5_y}WvpaA( zcyXQRxiszwtzERd9ws-{ST;4}xf;#VZ&H`KS;!3t8D%4xdne>|{a{o6ni{Z~fn_D6 zsmrBxAaptSE!HDm&9|N{zpnB%_A;>mv*3oqTo0bx5fly{1CdO`Qn$ox>JZ~5X;nD0 zDL87nEtd5qXAC%t`33Tq?A^TUBdu1OT~gAowe0D&adMy!|2YeGXp>t<=c}zz!ZeZ8 zu6&|R7;>qyu5(-bd97Fpfx_aTW>FpyT&wVP10>%(u zoW1-d+9`4%OZEWX)%AN0UTo@mk6l;4!?%UB?(t5E`K||JiP52rWDsWTO7IA+?%~rB zD&>z;mNdPSfj1A5{cQ~vSzI5VH#QnGl!Aq*(6a@Y*7%twms>VB;ON0q_Hl4!E^YTJ6-)DGEg5USkndF9Jp(@ zek~cYC7nx_xqf)k-h>fjHM>9&!Jg01v64F z3FG>s&5fn9)-Knfg1E55yG~8d15#Hl4OL8bhhPZ|50M9cyT+G=4Q>J~WMvf1Ga`rmMr=rg&XZiTP5EJDiS<8{dhiYUW17z=MFS@&44nIx z-fPV-dR*<dEt@L)3>2tOe zc?qeNkpUmTrWvleujE;Z{{m;dc(6PE?qrc|dA8wFCR4QzXVldRUPll8<8qpMho7~Tw8z#=S0)VH#vWhIyeIR&YiK%Xz<;P2;2MeA z1SFhy7U5H;x+gbqT?x@ustQ0p$t_I6zJCt7@sW=zP3k%)^4AjBK65m@NOGC2Vjw(bIcd|%_lXsDF z{F%=@+7x&cN2{}wf6tP)_qnedp3$4wA`qz`PC1kmio;B`>&4ohehdOxlCk@!^L97; zm)zYS>y`#bwmhhInpR$WYsi!O@;*forRK;SHYVkw2o$OG$`v<|dCqusT=x-ro+1R4 zzig^kb&UFy{_#r7+}uO^*}rV#;YiT>sX*8DfF#kfXEn1qd1EseQ`qrA-j)I3pdwE) zz4>N6%2<82j4u=J<;upZb@-mwQ=D24dsCm4&`p^9bFp;a2+imJKB=%rkp2S3o&r!Q zN*+gXb<=Z%mz{}4B~3lZb7J-uA0<;33Loa_sYtMM`E2S&DVlM&m1g)MF{Uckc_gk% zVtERyNIpN13b;t-2T@UO-YXSD+mMkcKT^xKVw{2Qu}$;9O{f|{Fd+ped4;Ttz8EpWVp!H};&H(GN33NP&G}abI z7ONGHiE5lrcd(D3jeL-N=O8*evMSD}gbWP1yRBmKB69yZTzKcSAjS$^D5hGkSnOx7 zJQDu~uZTkW2tWC~Row4HB5V5~(Fhu)2z1LKs0IuSmJ~X!-w@Yr-G~(kb*;)FU+E2m zgTJ>i7(maDtS!*fe&7AjJp$1|e5i2lc0kP0PKvi~0{TO} zkKZ`iam%$qpU$xSgwX9~Qdbkucb7=MdW-mN(${X1Hmp%YudNi;B(tWYT2wDoiXmxQ zy|hH(&f?`as7}V(3F+PPO(kOo8j{e(xEZN`6=KIv&DmO_L0nS#N~Xo^JuknNg7e0w z`htf>*8rMS@3}WE9?dDk(qW`3mh5qy`pzrxvPjt_!P3wKEb5O1MZO89+M`ju#sf0X zasAVP`&pf-!^L3CH>Go0#AQt0XfwUv?LvBq5Dw%pN^tqiloMCo3^~8 zPE7zfg+55^Ga3}#4MBEA9(Lc+=2w1PPU>7rHDvA}sERr7)N#XXIoCNS+5{9%0~}P4 z`A{nPkB8`^79_mg4UJJse2%}@y*|T9QyB{SokY&Cuv)J z>=47Hkh{GkFlCRs`)odhw>|y1JETcF=QA{7<4e5iF6UwmeHFm>xXMVyQ7m$G zqNDVSxMY3^$Kp(V?3cc;!CTVg#O<_|XYvT*y(ZJu2;>YI-(P0i?RItU67~&Du?D;> zG_lr77{4sOnGO1SZnw>9MGgepkY%v5cHYa?8rCCb^tJf$%>7#0IfxI-4TzBQXedXb zfV}Ns@&rCIwOAot@A6qvdl)=h$q&@i=HNPhc!3?+hGl7sD;5Ux0_8;}JrS)IcYe2v zND?c*^;^tiWlt4fyFnBiFl$u?9zR*VSSs|O8xgT`PnNOZSvL-sfq6~x4`W;EOe{HK z*}5O#`p|d^{b*Zu)hJa-B5SI344BA@2siaZoxVZob`U#L>gEBFKgpteC*X-Tz*OllrSaBSBQYU4AcGAviQ8 z9$VPru+rK=uVGYr-}X~O_l0;w^E@=Ffl~_NGAu%EoP$oSgo7^y(V8yBcPX@1+s;CB zVRtWxv$2+#4Q4U?9B)q7I#e%abREzex1lFnUM}mq{d@!Z`ZT zU18vd%0=Ic5sIATq~7={Z0~3WR+=s_N`xVW_)cDB2+B)TfvW!Em15ZzOkuJUZ?B=| z2&^;ZNb{VcOD2as%kyFp5u;NnckKfJ*4fW%k$S1ew z;HaB53|OiZ)~B`gPr&Q1xAVS~FGj?fRoxU7Ihp~q?5w0qQ!ky~)L?9H3(d%dN8d$i zmONG6_BZe>CbR7g-TwHsT)$rxcEyt;~wJy3w@P2b@tp4RDvk1*~P(KMz+r4#W$na}_216b4P!sXloa@8+9$n*+ zM0s7mlj^ahNI4K`{}Kcdbfs9f5if8eOM0@-BUpLkf`gqw2G_thT<&vS<{-IDB2d=r zdb~t{~s`d&;a*xiBD-sk!{59*{xKRJCi1m+WRS~b~EPR?K_uV13{aOu6v0$eX{bqYh-4q1!?i|TCZ8(551wkwq;aQu{!vL_4f$%cmI$ddHFUdtS3OH=Um-{XomUe_nK3o0kzW@l7 zq^hxOif!_()XGfcF!@K5`Lu0&0l&cyLEGUl@UAsKfcP`5!SHspmkeNhH;d+OsRl=r zcnop4Pu(-$3!Xy^~f`a7b>1w*I`^UHBF?F;@2^_m6Fp z2V3D>%+wS41n@Yc)E5zZ@7=Y{pAxmpf_!y2#acP8b17WhI~A58uLSNIX_7$fD>e6I z_Y>KA;zV{krv1Y)zQUVHsuzJvMNtYIO{1BoF=mOe7qiqCPHOL8nLby39j+;Pdsv(< zNU(vQ#I4=wAebn-ezz%CE}w}TmDOU|my)X2sn}Jiu4m(!xB+MW5z8It4KwJJe2IMJ zMmW7SC=WyoosT15z=LYiDs7=5L=bQAs}3EQE%+B?&sE4XDs()6x1sbd+oa~mZQ<|* zKU`mt@1#!#s-j2qU!;S;foxF{4-{q1U2&stM>JwA{Pn3KL&nkh#atJDK}Clb;ua)xI8kHC+lJh!6j~I61?1BdRa$lT$XdkFEdE zLkYBLPOo7Vp&*1!ah90o~p4;KVO<{RDDq=g=PY__q$32f+C?yb~f-j!D@ z!MVFU{T0StA7ah;iBfF{n8j+`PnLzgU3#}x?BDZk^&wzKUv5;C>H41abdewYJ_Sme zRAx)f%ugadw@S<^R?aawa-8BVe^4?v$lu6{-52aKDe>SeTkL>#T~v(utd(|Jn52ku z@K#MmSy2%xD{FcVBlG2LX(^Z#E2NTBHO^Y%jT*%zx4`+Yc+&fCj2U4f)wdW)$WbFK zgxa%nk2kz0A6>fB%=s)c%M@UHx+0c!sHS=ma2|;aX>H||zaCZ%NXL$F0o|>ZtWr|2 zKZT(4%;>o9otCz)zrzn$xJTq=oU0n=T>lhTSHUiC=ygDH4bgRYJ@v$Wma-3N73V!@ zq$l`)gq?L%99#Cbg9V4iT^e@}(lkzh1cC=ha0?LJ9fCv906~HWPjCnp+}(q_ySwG9 zzB6~`&irQPTdV(Q7S*S#t4JTMn0K#Q4&Krn$!7MiSpzA1WLyw}T@x8(As zA^Yd{kZ0VW>gv_1V;-H^+x8gdQ-;d*!U<#6Hr+-7L$K<5*aGHy?s1&eE1B-`>4AHp zebtrF(2nco5F;?Q>Qt(UDS$7UuIN-4l8F~GoD-M{C32S&E>oB{%Huy;?#q@q7EO=6 zL>JqB zptlfkZmhmIKMt{|y!m&~%sa8Sd-Xd~E#h$nidnty{oo!cKwc!OJt-rd4R_P$J!Qj05qM=w80VmX+J zlRHm_x&n;6#N6g&=rpC;YtUySo=rPfRLWy$Rprz9;z+TOAWpiwSE3BUzpYz zv#K!GgPUW6`s~=Y5X%QLiL5rMF%}C^oMZbe z!NgjrA~-G7)l6wVf#uG&`i10nx!T?@Y>`+uBntw0@6PY)zSx&Pzn=CpuK(Kgp@8O1 z7=;O%Pe=B$T5{GDX%gqjqcn#2y~cO8$P4(n@<^T569LE$zMs1UZ(Qtx9j3imW z^vjl$mV)xzwd>3(6SaAT8wM*EeA-16d((BuW%vD5`3?04_{X}M2~&2OJ~YC-6DttP z(I;Bjr{TYz6Y27Smg`DVupM3&0wW-%-;)bm%U_ZhBSVHeQl5j3GWvdepU3;pa@)Bl26mBfMyuB28sHNRZR;Q6^SVx>&kfDA z)0Z6j*;`Lz8m0kC0fq3L%dwh9azg*@;C_-Y5HxlIU3k2LGE)Wq1Sal~qlAm|5tX%5 zbt}5vSkcMCMW^vs0ZkN26de3m8xBi6hgR|ZYWLi#(eQq`dQxUSLSvG-{pZ>}KehS* zo#EEoe$GTU@5RWPi7z}iWlI;1VF#}E{Rb5x+T}-j&+u2*J9$!zxSh>(8%W(Ye%PqK zN1KlG$sf~{ZB7ZCXxu~VbuVWOADEjo>c-{$Dq)p@CwKQ|k$o48|=e;D|^5qD%(;ywGV* zIJ^4#W2IWp^?-DEruXKD>tdlj=XhreYl(Ah3Q{Xw0~+KcDg7dz1sg8FF5-%h%&r4-~!5R?a;lZ z1er9CF!iUx0V1|@aoT%M$vmB<`180*6{!txu}>{ghN5@Y($JM1!E z$=Y)w36_ZT{r6Ia+Y3Ky_GW*44>)frRWRBMKW0lGv$O#(z)}EZ0c6>w<8cN4m)_+U(+$!DgRq3Z~)S&78VPcqs+A3sgi_E-K(!cW*ObR#gL}G31j@;BdOs zRq_T@fh2B1g_uFh6M>=9Vq|xB0APef5j!XjdgqcE0KjnS40$7d9yQIC_ZPic+4nIEJAsZ&F-@Fa%CgmOGAkZ zyT5q6GQG7H>V?`Z)m(LD#fi3->UWf$QQp=1c^>T$o{x7?UIlh8li4a(m@ziLs6VVL6*i1+GHh(hU-FtuTS2A9b3xYiE>v`RGiIM5no{qx z^~>a%=!#I|1gpSJC(&*2*4a)p1lJS^BX4^cY|$0_|B{QcNZv0XfW&$Dr;*DSxi zu~qLj2E)zYzQE;Q(~vJKbb2u?wTp8mHK`)4mWOdG#Y>DoF5go zN^!LQk=0K1vTgQjcl{3+gUuC5J;Pg@-TJt@4DS-M`J-h6Yk}Qt?!&+=O$M^6WtW^9 z4bxYx=ZBSEWUS{4bC~BFRoOKR-V<9}$y0j6tP)8ji|(UXY8*WG`fl9|y$b==i#$S{ z>pAgICi+2&E!!;*S8dkbqhcVF3Ck?jd|JvSWgSo}ZQ`H6NnX`?NzQu{x2MPLUKT)w zNaD1BiMmoht9MricXzO+CFNMPL~PnZph=I&x<^7;Gkyu)R<)B){Om-!>u)(*sxSp| ziZR`v42nJW*T){8tjLxUPaDLac7@tws&q3D0}LVTt2c5}E|t%kjoYG~53Jtr0R$vm z-}0OQ!KzE@#p5=9My}t2U6u=3F+8{PtnfAUD5gEo%KmRc`lZs9Lzs!p1p4GHS`Mq@S4&TPac_$ z<2%eZP{hqXN4NB&Zv1agk0PS^Qc+~~LG_OJ21a(>-E&Wa+m{S%5eB{IMc_kjx3DOF zw_}5v4qSP}e&M#DZgJ`+YTp^>&lPR)I#0iir9>ljV_w&6Bxpl?7%;XM9fzxYz*pr= z9kCewYO9K(BN{24P>YsbEY-M+^N5CZT_+J2Yg1#)bh9x|`$WRYM0xb1E_>sU87=Cm zG5Pk6!xwX=iMoXEvNLVF5V^+nU)4MBZC-<|u-Z5i+(>Fw$BFJVnYT>!r8v{d_zJsi zJ_K>pre1z8FJZpd+SNS>D-sd-Qn99Ax7y}mGnMLAwCC8t?WaI?cH>qv-iu)A-hBR* zVqWO(NO#Yt&Sqe5YNURSNf+mnsrvy}lbUH$B5l4mRG=%e;_8>D zvkXnp8HmSxhXdOyMRA$b+Ns0CiNZ)VvxFM$Ci zO+$E(Q}p&foJr!y)RbO^8P7&bmH<=1o)ToJ*tMnAuWaK^c(+adJ(7e+iO5N{0$t)LIPJbZvEj~>{?;%XDT>3&PlKj zAPsAe1_9>I5w2sCEDD!t!^5g^MaP;YQBxPxfX^|yzo=vMx#0*iwC_pO`x&%u30`iR zo@MI*c!EZUn-HDFU)vCp<` zm~_^2IC-l#wz9Ag_iR|-!7pW0`(={d5?!O^!FhV!5Iuh)?lD>iHsia1p7?W zrN{fg?pqhCC654kPKfPMcee(6ekW&>?bd$5jQ7UpeID|wLlNt9F(2jk4Q12*7~$nC zA)E!O50fNd>91(j7#?!c|80^ zi}geMSszn^W%oh3cBI_^_`2DB;j@i~?Hfb*R&seAjn%u<=1ul}YB$j2tu_!e2gqGV zPxO5%JK-#ci8z`CLDrXxV!!V#^LtM&$B`jyg5zU`elAS|dMd^ti%wf76?Y+wrPhna zjV6(8>zfmC=bk5LMrWB5e7qMo4=KTQHmoj@0oYsX7kEV2il;njnw?$TB?7A+)L7Fp zuWo`5A!q6#&vf7NY{1#nJLyb#JKepCf)3H?CLXRY{&Y{8qob*l?__`MT620+>)iV5 zUXBWrOy+Eyj&$;6jP*N`kcyUBR)z6Uq*Jyp06j-KwYmyZSh@ z6(_U!WsN%~B`VT16NKEAsBWzxJ;<{hfsXi_ zqtzrIfvIO2#y8j-)yyo+Qw8#9b4vh6E*Y z>gIMx9ZgWdXUj%oO@6u{^7s0KzNt9iOUg7sZwPE6ou7$M$_=LG5 zGFPd4S0?MnW^W*2$R~nWa0l2b8oeUb=p;F1q_%#AiVHbaC5`lp2vm~deETX` z^R`BlptJg&dUL}SR?Y7lKm${%@Fp%SKU{I)vEj@3Yu?ZG@7WL^eQwL&N_^M(UqR-b@f7UvZ}H!mI_eBkbWL@8?H_vX&X8)6|2V^1sRvr5 zm8dUZLR2qdVG+hB`G{qrrbk$(x{MQg zUcN`L2oF;dEzA+z3jdy-7$u&yk(C5`OSq)!_p*wtq6dqR-`D6zU80OHpx8j+WQe*_vqh_lt!+M&F4g*=F50|5hn zxJI~31NlMUg+uE}%-F1UGGB%|N-X!Oyggq2_5DEVdLt<`yXwMaG_M)0|Hf22D+gC(h>j0SrJdeF@Fa5 z*#z8A*CC$jVU$2{mgqAvd*_S)aS4Gg@f{HC3=Z;*E6{sp68%d@`?Hh&gX5x)=mV&e z=sqO;e!R1F$ogNWO^pb2Q|pf^GdJ1OfR>i}pS|l}{_rCOXvp@te>ju=i&F+@iPSHF z{cTmjHVTWw{}~$o+MI$^<_4gj5;%Bi_CJqPhgs@aAfEU_|MkRx%{Lx!3yZ@-O8)&a z{Mi|R-z5H=HuDwt|GyKE-8d8<#dCdqtfO_ zh}&d|?$4*KCxBYn1z6xzrZ^4>Sq63AMlB0HoR9xZe)pv?Q~D9$ua>+@;fHxLiZ(l>)>&LiN|lB^rLvR<(P+?831PZ+zyrSQ&g9n$*fVu&SQ;o;%{p}Z-$r43`FVcdQLa{yg%0dN)>*X%mwIGzKW0Aab-p=oX5EyYC%YhADZuZYzW^XkI?VvW^014{ z7K4sRfKbOyqUNaSt{xT!g)062gbW;A+^(Oamak|tEOO-p2-|(BR{%(E-iM6FsTy1T z8sOYR`n~LL_A7_yN3x_SWCJUH0Aa|VLutYxdy>ClywYW4ACejQ14-P6KpR-5JP!klVbR!P_hksQq1$mvqC(KG1G@H|1c&X| zVi;4PUqHwyTpLL4uW80P&U>Ga%Jx1>yLzqhhJN`1nErlUi{i>Y1|AXA0Om0-YJ>w4 z;$ooVk@UWCR2#sVA4{_YobBtBA|CPVsZOZ{anvFFGbVAzC~VXSz|JS6YP>?vjK$W# z3t$&dp=|+3RY!o({OS+}F+6NT=X8Q0S^>`HD+e)AApin94^V80mR=4OM~DGQwL<_< zf=X8TJJAfjfkrSvewchV>7@L;IFb2Pqcg{NTBe#0WI&(qAZlT=6v15Qh&+yf4= z;DRxRBjC}@T8LiLlM^BQIrUeI^*2nvR6>u4*{l5--WPa%%o_Xv>{!pCw7f_Gu$vL| zKxI~cI`0w6kwFrV8qT5uI_6yFtfk1o^kvg5ugeUUk$2+4M%sUebJR1rVQauxyD&5} zf)E_Z7@$L~(9#DD(MCgY?@Ku)OVuMjdSk=i0QU@&FjA}O1IfoLfPO|=M6j){2TU(3 z3|9g213=i4*B$!iGJmWsG^%Nu*zkEqdMZaOC?Ny_w9Wwp9cWyZGS;ZU@{0 z&&i(uYob7vl3F&PW5YJG==PbkFSqs&YL;AJIMh&VX=4t*o|e7~pdAI2)+F&}VBg%v z8`=#>Jlj-C0E^UOj7-mI)rg^#2H<`mjUK>_O3~`kwQEH}^&DewaZV}Bg$3vD6v)Xhvy6hJ!^-F!|!#zhZ7P7sJr~Sn*&5$E9Bhcwb z9_gQ|Oe?W&lj4jRUt-?%3334!&XgJvuLmpKWM-RDJTJ0Swj2D4)fq8_x5D)b8J9ke$CAP%j|GR*N2Yc!rm#G|r)m`T8ySW^&lbwN8 zj4;F^MqUfopHb2b={pY!1{=FjH_a3I8X)#9?8LRL1v=t$KL=F9Na6etL#?j|hwNik z??DtktMap9TQHV-HDGLvLDuq+Xp32bA>hl#1a}Lv=K-`WnX8>4B~T)O8F~d>#a& zkF~K=b*qw(ar*I}d>(F*e9H{7jc+$oY@ZIa53>2jJXu#_@G}qCmI@^^-2won&Y+lh z)Kf&&q#XmTm{Fmp2=kvp)-iKlLL)K7IDr8<2ahBKom;|fJ^PJ4mxwiBGhLzF_!W45 z!Va1Q78ZCm0SIZTp+Bo~*8!w5?)*rdKOH?~Oc^<&LXxsE=t)St1*GO$iloYxkS6Fh z$mz6L9Ct-FwF{&i=6h{?L8K>sEcq@b(I9~S2$;9X`;d0TTl}hu07Cc5m(xL^G?PA- z0OWPvjoDqO-87Kzl1hGRe5i&jfx9v!M+?ma@b8cJ?LzZ@-Yg2E3K9w<}k0RiA0n@vL*Hv<*1#Jqv|=EAG?9ewSi)x z45v>VD8N*O{RL7OjE82H`31JCr+(T^`gsR$8wW&ol}_<#p6N~cdqf?@yM`hU7iJXS zo1qhl!N}Cgj4?#D`8NF~$u=6JIpNR_k;zwHzn9+*?KH1{^0wWE^IFQG=x3olugDE^ zz&@O?_X?nbW#TN0LvlBr5j@{}9y|vd9kM zj`1~G)B?&JDm|zfiYRH0p+tC#ehSo)PU)ev6ta+~Oa(g8XN0UydF}#flx;yVYqH%@ z=ehI@{8&JB0CAtuUTM_oC=3c@dCx43Fx)?n?RATO38 z3c==A2(NTC65EDKKA9E)n#!Ve-p&dMc2zDwO^FgnqvPUf^^bHr#=4Pw9OafB6$2>$ z0leXi_PM-1EpW(zSh+zKKA#@7R0?F(H3bLgTCCsEX@_u~UW*R#w zv(Tv(C@*^CdWXhCQAnmePlw8N$y}4`Sqy`ybrPqUMJ-? zlCG`ZX_zd`R+y>(P%CoWg3vB3n5SkFD3tIHWT=qU@r9dEPQQsr4jx5h%%7fa1IHiq zT@()mb5#bJ6#kOfn)zDS1SY_Y`u(NVK&@`@LSe>rD@~Y1>6$RNtOcGE1SW& zFnb_cN46|@q;e-@S;AdlCAC&XA4hX&Cn;8@kL$>veVpfo*b>STf;4!zm-Bx4?kiNK zJNdU)_5{*35}cH-)K-eeM~kW2HSg0871#;T{IdqYO{k3@XIyeBGhY~vvrEw@=5NZK zL$U)8i>)c1-BN1pM^t|CF3am$M4SGsG02$sDj`GTwcukTV8xK)k;zvkGe)1H0f}M>-X!NmiOa{@oPK0$a??e`vA_!H zyB1di(=?vI3(_TWXHwJ9EdzAF6jq(n&knK_vJEc~5YgOLwoTFH>GsJIspk&ZM)Li?eK8Hp3qV*b1Yu#@t&VI%?$qKf2J1{Pt* zkbO4=(L5$G7xlbUZzTJWB4j6Ld5G;tFg6t>Tgmo-0bGEQt!1hNHBI#+LB|tB%p{W5 zc1O7(DJ&s6r})x~y#cURmxRBONC>XNRy0;1DjJkRjIA@NPjV|A%4f;jgII*zmD~=j)SwYurn2Z~jK}t|Q0-sLjtd-lBj6AX<+tR57&%$( zSf$WocObjJ><;##Rdkx)36!O6jeua386`$oNN3}+TjW(tBwU76#t zjGPvkrhez%R%e*bpmie(l6x6gw)%r%M;ezC(VtB%JtV~Ro;JcLuhk!OGCQ8Lk7G(} z-JY(|K)z8@Pr3UzEy=m`jU0~mE@9y9*lEy_UqfIIR~9s;8-*}1-cKR+d&7yf_&jwy z(kYH5*Hd-snEE@3C#(W8i|^2Ay`vkhYyd##dHb7lY#f^S*6)C$@4@fVi(=eCKH<*4eK;@Imf0K$A-mXebyo5w|G7#?dg2n z+kSe|LfQM;Gu34WN#7|e{fJo48jMrkokR#Gs7Ak;hWv$&lKBN>{yM6MR47=VX))q< zocZ~iaN#qi<51?^)bTKB<;&|)xH_PuL%YZ$^|aOOdk4o|)bXk7lhh%aKx7JCIZ4QK zCk$hWut1ZqYltr-?x}HAo*0LX<1G!lD3VfVZWoM8RAUL#5v9Eg7fbVCGX{~F${6x* z;C<}}KS&f^t1PwXNr;^h*b8xk z(myPUeKN|a1q4y&ALIdYcqh*&JDcfzl8 zCL~%Z8?Cd8N}<7c8d(9zO-{$u@4y#KmR^o1h;$o$fzSZr93AbMyft(obU3(Pg9L3a z?1u1*fKQGJGkI2$>EeoNQ5D5&#J=(!*xV69`4KThPA%I7-Tt0UuV^dWY?fs9OGJkX z%~r9Dnz*Q^BJMLQU)^K|^tsBuVNoxjVpalND3lvylGv)f9X-$zFnIOU%I1{f1=U8# z)sA|crkADyW7q7|?yA>gPKMfLfoq|e)km<#I|k5W%+hlERc{Rio<~E7G9ehd0D*cT z(rt@mJ?&SdR{&6Z!_F?cSz(SfUu!{DPzzg-K+FXGja$bG)8Kzgz%sa@zD3eAwT&qafTTsm)u~#HV zZ>G?A7@F#rML#>VD|*ARoC6?U#N<=d+9^lOq)y1+61I zp6FA3^Xr*1#xzjb07~Y8Nm;POlu@UgmZiR1hC|?VrCk=Fjr~V>k`DoKS7CdUIqWl2 zp5|!b^ON8h3Hxlvk0YqBT#Yb{_cFiobs;|4N}l}K<{xPmg9(*I-H;7=>K~x^68ex} zN6lK6Dse-r=ft!f+LdDr5g}~0l3j)SB*&NW5YDj5wf*^(lr#_v)jrS5J_^JE zY$p7L^O!3Qppw%?0;c1x?Sr_#x7YD(A^ciYMsU(~#DaDPNsBM@f0Z$!Kq_KL-@THZ z2k$Z+aWjY0o3SZ0M&@sv4xpI!Nbx^#wNjOoe`s6!ZFU50*=H!>_i}06TSV_dGA@g> zcq+w|m$C@<8!`m$f2YRc|yOwbX6D zcb?<7y%{>&*R$XwjnsRQooqW40YY9_gHIT6?s*o9?y-)!0@)SXlyp(g6vyvcT`Yl; zxz*oz4>q=BELEmA2VXmL^QMTCSqt8tJdl<}Wp-8$owbY@BBD$a80AoSQ_gf}XmaB1 z#lc-+Z|zu&8ORQt+-1c;yVq(3ay@k_L|7(o$qOF)y$?1}>>s>Dl$wV44}FPjYpIS6 zx&p9H(mfN!g1Hb>#d-E@&2R@u8!WnqcZ{~Va{734aR#>4p^C7S zX~!8w&O*jP%a#~)&IL!fGHe>@YlS_~`i3gZBco^y^d{2fjV#+cW-%4EimxqpHq_d6 zHm-erLIsjozsOQ_JK5+*$3!AJJMJ)YbFOL)Fe8+Lt3%FC$4o!cY34IO@o72cp(zzD zO5j3NosN|~#0%CRrKX`uWt^G|ky(8ca7_3N>dZBiY)Lf8I&97-ipdrzuLXY6lHOpy zWM3>~){G6>K6Y@5R*vyl+Vj7m5IKFq}j^4s+9WM1P@nrrY zW1Y~8w`f63$wqvorEced!((-SqR*$q_p&a5PhlqUj6;27t!br!IT8A5tMA#_ov6qD zEXNwS+fH|^5wM81Kf7>0J#}}mS14h>dU7RKRoQXWS}+ooPw6kT0dESwQJiQIZ#&BK zbL31yFc+hnEOIMmi?Z}hAMGOdqP?oQ$BEng+A%|hJx+u}nsumrP(%Lx+gom?Ev7T( zfN3i5GaKj;hu$rJpmh2(Xul&xqFLHq&(>`KGUd;C`4h(#p^ceM3W;vy;pC-Kl~TE3 zDeuR&4_>NzcG&9>Mlp^Jjq^pL-?cqk_Te||Irr=gjYeymo|kJozj7bj8s+QM<-Efz z*RL3l#QNm=?(4}juHY`{`rw+W3O!fKiHfnihJ`E^gwfsgRm4^vR*yy{`^t0p2pHgL zsQ>;N{4Aa<@MZ4|(L8>n=j+$aMKX1a6G8)Gl6Ewb)92)*p?t^JQng>f{)rS)kJE`= z$o=+G(6+ls!w>2pi=46Jyw<=vWJF9>mhzm9HhLN)Uv(Yt5=Nq5tKBETB#}^3FODI1 z=uki@x*od-ggP&WvzhtYy-J)vP$#BU{%;MwMPTG2>bjM1QvVv*(%Pfvk3 zE^Y@Ol!y3f*SuQC9h9DpTRH-)Cz|+rx{&a9QlQWI_GqhRz=Du1OTSw)_dKBzVF`gk zp@QSX^;=VLFe3^LO4o(i^*1savNoooq~9@~h|#i$R1uEhWbXFHRFCsXR9N;T!wL*j zvR*XS5$-=vH-hd4FzvsH322R=bX#JceASY`&P(NFQxra^qBg1%^fzyP=;AVts3XRi z1Q~!@E!M}xjkT!vlLLmfiqG%sGDEKYlob*B&OU;0FFICyOx-vm@3W&IEc5N5IrB5%!*aI^R; z`HIjxszVW?tFLzxF3G1v64A!T&T>N}O78}?#0Nj~FKW-@#gB7rt4yje7>-tax(hn} za1C<+y4gI;Fju99ZXu;RX~kee@M^CXdepp$DaTXs(kmM@-Kv>5nLnSq;Ts-e4#O=0W|Z8)YX&cdF^|{|RTj15o1qBg z$ls5^hfqAIJ`{Q0wQOUN8e6Nx5e-N6w;<OAV(A=?Gn8YTN^iT zWknwrBYn-sb4}|_dV-?nl_tQ#bA4hit=vkFDUFqh;F>N4Ly0*p2~x9^YgSz}YMtsuseo-iSlJVyy3R)#}gb|WeE4z93n z`n~b7U3TlCV}<>zg2AW3vZM+wid`APrq`6gAwTPNSswr9@aHnbREG>Ovc zr%J)3XA%VIs6;ZyE#X7lGPgQpZFR^vWai6;DAI0wHxHEXXZLGDk!0>+q%`D?*W9HE zyvvVmWbs}jT&~9Y>B5K3h)A{tpYjWc4AiT_DLGS6R(GbhI3ta;jJbl4u1b~Ql>`^X zLv1-iJ(6X-4r^+`5wQ#u1jJvlcN~UQhU_96D#0x8aT7gbwy3(A#D+h4zI~qYVs)yM z$?^IFR(kq+q}XX+BcX4J0|leUfsWm|W7J`{;{b0P@4gY-hK5(Ii&KV9e*@LBv{@+n z0{K;p6xIt*fz8?G7;C4%kr)2g;_fS5jY^B!ymm^e0Gv`+@w_A?6Y)g zvw@u*k*Tl@)#>PUR(wovu>`Hmbeg5h`s%F>Cs5VI+&fSay?rE%)yuMnMgx6%Y%M*j z@)H(&p2P=<>RWjZ>|c_5^5k)z3w!G8pHE}%0$e3a)@1Xs!D$7pU!0C7FNPGx^7P{9 zAhK7l-fkveaq6Gx<&g^l2~NB{yBBw?3V*IY#1Y@3`NhVEDj#4T-$Iz7%mpSYCwVlo zw86n#pE(3bZqS9K~H85^#TL`!U69;s}P0Bc+F9YH8iA9uwez>MBO&7&j4%(8fDyI;!u}(Ot zqHETX6-&r(7ix*Le5+}b{_cKi7~LLGf-^nD?cQrIG;p5LM}IS1zsE&T2Po*dQoq)# zp&jtdeT|d>)n?Rb1>UoxW7``)QZ1u@9-(Z_oq7Fn^=9KO0d9@x>5IkPJIZyEY@IBO z)i(oX@mV@}hia$r2z~H}KO`f0KAAOTg@`x|t9DW6Fo?_rZPtvqkw-gbD-5{W62&r1 zk)4pO;4KC%nsv@I>L@|mr$bg&;&<#>H$@1R1g7fG`dq9XC=y*cuPFTAoO`D@L8IC| zv!@+$h@)O~ze1CTFd{aZsZ!NSHnhhjZ-rZ`Y+oos6syaO`t+5uMTPLs_S@mUzXHO? z-l%Y7tzOL!m*^V^3bDHe&LW~$th+esGy@Ln#?f?1Zw<#fh=svgxVNU$_ z&;Gf1p#h=Djf_YB!`sQ>i{kRQX#OhDVQ zlls{i@M$)FMfx9y=E)k&R$1&Qe3tpu=u|-X_ie#H_6L7?^M%fD?Ay0*49VQ4FaP=Y z{`&_q8Q@Soo+UF$|JOslu=)9i%xkEtZ?BQOy5wOo2CkMfSXo!s8l8}>z!}#|CzLN1 zgL7NRag)wkH3@c8`P|{<6WCr9{Z`o=OcSo@-O?w)2RgwFB2)Og;q)}O*ud^RvmzqZ zt$vNB6YgHOFJZ`we%92p$N=bH zp|d|MHHCL_;);MucR~B#1YtLCBnNdK$dg|JDvQ9rH$YA9{Uqb4az6y*Ss;adM|!hp z94%s%9m)SP#1{}_y8x`=kdKBhUW64_4ne8`IYwShrQP7OscE44uraKbvP`W8>_TON zQAd^sG@^>jyGUICxV#y8`UOD#GYtgF(3xHWn3mu&pqy^tEmbpsPs@NYQ?usTSXnCr zupm7!e_4e04;okxjg(jh%FmXH0P+)9l+T3x5P%d{13CO2AYTj3o^OlY_3CG@(dqI5 z2#DAxcJH!mYJeh=(?C^JBS0AP<9kUx3kqT&HkIgnl;CRU-0n8lSUKEDYd?m6L~x0AZt;Pl=3$$xFDCvgPS+2kTE?xyrCVy_(FaRC4< z(-f|-GGQ)SLjxMhWSv)t2m4|We5F_`VDqqDy0+BSL1!&l| zwDI!GV20Qd3=wi}U-8Sk;xow(g&KO@uDb8zSwh&Q4R&oz(NM%4)JGgHaD0FS94)5+qy{#g1Dha*^Fny>$z3vWbvQFfaA%G00Yze^I ze!c|l&s3T*X;Qhb;{Yke?l#c|aTo}UOvJ-UYf20@Rx!nkS35*NNYikJMemAMlF2Wi zmsO4Jeh!7k-BDQ;yJ=YQ@-VYS8m^O;o9-#Be)W#(q#>UZpyXMg-u^^M3uSV(tzCJV z?H~`CVBJyw1Y1jsa|1fw1IuigNHmIk!HilJ#fN<}vC6)_m!7L(j8MUNk(phu9l1gz zL_z2+Q^r@levI)>?dXaKhw!IRJx@23F+cg_E;}8Wa&{nr&JW! z(ifA>f#fVGDWAFW@oF}u^vx=5^X|8_hY@GeVQZ5#`|iU$1ui7AZ#16;e$xWgcEmQx zt^w7UHEgOjqQZow=3|-un3Bv@5s7Jnl|u}!y2T#3@q2*z*Hwnnwr+zk`w1nG?UoT_ zZFr(n1n9huBxeMTyCOhG0L2(9@{Nc4LV?a{$g(VWSbiB8+cF+5Ynp!mV!y@d#Kcx0 zyH3#nmwfo)Dfc4RA750!?&l^HoR4NY2`I~Ke?ML|2QX4mwyI>~yrlR;yt9GV*zLqI zl4MGj&Kj>B|3=S76+0)wcpKG}h>}nEur^y4kP2lD$-R+TOZ>>cL8gX3Vm##YN83!n z;y~8k8t5@KFm;%*0E8K32|z0IwxJiEmA3g$uaLp&^X_6-U-pwtI%@`jllQyc4#YTY5 zV4@JFf@IogJzWngm`s4HRL@IPL@D5$N&Cbuizso8mK0Ye`^zE)%LfcN2BjBg2JUZR z0}jYf2Qjv<99A=U;K2!yg9bArfL4GJ;I|1~z!hbB*8pby&1Oo-Efo#rXSF~`A9J7h zuJ@?JxQG@|37b4Pe??cpG}+AwWesN#%4?Qt9}MGON37b}wnSiyWH)-_e#Sl0R-B7H)A!ZKz~z_KC&UgBEqZhB`| z6ET6(PjXlE#(}6*?M7BW1K{|KB)bET6lpd-u}3&}-{;HpVcrIq)j3K9LPwmSPh~3g zMyD)112OVNysQ9JE|x`4eQZ9-3@JJhsHVw!-l2M8oD}rOCgBS%9BEM;!z(mL$&0-y zPW6Fp-K;hLiW69kUL^Lp*oYTO%q_{m20)E^EIn5@Zna170QVKX#i&-^$!;9uofiu^ z0vwl(8|K)E={1LMZ3M4S;~x!wq>oXLQemjO;&R*?b;~`YdGEy*nhrdW?M&lL(SV3A zcf@^#0u#f!4v<@p>z}6lQ-q+`NG3E4^p^?!E7H&I&IdA`W)W@Dd82D)iD4 zr4bEQ?ndEgfaB&QYY+`wrmCq=z|1`-UFRYF9&z_PGUtP_Te2qn40d@GpLvTBtc-Y) za=K(Rw#D*k&*R?)fcJ=YL3w^3sYAGlm?Bj;ok(8t3vQU=KHHS81GF(xptww$Cp7!u zdhP-L6#_5jtL^OQYCzdH#y@Qkpj<`;sBuS495{F*BJ1w19oAt$CJ(#S_7w+)%t%IewV(0VIpyMvTf$#KlJ;AeJ4>!NOt+p+WWHEHx36gMbcyr9Tu?g94aOdY$~ zR!r@}f&MHhqj7-hvoyF)F*Kl?vc1P^n_bEhkUb7@4WrGG_)8deo3*LXF=GG>cx3+G zKW^L$oXoAyil~7?EOzm4P|R&moG^kSN%dG2d%yLw?^Gj~CaX-J=%@&>4~wy&u0{+T+p(g^91>_5hR4 zXY@eGtf63`;R|OLa;}o*$6Keg_rPKlBQ58}jz{ux^Mwk3d`^R?>P6vh&YEc;w`h{# zkMn6Gd~>gj%c6($gAjw{lOqAB+Q$R?i+wf9F)6hS zQ;ImYH43R@R_@^!dz!%NRur|CQE%*+OAITUmx*>QjUZk{p|`DLNRRu%`}9HeXnooV zcMXRY57t~4jj~)?G|xwDZLU-f%^NMN^k1SJ2}!Hr;tzOCIfrT~*{Y0R7dG3i!e3-h zSNQSMT<}D_F3ThujzRbE%FPxLcE&W_M z{(t`j%`t*s1EmL0nK@1CpOLqJ+b{xK5o$k}c*<;71-r3Ahx@2*i_$n&c@t;aF1M+A z^tcIpyKLB4tTr{E1W1cFr{2B(RlQnpV6_|?=}4dAs%^0=Me(=i)f`^I1M0Be!-cFa zMJ2xj+oOsb<1VvS-yJpk8dIuv z{kSPq&|yE|KfXrVP~%@~Xz=$jAC~R&bm?ai5+H58R-b*%*_=>rxpa8|fQuE&P@@+U zaP;(9&tATdl36@#882$^?!JWtj=}oqe|-6UMUDTQknq+x%;WjiVK)Wj^N;cn0m|3L zSM=yxGqXP_HE0`3;Lz0^;SO&eiAZ{@UfIv)8HGI@Jz4_m4qfIKgXpyy2za3 z5@7i2MH26)Rz4>8cy;2`Kj&I;h!D&tH`&E5P$g48fIXe7^qX|$AV` zq*J<6TBJ)ry8F`7NTZ~52q@Bxl(f{ngtT->ch|SC@AuyG)&CoV;W*0moO5@qy<)C8 zlhP#@UZ$Vk47T3euSX(^58XA4*LXYQHU2n(p?}O>Ie5wHsrjCc9|4x*r*O@a%0d;M zCsZBHSVZIVZsqJPYjs&sal>&LM|l4}Om$dh6+8!P@qO{-$7km$N((QGQiNu3RY&BX zZ_Z>kILmv@KC~#$^ENJ?adqa%&sa*XLocm;zeHf~b9@;*Le04WIheyU39$U>QNV5M z-+nUe@4kF29N}R_vMGf??_`yTVePc}S!W(Ec;EN>tl%rxlcS{tMm26)PBZQ$x07QO z>$$0<(>M90mz!1JH`dGKnA_0srDJ|U2z|wZ$2Bp za8ZjRX=uu|_NL~3*@wsl|-)gGUQiN)P_ke83(ebF4=ha@_Un78gN`BxD;qDF{Q; z@QOVoV9UyQ$aG;<7Lk1AB{@~Dt~EWfKEXr9(AdKNdQ8?;=cSr1$;{M?_4SLr#MtPu z4_^k=TmE%>Fb2O0nyN~%9G{2geA1O#D8}S-EffqC?;$j8e!Q+J*5%gpu8d_Nv8RHr zl>WS;e6Y;n{9x%?OVxP6^Ck}!_Fei%kKS{=Y$d_2qLu!~)ch9iMQ2o36u*j`d3YC9 z%VYn}*HILnXQ`ZrvIU`ix`|ZoUy}98k6bLxq2VXmYJH{OtrR3RoZde?yoqDg@A~$c zo7VmB!&&k4z}nOfHI*Kz?k6w0&9P2=SSgcdv+a)k$KGikq{^VEmW^tNWI!N59GN)W z2|qm3B2ZQ}_Gk-eLARdJ=p5D;^w|FT*=oAic3;A>Y_fQ@>P?^75R>IqmG(2^>L$)F zjdNkll@$x7jkc+VWUe2KpK-dZ^VlUuOf5wd&fWW`MKJr0c%U3U;&thKRQO7GGPYW` zxXRknId^^AQMB;L@-ZJ{(phR>bWVjjhLcQ*Z?Kl>*S8M&)(7d?8*PV*|M9(r_oJvzqH`=Z!kMVNX1gVVVjSp5XJ3O3wT$VC{0#{o| z1asf{DykWSF#3?giugSiKB#Ff?yQbKTH>nxrNjcPT0)+gy8I zzYV|iX3a?7ES=8?FR`LWF@=_>Z`JWnF7pN#*Dm;ucr{1!=4Jn5O=Z+#(H1=ID}Dq& z?tdohCSvh~Hryw@FTRt3j^~zop z^`)Ju@+!77IBA;jtix0dU$FM#0N3UhQ>KOD%d)7Z=U%wvu+9%plw=%Y;NHs8($4gYQelFX!9KE2(v@)q*jl`LN z_P31QADf;rQdqNy9rThlYycv?YUOOnage8Skod;+`}yXJ?`w0ZUeOm-Pm62eqHN(U zT5v^I!+-dGF~WWGT%|cmmQ3i{_Izz~#WFzZmdSfTJqP`Sr7RIH3;)fH9~A!VEfqhL zh<`ki5_W)`Q9VF$4Vo1Qd37@5RbccSSna>f8$276()?q(;a(`e)q-w#lMa{B?)_wz z-STi+YkJ)AF-yf>aNwK2x3)HPGu20H^4M^$K-)|qh{qD4|ML+)k9_%1VNGkHsL7mu z(WL*K*S=~`GfXEP_>AJ>EYdD_!YqT{i;`X+@p){u_7>w6?_63XAD+xujl?qFKi+M& zpf3%4^uCeMThmfqHwi1=(s-ZhDt67cSB^^E)B2AW{%zam%LtSHnu*q8@U@O#HM(fG zR+!ZNWVqV`vFkWHeh^o6E%lbYSpczxJ0DaF3bn%_pD zwl6=_Q~u$D-4UCxa*66et|f!XMOVFwkHhLw>qB+NL{@<;1yG~MjK4hPCYBw7v0Qzg zL3O0q&*Z|-F+`Ke046s&j_Z4&S}>$W%|r8~M0)AXMvFfGxP+R8&jvpO6-0OmfzSI( z!Ya#}qBS2lxu+iPIlny^*+ALkb%i!6YyY~Q#WREvj8#9RIsA+{escjUo+D&?$6feF zTdiov-CwmyV}D}g*vVyW)viFo-qP{iGgp;CD;f(|x3=#5sao7SS6HF7a~x9eae5G|C2h$p_qBM`s^(VKu3gthCZzeOPm~0M_kL(C8nf{SZB=as9t*-lZ~#JxEWZ_gJurpJ}exLZb)Oj}RpwoZHQ z+)3tfGjtcQ&m6MgI+~d0$HpG|5ZoL(jJa%X?cFUTL#gCato260D`NAwdYb-Iyx!CP4T0#-`TD!Z7}>*+j# zV69>gJU+{I-_?>M-8U<^7iSF#n?1YG_Y0iEEz!!8+UXC}ZSxo7ivB!DhWS8=essntM{$_Lqd&h_VVZEY zF%pr_q47f5!;0B+b1wVAY|W}=j4Kaw43EMJN69vS`lfQu0^kfj_&h(q*)q;c5 zQMo8vpu0xjd-l;m@ae?wu2f$FD0wY=Y{okNzAC`X`MQ(CGCgdyU8813c;C-Gcu+-t z6jQrJSKQ?C0V8ub*z4--?a?7pv8lX;=w#8+ixoNMuFd#OOPa`Ou64nQKLQL`JqRk) zr8-DBwjGtX{)D~3&Gx`uCq{bqE5dFyg}&r2eJ-N17ruw7g6u~7-MYM!>`ziGRO5ua zJRefEMA1X5wpA8-x=keQFS!sMc4-!iCOboy*jC0Wo^Ptwf!bNZlGnVGME>wePertC9)#;Z^DM((MB{i+W} zn)dSM+I7!R^WSzFNzVU_z<(}i>4!>c1Vp6K__DsgZZUAp7}>lXT$H$<(mh#OE$`## z!rPxC5w_7XI-^irUShDFR&~5Xv0CzGSZSese`T!4RqqXY0W?sxdScQYL$6Zs?Q^aF z-4V8d92=LbS9AaH-FIh|pudh97ILhHW}A_%oyBPqBUhit)SEZYh^ht@+!orYHcn6F z!W5C6AlnL6#w%5;`Kca<<)`d<6Dzji^1+OofkizGrng4NAm*lGoxgb|Apgh_tVdrr z#{1Wbrx_~3d*h`M+qlC}!C}V&oT{Fw)ftWUtn{E$+^SKY)a@$tjFGUq!<=T>_j#W~oJtX4Lzs-flsUKAR&s><)d zXi(&#(Eshq;hScL%!NLFJYDz6pXr?NKZ$`a!+d}vA z*w5p$V6*#@uGG#Yc`y9?anfaAW%;{)!emlUn{M_JT}hq7-;6ScErM|$-+6b#pO)Z% zzYqZ7)P~tbd*MtBUZ=lBrQqCKs8z>&JHdG*so*eg#Rr~P$aFXz*H%#v`+Ql8dRS-m zdOX&2RbBUp4nI8=L)~DJ%9Ba6Yn5yft>5gX#yz;3{Qib+FsQTsxuD?#Rfl=9343sF zxW+B9-_|oFj1c*Nmbto<>wAepUfo)}ho-7T zZe9jWO=s|1YkSp;&+R6o7`h{8aihcxBXpck=1+WPetaH1N!3=iaKx+lN|4u~povg- zOlIgmI?mRkcKc_FWr#+p9LM_1O%44o>-y&b^6rN3)}?yyyRf{_gQ|j}PbKKO9wXA* zUA3E5B2V!))Snrw$1{}lJar!p!A8R$%@loNK>R zL1$}vsiv1V_8mtbZcIZd$wi83bwU~bG^4+7HcZ5)6S40F8TNVzWrPlmx`scfSYMp% zy6ja=j)bU?-JFq6c`@U4WFsQur8m)Ev=vKdQdIM@h@^6d-g2@u?2zzzbumHpX7qjH z_46La+o?&EAbZ7uhd}5ssZ$iYNB7SszCfJUf86h!QAtm4eOSBCmgPi8Urv$geS+Ct z{v_2VP8QeLN>M9G^O;SxYflPBscSpsXPe?%Am!5+_3`2ROfYZ0BQnBd?PjT?x~7c( zcz}{D0*Q(~HtBew=ygf)#nnu`1a1O0Qcz-karSY)c0 zac%7vC2pH8r^(EWwaL6iiS!xdr7E=S&StUDZ{X|~^q!kDQ*w7xGp}uL(wZu8D2>ZS z?95@N&2t?FC%Ldc7OmymHO=V!(HEX^C4b*yV54!+`U)T&v0tqj_Ml%U9pZCyu)bEI zQ7C(2YK+d>Xw;^(t~^am<=s9Xc+_#}(+~E*V6CaXwso?Xqr?Dk-hCMmyFY&Pb|~+= zFZJcm*Z1X?;;JBF9)swYp`KN|QqdJw@b*uC>yNz* zPrquZ+0cKgmOr!e+%h^o&^ihvcq>>1j)q*S=Nhj`)EjlcQPlV?Y;!o2ZncET>nyL4 zy1tB2kA;S0L07doQprt#WB+tJ+ZbbOSVt??<6zX(@ zTHCpn@RGgQ8&z^^{uIjRi-Ex#J=JMpcZ_vSI+|oXirzST6rp{8oG_+bF4+CxeZF-v zv6EUi(KCHkrhD%wN6DjkP)s8F{w21D+bQ1;Dy28P!>^7u_et%3Nb(W+1Zqe)SIVa! zI8!KFwyi!N>8ScqZ56Rohgc6%OjdJK+t_a*Wn%itD(~n>!qoW};kcbJn*jXyBs(`W`430V7kDJo3l zlt@x5sii*qVEnHu1pK3HdUH}i(epexD+gH8?QNff0E|t49-%({u1MD_EAfcAzBF>j z>xTU?Yc9t@ag6Ts$%gBDT!!bD`yDC)^T=Id#oT(K|J<`bm!W*Ta8>aG8sn27=TU`w z{RAVnOU{KW%?1SaTZxr0(v(VCs*M~$l1)>R?n2!ao1c0&Z7%%c9;o>FrqS85x513bF9>)CDIo$)xLAd{ z@VG~^@j16Dejm_4%tT)2kB6I+)zSH(!1+>ocvC=M0zt(Ii`MT|S~2Adx{t`i;Hp$h zc!-Hoi5w0A%QITb#y7{&`pZQAWw>({Gb(a&a#mNK@%-KY`Q>xSh))YXehd)(&#@BE zNWz3gPntMn#>)TaV7&r~-8I4geisw*p94-{tgiW&B*ZT-0*+&OVKE!+2(;{{rhpj;%5u%FSnhzT@nnR!p-hltBLU@#DRf&o93CWpPVTm2bPw zc;TT9mVu)gg@(m(xwqbw+vmztyX>XRG$izI_xt%*WrX+0YJp>LKpD{YY5?-ST!7Hw z^LP-EjaetLW4IUKn+n{}TjA#L88pzs^o^IE z1)McpX})J=O_!UtN4@OOm-3ND-vI^u5y0iWjKH3Gb#e?SI|!G;Ch_z=4Q4#|BZ>ij z;_q7|;{hhEH0(3z!QTv}FDfBmHyHy&O|4{BdO+KkZ=<9&{Eo30ktkv3N--;{VjEyw z8s90JghLW%n|+U(Z()pyVF<(??}XtoR{^24{;TclE2!Y*fy(-Lc^(=OSFiLwfXY+? z-kiy4$U;Q@Du+wJH6Z7y0<>h4xAAnM1vx|?_oD1_J>AZ^jb#>uNG+H6BGwr~J{r7P z*28pku@6Ox;ZGx78V3+XBRJ9wQ1N#>G1ZlVi9Hl&SR8MomVfus=W<;i?#XH%YZDUD zBB5;F&?Gz^VwK3?!OmdFSKOWsM8R8b7x4;N(E^U060xsD8154Bcw6~{&3t+$=XPA* zWvN#&-nF~~ZYC$PWrj08r)f>1(>^k%N*Y7tN(loBr(3OtP&@N)G2QqM$pr)LD9ZqM zjJD!^;N^$ttk2dD$@o|0H%>Ud)7*Jh1pgQ2NwYxm7wKhm34nb z{85KI*LWML&xJibGqe7L=D@Btk1sel`m3fKWVOxT$K97vio9GPyDkADePe`{pJMQ7 z)XAqSq6Cf-zXNm=e2Q=%RXlnRS9rgJq0fupy`MazkuK;pI6&&Q7(>1TM+>Pvd-et$ zS`8~Tk}@J|6K?B-Q&q(>r}8?N!9iGGRDgDQ75(Er&rSvxJ`#QaJaw$gM*6Y`^rFjb zzSliSj-3alp$(bE3kjMqs{G^Sd(YLGrly9yZh8Q8t!_U$F*uC!xyXjI1{e_?@^xo{ zWezigRoKoo05r+LYHfw9JM}QWpEx>>2^P;1iZi&q=dN5-K8`%qGMxl`j z@>fu~*>c3kE%9OM8DAIx`bl}IZNOT-(@(WOfQRv77x&98w3}fahj5T6U>3tTpO+9d zasr%h$Po&Jvmp}CB>^3jO^AsNpyIQaE&zl|F2l-FffU7U0_Pj$0-+6nx9%pTJ)hGL zOr~W(GL{^pzUK$&*m)6I4)!&Y0o&-UFm;j+%;&LQ^{y-!81#3qm0o|aG752JS}s+{ zP7b|+wgu+_ygG&Y+~FG4ag;X;aeS*xu#(7e1uzP_aM&T+30uWhytd8V)&sLC02iIe zbZBNfD)zbT!KV&Wr?A533eUq#bDgT-I0Gn<_2^~5MrYM@by(aQ5!{LK0402Z3Px$s zd<8Jg9+=8qVMJ&*>d|(EH%5!~XZu+JE*dWjBDf<7XI6ugS&aao^dwlY)?mGGLW}eA z^s&06UWKw8e*+p_#9KWO&wI9M1psu~_T)iDKVB2TAoTJg{rVzLuZ=aA8l2M>`6X{{ zAEQEA8UbjI0BS8laKUNvTqmP z>W%`);b}OLg`t9qJqXXk+Q_5 zXvKcK%6a>WcS4HH3#Z=agX}=kO2?H`{*Gslc*Y}aVY#sB6^?#L2b?y{Zo)}J87eX5 z7*^%WAFiJU1t?c;Czd@OO2R2XP&C&N;g4w8s(-bYz)}c>dLOZ$12fp_GC?rhWK0Pg zM24m1Zk~Ko*AH~bw7lh=CMP37atbUgiVw28%_&&DP@jDPp9=X8Vnau{0vEvk2Cl@^ zIT|T!FP(m~wMT?KhB?DQXW?vpO}pTrWBnTYS#~I;8z3wh=^J*8+8g0S0M-@qp46X|?iWNY1 zN49xR_~UuTMh;d3AY%(&Nm+?f2zsEVK`|Fzjzl5&tWinLj<_2^Pb(IK1NPk`YBR#z z30T27UdRfP@iLfQYaqvp5y!3P8G>a4VJX9id(2BjE0(WeP|v=$@b0V>ls@{BnvZ9E zY(X~x8c7Nqh0pz(jqpRF-z8q)LGn_oP5Y=)V~X81^xv;uf%cctK zZ^(yA|v zI3&X8ob%vB}gg`=RZ8( zm*y6j9Tv$yZjW#kB$eb}h!x}Sfy~eAid_2cy}lSo3Pu)5jd1U`1^8!j#Ai=3{8gzD zQ>^{lmr4xRRS;4%xeIn+nI2|s4FCgRN zW!{Ao58u6{g&69Yi#nGgP`Yoe%W)&%+xrx3SAK# zCl(CdbOKE}IK4wJ^aD6ZKjp|Q=t{p#ZX&jSD{;{BHrnoS=;GU_kJf0+pWT%VZ!^0= zLlE&oZ-k?&!Qd(W=}or%Z!nk~8xt{Zv5wTj85h&bVf@H@DB;sWL4Ae?_;wV#-o8X~ zJa~{gdb$UJ`K-gI0O5;{fMobE!s9VC|JwnJ!{!u92hC{IR=PET2!@!hNf*0x<5wE!O@Y;rV-TE(*+C<>wSVw3V|CNH?|MmNPFFeM!ZdaiUW*PD zSn{{s+`G?t{9>n!wT`hdTC9IpT(q?Ov)idqI zFBy~P7{z&3rcZl&f=3b12*UT`p0dOltSQL^xstUipB#EBkjuMGuz(BpOv<++nK$w{66@oROeFkux}vLPp2!$ zH!-FPHy)>_`xF6>lnRO`sr!y&VOvGON1@E^a!|6Zro$5u65rA5=cfGD{$?6wiXGqi z(S-Z37q_6oGbZw~)HBR8d>=FZdKB78g7#VT=fiJxYFeqHj%Y}vATb>cnlkJb#shIV z#%*}&q;9Wwg7N+RLJUK?0zP)hLT}F3CcIR(#nKZUxJRkyh5G(IMJT?s5lIi%m(OJM zg3r->qlJ1`%36CO?wL;2`w?K6M)D4>Nc5z*Lateuam3`YrpAIo;$HeAVW58rvF5PB zBA;JwG2!2aY>A^u;*&}@VvJI)>SS4s)1=|1`RgzT4Gp*RlchaTL>V>jCAve}&+_7l zjb0M+aNLb!oFz=Mg)gc}rZEU*jp3r$Sdl9!db=l%T0iU|M+6ofc93rNZf<@{+Syfu zPV6cs%7<}~!Auc3Uuams0{O?GlB51u(S2>Q-8Vt~1IR6Js@kJu^6sQcA)|1(pX^7z zg6I^630qPNGqX73^KvK%T^^7lLmC3uf+B_2?$xI8@#5^DX3fjgK6S6}@scKYrr^Ef z;A|njj^OlhFD>tWM6E`rG^Tsfhve_?_CyK!T&(aNLcA0{`#MLW&cNPsTTzX7FgvKZ1Nq@#vr7CK9~8%$B$r}dw=aZXjU9P@cqoYwDM}#a z5lb2Y9*&ou4xztIz^OESgHURyw>Gb@&bE-yu_rWLNF5TLZNx%}bm_+fn>x7QdA)qt zLo2h!Sy7vRYam|uvqRpeAF=Z7DVl>GUnaRjY#@^cv8SF&aqfwHLbY7&F5T9=Pa3=> zX|N9rzwi?pOg7z4KI`eS9KIg~# zERokGh;2Ey9NC!K+6APz3D`FFmnCjDoRFT?{_Rt_1N#KJazItlu9#*nB)2N^Hp-t zu%^Uycj9hV{z!t6FzIDuY3m_lpKh#N+>97mBLc8`lJ<(KB;DGSh#wz8p6rVnG-7nq z5bg?oYN}ctbrI5g7Hbreb=C3`nQ@u<6J+9w?O{q;d;)PQ3xsjDRG8{D9%wbt;=9Se zV&(~R49gI1^{+!)BB$iub_t*J(x^9LMwGl#RutCBFbZ%-m?v>&PSdXsA-F4&6nOGV zS@2or(q&X9D=xFg2Qq2`=UCu1bLM<4?~A1w7Q%l$OU3c#NF@=OgX<=tYKS$YT5{Vq ze!i;P4o5MnKxdZY)%<(=FSqd!J8u(Hn&GiJ+%Xczw7ye+oW0#%!n()&E>F5- zI$arG%f=q@p4av1>lKeHGo+!~fKgnMjf$v-!cFssmusi8S%VcV`D7A8`J!7e82GIwRiu5yl9R!_(mst zWOE=g0rQlAccVVxa84@{7rvkW=O@!$v1lRDva-EYGh0d6sbs@FN%>>Y3qPCbuVS5; z4W{+In2+2tS*?;J6)VDzFM*d{7;yu7FAZ^ErKiF10*@N;LtOApWcf%VU4@(pc{S+r@R{Vi5C-&sgY){v@#AgP zwQ=QaK_9?Le%oNO^;8LOSpgVHW@qnSzDkXwV?k%Hs{QFm!Ot9f`Pv@*M|5omR}2Af z<~d9e0voR{h(UNbe2TUIBVyqVU)}gdUlB@o(7MOqCAyZ7a_gd zqV3o>I7rQ5kqYvLJtzYUFnUR1rVx*7iKcm6c~WS){X)lWMZ#fKohQ0FRHUNRdJd>x z&bX$Dt zkWQN0glnG%f!h@k`sIVcmxIXj9SuZ;4m*!WBog?_9On2`oyPf8=3hvH4*Y7QZk#5( z7Iu8tECqp}UxY;+x}l@`EE$WAe{p{xbbX}+k2iWN;Lsz1R3`A ztD`6q;kF?mIlrYw#Y%jTqSJSRITjOMs@@9R=#NsQlVaBoeb}dnl&EwA)td7ffv* zmkWYL*&ru{U4>Qy-xEj(EUg6vcN=AGkmCjcV6Cz)^-G&hAE1A~6fd0-eXP$4C38&M zC7utNckFJBILqZb!s%9q>SyK<(vYI-aw99L8*<>Z7Hj4)&XYRVIzr22-EJ9~4#Ls{7mmmB@l&TM-#ihTL^|rg!ini(Yh;YibG4h&UuNgYB9!ab#}c}k@FJ&;gNE88 zI(W%4U--;RtQ2Oi5K+MN4+gwGWH{a$c+pt{S)B1et9R(rfjqy*ve%yQ3{#F(XuD)@ zL8u=aE86l08G?wiLAEEyY2?7$&Sj1%nxK?1v9Vzn}V4sEiAHi_b|`gpH=H)#Jnu%WmTr_PoScFb=7~ zSMKl`g6MG98A`DvRaFd|kLW$8(7IxmK!~8w^Nb~%)|^`fUFfT=(X>M-bOqVxmYQ(p z869YXk7h)ukrzIcxK+%dVSjyrTd+6UJ&fOW-9LXY-z)>~-S1ogjNsGijT|2oRZJB= z4s{+crAm5E8_P^n46nLfLDbKt%6B>L>5iV4D?JMx#YbG*3t#HiXWee{gz6V9;Cz;c z>X)_=ay2Ft4s({RsvaiYI=~ihuH&|Wc*6`JwmW)VM`@Y2@B|`VWs|lwx|mzyk2jXX z6sefC#h7Or+ig~E<6o|+3|_U-acnmV;WdqUdFo%kcaXzK`@H4>shSau{2G|OQmnBM z6zOq?T9;-|sVf4Crlu~~p5_lv{c~U-)asel%bv)xb;~(pK8#ULM7|KuXbj+2WF6gK zvtL`l!+JOai#g+t9K`eudZ-kR-^a%|y8kp)@PlIk*D3g7T*DQLj#Sa>ZlUS2jVsKg zO-$?VS8JlhSI33WvdZYG%+z6Z-Fx3ZCZeZ38-Dpao|uEUABUVSvfN9euvCH)VK<)4*(8^rF#O!X(P4oj;8>d!Lr zIsRTf`|YC{&X}}^7!(zeL*F$2#L52B9|W&h3hz@Zb>j)Y{Lexqz#jPve^`cDlHxtB z{qIsRa_l|-|17(Mr%;e%G%Pz7#;W}MYB&f$T(6H?!BfB}`!DF_-@XZ9D!>w2IxX^M z{O2u)(?HR9BrWymKVQjLl16C{s0*k<0bj}h#;05VIR>wgaU@^BGDQ9WFMu+fs=BIb zpumjBwg6nV1w~e(^tV^j;`EIYx*C%V#~=7e@MBRTBNJIJkwpZmF7`#Wt}qQ0+|_(g zkcDqy!`MffU&VPAP_vj1=2T?lQB)V6slmSfXL0%o!u^AHlMhsWVW#|J#(!RbCl9Wz zt*N02(=h)7aQ1sOxbL+v0ro1qiBKbrtakQQcty3)(nz@T{{WPK)Tn>Gz){GkplGje zDbGy&KUP5?Cav{Qt~|vqj?_P@wST;5#$8NW(9&mtFs}5IgXE82{Pp4<1-S^b#41Q8 zSF##)jHU26B9y~RxHb)kBcdlu5#=wx-cROpwV8%Q5Ey_;Sry>G2-vsjU0BojuQzn2 zQR;}E9NBt*48#`3;N&3*x-Lo1tAp)uxgPQ@61(P`&eU*9m@$ye;7fjDo3?xNP3{Z8 zBUA>M4w{cZ-846vWJv_zNC>d;ueXUd3##=2E+_2Wt|l$W%5dEE+=J#OF)uwu)ItCV z3&y#}YsBx^ZVDL5pRUo`_C*M5PP$Z05fY7e>7w^_xodW4(d&+bdI4H-<&zsZR0Zj8Eg%3G zA%0`!HB^s`NTK$4f-gt0!MrB?effTCi{EXOaD!qX%NkS&iXCtvq45gyp_UFfNey5? zFoDY%!HeBoW-#(ec%>3fp+a9&(*hK-Q!zU*CqR;0Fm(@5P*?&|3!||rP+*%}%}cil zc|3-~T>k5EYUd+K)!n&$+yK#WnB%ltOV>%0JX=QhzqF3ftzpQjySR&kiaYR zAxSJ#X4w&gZikzJ7gvC3rVP{{nxgXw?D2yTI-WqQ-uKZGP0`Hfxj- zjs?7uv3uD_>(n&SM$cti$rE%0NHVBdR(f2C&M=?;#I63twvtP{icwakZ>OhApm5;7 zI$6-nE{WhiG!J>^I_;Lnx_Af^!>E)Zb!!8#3qB*ky3_p?q)cm2=4KJEfJe|FZpk)v zA9Q^#534|Vd;+d=5(Ib+)M{Ix> zcD4mqZ?)r|9jqF;0*)CirvN_3Yu4vuXuBT)>cfB&Pb><~;Dp4?-PZTT9|;NTFvYQd zx6jQ7t1(w0m2k}cWk6kyM<~mR>=e+)ngnHk(je~gv{>9Z{B!EpRyo0T1W$sZ**|fA zEepg>003O|daFrLvod$Ta$M?*D%8g^V?zA+*!u^LIn$}C;NQ+a@r>I0A&QRA0Z0gx zqnME;z_{3SxHTP3Saxvn7p(OFMMg_d*OSAtU1DX^&(Fxhe z%y)RYPRf`!tH%t(N-jZ>tOS^7ZiaN{5ls;}s!f;8iNF%LM7uqPGD9*eBHq9%s79At z7S(oi_w=+nRNH*_t0vQPFE{Bc1E7H+H9fbb=-wX#+5Rset!Pj1-BJWRssv6K-@3p( zXP$$diJof3XWrhsVfy%nMDst1BE-cJMeC8UUccA@g>z2T!5HZa0R@Ggf#H>fX`(k zQDF@r%FsH+DvX%K_?c^qUxWtF127LRqK-@R5Y}9xXY1I?GjWz6c5_Fv&DxbT18!zN z$H7{uA;}Ym> znc1)U1^E0v?vN=B4 z+Y`X3MKEYMQ#q=~$GBXYO3@S|JU-Z0jUg7ciyD5l8-tE0w(KI7FCHs;&^8%e9|2UK z0vtVq$nd%`OW7=tLCl^xU@g-FVT&Z@VY6}vL?|t8j)jSMQ4}x@V`Jl*J7B!6FwsuA zyTHhhh_eQ;UX_?>QIH=33wBxTb$K{?lst3MG3GPZ5-3t3AxuTma>BmxwrV*UbgWEd{a^2 zX~)C@ya;KSLZh`F6UYJMd${)pe)2l~6Xix5Eli*%&Ghl*WT!*}5EGl&;crbeMYsPT z*v>yFQSs%3MRXWQ!q{nB7FG_5$moa5-xDkOvQrfHF3dwlj4OM0$3!gSGaxwee?pL^ zC&*0NN{i((A7rXg<+Q))uTJh~Fno5nj;97^%$fx3WHGpESbPM$y%(=SAXcW=q68iL zTk9c;r>MZne73F{rxst5ZCqRcR95UkEK+FpZ_WdRG`xX6*Fc{LM_BF>5!UTmq3qUB ztdpI@g)8Bm1&yhukdzQp;?{;o)l&{VEc}ENk#n`4CvC+f=QXa>dg+jjQ~rpMhLYKd zg`1}U28MVOYi{he+_KS2WR6jupCdFZv98u~#w!C9{tA}J7{%rZP+8x+2GB3RkO1;_ zVz;rU^o2M>&0=)s_^O$XOgiPD0HzHe>Kh*G}fL_GE3f?7x+5?uOqK zVx!a4=ye|S!keJ%9F%q0S(dfPaT`Ic#ei=Y>&AD$7*l%=#McP+>!WeStXcc1ER2nX zBE)F~d?d5XKMRLrCaq5iY+AX6k*fDl!lsa8<10D)vPY+i-tGMjw+JJ?8(Vp4aE}M- z@d1UHGBn+CDVA*6?b*iq8HGugM|LNdaqErz?8tkovoh^F&%xdV zkSPp9QnBaz1a1aq>j3kH8RY1G0r+s(0u~0^OXLt)@w!eDk(Se5K^%88BSepO4;GqG zA4mjg>O<#mdUXSA)!wv9Z!c)>TmCK&G?8JV$>&2||h>p&W6&0d=l z8`v32uZ0t^v$^;HWj?=A@)iciZ>Pb0AvlWkbyO>%DpsGBq;r>H*uM?d8M_8{nCeNoHlZO62ainEcq!p9LC zy|PO6iWP4H4(1W$7vUDgC6f|vvoFoZq!?_+0rGw7rdXdmyI4fW;OuqEwhT})e(N^; z`6!|%OrG2=3luDD#5kGJbE)`xMsQ4tdlw6-(*~5^u9v4vN_=l~VU^}`3wTs>w@3u_ z$xmDG(Ibut& z3VuU|{Zh1Wh@d*zI!i>ZL?Y2V`8;tegq44*hIyxJVH-d$Q4NXbdgVh*sdnLPLWqh2 zE#C_wGrxF3{Jly5t5`dn$0vT_8uRw+V7p*-ve9_swl;0s22Syn=@uil8DOzcqx$2Y zL}i1c+XnIM!U_qXCZ$e1-7msq`!;oA_2DtxuRms?h&#Pvy+pM=nIZ{0{P8)<+Op;k zggg^x;qV`Qn!||0-Se*7NG~6jU(!{Zd|J_(Ln%dF>7}k;oOoiM9LClg*b$5|g_-6J z0Fy}D1#sy)|FE-m6_nll#QG7F^encx(3B_&QoCOBPJS=cImWh~STWdM?WHGK5Yd8{ z6mN*3on-UW3xBkhPSFs&!+s+HZ7nNDqcq;2D#{;qb3C23F-ZK2iDb}VfrYzWZtYR+ zjVifvrJ_Zwq#+woWB8oQG>bLJUdpn(u6VK8yADf?go^_=0<5#eh592w-cVPH? z^zi#U=aV56>cN1UzYs2@*@~$FXn={R4c`CK>-%e9Rv0V%0h&Jg6sn*1AAJ_!(|w`B z=7Z{b$=?WQ%YXgPf4PQ*BLAes`LT+-uR3|BFXaB;=^TE4Lrh;>Ve&&?*dVSQA@6_F zy_%80yDisi`gvvleU!j`L_ya)cERFC^ zxLEo{=zl}|W#58S29x|5Z`FThJ8Mj)|20(c;_x20|IbZg)zs9g zPTuNF(3}8fvI#hxv_FN1f*w#emch}#hi?i&N5j}ut>gNm!n3DvLP&VPkH5nBpQ}+H z;l1@l#fKT3I4v{;IEMT?P`T!^ovtt01OaFj0Hqg7)=wY;Z-j9qPmv7tD17YOLMwx2 zfp%bDBvO`sZGg9i?cEK(K8`qoxt&io^^fsgl*%RkOSa7bIhOMgMZST8{c2tvh*602 zEJ3dYMv@!gA^en+^K#Yn6T#vQWji3RTm^8gPo!<&>cr$B^B;JPI#7uKv86w8-kA9A zvejf&VWs6LlhG&~)wz38!*`aLl=x7UY z&aFU-&H50^*7Du7II6E%s}!QlYqiJ}Y-06C&+eaDAmQ(KW2+=ZY`^&3?kE`rrHxj= zVfYhhKZwx0`1LKkm7qMB%zF&5^d^w+SXF*gI|BTJ;}6tz4AwuDD;8a8`aBuImxtzGk=ri zM=+^-S5}HeTuhe&gxjGQ9^%Eo$Z*r$*XZD#2kiW8rhV^>K}cBM0RGB3?{VXtAL#lT z9D*3Q$l1F#kGbv#CEW9F-GwLszqbCs&Ou1e+WS&#*hK#bPXD+8{P{9CiX3DsxIV*G zy=DNo-V|v1M#7=>mGX5R-pED7{&QP^G1&%^W+`s*=%#+drRWHIUuB=Gs9X~mn@`cJ zWP%qvVhe6zMBA+O8CdoIXpIAn!VHHL)gYfy4Q8I7-m(fSPY_Lc4ZKvvEp+Z?bb$ld z?6-12^Lrbb_eW9!nQ{Wo#M)L5yqRIZlIIRr=e7nTg%QySG`KllqQnGVVx5FEeWgyu zpTt~d;m=A`go9*1Q8~>y2W3d#dNB6|ZTFstAy^J52;|d>$lg-K_5mbLFcFI45F_M! zZ3JvDrN-ro;Msw9u@*S>R$;jK1%0DFSBG%lDg4)v#TL8Myrz0O!^2lw_ zN%^@$@{#ES3FikuC-5!p8KhGBuVyf*_Epd>K`l{!as{Bj>N`JL3c}p3@0CIbAz0LC z%#oe+4>tj4%m`EcPRl{V{TWl>YgU2W8qpIQ9e3;&GSc*rR{Uel*xLq>PqmmAVfq&> zCt-wckG|KmLw)Dw`KjPE&J?s{j=ijNwR33^TAo5P%aql{Qa+bj5d2e_r@=cpP90HX zWNCMgI?H$Ay5BxDX^<@EjWJe#0{b_ELE2Rw!Cr4rq5Tj7iHWOvn$4j%Ejt}OCbd;_ z=4SxzeA_n?9bv?gV1BiSxycH7%znWwL+-#FZGIA7!1=@O{=8rW`9u|N3Vu(_&=Jtj z6TZO$C7#?F{K!lMkUKkFq9vk`R?JqozBOU|FS!u((mTZu#hc->cvhW6Ar!7-a9~0k z$KVmgo6GZKjCs8x3^5i&S72qT0UIf_sCJnU^lV`Ce6Mpxnf8XP4nVv>_RSj3CE7^{ z=!mFmr?yLJn$MFEt0pA(#Dg%k1x3uTe_I= zK3APl{qAwd4%P14rMge~Og@EsVAQzf?v_l)z~ zHzr1NSx<1J+sHPAgvV3!xgVH8vHEjRT{kDb9TTkdgXHkGghYIG{(Xpj+WlL1P&3}M zC=!wTt_z$s(_NoI5P45U(01==iLFjoz-s6(xZ+lWp8A4&ipDMg|7P1HlI7KPsRJLm zv}SY(?7@S6vB!37`-#5mR%71(`6DC&6m$eoBG#I_09;?<*D1>W%9q!Z4>m*Xi~sNp zwk9d6no8lBg&^-iFQ9TLkdwe@#klxDtlwa3Pm2$c15aQSPLV|=KBMm(Y`V^7K|+xR z=cqjSLp2GxtJQ8*UAYOHdUraLRH_7O2cd}>0M);@(NfsBl_lHa)qT~{YZs;Z<&kA* z(qLf|gI@nRtnSls@sAg&&Q~BDRZ8zlD;;3&02!Vg-p-0yx1JO3Bzl2-6dI)Uw_uwv!9i-Jr{@$%CTOBV>C@l^ zFk6ib9;927xjrKctupQ8;CeHA8X;A9DNP}q6(TaC1|i{}v}%hNtZw;I>0N zvOya%a@j>>qaNyAholJ<{Va`#wiCb}&t#jFcKt#FeT(~bgl?$18pGo`d$FIflfTub z@}P}x;jb*&e+2mS6!M$SC8qrrnQYqZEGm%Ab_D178|_&pPD{9Nw~aeK4X0V*rJE?} zcT$D~z8z=4Ljmrf7>%=pHKmtEgUqnXA zQOL*fI@1L*QQ>D9)n41M?zCOG$iaW17w@lcEPBjy`1XY9DFsHK>x6&FxY)D~(WBHlj{#}E=o z<n*Xa4D4J zLFfU@63up}CQ6@qY6|+b2EGR!vIr0zV`P_X&LKx{v1gi&7}fmkpeuCQsH#iya=e%%1W zTM?&1L~roIQs~`Sr$CUI82Xi%{JGy&G)~%zaQ_<58xEq8&KQ0; zG1Y8K)o=EW&E4Ew;f*Pu!mX)vIDo;mEYl%3q;v!K$TQhLo;?fEin8g{{= z?t?j$#x79)!ZvJ|!-`Uyt|?@7O@nJ7nZtTnE&D>9_wpuqfcnv9&32WxF@%PF<@8zR ztgY(|w_lXSY#E^J_BOIjXsYmtrqqZky_w4;9A7EIgT3 zicigUTbW)DkXJ9Yau6lea!~uBGNO{Jg0c=rvqj?_r^44CPC-S7XMSbNxlt)LOff|m zuL6tiPG+I0uYHfx@^6wN2T2Z($XhA^XxQ+xzdEnX_IB>cVx@McJ@2#e}JJPF9BX zW{8;nMRFICNu-LRMv0ETmxi@!4M%nN41Gg)9S9AouU5{s#${2wI!kgv8Rn#*AJd@} z-%E|6O}WW)hx1wDeKK~Z8q6@qgB)@^xnAsL9SDiORAq)bLm1_V6Z9lbjA!oNrBjG@ z>hH2t2~(D`H4%!q`q6v*W5{IKEwtowkr1m;A4~Sc`k@BpH}Ni1A#8{0U2v8s zP|0@NkO91Xtn?|1uwm-i3r?~P%n+pp8`{}|qd6H8wnLr>?vzB?hSQiAE>KeR4-Y%8 z`8F2bxA)NwESH4!E0a`c+}S&oS)zADp3V7CO?z#YyZHLyWL`KdPL@X+H!)mjWNDV1 zmGd8`dDwZwPBI9WCiBE;6nZ~VBKIZaO`l}tIcpTk zL@hR=ixLXPi9+(KL7QaDWqm!ha>8Rxv2fgm6_Kqvo_JxKPBfg128Jw{>{-gJgAY&Q zmG>BLOQbO=eVR~frxQ^nh|QXmiw)2fpI5?3A3R%7_TY>dz+RhK;=JBxVl_BKJDMO} zud$5MD5;!)`GiojE+pNcQ_he!gYTdbgL~m`+6LC~9H$@7d{K!CWb{@Z;tDvQmz$yv znPT*(vcOtdP|KPv)u%kV?PSP%e3eORSxj%JPkfg%?^`wiyP9jo8YEcmNCqR_dNMH3 z=L1@dm~DjHa}j!}cmnD8J5_8s$1OSw=AD#bRB1tPBZiAlR8r^4`~~4`&Q4m9BA0&Q z`+mMdu1SYeb)`>f#kA#8JaL}oLSywaPbMF?OTdad0_-XK$&Bf$ycr{Zfp+wf#4{I> z>*F45=G^0=JPcvsG57C0eC}Kt@w*b#E9tLx%f-Z+r+X@RtcPE-J4!!R!A3Fi!S&@{ zcf+#P!H;YAZaQsDVKW>KxeMw=>mn{l1y4YhktvA^XLdD&cyH?uw#Nl~MClk)4)W&x z%$}}fnDm>dB_k9Hl!@mF7~?l75DhasCDR|K+%Co@$QIXt!j=RL= z^r>{XaoPB*HDPnymc#)uJqoIFJX!r3$Js>0#zs0kIgn$(YC*p3wfP9U97nD-J zZKp8RnUz0>5dmftz5p6WuF)P;N2zrQSa6gRn+w#3Z1|eQgQc|zFUdRQSgbHs$c~@e z*32g9JNMRr(ud~$hHeCi}4 z@6#zU4~KHEeR*!>@-$8vO?fgl^XNJBvBmJU?WA7ROn&`zAYTntR;Da;oTNVb^H&X* zoRbOaVfJs&s|24}&rEr0V}4F zU+zXecl6ry`)kLaTFR4NBB4F-aSIB9D;QHDAo})EBIQL!12*ma zQkV7fH?PW#&SPn{*L2DokJTQa_Z0mfKh}6q4!v-;=9nenbt)n7_CEs7f3Pk^R$9K~ zS0jC*AWkezyY^RjsY7 zrRKlU^gPJ<{Yv=zE1dIJYy@L;!gRw!|CYG_{2`Z$$t}^pZ@DR z_MSi4kzru)h#~d+PoP=30){YRfRGvXuoGxR3&B*(w_{&|M!ES40C5Db8A%9Y z-P%*6#c#9&-f9WJB{BPjH2?b+iYUOqH#jvnE&S=IXB3R(Spog7P4!K{JXHY@sFF`z z^3j|wv2|PtT(j@_roUwqi(taZQ>6DoJ%Ac93M6B(v27xnwE}HVJn);!`SU>Y$@#aw zeq~7jKI(*zJl}N1NZzl0e18a@mqzL+g_jmRfb3@i1|MC!ZC-iq2~Z>Zo_<049C=i% zR4qQvC>anyBYc4L<@D{Afoq!2LEc-dXjM9XHwn)KDceq#T`&%)Dks6LYUm@hn%#RV z+8C6CCIi|dnPWbO1;#+oeB;Qz8}yDBQ~-U3RuKWs%b>?XL_;K`?E3^N02=k)rsH|z zt+@VoMZz0Hq62%NpmU}aDDpGDpAqyr;?_Zeb>kTi+BTv04x(Y#P5V+5UcLH$oB7XE zs5e|OsNuu&li|aM0CPcSSA!8_eG?aDz+}m4LTxz^(kh8?)CiztepEf0pA1R{P5*9h z0H&-w(-gu0j-=RJjY5zlv=IXQ>tcU^#V+?JiDohVYf490~dUCDh27$W>l zlLh5*$|(S8JtC@>=Gglv(*om)9Y>%js*D<#dr$YLVwxCYuO|4Tyhl&up3#$^wtB|)HvI|zQ*ceY5Dgk47~22b7^^8V_eZf;a{ zc@-BD)R3+eI0CAEgOaS1ptobuAm zX-DfOaX~;j!LGKMH#4&pd-> zR{-)?O_}6lErYrn^!rVyy$f;?9myA}c^B*&w~A4>$*vu%OTfV@i7ORf69UlJ5quv(%8i-g+NIY&i6ee(n1Hnx&Rm5*h0& zC?9I=Y7U{KS`SmaQ12LL&;AM1&W^g0sFf@!SV9*aczFWM5FAVepjDx5*NgA--#+>J zu8Lg&(ENv%%674~zr>$ab>{n&{tRnilHgt!E(&LkO9B&`V}vQAdr_zb$FYyq$(QY( zEq;5Gun6kw*)vjmIaH_?pc7RA{c2=2pa|BvNFOf_CU&(O9PkJ^N>>pv&PRZDiyB+? zJ4KCt(sjODY=AAqU#i)6bR&@Rr|y(HBpID6 zV5ZL`#}|zNE@}j5anXY>XrNQweiace#v!<7hAUvKAgh&aPTXy0sG`M%ZTRqo0?Na> z)&nr{YuT!7cW%A-S@G4hhk(8FF>V?I+U~MBZlC4Xo3|gI^YhvX7+v(XsXxb#)VZEm z(Lu@Iyd&6m2p+($4Ue=<7}YQwmoQdcqaISE%Fw*rbgL^;m7+mYfdG~zOwd(dm*HFIEFAu!RxZHm+I?WXG!4>sx=X!NvoGivtT`~74srqHAM4joOov}P;aY&rRo zRb~qNZl3>;pBp1u<5`=i7G>j5gIhdh)fM1E9vrUHX+BeP=Clz+ z?cim3plI#78;EnltYE07o@7RBF*iTG-)w8fBCa&n{fm%Fo|p{PP~iG0@$mb|+o?Oj zitV1k_0N9hu=wcSP5I;0O3#4hMx`5!6qYjE_SnMXJtkTa;BZ!ISZD2~#guoPvxmaGe(8iOPl+ z`7oRd?zZ4-2tS0uigCp%ZNmR6JtjyIqJplEXtix3nLXk11L3Sk=k0%jXb|{BQ+G}n zD+*yriOarGkL%TIxZLmoG;bd(B`$~4*3pH-uXu_!!KvZ1FdRG-=ESIj&c43XCfdUb zS}dEc#tRaYtO2x31=I_+jA!y9MZ-=}7pMH3*h40aw|b~(H27Bl0`_2PiiSTM8V@Z1 zQ79i3e2^C+xI2@ZBA5@~UCrbDmMV#nMHl-em&I6zOB9}m-o@clO18KhQFGU>R1|#B zul_nlh@8MFwo5#9bJiXrWUa1z*wpqF;%I`GCjGSW+7lyYXRv<4`-D`SJ``C&^WSKu zGj^CbZD->B#Nh8I?Em|Nq6$Lya|8iZJ?YA8N$H==bEZdK3XDu^=X7$)f>(qmyOV@m zW8hf{k}8>ae5eJY$0?MVsQE?&CEe*KPXs7khFLvp?I@#h;)T?UpdI13FsMY@lZ~hJ z$}kbkd?IbMcYV?7NctG?IR zdFG_BqHH()MAmnPA0AF;r--qkb>M_>*bw@x>M1F@mCGO*tN=`UZBIzJ8Jtu2juqrT z(9}_TM`)7Ip3Q4st56KLG*eG;0W@X&Cms@&(E3D9u0i&0DL%lG;V%xrUirnh@ABqrFkfLi)RtC#0R<@9wAk0^XPAL}k z?5E|q&YyoUk8HW9ghFYX_Iz1x1G#lgS%Wz3ue#;_3SX--q1FN$162xC{Ghm14?jm= zxucY>aqVfNHI6GRgk=0ni8Kj+47iL!Se=CGP%OW4Y80S~1Ya0jYmJyNu+W2stzVhM zaUIFyPH%NkT*@E+w24o&4RA6T(L33@6X~UntF^#|g}#HIn$R@uE|OGD7~Um3&RQ-LgV9_y;1*2w z`tIyj7sZ@vM9I(MB4qLRdC+hC=t&PXl2a#DN)-jN=TR0(UyN#MmVtM-X%C}EV zbE)aeTL=4>boF4QyAs7|c^RAOq~eie(o#rj)HSxV^_47Y&pp=@*=bKw)t+64b<V8ZYR)EPlajgA=6VuSts1|`zv(L`xx}PwKFg(R zEVK1Tk9YdoU9)7v%JR||rD2z~o#ranc}_=PzTP0$BU<@c-~#LtUr31BxX>g|qURiJ zvu7l`hpvGSMeQ|CvP_K3Id;}JtyF5FYLInImOIwXI-Z0NXc+Q?S<#& zeHxb^a6%;dn&>XGPT@3Z+N=1<*LB^tBrKU^QoA^RJ%8SpRS&|@8v49;3E4<}VhmB* zgW-FJb@Iq6*fR8h!4^(J)hRgB)5e=av*xnE;=ncvgT!smLNOS< z9j|4E-0?YEwoD#v6_2RzI09-MKv5H3g&`Q!uBu3mFHH9?$~@*lSV_b_2RVd^q_`c` zSbE&TVwdew@8^!?ClQVC;W!>>xQUN;hAUe@#G52^p4uo33!P&YbWGf-7dV6EDxdzq z<#G1Xis;b2!aJRpI@L`Ap;t@!A1MY;uQS?Sw00J_YW38`4_vx=n3WQ_IyTokOjlg! zd4h5##G2VwBwyU^7*NvCVT?dpC zG#_UKDyHt4x4vA3TQJrWn51odw#J!W|6X|d2P>zGEmOIwNRR8YlaVmgoz@nDKms1A znV?2upOI)JW;Od>-LtYh>GBkl6`IwdPlhR4Q^X>rZj?GePL-?Yb1Z)&iN?k1H3Y2j zzeBzOO6=_UL$3T(kkM!s-c}YF$G(dvv|N|t0*6VW1)z{H;py%;+R(5JL`hIsfcV{JsQHl@B;(${b|+R{|{ z<_x;>+VWXBlg@SV1ST304h<<3;p$md*l?mIyt@n4mo3H@>4E@eE>A+&HS0d8Ms9oEBy70-MbL;m<_)<^hil`_kk}meIu)T3Z!G zGe&Mq`ViX$TrZ!6U!~6UOvz5|B_?zR^y<&#UFb;i_K1RXSytx@lNSkC z9v~y*U!IoXZ^XrerHZ6fM4*>qL_Lv?2`yUSS%dNDZ(i*6*QHT z8g77X|Mmte+gIP;nkm#IdfXuib>E^=LWBF;HeTU#@tLaIu@wuK-uO-hpLd73_@3vQ<8|_@G@^Of;(3;b_E3C6 z!SX6X6coO`Tq%EPu?EBF?;Il>SFm=Ol{;-^Y`ZkVDSm`6FlErXBj!O$Ka%Ab6W_37yax$M*-)J@v@6zCow3DZsjw|AVp;ANN> zj4-F*5nb52r?^yJ!~OJ2*c$EmDp;*yaM6tzKZ_A*Iw9VixR4rbfa~)sQ%z@=kn9?j zYKia0hw2C=rRK&jwmQp8qc>$fxLt5ebCV9ZSLnhk5GKhH-or*x`;86cfO^Vq1=Ylb z6}8IrLs+7b?Bt#2`)U)|>Gz6HVa~ysqZ58vAl2ZWj5Ls8PRrS0ULV_Ixc?PSKV!MH z%{Tbxc@I?6&CY(=za{+sdPJc*uQz!r zKR0K9UPpdMmkr2zOdOP^eWf^M;Tg0^ai6G@J?Bg}HI|jdAJ-Qf zLL0Uv+pY?UyYR?x0(v zL+@y*8>>ux#vWvwZlGbBQ;z0wYM;Me&8ky2WtGuElvfTcyr!DIBTN&b=*P{?n2;f- zN-!CI<7Ukp^{7)-wX!HS+m*2StdCoertO>U?^-M^lY8yY{P}5 z8va))lOF567CqE$%Qk6`6jRhfJxGx7de1Xc6+J!sPfxf!xftQ*vw&fJ^P6M=&utjJ z8`CzdTpgyU!ozVg9kE-8cl6=ZjjH`Ypm*orZLSjBy2qk{5`xzc{}qV!gT}^!uJ^lf++TpYOGqAR?z73pW#f+Y$f#v-gUBXzMjO`mDaZH_HF-*Z;4|3f2!` z_#q0{lq0v^|Lf=aK|#kS^mXp?m0M~5y#F6h=Khe2i-#(6-6KF>zGVihpt0ps?h(KZ%{NxF$vy5R)B#Ag>V=$F70_op z;@W7#Y}*qjh)SOOxIbCn-rh~n`cORPU2Do+909$$k^Cg_8R^8Z zD}ui-_9x*uUR}mdhMHkl?*f9(ozO>T=3!yJB;F-E#U%0IX8T1Z2P0etQ6DCz#A-T+ z6P08@yG@UP13n4>*;V3b@Mpa-4>JhT08Ct>yK_Io)9n}-KR);|7b>Ll<(eZt;`@pU-O=o!bWY;_>8mPnEfkK%7P}l+Z zijp2IzVqG(p!E~aFoAbCU{1PY^R>10T1C&bON~2MZL)mjYt}&_yghpa1i2+p_KAL) z0Xq(JDZfa0<_>K1ZTY9J6zQ+sFD3d-O77j_n(;nrB{Xcn_Z_NH)hMkyf0P&BpzR4R zbH_mL#h3O2F}jK<-UGF3$Qz`lvbBQ>c7XrbG+)>;I=DEzcbX2JqC?47znn&+e&0 zPxXGQad6;eY={zxG6d)wPX8l8#~6?y(!Sy^Z|L#o)#B6%7YwK7B=_Rr@YzEJtsXL z52UGzx`9}R?$%DU7pkXdt zaa&?&TLFN#D>3)mj5>KBARq{*4>k|4bE~mBP*;`th3`+#T`;Kmka-2Lo?WcIN9$(U zQ#?N4@VROVmc=d(mA#=~5CVjB1sF*Fo+uT{tvApXf>2l|;HrH@B*PEEG;`L)yg=r* z`LC}I#V}H!D;g$Ll`8|Pn^ExItEU5jA+hOg{kKiffFJ-@{}`no(LwG006{2Ln0CH# z0M20opqBfqL5BGXXwtYrAD4n?>0$Zoqo&hBW#G#UA?U^(0%Tmq1wlK@M_zVkqAAVl z!aLC|=9|akrPmmt6?QTXA0iucZ-58M)d9C#yoQ%;Cs3=E!k1<8|v z^bK}n`?G1QP2r4FsS)KgT71G+;-#DC#TTW9U${@8uk}}r`ukz*lmq=LpWe%RMBE_?6C0KqEz35}X>^$h(8}(EQJw-GM1YNrRWsrIQ z)x1AzdhY%2Yg4R@|1~ETj9jlZN2p-+R?kl!0S7W_`o4)$zT4x8N+!xhVsI)^2hh~p zEu`upe+sO!+*8j~iYh@?_$avWXMihuyq}AMV+0OxtU)Zd7e10LAEnW6hfI$ zr&q)T0ztxfz)$fygp-2FV<-e1ttw-nxOki5=t>X4J#*Xf2<(LF7|Q7Ij}2uB_Uz`m zKe|9KZu;lp*sp_R6O_=%4Jh`5%O*`ASUrk@axw0GRmhAA83?)avklO}*zP1Y5LJIOtQUL<1 zI1#;<1W5~RR-6lHY;IU{mQH98g8^s{StYkLiOCk0$_)r~sB$-Ha9*I>T#J%faGrYLPmBb=m z6a!ilw)%OMq#|yNB_{5$zK$f#O2Uae`_J47;nPi#q=Yll=JzYMDQ7o8PiQ{KcVTv< zxQLx2b2hQyZJT=&o3hk#-L@eAORc0y-xKdPspuv83+Qf5K@hQvEbYi<^YQ+de;qpAysf%I?bGlOfbUsHJa@l%ZJe!|1|5$#?uBT@fHp)6ZgDq*x@83(y zv^fFWG;FFOB-;-Qjk(ia)39r>Zfavef&dPamjrZYIT1mgUVhVXnbK*JAUy;4;cmbW zGkbABEKSNeQsbF#j&MSxCcs_xt#Ft({0aD@9RH`06yCUGdv=y5*-RnAY&}Y>BM`2e z&MJ{nK^#|yVaA5qQ9dd07IWj4=2+!AtnM%FHg?ogAZYCi!oJ@&vOYg%Ad=yYLxr0k zoX~>`jeOzy8y@aigsBmdY-L7_vX|jFePo))I%9Dx^JD#7a(wD~!cEd&P)-Hw_jVyq{`>8lQ`%ju%nqSnVq?7Pw&r&Kys)+E$i4iUBX0HwHh8+2w38;)rFW zNy&#;CDAWunCE5r#+~Srbwe&g8(2*8aOL3-%c<&HQETO~PgufIRwcFPR2pQk?2tLo zmmDT`0>7`fBGvrL@5*=}o^UZBs3&};Q$?{+A$yO2A>%-@K4B9k#n_Juz%>87Izn*b zG^?YvNZkx@3H~_6RC6QuaBF^Q*kSparQ_n_Mk@OW26{qd$>~Y%$=9d7pC-d+AmM@x zG`ROB3b30=Z)g!T8Pvsz*2v=l{4c5xE(Je+`ES26r7zH`{=G0zbcE-kkmJF{LV?K+ zPKsc#3GZrVhG4sRbH~}mP)4_s3J|Ap>k?hU87UV!w^R4WJR^;5me3fi#Uxwijq>rA zEQkfL?C#J=)NosEP8x-pKJqn@xH>&EL{@Pwz=8p)4+%KQNn&}?f8eP|zJo2 z6L}tBH+I#&^E?zb@+2lSLZl%=T56yvIN2W1!(XW$qUd^-1-z53m!v#5?)lO>O>(TL zrv(0m4&y5;&?oeHmD5LC)Y}x#jI$_fC_ZYrZIIac^ow;$Qd+cVl#VW4rwFC~OTp03 zfnx51*7RK@8TfOU8Pj^b(6xpm*KqHVhY%K+(o?|U?};|dB42J@^3PROKsR6j5?F@}i~_Gf~n&p5G=FSKw2RCElCH(5D-63f~^@)uo9 z&F#b#ae9($@+8e5F3jYRBLJO`@xR;5@;E!ZhZIHTG=pJB$Vc;B1HdY*#RN;&-l+Da z$wcYeWfIa!%1KCVM>)9!GG8N^OY8nLs}jFZ-89d~=M2oFFRYsPQHOana2h3HM@GBy zdh%cna@r9a+~7V0uXu1tDD?BGZd`8<(ckvI3!RRL9q;2BWr#k7dHNACN8cop$>3Ou zvw9HlqVlB{#Fl;L*=5Y7!ZH4_PTDttE>v(yRV^{780GJ3ibT3XA)ZUs?d2e zLRWQ&3&b@#yWG~`aMRW9dLeflA)jXt?2sFlY<1TQ(*?785znG1Y-?4-4e@WFyfl-M z^x;t4c%(Dplg*Q? zOItAZQJe?vrB(VPco0Rm$1xK1%uZ^&+`LDox#7B;6DuU5J4@XQ2wCDn9#BfD?d;K{ z`-uf-AZKMF-#LaP)_m}T90zMq8e;>AV2=cMiNHugP;W>*-xF)e&UJ(_bJly#C*zi! z+`TDD$m(&8WcV^#KvW1LKZzMT!@f`pGh>s`f#m*#m#kvz1XKE!8* z6N5q6o7}j8?+WMN&4d<_o;)1ht zj9>e9T^*SNAu)5p`W~Jq$QO~+DNnI-SEZl24!N`so!|ZbVR?j|Z?Z3_t;dOe zh4#3eh7G!Aas$Kg)n}&N>Vw!@M4hygy2&eCV!kGGtiMM@a?Cm&9pOS#PVu{k@x_A7QnCcfYIrY~uyFFw$akSSY@Ek=X`nc1OP=M?k}r5rIovPvAfm?k zM}%EaJMKNYMyq+BzBZz0^k~KsH?ABtB!eEW(Rz(=sb9Y^YT_?LLr)tJblQmz%QnN! z1%j$r6;_i9Dt3|Ufy`b!@7X0C634=QC`}E@AMR1#&}ZwAPAE82uIezI_p!Y@;U;}2 zo5?Mnn@(URmQSY~p4$MmYwaTq85c>M5@c!|uk}=>;H2>`x+||Ta;^O^#IUU%2}SWW zQRn4$S7m7x2$Wl~r`*^Q9&;2bA^5y<(0o`Xw&6`POjl6fH@MHrCe;Sxy`EzAgv0Hb zk0ys?jCRLYLrP;?68o5XZJSrCDgNM zJcO*_A^v=K47;?3^bErwJ{FUbiaUgsg^!i`qdO#^wNXAzhJ-p6|sf zW?l5Rz>_~lN(-dE;|bzfHV)lrJ~O9RP^Il1a_jKLGNm??Q;&eE;BdKJ-^93LyHan> zXAA!+Dg&rgG!JB;s&uuTvFW;+H!vVM&Qky$m-{8}YHL2pg^_k8dm!Wu`eeT?^5Z9!h9G)hwpT zE4an*>_Ex{&lgB5^x4Ab{wP72(U=FF!yi&=$M(AWt@)=1lX5G<$)5^ty}8X8Vpk}J znHAl+F56XBT|l!xAoks;bGt>~-jS8RE+rYGbN~9qwjHW5%-Nxs+WP67gK!Rf^4Wxx z2#FcDY*xa?o_Vm@% zak1@ha~GOnxlmavqwi-cTuu#Em7lII9oWMJ;b?7*=qqF$2OUD7bHDs=KYdIA=R1FL z^h{i6e(U*@v%a~}cMGF|<%28zmqm`%n`f#V=e8~`H>n$5Q#nxq)vg3_V4Cfhs3rq6 z8{?YmNkc_-3~M9!vRE6rK6P^3Vh=I!eoW!uqi*P1(aAGlZJe-!i?d0Nk1hYrx6gOp zzcO<5(yjT6{o5;}!=JF3M^KI?zMtxfvOk+SJ9u;Myv)dU{8P8Qrj(v}F6gz^@AsX5 zWI6vHST3L1fu7y-m-@d4i~X&8Dnc?L7njK^y3cPrZig zB^9gI_OEZ4egwVQ>mFjZkGK`~=T`sU-=sf+Z0Uyg6yN&%`-93q-0mY1s%u{W{HEW1 zGEebeza<|p@nx5IiynmietG^a2*(Bhty^FBR?@$J7$?bjFhh`EulwTd|4&@S0OaDE zx{l`(Zw96%6F2&pWD19hpA>0^JQ&;lH`Q1X@*w6fMccka{u}r2c9efMNcR*G#SR=T z`@NI!KfaZs<5{3Umt8e>{a0yRk&3(}!$8Gvy66zNe}7O*|A6fRoosI=+Gf_v*?lE#L~{jqm!OHUaAG z#-QN0a&X`_W@z9AUeIqNx+{wgUNo$<`siB$(26G2hvVIpOVw^ z5K`U0OWz>dreYLpc$J_}Ph!phl04I80H=J!iK1F~Fj`gia1p%!!pDP!OP^MNc^yp* z1^x8_2$nJ1;2?)#hgg@-pOk)1mMv$SCX9obG zKMKMurXKGs&6^s4e3D{%uK%jNUKx%cfzkz>aUbaCLAr$OUkEah9(4r{^|23TfR1zm zS#j<-dL7wy?BYme$uRJhkAhT|6=H@(^Wz1MZ*IUY@Ub2AHTF-{rj~&D8C8H%?W-n2 z$@d39^61f(h7;I;|ERr$R3^|S0f|-118L5c{xiWIqptm~KxBP+2s#F=0c^`k4K3we zM1~hC&P)$-7+LW1*)iJAIA8RCuyIwnJ)$$z5wN<2R?T=%Of91E$P?TlTrCeXFWpsq zExK*go+w%`So%eIM`DxB^e5<8*s#Qu!=GTB);a0SpI|CLs0lK08SKDvqrTnyj1F39 ziBNl)W=Gq_XWu8pokoxfYA(`@!xax#n^F2kh{)`6?67Vpm`gZ68u~;Y%qcVh;gTN= zo1|R;nElwD&FUD4!)sQFE{&Xb;sw>mEuS<8eY033(7p36^)=FNbt_E)!MFqAzzyxa#)=1Ur04uK(;~<}Mxj*jnL@wh$x9R^Z zPr7GG_NUq7v&pI6=tAJwJTN}6HwhQaP!4o-jo(v(7!hG(Tdc~64`J)C1{cVPk#TxKj%6D1 z2D|slPz%*%5|U0Nme0hia%cUt>dzmOmdRtF^WhZ2>b7P+fjf+1-s4U%>6u__5GA9B zR4Z2+npS=XwQuSD2`Lp_B5%*iNmWN}d3F`8oLC>B8YQpEBsg4rr0{D$QYW>+)Y^rm z?iUEc+Zg6(;WV5aC>@{RDdI(sAx;3JR7YbR1{gr3u`iy|@*aFtW(Xg~mm7YWAzT3+ z2^wG?SlsWuZKAtRI+g4Ou(t-Q{AcB1I0_nlU9YXV30TU!Iz#|_yGgQ*v90}hpyHvq zf;J|Tvj`4?lQ#p{HlP+WdHHu{fqpoCJN*A zz*P}v;AZSl9P~?@Lad)FV3BW1=pc(EZwG03wU!s=TPeTEMLsLosaxn0PFvWOEpzGj zwJm*wyuFMf&g;^m-XS_1mfba}G3B~5XnSZ)3_SLo)tNh}n^xg?X~cmYADU22!U+Px zm&&dLB1IS^fd?|1r8q&9Tfw5Z*k);N;tT%xBGw!dPo#$f-v{5ES_`u06HEY3gixD3 z#l5;pT%!6w#A8vy9!bfOQaECi=m^=Kgj%vGbJg)IBjo7TPeh-bAj81>&s(y!g9)W8 zjU;S!N)+6jBzP^XEQ(cA&)U}vC;kD=gb>1Vp60x+&&VSp+B^nA|56C19=TUtIUXaN zzx=8s@&6G(Db(@-rU4s6c7makjbXQ*@H(bQa>i<Jwj1H*^sMXctKH1^-)7v=#4mz zZ?wg00B=TvM*@O7^c}l0VjcLEJTMV%uu_R1qM%DS_SWJTC!1bhv^v|obZyjTv`a9r z$nN}C-l^|fL8Q~**1W%xU(&g;jTRi24Jsi2EV*hXX?EMD@{`N*U5b;GGY+T*R6F+k zEDircwh!0Nu&e(u>^{aVxHj?3*BN-rvdk3zqm?Yj373eO_kXMlt*L(cPGKV|BU`j@ z3d--4J&OcoWCh5XxEF6UWNoAL4Gb2MR5&M9YLQ52?yxK8hyW4F(k|X$|5GMeDVIQ0^6EBl-Vj9O`^pxberYtbNvD*v@FH%aJB;*e7s9xsb{>~|oP~2dW3<8%EbTrjb)2au8R&aQ@ zXjB8GXr(*^FKdR&Kt8g-7U>LlhVXSnvW2G-W1}f6f>@HDenQ)f^gQe>_@~bK4?W`V z%nLy5aB|w|?*j*4GTaMrz5x@0Yi1lmRyOoJtZ{En+glvjvR@Hy%k(;csq;Fi3UdD4Lp{ z{VY+8(wbDFko9M;lFQOKE2<(swDahL8>l0aNS zqKE!c9kmaH@LVGzviX4`QjyXpi9Rs(1>@&HqgtzGsl+Z*DooLF6_gw+@PFYsG0_sh z&UuDErHN-mYDGM+zFknANmv!pK>rg*T@WYZ zG-hSui`B0=>A=89=~JFX&`Fv3FS2KX%bio839^c(+z|mBd4%?Lo4j!gugzmERu-C0 z6%tz;hHwe1Gh`-s9(gfe_Qm@NIcv64s+HLv#mNx;urMG399oyw2W)=piF7n_te)z# z&aX?bk9q3ZtMk~AkCd4bIZZLlbMDT(IX-TaDTGY`oJOLQ3>T) zVRa&q>$7+gPICHnjNX&V9DE?zOzz@@p>3rV@=QOeM8QO(fO9!UwW(dc>&3QlmxeU` z42rsk98R&UbPlC=qiX4~Lm;0haGes_icgew+1V*Pr%7msIUGa`n4$~L zG$>(3o7BpeHLf>$H+^`BalKF$;*B0Fj;#EyVLENC^ovuZnN?vJ+h(DDP28mpjvPZ{ z-w80a+c&FlCAxR%r_F0Z%CmjQ7vF8bMBpWN&!4ySM4z#nBc=>283iMQzcif^hoVrO z_9KPuwD;i#X$4bqPSt`|`0EQGIGp*&t=D4FL){OBt59rL_T$u$R^3wOn_*J9H`VyK z!RR2ub58)4Xhipuouisjuku{6T1=&jB~M&OBwc9`rnT4zoe%wVMDUk^uQOF}uG)33 z68qed=J*bhlW{jaMhKF-X3yU_`2N`?Glk#3IlY!ECe-dK#X(_s@diKBP4+f(`z68y zKKX$hmA|3}(5IYQ>i4VOIi}gO9%EIYdI6p_0*N(g`*rAu!RvVinukPdr|^XzU;C7I zGUTQ^gD$J}tkm(=_c-+&phX8q90l5V(X$BB=OvT|3_6$OmP@~i={R=WGAj+wUjFKo zQ0nU_&C-)Po%f_%Y#aU|I0{UB{-K}`33Ir#n} zS48*gR7P6emUyd*$z5$xCkIFEV&#QmGRYq$4-tpDK9w#LN&sRezmc1$?#Tl+8U)kM zBj`(%MeF*wtJT|b=iROz_BU61Sd65S&8)=F-LSA?E|$r7X)Z z&)%4u6=jG6d{k4t=w5BQW`a=nH?uXJNr|o|>vBI{OOAcDZ61zq3mn6EJGx_ z5(s{x%u5)zyem=j?Kj-FLH`iQa z<~{FuzaP*0^Zsymvx&(09&PI`zS{Ca+1F)1dtr;m9&tti}8;_FA_eJFldI^R3+9M{Nvg107Ro#TJ~ z^EH;kQ*A178PfY59f$)%;Lo~5r@qOCY~Me0=k33RPQTmifKd#FNyz79+SVpuHJTEy}2MFFY?Dc>j5kkrMUvwz}LO%{eK5~ zzyA<**yniSp&rc?wK!3VNzHpq2VRGN{x4ibma* zch+c-DE*WXek-rdBKokz|lmVk{Cv?TNW~1Be3jwHr2W;B~L5BZVqexHl ze-Wrn4nJ?ASZ@;D4Jm88fVFeoA1nCnx?3Sx!sjy3Q7~URTeSdgk0`tQAdkUA@4q|- zS~`AQ)LP2`v~&bCsIzj|!Y2)x4PQ?6F8~Q0f+}6kq;m{o9Gpb$26~`yW9{oUSg5{T zZ+s(&e>g*j>&NwF_Y)8q_^uMD679M&_3c1p>I%YNt`f?AgoTw_Y&EdX+W8!%S&mOh z`36?}=ljXx%%b%hGd^tXf%cxQRT}-*}9& zF$`5T2KwLx?I6 zX8o5uG5WVWG4(*6h&%jmc_N$%FVrSh2W|4|BSidtnSpN2f%|l%y zw+5#Y5Hs3FlmiTG5Lj*(sx3?{C4pqloL~)Zq*@BUbiH<~2HMvO{z&tFOfhQ1ZRh(+ z71ePyKQG{FFljg3oJ*V6|cGv0^wMopWbD;IML^4A>?!nY z=hSmR@c&8l-F6r&wC7$9HG>u~o9M<{e;CkT=U4%Mc4Jv`$`2M$TSfo2m%%zSBAuf@ z(2~9cHa;Z~V)ryl^+urHH<0g6s6IDxXgD<}(8Od~{$b5X6$xVo-p+iWjwq!}hvX2D zcXRy=4>66l2IBs_aUxEQ zQss?21)*YLAXRO>Nj58AHQpC;tXtVD4J;K?>=gOTGnzhNv4TGpUlQ%TP3=wL2}v}- z2EoE$REOjG0V$*`af^?vzSJ0vR!AI&-77+kT&;w`^@ih2LU=Nnl4%K6T9rcHpbSGwsd&~0(ID8Qg`hna9Lh~1nC482uue6~GU_DB!Mf|oI z2(CwI4D99h=||yjS$HoH`vMigU=}!IR`Dv3{Y)*lMfbqQ>Cij>O98M4)_mR4Rmsgs z;1}NSZdUJajGbnqJzw&RHa%j%RrvppH7#iS$(mYHjd3!;`ayGcvn3k@*ILs^GM%!n*ODKi%?E4+T z+v2X=UrF#Y;^y=3Hxe9z=#-Ki7F3RB-vnpcXRhW26h8zO;p^W~fx?brc^^`hAMeCW zHBmGk>xQ>E#h_rF`>9nH<(HTz|&eeMVN)Z?VonBAw`-taShMb^`AWwDT(=%=n0bz+qNB^BI%gsH z^)hTvhe&Fz2UP=yiNenRSK>7LC0-Kt5q$R-O9K0R#rPA4kVCe$F3XtjiYGC8gxwZN zQy7Yhb_h(}=K9HRw$=S4)~U}1{?E`UIDS}2=!C=`7aYx2jBlp-#*b<|n!;`R)G2bM zrsow)X)$Xt+h^2-04*Cv@csA0!Jb>yhp%kM&d)#w1;bvKgu?CLSG^lfYtm3PjIhTs zeoS!bdsl8LCOZ`?uV7**aD;=xhYU?_AUKe#Ur(Cg@V=y%Jw=_IdJ~?IfAst$Obd)7 z-+HGV=B1CLZP)&q@?$(h`KPw_C7irY_7NML9FF)(T7gf1q46{W@%f3np9Di*-Rg54 z;4dXQOyuKt)dq)Bps`B{r8wU?cqPt0n>knPNTG$9()dh z<7a|$8F~B|z3R^!Xu`;P=Z=38N0f#9)YYz%wqS6%F#lka)#M#07B7%ZLtl({>$Z<# zlM?V|Hf7mlJWQgXnF2-)vEsDjF`YTYDKxvdOGmvGB}hCnwy&&Jkcx*IQl_lU(&mQy^IMJ0D!{&11 zE>^QnQLU{)T?IyP*&aD=)-Gryr%4F9%?+1DG4JP_X5IECN5JyaXM4Ls4vP#$s zh5vx91PN=g@yO$3r`QT_@rwG2P94`yLGYK5zGXDEOIu)P3Vd=Qq6>Fz2oW{LW?(n= zCMd6CLEI%?qcCY3z5-wGjE*pujK2ko{;hhneTXS9&UY+^~VDxLLN0BZA))aXeZF_6c7pkdFr z&eGvUXe3SwWl0KpB!pphvSYi>*6d)!uU-;hk3@ePjXYyEJm4pG*r5?cg8-UP#vMY2 zjA-$eI%B4-2UUYq6}9pJJPN-YllE{G>%YPF9Z}jQP_4zYn{H!proKI1l0EZs^cP|H z8s-)LF3mc9w@AHx@i+;4^k^~KW>IS%&8UR0A#SDj#=nAPKX_|@GDvoC zs$Y@PH|{J>%E*KFV$T)b(k;a_wua*l;Sz4m3Mii*IdQ4mevF>l-S;= zhzQXlD(#W1OpjrQF9O9j*-DM)h^*N@S&3aJM;XC{(11wvwKe7(eixcS1l z#-BRdkFfW_H)ygo)?!WbN-27gPdTQ=O@mf!Fq~g!RN^07`3YVJGsugEiD6;QwlZ_6 zJo5bqgA!S3;uf|^Q5*YooYb2msH1PmHPkOYV1?(~qaxTY%`qCQlkcAy4G&UH?Qy6J zxn-6f2s2i7yh|CDi?{3@xLt68=!DapJ}W;PIqS*3+doQ@K%-=w@=~2#(;hT)OS<_m z5I@n^)B=|7%%gtsr9OTkq~C)K$PorGZFdq%rWj?B+je4!sc~HP)1xMs+}s)p|BrPQ zx9h>|{c-8xx3<`DYMD#S<{0-li!g{T9o_pz|0-4LnG^2~dYgwmEmu5aU+|^#4j7bV zsHWBL*2TLssbu39-|slWYK-}tZU_h0`mN!F<&oRBYCQr{Ukfg=nD9`Ivwk%`l$xSA zA0}9o-xIbHa0s)%IylAkaNf10c>Nj|dU!L}wnM@uAz^sbp@7_>vtGQB#Drt^EwPEv z>}M&@XHSnhRm6U`drxpxa7W&&-NLZK$F3=QJUlk}h(UwF^2GV64=>ukddOjK51@$A zQ$HI3gi=zO??%aYiqqI?ePBtZXWg$IX01duSNT+-oI$l z^qn43->L{2gDae@aw)!-Lrji~m=3S7qJ7HJx;bNqDHRhZ0 z6}u8O-T*OOEP*48R^pC?Ve=S_~}9p zzox954`%pDF`ihejz-j)bf==hM}s5>GpA5c4}jCCmns>*ChW>SPF5S`37Vxx4Lf1p zVxDe}g56Gyq}i5JAM4zhqSazyL$Clqa7G<6ePaM>3Bu)m1j&{{`h@HYFI+@U5=k^M zT-KNqYl%3tDKvu_I4_!UnIldz=&Fv23aZ5a&}A(zHR8%#+n3v|QmU=`fkMQ_T=Cr* zSDiBk?h#{aj)kcvazEpu5Hk$gaOYZS&e^x$U~?SP2777lUXte@WxZGasPgb+L>Qjh zt{_Y0iu8}Q%UmO`&R*$nt%g*$``;?VD%Oebc|A$YyAxAQI>QuK{o|(6&Fe(ZlXaE1 zUyH9_zOk^QFR^Al8U<}^*H;KK5|ylCdt?n;sjr!HdN|ditBp`PNv|hGqh8lcxvp=x z&WoYi!`S;J`q}#>e{>gy*i2gghA7kdT#joUrkSZMA%-v^?Aey^Lna|(-o*9e-rSuY zeIVfYWb^93;H3)5GsNdk&zwp~KmO+u@km4(UfQAPwn+M|gQ3(v(W4Ioby}task4DB zgqM!L%DDf>-%S(n31)bj{O8OV(3GLF4WJVHPL`m~=|3j8Y#`KhocR)x^zDzPU7zb` zJ|+`Gz{i(!QaZn7`+tYQ&;lKpvJ@G<4AU&8Wf2K**RD#Hlr4St#;)MsE7K6nWj&I#Z$-X zy=`l)mW%}qhL@>Mj)Zwa@72G*Z2$c1v#pwJ0*cQzN_X$LpYr(+8Lm{K$Exxsa3j$A zfB5)Z9t!xT=f>-PUIZJ?jUsnGrx`KJpJia2Btkd3ORsd@xLbOZMz5yG z>Jxj?ptkM97-_JK_O_A1x&%sBb*^450hurRm#UWoc$Zy3-Pr-7V_4P{NS>c5jTqYG zH4H$-s^y-2{w18i;OqW&F5^uZ2+cl|y@M14!wFvB!78a#67Y)(+eYZWeb^P@JdS%Z z-W2ZoA?|!qAc<#hzS(=#{Z|)QEZX8{rMD)i-%dTV-gbKCU|hRZ*>dhps>EBB+V_20 zHa*@IwylKU14*%aZGhi*kkfz; zEZb@1{TWpEOBGr^qpzTXB|?Wg5tM+v1s>fkXAlj>&Ufb| zjZY=T@EiN~1Kv}}S#$UiO5WrCS!dL;zXLEzlsUDDH}PRUCuf7r${)qx@t-e(-SgG? zHnDMXu$lLCs~xa*m33K4pyv1Pqh$`pr(nCN9CW<9@fOl+1-gLu$rW6QhpjEV2nFww zc~R#l$1SkLeBlM>!#n;B9<^Tro394T)<7c#kIQQycAbT~z47dcnr;poV&85!8)sf(Ukd#Q|g#=AG}a z&>{<-e?b(S`@&W)IsnGzO<;KLedUy15yAv%hM@~d5uD_pqzXVj5HSgp;D=Ti3R|lx;6k3y!q(s zcg}VfS?ltd82qo%Q&p$yV{Q82*9W17iXrcPPd;HApg`WUL>z%1hqRP@hsIp)43y-} zgE-&yj`kv$tSo?}oC1~(|JZkqYA*0a{nz`5|!AS@)*m?hdfW z*^ISE0EoDwTpesWjDg0oNpImEP#v%<61dcw7u%(*AFh=?`}eoeuOBFIvS-d?g2xcD zaJd-5hA|t13ElZHv7|2GfxX%LE5{Y+X5>u;AJGraGaqYnyuao(RoFMt8i?bqqHIl$ z%!a~Xy~tJBV5Bbrq(9>qAA!yLkKT%6^$US2OTaz>9nHVA0hKV3pV|QDLPR&&{~JH8 z3t-&%3qK7^4ocSL1OxbPNrE}pw%;)qgCU5;Zo*yQkFkN&1SUIf-*x>?%igfb{jGLy zkGa!}=i(ucc?fP(R_*Z6e|HrXYccs`)Nj+1I_W7}0X#Mkw|+uUF`(rUIYRIZN?XA^_Uz03-E67p>P5RH z&j9zudy7k39&Hz4$n1E1*?x9Y|}&RvZ(f#6U0? z05qX|z3hX!PZaW(#KBa_Q-7jizP(nFs7MsoQ}D_CM1B`` z6U)msWjwX3OU_$W6D5Ne!2NKU?QGDP0PS212vIAl(LDS$*bx{J{vp;7HC0;yjNe95 zx2P#GoQT8A%|LASIS;P0x`v4#^*@hbJLegI`o`9I`iU_Swe=1&@ID015>(VOj&zWX z`tG%xLn1YKDNCuvGNt5rh>+k= zT-C?q0U&;@PXHd`DrDl(f!DbrsNSwYm2oq(Xdw3HdVh#@J)qH3zWS3caN(EGYUnS) zmo9`<)waqf{D@p(4Cq0>T1zODYQkOD542o*vKgOLQ1 znn6JB$BLiiNNr>;*sJB@5T@RYv42Hx90C*0lndaXLuD27BH4(Ic(m$NIDfvEY#4rW zidrs4TJ}!8C^_vJ3mpIgKKv1)%W7nc#i7b>-K|&&@UA^1-E|BnEaeH`o_PxPYqr;c ztNB6IYwi#Vsz{gqi?=S`B5*}I!ub$Z@H1mAvI?n4v0CH`iZ>zW`;v^ZGtMgC(+C*q z0p2>Rw+0j*8~v|Nh3G4s>Ksde1On9or!fqzbne*f6AVF{SK}WwZ;VdjZ~1Q`2^56m zM$fP##>%_Cy6D8r5E&_Y#7R&O53_nq&&C}W0XGTL|GotoSbEvmpP`nG@oQMqX99Ne z#!~n9ABTM-kor*&o#?(e7){#|^9WmzYtVSY+BRRE$#@o@RspLv+}9SVY?ld^EImAXKypxNp&c(FzfXME(8ON;HNSD`u!!|9T@1KuKs?lQej zxF)@XFUIbz%z=7}S4`WmyEPx-Uoiz<MMi+;(E4n z%>ajrhr0_j9>WL@)l0c9Uoul2p>GkW@Ip+CG&@CEucMJOxFO(O)kJ&J4kN;f3g9}+ zLoMcoM-TfJ)xj2oOh1u_QCB@|Ld64fbNllT8d3?7A12W<24#i@rYhK@tXn!%U zJON4?fz|TKYKI7DGA|emw@M$!e|NwF6R3Y9jNb@%q+WuoAWWrw`vKMzl|5!0WX4rj z-%xlD>y>wmjz%|71~9LC=Cnp@>S$7r<+4KBM3qvy&13CMjnv1iaXBCRdALbXls=7^ znsk!GWTRZ^H{qk0h>+Ei&E=11@Abr5zi^Qwy?Vqe3HFwve$TTEI0$DLE#ZAZtd}@> z8M*X0u{}c`GFM2tO-)WF#y%J53K3vhb`)NT*!Ur)RL+f)38kGpv8`@-t{q+g(GaGE zbs;~#5W*Mq3_Yf|1xi+S2+JieWQ;8mV?xBY-9RC#7rA|P?$Csm67%FynN|N?WusOF z{i^ZacVZ*-L9ph&AeSMIF5s2@n@RflLz)~>-^mxvxd^xAks9|v(({UVbQ~iqQO~xj z=vj?7L-p6X22949DWBR{J{UD4Op!Pk$$(BSic9V6RK)^^%vc@a>Ud3j)A2@yCmYqR zjKP|ss|DY>L0R&Y>)?mzCfbu*k3%1x2|q5-Skty<*R(o%!t4atBvZZg+E8X1ro)~Y zp{Zx|xxMeM1C6bW6ex~L} zi1Y9mV7{r`maEX=Zk33#miHlh7jK1?dv)TPjFm14Srd%0RilWOytKS*<~YR>L$l}Y z>t_g;wX1Q?`fjioynb%*@jM$Qc{&N>(h2_yP4FgoUl0Egd4-9p#{MVHL?6cH3Y;pM z65g6-<|#9SWt%q|O3W@{uEdvcSfTpM{kcBQqKN14V7JCwR^Tc_Or<)HGKro@sHxRG zavYn2I@kSbp+u2-lR$e@eCTnA2=52WeE@lRG|LRRvf=KrUKt8ro=fx66TS}RmHk{P;BVK2KZPM19vW5MBy-5 zD7W_3li>95$+t`wiaSMA7e428ZWi*{*wrX}tWfCeoN}b(LrCFbuwy(XjYNByv;o~Q zSyX1zj-LDA+PLBo)W-Er-hEDjmOvLLVm;OUk!;H$X{6z{^;`dG$E^@oq)D-x8Mb5d7R%&v+UYVSQ03ri;G74v_B?zh@Yz*Z!W_Jx#F*3U<%o;w*Lzf+BHJh=jK8QUsRc?JQ&J6x7h}O>1s)BG&XE%h-Qqono zC^KW~yc|^?tz5YK(e?{^w?Y_Qgr|^&BJ|>c4<3%F>lx8&zwklHPSNLFzt@Rx&Q$c(ecI`hT1tICY37 zRV|mr9(~au;x@R+LX(qYRkq>t9t@YYKIzTbc!C9`*7ud}dbGR-GQ6Admtz$V<&4{V z))p2@a2yOoKvt$|Vq`m}JNWB6!P)=Nkn0A@pfY<|Tk=3?cPCsnmJoP{s_M?414R$g zr~=Ls?pRsr@;>&bDMAOoY5shOXqlFCpKk~c^tb9agCZ9j; ze!`V^aD@2JBgsS2qVenWKd$vtJe73=IyM7O%5vr})k-gi<_BCYUoQPWBF&cy$zQ?E z=((5k9YufthYtQAt4z%a7WEn~ZxcB?{P`ujOg!;i_i|;r^}#dOUtdC;ZqV1yv9j-g zR&$2h+JAtQ$kDrh4n{_V)n^Dm*qilG5=G@T7RZ}z6V5R202ER1K@9+YiXGakd}m+wSWV% zT%PKJaE`T>3G`8DRvgKS@EdGZ9v`eIb;>_uIN{+oe#T&}Yr!xsyNS> z0L>*wDvO{s-HNVg14reX{b0R*q{mP%I^mGXOrh1M0nljl=z_!Hv(mfkS0L3_>DJnG z`A=IR3shmdha#v3epR#iYd(jP!! z+T-GiiUFweC(kodd3}>atO~4V>?Pjq&Q7>t9&5G}t0BDwH3XerzUGqg}Tod`O@fN?Z?4VC`czlN3}(H2lb&t-7@vW8G?%iVc^ zB#y(Ga=}5+Z|L+vWN(eP{Oj0qS6%1ocVYo=XjsG9Z!=aOlnCKDrhx;HHxNqS_Ai7! zH~T4M)&22pLCCgft+WCv@ghT)rt+Moc-}tV7`o=EX-T&Zbt+-h{R`2pet~Gy1+ZmK zNo65D?9jvvi6EXBfj7ls%0oxGeg*2WUUF|dYq|xDq4&Uk{wU5BNCKxo4mWN_U~U!jYo_iPIQ`8Jx= zTn9T3=uCT(3*_jTaxArwH9xR065!5?2PYlu3Pa8vBUrCPbTsAR_!WTjY?eaH z-2l8kn+;<=IDqi+C5;j~o33VRvJIA_%P)NEK^N15V=&F1TVxfFF+r@qjCcGfTnCRYP`6auHnq2I{th zIr)s-p z<7=9f1gPVQ)hHvnc3_$t?hs+sma^+qn7E*NxF0+N)XySjyo24oV z@K`|B@{QS=PcL|eigej?Bw|xM4JRrA_pjUNC}tccF=m9%yilzE*p&vkSdHAYB=>jLc2S8> z)~Sf7Hr?X|sz7!+>N4o8%ZL9|1*I3E3?eP=qSuiznnw4yox+6zY?*G{2ZZcUT*%vx z^ZYD!Q5VbgyoK71)4z3?yxNq9A=r%fMO>pajhkKuvzY}zO%|9vHS8*~>CM;HQl6#z zgx|qBt#VJfwQqu=c8>@F-E>*cgXeo6DcDtoh$rsPIm4wcY6No@13G_;^s1g1k~h9i z<&9oI6ZzN)-zPzqcw?aKO-Q3l$XLk{hjJ=y+&ttWWWc^eQu&B4S%p|ov;XEvBGi)Vp7AnZv44n~nc_A5oI$S@ z1!&y!mWJ@8*Ql{$W2dPnYyvFEh*ZGoS7?lrjkr6=0=;_-U9YwF;Q0qECtCbvXw0btSDHgp;TCW32 zcEv?-Ua9ygVr54wg{?y()`;LkCMnp$VPpB~Ldy=eQ`CvYbcrbgLa@H&SCre8U^6Rm z1L%qu>$25;!Ld>yq>ZOAsBSezD=uFKQ$`fkc$q-UIFd@<^`^(lMeig58aH*;RzY@P z6OUHq6lp)y$ZHxsO-U$o18}U-gU>}^@ubO7UV-o)Zdcg9?eD%7z-YHjklAorig}q= zEKD)VEEnxfqFOVqM7zy#M|t*pL@?YdQA5=Hdq?1pqd9hahNd1X@ngeeUb!jNVvu@Z z+iP-|2xl72nA{Gji@TqX^|m|wb{!y_91^5t%RtRYT>eR2@`J{`Odi$yVvVIG?}}c& z-yFo9z%Z-`j+-IHAloevuznC_zd}cSPKfvt`}GP=Y7JrPwM(Xq7}my@^rM9^d)4p! z?4yv#h3{bnOqzYlA@R{o_G#rw^Y?xvEYBN9AF4^D9q9mtL5M>rGP%fNRIxo1dPht* z;5iAc8{)VC1j9zjs5}tpJ7b*Q;`FVSd1a=&IKbr@#%Q_r9C*wSAlY)HE$0 zUnhCYn7AYI9@YYJJW$|W<1ZK%Apv{dSmM%nQ=8s^+80Gcj!aOV^)U9{H~z|c6{^T& zfmqn?rZP1$Z#^zq8BnOeaS$Xnk8YBCHVHj2Olt=N%VBeC-4oW5!*E%H*f=c`S^+JZ%~m6)BO^$2K*GU*4~a>n`nPxEKK~Vin=TQ1DrKx=L8V3;+hGkdwN*gVm8s###nTI zYua*l-m-02#1gouSVi)(Q;zN8r*ARI_ch0$<0+{a=M-QH>k2)g(LOQw?*SZ?MuAq& z{-g0Q!^YSRdio<Fz3EptfQyy#?wKybx)&!$gEr>reqgJO?PZA@ zmPJj-jU7~Hb;-3JdSOz1W!RXX2eW@~*pMWURMgEYMiu16pT@HlI9J@QW2<^OmVh2w#BpCgltki8O+Y7#XQZB!fi%^r0+Ag zVL_V5+-I3nxW|3>Y92>gMAPqg2`D0T5jhB7f$f3B9FNyVjUt=Gp63o;xqxQpdFvT{ z`Iy^m$N5PcU_#@1d7*0j{KWEcpYxHYhQxXDaZ3$FM+N-eou{7qxExTMhK_sCQ04&@ z!_pFiu^AbE1!nnKE%iG+Rxf_#+mA!V-bVu<);d&(ShDLQ`Zff_^2atoKrH`dZruQw zPv%9-fVX5c(+eh6UlSf#5|h`{#x;*knqVl9*NV|uq*)bc&IWz#K)o)t>5JJ?7pWvm znGMt!YG(4fBJb=nvHT+(>5#eV@|u7Y(QJ+w7dw>#8lwU(w{G)Euu8EWAI(xK5nwwy zcEZ!IgD=EbL7>l)rs*^Bg_b&1;%Oo4nAnn2-Ahq-H%Vs&7DW_#goU)eY&R>=Fj7za zWndNgX<#h@239Hg5@29mjy!XFxPoMbxL$}7byEIhQzpfpN&^dHzsGBeF43w$6XbB- zX*-y#9#-x1MYjsVeZ)?#&1Q_oRg%4^^V#s(XNHo>X$9p zM8Q0eL_=nK81riO#=Nz{Z7G)zne8+3jY4ePzWket_bP564^Gg8Re=-k;l&FbcgT(= z{?f2Ao0n$`LTv0;1Yl!(Z>PZJzb3~+)4U*QwgIRLn&UR?d~ZlG|E&CJ)XBCGH6gJu zT|}Z3UWWbAD6@Yo%(sbtNWOF;Z}r6zmJ$^?2x@C%H;y9gVWcmZ*)=Cx9wkU4WZY@G5?SEch9%eAmdCpCNu&QFlk8(5PndLjzL zSgfxLjGBjvQd4|tk!5}ULGQW*j-~5p{mglV>pg6OB4BTWMPr+K>I}uk=sW7F$W_Jg z*F^%)Xap$Qg)x{9POyl>VTJS^lzeQBXA;A)Df(raV!@_&oKdNdqkkOp`-_ithGBm4 zu`3y-Hoe!wLv)C{J}&2uJzIX2uW2gy+wc8qb`$%?NWJO%;aiwHBN}U6WZqxX?&w%e z!WF|fGU#o_L@SjqHx;}iygchy^^(dhVCqiD61avPepvstILy*c=EUUnfX)LWtSC{R z)zf@0`^vt~oml;PAFjO|eQWwEF^n8V#&;S+OzK(J>PLVo$k?b+E~+tzOzw3!D&*qg zN)7&cp$&U)s*4!977cx}>Z1dl-OP~DE z*6$ww-KUBCxs&|95d_FqW^+UORl;zq6K@uICtGp;8$RpxGhh7A(;5N&YQ89q^`Zk$ zFZVOryDY>bAN9t0?g06!CxJK1X8Ts-{QxX~-XZ{G;~Z`kV`ZNI%e~quFa+nGxmiW+ z6^uuK52fvB)-}bdCFA}S=N|F$>bm(Uy0O$Crx2=ob;4bNdUHa0FCb*;=U)Oswh1C+ zMaxFKYT>XIh>&HNWTkV?>`CSbVw|7quyCnnl@eTp`vUuF<;FG0zM2i$SCJ2kU$a-g zoh@4q42gZ*NIQ`pXn{0Id_vvr(#St{u3a)w9&6ec4j-7_k*qBcKg(>j<$8+BpduD= z4^cDgm!`+0E7P=GKjoFIkw&7$&mza4Zoo|YS5ot9ZotV*6nakT!nr91vhHuSkLw6$ z-;AGl^I}J9*Zu09JJVJ2T%H;~d^tk1w4$PUyPfP6T8)VU=!^rJ7_D!OqRcT565ekl zh}6YkZ-^Q4ZXJL3Sf$kXnGN}huyLS9#Z&G9fmW8y*igv9dZCb?0(0#-`O2M?N*d(l zQX9N)4?)7ARL_9k0c5STPv5=@0}j?ul3m}l2WdoK?Dbru=p61xmC=0T$nt%f!3YL~>t-0{Gu!h84!c;B74 z8Y;0J%lhi9Tr=CA7hw`DXf(yZ*Soq2SL{Y=d`_%6HeExXU1>2b@F^=+*9$f9 zP(3q-IC5qZZlwD)x?j`PM@{a^iP!n0ZY~iZ>t~zNk~Vw&!#|)B{=!;@< zYuA2yF~il||MCF;N;YLXU{M7<#kRp(h1%A+$sR66S+(Zr=l&xN|M$^Z8V!*dF!jBm zVLNyAj~VV9zfXR~B0)DWM@{Xw>yy78+9wjN`3>ZHPX;c|`W_4u|B*LbC5?(oK5y0% zrMIpC9-^ zGYJ;Or7UG%oGzt3^K=d!apG;4DG?XLgt|Ax=A)2vjL&r-9>{`?096Q7>ZK_urN zuw?v`Jj<$`;I#gnrlr>P`p*vom{ZxG`E>@y#Vm`A81h-V)+3ZkAZOre8zivf*``=(qkNE`Wpf8>y=4sCvE{lkG$;xucAud8j!?|Le%Ca zFc02Gf}l4O%Ho0v=FN{#cAx~@X+!HfMJcN)RO1cx0P!BDJp~|Q&1%>^rp=V`GY1a_ zA8l4mBNqQ>+J|noTK526=x0M$qzdosL(frv+IUQQ!b3+NEjKqeqZy$1WDcAe%+PsL zu{s$U!~9BSdj<_D(0=lF`5X#e438kQ*TV zH2pMvAI{hESKg?5;nyIBBMpo*To5-9QQI1fp&Yf~PN?x&>4V&YJ^H8ggIAky1UC-%VDe z!jYcqS~6ad3{IeUti-r3K<7Sql7`CfoTSx<_0q(a@Ma+^P~>$1fLf4Ub#r_i_yJmQ zPp1vAs+c$EsjKRN@c!k1$%`_IvAEs1D?X=!;A@;@?h_G8=bpHO+td<}rvrg7Nb)@f zlIA8(>E297x`VzGCcXktZB-8P-mCX7Y)w3-Y`<9m#vgr<)8U)WZygqzS;VVOx*1)s zqSQx0|5dd+xH&ciBa@2mFHkt%fCmJ6FQ8!W8d*xtB>N2j5OVBd85q0t0E3dco&Tw8 z_JFuer4`6789NTasuJ}NA?AAlJT*J83+-r;;2iz4b!$4^PqQEDs(LC8T8*d>OYtBM z>q`LiDnvssW9lG(Mmy>l>q#b$27sj{|*S#h?ST^h2;jPhqT3@)vfFZrC3d^4Txt8 zZl^DG2wwVWVvQZ|>@9^*SZ2wt@D7{A5NNO8lr25;k&^Zef^bv;c*)%FUX*455I;n< z8gY*&Zh__eg~~O$dGJM0$x=7KW!{nhRg8#sT(T{bQZmqjZT7|Pdk0*cr8pSoIYLH- z&F#}vo931i1$z|XLd74}K86XkVH}#n0s#zLA_Fz7L0(n8$jeLkho#FIQOY+3iRo_c z+!6p}){?Omhn~x!J@cO&m{I3l*xMaVzY*1>_XkhU$?Pz&nILEeq^oBu&Z{cOlY`02 z0#l*}G;zvV0cPKJ?7O@!Mx#s6V(@%V-V2%i&sQ|uM#K29ldP|_ii0R{=h;|OZC7RS z0DT2-=FG)M5Je23ul-bfmEbk)fZEdRfYIXH2HWS4i{O!aI~1k*;qc`Uc|5_I?*M(=<_%@wFV-s~S&s-QxsLspBxO;)56>>2F7zhhomekIzb*s=qtz5JHJ5xPR{ z0(w+V4~^pZn^KWzk7)ku?BAI7m%R7qTEl`Y7lTn zZ|hDW6=tTS$L^1X>=o}dFv8_vi@761so@CqyP%SRuf>rGCH=1X2;ZWqf?D<(cuzLo z?Sq5N&6tJn8h6lBnRJ;TVk`|>R>?bNWKRHbD#y6<9>6=pk1EJkq$6C#EdqK1n~=yJ z_L0>kqJ0{8N|@5Q&10UyN`g&h2QRiBaryXXV@h9LE6XHiSC60h1eboO#E=6-Ivbf89fF@jWLP}>M=1vTEXHP;NzX-h$Dw7HO`ZxCPAy-x>*Emjtuph zm_{=nk&1R{@9GGTVw%Huf;Fcu??V6E*Yrd1s$~O();gO=!@s~()wb9|bQtRtN|?>2 z6Gqxj}M?<|cL~oaUGuxP-?bQ^NeyB9myx$aBC#ejl0BI(fE_()vsm6$eH0t2rE>HNcsC(7J>#1-8i|9ozu_D`k(Y%`@L20l$yTP(8 zkwy40|Mm&v&|JGWM+8n8AI;H`(#Zp-*I^V*+cS~(%)FY+-%@18IBN0>KVxc7=dD$qplzE%ZP27Bc%#`G&kZD7g*iMto-YD?E znswo$4&2q_WwSv@db>GTsfLgbYD^L?`zHc+AL>h~mBTV&s@RL# zlw)VuD2TKT=<)c^M>u+>wRN?bt2)H@^nY=w?^gItY#errt&W<~2t*dbSaAYl3jsBU zg&L7Y%Gh&iv4Ur=U7FZlc2vkExQE+cA~vZIUa6^z+&-G4D5X#DjTL0$WJ^K8JK2R4 z^hD99dZvQqH3;%AxTq>DKT-#uUTG9I9S9&`*Y`M>7yPM@G2#rfAC~d(r3j!_%#BM! z&UE!v0IiaTo&?)DKB*?UhnX+l(OnwzkKum9aG2P5o8ozOMq_p5I%E40ubNR3^55ne z6PJ@QB%JM7_{1~i*+|lur^gtt^qgkqV~_%xRjll!wdzjn^2PH`H7`hCPZRtX%G8~+9K>AnwA3O_Jm{zQl%4e$3o3;cVP~j99jJ@a zZrO0p$_Np^JB`HMsv`?mqJGyCb>uJ0szARp?OiT~J5q0!eee9Q2vo2CAW)ye)ejJ; zfkR{*50*pd$mcWY#srKPa2uw0H`wNHSM1GCWMkEGojxSrnr)r(h$SCDA9%OP>87hofoN;soP}E9OJeY!!ZIaFad63N0G62 zRc~w5-EiVWG2c#WYC>)srFWog+##G2%?{icHYzM?JXF%I+VzVvW&1N_YA^HOC{v?{ zrF6(UuzMjK90t86UD%QB!^}=P!IRuTXOP2t@@M zf|#_y5O|n`p8w0OYCx43NcU&Xw2c8LCEt3Cl4&NqgHmWwmrSPElwvo*n~NSjI?FA?0-8_Eq^4WXtHOAwQZi`x@gMb*_C5?p@%t-MEKcbaF~8P5tVe; zzTjQXE(WxWwKwpTSb231+PHB_-svsT+fIXuAT_>)UV&(=;P6 zkor$v+|AsjvFP~r_*m^d=$5SJ!C`4K<5XNcJ3SG#Rm^(9HHPSG$HrI*bf#z?=I80y zq`bu&2F%Jp4nO2NA&_$(qw5yiQ4MQ#=+=0)EcO* z8gJ_t=;}!g1CqQiuU}9~Hc1kl##GRooH1ckjA2Lm!5XAYbA^rKmEvCx>jk!x`^1`# zRv*EgN1uBdX`4GnC=w&9WWSNaZ|hlEl8;y;eR{tAa_4d#`55bXq*who-=aQJH!4oW&&<8!0#XI7G>f4=*b1k|BtgbkB4&q|NkRG#0+KM1|ivZ8T*#3 ztw<3<3R%L~x3OiUK zO^4{n8;_0_=jomAE#Q|WsMANQb;J2f6*E4#KK&GOWXN4J;AZENSChd%F;SR*ux1v< z%*6G_4GHp|drRADJH_%2-$C&UtsUy9TtG-_9cDn*7oY;ppj_p%T;Qc{X#%8%(LE8< z#b(C)FZd2qV@Y5}fSFv%?S4Vz(S1)A1UFFMk zztTJ$Z2a}GUTG_)nO|YZKK`FO{_}zSaf^Q{r@o}`{%-2){M37QLDjlMPuAGs_v}9b zpetFtKxwb}yMDrNf``%C|9l~j5%YfwhQQBG)m`|#w3I`?5`=Bv1bzRb4Ci(dyDi9;{Lh5%5{Le^3v{`^B|TyOmw3PkdzYtS&%emvKOVmRB@nXl8|q)8 zdlG&aAo}aI^S{ImqD02&LBPm-gIci{fSqvt-DCI36#MD+Y_*qLSFNaq{&WEV73Tw} zMd@M_-!(+Bb(PtlVn53Y2t1kc%^v^3iR0 ztWLv|kZ&whf+-w94J0&h|N89N*G$`UK$0*30H`@i@V_txYGKejnZ-?pk#H(Zld-|1 zNxA7hz1z$rG@4pwzu5OcuBy}VUxBHAg>n`K*bj8g%D(lp01I7o?L9m2y?*u72T;&M zx$t(52&VE}Cv6gBl_7IsS==3|7lY9Gy1^<>`hP$Le8hqg0{A~n(`4ONKua~ zMo$jrdx8p*wfUege6RDUuRY%00;$RBguuJ5OZLEyn^H0{F=78jq9ZC;?XssK`NSu2T~>iA~Lx)tQ=Fxi)z=@{IcT|-RjWJ*hxvXFYY z>gJg6bFdsf5m*vhc4#^Xls#8}1)ki0B}fPVl@=0b{5>s<`Ye+}g(y(~eLv4W{Fl7Y zsNry47;^>63s1C_0&2INO_@Hc00==pm8~UPL^+aD_JYd#`2x_Ge&7!Jn;cQIW;X6# z0m%vo7C;Tk11L8;$Y^L6{pnhL4cvw)rF~mBhBSa!B`Eer zC+(x)_9^g2ZOQYBQ*1*W_lW1peelVe+SsCX5U+%Uh-E@fe<|DE!V7P}pt+cH6(8Fe z3JRAtuUaF`4W=1gK?Hbz$or^qljSbn1+>8MTUq{UMLsy$Ag?ISZQ@-z zK^w+4QH!w&Ec zAJTkhsjUrF9hCvrw@z{t*a{zjvCS{dwcMpyBkVa{fViAhxw1_apuot@uzcDZly)c9va#=wtJTVsrUwfQfXRRj|JT)+F>Cl zgGm!c2mBc@CH^wFoTUv;Ep>Iji(Bf4qeeB|c%%3}Sve<(Co@3y-{UQ0y+hWtUv@;IgR zh@ZCi>M7PB$HWKr;2F4GoP58|wB|tN@ECPp9(bn z^yyXpT8m?jWHn8y;&p}drTwj*8elZ-{|1rPo%jin67i_QF^>y?SE3Afl6TrjLr^=T zPeT;(U_Pn>>VWGBx}#JH&5;i`K&EOvTKH!e0lu&K=bT&Z_%h@;g%qnpmw{qcO#RmX zW=O{&hjsMxJ@DE_&>5zJ^DtZkjwshfGX0REM?_%>a({xP?AJJz5k3fI#}nK+?8%}v z!E&q#y&wV}Q*i#`z*YCCD8TRdFsPsLPwBGw=~WfLbp|0K(Wa)}Yu`-fRN0@-=e_Cu z;OVv)7N)_;`Y6b-$bEIbzh^_iJcvvV6(f4=R?8CT)vzYg+1!}!s5SkCk=DKa6C-v0 z3nTS_(y?_}+vy})f$LAqv0rIxFUNZxQ(_wGQu^oy;=^Je5UB1^F>yZ&GEcdx$l5@J zJDwdg`z*5Llu~3-WK4+TApL}6bVzn3xW49mY@-iH^1!SZXvzkhw7BC_t&dnFi8MQt zm<=MG&(H}0$13m>{&cLG1P=%u=19L&!8$x!T4%j45~4q@@aJa6MHEFZ)t)?%$8*vu z3?z3@?RwVrs_u&6hUxcj-sX4AMEJyIP6_XQ`gnD>(yzK%EZi|t|H~5I-D2X$A(3xZ z2`N{b^4;lkDbk$1(Be~G^~)=@799Q57~Mwq93AC zeK9IQ$yN=j;hLv_Tb1TZ9kR1G7`Rn!)TIRonN57?7Vd_6ZyR}EK;CKrtdnx9CsFSr-$7=g##UjD|Y6w(A=Uz1PihT|EUH{LWTj-TTZBRWUqchTxCE>u_P&| zfHsZ9PH~e1gYiAs->;_+q8X#jF6at_w5mfnp$`htGGkb9{bFhEO1?~D4w&S<7gQYq z_q1o+h$zu;A{jBXD9)efY=hyXn&-5^jPx62KWi3QKd*)CXU!>r7Ha91qWiQa8oZ>+(Y#-B8UbasGlKx~zz?TBl(JQ(BWBfF@Xmp|z7 zM!QC%E{-k5!b@@dv_M;sOSe&@r>j_^ zWWTMLLe%><`md{JH>fQrMw5ISHw6#vW_O{F09TS z@>`tLKeW+(d8$dc&vl2@BYX3q`98ZMy94YOP)gL(D;z7asDYFnjr=5<%Q4V_Et65N zik9F0B=SrFC}_v7W~x*5cTgov@c%3zH%Sen@$k@Y2?+7Um}hxz4W4}B<>WTMXO zJw)8?&)ON0uhXS)bVxT|j$9g;)ig z!?H7#0L|*nP+t2n$&Gxu%XoFQBWi|b%$y4yjilrB0pfd&(x*>YP(&ep0bSPf`Cc&Z zL#a%LG+S6IOJk(t7e@^6tZs;4*W=Gz-j!1`?Ufjv&W9HI1c3mi4_Wh-FrSZujs}-gOLX*sR9ryUQ^2sVQX70#?J6qd_)?50% zWL;!RR9@PmaN=aNIXcBLueX7lo<1O3=dRI5(#3RIBkaalUqEurcp91W9hANGMof_RK%j3CYSXEMuv<6b(VwRX{K!PXwy_G#8JWs$Szi3~1C!e#I97!h6q#$pButuNj9#Ab&jlosjO2<=- z%B#=SY9+>audvq9z}lqI`V<$LizPROPWjr}t~{1B?B8U4=9 ztQx-d?VyGH#jw3I_irFJ+ips)KN5@-zbc{Xv&q3I*07|n{zYcLrm!c`*t#l#;HWqMvq!*TMEOy z9S$?;zJ+7%@kgO+7_`hE&&o}bzqIyEEi>7y)x2KptQnV>>5RJ7$+n*Nj7nJb)`A5_ zY)O48C3wjqSWa)(pWnBf4#mACUw+T0{5uL6y%ROh~mYA$rD^2O385H5K@Zz7gEZD6ye8EEmADAfvq+lZvjd8=R`=jy4d&b zHPv(RBDAX+DyHa&LSiH$fL#5~BG8D7W(Vh;Xwjv>Zp`MzL%SW07CxE9<9gCt-x3X;nU+C$f?dIb^-IVmD_LCO)uR`c6g%`UkwNE%g zl7{>9!dFa-q4gIc7FpUV&c5Of;tld(#n3X*G2<@Ykam>hwB}eth5KsCpb%+vge;n) z4g+P=&g$_cvyo2cD;jg=U%nace{gd%_Y;_crCaK%6{8Yq>m2ut-1V#Wa2voCYGh5w zw%vEV(ul9ZH8P83q#<{(7OsNxEEf~mH1US-92xecxCK789!jOV^Z-lhGiZ8i^cu>^ zP}Zhm>th!4N(n;265I^@{H6_YT#cb53``vy*@3$wRRts?y`$VYb_V@ zm)K*J8H~9dCN5E$eYJhn@y7Jyg)zCdD+_KB5^dVdE!Vh*+@DA+A&os`*_MkeFwW^y zu|eH^GML(ODS;Z0`*vnW8GRhG+YB50eGOm-Fz+SmcQD&+%50e)5xP>P%vo9j)mww6 zF0b{vQace@JFg#XgAGtAvT4@WX?r=>5{?mw^E^Q8e;j^ce#unCz;ODh0ZV{!Xx_P| zHxIMuO7kn^i!*5Nb&r|_6`m@%cl9Q4uMUtF)*NF^nd46tppY)3o^|7c+^hH*welLR zB4BvhvJ{N%qF!B|J&)vit#v2Ywr<*s=*RB$H(e4sigDSg+y&c=)C7a3CtjAhR#NMCpW6sJx^0IZd&Y4i}J@A@bXnC#MP8=U;z?ya2|+S z>)Hk>d&8&wOh44FLii1NIOUl`-_D>FrGFp0{!*@wkzLp8bH9yS6^V|s>pyeoCwy_{ z_dWMr)c(uYUzOeYHd*}Iu7mHY(mx*FpP3?bqrMi=Nhf2ik*oQ?MNm&FXW7;S5C@H4 zX8mpM4D-Lvp2Z?^m!RU+p``3TOJ#rMKS@z#8Q#p_{<9Am=cZFv^^v{xd}S&olh&o(7ME%Bg5_-=uG!8>{vv(-y6SV$n^`nAAcm@1DOUGK_`j^+0zv9CSrAv z&${271HmDVRO>$2WH8xs(ro##0aj}7Pe}GwdxKP{ATO^a|7{cB``h{5;w4Z^io@Cb zl1sL7AQ3iJ9k~fa00XJ_3K-Jldje4xef~(9T|ol!lI~FwP+n&K=~T5V{m$LParvv- z?0KDZ2Pe=6Rp7od8II2q>H!xO?Sn}Vh1SQiJ>DP`wg(b{)eUhRHe$yUOhq>R7%HGN z>5dA<%bRaM-xqcNXchj25qo-;@z5bU!$9CZeN`m{s$q&M>;ZyPPsB8uMi(D&;;J{0 zbJ|Zmc5?+lU-B%toYM&bzp9j!%ghxwkYc}go$uSSK(}+eN(LkT&h~(lSe_~!bT#gI zW2(?N&c>wRgXsqZ4J1?rMCMej)=P4Kp%S2j=(-6ydiG&C$6V}6I@GK38=0LWc7Pyv z@BM$(36S}AmLq|=tpMl}GRW=JyRvVBIs3=50J-$uxr39LO27Pa^~U>Mknd((j8}V# zHLn_hjH)cbelFnQZ^ul6Y4{$fK#TaQ7z%%D1B^7&#!Cr)g$x6YdIK_1ga45VfZ6U# z%jwZyrD*wDWz88Zc0sD-3=FA$p5PGL+bjo-_M)Q`GIXqQ?K7b=311O)k{GaI9u2n5 z4<@hNQsbyYHep%a$73%{3<1;c0%oPv8HA`A3TzwC&$-us>uHaMs>=4aJir^j;~67Q zWw*b(1x3Wp7>#)VK)ZtZchqWO)nRa3Q5V8Tn_iwj-3O+w2BB~lsx$adP=Hy!Af%1~ z6T%B+!#*p@{g9|wS7zd*P$wi=wf~1IAQWH>zf=JT6Xfp$ULQ~`Uey9VZ0?(=DgF-R8TGgB^@u-vMZL+oUUS7|P1QRtyOg zXph$uQ=RE<+W{V1>V7&of}_fjFWYQ^Vj0?lDSVT%G405`Jt<-nHWEHXD`X2Sye=fn z4t{~(eRk%pKVKTowTwxY7lC(+Ha-R4m>2O-R~lRHcO--CgXxh*)k{W*=qIIU8(wR0 z#BK~d^pXd*fg9im{b1N2w*r{Pe$Oe9Zt%c76oTIywB%TRcO(*Qa7#C0aiwfi?bO&w z!l7+7ni;^U!5A1aKlJdpmrJQ|0+lKXs8lmTTmeYNa*@2*QrpoNSV_Lx$LUChaYHIq z=h0JXMkFg7iU-U55LB{9B?1O(9rfha;y)(+&_Z5t_vsw=Dm(E4wzp|U;-4z|Z|57S zzZ05Lhwr!&T_%YVk=YEC{QoS&0vZd-w&y_dFkp=Yzf{b`DQ_*9u5-|Bc>bL0+;p3m zh-!H)zDY?t*OrEf^uDU%`TlVNB{HQ^u-CB4@#$}){zKqXI1SaIm4RC9oeJ39I~(9` z=k9Q3*pZT=8W5_Z?~(+fg?N_%`J@G2^0G=O&h`!B910=j0ef1QT2ENCOga1Xsiyjw zruC@8?>TDZnG{r5s6B7^EU9d$CZ?9mtQF}@nt3`R(eokhU~kdadzx$LYH0&v7di$q ze`-{tb;KlrMm2bYC7>FdW#`A5%E2RIQEmfX2QO0uMZ?ov0jm<3f+&y<^?(zml}Tu| zC$Fi6*H=nRENqGXHF};S2O9|MVwLldCbHg!#|BPOS)}12EW3T?`pe$1JxAqm6q<=y zx2^`T&dNXsB7+itfhlj2r_I_ogAHY#JynIVrLeWd;bBiN4%f>h8w0>~5pTmYzdxmL z@T1$%;zS$U60r(uujk`_!g~^U#rx>;4C&mD`MyiXo@92j255nY+FRJDGIrOXl@Jq#Cz<`6Qv3RSO=MZVeAM5P`VY>J~XwQn|L~ zc06V>h(3bkErS-}h)we)0(wjQBB{b8-m4}sVM+v-;;TX0oOtNsEPexAkR6KyD+X>t z;@K~pUbNBTCg3QoQdkGAYnG|39^N8FwXm-(Fy(2c!zgJW+35^>dgUg664vQv4j~iY zUlaR8i9a(|;|P$k2KDF{+~_O2uP25}7s|u?m87Qw#Yh!BXVxT-VDuy4Rag4oXaLc9>!zs8igmQf20DVN}QQ)fuCf zu_zve(doRl5a9;zI&b3VrFQ+?>*PrIDKltn{$m5n7*lY2P@%eE**E{>htr`wd>OCk z5%Hlx#a3UOz$qzj1IERsjF2?L5(yP_P)3vnBO$NMj>Md)DnrvbAhSU7&^swOwG|#+ zVX#h*T^d>qIyPYfdd;Bf!nHL#|A>50KH2Be1rtW0vzHg^5sDv2U8J1G&$9)$CYuc) zDmbz@X&du5KAj6q4=-r`{DCHTgLAy!ZGozR9!Hy<>Z|pyeDvqMeN0{c;#Y^*EAve$ zs}^9RPWNemE^2M1`FX^gC&AjDusXnrxl)h~p2hdfx-hSDe~$ z^DD1j7t91{YlXN`TZGR_!2?CY={2uoR=D*t=2T9=J8w1g);gbRUyl5Mmi9Tfgl zD*81{Un3luj^jFZG9Q%C>C)T6T;B`Mlwv{~(2l7=6QYTR_u?eJlWJ+GPN;1PSj4)B zGaS{#z~U_HITd~J1Ik%AnP%zn5E>$H@;3t4?6@z9v6g?NH?1$oHMF}bbLiW$gi023 zjp8*V;iOAV!%0ca#_(fp1+=GF^|u&le2KEAtte5px4LRljcn9W)8O0dERX+Re$$LQ zrImaE#8`?k#dOQ&KvLSl@&Ko|j)+|mwzJ2QO1AGrJBp4%+y4n~lckJ!m4h>D>qf`Z z#I@VwB0irBNLULGOMRaht5xyj+@rpea;@c@@ksFoovxgKqM|1UEikS)6fEF`5Rz4g z%i=O6(M6`>4xb|H)cK0$>t3Nr-Q_*&dSw@r$Plo6k-Zem=$|0o;DBv^mFzjKQ=zyJDd$eYUriZEB4p)@@1J z{KGlP+3J?GMkGPX3*9uyFZWAg1)>w!s(RGGM;Y6O3Ws-pCSnmIAdTkVL||c98(XiO zcm*_NaVfJIhEy%oh1QBCDN^D+eqZTE{R&C*wcxODn;-aHbA%6n0i`d;B-P#*LCoZ1 zb?VI#7n?UXY7fe#VAJ$^^m*_q<@-{;V~Yx;j-hU}gt~I1hNPxI%S%f4@b=024uBJIeZ{_CMF3S)^j_z0f=Q=)?)(?nH}~Kt_QROX(^li5L zib&leuMC@OQHNo}3n7ZR$El)^hxi4t5`+@cG8(ZY8L~Cs2kZaSCx5R0<>tv{sYMY~ zJ+l|IGUu81&>^rKqFKL`B6```piv2{I62v*S=mZ4QHC$i^Ml5-Z{ZikJucs&8gyB$iB8dVm@n4AX z5kMC=%<+x$deIOwYv`)ZovZV7XUP|lO>g&$aHZE61CYUfG=Dis%@Cav7Pg5U7nm_>(rw-T*o z+m8F($wEd)D>AWYU7=I>`Z8Q3J}Xh z`xfbl-IQdyj4})4;+JwEe3jZX4uxv%oIbpbZU*O-TEqmqe1Gcv4rMn2sYyrGk3Mw{ z3c9K3J)+#3ixHw-7XrvBmHNMt(@^SAnw1W)9DS03r169BTLK$ zc7{_-dB+Z=UtN6upvrCax?LFGAL;}DV;B5%1ZPxUcpaT*y;=H?K&?xL@DvSQL6J@{^tqyFXU8_XoljKsWheG1>(>v|Mx%s0O4j@tA_QV zsOCShUY0K8#C%?%68U?s^8w++n%ubSl>^p-zTr})c)WLLvH*z^`76C zGdU79O}1sSx!q{|&m;NUllyh!47)${Ny(#>)YADMS!3w0A^m!mo+1uv6j)~s!Znyj zeLy>k=?u^p{s^XIxgO8>x1nhwr+salqoR&UEP)b4Z;ah51{1Zvwz8#PyIij z(~DB142syz5o#yp+WyX+<|O44{^U+2N&n8B4t-0KGQmpR9~^r3 z!^3OHJ>g%Uz%kNz8mF^DAEd?WWlR4iE}aH(B0F3{0~4AJq6TN#xk8mFnPsi@Ke5xI z#Bm_3UhFpUoZmhE;#t?I8rf^zy$R-%G-tw#hW8wBGmWfN&P-hcl)o&?gPkr<3V;hJZ zJD#188Yq1By1?KUbXqzh$w_$KC(MJ`;)?n|^LBqf#X*N3#~H8Cuz}plO{4eTY~fOuubLK;(08&&}sWg1ke?p!{V;W-ym zx!iPi5G13EAD@eqP=pGErr_@mS9w3nca=}t0P9PX8COzC&=bU}JIH3MsE(fq^Z{*D zH$T0MaYei19d75zffQzRv}FqDHET~WN#=FVw#qKHq`zqjk!A(@#Wn9XX-ocL&`h-e z5}3RT67oV5r;a538Xr}ny1I+kHkQ)-~?y8$AenznJ@c2vo5&z}Bs$<;G zKsr{@51az#Y0H3or~u39$q6$WV|@qM#TgJet!2MLEwW$f2>x@f-3RO4u0-h z_yg@Rw>}%5GVJlQ<-j@Gsh9D8V^6j7fOL|{lzT{rUbzOUjn_T*gKGo4c&M6NKmf2h zg`WZ0tHuDhWsbNSU zer88wL&6k#LZ6DPlJV_V+kwn^ZHzmIfrBr@WGdY`>a?b}25b-HlQ-HjVI>6v!lQ&uH$z{$fu%n@XHREup!2jv*`8p`jj-A-Mq( zxUWZTDE#wL_!|J2FKpuIg2^cv#Xpe~gJ4tfnaTF?Xsoo>xiau3SMsjh*opKgCn?v( zNP*6}Gd~n)ATmc>L-lpDsl%^>>%5uT6p)k@ytF6+p&NFU_)`MlTHuCKqgGYu}K9xUhxl{_t zOHoe}YCi^r4xp-+?|*@?$!T&Q{o|3=$Yx1f%u>Tpf1Gb6m}VvGflP$=>2ddgC}DlC znMw?mxLliXc=1s}8ZY)T&rao}vCY$jT`n$La>!u%HS4g!wD#-6&nI2Ce>}IwjKge! zYFN|_*b^$FSY)?XNJ&ZEdVwEes$RUQl zJmiD=fq-Gac)ZWD`pr<7R-WqsW)fNm?e)ezI69I0c& z!%qKS1g8HN`1B3?f47(>E3QBeQyQ~|VG**he30cuXn_KBBLRAbB^{>9~v~Yw~nR&BE$~$ zgca%x+M{IJeySEu`!X3{Qjb45k)hNcEalSP1LlgB@|IjV=KAVN^!baAf2vKsbpvtI zX|N==l;ed+DSTPDfGHQbuq6Co1NaA4HyA8pr--op7Goge|BSx0LUC(O)XIH;$KUcBnmJviaO+fkkYGfWssDyZZ+NA%YC!-DGox zRQ9?4;?sF4MJ2#gYL#Iep|PN`O+%&NbEJ6cgvmIvj3GC|F(W8mvrnLGpflP+d2_2Q zge{+bqvU98%+6zdM|nN0exK*8uk@*Z0#+23=l6Bpx_){b(&$enSAdos2`60I1aC5E+ukKmVUlhJIb z5&tUwWzqMwG_?_b*-YI?fX%cSBbQ9XaYZy+_CN+Ymvg} zJfqkWD3-&vhER5h)ZB}T3DuwpNM}$^S*ngZWx>CaBe#0iCEWl~T^z-d;YzPeqI^6@ z0GC#hZInVfMEfYZkz=DWk_MEOQ(hz@@Bp>+KjTo=HxU*@cf>kt$VZt(h)0PQ4Tcz0 zNZnDRkiMnr3w}br?r69*M?*QMFSS%gT4)kp)o`k6BqMtfb*zwl4Fs&C{kHQL%1UsPzYSC?-7l~3n}}*ZXi0vc zA+SInXBRa7 zfygP9IaPoZE7swVTh5mBc9q^dc`|8;KcLgPy7F|F%Fn(${2VAM z>oPNL#NGwxXsx)1iswKU`LI~9ElN>PhGx;5s74_84*{nGL?6q2cp_MaMqN0Yz8mUN ztHS%JKY&)P`Mm_95KRC@QrB; zA}0!^RIt>26g(Tq*~V7MTIaHyig-Bo#X6Whki>vlszIW0i51O5DD`jN)CwE*ZO?b^ zF-h{t`tIOxOJZkAdi|4XN@^`eaGI=Jt@{Dy9(6~iov)s(y?XKD>O&a>-(&=^2_pV)S>z10ja?kiWA!?+md6c{5A7zG{BGTeyN;yCx7sA|cnK8jmu>KfzX|>FiOOgB6}(nb5zntzCa- zTa6evh~Cm>GsNjdoSPI=&VdWVOkq62+&SD`BW9L*5ZWrRC)0}E%n2GN^%oXj zbX2v7WEzO~(4M3?`XVYJBjxoko-jQ{Bo1aGtm@b@Goo;1x2Woi^~^07oHOs_5`)%Q zaA8s+FOYq^`0pF zeH9LVb_q~qU{!ai$MY+H!qx9wN|tj;_$;M-$}Bq6GyZekQ@-F{B`_PXxsVz_LExyIL|daQM9G@tNMSZ$&j9K~Wb|CHf=hd_o(=xwA~ zM>m~n^{CD3u3Dmpc@*xQJYyt;TzVUI{n72WY3}As^jmLpnMa2uYIEz{_NT(0K%_{@ zyjyuxdV?nJI_7G!c(EUnX8eiEu3_LqG9iQwH{-Jje?@Z~uK){{YL?Kvgo#7IHswkg z(3HR2_VGmt%JNd_ea0uGDme(}M=6OO0DYhEz~muZe+LZsn^2SD5q^>x7AD>P-4# zyis9q)!C?OMFPoslDZol>dwZ4nk%xh68(di+zCzZN97$=qY@n^q>4yCw8agQjId-m zO_?y4ZV{`syD$0^=co2QT^gL#Y9@((VC>=Vq^%n6LCrZncJ=din3t5{xzi>*zUT)=k&cmy(T#i-jE<~ra@)~|zh>IQc{R$bV6rXge?|x8qm|!X(yOVD#`~ zu;XOj*yLNIDQ2VIsCGvmpzzw=zK&Go8kR})9Vi8dihO!!9raAmsFD>;trrFShOn|H zm?4WNm$+>wo$(~C4c}TDPF91ZxX+7b?LJ-GS86xgBUg+ojigaX?tKf}g^I02`vg`i z-a6L`Xp^~%x4kbxo)7PBy6kO~EA)~dW0D+^rVplQjkhH>$`ie4<&xGWV16nVk!3GV z1(M*Ro4*SE)hqcbk@9B#D2CYrOjTGF2P04%y5T#V{u0eM}^2KZt~X z@5IF@HZE9qx%CK3lbht8@X5^g3M;kbV+wYW)6LOH^bKo?I`@U*(12A-jNE6=?Z*ic z3QrH=h`cQR+@}s!4R(1I?hi5}W%$$Io>WWZIJkJ!^V+MsN&B^Y-nu(}JSS-A$uDYY zrA^Q?!<}Igcqd`NYD*O2VPc5tD9gdOR`fKB$}`s!oZoggg4{Zk=hQvr(GRyrZ@Sud zCX!GI$G-ao!CtleM3l6B9mTt~ta!4HwmYoZ+|j-6agxN%f%g*cgbJc;kay^aj;c=F zF@8(Qyu+Vf@~S7Mt7_Dzd#RR2@N@0kSC+U_7luXs&uYn|RhRW63637SLcK_4_HM12 zG*jGB*faw*72936;`L)5^{H{a$Wmbg(y3aYNyQ{_878UmNspQA;hA%vM@D@<2&Eqx zWio@!wiJ5WI1H!7c9idJnHYepyf=A)JDn~9ptZtO0#?+fwv#T=_6)7--Ya{?`m&8 zm82wOG>y!C?2_542pf1w^E?ee5 zO{r`IOPg%r{EH`plY<_0{v&<<$#TXAC>os+y_#|8dhz!^K1JwT-J6f+_MG7RyKr@l)3`vW=jv+lj= zmo)!=Mt|I*D96#BgK zs~msLd>s3n?9D_0lWIn zA?}1epb5nAce03dJvO|{x-Im|ud=Z+?2OUd{OgmXf1GdvOvJcQuU+sjom`&l&QF8j zJ!6L&V()Ar3_jpq=M&8@SF@rLPfif#E-xpbHA{tVoHLA-m>AX<%qj;e%d>Ilb zfQIZ>P}$Ij7)-k|`PNsP5Xc*`@*VgA-&&=l3SL*gJBAJf!KsUYacO!qiQW4K#(U#^ zQnM%!+dl(5aNEH3d-)TM;(OSLr4LPfuWvKF*QWX`q~1N(hWEP9JKd~fSKSu$fqR?j!oPI z*@8SK{w;{9WxfF90HNbq@#LueP8h>sBOpb^_d)_p9J9A~p&Tu{%~xg&c5m zR(G>#C~6KUTB(FeK$Vpb2wI~zI0iw1{0PX?Wg$OlIm9T3 z(?iqW#$f21WvpJT4T*Cd_I4}lP-l8C)+$}=4F;ye{{9lL6q3p+NjZ#^V@fJ-e$(k-;odH15sv) zb-hf)mv-s4KB)n{VaYa?em#ZUh!;UyozLkrL(c(oMI`rHCY-Jq|4`0IR*a^4NAUI2 zr}eTKJ4@iuS}YxK(h}7mQlTDTw8`-CKuCB_r~pk|BeX?>JSfy!kE3$W?<^d#ncA4Y>70Cc=U z_wl(c9LiSM<|j4Fd7p+Uxg5d%L~h*wGg|-_YN}C-A*MB~{;2WGzY63j-=SR?dyo$; zSt7dh7Xi^dbWsD@pUgkT5CRM8F{yI)Qjb;GDmPpPG<5wu&`<7jGB3&BcB%l91X)lX zk{n1LU~=`nq0v?;X&Ts5UjCen{J1^yIx0*8OKDDRERARxjSPazYtak*=skGjyVo3| zJ9g9Z9y9h}IyZXV26h|Hztk&UYeBM3KjcQL2swJfn{i;|U};Di*BHHFSI;Fc$l@ZB z+v;dJ2WlWd?LqfSc0R<^gX3JyA&WKiWGHI&F99pq-e3t3n-7Kgw_g~xQt*ZZte^pD z=M0vZkVz6u0|-qQW#GWZRys}HSYMDAgH|XP>EjZbd7xi~@T8ymRfdT7U|v_!KySty z@`r;nTE|M`4w(u{4p^$4EMVDbj&*Bw4D)vL;Zp1Y%mZdMy-yV`2pxw_T((Uq4DJ#&3(It zqq~JFY&C%ldPbP1NuWP6^QRrxo92zx%Gfvw^+Hc5W{yV>t+24Q+6X+i-w$pnvEXAY z^Ew+pWiIj`9-kaME!=kX#X|R+p>ID?NEhy3NNt8^!SDu1jwcFuR=2UuBr4isDx^wx zCe$)Q1wd?ktc@Zf%qSIME}UKa^@Pg#@4)cuZIT||lNsjD%rj2sfBMX@*VJEn*0V|A z38vmfscd4M;UZLGiyzG$mKdJxDn*zP4nWeiKLo9p*svDxe3%*RFQyjgaxtG8RRB|4 z7f2DUjYg`nkYAkeG6@yKNCN+@P)mmuy}1yF&LviE;i3jM6FJQvSS=mCqaEZme(P=4 z=uH#QA^4t-P;!i^=lgqSYoTjP42Xbp9JlpSMC+}0fcAT<^cPiYarP%w+v_B+OftKI zh!BaQH*iqKD3(0DM~C9juXX?znbms(h$^%6Ku{r7mH?>Q7=MVW?S(>YxhzlBfgw@DU03)vQq&4XxB@zAQdfpnQ;uz! zfDsZ%Grm6IAapAo+l{_$>?RbMH1X1I5aCxHOnTp>GLI%Kh!B|x9~WMkQ+SU zu(MoF-Y6Lk!_f~R8q@(q9K=J~hLCfU8{?OE5YF>90Sj#Ah65A)XFU)p_Qx;2)+O9;Q0m1g4n|yhk+N*C)rMMU+EO9w0#yW09~(j14lm)`!TXxw zBy7qo4bnL05K5L^>%=RCo^QxT2QoL6!q~1H{u1kwq$qPx*9^?M8Np3~XKWuu(Gh3d z%;!U99hczV*DlPV`e}BhSQ*00n(xC{&)xn66B6ZENTFj6fRC1=a=w4P3g?Ge!AQpV zLCSiogTx?4PhL>liX3vgo{ipy+^*LQ&4MmG7mjVPeaqs#NVUHb^0|!R$JYiHb67ya zJHX%?t$cbU_>$taMU}u_l>T!2wA97$;|&du*2PqwoF7vnmBipt;;|9>Dnu7&i#uGE z#;fOER_4`*od0t43jUm^NNv;exfq5a57ft^OpojPws1SRE{X;0YbOTLU0FItaiT_0 z{9dC2ny~oltqBX&ACRt5PZ&NA%0x#?1)a!d>8cvTg9=-t z4$yyyV3V)V07Mt-j2jY@v9goFqTmmc9gLG*Zg_N))G?7eo}$v?H)Z7(eD<_zMdy!!}!ewmB-ZM^;NQR70e3NH;;c9#CpNTV2k`j=}xdhSk?9#l)C3txQg^0&gSwNH~q!u zR{f376`A?T=YIOd=Ykgz44i$8_5l2%z;5rl&5i=$P2+;yk5ukM6I!z7b)*W%3^NeA zEu5a13nJu2>La)iW*@~AuqO9!tdJ;Hv|!2A^08uZ z`SKine>tv{3LYW~K^~b=qI2}dMCZ{cvAPR&k`aaHRn^euD-9QL^)jKwB}}vU6ohbb z8;0k*9!f0dEq_M!DW<$Bs)+P$%be$|8SbI(iIRdmb%v}+Gq0A-~$P5_WkXuL2K{#G!qH%B%<6v@Xz|hBo7Q2$mz~`E{_@i{8@A+hkw5U>MS2=3BpPNe_H<<}?(ugp8BVWL!Ws0Q~w^)fhbA@IED#Y9DvWOlkN;(Ep?D zz2m9w|M>rsa)g{i_B>=|XQUi^rG!ZKo@JDTW3PiFv&cxuDwUZ%%idcQvLl3JC98g~ zw`-N_)93s7-G1NSe|2@P=1&H^8hQxyMdTq^bUK$y>PBgZvSSjHbH0kCpn|bo<$ojLCQ9z=;rPH;aBApPnS1OJ5|(J9{c_Zsn?{UUi~pOX8Kb zl`Zu@rs+4(F-Fvqp7>bl8p-(8--j%3o6J@z2a*5Wk3-A1n6;Cd4*hj4>1qmT_#IuN zUh~;W+nb%Xqmt`#Q8cz9Yv~9pqcj&4{X_G_3ZSPjpj_gn;j5n z9c0JoxAQhIU&#$r-SF30>!w8EWOcpqu&J=nY*rmRKa|h>W<6?!da65lG!{o>&E~{IQu2Mo7NT}ft}v| z8iycXkR1wh;ys#np&iJaH~TFd`g9Udt3$Zq>)MA7{lAmM9$&(k^Aon*ZJ88n*GJM$ zXQ}-5&X@xM+N&|~`S+agfC!!?SQyT+b=L6u?cGS@lfhyh#c?l)`h~k3-njjHkzYCq zsAWCAez~aq;^mDj@FHkQXw4m3wEHJgm9A!1zhSzWmi98^mlye;TR?a0q$j6V{V#m> z?+3bo0I2%A^d=3h-&4RG$Z<%yo&Uv5tBmZ*B=D#@9zwZu6BzT_=Md@k&mhbJE zAmp4WsXbr7r~Vs$`6&|7BPU3!VY{IB_x&FF11$T8_p zgGjh9w}RBD6fBF5-+!oGa1Q#GgPLyWhjJrLZ67K;Z&g!xuV4*FWIle@9@m|(q|MSRQpfxpA*t;h)7khRUg53@rvMAhJ4T@CH z1D1D;3~k*&;;`_|(P6NI=EacuSa!MX2XEV<)ZN|}^Y;!t`=_f2PGDJen66x)t(gLi z6BnumDGlz(7_UKQ0Lb!RU!0ZFhztU(WUD=Bd15Q~1(w`VfF<3HcrF2%!o zpw<2J)*vS`02SAB;+wDXYS!=^&_@JIL08jc?%8U!sZ~Jh9n`FMg5ruC@Y3Z1GE1vX z3Psr6w{Xq}Y>`6?$`a2nIL%@{R6?!cLsX)mf=VUR{3a8GMW&3)67kMFQ%!n&MbF4+ z87Lhy-;1`g?aYzTL%vq2+4CPP$V*#TLcg&>rBwQ+ffRSQ{6D*i?7M;VIN~Byrz~Q4 zFP)cE@b(&=`8h)=|CG!}S#g93WWOBk(&@+^PNw^-0NcG-XEaiJ8@PUK=OQl5Qg4Bm ze^>FxzhY9{FEOb~7s3mcx(~jB?lOETpG$VCTq;SFDgoCNm0$!W#@_zE%yAmR6d!X3 ztU>GTOb;*X!aP$aKR`|8+lH`XF~#5r+pT~Ywo|o7|8qtE^XaR&s-UP2?4!d-WSx6yrey`4>FaC zC{3*eL~=kdtJe~E(5GDI#>PRm>j36xkBmTs=&_7;9&1>o2I9%v9y?rK+aPOk1kM0y zXYd+5G}cPcpG5n!oNN-L0lg!YfGj@gK==M3|2|c2)8h&wkgtCqGx^kPPZJDGu!WFk zfZ@vt;2d3NSptWV#*+F5)HDwTyp9S~RiuJ>I$qBw>geVP(X$k{ZqDJ-MH3V zY-QU!YZp9X`Ym3ehE0xSbXs5NZq&ce-Z`6vUWkT=%!78Ic_>4Ce+va{3Q#V>*HX_e znr_08HUKQR6MyPsPaWuE0VKSK@c;u1Cy>=wLHgL+fYOHc@$UpPx@S=>fMr~bQjk)zec9{||ytrwZ2pejr+1jfimUw`G* z&)_a7_zT?90oN7cpJFuc8r_A7f}+2IO7I>UK37fJbHvBTh<|zF)U|3x>o$U))Prh} zNHo~SJdnanu-usV5e}QhFs667E9Xq8_v?4$P{2 z6`#|*eTJD(if|ph61xQQKi#o6|8&Q8p*dN?dP)(g@Hg<(vJ>Rj;3|Yd7|0z9KFJrx z|8U3F9JpgqaKAU-rigsLD^MBED72T|Grhz*IrL+@+o$S%Yer&4VT~CS(s8gehNCat z0Il-rzyVsbubbYBVMJY;KPF)H18i4Bkqb|b7h0?Ncx?cJ7YtsmJww~qJvj%TQv|Z> zb@`aLteZfr#a-0jghHzT^fG(hd5cF)keWaLb>{_<)a&hJ3Lzq z80Ym4Hsh)zT(;m=k)N6(PoQbe8D*6g6Pa%V{{3s6)F&aAjxPk*&(wv}!-H4x(7J2W z5nf6-R+_C0F_}owxyne#w~^Xb8`{g!u&u%73r#;xgpou%;FtsLT0u2G$alJ3DWzNl zjmlQm>Z!K~WjheV+eUG}eChbYVuGY;$g75h+3{d594Vf!Nv{=FFwYi5nmb0@UeW$M zh#`}uT|GB#$tcDTK8W}#?{tHMym^4P-{CsegTa`+@h~RUji2`7mHit~P;wg6-Vk}Rj7iPk8i zb~m*9W>8sxuMIzuA+IRuf-g=1z5Ukj*nX(wNe=e!md6 zvO-a&Pqe6TJ9+Jh>>5IndSy_}My^4;fdt3Jj{&@UA{`b5CKECJ>umYLJ&&%H|Dj-H5gT;7^#tfnYPa8^OA z!583tADT(;WK4QQ^NzE6YU>%7u7q7aK7WV^fcj|HNyQoIi*KsDPVj}SJY%6j75QEC z^wpf=;EgQXp3VQju2#a(X$d**dYLe5i0&?nx2*fz)o3G**f&MY@7+Q5^n9dEg5$L^CTaQUk*=n3ujX zy&qJ26meSa`cqO6uARFNneX>>i3Ks> zF&im_nYJlDm2a{3v0=|*C1$bvTOm6=xcmpvd#@)Fv1RiI(fc($<$&njIv{$xMC494 zCUz5>9!Ic8(Ct6oN0Zi(ub5+&fQ9^)yg%cCk_OKUcb75RnU!f*F9Gzu4OjsH) z7lf-!1=?CTObYnMqmXh{%)a>nI=;og2<^csD0q$%%Y-FBS+I7kB?Z9hikoQs8Eiiz z&Ru4JGsJgHdttuG$8*L$Ldr7RA|4k|(kU{m)0mpVsImN5a%%F+@p7q{O^LVGZ>2Fln2cU>&V` zi-yq#b^^VKaOjX{bPOq}wV~P(NTYTZ4mH2!&$w;Mu7XQ0K67>SzOCz8sUy(I76jqq zt=M1c(Ivo5|3~OnR`7p@ZdvxZPWr7`QAi1QJQNZ`S#LoSO=hOi!3y3Scp8~4zSiDiKu9wY1w`~Byca^GqLPNaW~H>i(obquBCefV-^D|qg8 zz#8r)q45hEe1iT3>ND%N6TVC*C|=5PvznSeuCx$l6Rdq|pR8M{%ALoMlfF@~_%*yw zxxK8`1V1jrMG5m%l_3C*ZhzIoYvjDatH1c5=Kfn+TE^Q3Sy`1^sZ${Dv#QX;~v}a%c9+m5H^>c!e=1v z(ji;SHt(=blS+UU*-5PsB&vk`P>yjqWjo^NV>42cv&F7jk>}X`mi%v9UU)RUe! z+k6%(34%3C$yU34B^gR8^3*d%zFCoTjQgs;l65TVw0P^@M*LUDwAzZV%O-1`KprQ> zOMY_yh#%5oGEg4NOwQPWLhONjn*AKYthwQMZJR79qE2UK3`JeX1LEmcb_qN(+Xaxv zvJf+$Cac2;UZa(8zsFZaN_w$t<=v||W8=_Z?2LHxTI7h!%Gk$X&Br>j)dHv%9bcyQ zW_ay!)*@H1yI-y@HyAXnT(KRd%>J`)wrS=a>H!bQh}ddCz8ZTqh$z;TZ-P_iww16w zKQ3hC?1i{kf}03^x0n338*GmPw@w;qv0r~3L1DY>$h*zs&bQc(JQCbQd;1#q3DPD) zQy0`mZP+I9Y75Z+7sLiTnqbv87-X-dTPh{!8D&hS=Htp>jYhx%C{MJ}$@Hpii^P zduv9{24xzhJgRd(QnYZ@A9v}ET!u_X<@~cml(oEa_a0(P%G*E0RseiYV{-o5>W{su&D*${{5x%Rg>62H zTx(1s`PP~Kl^aYq=ADKKP&ebT4TN$x=hzqmSj|qQoftc5g{~?%LCI*wj{m+OTOSh8 z8eTGdbysz8N2kJ*cy(ujFa^yoSleNy!iP|`lPJQ`vnOgqnvz6i zeJ7UCKz9vk_c-_#F}1+chiEkz_cVj;#|r1JdSQsY?cKVH>W&+W2==sN(*Not^}0t- zToEf^F0{;*q3rgde3DX4*5e$y%y`8%=*aj5R6P5wQE`Ng?$$%mlZ~jpAb-Xb1P&+s ziGW~-$&7CiSHN?Wv{m|!;-#kk1P-NjuO=~>qI&X3rb{>hg$708S?V8G8gf1d;)pu+y?fItdN2KSm(>7FP7~nWY5pV0L}| zNmFivp_eb+7OJM;6G!RL7Hby0o~Cabxe6TSSQrC~NsX$pPtaUn!CG;CG~K0Jgzh96 z$RFjz4PxH~vm%gqJ3hdcDWSUwvpIKN!uz5=ejm)nGqbl>5RoMbe)fXU^;0ZS@(_P( z&|2pH*C1{)#OigWDWpEdqX{waoObu`2l|i+<*Mxuez{DheY^4-RwBRM%{l5G}fN1K(qZ83HIAjd};>)u{m8Y^L{-G z`a8P@*}NW}CD4|Jf1Prk{QYAZhs6NvX=Tkj-OWQt-QQs>+)we!(<)#$RUWwF@B`v+ zFNzg7J^!!4^R0)zgFUa5htFR5{i~|{v`!{ZM&fhHW3hYx1;Vw*)04|{D2=@JyTUVO zyhpGWi9E81o$bk=8QlHjPe9{{!~1+wh4T0}KfaFuK#Ju%gynZg2pH}~nWr3z z$o>lE7lfcddv0*|`7*!_i#-5J_z|G3%UcKXSr8NP1Nkh&#Q`YpbpUcoh1NWFaIefN zlE78B+^;5;(|R_G2Rh(6nD1B!UK!X zQ@rn9;Vr&ycOe>77^zJdT0Bq~z093+I#F^_wTcrIb}N+vIYb4NSrfGq@fJl%CAk0) zjUScLDLTSq8~b8D%`$^sRZPs~i_Xw%%l2(_PpoZrfnu&#VMKF+kaY#rKm-NH-YWh4 z9n|BmvR_|*R$zG2=mx3%6}5@z6mKps@$iKj;7fFB@yyaImgJxq1U?eQ@p8OQ=l zWyiSy@XUJvW~>G}`DO#CZW>+CuPR<1Le5bE{%O?ybt}6!6S4?<)(Y@NPXJ>1ajyVU zUP8tw!R_XzaJo4ckP#Zt#JGNXq`iaFXan_QOP~!KBKnfY1G8jw0f|TNhv<$`O zK3_V7y6sXrwyR<)U5+DInw-w+3^SZPSgcQ>t{L4K{;RNiwWmLvI$>+Nv z=j^VUh9&5I7d`L!4F_7tmdjYV+-CQS!UOLYD)6L70?l#bGO$j#0s#2g3KIxEz4@w8 zPP2l9Ibrc~2`=tEkqtbdT{oW2h?8X)ODfR3-H6=(W5CE zYxlX;c5kJ;1+>{5BY3wjQ>3m)fT(vF#1GD+`k?$SR$O%lf^MOrl!JaQFj47Z=%@SX zQyQ{-@5ntBaLwFtGA!2X|Noz=<&72@3`!KSjeX-#RqGM@zyfmM$c1cz@Qo}|7RBKUU~Htr zvMbDo#lpl4`jt77W)AeT{~4;CKpsyAd8257ckeL)=7IRN4y%s%Nl+{0z~nUY`8ycT zaL)n#tPRuugwc~gcsOKuOgVIyInPT zyc!5kg;9nphenYLN5O|9W%&cRJp36hLI6P`7#2d2tOkhJ8vfN7P1RPn)`CGgqe}pC ze!d9goKg`4$Lkn^v`>M&H}SnRniWrWSdJ0aE2sXJ{20Q*?>HrH1#xQiYyFiKaLl{> z74~}S!bA?jUe^Icw^(2rA^7HYk^AxUGz2XNAtDPpW&nAr;g$?NE&ZNqT7bv6kmg+Gjc?8K2K zHB`0@ieY~A0?}+ga|?^kRKd-r`l}|9lU~6`?g9Bwc^L}oDh%!s^4>#_-+%=;&S!iOiQj|A*_4D8Q*<=Zii}=>Vh@(WQk7_!-ch1>LeFdBM zTbihAi1+y~G@rZ6L~hc9mul__GvyH9OuG(L)>Yl3EZ!RdqkRwZz3OHTv-6e$v$>#V z&_LqF7GzAiVc@9H&D4wkpE24cd{-R-(VOO&evnZQhra#-`ftv4`B6>BuXZ?t#fBk{ zH$c@~ogYcX9ox{(GysgdM@Suvux;pbiM^4Z>995Ei~T8pJ?0Mn+*$1nK22Rf7MHma zjJe|^)m)}TzHk+GK@k+8e5sG_mR;hCTp`>^J@ifb^egPTjj(00w)-(2nn(ihdZYT# zNgm7P-s9lNohjWTtgeY?HdT2D1hlx}$vM^n=LYJ8;=n3)+8Z*+gF;$Ww-dZ4YWRBB6i2D0;dt( zCcRNd9`id|w$|^z)3Sd$XvNG7YHxxMY*jlz%bu+}h)VH}|LvfKXxTp;v2nradvbJg=g zBx_LJ=|`w&vwhO&t=QiV+IG#6AekeAr(`Zx)NrKnr_nQZj=FA};@y^LFx#QsVv^k> zOqy#ZtIX?5`L_BtOwg~CV~$yGUBVBJjm!Sn&6{(WuoqE#YOpwWn(AV-w;dR8y^2`{ zc=@6zSTPx`5krbNq!g-zUf7Y8TOms*MHr`hIjR>HDjDrkj=q*H7xBzPJIj96^UF^>1vT-+~+jmyJ)Vhvq% z`7QMBqWnJV8@!Py@|XNWKRf30!;6Up8+AfxhcWq8cG7v%I*bnT!D4+oqW0v9#Ncgt z=B6v;q$r*jh6e)L?|%zuoq>S%lj#{uyg8*eBvAJ#!G>7DJgKKpWARoSBkI(V5k7s_ zjKxgzWppMhI7hk^gxSxG@pQ!1H0UK}hbrn^WI4-^D)=0lovzGuX(}+D$Ce(yEQQ6B z)q=IHcl%%{2vCm&+Dz(VtuVombu%;!>oI#g*hF58 zFWKhnJuQ493{8WdSi9>f7M+b+ikaw0qRGfW9l^4UM@n8{(czI4H*`|_xI|x&D74_b z;^Q5y6lqbV4~Yd~wQa+V@}1dk7Rqtg6*ZF5cIRC&4}%rogy>xt5RENLq4BpMBbCjc z3~Wvhu>ffwRxc&IgouUHO6{X1ucZ7f#;0}BcY&+jL}8cL64+=}>hweQ2m05nLv2Fm znDT%#>RcSDJ?6ZL4a_A~S3GE!Ghp$2=-U0+_IgsD4#o#D-uDS8c;M@OXkD6NQ9Hbi ztFp6*;MJ*grYVY0YE>UI)cbvE83w=6CKY-bc~p~lns^#2t@3aKJuh zWy-O^-5HgAOz1Y_I(`*2ex$t&1(WsmhBIV?{GQzn6f3d+P_J-PoTs4ZWVz!CA;X{4 zD}0fs<07BL;;|{^fU^6+Y_a^LNzr?isRj#k88E?Vv zZEz3|!cL`@>c^AH(oZD?`f8rSqpZ``sAR4SWTDv>{EF+D-uoP18$fy#LlDYbLw>5W z-Xx2ADCAD-F=3r6q%u*?yD-xtbzFW;V9j&lT!Mn*^+H0zJC6l}j``m|(9-^my{an% zE$zRsSA8iM{B>jk0XMQ3TRrN5X1YH=828ya{-YAQyUaq${K$$!jS~8tIAiYD0J8bR zRCh6OD$DR++|EgQDIBJOaD(+WcmxxkSH!ZCo|ndFK0{U*67wSp*IZSt;}qITp;k8I zcY@lseHC|LsvUz&wY+Q|0!Q4K?}83fbsN&Ow*irxZ#wAi7dMHe6u(iG+_v~J@X>QF z%5`APv0$UO#)kNdnEr@1ERHi;;LT?b)QvAY7n&?$^A%-H-L6U6zG>7g`ko;pzyPQt zI$@hAsXze@S=DG_zYt+eXTf32HRb;;<~m_&k=k9vhNrJliLuo6hQ(ub^Y5Q5K#2tj z+^f5Lf$HlQIeIypX+Iij7M5w++uDPK!lB&V5e4Dm4!b($(f^`csR890r3_K7%Yr(z z{1L2OeGb|6)7~}e32$;V#(thGMK#r3dYGWWE1K9ywahITEAhoo(x&xcv~ZP;Htf^dH>eC z=Dm?HMoq%ThOVT8CH&|3zjL58bCc52C(O~OGi^4qBiT!rq zK=Ii*_0o#2Kmo;Md>TobSa%^+oY}ca=b`1f`u4pImT22!N zUed;{<`Xme`fgpfxmi_r@10j9wT;?xu7lCVH@EQ7cTSB>Oh$?n5s|LRWPGaW>VI{0 zqmi8Mw%X3cX+l8;L?Y9zZ<8=b(%wX;Z6DvSY(6y}0`it9+3i%N8+v%CF!||MMPZLT zrrDmZzC(`~X&VXQ3pd>gD!hF23I4Y?^dC>yr&c+#WF@?cIC<qM;u|e4zEW7fbP+_N z8SA!YKAe)|Qji@%|vm*=ek1X$TcZj_O zn2FEbx>=QWbFGd>Gd+&LBmghHqGB);hQUHU{e|AN?nys6jRejl__^~KQ>0! zj2+@92k1eckVtdI88!st{pa+HCV{rBk23PzV{ZOws-1N{3jwQeL7CW;BW9d+EXYTV zlr8IVxu-V+r5}Hzq*yOwuUen_>J+xG+$?su88k~5@6+BC->WzHe;}*l-kW~ypypY? zr;%=+5jAjT*7CL|qeD-z?a&tv&P>=0@~!)eK==Ezts23HE@UoWl4f*g!@SD=^S?ip zglBa$;mr*F9gYe2I|;(g0TL*TH4@p(|H}pNS6uc>Nc)r#veZV>UeWq} zptx4z$e)BQKjI02FmH+-*TF4;lMxzLNkz z>nL!v+}GIrDNWQ#PyxXm!@VAvh{eO^xxXLnX|SKf=nkZ-Tn@Qyz)<_wR=)#oqSgWI zp*n#yEt_h~{p%N9E<-IzVh}BE&i6M%?M%73X#K8u!FmZOSp;cTb{pF~{lOFT!^c|* zE33WAAl23R_yQ|Z;nT-YosTPHmr7k2DwqtneI*YaJp;CQpFoznu>?sPgNKGe&-P~` zkI6tP0}v8kHokL=^QhoGuF z;Ve{&WIJ5+V(#?5sTn{JH#Y-2&$aWAQzq?v2Uz0jHg8dnti!^<3*f$yw#j^S~54$ec7uKd_!?fw+&t|#+Z{lEjD)vxfX>MUHk zBXO@O-oH!!TcOjL1qzI6$S=SCPgTinVu(KP|Gn-HV%6bt^N0&gUV!+hNv+viyK>;% z1Pve^&S1z$gc4sWicS=BOsfRpA49a0Jd>=A4{%c&OiMyNSb&LKZx$W*bUJVH_DHh@ z4c&Q%CnLaV=VYlq2G&dGQr-VmAkz6QQud*dPSv__F)Cf3Pr&nkiS zaBr8v<$djBPH<+@G+QnxW9WLPvc=p=ySU0PuiHmKjJG5OcQfR5B?3EbQ`oA#np7sgu~VnWGAMw_QWgAeu=eV#6F0q@x_qq| zd%9Aj3wXY2wf4vK*D`<9z0=VgBH}B1J5HCqSH?RHwY^Zkqy$YCVh|cSVe6-~&c{XkkLN%T2 z3IRB~GNY0HkN{7OTtYkLmp4)xAFTZak2dYg8C9|LIhmR5fJaba=<$bODxZ;fAr7vn%*@s08m)(-PQDzi z`B!jxfn5@I;*Z!;yBl1&O#Pt)Z~$#ZW12*@;p?q&t%Fdf+@PVW;TAv?D*o@&tv~5$ z0XGTsw4b*jt!&qbU8l%U$D`=4?2ieIFpi7Viv5|NZZ^Z)!IP`3GR6Icwk{QImjEsW zTM7Wt%Jj%&s@EW49V&;!%b+ojLz~Y&P|5TO8^g%0S2+eTZi6oA^i4;GLbjk3;uBOp z)hwe!fWMQ~%Qqmhz!rKbT-#`%OJd95P3WfLO(qlt&5EPqkK}Wf_eTH@T+OVy&sT+$ zJ%4L}bLE50+*{0Enpc9LDpQHK-TVhyrKUKr^ou?j>jDD_9{?q?)HC&di0D;Kx2=kD!l?`;^L}Z z#zzy3*hzx0i_a%)I?>4T<|Gxs(Cmbjd&G@#CT4akT<>1^zOrTYN}Bo_}X^v zjCi1A>lU9GioxsZ8LDCaDegzj_TNi{boIw$r;`cthr*ay6 zvm5!)Upv{&VN|8WW2tc&Cel>g|Ks7>#A7%y!UXqOZ=4gB8D<}Iq}x-y8=@n`4nYpZcNA)8w=N18ung3<^uT| znAY*cz7Tv)+<+2e-MPj{?sb5+9>*;!LeZv7p&EMr|07&c5U5*s%m$23OCfkSeR!*RMMBnwXsFdfMOA2Btynf0PB!45%(c1pICMu+5HL-E9JTuDkT^4&VIEzB5Cz+O|Le zOiNux&wGJwp%o>RIFQwz%VYs$>zns~kgaktB93tIF9g%n8cI9#$V~JR4R%@PG;0G! z6^DeGbE}Pu0y)_NPsmf-#R?@^y`I8Z`BC*9umn+VcG9&kqveIxwHb+U$3esT^wX0e zn~R@!(Qi!eNaHu+zNP*fZr%8l;qsTRR@eAIS4-2JFL$INF-x(u= zIo04=MTC%18MPW6mNxRgST#GQ8y7OI$e>y7u-d7`3)Dt(4cFxo@=M9?^*8BoD(YdIO1L_+ixP1PcWTPwNJ}s%t4$r4(D)ShR zBj#ss@+hqjS^shwV`GQEAm75T5SWt6= z`N7;FA;Kv&0et273HzXUL+m8tl1C$emIahKii&`=%GOAY65r5%!)oDGNuB$>-vTjktvhL6CXR_gh!)fv87Uz&Hli{I5 z!e;dQFg5L(=hUq1F-|}7J&q-}#&1fkdy?)-jGqrfF8Hmof?vU3Kj+`>;h&uiU-wAs zOv$$TiVKyHW#k`=tNZfel}ZibCCo#9G+l-9+_m50uEIa#uF0t1;jZYm)Es`SZ+-ub z-_x$>YUI~=o7RTD9WFq-#;dbSOw_Lx@D5=(+wf1z1T>Bz#2*f>P9u3#&grIi%GVd6 z;-BhK>*-y@Fby7WusP5ECSSqgR&QFM)_E7Y^_u5A8oW#XH=S2Ranmq zpoCU8{8^n9i{y?xHJ;kW21jHThKRd09fDoY`~$n<9rtPjXb`JWYD_q@tWE_XBT}h7dgqK|x>vnzS~c8O zr!)-sW&Me))HGDhlAObItBZJf{UE{Yd(B50eO(IlO`6dnG}|>HTZ(Uhv${!SoPTs~wTHEVADIg>{ZHQGn~m2T+9t%m<_T%HTfbt zBv7ZlUQ9rqbLUiQR`2U{6<+>6$FBDU=3cvN2{=vEkN-h3D@*jJWY%Kz49ygbw8Esy z1cpI#v(_ktd&0t-L(hiLEzb5@i5kHf=UuVfShw>Z??vBc`Wbc|qW3%Xac)0K$a$}< zBiS82i=6#X?pWM79rNS(=aJN>of0Wbayly!yA=Bbi1>nTQZmfgU49b-Tzw49_|ehk zdM_6q`zvFxAoTb!b*Q)Tv!p!pU-PGUnD7f+Zh~zZV=_IZs_scxW{c0j+vGJzMrg#)=PoV5doHYedhHP}5gYkuvZD-;&uigeCtyP&&hKEEc| zFzp}3Qx(TE+S_$?ck-oE>cEif+m<+jH0F|gRRhY&MMO~l@qA}S@iZ-2K~%a0;6wi(mn)gweE}F=sGqxog2k=RkHK?>~}0%gY$37 zk`NG6t1DM=U>>bT6sX3B1Z=N0h({K&C(m8E-7F_r63M$;&ZKLT!@w#ZUvSejs${&Y z^Fk>sk*G9{aOqPR`{ZAU+s=RbN%%UpvdKh7X1HoiRwA-ITK zSeIz6zxQnw`@Q+$X-_4V??{vB)mxJ@8*=jN+0z_)KX$&;Aho7n)s&_!7;6*Sc)oiV zd##%GB%n)!`W{w9R9yOlY<-Y;U1fp$`LS_pw_P8`iN0Mo1rZ(D`mI8wSzA*fCYZz~Dc|i*1M9Qsj4v$LQ=WfX;L7KUx|dZ; z#+mtkP)A~o*3P;&@aNzy1|xl8v7dRN^|IX4|HQds;BCL;r+{e?M@Dy6|HO6V}Ctg z_$jByN{c`_xGhcfE!->e=QTgO7V^4pK2MqrBB8qxQ?U;&WS~ZP?#o6ZNy;sOwqlTL zVfQz~2K5xe0{~cZ$k;iL83*FpN`SlcK*@7*b78mSq7g_V((-A*#1mYsd>RG9)%y>P zuUe7am5KKRwBbj9ndwDqsp~>-pL#m}DYwn5r3>|}4El$@C#CDz)QxW3m_4)bZso-C zPmLK=rnpyJ`2;cR8u3DHa~=fP}LgER2Kt#9@k5#YctAqx&Gua|HEW&vwCs zV=#9FC1o$3WKl|9%L74SD{t|DMnR?;P%}vSxjs;!bmYz{(y-gf7GF&R!5-5`sC8KK z$DR}a8GaBjf4?_834EqFPhit5%+`JO3^Y7G7Mq*^UtfmpvAlEBGWxk-?Xvu9=S4;+ zSO!bnLZyRxw%dYN-w2p{=7CG%geDg*w5~)^&IrEIw;g?BnUTSz;g>Fl4r47gsA%vq z-=`|6AA9|XufsK79{l(WP91_q`I9kVzrN2NY}PLWUd9QSW45Lmfj4-DUG>RlU~#=$ z+RC2z%?s1R@-iMkrH3Qt8K%P#bNv-4VlD!H%AO>ElzCI7ov_RSu~AKKFq3x~RC}~n z0FJ_a+??g>|ToA`@7e4*duY+7+mGeq5>xyif*cV5Tr9)1wg# zKDQ)mS5Fs9wM1=6R&x6pF*g}<_5sz`7S_n?ZCg!rx9>rnT)RM$u)kU+l{rJ9o&5Ek z8Xoqm8fe1KjQhB?YBgKq4jh-|ptr4zOY_+b-$P+gGhZepYSlq~9>m?Fg4Kszf4X>M za(R+Lnu9#g>MoA}EA2-}im^DE1WE_M z_m((a;VHm~Z}iAjV;wBsYeWSFD>Kmf%busxo!XwSr$KrE!jjYbV{#ykk?5lLX7QkG5{i>>nkd zpU^9^nQT0_-~pXpCbvOg)ZZy_V;uJ0p|Oq&kP1no_42U6Yd&2$YCsNixAX1q0tx32a2z#vO~3=oRe>66ch zewkhRRmeXzm@H|uKZTFLaIq_}ry+yv!PxFp_j72zMTKtTdOlM%qq9iDp8@jxe&>aO zRwkc?7tgEiG!sd(ymImDk457jYpKy_?GLoUIH>Z;ixyuO{|ZX96J195MX+im-jm7Yy(u4GBvhG* z+z4Zm8Y`u!GcmZhV5XQf-3B@vB}UyBbLQmq-|Q}nUrBbm^5YrfsOJAfzc!q}7qtUJ zKBMa<63yVV>H-J0v6yK4Tx_hdw;R7+k7^MsW6FQ0U-R^cCpR(Vsx9F%7>6dr5V>_x zX)*tpZxQ*Q5?SS3s5`Cg^|<__vb|p{vhzUx@{>hY*c}he(BECY#mqjkb#i6f&zC6* zzWOaWHDz7Gw^__9k|{-C*&K~SGEeKaNx%{CY4Pw~=5aRky=lYH&#E?(Qc-6D*LR~g zm3}=vVJ7!;%au)dc=j449#CKhsVRQrVZ2#&F#cEpW2H7rguB<|rvOM(Fll_y77w(TmoHChm9wWgA2suG5{`EX6Z zFGS?~DamgW4fiH9*&q3RZj?{{2ZD`r+q{zmZSb2>n9;Kwah7jMUQ_!#23*=RBV>;8 z0=CrQIq=()twiSS+n97#Jmx=yvBSVMK|XRk8GB!#!2>I@3}+L-@L@#iDsqS$uFES` z-B`We2s3oW_jA)mQsEp42CQX#cTV*eLdS35)M@Zu3XqJ;5jP z?rNj8chTfnV0`oAN1nHF)d8hETRH03!rgOHVt3xm)L1sTXKtwNNNxGlOjA2iOWkNa zbc*>>O`5bZOS1m*1%dhI1Es(&0K;`kCxhr_zv{lXbWmzcEc2R`39*(35v*XsWuZE1 zgpE!B@oi#RJ$plxJdCLHV z?p`fSaQgVMZ#oR{KHL*C|11AUVuMlv20QIXa7YphkD6MOmd~IUtChT>t8DqL&2q00 zOp)D@{SOOgk-zuEc54lGB?_3zW=FMbPJY6g1a2{oNy6~aH>do9*@}sb!qL>dKX4XL zG?1JuX-K#RhmgDuK5-rF|7?nl`pXnccKZ)gY$y1Z9SY85O+z7_;|zbj1ji= z9K!dAtbn;MlS3m7pLMyA z!zB6+e%lh$@`80HJ+q0L+^5>pqRQ557;EiUCrPtp!$YL-)Hh5|p@mIjWLh*IBM!S^ zRr28!0{;gdme7?uJ6|?avm=q`G_ronbm|U^%Htx(U}`WcTrx|u8brO$xN?>?+iBQi zhaq()wfA-!B}G^`+mdyVKvY8j+zve{V!=W~`bipIEJJU{N} zQdSn;MFzrI0=BM4VY3l>!a@)=5I@kLBA~Dk)UV!PqjFp%CVN~}mW}4sE%SEoIo1Y++93-AW9>uO;YyXcTg}=s!td6)){&O>StOn1Zs!G)BgELFPVx$k zJZI0&@|@h;J?*_d1Xa-8{P4l+jgyu2vq}vqt#^f+U$wPhaduB@_1t0pDvkDF2if5) zT4zjFDw<#@U=A5%ZDms=Vopp@MSs=PVqdcB8ed{vN>k{)gq;W~$}M;y*f`%ckEsv) zeycxnDSj;R)KNy5;F9Pql|%)B^Ma2{f^<4g>oE@ER1+J@;!I0wLq7(HHAx&}SKgEdI%{b9F=E8A#h`+Z^H!}A9RwykH(XQe0VzQqx{W0 znKZk+@d%cI??cZK^OvU+nHt>o<@*(dnNgZA?aYt#Nza&EM9QYx%h&pb9zeIwk=X8G zW6<2ZUb#FQDmQ$sy}7YYDUjOSWX`SBJn&A)Il}%>Z>!7C4W;JdUv?BJKC4?}@i}nI zZW98xtlfJ7$SunhcvL|10J;@Wk+aGX=HVr2kiiHJE9!|odp70ORB_wU?aZTKG4wbB zxMkxj+S%11*5h+D?G}X8vZ5Vt;fVPmbmeQ+r@98-E)iR0>n>p;qOInidr~Fo z-QHgqLog$zI^o=i5rILWdSJGX_aKgK3SEcs4$zHhTfsW$g(A5lrmqEN@w}46OXMxb zc-&o!i`Y6-|B5bBtHDs-mhtqYNU%-wemDWjjym9NFt+pF4^X7iw1q^;uMSuZIqs0{ z<4;TaUBc!!3%hu)*u41?7W%Dg-|uD(iu&w~_mg`h7k}L??o5&ny+|5a5&T&wrHu9D z`+=6rzAu_KMj~l7NgEp+3>UrBcI!;AN3WI{Y3qISoXg@kp^YU&OT-uWN-YLXiZpH1 znT7dL(9 z#3PU46(qy{qK#Q5h6;gx8ii&8rwu(|j(%JkFb3e172JLwL=xBlUZVN)E_`+~aO->V zX21jhxZFNQQ0hokXxH|bLCqub*@M%fwq+ULNE}h8Q)qBP4DSbDh0aDwM{VS%4!9Ro z;Z*MnEpTL~-wkz}Nr-VZa1#rPYMP}+34DI{YKW({58X+oL-3g4XoFal@RBLx8(yo8 zD=06-#Ap3fXcsp^d-MXv1yx;NgtZk0(?*+0MKdedE^nQbR+>@!*Bs|KO> z-6lnvlUQ?#Haa}`Rh0gPWO1msOMM{QyiXujY5w~E;q5)6n%dvBT`5A4mWa{`O^Q+@ zRisIkj-rByND&0-NC~||=%`3lI@pk+NUxzOT|h*nBV8b&NXPd#b*=T6wYU51cbqfM zSnGp27)eN(ne%?G=eiwhXbaQd(!K~FPZNBdOpMcgn3Px}RwQz|kHLbYhaNUA!(<=v zfxa#0?0=F(kbKGOfm`Wk_$^2}p;#~8!pmJSdFbc-VJB2GR055i#!vit-Q1FtKyLb4 zmhssg1-G|a+RAtSbqe>Nzh+1iFF2U$r-?p__#eW!5Dr;EK*N=&f+QrB} zJ};tNAP%)rfBW3#Uzy53nW@z(ami_whlOT0GyZTZ@_HPgnd|h&ygx#^8SiO;QuxT# zJE0Oq8gIxP01&(?;BIWEL`n~Kf~#^Unp>MR22!S}Kspyt=w%9(3N3?jdnYlmXvOq> zaIeGA$~VYk3j+(31Ae{MjA`{RISZU0w#44^)7sC@=&-rbIX~n!+~m68YH$I6!r<_w zVulOhTM^3+UYV1*aq1a&y3?o%-&V||w1;`EzUR3KltP!M=DunIy)&>7)P8a4)8Y&K z3dNz25qE5U8|=-yf*8kEdG)mDrRsAx-rk*_0fxovS%Afz1$?d!+e|_EWW+>fmMjk* zq_(WXKg*DI7KMJcb^(LJ0w-_qRLJ}J`A$6{d!6q!s?Hq)Oj!q{efwkDIZ)Ps&#IdLtV4AH&+`zJ#w!-`Oh;&N&# z5h~`QNcdUIwN&~=Fp+fort^C)U-dH{?6{E7J71uhX=-+g zxKC$Z=1;bJ_FN!6M@;$+>SLn2>2m)^HDFq$AYXu_tb9j$t}y6zD*^p;T@` zB$TVxAeFW$6!18+1C@~hGeT;4KDlgYl72y{p5shJ4=-#yS^q_DE(&<&{l-9X(fMI$ zcN|2b@Klz%L=dzFSAmy^WwRgH4n^sx@INxckj?;yPW|c4h(E38JiC6_1d+lQV0iF3 z?MX}hI>c%rI<%4f7oWh?8B8 zk=?Np>P2D3yw^HMAdDTnL*#_|pZFbY+iy=NxdqwJLAnEnLM4dHTggcP_?|2mrr!-r2aCY#N-cDx0DK;P!n#{I z?HRKm$#n%g)s_VITF_M$8 zU8#1ja~^Dy5FfZ))M%;w5^9xZlJl+p$)ayx)<>Ucx!zk5EipQ%oP6h%#A+tB;}f(4 zBrYk?NEEDP4YrWah-KVRxSnnN8q<%SR)##@YhgIcJYU?EoVr$qrCpHfJ3~<}UDN3? zXuTNHWymlIP-$Ki8cLX-DlxTbrA>36!fbLc39L);2Qyh;5*!$ddSfPAPkx(Z4 zIX{tk9qBoa>cdy~(3^=Q=FLwptyN|Slu7CrB5{rr%*KY(XQeISiST?)B}EGJ41fJ2 zePqQTw-le{3NyL4TrpdjYG3)@6)02FRpsT&8?^zvCzN-;l(Hu|C9FKL6h*A(h)~A4 zRf2Qg5$1ax6LOr)lS^TVNWuoFwdmSS*Q@DtSx2X90Uhnb09jR5-iKUNxjFeZQ7A@- zcl8cXkGO#eStY9yyEAG|f$i&)204mR-(9;~d7vTqZqf2cRTY@4HT%heal!r(3V`fB zAh;>Z1a`aW3_w9}>fb)v=YRQVJ0Kse@StL_!k$9#B%`L%1!0R6_HPXGW{?%-M~7G= zV&&@4F~T$6Q@!%U;yMo?El6a7(**W(v}WDGir; zceQ-?L0zGxp|={%!594}POGP1=n0kZ&|Q)7T*u|JqQ?pRSaa;~$C}T!`%9LP4V_eA z|D?rmnlF&ij)|RmsuIX1nm-bsj!tE zGY37~dST?7=mA2tXb~)H{Ae9+ z!^+JwPZ&kMf(j_(p~gXs^v zy&t@b%#e=}`|qgnNj91<+(}l^n;a*S*y9q8?hssYTjd0(fBFZz|aDX?&iPP~sivJXaq<$BuZn!T!fV-OjgFjApl2O4giuX08P zCHq%)d&q5E+kwkvoqW|KgUB91$b~a)YBgz~Ir962=0y5gHjlVv$}X2rc_+UzQp;be z9#ziJB^++uV#)9`MJI6h-m9aCmJRqo+A&wiUEB8*jmA1qE66Ian2Ao{cNF2XwHJo? zuhySK!kz80!DO|aebn1ezF1{P?>X(VyxChnd}01krQU0f9n+z09@lxq1$^z`jYZ=_ zTxa0-CH1wZSbc55-qp)Qe&e%1S>(2yL@De{x*!YsIg6r|)7MkW!{*{GDcTTO2DdO; zl(+}Qu6VfgWFG3QfttF+E#~T6IEA8O92QOiW)*satZ|**TT!%~7vzuiHtGnKmuRiQ+V; zUCe2~?>^uG{4NjHUX*f&D(G5u22M(|o$qm1c#p;7>*@E!buss8(@ZVVbxDsNl3Kfg zobZkOGxG?^#e#`T5xC$@N;}pS2?{Dq27QqI5S+F(-m@A0_8E`TnJvyWYqVRZQ#I*CcztwH zbkT+MEWvLnIAgO2KSNgX=8NsORyg7w`Fogio|cd z@S(~cSxqJ-+4FVmE*>-PTB{@SNs~s?`xnK02>Z4fu`;YzuHzV+8T;<=*=!0~$9J)H z3SY zJ?<^6(;$*EJ8C;BfR&JBGLo`7Da%5E5_wIt9jj?I&2r&%7j}xfHk1e}O!X;dmS&nq zPDz@$Cg1utSr`v};3-Xnr+X(%nNHm|Yg);o(hfN$fpr)7h;q7ubNUrHZQih3H|r=P#V);2|8XX)cF+pte? zi7DWTm)81$snfqdwhAUQ(updU4W%RDt7v@1am%WLvs)_9%!W88kshz#E1^OMFGzta zCp?i)UI9dT_#O#xeAvxP9z?5jJP(^(Y)#UNKZAWpif<)8Tb(UTa{(vW=*6qStRc4( zGYjWnsG=D9si`&1V&>MpZShV!9m5KX`vz%h^&VldV+Y?;=~KiMJ;_j@K?IU)+9ht;I@|WB}bF%+)V_lm0~G{j;1y6B`OuO=}1p zQF1z}p{XQ8W7vFf?wE;ipvL7Ik@BaSHv>=O60T*gpg(>nwSA>JbcWEz3SI4_h5j*k z#ZH<4(Fhktcs*B)VK)%gitBXjFu`u*enc_jk8wFDDdy#Vx$+|}J6Fx)LHVV+39(DJ zFl@H+*mDI$DB>WIgeEB)*0u0CovX*KzBtVg-Vp zJy_3lvd~1ya-a|NynXNS7Z2yvmV1A9SP17oTb3}g2v~GS-b1sDfVMT3NpvYPuahkm z2fLX69EcP!!v4A#cf!!kzGs)Ro%?oi8Jq{8tmfONPi8dty`A{?%iT%NYd#e%4t6%B zD4{np-KOU#H_=>T5w+5_f5C3kSp3jlw()!{0aIWI!>BGyCSN18SiTYWR3fKCCp6+|waZgZy63bEg`Xywioeq(p`)Q|5p!sE|WlY?dhWjg; zN0&W&6hyioe3R?*dIN}M>68H zp*h2Kr^;vuoYv~ ztwOg>M-c#buxKiKcArXbs%pTl=V2421J6Ro4mp-{iHe;bFn-1}cmsukd zRL5SX%0D$0VWrYylq)dNk&#}5uklCok_C(A&2w_E?cSYaUP=u+Gc0kg%Yh|})fE4D zYJyxrYLjlaMv1=ZM#?VVEPM-2_=Y}hY511a)NnSu$KxW`e|d$ov`vysN0rgegD!3A zMpw9cSufj0l`hye zaGr{6&PC7(*_4-;Q@ZjOL|IEeqa$g+w0)?&%_14|*`?R4ko~!D;}pdXK3HS5h+o{H zTEQA3cGbeH`)psJOzQnTCuK&J*WD?)*=R`Da>G9%Oo5S>ZnP`R`y2fV^Q`Y}J)0$F zz2N!OiFKv(iSY?fsK@Z9N}e<{PJyr&K3-eDdi2s%TI5#eP%+we%_JhsOuAp8Nu_CO zBJCB8`g!vq!S+)CD}5~IJa?MAV4ugV98 zQAB?pe5bho67?yr?OG>sf8C3U?^nLxWh0R42>;s!kRf}G@@>x9YkUL;PnGG+h6nSH z)`UKjALujdl#^Bxy4;1&RWm44{r=TTj`7DkiG~5N zD+&HP1{T|AHfFSdq}K8Y^-%Ta`2B_Jx5#xWzO+G&PAMz-((b(&|U_pN`+xc?PxW8_`o z&nzS=?$T}?`~0y~>V;D72_R}6{;qVVWqXHs_7uji7)c!ZtugUsJD%6%2X2R&;JJwZAx{5!Tcx(2{~vGbonj#|I+|+%lq9WuA9266 z2{f_W94sI-fC{B7PLF~T@p&k(eVy~MCp_4wJQVV6I%yuh-2CTP`KT#hHGJ*f(*Diw ze@E8)0MI;m2jYzxs3rNe(Ptp57&eO(n0euJ*X`X=)73PuWhYi|+=c7qya?#`wxS~b z?z7BQ_DzObYV_aPcyyS*TZNsp>m?U8;H8)c`Q&+tPe%8)Mbo@j)t+{0KaO+`xMXK% zs&xPuICo8rm7Yw+4;v3pIJHDEEQ5!B4*<9ipt7EuT3XRJfPeNupv0h4+Xf&#t3qfE zdBwXo$NcrYqhRz4|!bwQLj0;1DJ+3l}1LZ?8gF)S;!fdlpEYZEeWeDnnZeF8(%cWSor`oQ-R#6NUG5MtD-AwvWmw4SWS<|QL zcy&Irr-LzZ+T*?4IukDkWBtOHhbg}n4d8=0`79N5Lv^B--kP_@7{jDME>>frcn!oH z$zQ;8IShfSkdUuA5E0Z|>kPvbpA>Ow2sPn=p94&YfN9zXYN^C2(sE)enVRXo&|dVdp? zav!WE+_0aANZrY;BV>NP<+3yQa21hbn!39_&H8pOWYgOoSxbpUu~D7N;-fQ*Ht-)8ha=3*5od%OIt9fwZ%9jDRB- z@uNZ=$ut4r7mko^R2y_NIYUhqc(u)No-{{@!@S|M@o@xP(a+GM+2<}Hm7+={!O_6a zjOpT3AO@`Ki9zfAZWuqui6IarD+?_&fE(|+2Qtd%UjRQ%J{cHxBC2-JIj>C3j6H}( z*yIIjJ9!__?e<;gW=jeyHs|nQ*dYV_v;oh4`e}iUFdfQ$Svo+2-W~FU9i&!JeSdg( z5$!p_$4@jo!@84D=H5&Yshg`oH^%*-7m&J-xF{5*fB?1_kh*K&kTE}0Vm;M-cBiB6 zU_)r-iRz6ykcRp&B^cTQ3H zh=@*J-w$oI{xaiX)oOjmNkJt^&@SR&8$5UAAFti$%o^}g1%BF>#;1G`0msQ8%#^$n zQmWRu-&^^5FaUsg2~e2)snXR3;^}tAICm(iZ4BB1#O*?1?`pCb6Wxn!da4e6$B3Q+ zk?@n(s|b1cg(PfWy^?5?Fo_6S_7#|^$-em&0Jj=CpxH;jD6PQeQ^CO=R2Ug@zIOak zP?E|Jx41BX!rAQ}lIG2^^A3Z#h%s?8aKr4~30AD$$Mx<)BeZ`KU?By{p9wIFMbjHf z0s?U5$_qNln(<`H2VbYm8VYN^82N&S)4ox50 z0Yi-IxQ>+)hc;-UBPaay)mb|_#7U&)g{6_IGDXKcB%%mzX#Iuxslc1>=06Vhea<)2 zoD85$1*8_;I-CGN8&?{@9z9yXOPXO!aNrXkyr~+lZ84n>;#fdSNUl2B9qkq4jOf%mDX(KZ5m3a<6;QNz` zAkFImSs&Vrb7lkRD8eQhXg049D@2W51evcm``+ggKVnzkH*++HSL&_oiSMp@Oo~dd z^%gET4bfp*%42cw|61R zH17Qo8Yf~Dbtb~};i|Aq0s$}4wP4mJ<>~@@7wjH5IbJ8aEIwg!jEl%X`Yb5Ha( zgSYExuTLc4$1=NyqT-Zu)YKb^xd*ns0F%M-#*oC6c+xDow2Xc~S@VdMbF+^hda;{u z);c`_pxK()$+2W{Z3e_^hIMl=8Y?T*Xfn;a-e_g}1Wm4EOuy1}M@njOjXeq|f%P2? zf%b)F@h7f342@+N-7yaIuHi*3CHCz^sFNQMg;%Ao7K1tThz_-qwmma*-||u!KrxUALPobX|3a;=C{`*a0ocz~!0ZNf+QulcD9@{j?ho4-JE3ykI@~;6ox-M<9Kw;fBx|qc<*u zfpUQ|E&GYP84QzbOHV*6Uzfvx3X|PeW!qi5;v&yOdu;(T3K&w?v1jJf{Er|2<4&I`$_C#=0p{G&59oV z%;gd6^r4~Sk7CIc;ItNTrz8{GxcF}k->D|Vvzhvb18XhAPiyU2V6Amjp364w&#OQ*oH2^M#h_BKpFG(O zxxzF=`^h2oT8|}yldRojAB^#EHWxW^8lp`HRUNaMRCG!KY`EwB+h$Qf#DeG%1M?%ThQY9W+IT z?0BP8cjYE{g&qqJvVC*D`PI$|5uFTR-8_vOX0NmcILr+pYi;#oE67^Q^wU~P6QF)v z-qw7LF>3czOAQMGdFjdgc!|#tUn-?3=G*#FWZG@9-aKlWRwUu==$DTFoXJ9e=(z&x zKWidtn)TeM|64WH7s^M`r)}e6=qS@}E-grB91|mvgUNsBWX4%x-vwQ`oPv^B2j@s` z7>Zxs+9nqx=?}K<|9ETZND=&%PDkgzPGL{HQpjgE>Rrv2Zh61cdR&A5l28QYDMiHD zJ!X>92EJBU(CoDbmvms)t_gA9wbbI&D9@38&~`#byUP5GhgC`HGv%Y^=4$)N>=(K5 zCdb69acI%|QCjEVO0POq7LOuMyt(OqJ(Bu9qYztDD44ihA2@hY4UxJNlub@;*7IvI zR*`ha3!(XLB9$xTt;L+kye<>k`tFyvHg6YvuD|Ae=6ukrjW-NDYG%wR)UF5ySoVYi zF`aA7v5rmmkSfAHteGh+Df2YwIgXB09$_RA!E9vzf4a zbA2S|Fyei1AL&C)Eii3ero8}VSdn5>Etkb!KA-%)lwd4XZm z0_!3kjxsQ2`n2TC4+BvsW;jaoFPxUyNir?G$RyR#B z2v9n5U&foaQS`>n1Fcjs2g3v{`SK}Q3_GrGrQ_u}&9P-`<|$BHw&J;A9gwgy&^o`k~H~lh6Hm&GrY-Gce(D=9?C&z zU|3<@BuqnGwBF!GOeghZwQrU+CnG#j7H8c@I_bhn zvJ+w>Lt>AiTI##j>|2jb9Je^0N4MV*uU+Nah4Q~`$f;-QabNDI#&$0lXl%u8lOT<4 zELQY#-eYbCLK@Sg7cGX?28N87Aeebcbcv&;R`YI@>)7P##WU1SxLVE_kD3Xe#{Ze9 zt$*2?C##nTvsK$TK4US@Zo*;NaOO|pL-R?1-X7Ww)B;CX!w75Gp!qqL4Br3Fm zOHTr5{$^;cz8T>}uY*0deMV1qkzj}FBwJy|wDwho!V^vMYu~VZQ6uU)k`uwh1+TVy z!vQcV`wJLl?q(i(ttG+&Bw3qL;Ht8o|1+my@hCG9dV#y-@?vwZf)Sg*OV;x-M*_+t zGW;h5=nKNEC)7Q79I9jC^T$x)?e$E@Vsm?X(IFG+`%&~(=iL)i5+?P92zK6q%d2~n zjCGu7EJs?O%HS1PL(&+%Tdz1l%9u#r>@u)jR*;J6%6reU2g+b3He*V_uxs`_UYOXv zTF+yy|3tJH*~hvRv(AMSMk0cZ!WLcfGm3iL8L|WMHu|5$tH^M5!ap3c1^T;|v7*y^ z*;x7KpV~|?4PI6la!q%IIbjD3&U>J{)KqZ*7tF^^g=aiZCl2JcQkunP$oXWp+t$>O zqx?EL*y61fqZxbI3ep$(Z}pg;t(U^K(guuPm+-4xPwuvq_lGM7I@F(T*MiKq~-S`;gNMNQ6Vqqj=+?3Sk|eL;X$xd72pmY0o64BW>G0 zwO}_4t9=I;3rGZQ0N0y;)FDsx7c{&2*(gIb7WtWzHwShFK~U|~sD*m*Z0^j9!w-_4 zK&!$|xWDb<-{Bk^D}i{<{ol0&;1HEV^QK;BPtKueem5TenR6?c;Uzyk~#>8KsN>5UGJx{(#q)#SeX1{f5ngf6qPs3{urS zx8|)q^m`pXtP&xfCCmDF5?Nf`wv}?3)7{pL|5yF%Z`<=7DiA-L8qNIZ?H_Ma6b3zQ z@Qya6KmG=7it;yx6T-4D{|Rq}2avGqeqpP)BK!~{W;JU57sRX>AV00tKV|=snS}>% zYsu@`r@Cw`OdblSe|r^D7=dy?VD%%7fEtrU4JK$51c9~BRc^a2-3BOudT^xc`~ zx%K!TbXIv6BoZT_pUEhpr0vl=a9uF_ebmdL)wTUkcig6t;RaTtr?oCU?^G~Z{rY~n zplaDUh?Lq5+)^FX=2Tt&smgujI+oVcIz!Nb{UOqwA1hxc>P|{cWXHOyJ_HaR7fHE8bqQ+^ce(Mu}q_cXdIf38y z%o>P?Mx3aF^wuYuvLXc++R0OuX|JE^klI)~%+8wrzhY;b{$ghz6dYsk>5Y4)e_UPp z_v48b3Gv;mpm9sbPDllDPt$7&^baleWCooFdFBXsj7viMfaAFbb+uQ4KBb$`hGqR5 z;E}C@3b#Ob(}R*!T{k_p1VY;M#tq2Lx>Pncn*IfhZ=e+p<{%5(;c_Qv-MxMKf^VXc zb9nj#bz_)!=EP^W7KS@piZG(DZ`;ni+A< z_i5HibQFU~%O{zo_)>515>|n2?KknZ-bTHA2^AJGJiJ*Z%n!j;Y6Sq9-;P%X2+a5T zPTb8uy?Fi3lj#-81i#_)`?wUF0w<`V?U&%zFc@4h+GwOj_<|g}0#tW#3oZu6vd=tv zxpd-j1&8QqLiEg|_SM{GB9fg=DA!bpMJ|DOwzWThTaHv{8{~p#=$3);(h(@@9l?uL zRrlkKcgW$O^F_G)(l_Ov_fG;eyh0i81d!ovY1W zq?r+CA=$uBYcQJC z$5uk_;a8yJY#DS>xj;gJDQOR3OcL<3>d>rkQ)HR|5Z6f+>5=0F$i`}uA`k^_-$QQ< z1H9h;XYe@=0{<16xA0+%P9;PJLlV&uko_(LQGnPch|Q#kW!i#-lWD_F*ExkI4uOx= z1e_da8+hJkT%dMq(pN@$QW!VOSS%VUD?h?oz65w<<6$LHMI{S1H^9Q*i0gMJ{s4J1 zATf7^Bj%=)u?@H8my#(c`5YiW!{`S_1|1%$uS$B=E4+JUmHO%z0|d+LW$7tdEy}3r|`KL}tL7X$`H|%YbF_<5XxE`799I zCjKV2g+N=B!$H={Jya zFGD`j$x|G3K`g`yqYUy5A{px{hS4Qg`nF-!`tVKueSS&!{YDdj9WFS#8I0 zr2LoMPUo=;1`^#yz0Krt)wBjC0S5LMW;6pf+WAIJPvXyjb?>2^Pb+`)+mH`cunv1d zj1xZ%c7JT=6!ph)cN`O=ShcRlMTIf3DTzQ*{qOz}Yi_JhS#eBljWVko%$p9rVe_-n z!{h9P7UN}swc6*(9oGDU4oI?@TTKzZGnlxHawjE$|X`Dv^8Zs8T5iiTe6|mygp=;1PjaJ zn!t6Ly`XJjg9Du{Kw_2WOpZZ1+k*$a|LAOw&C=}dQrnScLMr+VRd_2r{F;I3(Vs%w z&A)`US~mqGsN4K;&FiZHM5H@(b|o z8W=vr?!jX#T5>#9FWxSSX1f!rYblMp-E7rf%}c$Zj(j>mhRZh(d&&};)SAKaA>q5$ zU=P0*u|w*E?u@hp`=wy1zl63R8+3g7*f|0SZCQZO7V(?VcBOh~U7 z0r(r(74bm#$4RQ`lM?=KH8GgxXMKD6T1@3!>qtscOSI%J*Hc^ z-uFmWscvQ%N@WKCezIcckd>ix(eKd7Wd@e`;KzN}5D|5avbyMG5nhDCG%gHIf0g{W)^Ot#oV-u=x&e*I4Kl^IPac5Ut(KD z+xnNhF-%J-Q)p@|O#ss+a|mG8xkTrth2BOr%e{&XG0T}QbVnqO5W`33+)Lc0uWoCN zAJ8z4E^02$jsjmuSFc34#t-qS(GcCR4-Q-Qb*%jN8XRa;q?cLO^^yHJ6V<~Q1Eq3C zg5O1^Ak;gh6DIHoRA-d=w7A!?SQD!t!+~t<`KLG2=DnOOE_95idjJ}Cf->m7sw_dI z>$YI+mYEQY?He1d$ngnJ08gXZPk}c5jl~brmE2F0-LoNk|ied&Y ztKe;x!uz+%wwRVlg<*|BFAE_IzXj(Jt`^pO*3cMnT04pCRkbRq3pnXW$CZZ{a<>@L zd(95vy|ebdw#rjo5VB#sj-4P2Wh0}h?u5S~N0G$z>pupJa~48RBUWmGcf}`^lriXf z^+u9?$3Br$cxA&gx*_2#1IhAe^Sgm*lrdVwJS_h`5_@}7&W5H*%r`;%9Ybb}m;^!q z@pX=_gl3t2-MmS*`gZbbhtVK3;Uv%iMX*PhUnBXEyBz!0u2zqPk7-O16}w_^T!Kaj zYr`SbJ9TmQ;shuCk%O{hh=;OT>R{eDrqPX@-< zc-Mc|+(1|K!HaF8x@qB`$FB#+wenS_8Jp!0>I@dVqyS3Wr0ImG|3wx*liWS}tCAf4K4%v3RwKukQ z>Rj-}mIA-hS~fx|W2*Q@;)r~T&+{~RB7z4aGWhT2cbz3ABN75u{&L!$P@%a#9^}{< z-;qNpn`P~+g~`$+wGakFDQeHc*Ez0xgTY6gLIP64L#?fa>$5uy3?+X`ZJ$Xf84hxs zeQVvj8#y>Wq83S;;e*>;}|V@s}*9Ar)qG>NfO0XR08 zNQr=0v&ncN&Kw>7T7@-rBB>#GQRAh#Eyz?p}zEd%Z@=AP+dpj|xCXqhzB#e&cKa?ya zOE2zwHVGhEFl+dLn`rbgS`b*TTqWi7Gii%gU3;vd5mbbE^=+Y@(MQc=qO+N;Cs;kt zWaBRoEK~RAm{R6t_qa*WR6RkN3sQN(+hj zZhkVf5m>np6(+DxGx4}Kstn~*1t&-qEvN2tNV0EtxHh~}10BVGXZd&~0%%=F#Y8mw z8y`02=_Q=!?0u=U!%6zRK)-)^KkU`6t$wC~L@TbRI!bxhcuS4*;;HIef>m=I}UHkQ<0 zogeo4n~v|Lw?4x#W8~6Ah|W%txLrh+$GH^^+v?1NlLJ|@k@DNHXMT@jb1xqckR)6% zce>)D2@untep@H=$Vxw>JA*C_>M(oL`+WC(PX`(sl&bq!$_NbPH#SBzD3%vo&0W1x z`59K!K!QyE#-HNA=vaE<<@tE@iEDo74Gw1x=D~v0kX+sUOs=`Bek|A4PU3{mF5r#d zZLodAx1A|(&DHYGk0T{;nr~w1GvSSihzXbXfF2Q)Sq7W}k4WvdixIIp5B!+t+dWR3 zK;wBez7Sr5>La*#CTVn0Q#J47&wDIF-6?9g9Ll=w1O`dGBuNXR7Dr^r} z*J%#jh$K}8_=Nh&N%iPkg0$*~z7n<(RxUPkVsFpPeJLxP;J-h)0UQX{EvJq(5=!3R5FzHuAfoSC;OvcRz8`me<-laLc6Tt z0pD%?FC={NXaDTTJ%)($G7hOfbN$c<R(=8g5Oi__(XQf4n*vJpIssHh3)VY3YG%ok)?tRuAhl<`o1X#EWfE;f%$h#@wy@h)n zzW|b27ocmncfI%SoRWf|Q6o50Uy|hh?^$TD|G`FGbGM+Tu3gq+^|t$`o9-32e7Bof zJwRMN4AM{C1U@D(9R=}dvys?xC^N9#R)bY+Xz5*-R#5%dfFQ%0xH8744gcU@bCuhi zx~T$53SyRoGG5N{2gIXT^*}WBcpLcv@pv7Qt%qd2;Fn z=a7@v-hFf!c+&J#`^kdr!InAH^Rz3gRVAG5Cj>5&lXu*>(AUp_HK<2yxY13yYaG{e zPak64wG!mD1_CS}a_I(;gBX2`xzG4KsC^2_fO^fy#cywbYvT$Kvtvj6e(V?M7aAK^ z4}uNtk*08(kq|oLIVtz$Z?UKl+Dpyf0LbVL2%;LfvIY{Sasna}Ns=FffPGAC z584x~_IC%PTPtaFv_E6WwSmP#yb z8=Vqk<=HV(ZHcjG0o43{<8pV~bStahdQ=ww0vGMt(L!0JJau})0RWJ$JQW=S4|^FT z)PiSHLEh5_R>ilaZvZw_cFgy|v3vi&QnT`k$H&WNL0a@PF!lm+1LwMcc+VfTwO)pnN>g9@vZ5g5trbXG{Q8 zR#D+6Kd7?0p8r-9bOT_v!+?C98}-?|+3K-s@?r_7AiPrmg`B7ww)r*_p z@uD+L-*k$v&BBS`$9{PiCYSnOT;=;z=5R~ZyVoLP9Yn~LkVh8^+n2#x%LV2cPm16a z=mH9ubORY{BRB%#Sf1wxP(dm@wV=^%1Yg0Nvdk9bLALMHl5m9_6Bmr&1=r{jp|-F)1db2LyW?M8JGNXxsIK*mmG3C#(PYWT$F zT`*Z_QZk5Srt9kBs%gB_k%X#^o>{y74TzH+XwG^$SMcIn^#HGfi``HO z-i*O#=GKp$#LcekSGU0Mzm~F3zaz`~vlFr4ko)87NH;11f82+iX-U1(?D;4V4GRD% z_UPh6$@R`2%$*G;c1@C3L=Sx}Ilk58c`R<1q8lH6BoKz}hoqj6O5qC_s_e^~feN|xbAQFe1D=iK zV6tZKe6z}JV-^(snF*8HHTTW?N)xE*tD2A7VY!hdhn zpk6sjqCoLLIGC}`2h`h3wP7TP2no}iV3*KK(~(m&5qs}jn*(nF<%a#sSEZ}BCNP`q z*!O>iXepRG7m0oWwCo)d(IF_G1nUyax&KRmmVJHviNZ~Gik6UUe#`iCg0Z0d>BB3a z1oyqW2-E}?4I*_Sx_QjQI&i$zOU*CJN+G0rx`4@FBK_FUNl2@}XO}uvVlm+RZLF@& z;VC+cqsSDLY_0|(7th&)xB9sY`~}7r6KhL=y4Nf7p=TBnztu!S#XKh?i>P`ZBP0}6JKiV3ad6HI1QK1bcu}GO}$-tzr9!!y%M-s9pZoGHsG5cmtj|Gv_dN1p-)U!vG}{5=~o6unZ^!ZOJe%Ikj^o<-%Yv(rNRKg%Gd z_>K&0QsiyI9Z_J*V5YaA^bl_DUKm)QyYK(MC1=%W-azE+wm)z?URC!WJCTqeY%ZXq zB)!8eP(5rlRR|J9wF;&k|ANYZV^=>W*lH^ zq@n0OdV?;O;MgeXrA8pRg?MNV1z`%x20m6g5`BaC3%&i_mn(v&BX^_p*^KQdV2GPV zz_9hX&g2LyUy#5^PG+q)~xN06s&wkcUFMe2H9I$?)#-AP&|@e&46SWGBV#%JkCyO zSt28?j}J~hEV{L^Vuy=J-pPmtz#$ObzV1E1-B!|7Qc`5g(X_-A*{Wbq-0R3ohiX#O z1kAD+2w7W>u>Nn*S;AlFY%uu{hZ(6ITR5HBYfa)8kB%Tcs^RbO!+9&XdeS#zd|WEy4bQ#@RY0;qjihN&WZilU55S7y;_k^?;WB%z!KW2xkt&RTHB`P$Cz@al!NZ* zS4ly7+W?@qbrB(zh6%5lbmohid(J^Mm84w%=4MG`GkKJf+-fB;CLf~tFzK=6eXQig z&W>vBv8(hvG|L8Mr$yJe$(7&X?$L`gQyk~ElYc*sXlPq#R_cUo0g3Ud1~VnyCFk>s zLsY854X+4`C-kQ?1l~SQooCWWF2qFhelVWsLjRC$i81^F>WgdQ+b#I>&+;KpoX@*1 z+`hi+zDku0T5mU*T2DXC?LKdIB+ajy>fF~jBdLDGsDCCqN3i7vJ(82UV2mFKZUvbL z2StJ4cIa=xt%b+jP3T$lIkuvYd?9=lxpITz60458bkw{Kf1>}K{U*hZ!2Uzub|S{$ zx}q^6~D-B+J>6d6p&gQeU^vjBfcaBT;xijpIZ`50|BzdeQ@r(Iy^0QH!Ysj(P3KbywPk-wZa0ABmLlHpV?L6UhvWcAfN%1VXAbtk>&e@5Q(0;hy3- zZsyg#Az}Zo3R-0ox8wDZsb2K^F=PCoT8n1$>Q2sv7t-j1`)A^a15G(>x!mzkuax8` zBRP(3%AOrJ+UqrlB<^FGU@(W^)#P0?+Ib&oW^P)(`X$AAc_IJ#er9Og&?+z?IS) zV<;;~J4$l<`w0D@`{{8%9XAX?Chn_a;=KL|(z_*=%1#(o{jZ@PyMK zDmPhdLRfkX2b(tNH~18z#cAN){r@dB8%zRGvl8&XsoA&-HN{lv|Dk3}t)pnQ0cfs9 z$oE#8?wv=HGSl>da;ii&wIj9ZF~Pc9-cJjs1iD1sC&xcVBueTHZ1aTUN;?|C7248@ zO^Js{uxrA_dJQJ(TlsNgaO}g_!&BfhY8lES83LQPc(VMpqVtvVJ|_9@UNT?EOd5P; zQ?p`y%OEM0z~e9PEIr#edoXWRatq$JX* z#3I#F3T%+AFo0%m|Ld>s9O?FFp=SCEo5g}UtbE^Zl33axKVlCGhXzL(O>+IV^Bz+t zgD>i1im#KTsiP-C6I%Ev^cU_l$$zP+>MuEQi?|my&d~0l-JcYrGj<{P%}B+3BRb2O zS{2r$m@=lLbgs$apnKv##B<%sFUnWv#{sxd-1|Sv*L?XQ;kb)^UAX6YIW^NM5y$y% zy^6mmbse}Ql^?ip_ESNK7I4kEL#<9{PhYpgOO^{Q7jl2x-*WEYYP0Q|Q$Qni6C6S$ zIL?cHmh7KfFiS8~L2tt{38(h8nqfY-fa_-!3%fg=fA!AgmbN@1DGNN9w*QNdz@{zj zJd%%&>ew9G6lK!8q$2XL>e2j;#|wX)5eZ+${Mb@Bo#TclzqHp{@zeTR4{jC04xpVp zW&2dcUw!ZcXv4p35&tt8d;~491|AZ`TrCoo%CI9MyRNyMxSz8~R{lX!aCG>ey_&;E;^8F>7X`7ZWnV@vRhVwz9 z+&a}v5vigN6IIviB(8Y_+Dml8&!JY^TDw)GF^OYEzo@fsp^JiaUz?yt#RaW$GXM6;rl&cSi3uT|5an98y$)8w4WM-H_%;&vrWOblqIETs&NyccOdD zJ}WgQ-`<8_LBXp7WBrqrforR8WVt-e^kR7tzh_HZ+`K4V;6Nwvkee;AQN9B?3IXRF zU7eSOp4*egT$YMFY7>yg^zeWC)>OaflZc@!hsBBl|1JmTEcEhSJmbgFBc8kV6)l@O zr5%_Mfg$I=B0eOzcjX#jxYn)#hie#UA#_x>-&6RyLl4z}Qw@7>>^OStvD2c$#rK2t z!_<*azMW;m_|JaJbhD!wpRTUuhK}+!K676nVYtTdxaL;2?w#9$K8Mr@W~^b!QMeLu zdU;W&!&cz{`PJW~LVm7pb(lP>==MVA_N<5Nir^P`P3d%4nH0M4<7VKsCTcG~b!M+$ zVt{fA_JuzjH~x3*G1qil|1)&yI@rOhv&DYN8J#Pu^Y{f)fzlHCCVZAUl zs6sGzopr0K&3~ AU;qFB literal 0 HcmV?d00001 diff --git a/docs/getting-started/vote_trace.png b/docs/getting-started/vote_trace.png new file mode 100644 index 0000000000000000000000000000000000000000..d71fe5cd21620dd901814ec299e97b846537c2e7 GIT binary patch literal 65384 zcmd3Oby(Eh+Abi{jg+JyB^}ZsB_K#C-6bLnL)S2%bceK*(nxoA=Md5ijlcjycb(yl zz2Ecg{hhxL*EQGtV&${$^{h3|eJ?`PROE57o?;;(A>k@2$Z8-VpA)atT z;T4FR*VZyJYKk&4bZU;k57xGpNJuO(<|ZaYitH?Xrluw)eZy?5SdMNQ!NK7gCO$oF z{dC=Q9p5{@$0r#WERz!~KYHJRl%?KYYl9O`cU8gJ$DVw1dIL{%D_~@wO}IOHCB>2J z`J^rWt6nNj_C1n=r=yfQ=A%dESkc7>MjA+FZb-BAaH0pZ`zul`+fZtN<^@i zYOJOkmz=Jixr~96^ZqfU$wHj^F~cJU1~fFaB$@XD4`!I}bP2f_Ah{9EKaxnqa~zzc~X&3P|+Pqn)bzd&wX^?lK!* z?wjVj`}_U9`}=#tp0+lxurDiZf=K>preYU2=+X$oYFX+iet7#9=>_5%0|`0E8VMC~ zg^c(-MSPHu9(@f&LPvZPAwII-QT~35dhz|y-`B{A4+*8-$tWr!zTcTUT3XsUeFQqI z36EVNikh~5uj8!qR$0Ux2;ele0Ge5Hx&!PVvLK1Miy$rmmd>Vh?f_dmClPmX`ae>L zAg&)CbJ5fNk;K_XoL=Xx8l4Q#(UMMplbe&9UIL4bj!w+c;)95W?CZa>BksiMKRP?x zi*Rwdxw&z=@o@qjt+;rEg@w7edAWFbIS?s0oILEDP2D-{oEZKrmN?kyY&Bsfe1j zyQQtJtTg~(9z-1y{M>?Kf29A9H~+5jA31gYos)-GkoTWi|MBX7X4Q1Ebd&)C5Oq3B z{CjBr%KXole`OTodg%H;O!23k|9FZpv;>wI*S`i$0_zQn;2ILrDgU2YLpF=Us%;`dBs98coLZSIOw4wAYOqukwCMG|Eq0mrj7FUz75R{rs6C`@l z`)hrlp3C3RT@eq6@HsWaX=D*pT>qh|vd4Wh$q7()I;Ed6A?N#w00Tve4g>WI9Rcc} zHzw+YGcMDHjo@==?YvnS2kFZ+SsGN|wp~J@+mne#hDf1I(cektAMWkbF;E7PzCZ~SN6ZlYWw*bsorh*3%cvPT_d1&QcJ%WR*`EjWx_~r4=cz!1HWICIV$dYs+=wu zjBfl?>Ob4zKqz#zmDRXcyCku`xZ06A_RHt>Ywm z`|bbk#6v4iF_GsT*XnB}Cfx@bhzLjJD+9b4rwop8z7Tj>qyK06e|5p+F#~}w@Uga0 z1)|^oX`sJ)D1DHF`wz4I-S2;;CkcOr(L!S2(eL>mUHeDc_C$fd4gZg)D1Wz3iyP(H zg_ivWQvR?hSG6pHXRE~%gUT>@V%v~;cU+*;**UWwLuo9}r{JsCt@kDruV|?KWEl@G^*ZVfTaJP7MM}@by?#xWsuqOBSgs{ zv+=YT2sOM}CEK45s*%AAW9LAbZuB!P! zF86i`N`$4C8WDpb$*1dh>xCGlp?xo1NkVc&n}|n9!9ls zAG{9|uOItx3f=d1bNhj9nBNG~ES(d-S-}SaUH093MH?an7u}0(yuD!WGGH_ZpV3dI z_dTZ@UAaKBgCoRn@qG`~+Ve%wxha7y5Hvr3weNS2C$jY&o}U%@^jpFgg9UV2uY+at zTc9abdC1@0^YCc?Rbs=QHweI(kf}~mYq||yfahE2IqOhbaMk)^OhWx zDaDpIRx|X`E%@%peIQbypw z6#2JXC?rId9YIE?8a0GFChiy=f14hPe!H85j{rF|HvJ?!5^nC`k$Q8Sale~JTH;b{ zb9&WPSLRfIUfX(G?AG<_fFr1{Ruj&%n(0jQLWN$hH3J(f-e!!YMt7@Jzr`yURiE-4H8}WA;{Z$ zv%yu$vfo&Z#UDh=U3qjYd4DX~+`E8lXYbcyu8ueLxLq)ap1o1tUF_MpdjgI3#frFf z`8B-Jt%RY1a3Q8!{id&<x3{jTOQ6wd*=aJjY26FUO+1tCkYN#5Q6uHXWrl zn~!q^n+yE5wOg+ykKKi7TxU#gwX9#?^Yl{jWtkwUiXSe>k~T!K)Ae!cGa6Q=B{Q3{ zxz!IEUKOLmeRj=hcf^C|t_Lr#jX-;oX`Zlx+k~DdpPMyk2y^;O^F=oo+~_b=`(!gK z4n?c(Zk<_j`%uQjc%7bXJM8zdjq$afs%INI9_?kHyvU*!tfvbAy2_%x-Ky?jcoIN- zH)9^Pcm2lHvimm&&_n4Q@h1No;p7%ePaG$h;ujI{g53!l*=fD2LZ;Dg!ehl6C?lAs zeW4n5xvhX?_Bc#1pI4Ve`V+0&f&(>ht<>js=k}9Z3Vt0c^9sdHe5qGX zdmpH~Bf{6!-*cACE$X?56qV9Zbe}#zwe*qu&(?>j4ZgFr9J~KDAymI~3!es3U;Y+s zou&0q1N87U1;s1sk4t1ry)f=+TZ@uxF~0ejQJE%_%$}cbGrz7BUVB9s<70$eBc_z6 zRbIUfTg$lUVs2m&4pWwH za`8E-9p*jtJN(9~O&yGuQOLGn5O~EEJl2XzynjsPgx#8z^2h$Xz}~l;nvFFIg(bI) z;&ojQmP4p-6=(o2Zx%yb@y?yc=r?cTc2uR~Fpu_lWRWpOcqIuIrbyFS--mVfw%G!b z#Wvg13ROLQaB8~5n_A#n`tNHYZ_}^f&}FZs>&5BKwC1C#Jn`aMeJbJizG37a_`)kf zcIw+zu{k?seHIYg$3UpwxJ}sWg922Vrwi4DF4=(Rns5AA)aF|odIM5%?64==+{cCH zOG(gdD5Lh*vPXi*e`^ZC>*Kv3vi@656KU{YlnZiabQJDF?I_8eYJpsD(Zri&D*kX8&ijnLY@0kP&T5x*+q zCs69Gc`XYFkbiXu*C4BT595-{ZH2p(?ud`DSdXt4>(0;ac+@d0FCq3c=kWXBC;IDz zzHzyY2o&B@d}I5;3A0t1-z1cgOMS*3CA1oxelUTCSn1G5o}f#8NNH^`T@~H>?&tY< z=nVAeB?^fHhGZBCDsrKrDvWL9_b*zwYi;8xO%^1 zR$9467&Cm(FJ2FT`6I+Y+m7w-D$!NeTDDG8|2WkZltl^6&*)<<74rm`GsOd!s%q1`BB_DM;$0pneIVY<5AaT{OyVYt!Zdspe%mp#$#0LHoOJGJz% z&K{EIg$~`YD`v^d{uZ$wTzA>O_o7A4s9PHfMdRf`@x4?wEk)F7ogKU2*s>EA@t zuAZ}_VDaRnm$+6Jp87`}T#-r#jQ@zz!F+-j*u+i9fni`qM=v> z$cka;#{{X~U@to+!rE-4puACsSDDLFOF7mXZ?F~_mhwF@{Xj2erVGvd)qGZ6x;HN* zeO;gm{zRKdQs@BA!LRyFds7q~vJ(OHGFQ!o1)<(e23}!5x?hLP&BVq1z1d2v16tO|a|FPi zXtx$gWiPjp!fnDJXEI?dtj=Vc-*q_m>+VZeg1K{@FxS(wHnPx9XWJ!c5d1H?lR!+-LI7^tq(HUT^ zI!8-HGm1m^yslS#q?qEzmKNwM?Vc26@@p7XM}q7`Z`en3j6Qvj_ptM76rr~_Sshht z1BiY1bQD`pc2<-`gO9)ID|Uf@I>w<(v8ExPoO#@YekvP@41At0qvKu$u6d=olbZ<@ z(c)G?xOYlkMd1e}cu1$OX^O-?<#rU&x*nmOM2sEAYw0K#FFf%y?>10rUyJ%-L?d3< z8zmu6eENuzPPU&ldq<;AX;oZJuaK@7Hlls`ISh+xWF~q|B+1m}QF*9zeF&1Kw3e0M znI)!`o9Csu!rTI_Aueyp0l(__whFW$Tqm1C-amG~sh?R#L~JBI2U1}VgqVLFRzo$m zA&z3Bm1l13o=Ks~n(;dlayJ;O6Cyoc^gX$2mqLB^5z-AYfk0?$&A4Vazfs*@$YrN`q)+8|aU8$fj_z4(+&sB3}oTf+X~dZqJ%(H~^30i(zOV{jn`=)aEwX zqF|);3eiDm_v$pEeuo@EOGl9Fk&Hu(_P{vb5X?b$-{rMtCDX#&9SIfgF^qBz^#ckCOG>@&0@pkn@a|RO!pxCee0UoOY}90n_*X` zjebFQ$yRMzl*)3Fs&cIvJlnvh+GzWgtUKwOKZ~yI+z~%tck-*q=wr0pK9^Itu#>bNPH%Ag9rzDLn)_h!G5jNCZg|9emqVw zYi4U{SM|r*#TGnY2|nfg06s{LKcV!VTLmDZ4asB#@9zL%>&Y0EdSmMWnyVBYjP51A zwj4i9^2tv7!}?$KPB=(bpaHM>pVOAZ)Lno9(vqyeA_qw64rruiqGg^Z&}?(m z5>+dL3_~0+N@^6Fe2k6>UOq4 z8kX99*W1=Qcedy`ynQ^ zJ|VuOb2)c2u?*845&{~(_3U8=)6RZ8taM$8<1se+)KR^3%e05hoy`>rw3 zb2ImLJ=m0o=1?Q@k)MBO_R>Udy!{~hm)RMt>PPZ$0RFUgm7>T?$FOFdj$8}X_*;?U zbfeqS)dJPVG$F0BR)y`$jXjY_<0OlWRa*>E0;{gOkATST3JR(y3uUdExv^<03+nrn zSoDlNUoAG<0CS6{(ZPOliZA(rssLOLe>~~FTY7BnpO#O~@JlZ@N7Z}2U&MHb4H`@! zc`T7AT`z1()Y5EA0=THdu?zK#7y%}@NQ4Cre7@+lXINp1AJpc1Y%0u@KW!Z?<2<%l zc|**FJ}TvLmlPcL#VsN6MUs1T29uJ1`f+)*jGW_9g0ofz=G)#w*Qep0N~Dn;GR+4< zM`B#cT{OHoixy(A`gq4Qo2s+S2oObJ?UbkKqnvQxcfjtP)Y&NoitiR}{^O=5KPS6q z6FeGUF2>GrW%`AcwOGsjSnLUqeV-BB>bgvm5IKnf5iTSO>E?SQ$!XT8aAOML46>;y z5Mh%BIh|3-K`4lyZ~=d?Nf}WZS4pkO#1CdZjuM|v71c$xJ#}$Wq!QUFlB|o`VT)fh zkOUM@88;hb^(i_Ce`~YQ(Dz4Qn=Y+-*+n<)2~e8-RCsQ3q1YNfFEkX*&Do|spMb}k z)LWBSo>Uj{4CB33D%NI;a7Qvt53z>OoCu&>-#xZg!n_?xYMZKEF|#z;FZIy6gvU6E zmY}lw)>4D2p7!s3R6T=yFY_act`6Y(?5`OxFX8hIl`G}<)S8O~u^wpMZiV~WG= z&aW(JdCO~(RT_*BpC#>LtmaF#=HT~HLinvGd;(0BaIrQC8VhIi#y3rWagyQ%YU4FF z*iKqzTtqx)Q|Cm@aR20{3r*Q)rkC>G9th@pE{%Cj+AqKFsH)R|?+6hvm9H!#*@C)W z(J^mx*#F>q%iyei%BUjyA`?|OnC0238&3F=LZV`8o+6)V!XGa14cRoa(CtSz7ZuU@ zG1qquqG<*?=HW{gU(+R&Yk_0D2|9gN8Rh+-f~@v(sd~ATD^$BN(QATRO?gK?n8*)l zx@&O>CKI>!D#)nKtOmYkz!A+(m6}OO#S!7CXU5^8h>h+K-juHoNRSWZ&Q3CTB>E^p zszB=3lun^=xKkj5R1;x@JvS$MFR}F{8xH~RSC2G0zCc2+0c)Z;pZi;@0c!$H&K?)V zdZ#HXL*vK{1(fxt%Jbk=k(}B{BH|}s{bO(_V*?c1+v8Db`fz8qi*P)xfSTeLw&iCy zL|xgI*9_xNl7qcoT};*+7FUe*Y+P<|*0^@O5e{1p#QoamVz&A^fx7B7reE`Q91&`P z=Z_omkJaTwLQhCbCeLe%pPkjA9nVyHezvH389y^skly6g{-q^O0Ic{F_K{m0LZ{qx zBO}aWt_7R~#~gLAYmW&|B1g%flKs%pg}UY%g&c-t+BUHOjn1nS*T~EuFA@bX2fr=Y zT5kHj)g?iXDt7?OfvZn-Z!=-)-%6@m4H;f0JQdV;gos;I@L)X4-HQ>x!^){;>qIsU z$=3D>_;SWqC%y1{61-R03cfG);?%|Pex#JbvhLI#*JHK!xTksH1(4H{4 zgC#e>1@(U_$f44hy_?OEShy=-4a2oA5r6HSjBR?W-J zaJpDg-q`s3C#Lsl#m+OjF&!B2P9K?*i&l%FG9O~c?!NQSk#ty#UZ=gx1;#iC_&vs5 zS+{=Khh~GecW(?6j_aWt0;Ggpd`A`u+Uk)o+wdbJWPrdR8evt0+{~rAthyYTJcW{| zcok-GZQeS!kqr_r(icbM8fVNk6T$#lzL7a-3WNX?Y3=y&L)K}MnT^hTay zlp|jeOIZ?jN2KB7uVWW*wbw|$Uny3UGPxYf`=o#? zi`|G%7})VWb?)5lg>R!h*Mgg0?6b&#ew}*S{n|9hpd?vxY?R^gaTcz=cM0p>Y=$qH9IM;{cPKRCTXm~Zo# z;&14|CXD8mPWoDR_Y#m~_)N)HM*oQzPHJ|REbz(8Rm zMD|Yy{5s7Hiq{EriLs*Ttx1}nS{4iZckms-MYc7_ApO|HNWN@g&*nhxm=O4&@3g~_ zx_9e^k0NE_Lif4M3FkAPLan}&fH=fZo>({q436^vj2Y4*D<%KA%lRi8S}AA3Q@b@H zz=ereY}!7eY8{h8$8tu}CO@~G1W^_Rj_2b1y`TO&B!&7{1Qr8PU;Hx!og1(DF_ic( zQ~k5-KQoqjKcu<+xgRI+mm~NWkNY?O^ZzKP?MP<%WI}acMf~*FMq>Fo3!)4P)Dv~^ zOCnS)`UeKrte6qgOsLvFI|5vlpVGL0sc{hUe|0z$}pe*!zyJ11k3e73-g}}i?ww7HB$fVuMRDt z(ETN3Db~U&-Q#!HDp#WLD3vW|LWW|6!I2niM!lpP>W2xMo*W`yAeBfx**_+*X5eQ) z{j+l|-JD#ZKg@Ybh5UT!f!hyZVb2pDH4qzCrx;{~5F@L67G~fEfXEXO1M9H0ZuGxS zP6Qx-KLGMKN!;!qR`^Hz{|P<^jCDrJwbA}&nlA|Qj}|J}dO3V|ouF?wyH~dsd3!F2 z&;mdq2%hrp`XQiY2-8S}wQer0GI0M?A(h;?S6V?({jf;MyNkPyyX*ZWLj-Af)0z@? z1DHFyN4T)P^aFop=MEr3umBA+I?04T2ovZxImiAnc>l(&jvlJ?0SCt-8}G{?Pl+ul zeAqD@0Lr)=vbx&OK>UDf$dfoNxIMpKJa2*i2%>3N-;m)=M+kqw4T*JKj0tfTdPf}s zn2|qYnffxlZ+DFE=l%$pPaFtT3>uwPgne5yS)WL_N3iT>=Lqt!%;!d{wqf#XEXeqJ zZu-LrO8p8ha0bwH*yAVH|KB~r@oSTI%$5mN$>s+U)bF%%#8l3eTCU8vwLO1eyzo5{ zRB`L|(*5m{HH}h|2mQeheDFu6z{bVXlEH*JPekv9V<8{}NyfL72pe1k?L%)7e9Lz1 zH9`!LF0+@2b&>r))+17+FFtq28PM96(_%bGIfBN*ak0Ia$hiBpZ#!q-iQ8ynxT6OR z;B@}+SV34F^~)?n*>}{X2PFXhtfznt+2@(vKOQcNZl*dlJPZZjWz!#O zkApAxyFSJU-9=h`I#(g>7nirG5uai?j)JQn_~2W{6^{csQd(pn7oXOF)`E#2E~#WY z)8lQ8j$pxp|DhCXGa!5g6Tj?Ng?nGmFOA3^MhA&yHx3%Yd5g40iJNpoL0myNS1gdv^%!45z;D{sV37wxhq)Fpq$pRm7oo%Tc^{ zBXk(SlIuz~ex)r#IUKT*I2MzuyP7OrybMEdls8-QlCTHS#96?ibza(4d{NG8llLjM z$A@3=y-a>@BE%{X#-()8*bA&XUvAKOOwPe*XK&>SxC_C{Rsx+Nxo`*h>tWGu*euF!Dr z6EtPY%PFOK^2 zA}ev5*@{V^dne@;M{23p1{)~LMIe5MkvPh|i{VP;xM@?ow35St(-EPza-qGR>HR|i zCQj(NXJg!G{v1JGx=BW{?LP~m8W-$)@Xw%`PMRr%M5GiZal5VR_F$L?bzVzj|69B9 zz3OQru>3^_S<5Kp$jHrjFw_U3{#uBjXOKLKiE@6Bcs0=8ETeTcao^N~NDKM^;bbe*L69?IVcFK!n?p96bGM?WJnlvXYUWyGfX{So zc5?WzBoXDF*Ajkz2=Tx82&9@6FymaPA*;QVeFH{lOW@_FqlnSDg`)}9N!326S307I zUdOoJBG{{+qNl&!fgUN&JxG^CxL#RrY)amHY?h)DqEuRU%WBi#X{Cl-AS5fLP7+y8 zM+CxirI?2ZrJ8D9bFIc+H#Rq((DG;Rj`y`N&BnT(mnCCR1hczi=bS}Z9d$Zy6ja?W zF!}(=TE`uaIqkpb&c49b9jHjAxf%^RYmi9U>0^l6Rgt({Z=t?<5XjB<*){G> z&3BA{7%V4A(3^RBiZWzs4LV#NwsWmCttH)i+W4T6Ihnag+kpo}Ks-jAL{ht?2N3GR zsYRx4!euNY1P)z`iTk8;s|{Aa3AWd2^oje+5VGl5pb10btQA`Jz0Vt==^(hU`If|C zi0W?b&q#Vmpk_&}2aQ7);qB+q#e0NQZkpJs`st`=stz?>4Ho?g{{88@p1GQEVxl#>kL+NU$0jKHf#{0I=dzC`QG5(RRaOI4pqxPmc8c%~$k>g}!q}6xq-!Zl z&I~lYiSXaca+M#9ju0Sg~c@@QIUe=t^%zq zF906gy;Z(qYYx?%;>;XP#3TH*b=@2vQbj^fiXkFBusq3IYgKqbX->i;d@=jq8{Uzu zW}vc0CFa(H0IsHAy0Ce6U=Pt5``0R?U)v&%iO}kqB;8lGdyNAVpRQBM{s3frV0dFE zHGC8Vxr|tsY2qI0#eIsSk#7Ig3^OW|cXVeiTeXX#rnO7J)Gxmsg(4_**;fl@c-9;7boq64P$cVI=OYG)+kO zbzIOuRI&SbEllGGF(4H!XQ%4tA5yqh0>D<6kKQeNA$AqEdB^4m(e=1O zGdRUP8c%GgVqR-5_IPTo*f)m;d)q385ym3FZcWSBH<)0;airnnf!Mhkw~GL6rhqIA z3eLXKPAVG+8QesMcpgnSg=Sud!u(HQT5tP==Hky%dav%VvSP0!R8~B|)#_75Qlb+~ zhkWeQtWvcew15s-kDPq^4HhPh0hnkgOafo0#R;8xg(PL&2;XaH#1|lz$W=Uny+Mw zA96OY_Q<)<19=l(&fzhkt)#C@6(d)%NkQ* zer5d@3F5)6rBu-18~XF*V&53lrtDAp1yU2FP3q5S9i!yGzJBNX{0YRwui&~<0yhD% zaY5+9ThAMar%bMrdc|_j^RwuV=T;;{S)QhT@iQxaH!}{pIqZd?uJJf`QZAO=M|^zM zLJ%nMSl>#jj-=kocbt#_3zgO1YiuP%3L9AyRmI04)Mqv87a4NF@xob6ZJNjU+4@&{ zwclU4JdUj>KQzlF%4>O8zcJ@LRM9uGeBm3#Y#D-Frclz*BU8f7%@Y6XrG*Ni6q?*A zj*RcttE#K2X7xJLl1Vg8{n4<#vERz<8)JRcmzG>0T}JUui0iyfBRD>>u)SVZoHAU= z9ZYIHxvG8+{uDdM6ZJkbZKqW3<}i8!&J17{C@1Y_PlsW*fLbsl_Oci+$g?%wn(hdE zk4Doa3r3>t;?WD8?WY#sKD{ahY)%Rgj0A*n{L+*>GNUR09R=gaR}m6_3khj@P@>sl z=l55&3aw{&+f|ngs7b{o9u9>~)a8^?qPx@LVc|p%<}6J9EDss!3R2D*`j{ctKoK-o zj^WTJlSG6hzgp|5F5%GmNsVPhp-tmpp%j2tBc1YDiG?+e(2~`XUV(uRIPi$i!x#aX^i%lGYe&q^|Vat&V;yihUb-rK{rWB;+w%V-_ja zCwY8`5QV3YjBw&T*`>jICPafufiili`1=TP5WyQPOg)heq;ejWYUWtUXB5EM#DyHu ziNW%-rYhWW+dsqUfJX}KNOP;~cCMv-xPW6hqzcJx{0pj)=QSr4lVV{9Yjr02B@+A! z6$2n)w965u4feJbX(;_iVY7>2t#5$KZ0MY)rmKf3TTS){sD3y^n9xfO-cJzq1Z|7o zmt&*8rljk$MO5u%5dF8;F3Ndib30!BKsYB?jqw)OwD8@^* zhRY9{tOxQxT!`isqs~rzwPj-LaaZ!3@zq~X-!#d3cQnddN7)ynK0=%nkwixT*a#g| z`WeiwQ|nQ3LdIt76ftcvJW9?q5R`4-VrV+V&BH?BjPryMhvd}ApY-vUJhDSufDlmdv+>j4zYr#L4lMPUqmxrE1y{~@ALa$$!Uqhqn*@TEQ=W4dc#@SK3xq8kv)jJSeK@~x zT|uYiVHQbrnEbsEs=*njpH`n2@d-3XWmeiJe!KXIdv%0@YfgeH91JT8_IzX598-7n zJu;10;ga`bP2jbHm>lGi)4ilpv(W*o0>U5Ezm(-HW;u{;)mwB zMxDl#T=u5Ns$Q@M41HTRmz@n%??7T_C@YD$vPdnq8B6jQp_@aXH{3fNgpvHU-W@(! z+1Ei7_!9V2eH-KP_95IDR24dx-)x$i%BVC%lnDw)l>7ywSf~@|m~rrG;)$L=$@JUQ@OXO^`9jK5 zD~)7!m1Z>)cT>;9<1%uK{0XtW2e9Vc9sG^TCNuj9cV-o?Pi1^Npfuj+aBF_DH6{%< z$IMUyy%XmgPH--=SD-EwJT=32P@%tgQ6z+hP)IWE7V{FCw;>`l;xe|UWYafJxzA$m ziHOg+@l{R3mibr@t_o`mA$Z>3@rZz$e;b`3n>*f)+X#LQqZKgE>&d8Q+4Lc6@+ zqcs-ZC~L3*$XA|AQ?;f*k3l_B2={ADZH)MiJHIs4`mmp+LVj&4iuY80uKxSmGH8Pq zwput!XsyJ8r>~Be^aamHhCgG86v*i|C-kzf8(*o^@|TQ1i%51F+hAV#^dj;d6X z2VU~*PwJP?xyQ=%x^Tip`;-pD$Ra{TOzI{3BtAZRj6tP0gD#T5+fMFm@opIMuC2>l3-ud?9U zP}QFp34gXQJ^1-Ic;83o}>ArzS^dXtOGqwc5CsVUw(?7CD_CyRu9@A@`%snKTfM?s4Mhseq>E5eu@O( zY9Hd<(U7^p{|Nmee)zbOG&fT{VONVw*H{EOGngkE3StYph9vfW?;cO+%C8t7%x0Bz zt_wJ$iiJnEW+0jn6=jYGZ=%}7q=~x0ZQalR$juZc#;s3>ZTwtG^dtE}l;K*1ve-NQ z3UtxNGeH$~?wRVquNQM7$BiV!&LNXg^`Rtb^jID|cwZfwT0c>i^DpOxV~{;!Puy@F zJSp>{E7yZWWBJXnQoJ1d1-4R*qcaG?L@9;gVgdqwLcK$g*sZT$z1?yty=8YCt+sv= zGuQH>$y=yDo|-~X<&%{3HM#9OfMLAvixOAgbA1pXL~*ak;0(&8E@4i7MC@T@2AKB@ z$ofvo6H>*tT6@a=TQk2^^G;kT8Qj0$YX1q7hjRbWJ>LN^DlF^JsKhaKlgNm z$hiz>g+xB$;{>KafDO9aw>5j5HC5|I+i~`+4a+ zrTIR|J)isCZ|C@d3O#XyY0_?}u}{3gd;3~!_>GWGKH2T}ri0lE*Igkid{S3n_2$Ae zvBb>g_cUPAA0N+iyx+`FQHAH0_g|r--C6rNab#=?MF~xXq*+XVToH^O%Dhb_Zf6!O zj9<5jF~V>xEgSE{0Dd!FRCV!=L!STMK;F?^W5nHNSOpHV$yn4hOZg!|i%en2q5c!cK#fD4u{ z)qvaCSYly7vHXk3%Wtn}RSgK6p2d;9Md+DZ2Hp)f*WhpQb@~T=AZ&aRoiIvEx>%jC zo|x-IS{3}`5XD072Ax`{Z&@WY)#pf$xy}onx%wsy>#a}t(4Ypuf!$ERVl5& z@~}yAooTPRxe}H6qhxY1KNB5at@oN1&^|-AB9TqcYHSjo2A>%S*SWK1kjdE9_9XiagArloQ{eh3 zZ%59P%U=@Njho*%Dz1vD9d<)%#D@h`k6AM+uc%kL7J;=-Ap-bLxUDM&v?m5JULsVg zEjcBlm+Q^xFQey5!iH=tfAonv)XeKTr#fC2oj79{sV{g?JI}tTC;9M9qIs;cE1`{^ z5%zSdWziWnmtX8g;=Pd9ua+F_40~JaJw5LPX2y;$oze$9TifFkUNycRCzmBux1*l( z*Wt>{2f-=1^$G+d8nn2Wt@kMns&RexC=KVi_iW~O8fvs$hBWIjUJ*|y86AC1mP8#D zlDcwN#~GUrdaJcJ`&j{^g;T}hu&`*;x)an<)6r%F@yjQRtulo*@`uV+L#qb#&*vct zH^*mlo+_=t_}nA@(;|{4&n$#skgL|}Q;n=^Kmo+@**T@UerRmfj+qcn1JYmr3qWiX z%LeB_BjV@z9FhJxy5!)*s8fzR7K4w1>gIuB7Gp5FIMh8EYZDS$Pzkp!Kb85Ti22m@D%M+Wn`vOq^LfLENq)qMh_+QaHL$(T zZZ#5}@^y2^RP|LAtaN{;b7aRR2wm~m-y zilXsz=Y3uLLA@o1g`qjcsgs+x=jFK`)T@A}G>yS!${k=>ax-N$OSFq0Hcetza4ZV& z{5>yzHj`C}4S>AtN-EAtrK$n~qbASrA5IrP9Q95UOjQMr72C3$H6@aXr1uXp%;39b zMmY84H^p;u!`uure#Zhl5tP$;SfIl6!=csl^)-Gz6|`eD)52j$p4X}w*L;0Fr^N`3 zSNtsfB>{e+Wg}erE6BcMxdjpC%9!=+c@)~n)Jakw)W%v~Z2#V`klX3@#8njtm%Ta= zSsj3V!^ElYjjxj3OygQ(j}$R!U6p%Uvw2f5k>OSCA3)}*!?6PPmrYS^ieFO9@Uuub zkb_;?#dn4Y=*?Q2jaCa?j zKKo{^EmlC_#kiOxVz*NtEgyLHiVuW(jB*#Mbw`&^}-qaqfRw)p;aV#!E!|NAZ&5 zN~w@?WDYqU%G=Z)Wqmu3J@MZ>QQLl>9*w|>xdPgRX(rv24aCfPG4T^ceobMkD8FE0 zLAB-}7xGbu_Q%F+1isWzmCP%vStq|?TN>YxW0iP=y;?fbZvH*$X({=RQ8X{h(R+V; zXl=99P16xUbsYA3h8PV9KIOWn*W6w@@DtMcKEtheZrSA9B{c$YH-sOXQ_#)%$Z8u= z=Jq?D_RiV#MCg_AyvB`W=vfpgoH~y6#wPyb*gZQxO0|L_?GG#bdFzT%>k{B0#Xb7w zXHq|UgEy#yH7Vhom!dGbznVT5KyECqM&8~C7UzPQ@KrTBytp&X7|El20;%z^ z0f?B!0Q~Tz0q&NdZZ@N_jHr)NWsLrSM2;1t)u?6AP4zg9u;BDj^qg;(^t zjAxaR&CXBzN=0qI|HIu|MpeCS;lqkZNDIQIyQD!W=?)bIr5ov%+H`j}N-3bIbazWg zm&B$;x;9+`@7kPu?mg$8bM8Cd5C1X#Smlq7E6TT83el$_aloOW8AF>sdIa(gMCLy(3V%`F&_Re&S-hvFApcx z$QU|k($mCO2VQ+*Wk{THo+_B5VXaRrF|f5w>TKav*&SzWZ>4bB_)+FdX%HzVT^ zVU!sV!Q|eTkZ`;2=}nKuolpN2wv%{OneS8}(qr;zZey=ZSihg(JK9#3s13E%Qfj$LmcBwrmQM&9n$%Pfx38qsZJHA>~uoag=8LgHV$NzAw zGWzOj^y;Dt=_PW^_t>Oo7fsKuyp4@tP(WYP%)!1HOq`n6F9ca*1T#u}@w{cH<#lR? z&c>p;*!|*^LdXT^0DHkTasb%C>J{o$jQ#E0xT0j5(P-Xk%@}zK{2izjG^Q=GBCM}}2 z$XbKU&xPejV2iV5{|VDjk*j#+;gb85_m}#^$Nx%RxQ2jm5+P6M_@8~#{_%~61?OhK zIDmM-b{vg1>|PYB&)y+jds*c6vgt#j?#^_rU|22|0;|Z3JE0$0w|kXtQBT0ku20f0 zIrv`nt=+Cn8oYAoH1(Z1u*r;(Du`fuudla}dvmGtp&HbSP+n>?*X_RKpT*YY zLi@O!@zZ_Q4c{xRPs=0UTTjhO^tdNZ@eN}SeVr<)+}Xo*aL)E0R}$L&+Sps)53`=g zUKgvcXeW>lAkbl57+NMH^d$7v`Z`v9Ft2PIGAa^$$P+vcyX?Nu@lI1Bj^Kj%3q@Hz zTKCgxbmo3)f3IHv`a^0EtLLhEZ{R4yEB~TrB!^dfg%^8czw8O$0)YDY`B?955od2G z)~NI&u7I}45uSu5w0T4~AJxh<@RZk-b>qlKe>CFdn|xdQ zZLQR6Y2Wz^sOn^5eWpLU%(||GKBs<*I$)l55c8VDaZ>g}C^VJr6eU?+>RmzZC80zF z*CJY-!ma0gk&o)^MmjX?2UhTz1)enK;2GMA$gNBwuBQJ%-r*vvVjysmici=j1oC~L z;ZMn5bD(EPBQO|$`r3c~Sn>zZs3jGm9(Kmu3^xn!BlXl0`JyzNw*TOR|I)bm2ZGsW zmrJ*Vc_MBlLJYM>u>R5j$6fvEW6wRUcdtAqsS()QgQ5q?CGuM8$vVsN@Bh*XV$?mz z0F~F1Lz860o7SWXf@o2viW#aRNap}>*3BWMa6M{u12q1{xa3P!E$fQb*BP7F!AURy zNR&@PGcG~CaKoEB}_fW*bh)s!xSkQQr34j|D0y{f;>SVP{|@&-Aom*3N*KDG zA`$S?Sp-$fOVy+{vMv@J`zpWyRG1>9lsJU^79Xk18YlZMdJEs3H`)N?`yZ&+zaWag zi;?Aquho#w&BO%O-^KA?U$}1i96;Ls3;Fk#9`E@81-SQ2{+r?d0LMWB!Iz$Q{rq1f zOzJlg0J{I%hGYdt@aLr6iy4U3KtLpAXL}-l7vkTDw-^RMnIML(xn=zL^tVO*i^LGk zo4-g?X*sG{fB&feH@*C8w{6@)AX9@ipA!Ew3{;g3v0?vz*$?Rj0?_CMfLM`i^9Ur@ zHJEXNGu(9_z>JJshUFQZ5d2FBLai@#-7gD=t&3Yw!r%NHtiIZf_I5;IjOq}mh#6`2 z*Rk7SYW0RLz8Kp2W)n+p&podeaJ*N`5R63Z=urq3tU3@>x19k{OxKJ91nm>W03Z?i zHG?2~`mBGB05@8feq)&Vm}=ve0bd-x3mv{dV6Qw=FmzTWRzlqyiE;|Iv=6d~wgAi2 zlEVhL$u`v@#<#L|ixVK*c+Lg=7KEYZT>`PqHY`6ZT8r_Z$9#_}0{5K(yl2|U z%ZH)R^MhQ`8ER>SA`Gw;KF7)1LC|1aAf~xg#+@M3F0g(EP|rixYzK{iyy{4N-YL0m z`a>Ne6aDHEAp6D|04dp)JO>fvIbcq@8sRbv3KazCyxGCfWPsnoo{^+H8{EE|TrH*4 z-LPeCyRn;RintWI)NR*VUO6c1Leh%dzUK*M28dUzWVkzz0}R>O+{oo4c=N4u{;w~C zN_qDI;Z4msz~FJ>W07qGj1$ho340D+n# zkH8%n@L1-lL+}yJIArXn@pknhatj*j0F+W--yM!2#1cJT)9-X9C^qH=Kyn$Ml?FJY zY~4muk5H`JeF=mBAE4mEp^>M{d#McE=mIL~m>vMPEeMKhwVtT);$xsDaslL2B4G$P zk}$Ia0L8i#K9BOSsoeTZa|V=sdaG`yaR$)+EIoZhp0F78sL*{)Q4jXy%X!PnSi7yO z^mfIbKjp7?J4Iz%W!7Zbjg;=2B^N3B?ArIaDC+?*blVGnmX73UP5>Y)8iCzw@iR7< zm@aD4Mv!%_jF_Xh%M%L%I>B>iQ~RjZTtaMH*B-5>Zsko^fQ70k)0-^@*Wqg$#ZmEg zX>xgc$ZM$!A)I=MwDdO;QRQruQRKlYpfq10;=_PmXr1qWD- zg}~2;u75blKsrXVjB2Z`=Z4lmLLzk=+~(d+`+>w8d1zNM;-A7bow(HqinDlr)yil9 zs*Z~DC~}|4^A4l_nr&Iw%F;|ZY&h|y_9Pmxc8R#DTLTU`@_}GriWD1eR)SY7Cj_Kv z`R%V>hvCz&j3PswP3p*Vj}60r1^Vv!5!JsthQ4BLjd*_9@6uSt=ngSK@VK4rbg}0I zmWm=^xd0YSlpYLyCH0bg8bHIgq2j*~)KA!=zu=eGnA~GPf%cIR9nZU~nGb*i8^*_< z*u0J}ajikXaLHeHQF~Hclbq?ABUo?h021=l(~H5?_7|W^T5r&A0z`PdxB&&eM_^Yq zI^f{dTpUfgzz$JGPg)uy+9HJLcx#3tZOT>IDs;MO=2Dwln;1Xtp=Ajf(Q3c^XTFpK1bn~c;YQliJk{CIn~1IM|tA+gyXwd8=JqK z&|~pa!z+?;Jmzm*^NUIE%8a=r79fXqEJC?nRc?J#zkMs5K4*Q-1@f8ir2e>J$LTX8 z!#PLK0i~^ePH+u|_-4Fmg*1uOVAP}S3H%<6H=Y+s$0y36Ui*l&VxCH-=*w4)Tqq(N z8Uun#P3cOFy{^C@9=a=|qg%x;A{Z%OWw>j9D4Fo@}WJ zYo&3jJzkuA#QtPalsx+@4QbIFDWGS&_#j`~u0K}hyLkM23Zd>?9>zrkWL}1^|#+&=?ch^1l6$F)@MP&BTP|f z0tpQK186JjsP0%tQVYFt2HN(b zar{I0AfKK-DQb~QvkYZ&Fi*U!VVw&yv1ECW+)du zvF_h2fh~V-p;o8qf&jZS_R?KB21Is&Y{mVK!A#j zayc?x2w^SAL(Va|15g&5k6E-A?ldq?191K2ta}tuq6bc#d=2u z0e!R$vE&Ij9tVDb=*vfYs+Zr-=Lz%o9xTYWdQJB+w( z?@M9llJrF$hjl^L)T-F& ztSCdiBM3q3Onp8>H8I83@WTV)GZN)VS#|+%N)h41uDS#&DP2HOdF+(eko1YeNrgr< zn8M90dOUsGF}KzuLrF^E@XZl}Q36#JF3s5+XPSH=Qc(tS)WHtE@txu?yNYCJdI3JQ zFNlOZ0YPQe@siZ#T~}$&H-HR=kvqI22O%FQ8lHkdF3Sl+JN6M^rJ z)|+fMPPT| zYbYi3h9JnjaVLvC?6?zfOX;z36Oik;`v{4p{wZLoGw)!z!_~nus9uHZ_l%k|e^)_E z<}1WKvJ;K#RieG`_-g|jvQd#3;K(OTRh+ld5n595fKD8XM7og%y{ zE3J7eZ`)Xxim818*vfzX+yR&pq@LS+3xpu3ZX$=z{)ywh#O#hR zXR@Mln3DN7CARzD0D{vl*sI?zIwiS6ZA+UJe+68FcHabQj?1i>u8Vm>GApbnEVDZV zPw<^=XSp&$r+x`oxdfOp_Pz8BIQ?UC5LNLjv|rweCXZi7(0X?fu`CgMQ}SF_X;AL5 zGm@j;_{C+$+<}JKO}&&*`prjzZnChWEbM(3zhn&8NvuvI51H0`J8n+M(r|7U&lnyT zea0z3=+2R%MNqp+RXz){w%k4c`EV93!g2sRNw${2*c;P%i8Ns>#SLI8=i&`iFPIyQ zk)Qn{?k3Rfz*?%pl*)jF+`HpM4BIQP0vQkIXZ3CNDSJ4iQ_CTyFn(tZ$vtZ1^|y}1 zzLmP$2)r*(#BFn031T|V`wI&UPX_?EM%C5j`Ek&UO6J+9i29O>uB(9%0=b`frBL=m z`BF6@umok`K9OX|CwJtudg^Ulb<8$yLQUJSFnr%$A2k%^pq!n=%Dp@#Wv7lCX$eFV zJuIcMA<-pDKb_*tP%*t--IiGNYEH^x4$Yl|BIs?wcHVguqz z>36h@xWovaMmHS7W5t-}GmIZMT5?&1=qqFcsEe8mvbGV7Y?n#U?|q!&LaPIILse65 zKDS!C%DQd_P}^71km=_{o1-dqA#@BXr-Z83@NR>)+j1||P?<|4sm03!kZT&D+`c;2spVhi0DqS4R`{Qi;e@~$;I%86nrF?e0PD(%kP z;6mKS)E6^6n6hg}D9cIrqqyYsxUN>mmwBW($dw{1LLTmhkj^J0Vt(7H=mO$GohLE`G-g*+8_7=C?l%SG9qGK425;2 zDHfW1tfs-aLlsX|kx0Fco8e@H?}H96?2T?4+NCi)VvU75VjSKW8H*pD_@HMY+g%j- zCi74)Tx#)vXG?u%(KRno{2qfzX}UAQgbYucs!gSkUU5Y0F#HpnOY zYgMb5A?rk359e{`4I|dcyRGj^52LwzpDnpETF>5?DwyQe%Il9{>VSUJcm0{(%0AGB zi4s;>HVaO`@x$kw>leFY;+WJ=Ax;SfGFu2T*kA;6-kYvQVf7iVE+N z=$;7siuOZX1~)7KuOI$ug2qZ;H6Z$2Zs3|5c%_+i47!Oss}XT))+xa`%uNx#t6(UU zxI)+_MV`b*^4gc^z3Gyq0PfuaIMkpV^Zu2c6iO02hlN9EmK76CS2VNUb!vp$;m*ru}i9%42!8Wh76@f=BOE46B|nk`7^ zX^w^y@Z-(R$WqXfABb+fzqjZk>Z$pNjkz>&_lq70>X)>8Cd?ugEGXOMS+me&3q4rj zTo-j_H=5RBSS@GAD&x|HmagnDcO~wk@%Qk{ckDf+eV$w5OxEDpYOyO{UxQh%HcB!UL<}~`8hpyo?uj7*UmxPzvT$k|v%UCN;<{jw% zu>PE=E7p6KrnZhSdDr-$+f??$jK9n=mPd{z2t40)FxWQ&Ts4ikUI z%pbF3kuK>HUU1PU3sZtia9Z zB-7_t%{5m)bv&drn0_R<(0C|na$6+gy_bb3N#}FgwW|bKQ|kALuHhpSwW5D+CynD$ zfM`d|s>0?XZpifVKS%lbVxeN?ZGq?T;!KO#OYcf1`~c>xcxvqoH-GzZ)c5aLLs&Cz zeP6yqIzY9q(CtH!n0zNVV0oc~Gcc2_f{jaSVfoA)BXe)RT)%p^_nuN$s^g)Bpl{uZ{V->) zI1;w|-2J{^rvr@74`=tKvQ*j}r`420pt-1QMJ{izglDoIvh{|Ju{OgQwRSm6tJd&D zi{wP?ZI~agz!#-soW8wGE}|CdCtKQ6GGTH=&JS%W=^P``r5~G}cL^JAN*P*=!$PI$ zl^30_jQX1PG{107JK4VwB7BF2^hrt-&(xK|LbgNjLORoWrQ7Y}h1BM%X#dtIYUFOX zr%awe66C5E;}u!bnRBdrD@k2MHazawVE8E5t#aK=9Xd{N@DBCR?Z)uLF2QnT_QND=WJ<~Z$>yW_x86FwxYi&Pca`<l&Be$4Oao>6_4BYo3 zJRK0EBu<&`jZhaX+KvW;S2s$(gct;2LVp=hem%aF4RPWG^>>S(h`cu^;oQ%>P_7F4Nu>}nGlY*4g=yV#a<#C?Azu)2_< zi>cK)#YOA8?@A2mS?#6I{ENmtbqDXXkh-ntR#oo;u9CB@YUp&TwfkFwx$? zBl@$44j7yf9!3w8XXo_Ktrp+*xy-)qqBRP3{Y>bq&EqwS6v#j2F@8+LJXP{o{bJTx zBU}wue)+CY>$7y6vxwD>+M_S!)BEHym(cXxpVF|2EQ|bjRo7dp+Gr}KsWf{%Wh4BZ zq=P)+Pco>eLq%?=ajP?o-%*^?`dkcRKyS5RD?y%o%cR+?$cflK0TLfItt`J)84L`p zXdVvSS86xbE_BT;{Jx^ydB;<0hNdmDXZfag$4gTp!lC==Eh1{_7MVgfWYA{W9Acx?8!WnfxTR>srXFZXRpMdtqWQcOtc`x&i~my|%a+o;YsP+1e1vNig( zEOEiUvz4tRH@rGKg=Rx@fP=329W{L)%`#JUfq46>zBZ0Zv8w}BW16Yz6pL$k1+t!2 zhIylkBl!c{JlbgNyyFn0915d2YW1n-xB^a0f*j1p#8eRiG;`gzbH{L(TAt;tE)jpf zi&?z5cGFuXzqIN&m$_3v<$iSiXUeR8rc*hp4tnJu#RYMCdi)`IKS7~AGX38R><3H zNXRUfz7xAAsM1eErz2a9sW8<@Jhwh9kd^T;1CBElP-p-l17v-*+I&5R`Y)kwMHqR7iRcI90SdcDfo9y5s+?Bd3sZ;J?yaoAG zpS=BUCVFJx{;y9;)-NXyNF|CEAKKKD(4ExFnT~2d?6!1xQCst;dLhM}XaM+}_llSb z6JJKiKbT4ZB2XDW5wz+dXu#Bo#^xQtqL9r-Rmtj_gtT-1?%5~T&dImnu(9I#8q1Fy zD%P!jSIxEJIrM_-3xqL8uJTfLe_%i0W>?Jp(n3F`V9Ace?^>#O*4>&iK@PFFsC&%V zT8>NKyZJufT4NEhy??I})1D5KKEqxP*F2cg3#wG8@ubRgxW>ITy*|jy&_|HN4u0b@ z%p0bJI>$q2q4nl9Z7j5Na=k-EMW-df_roQkQp4kW4gAD{QWsO(ntqOw39a3yp)j=Q zE*O#~N8Km5$kKFw2X{+KY}6PCM~H!t3S$7e`lTp2g?@CNlaXb!z<^d z@6L;3b<*w?=> zhG9oxxD0TAT0`ZUaJZj)Bo3zO;#WGns1;o9Y&osnx_*9HR^lSfVfnPm26Gh{98tf( zi)<)bID6~fBph$!~a3`aO$+4+o*$f;;G+H$dCP$#IKl7F*)O_(;N#~Jr z3sU^4!juFQ&1m*h)x$RFRJ_i2a#Mt+Mh!e#!di>wiZC1zzT`PH@`m z=gO^915fX1b*}qQtfjPv1)U>Ntz7%|Kk|6p7d z6|vS~w;xuUof>Q4X)>+7q7hu~Ql!%}SPlNgOI4yijd*m%t< zX!7DvvS-7gTa^*)3ZF%TFqHU%=HES=CB}$Y;Qkb7AjOqnsa15qd|6)!Md4ZA&_9LA|3Ucn%hMm+!zq`M>SYf&m`5@7AK=^nw^UanhGy#70g=c2; z^Zq8p7*oY`gMYQDUq|Aj8|lit>W45(c-f({LlGwT95J5V!mjVZGhQT83T0#UBar-I zBxJ!tZ>?R(<%O#Uqf_dkN&cy(^~$PhScHRPy*#I31;(!w>1Hy`C}gd1;714`RLM~8 zEl}>nQuvFF_Be|5hA}37z-`+`iyceh2R}MFhsAV*kz@?{79O0*kvXJiQ8LvZ}=}g#=KPgIu zm*!bIMD7-?!_u<#EIH1~&z+V(oRKZx%jXcx91(DMC_;Shioza1^eSU9 z1htyf$15KSO2&r!dwLJ64<%W{A92`X_`{SQ1(V2bFkuXsIXD)+eN>@#I@)2uO8PPL ziNzJHvZgcb*}mV={MkEJV0a<62u#@TdJ6cG$bGTKAfzi5Cb=Qe&wVi8KUUrbm5{ie zwVp^TU}{|~8Mm!|_@s0fv^j?p_*H-9 zKfs#nepclyICqxMT`_gF4)YK_FYS%W~_r_AMY7ui8SGAVVI6& zeC(T(2plnuncPDwGVggb<)%s*$h`B#z$m*!)tgj$qOYR20y5a|YORfyVz3zFOg8{~ z)~B@P;6E2RV29_deu~m|F04fs+|IQL<7D0F)#9ic&P)Kw%dFPjWc*WH_V0^7)x0LT zFlscqebL=|lV$+P%=I`ApJSQZMB~O!>)c4J{(+HI)3)`hLf6>|lb)SVM>+;-XWB29 zx=jCo$WXn7xmm=;Bg!EcjEqW;9wS>G(f86W33tDQ*GOT~7Ui zed2fjO z^Vd%sK)q5lb$Y!H`FD_YPrKEe5$J-k`{5-vRWr^TAZFoG;4~B6h9g?<{sTV~nz4Z( zhN(p`{H)YuU|fr6DX1Bd!Mcrz!Mk)(2Rj0|MZ0V1F@o#>Q7A{m!Lx3wa^q;qwrM-X zC~6HV8=~Hz?2=P*!=`av z!|`n0Ro^N(!J-*+O}z<22e1J z2iE{nJ3a^7(Ze@4EE^w_XqmLt9m2*CQA3*^wyMoSXgkZ%+GhF4(-|c&_idoimdAi1 ztIQp6RL!xNfQn0Mb=OtN09V=OHiBD+$xAy8D@)al!|AhP#c3}hZOE^=RMMwP*Ojqp zRhna+-EAn`xqdg~Hug0)2ww;efCyf?=&al}3Ooi>JB~ZI+cs|d9wUmX;T!`fOv813 zwq36UX7!)~u0-zNP>HPcNC!M9EYS&wxD{=DWnw@wMsx$Y%XA5!$88hV>oR{udOz+a zuYyWn8wd7~M+1Q1X?wu?(t(oi?jYej0y8E2#`N*Mq(-@9x_H(4bFtq-WGS>rgxmNrpllF56yK_nSp^PhOI+sEUqQ=z45{BMMYXh62UN#P5Uv63JcAO&6CL)hJ>Ihpv z;9!FiiBK4UTg~7o!)VvUtcC zk0R=wP>cVR|GoSCmC+7s^UwRkl{&t-bk!*6+a%L$)wh#xgx76K%rCYP9nXh*iP^a% zA!BTls88byRo@=SteaTB>V0p`kp5)Fu z$e}@Uyad2W5q!}4TUE1e8}M$HqOb0z3M<~|a$-nZ;y&&ZnwACk5YW@ORN9{bl@!9G z0A~U{uxMOL(lT`WT0^Ag!6gI;trkjq*fAK>9hJ5FJ>!UsC0_D3ybG9IJMI;YK z(IR1>$rtm8#t%uF_wP8q$aUG7^-Z3kjTYkGY&_rg zg;yH11+~Aud&u?uh01N+loC)Zk-w47LGMEuEgR$A09^j=Z|o z$P(O^{A`EAVgjNJ*tV&P91Z0$Iqt{X28l0KL$}&|Z=n(jnl{Yc!#$NodZOslg)DSx z2dCPsBvf6S9VVP%yW=rE{R}l8&q#aII3ZoWgWnTVM4=7W_MTzvL&Reu#eB}m4apbE zU5&c@e!frE309-zo2;iwc_IlRlgZu%oYx`mZFcJSpRUd|c^ll#wsLDy6hpeZYKA0b zk87CPF`n)3=T3Yq&!9v5$&OJ(UFWO#2v_M; z+4##Dq6M>s0iw4pW$#)yu zQ+giXPY8I_v7Wt1)Hd>l$S`7Qn$P_Fr4gq30K@|-$rDd6*#f1^4@xr!^RL9MK3mVr z?j(=5gxkEWaBRv>@1Q!FKIZI5HbtTmw5t*Q@Dwe{p()SV!*$0+1Ll=1wnEeVjDg>6 zkhod+Ct%BC$Fxn}W;3#gp316gm*<7^8hG662yZo;;Ibj$?O^+l1TDI6DXo$&FOG^60Duw?peUw*l|xZeVgtx-HnS%_$z` z=;%wv%9Vym+qr9^vs?*^!JIv29LuI@EUHmGbYP2>2j0k<3BjZNAKed(fhq8;ci5Bt;@C?qBCdySPymf{2YE;x z!E9G=%h^J+h-0)i8@KbqY$GGrUEyqwaHgQ=6X`8;g1_A8w;uPI^wP z#!V@*7jF+Dc-kSX`QwP;JixzcbA)MH3`iMow+@wd^l%D`IHuq(f0PGG{>c=n9x@Ue zEAd)Ihgd24z1FbR4|CUwt5EnmOjy{pF1t}RBbz%8F7GH#=fQ^!P-ZLZr`($Ig0n5j z={QZ$ICmjQX|o-@s$t16l9__Q`<=~M9(zGkuS>X26+R5C99JPWM8AR$MN)lrXJcvF zB;D`ZvOk32ZE67rM~(HpVeWw=zLJIGwbb}SjIl~f zW&klDeudy8XEnQQ*Q`W^ma?h*>7ze<>(fnN1gi5DvrZ9s`?dp2Ywa!Z$r(mpihI*k zk{@s0xwa}#_0^A0B?c%hcq&}8%Ze}W#)z%Z!>y}68%^27=>@yYraKNGo*O}sIm`yW^Ub;SJ{nH9KV%`)!5e%x+O8on!6MF*Y_#HVr@W0gW zcX7Nk0-rl!x>Vi&Q@8*Aw(nb9h~>|&*oVwr62GhN?`?mVsxJ)hlWNt7f01)9oBZEO z8eDIlzH2ib(lMJMpYqI|d526lSdYx!a4mGEkw$F<vgdc6ECyO8Y3B3nWS#$)iFmhwzS=Sl4<01{Z*l)7DKir=fa#ZJHnYibTIf8S>|$Aw)(36R%(jamh;7wjY@DVt!xknW!)F&K+QNX4_`OB zLC;3cleAmwB_?A)|ILt)!fnq0EzS#`miv*kzjFbMwr8xjs1XIXDExbK{aNSVSpypi z>*&+|2c7$b0cP)H56KVsTj}{A!(_mgu%7Ov|8u|p-lnxw@0$N#29PFQ^@k3`BGDa* zE%On3)I!_BfshYjdc$pi>3xgu;|^@^11w)~M;=$Wr1t4hUdESKIwTRmDq%S{=NJCDgMZJr6s%$CgI|9!XTPnfFA6PCKz-ES zb%ozo<=-u@b)HI5%$Gy4ZRa0Uz>E`NcK+w%)1>+Sraf*4Ns}zZWjS&^^Q(U{uZ-|U zX3oO|aIU8z=Hqpvpz&|#Bj$krY~FHvac36s7V^iv`rC$kzz^07Mbt-C@9#d9dsl-F z4%p*emmS3G-e1+8Buy+Ck5(o^2)tjAdhq4{{UCgh1v##7K|lMYeT#l-s{OU2f7uJC zC(XDswIV{QPyco}Vn|D1Jc%odntwAEL>HqE!F2xbZtv&`u8iHeb_IXCUSL(8RUy}U zoUP^3Zd5v}J_d4VHoFUPipCgu%+qIozJ#*-Ai&L#Afvf3w~Q$*&@GkUVG>>+e-UPX7Q1IZ{MY@vrJ~y>Mc|z{+oM9@wb= z!y;uXiTTy-V9a3=rZ82ADlCc=w-95d*MC1u+{)lYUd;|5m5w zRiN~wo(|*v(Y=v3f3q2V zqo@ZZ=Iel?ruEv3r0029JS0OJXq=?MunAnL3y0%+w#hJRx?)d}E#u=kZ|~KaI+y9W zL{&{@GVtV^Ekz`x0jCKA zV0G|)ptb15!AR_B3o50y`f~Ca9sEZ)2TGJd!RD|c2NsSHT_iQMb9LWZu{=|VX&it@~4_7dp#U&0OUm>YPAA9 z6?YI($obozk4alerdCEMf^vTVz6A)p5mAby4U?xA*QRDE$?klsN^SZVN7JvnXNMa^ zh++Y7;Cl=B#+WJ83+RV^xhXy1EyeAGS^=h+o|T3ITj}$FrWXVF#jN?kTlSq)8TCNd zhqKy&kG0q8((XaKmCcG0| zEIb^6s$v|G6DsZ3-{=TO!Vc!B zH(^!Q_v3g#^hyXg?irrnXj8F%><)dxzYwqh@buQ-v1nDxBfWKjPcp?}DNzj@D4RFI zGQ6=((E_+xIJDM54FFQal{aO1R7D93L>R1oMRkr`{TjHEvfl}zjY8v_g&M7n6=+SC z3c4+UwV>Pv{xwcO^Y7^RlEmvAq&3>88z;VOO>^kiaMXi_=zwP#_}(T&!(gx0A9}Dv z_=C+2s8Zm~TPOh_^*#4xt5(Tt5V{&$Z3!!G0EvS^pFh6+5@R*r?EAcU);L*5BAH$1 zP7jOc8+|`?Bv)KiJX)|-_Mx7RJF~*mt}E$7@wR;r$E{wzNvxcN9XhIOI}S+)MqwcL zk~>dOKj!{MSHRYN0Nx%S-G%ObV{BVW*3)$iNBHkIwV{B9_^Q+k_>r(K&W~{r7@MJ| zUjqp>nKtY9`@O%dAOQzyFD{i}NdNMF|09kFkmg6vw+H<7EICJR3gzG(BJe}9u3#g_ zCdhvDCRPqPI!;h|`X=ri9Dtwje8E6@v_ZO7pjB<}0>dujn7cZkVk>Fp9s_f@QP*u5og^m0<)*DKaF3Ta+vYX%*}rV&Hwr;Z^L zLPem`MpZGq6=Owh{J@3a1TMJf|AeRSK_Hgh`-O&JzJ8EHsiXe%_HIXuB$hZvi66%6 zk8e!E%;CceOBul&tvCEoehh&PLc{<hgZ1n^|r zV}?tyF341YBtz6jBOo~ks(ivC$q8JO2u8vTSC?sfS%T*xApcW+dD>xs98t)Fb6nd& zI{FJ(HvXiRBRng-Q2l{ElILNybajVgTG^|i!9PHZg|wy&OE;nT1y23FOz4kLsDB3d z*#=@{gk$PPkrJLNu6=OIA#8S#wXE{hUWeN%u0TaY6 z^$Z?Tv_tV}=MA)MYK$?IZVGbaVXkC)UrJCkffLFo>c*C8{TV6_h4yzD++#Df;ixBL z*|O0mi3@g(K;CeW7Mv~Z?pOHlx0Nf{KO4igTQ-P^ZuQ=B zt8F7V-zn|GVl-{|nXwGoJs_x?0r*ctdcrTn2PIhP$eprgH*s{smm;Fq6 zi$<7-OoX0%6ZZr~GYlK#qs7{sPn*|(O$s$!CAF=`Ysh5ET$D(MTw%r@wqkHZAg%R) z!-1#~1Wv38ZWD80(Q-(TrI|f`PSpJo8?vGWBKFh1pRgYsyvthFJN)H7t;}mryTUT^e°uXWMEZhPBCp6(

TdWY;LCA{st)0em8|^;fBErrG z);(9i_L(DTm#x*(-%Ho5e}zbO*sYPuz1e21FU2^xzzgCF9Z~E_Lu-kw4QYeK;=y!5 z$#cqzY%f=;}&|loFDspQoA@8`A zr_Aiy*+T9$4EDHPm7lxXpu^h1jsYXjGxfYTOFBDvv9_#qOU-QOg~dDh$wwYDgh<{X z|DH1L@^zjPoq#^3<7cOR0I!Gy$_^&;9nMVj0-s|Vns&~N_c`rDH$jl?_(z>gm|3d; zvVGw3^NfAnCcJoW*c-7A`@DMOu(yufBaJ`P`bp0Sqh6Qu?3(nEyuGQrPHI&w?l}G4 zTAuM?l+~)X8C%F)eeOr+`#Yb^Oob?2KgK4Tz8d=h@p$mq-c+_+{G{bkBnn5o5~mC~ zPRFYNl+wjd$02TLHy?i$7a{4;$TsM`MHU;Cydq7c^Po`1Q6WjH$q?TXUYh>30n|=m z4nr17s1c`<8MYkY9d^dU#J!7l>s7FP&xzrO2pP%sB}or40;9Py-H7(RkN&d4`l`Kf z>{k86hwIW8xR`OzWc>YV4L2EC4esb6KNPxa_BBSta`TbjEk+DJEul_MA-Zop=sr+M zS29VP1bIiv38@FHgkcfy+MFl(gedjHaC=0a;{?2`FJbEsM376^zuY6}&9w}ggQ_@h z!7AFNdvEughRr_&x3qEOTT4_)TtQgl###|vtGH9uT=cQ2`vBKK7;Y$>MQ5atBsh>a z$$(|suT=k3Alht#HiVkwHM>1URqh8akun}KlL@YI6g`YyQegeLkE%_Wcp1;sGJ4xo!?4Tw_SmGF+;KLqC-Lsz=Hfb4lE0i5u zL{IQEHMjt!yRO=ug|~1smZ0m4#^UG6N9fjSg1HTiw8~d<@91s{Ev!A3oK_6lmzycY%ulImFS@pC{P82|Zf{xDVUtVtOCg`n-e(?Z(Pn-0|6 zPxW}zt+j@lL_a831V{*aCvH`MtGaK{wPgnUtHXoUK@BW$keI;{3c0GG9t52mI>>dYcNhWq`~MxN1D- zlt=@ItnsY@mJZ0`1U*OggGq5-@6S7E9uN!rJ!h%|^Jw9tke-pV6QfZ|5_x$ld8eh6 zpU1)Q3WR*C36tv;kZSnM*omj~ z@T*xzkK6)h0bAxlHLXMX!sOf5c{5xpuL0nHy&c=YW?V&&gN3yoSMlJfNo{4>#@^g+ zN)A_B5Bf22K%?X3%E*}(h>18LLsdtLvo7NJGDOjK9A!S5+VElxxCz#*o<1Jf*gP|w zs~I<(?yOeg?!6IN;&{cB)M*T?-4uF`%N-#P+#R^`JO4CGA|v5}11!F2PDE-*iEy;! z%^k*Xa4MPynO7095knbEr;*9XGN!)cE>a7W=m~Vq?h;|mZI+=fsI!T#N=&9`tBBaQ z2jdUH-l{jQYMnO&U2X+ccZ5g$+a44KX z?MNkej1S^{UsXS`4}YR-`2l5GX-YxC3r68*K+?t<85m4Nh6Atvfa>feU^M+)B+^j= z3NJL&W|vTLCDtd;Qsqi@U4FCpW3*Uo@SB!J!q1H;(-&j<0SgO>dv-!$TZ&0+u6xD{ z8eO|IIWCT@-)X+aPb3dPV9d^YzpH(K({vM4q?7^Wo6icB2eQfqVCd*sniaF1PQI5W!Kg`FX zRz2@}gGSFZ@Dx3VGkPZ1U1PKY@I~{*OzGhEXL`EWSoYzK`3lHo7dmGP%{Up1_ z51S)HF=knkc{38{0;!x?gK)w=ZF*z;*p_}GT1hjQA4@8NN5A^L!>QRj>hEN_E?D6% z(GM?+X>ECXkiBr894e8yI-I4Je#4pdc?ItIQ>x`P9)3{Btjkd67po%Jn96tv>I7Eb2n}$nCe7b%N!tkl5+mw zSgm)9e;i}=&XTZO^Z_ZdHz!EK|IzHD#5dZ0WY~{QxXN$^&k`#dOytS(XwNYjTI^XU zaN5)@VmXSqjh~jaIcz+CgA<+~lljgIDr!e$~e_l3|6Lpwtmjx7bM0^L$>DdxR>dQ@roU9{p-U@M<;rVwq?XTg{oMu z=jhc_W|#KQJ*aWMz{EVA7A(dq>}Uh#;#WA+JfkZA>BHAse%*@3@5h;{)0Iin2$07& z-||~Z_qv^(3y^a@JuJhF-F;hX^9D-ZMH14|C`ZZ_?-8y(WanwxN|%#rauaLlm$`FH z)2%_1)VDFUED52SoEko^4$MnP6{coUZngP`0$oyfPb=Kr>}ubBLgYBsU6$*}nkD@~ zqS-|%zHj@Y^mwh;w$69yXLxav_N5qS-sR|FA)f&hMit`6P_y&n9rF_g2>Q2q#V{c932cI&14hDVboaq*E*cv!KmLOsex^s zB@3UevxF=z>a5_!kTY?bS9n|NFrbcm@lErqAM9OSj=)k9Vn676o7D*1-Dmjx?tBtO zsrFapyBKysspb+tvoSB1Kul7PEF0bi*85F4otFVKbsB}#wWFv&3Y%{g=90m7$N|JV z#|UO5;@T&B@xg>}SAqqBA)=?kXq%unyo;h)W-1{b1G2jlmThfn!&h(BSaiNN%j@@x zAi`i(H8N{E#jl*lR3yWC*DiOoeqg@!`U5{2t1WuNT<@8^P+sl zM6)URVaA-n(p|pt$0)u6?B>;-jW)eNU~maiLkQ+>MJ_E2ge;%3moK=7<1FP`HN}+A z(Ikx9rN4-_eqS4r!a2->*j-`#8UtFtVfPDdP_wX#$Mn|HgS%9(VLY`fPut+&YSChq zVP}$Y`ivwTU%QQB$;!S5PhKy$^*q0%Er+ysSUi9#u4KAn=~oj_%P(@;d8VF1jxv+_ zbXiLDe{Qg>F-osTes&7)JN_hLR!QId^&8r6aG+tin&#RwYYQy#iH*)C{74rEp;Qy( zhxfLQBZbdJ+oP#lCC?6v+1(!-mg;u9ovS~opl4%H|C-I>NE@d;?ae&m zT%46o&Gmkd2YDs;Yg0L8L}(^W-T0nS=ktrYoz%6HeO$C={-+Kun{=IP2vnH@MNT$yPSX$QdFw4W=tDC3BNA;Xwkr zD+~T96dY%;V6CU09&<@0-l-E%l&PT;{L*530ro;yP-BH7i>Ve77dev`_w0@`6A$jY8#|11hiWGZW4`WTvwXQbfrrc4r=#sTFWZi#Zzi3oj$%9 z6i=ka=CFZz?3%!qcHC3Fj}MD+W85A6l~+1w81g;Er|{fVY!_2G$QkULo$Ke=JIZg{ z@^sm{K}+p@g;U-1S+K3{0v-3Qx7_9F5d`^h0xIJ^mh{TlMD}I{j}44qZESRY9@wo9 z6ZZT7qJWk;-Ha^}*RM*pYG7bxHO_8&heig6SSEb|WN+H)r=_=Xd4mXj@51%_oXO9U z@p7yL*?T%^hUpa^FM#`d?0l5XyV2;NEqA-YfoAq`EVZJbL@&v@Cp?2%K_Zp~tS??^L!WnV|R>I8i=WSb(wV)*g#nT1PSCC1EQ`R1- zCx?#ieG)ZxRrTiUhCA2$rl)g#w`D`txrk4yKE3boUb{LtVN-JW9WaGDDwz|zdiU^N ztL_36hb0sjd1@wJFaNs&jAU50+g#dJuWfkXgHqBo$w7=iL}_I zcgV*aq{sFySmiZdAuh%>hbG-RWw^~T+QY6k5&pyWHde_Mbf?oL7rMrs+}d^|MCe2q zCk?}vG&KIXfKO1}d+^Mp+OjNTy<+y*uh=)mL zQ1{}vqCkUbL3wM3^5ny!5yvc|mIoz=tB!qWz6{Ug;{>@{IOo1lLv56%;M|kj8+^*G z=A>4hSW@0$cweo%KXY~jDdaplh8{mnpS}B4HW3x~ixX2T2AY?vc?UXKeEV=Jy&TE8 z%ooPSbGPE|uI=iDqC50dGyB}e$F}Y#Gkgfs@wUVO#ttD)pmOmJWY*1l~L zBTo(RzWST23cmta^t6a47z0UP7vW!i@z;-;?_pF~<7T)MAAc{p`K%8SOv9Vb_P=MK zoMji*@8LO9V1X9LBkbP$lLy6p zjDLN_PkzW(Lk(OE8Kb`IKQ8gF&t+}{s%!aM+lVyaf`4 ze`o;bEt*PD-nZ}uqlv2q)(7?J4`NdU_&h~&4;38N*?KZ@fGUKoaO$kI%Pl=DgZgxA zQY(G%-*AtWe7A>W0*Y^{BI`Z=kj(w>F?y!KSkinub@%aa$u!?j?0}1#Xq&2qo{8U# zl>^p28?6)HHoM`hq;evLp4m6DzxmjY3-c9J0O|$7ra|rBv(>CUeBfNh&Xm&r{=P&t zBq1^z#4IZBzWm*(fMbjW$o0cKHKliTMgSa*f#AJH24Ju?ZtyvM(f8YOVSONA#_HJ3 z2VX`N)*W5gSsfQEnu3&%|7OpD!tZ+QRZ*JL-EEBCbU;M?tf$`lM4(rZEC3R7hCT*_ z!AGmxCxDbA0ujfW2Vf&+jIQZmkj2qpqnb{!tC%e|0g2`8zV*_JHi8AJw0gTSV zqVm-FWq#jhEE_|+>Tf#Mif|+dPZv&UJmmZs&CWW#JC4Hrcn{FG_o~Bb-T5kQt!RAh zYj=n6k>x;Sjoi$X2CU{&)kHo*k5l8Nv%%T+_1|4|0fTV2d=%2o0Q{4?Q|9Z+nISvg zS2t-zi*bZ-0%bic4?d+W3aftmx1Q@W9gc&U+kSH6)24|J%4jMQSnNHA#xqTTvY~YW z+a_-Sl2PR?;3kcA9b3*f0rLXM(asW?MXFMeKq`Hh*8$)nc2dwHlAW`vE z<^gd@u$*72q5lRzy@4PxjprMnw;aD`N6OGZOaVr8WDZuZru#Wpz(ZAR+|0J9zum)iGv5 z;|`#>b_?5Bs7Qd06~q%nLAw=%(+)p)@VUc$=$sGgkw84+TW*fftAMg$2?-0(Svbz#Db3k0MMjp?pZK2|a+~V*tlSIb`Vl zy$IypwnmNL(742QYZ;J!VTUB&uGE7;!X3(m4+52bn~*m+t0aaQ{6Z0&)?q_$X?<`5 z0zN8qz6E?t6Oi9go@s=Luya1(Y&=GcgXm4}k#taXM~Xm%OJ`VvSO-t3PUnr0>uVi4 zH`LD;fMNB6;kmZ;h|4~5MOI06`&p2FWd*TRB{K;pRhy$ zqU?FJ-8HmBkgLI@Zo)yy0}LJq0f77+2|_-(7MJK6bixF?XwtnsOIr70d{XYMx#F4O zecK$*VD@%Np8EGxPYaPlDDDGeR|uvTOrA-TlXP&51_`Oc`{w?*#6%FYO@5waR-m~U z@*Yg*l{aAFH=9GmYGW9Y<6<+JCOXS#eX@4$2<)rIQFHhyW%DbE3LQzy#dZe3YR#1Z zHjpp$@dEo3CNoNsFTk@!061tDD$7*IS)lAsW_8D&ZP^D)C<@R&GM&=<6U7q{OMfmH z{J&Rb1VmX>g0!?IFryjTrkh?BYNzX7U+WH}eLw}Df^$P`Ddz=ds@Z!7U};eFT?Rm4 znA!zFeT!sslO>zi<+sQQ4~qf4siN6D7bz<<%^Q5`_WQNB%LM|*2XjH`(jLmj+hD8f z;8}*54@d)TO+`g7mUhHjb&!^SS}<-sI2M*^%N-xU@d?1<lr$NT%YzR*5pA>H$7XGwDS&I6b80R( zLzW;sH=n9WeT}J9c`{!cB!0UKwyPASpxcy`Y6A9{4>6B+jaH)I3iin7P^6l9ty2}h z1rJ3p8tpaZFv5Z#b_%MrYGwlq!plUe7%P{1#p_6k zy)T2@1@3@cp7VN`Pj#F4DbZK3iOrng0dTZ2C@HejRsoGf_LZRPZMdrDh%Y7RsQc*0 zbKm4AlqM8DL;eeeHxE8yAnkxsGYEJTWqP{??$HboC=f6{-q9KXHV5qSZ%fZJvNmY( zw|_rOLRe>r>sYryob~eF(v)D3oIr=T!E&g_(aMwhi% z9VTx5@Kkzda_CdsK40hOBn$7Lc1H#U=aYwE-0c zEzGTp#)NGVk5QM1R+Oh&!mMMKDrOBVO6c?yH7~yxLGMDMQgD=7Z?KwCpLPZJF~YzP ziN(w_E0{!hPkE#Nx9>Y)QcjrXic}W<>?FwDroJPf%+PV)4&`D33+7shcl-!*OmiC$ zcYJ*jB`r0zMP@#II;c4On%@v0vgslH2d4z{b-`8!(Z$q(~JpZP|`Aon+GLJ%8MRP2G45| z&V)LCgnu1jkG)mavIi(hT_OVul&8?MNw7N8wn)q0<)(gwAm0Nn5&Xwr_jp;SOe3Xd zoiLB_7?qh+{itL8jo#mY+Y7U=yj*f4=s#$7#+)pFB_ z`_w{1^up`RR}6rLrI$A9x&`|Vr=@jgJ*!C_h=}ZsCDK5SKR#SYnL|E^op#d|={?FhS@{cxB%81nrFRN&rGxC$xCppKs~zinQt?3_)nh?l zZ`LS;Krh;^`ng%?#;boV37G|WWgF9~7wK^_Tt6o|i{&7O}{hVgxM^u`xRBvF-eO^_m$nj+jW1Nv2&4EJGvxems>IFy{&q zKW%_acXS<*XMl(10YPy%cgMHJxrpo2^I9Rp4C89HdARA1V9``l$u-z4_h^V9wEIDq=E^0pmW7Pgl9o|iqG_rgaETOE9}vB?uCrz9SnF4z+w`*lwBL^br{sr^_^wo4CCu7<3?(- z@>V~LLjT*HF!}Cr^pIm2)_Z-&Vzldo>smbxXjN-W_;(Epbr{#98w@RaUne!;{Of!E ztncMM!hr%lMZs9}|~_>b}6yau{gP72EZ z5KDu_Cz5(lO);pyJbjwi>#M@=ZY?vyk3egDhbGK4H1%KpQ{IMU*WG zd1QY%$3K7U$p@|96A%DB_4`vz^8+n?IMLhVs|U)c$R<#tlOOG`GqOLi%5pgQzOPbj45a5MP4aHXJ!qfsZMoWF)NrzV&c>rOe}kuM0Ei z?^eqYV*SoIZ(V4`cJv)adtP<(slQnVE#IG`loknHSi};v&&0-kP*!i6gb>SqbNJks zs~Uc7eWHaaq7F!SjDhBomPJwmc#s8v;Wl8(`$XCkydEG88y(BIwcS&shs*L1FIsY~ z();~UuL`5mWwB~3M^~^6b@1Kq-`AD`j>eP?@JG_-H4@uN!noG(evh?f_mc0YDbY!^bke z2W}eQz}o*^pU8|uSpnLthb?a()PLWb0hL9_GLiI7j{_Ky=5_AE8mER7V(vr^cFwKm zVEyndiIoP)AJI*Nw++)M0>E>0(YCBtdDHb$AXgJuY{}tbBp(v)xs1x+>p!}G3`+bD zGvK4I*{xIh;1|9(U=uf+_6!v*flvx*vrFZ9%*kp>#Jvmth4JJhaxMYe9 zNcVKYK^1P_f+S#&5@+z}y3w`pu`}naX9n^%j(z-1til*WJ?$`J4bC_-fl{_Ih~Mobic^r-Gmh=%A4Cr08iQ`jnaN(nhKJe`u9+PSbNs1@wLfn^KL?9u09hE8aMLkem?W$pV~%4O?o)pxK?o9>8_7)313Z z^1b{gEyJxtsDbkn8w2WvboIMi9(4pY1YzO+Nt(Ay8amH43mcI49h==MKac>st^`6` z_qCL)M8?%qNFlkBL8scpSN)CpnKOt@2!QeeY-=`K1Js?s-ibUGxkJ3AokEE2nz6ZC zwvxM*okbJwQWqf4Qk2{-PW#6;x4nKrHCiX&_hZAa1s$U4c(jJe7|PiJ5)>DQ-xP}F z{yEK};Amd2c8(;9$TVJ3!EA?&bGCDumT zFJL5y=Fq|#-y))d#h45{VJ1NE?3o1G>p7R(cdc`E*8!v@JG2QN{_u2zV2j{O$laUm zWccmhM}bhfNlS(Pe9JXOewqwe;5QW>zebzFT8d?z5Cn#>V(6|-0I<=sdrbkrkFsbzQinc}#sN+X(5jF%n=$nykXE2nK5DH1>rXEtX5RUl`J zOwXxBDnw=%kd{Y_F(i(F=}vvnCDT-FGhDE#fBAZVeX$TcKo+!qNhgq&k=dfy*_NAn zW(?X#gItzGEl+Yz7&L4Zy*J1rRirq_P0Bwxf(=sJ=DMjOuNE~o#XUUL%2Pk>hkp)> z;~TYJ%=fu(%9#tY3>j|EkdH8_c1*f+gL28J!nxwNVC7GcTC+1YW%%PwCdZ2hf8S^c z+Erp_UCL4soOfVq(FfrqLr4lPW0PHvTlga5D)|^`nHJP9a?+HfyCCR0bF%IHqu!NP z0@%gzGwE2@-#FxpK)Gtv=RT{;4PeB-WBC~f)s>F0s?Ky z4k=9QdL5eJ!!f-tSxApcK8w z?w9ki%zj-0O$3{|ji@68O|QczDkjp#fFjD~F{se~q>!&r30m-GR{C@cAW6TcADM{? zqGqgPIqGX*pQkaMx^!|azEP%EKqanau2ko(?uhq^!y1#m4A?-y5zmC$WIn&Ni{=*S z9zGMcuRAFxiTarwSf6FCsSQ5IcSpot0u|B@^#ssR%M0~fhacA zny8*fw5sy9NVn%|1$+?cSKIVHQmAAJe`Us1Ciwl6cd>aeEmdv)9aR%XW}Qn-j<^4#i;k&w;$M>l} zDTw~S0;uKbYX?vdSjZ7nz0>NpRx9l5S7;hH*wH({f5MIOC`Ee$ocNY4IY%*k{fZQR zm|#vs>O)lKEaIIg$=MrC5{75PAJVKN(`MpzALs?UzlYbwWPUh^NX33F*pBJorA7?B zzyID}2)tE4yu+G_h}r@+7FqXH(vl8V>eR1GZv(KiI7OFoVkuf}d0OM$@*Wa-nxKW8-0@fvSzMk(P|g&M<|no;q4_2cwmhImzzJ z5|Y;2M&B$hrTOMcoi&yJ`G=skrSo+mI~d`^I>mh2*o|tYsGMS-Q*5_{nTfqy-2Db# zV@~nlU4@B;Z9>iB{2Ajw2#BDVJ4ypHPRm*GGs2l91-x;yamm6fo3R9ONTRMvhTh4Q z5)o1j_YLxCqw+*0Y2zxgqR6E>;n}e2=9lKd0`GJK-&1uEW=F)M&k7iK1;5NYtu`m- zRsq=n9Jh$tuVT1QNRmSDxVVv;#)_wCcGt~mDSsbj$YQ`UEH~GQCDOcta}8uIgjRl} z$zIHuyV(iGa`O~k<3}KEHcf&*m4_7~w@K1FRdE?`>1fe&m`mRvqsuxB zm$c=uOE>On8PB7MtGCyO%EvjQ-3HXqe=H0l?5Ee}$^|6eZ)iLhjv;Ec)kB0wrjCi{ zDZn+|(2GY-9lVs|Cdl6H6vrfLjN;!>1A}m@MEFNrr41?hk-4UQL1XJ%w-qm7jeu=5_{H`^!2pA)ist&7lZMsRXvR};8*b&m7+|FY!vGTveUa;bNEC`@M01C zw+aYomIkV{C2$m4&o_%d2(Bo~MNEOly0T^Uk8< z>dNoSUmmydc%bs5^@~lfl>Z99a zUv!}56rh@J+mSr`Ip~@1@ycG|8k$HyL)GfYV9wQMbasX^`66s*auu&25J9>Z!wXp@ z0GJZagSm6#1v6#@*qEr=xWdj@9M5+sJ0PU}NKLoc6dcSb3{VOfK>?aa{$~jQmQ(!1G=ff*urcgzj25L?m3HvTtlqoenr}ZW!{sk zj(Kq=@Qu+B((C!v#+XEdiwj$w*@TLUr_)l=iz?3_)Jfk_zw_)Tk(hZ27_BcVk7oFL z4OpGHjcUxKUA!Pf05!HsuODsrP}FyP&x}^e<|6de=d-)G{MlG(;<7W7tsphX`w{WM zy~C#YI*#LnaT9AM`{E-z)%0&J+}{hD;hL|Y6r>Q&mv)_AfB@_@bW%HqHhR})Q5HKHMX9cb5^U78$ahhQUY4{+WzUn5ueClbztM_J z-A#}S-e=3GPsby*lEO+en6`;jz~on;NM?Nldg5EXZ6fWe!?$pfim)TqE$UyBi|W_q zbQM=nyMZW+h=;?qRvK96a6Y(Aq&zO9mQA{XqgbabS~#UF<33b7iii9z`jvY6SPZ~D z07=o&&HeHLX@u^EF{k%x*IXfK<1_+nP7-}v-G1VcchELYT%z$uN||I?t_$~ zx%2Jm9K=^g*2f#!WS_Dr?)Kad3eFGMt_PDwgnRlKYN zp$ZLD%mPDH7luv#O+o!x61YH^1X0w-|ML5{lKTe2et!pMDNBx*YNKvlRFP??Mojs(tq5;zmGV; z4Mj~z3k|9MSbqQg6*nOy4@+B`)eSUrz63M`G1UM7_zK-dw9eRRG7<%2=q91I|y7+dNf(xGgB z`hUp&iwU1n7KDJEH4viv^Xrd~j6>KGsO`COT@SR0=^#Gk~48DlUN1*FZmLQ=DHeyHNr$^i62tE~-ExdYWfX z?!Sa6%QqEN{Xkt#sCde8{gZ2u==JdN!k4i0kZ@+hua2&&e?2dm!lYI_uCFB|ut4Sj z4E3I`a@tReY7Fpj***&AL5tp0G#knt2p}q!ouz(`P-?)M-v^+G7zU7Z6aY*su0%)a zDJGZ!ji8Y(u&~a)1+{|^oy&;v3?R`$UIFs1x2ToIhP8iGCh4RNqW~yiO4{&HlUp;BE*k>$dd^nP1kz%Fu7m=h3u*Gk0H;u=0+EN6fIP+k zxA=J^5jzY0zWWxyQT_mq{^)JGR5KqHXrv`7yxO+~(uZ?@z&>pGAj(ja5JHF`UvAUi zYJ?TYx>6%Vwe|0r_)DCid%LEKJ;}%q+9MnVDHP5L0szcYfB(y?!a%T5_C;HOKx)BR^~?3% zJa`HLao^&;f?ERW9VDU?ATh?^{WJrhD?*s(0Ip`KlN*eL&wQbh=>qfTB25snDvM>p zq(8C`*c9GS&kad%OPiod7a~M&IW}fTZ|=(gPC|R|YljonbRLi(dRDW0k^+&3$G>tYH_2ad zwm%gR8ndL~F3ojLvC8n0Fdt_yxdK6DFA1i!_@<;h^P~@Qv$qL=wB11f6_R{FITPp( z)`>%3iM}~+Uf(ivrEf-M^xe6gE={(^3UuQ{8@ zHSnDUNswi2eJ6H50%Vg z;MZ?;B;X=A29rZo&0j9eCq%_kh+WlJI?$EDWD#tMOcomN2)2C2X>Nw#H3n`J#$@S* zs?ZmGTUxZHI5_pT#Cq^d^RN{j$?``IU~9q^rMqroJV|cO2m-m$+17x0rP#T5IDD`| zSR2ox{wJkvuyb6*B3Js$CH)s~N!cMOUJolytlrN-G)9jr9I zdswUIeo+Bt9^;{Jp4`l@r;!0gcCj{Ue73lC5j1@04k!*lKA_aVSR_u6rsKVpXMgY~ zh2&uVs}n4Q#uZfI5c0w8M@Q&EU~K+}s)Dkxfpx8zf&UavqV~eAc7HMIr|(CJ`H2Rd z?f^G@p0Wr^K#G=Rzi6Ib7oV@VLC8Bv2en~jkQzuxOVJ|T%r1}0Bc3U%;Y8@G18udI ztyztDvvd-~acJ$#nTHAJ*9>lqD2^!Tt0G>{FZz$PSZ=mZM#|H-5h#3P6RFan1~9j) zR05hL*it#qdGsD{IiUg3Ci%j_Z6SF-O@Liua4*yHlkS1FcNmSuR*xtAJOVZjo+ksI zJ+M`FL>p;wQjskc;u9v8xb=kGkAd>wkGASATrMe_jM!cp9lUF!dw z3Q=UOFO5T9)3c?FwEsn;VH975)|JC3us!4oLqf;3= zxTuR#tng!TK7cw{s&xzX%@{WpKj$IPgekr@37ifUV>F13Yf_~$6@j2Gr4BhAwMput zLJPgz3axyZ+=NZ}_m1kVNg=6vE8b6XlO9qy#sEJflujLDdYyT)5&e+3`<8q=#0b7b zwUkN!k?J8A+|4D<)X>{2uR@h}@%`uPvy+{r!ItFo*Cqc>Dx7Wp_aZXD7EI#Al#^nd*>NG70(k|wx zcfT`Px(Af^KMSwxhByShc1@eQ075fa7tf-Z>zZ*37->6jSG(IwVM=kQ9mIz}o}H%* zb^>*#y{+xs$D8k8;3G0X!=?Xu{Ea>0QmjK!s)HfMm1;fWy{v%z)#8EadXN`0J0dwa zA42`m`%AQHL1;imO#_@SMgCd8xDvV$SJogE$#u>496&%2`k}>3u&-?2@HY7Z%qcrC z2YyIBrixkLkee4+Lc$mN1gp-))*7``klZFeY`TQusUP5=_S|S!W2}*QDJZ1^7r&Gt zpgU)bHLl&d^5NC%in~%L+E2iK@Ai&rtvj@r6GX6;Kh(VfFRpL}qt*0&F%5Ic7ta=` zdPSicEUQSxgXz%*)1)A|BIyxQv?m$!J(ZYYLF(&a&R2W)XSs`b)g9lHg(?@x&d7OW z0SO1B7eqV~ae-5aasNGzJ?Eeqh;{4QHSA=Atu&W0E)BCrCwb;%9!N_Pj)>z?4R@$Z zESV>)0QFa!vZ(Nc&}FRF5ofh$Q8m>i<^cZCK}g3c3&`jLH3_?$oVZ#n_4JIGRZpgT z@Fr+3^L()8WKx6NdZN7<#kl4pBCmIY?B2^ik-}vD463MAH=Du zAO+{RcmaYXSR+~=uDy#Oo^%@sdw)-$b$TuqJs0MxQv97m-R05>%=Z|~QtHw<>X0_h zj!+=re1p;JK9m#3jB*%nq&c+imAQURqI*K6DB?+b!K(+sye! zBJ_dt1E!wdIwNf!w1*@X14F->0SZ@|nMt00UoX(hhzhorh+LmL9ZYHXRx>tX3X1lr zSuaT?V!)A>2ts~hqGBe$|JQs5_x5sT2Pc14pCig{1XnSb{N-ri%K1`s$krmANM(!5 z)Q`4p!K-IPV{R}`_4cX+%_3Bp*y{Itq^|%@EwVJ98MX7dmxcGi;0aXbwMrX{58l<= zy6#f@a3&z+`ty~}(t(sj=GIFlommxBlODnTC^h3wosN}OCU`4ZqWY+p-}2h) zjFu`ruqdxxDd{k=cc)P)RPwvvorA~pQjHCoYeCggG^@J~N z8LV_Z>%!gScU#L9O5)5*QV~r*&RM+CSuL}$4?KWBJ7l@b75=_+NfZ3kFyUheXm^ z=x_3pBo;c_%wu-9ze>wCoKc)qM zv#`7rvljIGv$#R}c?{+uy-~S(SLfktf84TzRgmuR69D+fg^O^5Vf#PnVxEhm*M5&- z$(53Ve8C}>b+6xFtMfU4O>tFQ% zKA^$tKddVBDwzoO(a+*igZ7924Wtwt$zRK<0ep57Fe#8hxT(O9?(Wm~$Dk{j0n$@E z00bz7+^zm4ziv8UoDbGy;3@KLucKQXckcCa%7es@#(2&&z~++n>H1riN6LSx^=gk+ zw6~vdZ4AQx|5VlRmOvWC(}f>^Y`CuF2Qvm?DaHV9e^6XA5($<{72r+gdd6At_N6%# zXa>k=Vk~o>;%3sD3wd#z^kIPeuGiKc{_|GQq@S9dtnMawaPZv$_vZreg7CD&H|_Dv zA!ftJmHvZ)H^Q|4!;sM?@-IWinGDbsUIbtf?F>*r;6w5I`pWNCL05i{bN~NRWur*^ z|Ch=Jn;AaKo;3=DhI%h-?izkLNwKfHR0AHVK~}pPH1fHOz^H>H7^4w={KJXyT=XVu zEFLjP^Z~txSm{o8;r>TgLx3pZV?a=!mhKM$KhVK)N&(eOfcYW+yxV-V%IqvC2rEA9 zE~G+*Hqc*Bz~8hzasrWbQO*Dd|`sydH{4iS~FhItx#ZYouRl5qR$je`#o zeFJ^)yn?r1Udjcp004;eED;^m5P+>eQ}2Qqp*&;PuPzpzH3lhZT58YV(nX{K>69^u ziX(=i@oZ0}1IbJA-C(|Xl?|5fP#T%1^dVg6?&?7F0dZ73w)7y?EZTM6@9x6G%_-*MO5qk1j)Pr*eGIlrkrjpu zp9uiUDrA_#4iF8gtTVZ5+d#&Y2nIcvF3gc?b_7H@o!@BAG7eh(1CnW`tx15N0o5@5 za6c0Oh{Wdh!4^Txp*C@8@)w?i&4@Vn;!~{rqCP@6|f?S3eH0r+AZEAi?>j+Xn8ssJlBoSS1BlNPBaCI8liGh-YcTO;HqzN;nF~EEJ7C zf&7nNHp3eU^nm*$%j(^Jn(O2xcV=dT8D7wvla*BF0~gmlUxyFCdlCqc)Jvh^sOLgM zOePd<;YZNkA*YF`9<}~W;@4&<8}PU+Y4Jd*dnO;LGe~BrG}WaT zHZyrFAY5!>3ZW2)({%>D4fjo$^8z=8!oXHM5?(|?NFueV>_bK%Si^lOl8Q2BAsDrC z0*Psm#Z>@-XI2p}idbgDbFR5UlHTD$LVrV-H=WD@C5&hVNaLdkhT$#%c+x8=Cv;0) z+h`F!50K`$SuYls(#HkG045U)tzJSR9z3M`6Lymm#DeS~wt8{2kq6*$3+pZil0RvR z#%+qrQI;Pd=LMvv8xb{PORFgJ2;Ry3pduNsq0-z0T0!XwHeF5HkP4Pn5eY+Ug$=cZ zJ8fGl+x5D&zjT#j{tddT#UzSYI5hwk=4blMHYeGkD<)wYkh|4)!kP-l3i;D+Q{V-L zUb_T{c_1*!(T!B+;IcxbGCgB^b18p_N4_SgvmY)HL}MGDH6}E53RM>!Wlc~rz{v!- zP&$L9V*U?Yh=VfSf0WqZj;+5kXSgm-Ca!Y8>mQ094{c(xnf5^;#hOkU3?c#5yYkj# zYSVdT@YQYo0GI^G^=vjhL-s`_Nx*c`kpSAa>RrHD36s^!xb)=Py*@~VF-@m8BNp)aYaBWiM(Mn3gf>^^-_A&6@fd`{zr*)OaB;L+v00sy?Hp2H zEJOC1Gvk1s7h5BBgENxY_7^j)Bqnky>NXppuV46cJ-?2Y`;wUz8{E~WtxOxd$V;!A zc+cgIXT^pmvusBGzHE06d7Ww-9eudeb4vg#$$dq2gJOj-<7u90SOwlHUb?mO{oVpK zdehu5^M8k@_b}kRt!PsoQ6@dyz`G@y3K{qVsgP>ARxm$I{;HMIH`W2FVtlR0 z-TA@<~{XC5t7SMH$j-P zkw)mF5s&6mfi#Kuaz%(hFzjwVL9>zp1yZnqyLh4^CXx25MxobiCnORYq+zC&=bL3q z$F*hjB_tsgBr+yaC<KJ-Ep1z!j7iH4vj%2FEIBDUlsD}!G6ko4WQag21@G{L~(v6ghwWk|XYQWtEC z$^(mnqWnf;F1kAkR%l)AVMcF)SVc79WfVi}NYf{fct|DRPK63NgWwGIQ5)0hys&T? zWnu_oXeL4UEuDf^9<~WlZ4WXD@d!G{ z%R3p6s^@Sm;b4Q7p~hCHgjMR9JIh^@(VC^Nkj$ooEmb^Z9(kFG_1VKX)7WwygO`?o ztuRRv^u)8*z}U1mRg`@76=Qs=edx^f$0kvr?-+znk79xrrMhe4l?fkR4q{y8!I2$1 zQ|1akL?)QG`LupzQ0;Cf{}}z)pw~iPfDSNHYN~CfUPE6iXY0Lzw0)4|u%mla3Cg}; z-8dPOBsSs-cx~QweG3K)E`;WzH*FD$8N;}F;g}* zq0-1)Y)T}5^;8_s^E>xQ2H^#;SjCm>u6e4 zglDwA*=PuZI}kGt&lxKv;hJ10?SwTp$2@1E*I{4dTuhQ*MeLmKMLWEU%ZPffl+^6I z7o9@Lorn;w7TV_XW5vKHeNaLi#HI49a&U|de@N0i5Ck%K!quszRpu|WiE~ISp<7uP zqB)473$HWC)y#Y@iuK?R32tf6EX`2NH~EUNioOk>dy5Eer0^x|eU)S$X)cTL6X(E@ zF}N;(L2XJY3Mj&xUh&oX6iMUd@=yw+B$2}7e2XpLqrgYp;oI85;s)+0shPth9C0Ty z$29S?pNcg274r;^hc>3?4kqeJq`t9hrqgZjBI@RDUhBGyPR=4xs2Yyl1&BurLC^e_ zX$CNgKfCws&xGz~FYNB@9kpwZ@p}Y(+8?52s7VNR1g~7|rC~8Y^O!Z=7rCMSM1;$I zkMe?P@68kH9^SH#yFVM=GEJ--*^$>D`bMe-6^WHMOSh}&BD(3PQ1?j#LwW>EnuB|) z9xhsRKV1ptXm^ZY;nkM&fNQ6+0ga3v$VQB2+}O zzM+fdh!d*Whq0~3Y`$P!p=i9nG2OU%)F?(fl-#bCwzrdFFYyI-4<<7or||9CV)94+ zYJwZeTd|h+iiJiJQDdDn`nIw)SlY+(UuF%S5_RRqEik08dtBC4#j7FlBN;T(cp!x; zpC{=!6s9#g=i7bT(4X|;-)-0kYhBnrw@e&Ir+CKU^TUP*`yX~C2 zWA`(s(nn6xB*fN~`!|L-@i*fI45Y3ddR#rEBO$}HaLfN5WgMweu}=0 zv%Fsa(6tDzH`3Pi+62@e*u@A9?r@Qd(Cd9pA+g8FjiVK)X3V;gOYollipPxt@pkhp zSd0^kRlMn8`#V?ts;>)@F4u+;Mi_p)lK42W`vWh;dkNe^jaqrS)%0VW4iH(0%$bWx zv|i0&g#1_Tbj6pQo{1`XHZOH;FbsCpfDODOfP_iSX?n_j?%tcck0x218_g=6O`mTt z)sUR_rIc{9e_tCk-FAu$J9kG6IT;n<|6P!M;4>&-^(~6xuXa)OWEZO3KX>*V-nbHH zPDa}_U$;zqrY-vT9Cm>9v~a;r#+8P8Lwg)N5x&zWUbOpTqg#9GMo%aY?mN0sv#~GI zGw8zZah>S#eyNC<1(GTMQLE%f6*?mhn=#L7UpEC2NAh1lmNRc4c*sI!UMFKsmANQM zXY469P@?yo%U^jHz}yc}VmMMf8T)QkuQP2UGGc_LD${^JAfARFa25!?Px$>aYFsazUB z0$=sxo0k5^$zCS{H_VB1uu%qBXq-nt--!X*DMr1ApofOG)0YoC`^IqON;SzW`0mw19J;L;_ zqYTSnyyH?RmQ=H|3hqZlPz@ghg4{!0pwmAEFsXQ_2~cAkdg0Lks7FvP!cUq?(d{x1 z>;$JZUV$IjW=uhr$@AFI?F}fPE%NCr)r+yO`{@5`AcyF~CXNToY;P_Sk>9`7zwfpy zvVb+#EuHHA_^d@$9AkIC$2;+!*8R=eciw1^Tl5YQqYR)xbcVo`pOh!tZD7w1cu%T_ z^gl{_inojdiw?^`I!?h&h_3=UM0A0YkTb({15?M*2!N|6gHCagP!Pd81z-ulc`OfS z`yE6M&>(9GmH9hQbrWd07)LEgI;B;WO-Ky|O?8MM=2m{KK`3np%1Z!d_ceB-&o{ZN ze~VO^Lz1S)2RzfBKHAdHQ)awH1Sa4CC#9DAnFGb1RhHITiOH6wIs*>xyhhe1NLoiz zJ-XbEE*#Wc5jVcYp*-f>2PHH_3#td{2)hFOg%uJ890A7EEl@c`v-Za>orAn;cQmJfG-DS72>Eti5N3gKna9~k_M(gqH59>ltbVMMu14`D2I%Wu1nj8c1T8FaR7vv z7D)M32B5mra+h9Wb)?lqpE_BQsTog&2BadbR}!*L$7Ek!8=3+|a5I_fAe#b3(l z93v%%^jlg-@?EaZe<5Dh2TJ`hC%ZK&2>%$y3l@lP4H!uhs+-ikRfW48DRuy<_aG80|*)C?FpD3ERb#gARxoF zK#?0l9KcG!QPGb1Ef!Wjn%ccPdb8J_-D| z&|B!d@C69-_?Z!c{MunljA+IHfC94U3HY7jPzNy-pP&4!$K4n_n#E1-aNC2tf$FYS zE(N&v6<`XVcux41xLHcjVNlc2z#@wTt)@tisv&WoD8B7Z>_!(5YdXF=fvHs zh+9r92YrWVD6=K>JQy68F$5YrHQx5caqrkNe+s;R22faLYENFg!(zi>zo5rQoa1tj z{V3KGetrEs8~^HBD{_prtR0X{kZ#>nc;5q2Pw%587@sHDPB#;@r*UAMjOY!7;r zgYFVQ;7Je*W}F7-h}3h8@Uj;m2Dl*^VzKM5W zqRM*`#M6RsZ~%_k!yrPP3^NK&hw@Y%-hh^LCDO@YOg)H0VWtW94aQ6PjXtB3GFpAR69Cht3-CCd0N4rAr!A4T{0HhqV$yq`fixXyG1(-6iNZj$#sus| zY*3_)x6-P0xbKCYMq|+J-txUsCEoQYCh~jk`8KSU7sPdG1@8ZEom>=yW!9Ao6xNqO zWDPf1hvas_{8b<=Ce2gGsjVr&Y*w=-E&}U}eu~R6S@8oR194SPvV*f0q0HP0%bH&U z9m9$ZuhU)lw*1vB@Ui|E$Kp4T!f7q(e(v{)f%78SUZ*rhTe-g$2_;OqHSgL66w`gz z`U1p__w39-UO}pErifR-#boL8{|2gZg?)HvX&Njg5vU4`b9yNA0Deq>L2(%8IbfC@ z8z=c^jxW2A6t{Q3j#fn3R3OrSn&xyNBau}!dI~bgADm~Wxv0xDgK5DL78Gum)TztG z&NN!<70j0KT~2v*#$t}n7-ZB`DQ-a~8J}<4wfzGYvc!R!UpKmp$jeI{iiHRc`*`BL8e6pT5mS*PQY~MY|2JLR1-gj zuiL!aI|5MEm#|9GDekGpwCH&rExxG9Xm1bL)f}+3&G>0cI*TH{sO!kYqcn-~;(uvu zQx+RdA7G{^UV8kL7r7>kbDUBP2$lF98o!R@C;%;Ip0$l6E)u0&_vB~x>ZyHPID0@Q zwe<;phPUrnd`c(OKZ<<_yGBT9aR=Jpq>-h96Dsf}d>2+Ll;wjxI8D*VDJTEwS%JOq zndtTB0#`5dD?>e^BkixwVsW`Q*XgU~m6+!O9rPInH`hAs^sePDKZpxpfIg{#WjW!{ z-7;)+<^nMa@71A{7|kGDWOu7B-v-#DZtu=LYKB{GDo8Y^=Wgj_+K)#vQD@b4k3v#< z$;uSza4$=E3M(YQTRv0l+bw|&rcs~NiJ_Na9c zC$qgxPy$j&cULX@Yvp4QUu5)E>#d7Q5cP8+1ic^@cGy<`7%F{{o5&0! zR>3t{7gA7NpTe#mK%AlDN>^aVI_ztlUwh3mU^+3}kE}^wD%@0G+%F4y_)^t}h*zht z5+C4RskNx0w!9YQ)`Wt~AGT}isQ@dX1eIA@C^|_15$;o0;>I@3K_0oWF1Wf18DU8r z;`(yv{EQev5H~29p~mEG1l=mnP$>-H{MO?U5ei&)L#V7_>KeIu&;k5PGt-*>ppVp6 z7f5s$*JMv&MQBi(L+CAYq;6YJX&Ph`clO#FsYA52l{IrV{yu=tNKTi_4`g|nFH7%b zeW|TJHy~-rHL`?n^~hzXE8FztFn{3RFhdTYB|E#w+pUq@wf) z_<%9L?wn`>>ohs0-PYYFY1A2INYPwEJLd>b$p~= z%_;%P@35P>sS3sLt$3hZC|w3Lzkh0|Qt|66n)xt3=D!Tk+Q&1$%YE=gu54tRqs@d- z2T#W)I!(BIy{|BS5Xlhe`mwiA?~|T{YhtD6TI~$K(Yb3iGGR5s;3{@FQ^Zr7V`JIr zV8dQbxNyXm%VRaVbTG##12!b-#(>o~IV&61A+h~Dsk#T=Bxi>G*k%cHaf%4Bw<4cI zFJp}4GsNA`^7N9B7B`v|c^Fzy9tPti+jGtD|>NLr3Dh9lA znAcEBCHT*Xv7V{Cz3oHfL4S1|Qg(USSvHSHJj7g7{8k;HSlqO=co6a88(n>bIJ&o+49NtGU;eVzBUqH$Xn4K zoAtblSKIr6a<=58h(pH7(ZR1L{RIRhIy-|(6k|Ijc)|~EA(_j5;syU#aOauRe^rUe z(%X;?+Mm!k606Zy->%*P{vPsS?8fLlKSbe=%=wlC z4TVcAr7Cn4EbeW`SU-D!_TALWb0;hQkiYSu2+z8??lxvaMAlJgUt6@LhO!i#Tj+N4 zBlQw1QuXgH&V{VxO=+4-Ch0UNN~wrDs0{hR0@P-`ykAG9pIUE2YrJXY!K<_>}!W4Prpe2^B^aaW7>Hd%}Eq zs{_mzH1c;I*5_u7fbtf zT4@a$4t$03MymOESJpd6fmZ2R*7}`L`F-#k5r~=W2$In9WhHOsh>sr#WirZH~t2^pk1cNic#M(J=>+Qbl9;Te9IOTUVQBF)}d?fhC0-XHd9v_e|`Ib zFlC7*MqWrh7FHz!a&A3z$Af-*!#~U|Qzk%yr7P!r`rayxtowHf@(YpeC(q0sxJW(X zHDvpfL~aqH?d6cMe^TtZ19<6S)SK}C0z&@&In!Wzfwn|}t$@Wx&v5^W%|Nt2UPjgJ zF_(VHcEvw@&4I9C$U=CntJLh*-T9Y|+7je-T4U3={v===1}4al)URCpcMs%bjefvE zx7>4&>G$dW&ky9SfpNOO9_9Vh!^T43rS=8Q|9s+i>94ougYJxC^`tbWL>1w9bbA4_j?ns{jB1 literal 0 HcmV?d00001 diff --git a/docs/how-it-works.md b/docs/how-it-works.md new file mode 100644 index 000000000..3ea595bbb --- /dev/null +++ b/docs/how-it-works.md @@ -0,0 +1,51 @@ +# OpenTelemtry Go Instrumentation - How it works + +We aim to bring the automatic instrumentation experience found in languages like [Java](https://github.com/open-telemetry/opentelemetry-java-instrumentation), [Python](https://github.com/open-telemetry/opentelemetry-python-contrib) and [JavaScript](https://github.com/open-telemetry/opentelemetry-js-contrib) to Go applications. + +## Design Goals + +- No code changes required - any Go application can be instrumented without modifying the source code. +- Support wide range of Go applications - instrumentation is supported for Go version 1.12 and above. In addition, a common practice for Go applications is to shrink the binary size by stripping debug symbols via `go build -ldflags "-s -w"`. This instrumentation works for stripped binaries as well. +- Configuration is done via `OTEL_*` environment variables according to [OpenTelemetry Environment Variable Specification](https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/sdk-environment-variables.md#general-sdk-configuration) +- Instrumented libraries follow the [OpenTelemetry specification](https://github.com/open-telemetry/opentelemetry-specification) and semantic conventions to produce standard OpenTelemetry data. + +## Why eBPF + +Go is a compiled language. Unlike languages such as Java and Python, Go compiles natively to machine code. This makes it impossible to add additional code at runtime to instrument Go applications. +Fortunately, the Linux kernel provides a mechanism to attach user-defined code to the execution of a process. This is called [eBPF](https://ebpf.io/) and it is widely used in other Cloud Native projects such as Cilium and Falco. + +## Main Challenges and How We Overcome Them + +Using eBPF to instrument Go applications is non-trivial. In the following sections we will describe the main challenges and how we solved them. + +### Instrumentation Stability + +eBPF programs access user code and variables by analyzing the stack and the CPU registers. For example, to read the value of the `target` field in the `google.golang.org/grpc.ClientConn` struct (see gRPC instrumentor for an example), the eBPF program needs to know the offset of the field inside the struct. The offset is determined by the field location inside the struct definition. + +Hard coding this offset information into the eBPF programs creates a very unstable instrumentation. Fields locations inside structs are subject to change and the eBPF program needs to be recompiled every time the struct definition changes. +Luckily for us, there is a way to analyze the target binary and extract the required offsets, by using DWARF. The DWARF debug information is generated by the compiler and is stored inside the binary. + +Notice that one of our design goals is to support stripped Go binaries - meaning binaries that do not contain debug information. In order to support stripped binaries and to create a stable instrumentation, we created a library called [offsets-tracker](https://github.com/keyval-dev/offsets-tracker). This library tracks the offset of different fields across versions. + +We currently track instrumented structs inside the Go standard library and selected open source packages. This solution does not require DWARF information on the target binary and provides stability to instrumentations. Instrumentation authors can get a field location by name instead of hard coding a field offset. + +The offsets-tracker generates the [offset_results.json](https://github.com/open-telemetry/opentelemetry-go-instrumentation/blob/master/pkg/inject/offset_results.json) file. This file contains the offsets of the fields in the instrumented structs. + +### Uretprobes + +One of the basic requirments of OpenTelemetry spans is to contain start timestamp and end timestamp. Getting those timestamps is possible by placing an eBPF code at the start and the end of the instrumented function. eBPF supports this requirement via uprobes and uretprobes. Uretprobes are used to invoke eBPF code at the end of the function. Unfortunately, uretprobes and Go [do not play well together](https://github.com/golang/go/issues/22008). + +We overcome this issue by analyzing the target binary and detecting all the return statements in the instrumented functions. We then place a uprobe at the end of each return statement. This uprobe invokes the eBPF code that collects the end timestamp. + +### Timestamp tracking + +eBPF programs can access the current timestamp by calling `bpf_ktime_get_ns()`. The value returned by this function is fetched from the `CLOCK_MONOTONIC` clock and represents the number of nanoseconds since the system boot time. + +According to OpenTelemetry specification start time and end time should be timestamps and represent exact point in time. Converting from monotonic time to epoch timestamp is automatically handled by this library. Conversion is achieved by discovering the epoch boot time and adding it to the monotonic time collected by the eBPF program. + +### Support Go 1.17 and above + +Since version 1.17 and above, Go [changed the way it passes arguments to functions](https://go.googlesource.com/go/+/refs/heads/dev.regabi/src/cmd/compile/internal-abi.md#function-call-argument-and-result-passing). +Prior to version 1.17, Go placed arguments in the stack in the order they were defined in the function signature. Version 1.17 and above uses the machine registers to pass arguments. + +We overcome this by analyzing the target binary and detecting the compiled Go version. If the compiled Go version is 1.17 or above, we read arguments from the machine registers. If the compiled Go version is below 1.17, we read arguments from the stack. This should be transparent to the instrumentation authors and abstracted by a function named `get_argument()`. diff --git a/go.mod b/go.mod new file mode 100644 index 000000000..7de39bf66 --- /dev/null +++ b/go.mod @@ -0,0 +1,35 @@ +module github.com/open-telemetry/opentelemetry-go-instrumentation + +go 1.18 + +require ( + github.com/cilium/ebpf v0.8.0 + github.com/go-logr/logr v1.2.3 + github.com/go-logr/zapr v1.2.2 + github.com/hashicorp/go-version v1.4.0 + go.opentelemetry.io/otel v1.8.0 + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.8.0 + go.opentelemetry.io/otel/sdk v1.8.0 + go.opentelemetry.io/otel/trace v1.8.0 + go.uber.org/zap v1.20.0 + golang.org/x/arch v0.0.0-20210923205945-b76863e36670 + golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a + google.golang.org/grpc v1.46.2 +) + +require ( + github.com/cenkalti/backoff/v4 v4.1.3 // indirect + github.com/go-logr/stdr v1.2.2 // indirect + github.com/golang/protobuf v1.5.2 // indirect + github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 // indirect + github.com/prometheus/procfs v0.8.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.8.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.8.0 // indirect + go.opentelemetry.io/proto/otlp v0.18.0 // indirect + go.uber.org/atomic v1.7.0 // indirect + go.uber.org/multierr v1.6.0 // indirect + golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4 // indirect + golang.org/x/text v0.3.5 // indirect + google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1 // indirect + google.golang.org/protobuf v1.28.0 // indirect +) diff --git a/go.sum b/go.sum new file mode 100644 index 000000000..b22ec54ac --- /dev/null +++ b/go.sum @@ -0,0 +1,489 @@ +cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= +cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= +cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU= +cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU= +cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY= +cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc= +cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0= +cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To= +cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4= +cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M= +cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc= +cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk= +cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs= +cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc= +cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY= +cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o= +cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE= +cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc= +cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg= +cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc= +cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ= +cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE= +cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk= +cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I= +cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw= +cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA= +cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU= +cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw= +cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos= +cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk= +cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs= +cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0= +dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= +github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= +github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= +github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU= +github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY= +github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8= +github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA= +github.com/cenkalti/backoff/v4 v4.1.3 h1:cFAlzYUlVYDysBEH2T5hyJZMh3+5+WCBvSnK6Q8UtC4= +github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw= +github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= +github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc= +github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= +github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= +github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= +github.com/cilium/ebpf v0.8.0 h1:2V6KSg3FRADVU2BMIRemZ0hV+9OM+aAHhZDjQyjJTAs= +github.com/cilium/ebpf v0.8.0/go.mod h1:f5zLIM0FSNuAkSyLAN7X+Hy6yznlF1mNiWUMfxMtrgk= +github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= +github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc= +github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk= +github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI= +github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= +github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= +github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= +github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= +github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= +github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= +github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= +github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98= +github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk= +github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ= +github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0= +github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE= +github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= +github.com/frankban/quicktest v1.14.0 h1:+cqqvzZV87b4adx/5ayVOaYZ2CrvM4ejQvUdBzPPUss= +github.com/frankban/quicktest v1.14.0/go.mod h1:NeW+ay9A/U67EYXNFA1nPE8e/tnQv/09mUdL/ijj8og= +github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= +github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU= +github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= +github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= +github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= +github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0= +github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= +github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= +github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-logr/zapr v1.2.2 h1:5YNlIL6oZLydaV4dOFjL8YpgXF/tPeTbnpatnu3cq6o= +github.com/go-logr/zapr v1.2.2/go.mod h1:eIauM6P8qSvTw5o2ez6UEAfGjQKrxQTl5EoK+Qa2oG4= +github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= +github.com/golang/glog v1.0.0 h1:nfP3RFugxnNRyKgeWd4oI1nYvXpxrx8ck8ZrcizshdQ= +github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4= +github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= +github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= +github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= +github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= +github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= +github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y= +github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw= +github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw= +github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw= +github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4= +github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= +github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= +github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= +github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw= +github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw= +github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk= +github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= +github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA= +github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs= +github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w= +github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0= +github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8= +github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= +github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= +github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= +github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw= +github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= +github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= +github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M= +github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= +github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= +github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg= +github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs= +github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0= +github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc= +github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc= +github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= +github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= +github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= +github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= +github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= +github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= +github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg= +github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk= +github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 h1:BZHcxBETFHIdVyhyEfOvn/RdU/QGdLI4y34qQGjGWO0= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks= +github.com/hashicorp/go-version v1.4.0 h1:aAQzgqIrRKRa7w75CKpbBxYsmUoPjzVm1W59ca1L0J4= +github.com/hashicorp/go-version v1.4.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= +github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= +github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= +github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= +github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU= +github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk= +github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= +github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= +github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0= +github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk= +github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= +github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= +github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= +github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= +github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5mo= +github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4= +github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ= +github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= +github.com/rogpeppe/go-internal v1.6.1 h1:/FiVV8dS/e+YqF2JvO3yXRFbBLTIuSDkuC7aBOAvL+k= +github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc= +github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= +github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= +github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= +github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.7.1 h1:5TQK59W5E3v0r2duFAb7P95B6hEeOyEnHRa8MjYSMTY= +github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= +go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU= +go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8= +go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= +go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= +go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= +go.opentelemetry.io/otel v1.8.0 h1:zcvBFizPbpa1q7FehvFiHbQwGzmPILebO0tyqIR5Djg= +go.opentelemetry.io/otel v1.8.0/go.mod h1:2pkj+iMj0o03Y+cW6/m8Y4WkRdYN3AvCXCnzRMp9yvM= +go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.8.0 h1:ao8CJIShCaIbaMsGxy+jp2YHSudketpDgDRcbirov78= +go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.8.0/go.mod h1:78XhIg8Ht9vR4tbLNUhXsiOnE2HOuSeKAiAcoVQEpOY= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.8.0 h1:LrHL1A3KqIgAgi6mK7Q0aczmzU414AONAGT5xtnp+uo= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.8.0/go.mod h1:w8aZL87GMOvOBa2lU/JlVXE1q4chk/0FX+8ai4513bw= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.8.0 h1:00hCSGLIxdYK/Z7r8GkaX0QIlfvgU3tmnLlQvcnix6U= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.8.0/go.mod h1:twhIvtDQW2sWP1O2cT1N8nkSBgKCRZv2z6COTTBrf8Q= +go.opentelemetry.io/otel/sdk v1.8.0 h1:xwu69/fNuwbSHWe/0PGS888RmjWY181OmcXDQKu7ZQk= +go.opentelemetry.io/otel/sdk v1.8.0/go.mod h1:uPSfc+yfDH2StDM/Rm35WE8gXSNdvCg023J6HeGNO0c= +go.opentelemetry.io/otel/trace v1.8.0 h1:cSy0DF9eGI5WIfNwZ1q2iUyGj00tGzP24dE1lOlHrfY= +go.opentelemetry.io/otel/trace v1.8.0/go.mod h1:0Bt3PXY8w+3pheS3hQUt+wow8b1ojPaTBoTCh2zIFI4= +go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI= +go.opentelemetry.io/proto/otlp v0.18.0 h1:W5hyXNComRa23tGpKwG+FRAc4rfF6ZUg1JReK+QHS80= +go.opentelemetry.io/proto/otlp v0.18.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U= +go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw= +go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= +go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A= +go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ= +go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA= +go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4= +go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU= +go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI= +go.uber.org/zap v1.20.0 h1:N4oPlghZwYG55MlU6LXk/Zp00FVNE9X9wrYO8CEs4lc= +go.uber.org/zap v1.20.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw= +golang.org/x/arch v0.0.0-20210923205945-b76863e36670 h1:18EFjUmQOcUvxNYSkA6jO9VAiXCnxFY6NyDX0bHDmkU= +golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= +golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= +golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= +golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= +golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= +golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= +golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= +golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek= +golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY= +golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4= +golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4= +golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4= +golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM= +golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU= +golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= +golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= +golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= +golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU= +golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= +golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= +golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= +golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= +golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= +golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs= +golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= +golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= +golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE= +golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o= +golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc= +golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY= +golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= +golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= +golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= +golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= +golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= +golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= +golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4 h1:4nGaVu0QrbjT/AK2PRLuQfQuh6DJve+pELhqTdAj3x0= +golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= +golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= +golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= +golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= +golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= +golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= +golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= +golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34 h1:GkvMjFtXUmahfDtashnc1mnrCtuBVcwse5QV2lUk/tI= +golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a h1:dGzPydgVsqGcTRVwiLJ1jVbufYwmzD3LfVPLKsKg+0k= +golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= +golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.5 h1:i6eZZ+zk0SOf0xgBpEpPD18qWcJda6q1sxt3S0kzyUQ= +golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= +golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= +golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= +golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= +golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= +golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= +golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= +golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= +golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= +golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= +golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw= +golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw= +golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8= +golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= +golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= +golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= +golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= +golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= +golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= +golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= +golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE= +google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M= +google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg= +google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg= +google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI= +google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI= +google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI= +google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= +google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= +google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= +google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= +google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= +google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE= +google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE= +google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM= +google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc= +google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= +google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= +google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= +google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0= +google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= +google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= +google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= +google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= +google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= +google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= +google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= +google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc= +google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc= +google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8= +google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= +google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= +google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= +google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= +google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= +google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= +google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA= +google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U= +google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo= +google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA= +google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= +google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= +google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= +google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1 h1:b9mVrqYfq3P4bCdaLg1qtBnPzUYgglsIdjZkL/fQVOE= +google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc= +google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= +google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= +google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= +google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg= +google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY= +google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= +google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= +google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= +google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60= +google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= +google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= +google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= +google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0= +google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU= +google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34= +google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU= +google.golang.org/grpc v1.46.2 h1:u+MLGgVf7vRdjEYZ8wDFhAVNmhkbJ5hmrA1LMWK1CAQ= +google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk= +google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= +google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= +google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= +google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE= +google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo= +google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= +google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= +google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= +google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4= +google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c= +google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= +google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= +google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= +google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw= +google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI= +gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10= +gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo= +gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= +honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= +honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= +honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= +honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= +honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= +honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= +rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= +rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0= +rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= diff --git a/include/alloc.h b/include/alloc.h new file mode 100644 index 000000000..3fff24d8c --- /dev/null +++ b/include/alloc.h @@ -0,0 +1,99 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include "bpf_helpers.h" + +#define MAX_ENTRIES 50 + +// Injected in init +volatile const u32 total_cpus; +volatile const u64 start_addr; +volatile const u64 end_addr; + +struct +{ + __uint(type, BPF_MAP_TYPE_PERCPU_HASH); + __type(key, s32); + __type(value, u64); + __uint(max_entries, MAX_ENTRIES); + __uint(pinning, LIBBPF_PIN_BY_NAME); +} alloc_map SEC(".maps"); + +static __always_inline u64 get_area_start() +{ + s64 partition_size = (end_addr - start_addr) / total_cpus; + u32 current_cpu = bpf_get_smp_processor_id(); + s32 start_index = 0; + u64 *start = (u64 *)bpf_map_lookup_elem(&alloc_map, &start_index); + if (start == NULL || *start == 0) + { + u64 current_start_addr = start_addr + (partition_size * current_cpu); + bpf_map_update_elem(&alloc_map, &start_index, ¤t_start_addr, BPF_ANY); + return current_start_addr; + } + else + { + return *start; + } +} + +static __always_inline u64 get_area_end(u64 start) +{ + s64 partition_size = (end_addr - start_addr) / total_cpus; + s32 end_index = 1; + u64 *end = (u64 *)bpf_map_lookup_elem(&alloc_map, &end_index); + if (end == NULL || *end == 0) + { + u64 current_end_addr = start + partition_size; + bpf_map_update_elem(&alloc_map, &end_index, ¤t_end_addr, BPF_ANY); + return current_end_addr; + } + else + { + return *end; + } +} + +static __always_inline void *write_target_data(void *data, s32 size) +{ + if (!data || data == NULL) + { + return NULL; + } + + u64 start = get_area_start(); + u64 end = get_area_end(start); + if (end - start < size) + { + bpf_printk("reached end of CPU memory block, going to the start again"); + s32 start_index = 0; + bpf_map_delete_elem(&alloc_map, &start_index); + start = get_area_start(); + } + + void *target = (void *)start; + long success = bpf_probe_write_user(target, data, size); + if (success == 0) + { + s32 start_index = 0; + u64 updated_start = start + size; + bpf_map_update_elem(&alloc_map, &start_index, &updated_start, BPF_ANY); + return target; + } + else + { + bpf_printk("failed to write to userspace, error code: %d, addr: %lx, size: %d", success, target, size); + return NULL; + } +} diff --git a/include/arguments.h b/include/arguments.h new file mode 100644 index 000000000..5b4098956 --- /dev/null +++ b/include/arguments.h @@ -0,0 +1,64 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include "common.h" +#include "bpf_helpers.h" +#include + +// Injected in init +volatile const bool is_registers_abi; + +void *get_argument_by_reg(struct pt_regs *ctx, int index) +{ + switch (index) + { + case 1: + return (void *)(ctx->rax); + case 2: + return (void *)(ctx->rbx); + case 3: + return (void *)(ctx->rcx); + case 4: + return (void *)(ctx->rdi); + case 5: + return (void *)(ctx->rsi); + case 6: + return (void *)(ctx->r8); + case 7: + return (void *)(ctx->r9); + case 8: + return (void *)(ctx->r10); + case 9: + return (void *)(ctx->r11); + default: + return NULL; + } +} + +void *get_argument_by_stack(struct pt_regs *ctx, int index) +{ + void *ptr = 0; + bpf_probe_read(&ptr, sizeof(ptr), (void *)(ctx->rsp + (index * 8))); + return ptr; +} + +void *get_argument(struct pt_regs *ctx, int index) +{ + if (is_registers_abi) + { + return get_argument_by_reg(ctx, index); + } + + return get_argument_by_stack(ctx, index); +} diff --git a/include/common.h b/include/common.h new file mode 100644 index 000000000..7316a0459 --- /dev/null +++ b/include/common.h @@ -0,0 +1,124 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#define MAX_OS_THREADS 20 + +#ifndef __VMLINUX_H__ +#define __VMLINUX_H__ + +typedef unsigned char __u8; +typedef short int __s16; +typedef short unsigned int __u16; +typedef int __s32; +typedef unsigned int __u32; +typedef long long int __s64; +typedef long long unsigned int __u64; +typedef __u8 u8; +typedef __s16 s16; +typedef __u16 u16; +typedef __s32 s32; +typedef __u32 u32; +typedef __s64 s64; +typedef __u64 u64; +typedef __u16 __le16; +typedef __u16 __be16; +typedef __u32 __be32; +typedef __u64 __be64; +typedef __u32 __wsum; + +enum bpf_map_type +{ + BPF_MAP_TYPE_UNSPEC = 0, + BPF_MAP_TYPE_HASH = 1, + BPF_MAP_TYPE_ARRAY = 2, + BPF_MAP_TYPE_PROG_ARRAY = 3, + BPF_MAP_TYPE_PERF_EVENT_ARRAY = 4, + BPF_MAP_TYPE_PERCPU_HASH = 5, + BPF_MAP_TYPE_PERCPU_ARRAY = 6, + BPF_MAP_TYPE_STACK_TRACE = 7, + BPF_MAP_TYPE_CGROUP_ARRAY = 8, + BPF_MAP_TYPE_LRU_HASH = 9, + BPF_MAP_TYPE_LRU_PERCPU_HASH = 10, + BPF_MAP_TYPE_LPM_TRIE = 11, + BPF_MAP_TYPE_ARRAY_OF_MAPS = 12, + BPF_MAP_TYPE_HASH_OF_MAPS = 13, + BPF_MAP_TYPE_DEVMAP = 14, + BPF_MAP_TYPE_SOCKMAP = 15, + BPF_MAP_TYPE_CPUMAP = 16, + BPF_MAP_TYPE_XSKMAP = 17, + BPF_MAP_TYPE_SOCKHASH = 18, + BPF_MAP_TYPE_CGROUP_STORAGE = 19, + BPF_MAP_TYPE_REUSEPORT_SOCKARRAY = 20, + BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE = 21, + BPF_MAP_TYPE_QUEUE = 22, + BPF_MAP_TYPE_STACK = 23, + BPF_MAP_TYPE_SK_STORAGE = 24, + BPF_MAP_TYPE_DEVMAP_HASH = 25, + BPF_MAP_TYPE_STRUCT_OPS = 26, + BPF_MAP_TYPE_RINGBUF = 27, + BPF_MAP_TYPE_INODE_STORAGE = 28, +}; + +enum +{ + BPF_ANY = 0, + BPF_NOEXIST = 1, + BPF_EXIST = 2, + BPF_F_LOCK = 4, +}; + +/* BPF_FUNC_perf_event_output, BPF_FUNC_perf_event_read and + * BPF_FUNC_perf_event_read_value flags. + */ +#define BPF_F_INDEX_MASK 0xffffffffULL +#define BPF_F_CURRENT_CPU BPF_F_INDEX_MASK + +#define PT_REGS_RC(x) ((x)->rax) +struct pt_regs +{ + /* + * C ABI says these regs are callee-preserved. They aren't saved on kernel entry + * unless syscall needs a complete, fully filled "struct pt_regs". + */ + unsigned long r15; + unsigned long r14; + unsigned long r13; + unsigned long r12; + unsigned long rbp; + unsigned long rbx; + /* These regs are callee-clobbered. Always saved on kernel entry. */ + unsigned long r11; + unsigned long r10; + unsigned long r9; + unsigned long r8; + unsigned long rax; + unsigned long rcx; + unsigned long rdx; + unsigned long rsi; + unsigned long rdi; + /* + * On syscall entry, this is syscall#. On CPU exception, this is error code. + * On hw interrupt, it's IRQ number: + */ + unsigned long orig_rax; + /* Return frame for iretq */ + unsigned long rip; + unsigned long cs; + unsigned long eflags; + unsigned long rsp; + unsigned long ss; + /* top of stack page */ +}; + +#endif /* __VMLINUX_H__ */ diff --git a/include/go_context.h b/include/go_context.h new file mode 100644 index 000000000..027498722 --- /dev/null +++ b/include/go_context.h @@ -0,0 +1,37 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include "bpf_helpers.h" + +#define MAX_DISTANCE 10 + +static __always_inline void *find_context_in_map(void *ctx, void *context_map) +{ + void *data = ctx; + for (int i = 0; i < MAX_DISTANCE; i++) + { + void *found_in_map = bpf_map_lookup_elem(context_map, &data); + if (found_in_map != NULL) + { + return data; + } + + // We assume context.Context implementation containens Parent context.Context member + // Since the parent is also an interface, we need to read the data part of it + bpf_probe_read(&data, sizeof(data), data + 8); + } + + bpf_printk("context %lx not found in context map", ctx); + return NULL; +} diff --git a/include/go_types.h b/include/go_types.h new file mode 100644 index 000000000..622f9c626 --- /dev/null +++ b/include/go_types.h @@ -0,0 +1,99 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include "alloc.h" +#include "bpf_helpers.h" + +#define MAX_REALLOCATION 400 + +struct go_string +{ + char *str; + s32 len; +}; + +struct go_slice +{ + void *array; + s32 len; + s32 cap; +}; + +struct go_slice_user_ptr +{ + void *array; + void *len; + void *cap; +}; + +struct go_iface +{ + void *tab; + void *data; +}; + +static __always_inline struct go_string write_user_go_string(char *str, u32 len) +{ + // Copy chars to userspace + char *addr = write_target_data((void *)str, len); + + // Build string struct in kernel space + struct go_string new_string = {}; + new_string.str = addr; + new_string.len = len; + + // Copy new string struct to userspace + write_target_data((void *)&new_string, sizeof(new_string)); + return new_string; +} + +static __always_inline void append_item_to_slice(struct go_slice *slice, void *new_item, s32 item_size, struct go_slice_user_ptr *slice_user_ptr, void *buff) +{ + if (slice->len < slice->cap) + { + // Room available on current array + bpf_probe_write_user(slice->array + (item_size * slice->len), new_item, item_size); + } + else + { + // No room on current array - copy to new one of size item_size * (len + 1) + s32 alloc_size = item_size * slice->len; + s32 bounded_alloc_size = alloc_size > MAX_REALLOCATION ? MAX_REALLOCATION : (alloc_size < 1 ? 1 : alloc_size); + + // Get buffer + s32 index = 0; + void *map_buff = bpf_map_lookup_elem(buff, &index); + if (!map_buff) + { + return; + } + + // Append to buffer + bpf_probe_read_user(map_buff, bounded_alloc_size, slice->array); + bpf_probe_read(map_buff + bounded_alloc_size, item_size, new_item); + void *new_array = write_target_data(map_buff, bounded_alloc_size + item_size); + + // Update array + slice->array = new_array; + long success = bpf_probe_write_user(slice_user_ptr->array, &slice->array, sizeof(slice->array)); + + // Update cap + slice->cap++; + success = bpf_probe_write_user(slice_user_ptr->cap, &slice->cap, sizeof(slice->cap)); + } + + // Update len + slice->len++; + long success = bpf_probe_write_user(slice_user_ptr->len, &slice->len, sizeof(slice->len)); +} diff --git a/include/libbpf/LICENSE b/include/libbpf/LICENSE new file mode 100644 index 000000000..d38fed3cd --- /dev/null +++ b/include/libbpf/LICENSE @@ -0,0 +1 @@ +LGPL-2.1 OR BSD-2-Clause diff --git a/include/libbpf/LICENSE.BSD-2-Clause b/include/libbpf/LICENSE.BSD-2-Clause new file mode 100644 index 000000000..bce40aa98 --- /dev/null +++ b/include/libbpf/LICENSE.BSD-2-Clause @@ -0,0 +1,32 @@ +Valid-License-Identifier: BSD-2-Clause +SPDX-URL: https://spdx.org/licenses/BSD-2-Clause.html +Usage-Guide: + To use the BSD 2-clause "Simplified" License put the following SPDX + tag/value pair into a comment according to the placement guidelines in + the licensing rules documentation: + SPDX-License-Identifier: BSD-2-Clause +License-Text: + +Copyright (c) 2015 The Libbpf Authors. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE +LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. diff --git a/include/libbpf/LICENSE.LGPL-2.1 b/include/libbpf/LICENSE.LGPL-2.1 new file mode 100644 index 000000000..27bb4342a --- /dev/null +++ b/include/libbpf/LICENSE.LGPL-2.1 @@ -0,0 +1,503 @@ +Valid-License-Identifier: LGPL-2.1 +Valid-License-Identifier: LGPL-2.1+ +SPDX-URL: https://spdx.org/licenses/LGPL-2.1.html +Usage-Guide: + To use this license in source code, put one of the following SPDX + tag/value pairs into a comment according to the placement + guidelines in the licensing rules documentation. + For 'GNU Lesser General Public License (LGPL) version 2.1 only' use: + SPDX-License-Identifier: LGPL-2.1 + For 'GNU Lesser General Public License (LGPL) version 2.1 or any later + version' use: + SPDX-License-Identifier: LGPL-2.1+ +License-Text: + +GNU LESSER GENERAL PUBLIC LICENSE +Version 2.1, February 1999 + +Copyright (C) 1991, 1999 Free Software Foundation, Inc. +51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + +Everyone is permitted to copy and distribute verbatim copies of this +license document, but changing it is not allowed. + +[This is the first released version of the Lesser GPL. It also counts as +the successor of the GNU Library Public License, version 2, hence the +version number 2.1.] + +Preamble + +The licenses for most software are designed to take away your freedom to +share and change it. By contrast, the GNU General Public Licenses are +intended to guarantee your freedom to share and change free software--to +make sure the software is free for all its users. + +This license, the Lesser General Public License, applies to some specially +designated software packages--typically libraries--of the Free Software +Foundation and other authors who decide to use it. You can use it too, but +we suggest you first think carefully about whether this license or the +ordinary General Public License is the better strategy to use in any +particular case, based on the explanations below. + +When we speak of free software, we are referring to freedom of use, not +price. Our General Public Licenses are designed to make sure that you have +the freedom to distribute copies of free software (and charge for this +service if you wish); that you receive source code or can get it if you +want it; that you can change the software and use pieces of it in new free +programs; and that you are informed that you can do these things. + +To protect your rights, we need to make restrictions that forbid +distributors to deny you these rights or to ask you to surrender these +rights. These restrictions translate to certain responsibilities for you if +you distribute copies of the library or if you modify it. + +For example, if you distribute copies of the library, whether gratis or for +a fee, you must give the recipients all the rights that we gave you. You +must make sure that they, too, receive or can get the source code. If you +link other code with the library, you must provide complete object files to +the recipients, so that they can relink them with the library after making +changes to the library and recompiling it. And you must show them these +terms so they know their rights. + +We protect your rights with a two-step method: (1) we copyright the +library, and (2) we offer you this license, which gives you legal +permission to copy, distribute and/or modify the library. + +To protect each distributor, we want to make it very clear that there is no +warranty for the free library. Also, if the library is modified by someone +else and passed on, the recipients should know that what they have is not +the original version, so that the original author's reputation will not be +affected by problems that might be introduced by others. + +Finally, software patents pose a constant threat to the existence of any +free program. We wish to make sure that a company cannot effectively +restrict the users of a free program by obtaining a restrictive license +from a patent holder. Therefore, we insist that any patent license obtained +for a version of the library must be consistent with the full freedom of +use specified in this license. + +Most GNU software, including some libraries, is covered by the ordinary GNU +General Public License. This license, the GNU Lesser General Public +License, applies to certain designated libraries, and is quite different +from the ordinary General Public License. We use this license for certain +libraries in order to permit linking those libraries into non-free +programs. + +When a program is linked with a library, whether statically or using a +shared library, the combination of the two is legally speaking a combined +work, a derivative of the original library. The ordinary General Public +License therefore permits such linking only if the entire combination fits +its criteria of freedom. The Lesser General Public License permits more lax +criteria for linking other code with the library. + +We call this license the "Lesser" General Public License because it does +Less to protect the user's freedom than the ordinary General Public +License. It also provides other free software developers Less of an +advantage over competing non-free programs. These disadvantages are the +reason we use the ordinary General Public License for many +libraries. However, the Lesser license provides advantages in certain +special circumstances. + +For example, on rare occasions, there may be a special need to encourage +the widest possible use of a certain library, so that it becomes a de-facto +standard. To achieve this, non-free programs must be allowed to use the +library. A more frequent case is that a free library does the same job as +widely used non-free libraries. In this case, there is little to gain by +limiting the free library to free software only, so we use the Lesser +General Public License. + +In other cases, permission to use a particular library in non-free programs +enables a greater number of people to use a large body of free +software. For example, permission to use the GNU C Library in non-free +programs enables many more people to use the whole GNU operating system, as +well as its variant, the GNU/Linux operating system. + +Although the Lesser General Public License is Less protective of the users' +freedom, it does ensure that the user of a program that is linked with the +Library has the freedom and the wherewithal to run that program using a +modified version of the Library. + +The precise terms and conditions for copying, distribution and modification +follow. Pay close attention to the difference between a "work based on the +library" and a "work that uses the library". The former contains code +derived from the library, whereas the latter must be combined with the +library in order to run. + +TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + +0. This License Agreement applies to any software library or other program + which contains a notice placed by the copyright holder or other + authorized party saying it may be distributed under the terms of this + Lesser General Public License (also called "this License"). Each + licensee is addressed as "you". + + A "library" means a collection of software functions and/or data + prepared so as to be conveniently linked with application programs + (which use some of those functions and data) to form executables. + + The "Library", below, refers to any such software library or work which + has been distributed under these terms. A "work based on the Library" + means either the Library or any derivative work under copyright law: + that is to say, a work containing the Library or a portion of it, either + verbatim or with modifications and/or translated straightforwardly into + another language. (Hereinafter, translation is included without + limitation in the term "modification".) + + "Source code" for a work means the preferred form of the work for making + modifications to it. For a library, complete source code means all the + source code for all modules it contains, plus any associated interface + definition files, plus the scripts used to control compilation and + installation of the library. + + Activities other than copying, distribution and modification are not + covered by this License; they are outside its scope. The act of running + a program using the Library is not restricted, and output from such a + program is covered only if its contents constitute a work based on the + Library (independent of the use of the Library in a tool for writing + it). Whether that is true depends on what the Library does and what the + program that uses the Library does. + +1. You may copy and distribute verbatim copies of the Library's complete + source code as you receive it, in any medium, provided that you + conspicuously and appropriately publish on each copy an appropriate + copyright notice and disclaimer of warranty; keep intact all the notices + that refer to this License and to the absence of any warranty; and + distribute a copy of this License along with the Library. + + You may charge a fee for the physical act of transferring a copy, and + you may at your option offer warranty protection in exchange for a fee. + +2. You may modify your copy or copies of the Library or any portion of it, + thus forming a work based on the Library, and copy and distribute such + modifications or work under the terms of Section 1 above, provided that + you also meet all of these conditions: + + a) The modified work must itself be a software library. + + b) You must cause the files modified to carry prominent notices stating + that you changed the files and the date of any change. + + c) You must cause the whole of the work to be licensed at no charge to + all third parties under the terms of this License. + + d) If a facility in the modified Library refers to a function or a table + of data to be supplied by an application program that uses the + facility, other than as an argument passed when the facility is + invoked, then you must make a good faith effort to ensure that, in + the event an application does not supply such function or table, the + facility still operates, and performs whatever part of its purpose + remains meaningful. + + (For example, a function in a library to compute square roots has a + purpose that is entirely well-defined independent of the + application. Therefore, Subsection 2d requires that any + application-supplied function or table used by this function must be + optional: if the application does not supply it, the square root + function must still compute square roots.) + + These requirements apply to the modified work as a whole. If + identifiable sections of that work are not derived from the Library, and + can be reasonably considered independent and separate works in + themselves, then this License, and its terms, do not apply to those + sections when you distribute them as separate works. But when you + distribute the same sections as part of a whole which is a work based on + the Library, the distribution of the whole must be on the terms of this + License, whose permissions for other licensees extend to the entire + whole, and thus to each and every part regardless of who wrote it. + + Thus, it is not the intent of this section to claim rights or contest + your rights to work written entirely by you; rather, the intent is to + exercise the right to control the distribution of derivative or + collective works based on the Library. + + In addition, mere aggregation of another work not based on the Library + with the Library (or with a work based on the Library) on a volume of a + storage or distribution medium does not bring the other work under the + scope of this License. + +3. You may opt to apply the terms of the ordinary GNU General Public + License instead of this License to a given copy of the Library. To do + this, you must alter all the notices that refer to this License, so that + they refer to the ordinary GNU General Public License, version 2, + instead of to this License. (If a newer version than version 2 of the + ordinary GNU General Public License has appeared, then you can specify + that version instead if you wish.) Do not make any other change in these + notices. + + Once this change is made in a given copy, it is irreversible for that + copy, so the ordinary GNU General Public License applies to all + subsequent copies and derivative works made from that copy. + + This option is useful when you wish to copy part of the code of the + Library into a program that is not a library. + +4. You may copy and distribute the Library (or a portion or derivative of + it, under Section 2) in object code or executable form under the terms + of Sections 1 and 2 above provided that you accompany it with the + complete corresponding machine-readable source code, which must be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange. + + If distribution of object code is made by offering access to copy from a + designated place, then offering equivalent access to copy the source + code from the same place satisfies the requirement to distribute the + source code, even though third parties are not compelled to copy the + source along with the object code. + +5. A program that contains no derivative of any portion of the Library, but + is designed to work with the Library by being compiled or linked with + it, is called a "work that uses the Library". Such a work, in isolation, + is not a derivative work of the Library, and therefore falls outside the + scope of this License. + + However, linking a "work that uses the Library" with the Library creates + an executable that is a derivative of the Library (because it contains + portions of the Library), rather than a "work that uses the + library". The executable is therefore covered by this License. Section 6 + states terms for distribution of such executables. + + When a "work that uses the Library" uses material from a header file + that is part of the Library, the object code for the work may be a + derivative work of the Library even though the source code is + not. Whether this is true is especially significant if the work can be + linked without the Library, or if the work is itself a library. The + threshold for this to be true is not precisely defined by law. + + If such an object file uses only numerical parameters, data structure + layouts and accessors, and small macros and small inline functions (ten + lines or less in length), then the use of the object file is + unrestricted, regardless of whether it is legally a derivative + work. (Executables containing this object code plus portions of the + Library will still fall under Section 6.) + + Otherwise, if the work is a derivative of the Library, you may + distribute the object code for the work under the terms of Section + 6. Any executables containing that work also fall under Section 6, + whether or not they are linked directly with the Library itself. + +6. As an exception to the Sections above, you may also combine or link a + "work that uses the Library" with the Library to produce a work + containing portions of the Library, and distribute that work under terms + of your choice, provided that the terms permit modification of the work + for the customer's own use and reverse engineering for debugging such + modifications. + + You must give prominent notice with each copy of the work that the + Library is used in it and that the Library and its use are covered by + this License. You must supply a copy of this License. If the work during + execution displays copyright notices, you must include the copyright + notice for the Library among them, as well as a reference directing the + user to the copy of this License. Also, you must do one of these things: + + a) Accompany the work with the complete corresponding machine-readable + source code for the Library including whatever changes were used in + the work (which must be distributed under Sections 1 and 2 above); + and, if the work is an executable linked with the Library, with the + complete machine-readable "work that uses the Library", as object + code and/or source code, so that the user can modify the Library and + then relink to produce a modified executable containing the modified + Library. (It is understood that the user who changes the contents of + definitions files in the Library will not necessarily be able to + recompile the application to use the modified definitions.) + + b) Use a suitable shared library mechanism for linking with the + Library. A suitable mechanism is one that (1) uses at run time a copy + of the library already present on the user's computer system, rather + than copying library functions into the executable, and (2) will + operate properly with a modified version of the library, if the user + installs one, as long as the modified version is interface-compatible + with the version that the work was made with. + + c) Accompany the work with a written offer, valid for at least three + years, to give the same user the materials specified in Subsection + 6a, above, for a charge no more than the cost of performing this + distribution. + + d) If distribution of the work is made by offering access to copy from a + designated place, offer equivalent access to copy the above specified + materials from the same place. + + e) Verify that the user has already received a copy of these materials + or that you have already sent this user a copy. + + For an executable, the required form of the "work that uses the Library" + must include any data and utility programs needed for reproducing the + executable from it. However, as a special exception, the materials to be + distributed need not include anything that is normally distributed (in + either source or binary form) with the major components (compiler, + kernel, and so on) of the operating system on which the executable runs, + unless that component itself accompanies the executable. + + It may happen that this requirement contradicts the license restrictions + of other proprietary libraries that do not normally accompany the + operating system. Such a contradiction means you cannot use both them + and the Library together in an executable that you distribute. + +7. You may place library facilities that are a work based on the Library + side-by-side in a single library together with other library facilities + not covered by this License, and distribute such a combined library, + provided that the separate distribution of the work based on the Library + and of the other library facilities is otherwise permitted, and provided + that you do these two things: + + a) Accompany the combined library with a copy of the same work based on + the Library, uncombined with any other library facilities. This must + be distributed under the terms of the Sections above. + + b) Give prominent notice with the combined library of the fact that part + of it is a work based on the Library, and explaining where to find + the accompanying uncombined form of the same work. + +8. You may not copy, modify, sublicense, link with, or distribute the + Library except as expressly provided under this License. Any attempt + otherwise to copy, modify, sublicense, link with, or distribute the + Library is void, and will automatically terminate your rights under this + License. However, parties who have received copies, or rights, from you + under this License will not have their licenses terminated so long as + such parties remain in full compliance. + +9. You are not required to accept this License, since you have not signed + it. However, nothing else grants you permission to modify or distribute + the Library or its derivative works. These actions are prohibited by law + if you do not accept this License. Therefore, by modifying or + distributing the Library (or any work based on the Library), you + indicate your acceptance of this License to do so, and all its terms and + conditions for copying, distributing or modifying the Library or works + based on it. + +10. Each time you redistribute the Library (or any work based on the + Library), the recipient automatically receives a license from the + original licensor to copy, distribute, link with or modify the Library + subject to these terms and conditions. You may not impose any further + restrictions on the recipients' exercise of the rights granted + herein. You are not responsible for enforcing compliance by third + parties with this License. + +11. If, as a consequence of a court judgment or allegation of patent + infringement or for any other reason (not limited to patent issues), + conditions are imposed on you (whether by court order, agreement or + otherwise) that contradict the conditions of this License, they do not + excuse you from the conditions of this License. If you cannot + distribute so as to satisfy simultaneously your obligations under this + License and any other pertinent obligations, then as a consequence you + may not distribute the Library at all. For example, if a patent license + would not permit royalty-free redistribution of the Library by all + those who receive copies directly or indirectly through you, then the + only way you could satisfy both it and this License would be to refrain + entirely from distribution of the Library. + + If any portion of this section is held invalid or unenforceable under + any particular circumstance, the balance of the section is intended to + apply, and the section as a whole is intended to apply in other + circumstances. + + It is not the purpose of this section to induce you to infringe any + patents or other property right claims or to contest validity of any + such claims; this section has the sole purpose of protecting the + integrity of the free software distribution system which is implemented + by public license practices. Many people have made generous + contributions to the wide range of software distributed through that + system in reliance on consistent application of that system; it is up + to the author/donor to decide if he or she is willing to distribute + software through any other system and a licensee cannot impose that + choice. + + This section is intended to make thoroughly clear what is believed to + be a consequence of the rest of this License. + +12. If the distribution and/or use of the Library is restricted in certain + countries either by patents or by copyrighted interfaces, the original + copyright holder who places the Library under this License may add an + explicit geographical distribution limitation excluding those + countries, so that distribution is permitted only in or among countries + not thus excluded. In such case, this License incorporates the + limitation as if written in the body of this License. + +13. The Free Software Foundation may publish revised and/or new versions of + the Lesser General Public License from time to time. Such new versions + will be similar in spirit to the present version, but may differ in + detail to address new problems or concerns. + + Each version is given a distinguishing version number. If the Library + specifies a version number of this License which applies to it and "any + later version", you have the option of following the terms and + conditions either of that version or of any later version published by + the Free Software Foundation. If the Library does not specify a license + version number, you may choose any version ever published by the Free + Software Foundation. + +14. If you wish to incorporate parts of the Library into other free + programs whose distribution conditions are incompatible with these, + write to the author to ask for permission. For software which is + copyrighted by the Free Software Foundation, write to the Free Software + Foundation; we sometimes make exceptions for this. Our decision will be + guided by the two goals of preserving the free status of all + derivatives of our free software and of promoting the sharing and reuse + of software generally. + +NO WARRANTY + +15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY + FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN + OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES + PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER + EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE + ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH + YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL + NECESSARY SERVICING, REPAIR OR CORRECTION. + +16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING + WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR + REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR + DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL + DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY + (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED + INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF + THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR + OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. + +END OF TERMS AND CONDITIONS + +How to Apply These Terms to Your New Libraries + +If you develop a new library, and you want it to be of the greatest +possible use to the public, we recommend making it free software that +everyone can redistribute and change. You can do so by permitting +redistribution under these terms (or, alternatively, under the terms of the +ordinary General Public License). + +To apply these terms, attach the following notices to the library. It is +safest to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least the +"copyright" line and a pointer to where the full notice is found. + +one line to give the library's name and an idea of what it does. +Copyright (C) year name of author + +This library is free software; you can redistribute it and/or modify it +under the terms of the GNU Lesser General Public License as published by +the Free Software Foundation; either version 2.1 of the License, or (at +your option) any later version. + +This library is distributed in the hope that it will be useful, but WITHOUT +ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License +for more details. + +You should have received a copy of the GNU Lesser General Public License +along with this library; if not, write to the Free Software Foundation, +Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Also add +information on how to contact you by electronic and paper mail. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the library, if +necessary. Here is a sample; alter the names: + +Yoyodyne, Inc., hereby disclaims all copyright interest in +the library `Frob' (a library for tweaking knobs) written +by James Random Hacker. + +signature of Ty Coon, 1 April 1990 +Ty Coon, President of Vice +That's all there is to it! diff --git a/include/libbpf/bpf.h b/include/libbpf/bpf.h new file mode 100644 index 000000000..6fffb3cdf --- /dev/null +++ b/include/libbpf/bpf.h @@ -0,0 +1,293 @@ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ + +/* + * common eBPF ELF operations. + * + * Copyright (C) 2013-2015 Alexei Starovoitov + * Copyright (C) 2015 Wang Nan + * Copyright (C) 2015 Huawei Inc. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; + * version 2.1 of the License (not later!) + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this program; if not, see + */ +#ifndef __LIBBPF_BPF_H +#define __LIBBPF_BPF_H + +#include +#include +#include +#include + +#include "libbpf_common.h" + +#ifdef __cplusplus +extern "C" { +#endif + +struct bpf_create_map_attr { + const char *name; + enum bpf_map_type map_type; + __u32 map_flags; + __u32 key_size; + __u32 value_size; + __u32 max_entries; + __u32 numa_node; + __u32 btf_fd; + __u32 btf_key_type_id; + __u32 btf_value_type_id; + __u32 map_ifindex; + union { + __u32 inner_map_fd; + __u32 btf_vmlinux_value_type_id; + }; +}; + +LIBBPF_API int +bpf_create_map_xattr(const struct bpf_create_map_attr *create_attr); +LIBBPF_API int bpf_create_map_node(enum bpf_map_type map_type, const char *name, + int key_size, int value_size, + int max_entries, __u32 map_flags, int node); +LIBBPF_API int bpf_create_map_name(enum bpf_map_type map_type, const char *name, + int key_size, int value_size, + int max_entries, __u32 map_flags); +LIBBPF_API int bpf_create_map(enum bpf_map_type map_type, int key_size, + int value_size, int max_entries, __u32 map_flags); +LIBBPF_API int bpf_create_map_in_map_node(enum bpf_map_type map_type, + const char *name, int key_size, + int inner_map_fd, int max_entries, + __u32 map_flags, int node); +LIBBPF_API int bpf_create_map_in_map(enum bpf_map_type map_type, + const char *name, int key_size, + int inner_map_fd, int max_entries, + __u32 map_flags); + +struct bpf_load_program_attr { + enum bpf_prog_type prog_type; + enum bpf_attach_type expected_attach_type; + const char *name; + const struct bpf_insn *insns; + size_t insns_cnt; + const char *license; + union { + __u32 kern_version; + __u32 attach_prog_fd; + }; + union { + __u32 prog_ifindex; + __u32 attach_btf_id; + }; + __u32 prog_btf_fd; + __u32 func_info_rec_size; + const void *func_info; + __u32 func_info_cnt; + __u32 line_info_rec_size; + const void *line_info; + __u32 line_info_cnt; + __u32 log_level; + __u32 prog_flags; +}; + +/* Flags to direct loading requirements */ +#define MAPS_RELAX_COMPAT 0x01 + +/* Recommend log buffer size */ +#define BPF_LOG_BUF_SIZE (UINT32_MAX >> 8) /* verifier maximum in kernels <= 5.1 */ +LIBBPF_API int +bpf_load_program_xattr(const struct bpf_load_program_attr *load_attr, + char *log_buf, size_t log_buf_sz); +LIBBPF_API int bpf_load_program(enum bpf_prog_type type, + const struct bpf_insn *insns, size_t insns_cnt, + const char *license, __u32 kern_version, + char *log_buf, size_t log_buf_sz); +LIBBPF_API int bpf_verify_program(enum bpf_prog_type type, + const struct bpf_insn *insns, + size_t insns_cnt, __u32 prog_flags, + const char *license, __u32 kern_version, + char *log_buf, size_t log_buf_sz, + int log_level); + +LIBBPF_API int bpf_map_update_elem(int fd, const void *key, const void *value, + __u64 flags); + +LIBBPF_API int bpf_map_lookup_elem(int fd, const void *key, void *value); +LIBBPF_API int bpf_map_lookup_elem_flags(int fd, const void *key, void *value, + __u64 flags); +LIBBPF_API int bpf_map_lookup_and_delete_elem(int fd, const void *key, + void *value); +LIBBPF_API int bpf_map_lookup_and_delete_elem_flags(int fd, const void *key, + void *value, __u64 flags); +LIBBPF_API int bpf_map_delete_elem(int fd, const void *key); +LIBBPF_API int bpf_map_get_next_key(int fd, const void *key, void *next_key); +LIBBPF_API int bpf_map_freeze(int fd); + +struct bpf_map_batch_opts { + size_t sz; /* size of this struct for forward/backward compatibility */ + __u64 elem_flags; + __u64 flags; +}; +#define bpf_map_batch_opts__last_field flags + +LIBBPF_API int bpf_map_delete_batch(int fd, void *keys, + __u32 *count, + const struct bpf_map_batch_opts *opts); +LIBBPF_API int bpf_map_lookup_batch(int fd, void *in_batch, void *out_batch, + void *keys, void *values, __u32 *count, + const struct bpf_map_batch_opts *opts); +LIBBPF_API int bpf_map_lookup_and_delete_batch(int fd, void *in_batch, + void *out_batch, void *keys, + void *values, __u32 *count, + const struct bpf_map_batch_opts *opts); +LIBBPF_API int bpf_map_update_batch(int fd, void *keys, void *values, + __u32 *count, + const struct bpf_map_batch_opts *opts); + +LIBBPF_API int bpf_obj_pin(int fd, const char *pathname); +LIBBPF_API int bpf_obj_get(const char *pathname); + +struct bpf_prog_attach_opts { + size_t sz; /* size of this struct for forward/backward compatibility */ + unsigned int flags; + int replace_prog_fd; +}; +#define bpf_prog_attach_opts__last_field replace_prog_fd + +LIBBPF_API int bpf_prog_attach(int prog_fd, int attachable_fd, + enum bpf_attach_type type, unsigned int flags); +LIBBPF_API int bpf_prog_attach_xattr(int prog_fd, int attachable_fd, + enum bpf_attach_type type, + const struct bpf_prog_attach_opts *opts); +LIBBPF_API int bpf_prog_detach(int attachable_fd, enum bpf_attach_type type); +LIBBPF_API int bpf_prog_detach2(int prog_fd, int attachable_fd, + enum bpf_attach_type type); + +union bpf_iter_link_info; /* defined in up-to-date linux/bpf.h */ +struct bpf_link_create_opts { + size_t sz; /* size of this struct for forward/backward compatibility */ + __u32 flags; + union bpf_iter_link_info *iter_info; + __u32 iter_info_len; + __u32 target_btf_id; + union { + struct { + __u64 bpf_cookie; + } perf_event; + }; + size_t :0; +}; +#define bpf_link_create_opts__last_field perf_event + +LIBBPF_API int bpf_link_create(int prog_fd, int target_fd, + enum bpf_attach_type attach_type, + const struct bpf_link_create_opts *opts); + +LIBBPF_API int bpf_link_detach(int link_fd); + +struct bpf_link_update_opts { + size_t sz; /* size of this struct for forward/backward compatibility */ + __u32 flags; /* extra flags */ + __u32 old_prog_fd; /* expected old program FD */ +}; +#define bpf_link_update_opts__last_field old_prog_fd + +LIBBPF_API int bpf_link_update(int link_fd, int new_prog_fd, + const struct bpf_link_update_opts *opts); + +LIBBPF_API int bpf_iter_create(int link_fd); + +struct bpf_prog_test_run_attr { + int prog_fd; + int repeat; + const void *data_in; + __u32 data_size_in; + void *data_out; /* optional */ + __u32 data_size_out; /* in: max length of data_out + * out: length of data_out */ + __u32 retval; /* out: return code of the BPF program */ + __u32 duration; /* out: average per repetition in ns */ + const void *ctx_in; /* optional */ + __u32 ctx_size_in; + void *ctx_out; /* optional */ + __u32 ctx_size_out; /* in: max length of ctx_out + * out: length of cxt_out */ +}; + +LIBBPF_API int bpf_prog_test_run_xattr(struct bpf_prog_test_run_attr *test_attr); + +/* + * bpf_prog_test_run does not check that data_out is large enough. Consider + * using bpf_prog_test_run_xattr instead. + */ +LIBBPF_API int bpf_prog_test_run(int prog_fd, int repeat, void *data, + __u32 size, void *data_out, __u32 *size_out, + __u32 *retval, __u32 *duration); +LIBBPF_API int bpf_prog_get_next_id(__u32 start_id, __u32 *next_id); +LIBBPF_API int bpf_map_get_next_id(__u32 start_id, __u32 *next_id); +LIBBPF_API int bpf_btf_get_next_id(__u32 start_id, __u32 *next_id); +LIBBPF_API int bpf_link_get_next_id(__u32 start_id, __u32 *next_id); +LIBBPF_API int bpf_prog_get_fd_by_id(__u32 id); +LIBBPF_API int bpf_map_get_fd_by_id(__u32 id); +LIBBPF_API int bpf_btf_get_fd_by_id(__u32 id); +LIBBPF_API int bpf_link_get_fd_by_id(__u32 id); +LIBBPF_API int bpf_obj_get_info_by_fd(int bpf_fd, void *info, __u32 *info_len); +LIBBPF_API int bpf_prog_query(int target_fd, enum bpf_attach_type type, + __u32 query_flags, __u32 *attach_flags, + __u32 *prog_ids, __u32 *prog_cnt); +LIBBPF_API int bpf_raw_tracepoint_open(const char *name, int prog_fd); +LIBBPF_API int bpf_load_btf(const void *btf, __u32 btf_size, char *log_buf, + __u32 log_buf_size, bool do_log); +LIBBPF_API int bpf_task_fd_query(int pid, int fd, __u32 flags, char *buf, + __u32 *buf_len, __u32 *prog_id, __u32 *fd_type, + __u64 *probe_offset, __u64 *probe_addr); + +enum bpf_stats_type; /* defined in up-to-date linux/bpf.h */ +LIBBPF_API int bpf_enable_stats(enum bpf_stats_type type); + +struct bpf_prog_bind_opts { + size_t sz; /* size of this struct for forward/backward compatibility */ + __u32 flags; +}; +#define bpf_prog_bind_opts__last_field flags + +LIBBPF_API int bpf_prog_bind_map(int prog_fd, int map_fd, + const struct bpf_prog_bind_opts *opts); + +struct bpf_test_run_opts { + size_t sz; /* size of this struct for forward/backward compatibility */ + const void *data_in; /* optional */ + void *data_out; /* optional */ + __u32 data_size_in; + __u32 data_size_out; /* in: max length of data_out + * out: length of data_out + */ + const void *ctx_in; /* optional */ + void *ctx_out; /* optional */ + __u32 ctx_size_in; + __u32 ctx_size_out; /* in: max length of ctx_out + * out: length of cxt_out + */ + __u32 retval; /* out: return code of the BPF program */ + int repeat; + __u32 duration; /* out: average per repetition in ns */ + __u32 flags; + __u32 cpu; +}; +#define bpf_test_run_opts__last_field cpu + +LIBBPF_API int bpf_prog_test_run_opts(int prog_fd, + struct bpf_test_run_opts *opts); + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif /* __LIBBPF_BPF_H */ diff --git a/include/libbpf/bpf_core_read.h b/include/libbpf/bpf_core_read.h new file mode 100644 index 000000000..09ebe3db5 --- /dev/null +++ b/include/libbpf/bpf_core_read.h @@ -0,0 +1,444 @@ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ +#ifndef __BPF_CORE_READ_H__ +#define __BPF_CORE_READ_H__ + +/* + * enum bpf_field_info_kind is passed as a second argument into + * __builtin_preserve_field_info() built-in to get a specific aspect of + * a field, captured as a first argument. __builtin_preserve_field_info(field, + * info_kind) returns __u32 integer and produces BTF field relocation, which + * is understood and processed by libbpf during BPF object loading. See + * selftests/bpf for examples. + */ +enum bpf_field_info_kind { + BPF_FIELD_BYTE_OFFSET = 0, /* field byte offset */ + BPF_FIELD_BYTE_SIZE = 1, + BPF_FIELD_EXISTS = 2, /* field existence in target kernel */ + BPF_FIELD_SIGNED = 3, + BPF_FIELD_LSHIFT_U64 = 4, + BPF_FIELD_RSHIFT_U64 = 5, +}; + +/* second argument to __builtin_btf_type_id() built-in */ +enum bpf_type_id_kind { + BPF_TYPE_ID_LOCAL = 0, /* BTF type ID in local program */ + BPF_TYPE_ID_TARGET = 1, /* BTF type ID in target kernel */ +}; + +/* second argument to __builtin_preserve_type_info() built-in */ +enum bpf_type_info_kind { + BPF_TYPE_EXISTS = 0, /* type existence in target kernel */ + BPF_TYPE_SIZE = 1, /* type size in target kernel */ +}; + +/* second argument to __builtin_preserve_enum_value() built-in */ +enum bpf_enum_value_kind { + BPF_ENUMVAL_EXISTS = 0, /* enum value existence in kernel */ + BPF_ENUMVAL_VALUE = 1, /* enum value value relocation */ +}; + +#define __CORE_RELO(src, field, info) \ + __builtin_preserve_field_info((src)->field, BPF_FIELD_##info) + +#if __BYTE_ORDER == __LITTLE_ENDIAN +#define __CORE_BITFIELD_PROBE_READ(dst, src, fld) \ + bpf_probe_read_kernel( \ + (void *)dst, \ + __CORE_RELO(src, fld, BYTE_SIZE), \ + (const void *)src + __CORE_RELO(src, fld, BYTE_OFFSET)) +#else +/* semantics of LSHIFT_64 assumes loading values into low-ordered bytes, so + * for big-endian we need to adjust destination pointer accordingly, based on + * field byte size + */ +#define __CORE_BITFIELD_PROBE_READ(dst, src, fld) \ + bpf_probe_read_kernel( \ + (void *)dst + (8 - __CORE_RELO(src, fld, BYTE_SIZE)), \ + __CORE_RELO(src, fld, BYTE_SIZE), \ + (const void *)src + __CORE_RELO(src, fld, BYTE_OFFSET)) +#endif + +/* + * Extract bitfield, identified by s->field, and return its value as u64. + * All this is done in relocatable manner, so bitfield changes such as + * signedness, bit size, offset changes, this will be handled automatically. + * This version of macro is using bpf_probe_read_kernel() to read underlying + * integer storage. Macro functions as an expression and its return type is + * bpf_probe_read_kernel()'s return value: 0, on success, <0 on error. + */ +#define BPF_CORE_READ_BITFIELD_PROBED(s, field) ({ \ + unsigned long long val = 0; \ + \ + __CORE_BITFIELD_PROBE_READ(&val, s, field); \ + val <<= __CORE_RELO(s, field, LSHIFT_U64); \ + if (__CORE_RELO(s, field, SIGNED)) \ + val = ((long long)val) >> __CORE_RELO(s, field, RSHIFT_U64); \ + else \ + val = val >> __CORE_RELO(s, field, RSHIFT_U64); \ + val; \ +}) + +/* + * Extract bitfield, identified by s->field, and return its value as u64. + * This version of macro is using direct memory reads and should be used from + * BPF program types that support such functionality (e.g., typed raw + * tracepoints). + */ +#define BPF_CORE_READ_BITFIELD(s, field) ({ \ + const void *p = (const void *)s + __CORE_RELO(s, field, BYTE_OFFSET); \ + unsigned long long val; \ + \ + /* This is a so-called barrier_var() operation that makes specified \ + * variable "a black box" for optimizing compiler. \ + * It forces compiler to perform BYTE_OFFSET relocation on p and use \ + * its calculated value in the switch below, instead of applying \ + * the same relocation 4 times for each individual memory load. \ + */ \ + asm volatile("" : "=r"(p) : "0"(p)); \ + \ + switch (__CORE_RELO(s, field, BYTE_SIZE)) { \ + case 1: val = *(const unsigned char *)p; break; \ + case 2: val = *(const unsigned short *)p; break; \ + case 4: val = *(const unsigned int *)p; break; \ + case 8: val = *(const unsigned long long *)p; break; \ + } \ + val <<= __CORE_RELO(s, field, LSHIFT_U64); \ + if (__CORE_RELO(s, field, SIGNED)) \ + val = ((long long)val) >> __CORE_RELO(s, field, RSHIFT_U64); \ + else \ + val = val >> __CORE_RELO(s, field, RSHIFT_U64); \ + val; \ +}) + +/* + * Convenience macro to check that field actually exists in target kernel's. + * Returns: + * 1, if matching field is present in target kernel; + * 0, if no matching field found. + */ +#define bpf_core_field_exists(field) \ + __builtin_preserve_field_info(field, BPF_FIELD_EXISTS) + +/* + * Convenience macro to get the byte size of a field. Works for integers, + * struct/unions, pointers, arrays, and enums. + */ +#define bpf_core_field_size(field) \ + __builtin_preserve_field_info(field, BPF_FIELD_BYTE_SIZE) + +/* + * Convenience macro to get BTF type ID of a specified type, using a local BTF + * information. Return 32-bit unsigned integer with type ID from program's own + * BTF. Always succeeds. + */ +#define bpf_core_type_id_local(type) \ + __builtin_btf_type_id(*(typeof(type) *)0, BPF_TYPE_ID_LOCAL) + +/* + * Convenience macro to get BTF type ID of a target kernel's type that matches + * specified local type. + * Returns: + * - valid 32-bit unsigned type ID in kernel BTF; + * - 0, if no matching type was found in a target kernel BTF. + */ +#define bpf_core_type_id_kernel(type) \ + __builtin_btf_type_id(*(typeof(type) *)0, BPF_TYPE_ID_TARGET) + +/* + * Convenience macro to check that provided named type + * (struct/union/enum/typedef) exists in a target kernel. + * Returns: + * 1, if such type is present in target kernel's BTF; + * 0, if no matching type is found. + */ +#define bpf_core_type_exists(type) \ + __builtin_preserve_type_info(*(typeof(type) *)0, BPF_TYPE_EXISTS) + +/* + * Convenience macro to get the byte size of a provided named type + * (struct/union/enum/typedef) in a target kernel. + * Returns: + * >= 0 size (in bytes), if type is present in target kernel's BTF; + * 0, if no matching type is found. + */ +#define bpf_core_type_size(type) \ + __builtin_preserve_type_info(*(typeof(type) *)0, BPF_TYPE_SIZE) + +/* + * Convenience macro to check that provided enumerator value is defined in + * a target kernel. + * Returns: + * 1, if specified enum type and its enumerator value are present in target + * kernel's BTF; + * 0, if no matching enum and/or enum value within that enum is found. + */ +#define bpf_core_enum_value_exists(enum_type, enum_value) \ + __builtin_preserve_enum_value(*(typeof(enum_type) *)enum_value, BPF_ENUMVAL_EXISTS) + +/* + * Convenience macro to get the integer value of an enumerator value in + * a target kernel. + * Returns: + * 64-bit value, if specified enum type and its enumerator value are + * present in target kernel's BTF; + * 0, if no matching enum and/or enum value within that enum is found. + */ +#define bpf_core_enum_value(enum_type, enum_value) \ + __builtin_preserve_enum_value(*(typeof(enum_type) *)enum_value, BPF_ENUMVAL_VALUE) + +/* + * bpf_core_read() abstracts away bpf_probe_read_kernel() call and captures + * offset relocation for source address using __builtin_preserve_access_index() + * built-in, provided by Clang. + * + * __builtin_preserve_access_index() takes as an argument an expression of + * taking an address of a field within struct/union. It makes compiler emit + * a relocation, which records BTF type ID describing root struct/union and an + * accessor string which describes exact embedded field that was used to take + * an address. See detailed description of this relocation format and + * semantics in comments to struct bpf_field_reloc in libbpf_internal.h. + * + * This relocation allows libbpf to adjust BPF instruction to use correct + * actual field offset, based on target kernel BTF type that matches original + * (local) BTF, used to record relocation. + */ +#define bpf_core_read(dst, sz, src) \ + bpf_probe_read_kernel(dst, sz, (const void *)__builtin_preserve_access_index(src)) + +/* NOTE: see comments for BPF_CORE_READ_USER() about the proper types use. */ +#define bpf_core_read_user(dst, sz, src) \ + bpf_probe_read_user(dst, sz, (const void *)__builtin_preserve_access_index(src)) +/* + * bpf_core_read_str() is a thin wrapper around bpf_probe_read_str() + * additionally emitting BPF CO-RE field relocation for specified source + * argument. + */ +#define bpf_core_read_str(dst, sz, src) \ + bpf_probe_read_kernel_str(dst, sz, (const void *)__builtin_preserve_access_index(src)) + +/* NOTE: see comments for BPF_CORE_READ_USER() about the proper types use. */ +#define bpf_core_read_user_str(dst, sz, src) \ + bpf_probe_read_user_str(dst, sz, (const void *)__builtin_preserve_access_index(src)) + +#define ___concat(a, b) a ## b +#define ___apply(fn, n) ___concat(fn, n) +#define ___nth(_1, _2, _3, _4, _5, _6, _7, _8, _9, _10, __11, N, ...) N + +/* + * return number of provided arguments; used for switch-based variadic macro + * definitions (see ___last, ___arrow, etc below) + */ +#define ___narg(...) ___nth(_, ##__VA_ARGS__, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) +/* + * return 0 if no arguments are passed, N - otherwise; used for + * recursively-defined macros to specify termination (0) case, and generic + * (N) case (e.g., ___read_ptrs, ___core_read) + */ +#define ___empty(...) ___nth(_, ##__VA_ARGS__, N, N, N, N, N, N, N, N, N, N, 0) + +#define ___last1(x) x +#define ___last2(a, x) x +#define ___last3(a, b, x) x +#define ___last4(a, b, c, x) x +#define ___last5(a, b, c, d, x) x +#define ___last6(a, b, c, d, e, x) x +#define ___last7(a, b, c, d, e, f, x) x +#define ___last8(a, b, c, d, e, f, g, x) x +#define ___last9(a, b, c, d, e, f, g, h, x) x +#define ___last10(a, b, c, d, e, f, g, h, i, x) x +#define ___last(...) ___apply(___last, ___narg(__VA_ARGS__))(__VA_ARGS__) + +#define ___nolast2(a, _) a +#define ___nolast3(a, b, _) a, b +#define ___nolast4(a, b, c, _) a, b, c +#define ___nolast5(a, b, c, d, _) a, b, c, d +#define ___nolast6(a, b, c, d, e, _) a, b, c, d, e +#define ___nolast7(a, b, c, d, e, f, _) a, b, c, d, e, f +#define ___nolast8(a, b, c, d, e, f, g, _) a, b, c, d, e, f, g +#define ___nolast9(a, b, c, d, e, f, g, h, _) a, b, c, d, e, f, g, h +#define ___nolast10(a, b, c, d, e, f, g, h, i, _) a, b, c, d, e, f, g, h, i +#define ___nolast(...) ___apply(___nolast, ___narg(__VA_ARGS__))(__VA_ARGS__) + +#define ___arrow1(a) a +#define ___arrow2(a, b) a->b +#define ___arrow3(a, b, c) a->b->c +#define ___arrow4(a, b, c, d) a->b->c->d +#define ___arrow5(a, b, c, d, e) a->b->c->d->e +#define ___arrow6(a, b, c, d, e, f) a->b->c->d->e->f +#define ___arrow7(a, b, c, d, e, f, g) a->b->c->d->e->f->g +#define ___arrow8(a, b, c, d, e, f, g, h) a->b->c->d->e->f->g->h +#define ___arrow9(a, b, c, d, e, f, g, h, i) a->b->c->d->e->f->g->h->i +#define ___arrow10(a, b, c, d, e, f, g, h, i, j) a->b->c->d->e->f->g->h->i->j +#define ___arrow(...) ___apply(___arrow, ___narg(__VA_ARGS__))(__VA_ARGS__) + +#define ___type(...) typeof(___arrow(__VA_ARGS__)) + +#define ___read(read_fn, dst, src_type, src, accessor) \ + read_fn((void *)(dst), sizeof(*(dst)), &((src_type)(src))->accessor) + +/* "recursively" read a sequence of inner pointers using local __t var */ +#define ___rd_first(fn, src, a) ___read(fn, &__t, ___type(src), src, a); +#define ___rd_last(fn, ...) \ + ___read(fn, &__t, ___type(___nolast(__VA_ARGS__)), __t, ___last(__VA_ARGS__)); +#define ___rd_p1(fn, ...) const void *__t; ___rd_first(fn, __VA_ARGS__) +#define ___rd_p2(fn, ...) ___rd_p1(fn, ___nolast(__VA_ARGS__)) ___rd_last(fn, __VA_ARGS__) +#define ___rd_p3(fn, ...) ___rd_p2(fn, ___nolast(__VA_ARGS__)) ___rd_last(fn, __VA_ARGS__) +#define ___rd_p4(fn, ...) ___rd_p3(fn, ___nolast(__VA_ARGS__)) ___rd_last(fn, __VA_ARGS__) +#define ___rd_p5(fn, ...) ___rd_p4(fn, ___nolast(__VA_ARGS__)) ___rd_last(fn, __VA_ARGS__) +#define ___rd_p6(fn, ...) ___rd_p5(fn, ___nolast(__VA_ARGS__)) ___rd_last(fn, __VA_ARGS__) +#define ___rd_p7(fn, ...) ___rd_p6(fn, ___nolast(__VA_ARGS__)) ___rd_last(fn, __VA_ARGS__) +#define ___rd_p8(fn, ...) ___rd_p7(fn, ___nolast(__VA_ARGS__)) ___rd_last(fn, __VA_ARGS__) +#define ___rd_p9(fn, ...) ___rd_p8(fn, ___nolast(__VA_ARGS__)) ___rd_last(fn, __VA_ARGS__) +#define ___read_ptrs(fn, src, ...) \ + ___apply(___rd_p, ___narg(__VA_ARGS__))(fn, src, __VA_ARGS__) + +#define ___core_read0(fn, fn_ptr, dst, src, a) \ + ___read(fn, dst, ___type(src), src, a); +#define ___core_readN(fn, fn_ptr, dst, src, ...) \ + ___read_ptrs(fn_ptr, src, ___nolast(__VA_ARGS__)) \ + ___read(fn, dst, ___type(src, ___nolast(__VA_ARGS__)), __t, \ + ___last(__VA_ARGS__)); +#define ___core_read(fn, fn_ptr, dst, src, a, ...) \ + ___apply(___core_read, ___empty(__VA_ARGS__))(fn, fn_ptr, dst, \ + src, a, ##__VA_ARGS__) + +/* + * BPF_CORE_READ_INTO() is a more performance-conscious variant of + * BPF_CORE_READ(), in which final field is read into user-provided storage. + * See BPF_CORE_READ() below for more details on general usage. + */ +#define BPF_CORE_READ_INTO(dst, src, a, ...) ({ \ + ___core_read(bpf_core_read, bpf_core_read, \ + dst, (src), a, ##__VA_ARGS__) \ +}) + +/* + * Variant of BPF_CORE_READ_INTO() for reading from user-space memory. + * + * NOTE: see comments for BPF_CORE_READ_USER() about the proper types use. + */ +#define BPF_CORE_READ_USER_INTO(dst, src, a, ...) ({ \ + ___core_read(bpf_core_read_user, bpf_core_read_user, \ + dst, (src), a, ##__VA_ARGS__) \ +}) + +/* Non-CO-RE variant of BPF_CORE_READ_INTO() */ +#define BPF_PROBE_READ_INTO(dst, src, a, ...) ({ \ + ___core_read(bpf_probe_read, bpf_probe_read, \ + dst, (src), a, ##__VA_ARGS__) \ +}) + +/* Non-CO-RE variant of BPF_CORE_READ_USER_INTO(). + * + * As no CO-RE relocations are emitted, source types can be arbitrary and are + * not restricted to kernel types only. + */ +#define BPF_PROBE_READ_USER_INTO(dst, src, a, ...) ({ \ + ___core_read(bpf_probe_read_user, bpf_probe_read_user, \ + dst, (src), a, ##__VA_ARGS__) \ +}) + +/* + * BPF_CORE_READ_STR_INTO() does same "pointer chasing" as + * BPF_CORE_READ() for intermediate pointers, but then executes (and returns + * corresponding error code) bpf_core_read_str() for final string read. + */ +#define BPF_CORE_READ_STR_INTO(dst, src, a, ...) ({ \ + ___core_read(bpf_core_read_str, bpf_core_read, \ + dst, (src), a, ##__VA_ARGS__) \ +}) + +/* + * Variant of BPF_CORE_READ_STR_INTO() for reading from user-space memory. + * + * NOTE: see comments for BPF_CORE_READ_USER() about the proper types use. + */ +#define BPF_CORE_READ_USER_STR_INTO(dst, src, a, ...) ({ \ + ___core_read(bpf_core_read_user_str, bpf_core_read_user, \ + dst, (src), a, ##__VA_ARGS__) \ +}) + +/* Non-CO-RE variant of BPF_CORE_READ_STR_INTO() */ +#define BPF_PROBE_READ_STR_INTO(dst, src, a, ...) ({ \ + ___core_read(bpf_probe_read_str, bpf_probe_read, \ + dst, (src), a, ##__VA_ARGS__) \ +}) + +/* + * Non-CO-RE variant of BPF_CORE_READ_USER_STR_INTO(). + * + * As no CO-RE relocations are emitted, source types can be arbitrary and are + * not restricted to kernel types only. + */ +#define BPF_PROBE_READ_USER_STR_INTO(dst, src, a, ...) ({ \ + ___core_read(bpf_probe_read_user_str, bpf_probe_read_user, \ + dst, (src), a, ##__VA_ARGS__) \ +}) + +/* + * BPF_CORE_READ() is used to simplify BPF CO-RE relocatable read, especially + * when there are few pointer chasing steps. + * E.g., what in non-BPF world (or in BPF w/ BCC) would be something like: + * int x = s->a.b.c->d.e->f->g; + * can be succinctly achieved using BPF_CORE_READ as: + * int x = BPF_CORE_READ(s, a.b.c, d.e, f, g); + * + * BPF_CORE_READ will decompose above statement into 4 bpf_core_read (BPF + * CO-RE relocatable bpf_probe_read_kernel() wrapper) calls, logically + * equivalent to: + * 1. const void *__t = s->a.b.c; + * 2. __t = __t->d.e; + * 3. __t = __t->f; + * 4. return __t->g; + * + * Equivalence is logical, because there is a heavy type casting/preservation + * involved, as well as all the reads are happening through + * bpf_probe_read_kernel() calls using __builtin_preserve_access_index() to + * emit CO-RE relocations. + * + * N.B. Only up to 9 "field accessors" are supported, which should be more + * than enough for any practical purpose. + */ +#define BPF_CORE_READ(src, a, ...) ({ \ + ___type((src), a, ##__VA_ARGS__) __r; \ + BPF_CORE_READ_INTO(&__r, (src), a, ##__VA_ARGS__); \ + __r; \ +}) + +/* + * Variant of BPF_CORE_READ() for reading from user-space memory. + * + * NOTE: all the source types involved are still *kernel types* and need to + * exist in kernel (or kernel module) BTF, otherwise CO-RE relocation will + * fail. Custom user types are not relocatable with CO-RE. + * The typical situation in which BPF_CORE_READ_USER() might be used is to + * read kernel UAPI types from the user-space memory passed in as a syscall + * input argument. + */ +#define BPF_CORE_READ_USER(src, a, ...) ({ \ + ___type((src), a, ##__VA_ARGS__) __r; \ + BPF_CORE_READ_USER_INTO(&__r, (src), a, ##__VA_ARGS__); \ + __r; \ +}) + +/* Non-CO-RE variant of BPF_CORE_READ() */ +#define BPF_PROBE_READ(src, a, ...) ({ \ + ___type((src), a, ##__VA_ARGS__) __r; \ + BPF_PROBE_READ_INTO(&__r, (src), a, ##__VA_ARGS__); \ + __r; \ +}) + +/* + * Non-CO-RE variant of BPF_CORE_READ_USER(). + * + * As no CO-RE relocations are emitted, source types can be arbitrary and are + * not restricted to kernel types only. + */ +#define BPF_PROBE_READ_USER(src, a, ...) ({ \ + ___type((src), a, ##__VA_ARGS__) __r; \ + BPF_PROBE_READ_USER_INTO(&__r, (src), a, ##__VA_ARGS__); \ + __r; \ +}) + +#endif + diff --git a/include/libbpf/bpf_endian.h b/include/libbpf/bpf_endian.h new file mode 100644 index 000000000..ec9db4fec --- /dev/null +++ b/include/libbpf/bpf_endian.h @@ -0,0 +1,99 @@ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ +#ifndef __BPF_ENDIAN__ +#define __BPF_ENDIAN__ + +/* + * Isolate byte #n and put it into byte #m, for __u##b type. + * E.g., moving byte #6 (nnnnnnnn) into byte #1 (mmmmmmmm) for __u64: + * 1) xxxxxxxx nnnnnnnn xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx mmmmmmmm xxxxxxxx + * 2) nnnnnnnn xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx mmmmmmmm xxxxxxxx 00000000 + * 3) 00000000 00000000 00000000 00000000 00000000 00000000 00000000 nnnnnnnn + * 4) 00000000 00000000 00000000 00000000 00000000 00000000 nnnnnnnn 00000000 + */ +#define ___bpf_mvb(x, b, n, m) ((__u##b)(x) << (b-(n+1)*8) >> (b-8) << (m*8)) + +#define ___bpf_swab16(x) ((__u16)( \ + ___bpf_mvb(x, 16, 0, 1) | \ + ___bpf_mvb(x, 16, 1, 0))) + +#define ___bpf_swab32(x) ((__u32)( \ + ___bpf_mvb(x, 32, 0, 3) | \ + ___bpf_mvb(x, 32, 1, 2) | \ + ___bpf_mvb(x, 32, 2, 1) | \ + ___bpf_mvb(x, 32, 3, 0))) + +#define ___bpf_swab64(x) ((__u64)( \ + ___bpf_mvb(x, 64, 0, 7) | \ + ___bpf_mvb(x, 64, 1, 6) | \ + ___bpf_mvb(x, 64, 2, 5) | \ + ___bpf_mvb(x, 64, 3, 4) | \ + ___bpf_mvb(x, 64, 4, 3) | \ + ___bpf_mvb(x, 64, 5, 2) | \ + ___bpf_mvb(x, 64, 6, 1) | \ + ___bpf_mvb(x, 64, 7, 0))) + +/* LLVM's BPF target selects the endianness of the CPU + * it compiles on, or the user specifies (bpfel/bpfeb), + * respectively. The used __BYTE_ORDER__ is defined by + * the compiler, we cannot rely on __BYTE_ORDER from + * libc headers, since it doesn't reflect the actual + * requested byte order. + * + * Note, LLVM's BPF target has different __builtin_bswapX() + * semantics. It does map to BPF_ALU | BPF_END | BPF_TO_BE + * in bpfel and bpfeb case, which means below, that we map + * to cpu_to_be16(). We could use it unconditionally in BPF + * case, but better not rely on it, so that this header here + * can be used from application and BPF program side, which + * use different targets. + */ +#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ +# define __bpf_ntohs(x) __builtin_bswap16(x) +# define __bpf_htons(x) __builtin_bswap16(x) +# define __bpf_constant_ntohs(x) ___bpf_swab16(x) +# define __bpf_constant_htons(x) ___bpf_swab16(x) +# define __bpf_ntohl(x) __builtin_bswap32(x) +# define __bpf_htonl(x) __builtin_bswap32(x) +# define __bpf_constant_ntohl(x) ___bpf_swab32(x) +# define __bpf_constant_htonl(x) ___bpf_swab32(x) +# define __bpf_be64_to_cpu(x) __builtin_bswap64(x) +# define __bpf_cpu_to_be64(x) __builtin_bswap64(x) +# define __bpf_constant_be64_to_cpu(x) ___bpf_swab64(x) +# define __bpf_constant_cpu_to_be64(x) ___bpf_swab64(x) +#elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ +# define __bpf_ntohs(x) (x) +# define __bpf_htons(x) (x) +# define __bpf_constant_ntohs(x) (x) +# define __bpf_constant_htons(x) (x) +# define __bpf_ntohl(x) (x) +# define __bpf_htonl(x) (x) +# define __bpf_constant_ntohl(x) (x) +# define __bpf_constant_htonl(x) (x) +# define __bpf_be64_to_cpu(x) (x) +# define __bpf_cpu_to_be64(x) (x) +# define __bpf_constant_be64_to_cpu(x) (x) +# define __bpf_constant_cpu_to_be64(x) (x) +#else +# error "Fix your compiler's __BYTE_ORDER__?!" +#endif + +#define bpf_htons(x) \ + (__builtin_constant_p(x) ? \ + __bpf_constant_htons(x) : __bpf_htons(x)) +#define bpf_ntohs(x) \ + (__builtin_constant_p(x) ? \ + __bpf_constant_ntohs(x) : __bpf_ntohs(x)) +#define bpf_htonl(x) \ + (__builtin_constant_p(x) ? \ + __bpf_constant_htonl(x) : __bpf_htonl(x)) +#define bpf_ntohl(x) \ + (__builtin_constant_p(x) ? \ + __bpf_constant_ntohl(x) : __bpf_ntohl(x)) +#define bpf_cpu_to_be64(x) \ + (__builtin_constant_p(x) ? \ + __bpf_constant_cpu_to_be64(x) : __bpf_cpu_to_be64(x)) +#define bpf_be64_to_cpu(x) \ + (__builtin_constant_p(x) ? \ + __bpf_constant_be64_to_cpu(x) : __bpf_be64_to_cpu(x)) + +#endif /* __BPF_ENDIAN__ */ diff --git a/include/libbpf/bpf_helper_defs.h b/include/libbpf/bpf_helper_defs.h new file mode 100644 index 000000000..00929faad --- /dev/null +++ b/include/libbpf/bpf_helper_defs.h @@ -0,0 +1,4046 @@ +/* This is auto-generated file. See bpf_doc.py for details. */ + +/* Forward declarations of BPF structs */ +struct bpf_fib_lookup; +struct bpf_sk_lookup; +struct bpf_perf_event_data; +struct bpf_perf_event_value; +struct bpf_pidns_info; +struct bpf_redir_neigh; +struct bpf_sock; +struct bpf_sock_addr; +struct bpf_sock_ops; +struct bpf_sock_tuple; +struct bpf_spin_lock; +struct bpf_sysctl; +struct bpf_tcp_sock; +struct bpf_tunnel_key; +struct bpf_xfrm_state; +struct linux_binprm; +struct pt_regs; +struct sk_reuseport_md; +struct sockaddr; +struct tcphdr; +struct seq_file; +struct tcp6_sock; +struct tcp_sock; +struct tcp_timewait_sock; +struct tcp_request_sock; +struct udp6_sock; +struct task_struct; +struct __sk_buff; +struct sk_msg_md; +struct xdp_md; +struct path; +struct btf_ptr; +struct inode; +struct socket; +struct file; +struct bpf_timer; + +/* + * bpf_map_lookup_elem + * + * Perform a lookup in *map* for an entry associated to *key*. + * + * Returns + * Map value associated to *key*, or **NULL** if no entry was + * found. + */ +static void *(*bpf_map_lookup_elem)(void *map, const void *key) = (void *) 1; + +/* + * bpf_map_update_elem + * + * Add or update the value of the entry associated to *key* in + * *map* with *value*. *flags* is one of: + * + * **BPF_NOEXIST** + * The entry for *key* must not exist in the map. + * **BPF_EXIST** + * The entry for *key* must already exist in the map. + * **BPF_ANY** + * No condition on the existence of the entry for *key*. + * + * Flag value **BPF_NOEXIST** cannot be used for maps of types + * **BPF_MAP_TYPE_ARRAY** or **BPF_MAP_TYPE_PERCPU_ARRAY** (all + * elements always exist), the helper would return an error. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_map_update_elem)(void *map, const void *key, const void *value, __u64 flags) = (void *) 2; + +/* + * bpf_map_delete_elem + * + * Delete entry with *key* from *map*. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_map_delete_elem)(void *map, const void *key) = (void *) 3; + +/* + * bpf_probe_read + * + * For tracing programs, safely attempt to read *size* bytes from + * kernel space address *unsafe_ptr* and store the data in *dst*. + * + * Generally, use **bpf_probe_read_user**\ () or + * **bpf_probe_read_kernel**\ () instead. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_probe_read)(void *dst, __u32 size, const void *unsafe_ptr) = (void *) 4; + +/* + * bpf_ktime_get_ns + * + * Return the time elapsed since system boot, in nanoseconds. + * Does not include time the system was suspended. + * See: **clock_gettime**\ (**CLOCK_MONOTONIC**) + * + * Returns + * Current *ktime*. + */ +static __u64 (*bpf_ktime_get_ns)(void) = (void *) 5; + +/* + * bpf_trace_printk + * + * This helper is a "printk()-like" facility for debugging. It + * prints a message defined by format *fmt* (of size *fmt_size*) + * to file *\/sys/kernel/debug/tracing/trace* from DebugFS, if + * available. It can take up to three additional **u64** + * arguments (as an eBPF helpers, the total number of arguments is + * limited to five). + * + * Each time the helper is called, it appends a line to the trace. + * Lines are discarded while *\/sys/kernel/debug/tracing/trace* is + * open, use *\/sys/kernel/debug/tracing/trace_pipe* to avoid this. + * The format of the trace is customizable, and the exact output + * one will get depends on the options set in + * *\/sys/kernel/debug/tracing/trace_options* (see also the + * *README* file under the same directory). However, it usually + * defaults to something like: + * + * :: + * + * telnet-470 [001] .N.. 419421.045894: 0x00000001: + * + * In the above: + * + * * ``telnet`` is the name of the current task. + * * ``470`` is the PID of the current task. + * * ``001`` is the CPU number on which the task is + * running. + * * In ``.N..``, each character refers to a set of + * options (whether irqs are enabled, scheduling + * options, whether hard/softirqs are running, level of + * preempt_disabled respectively). **N** means that + * **TIF_NEED_RESCHED** and **PREEMPT_NEED_RESCHED** + * are set. + * * ``419421.045894`` is a timestamp. + * * ``0x00000001`` is a fake value used by BPF for the + * instruction pointer register. + * * ```` is the message formatted with + * *fmt*. + * + * The conversion specifiers supported by *fmt* are similar, but + * more limited than for printk(). They are **%d**, **%i**, + * **%u**, **%x**, **%ld**, **%li**, **%lu**, **%lx**, **%lld**, + * **%lli**, **%llu**, **%llx**, **%p**, **%s**. No modifier (size + * of field, padding with zeroes, etc.) is available, and the + * helper will return **-EINVAL** (but print nothing) if it + * encounters an unknown specifier. + * + * Also, note that **bpf_trace_printk**\ () is slow, and should + * only be used for debugging purposes. For this reason, a notice + * block (spanning several lines) is printed to kernel logs and + * states that the helper should not be used "for production use" + * the first time this helper is used (or more precisely, when + * **trace_printk**\ () buffers are allocated). For passing values + * to user space, perf events should be preferred. + * + * Returns + * The number of bytes written to the buffer, or a negative error + * in case of failure. + */ +static long (*bpf_trace_printk)(const char *fmt, __u32 fmt_size, ...) = (void *) 6; + +/* + * bpf_get_prandom_u32 + * + * Get a pseudo-random number. + * + * From a security point of view, this helper uses its own + * pseudo-random internal state, and cannot be used to infer the + * seed of other random functions in the kernel. However, it is + * essential to note that the generator used by the helper is not + * cryptographically secure. + * + * Returns + * A random 32-bit unsigned value. + */ +static __u32 (*bpf_get_prandom_u32)(void) = (void *) 7; + +/* + * bpf_get_smp_processor_id + * + * Get the SMP (symmetric multiprocessing) processor id. Note that + * all programs run with preemption disabled, which means that the + * SMP processor id is stable during all the execution of the + * program. + * + * Returns + * The SMP id of the processor running the program. + */ +static __u32 (*bpf_get_smp_processor_id)(void) = (void *) 8; + +/* + * bpf_skb_store_bytes + * + * Store *len* bytes from address *from* into the packet + * associated to *skb*, at *offset*. *flags* are a combination of + * **BPF_F_RECOMPUTE_CSUM** (automatically recompute the + * checksum for the packet after storing the bytes) and + * **BPF_F_INVALIDATE_HASH** (set *skb*\ **->hash**, *skb*\ + * **->swhash** and *skb*\ **->l4hash** to 0). + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_store_bytes)(struct __sk_buff *skb, __u32 offset, const void *from, __u32 len, __u64 flags) = (void *) 9; + +/* + * bpf_l3_csum_replace + * + * Recompute the layer 3 (e.g. IP) checksum for the packet + * associated to *skb*. Computation is incremental, so the helper + * must know the former value of the header field that was + * modified (*from*), the new value of this field (*to*), and the + * number of bytes (2 or 4) for this field, stored in *size*. + * Alternatively, it is possible to store the difference between + * the previous and the new values of the header field in *to*, by + * setting *from* and *size* to 0. For both methods, *offset* + * indicates the location of the IP checksum within the packet. + * + * This helper works in combination with **bpf_csum_diff**\ (), + * which does not update the checksum in-place, but offers more + * flexibility and can handle sizes larger than 2 or 4 for the + * checksum to update. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_l3_csum_replace)(struct __sk_buff *skb, __u32 offset, __u64 from, __u64 to, __u64 size) = (void *) 10; + +/* + * bpf_l4_csum_replace + * + * Recompute the layer 4 (e.g. TCP, UDP or ICMP) checksum for the + * packet associated to *skb*. Computation is incremental, so the + * helper must know the former value of the header field that was + * modified (*from*), the new value of this field (*to*), and the + * number of bytes (2 or 4) for this field, stored on the lowest + * four bits of *flags*. Alternatively, it is possible to store + * the difference between the previous and the new values of the + * header field in *to*, by setting *from* and the four lowest + * bits of *flags* to 0. For both methods, *offset* indicates the + * location of the IP checksum within the packet. In addition to + * the size of the field, *flags* can be added (bitwise OR) actual + * flags. With **BPF_F_MARK_MANGLED_0**, a null checksum is left + * untouched (unless **BPF_F_MARK_ENFORCE** is added as well), and + * for updates resulting in a null checksum the value is set to + * **CSUM_MANGLED_0** instead. Flag **BPF_F_PSEUDO_HDR** indicates + * the checksum is to be computed against a pseudo-header. + * + * This helper works in combination with **bpf_csum_diff**\ (), + * which does not update the checksum in-place, but offers more + * flexibility and can handle sizes larger than 2 or 4 for the + * checksum to update. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_l4_csum_replace)(struct __sk_buff *skb, __u32 offset, __u64 from, __u64 to, __u64 flags) = (void *) 11; + +/* + * bpf_tail_call + * + * This special helper is used to trigger a "tail call", or in + * other words, to jump into another eBPF program. The same stack + * frame is used (but values on stack and in registers for the + * caller are not accessible to the callee). This mechanism allows + * for program chaining, either for raising the maximum number of + * available eBPF instructions, or to execute given programs in + * conditional blocks. For security reasons, there is an upper + * limit to the number of successive tail calls that can be + * performed. + * + * Upon call of this helper, the program attempts to jump into a + * program referenced at index *index* in *prog_array_map*, a + * special map of type **BPF_MAP_TYPE_PROG_ARRAY**, and passes + * *ctx*, a pointer to the context. + * + * If the call succeeds, the kernel immediately runs the first + * instruction of the new program. This is not a function call, + * and it never returns to the previous program. If the call + * fails, then the helper has no effect, and the caller continues + * to run its subsequent instructions. A call can fail if the + * destination program for the jump does not exist (i.e. *index* + * is superior to the number of entries in *prog_array_map*), or + * if the maximum number of tail calls has been reached for this + * chain of programs. This limit is defined in the kernel by the + * macro **MAX_TAIL_CALL_CNT** (not accessible to user space), + * which is currently set to 32. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_tail_call)(void *ctx, void *prog_array_map, __u32 index) = (void *) 12; + +/* + * bpf_clone_redirect + * + * Clone and redirect the packet associated to *skb* to another + * net device of index *ifindex*. Both ingress and egress + * interfaces can be used for redirection. The **BPF_F_INGRESS** + * value in *flags* is used to make the distinction (ingress path + * is selected if the flag is present, egress path otherwise). + * This is the only flag supported for now. + * + * In comparison with **bpf_redirect**\ () helper, + * **bpf_clone_redirect**\ () has the associated cost of + * duplicating the packet buffer, but this can be executed out of + * the eBPF program. Conversely, **bpf_redirect**\ () is more + * efficient, but it is handled through an action code where the + * redirection happens only after the eBPF program has returned. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_clone_redirect)(struct __sk_buff *skb, __u32 ifindex, __u64 flags) = (void *) 13; + +/* + * bpf_get_current_pid_tgid + * + * + * Returns + * A 64-bit integer containing the current tgid and pid, and + * created as such: + * *current_task*\ **->tgid << 32 \|** + * *current_task*\ **->pid**. + */ +static __u64 (*bpf_get_current_pid_tgid)(void) = (void *) 14; + +/* + * bpf_get_current_uid_gid + * + * + * Returns + * A 64-bit integer containing the current GID and UID, and + * created as such: *current_gid* **<< 32 \|** *current_uid*. + */ +static __u64 (*bpf_get_current_uid_gid)(void) = (void *) 15; + +/* + * bpf_get_current_comm + * + * Copy the **comm** attribute of the current task into *buf* of + * *size_of_buf*. The **comm** attribute contains the name of + * the executable (excluding the path) for the current task. The + * *size_of_buf* must be strictly positive. On success, the + * helper makes sure that the *buf* is NUL-terminated. On failure, + * it is filled with zeroes. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_get_current_comm)(void *buf, __u32 size_of_buf) = (void *) 16; + +/* + * bpf_get_cgroup_classid + * + * Retrieve the classid for the current task, i.e. for the net_cls + * cgroup to which *skb* belongs. + * + * This helper can be used on TC egress path, but not on ingress. + * + * The net_cls cgroup provides an interface to tag network packets + * based on a user-provided identifier for all traffic coming from + * the tasks belonging to the related cgroup. See also the related + * kernel documentation, available from the Linux sources in file + * *Documentation/admin-guide/cgroup-v1/net_cls.rst*. + * + * The Linux kernel has two versions for cgroups: there are + * cgroups v1 and cgroups v2. Both are available to users, who can + * use a mixture of them, but note that the net_cls cgroup is for + * cgroup v1 only. This makes it incompatible with BPF programs + * run on cgroups, which is a cgroup-v2-only feature (a socket can + * only hold data for one version of cgroups at a time). + * + * This helper is only available is the kernel was compiled with + * the **CONFIG_CGROUP_NET_CLASSID** configuration option set to + * "**y**" or to "**m**". + * + * Returns + * The classid, or 0 for the default unconfigured classid. + */ +static __u32 (*bpf_get_cgroup_classid)(struct __sk_buff *skb) = (void *) 17; + +/* + * bpf_skb_vlan_push + * + * Push a *vlan_tci* (VLAN tag control information) of protocol + * *vlan_proto* to the packet associated to *skb*, then update + * the checksum. Note that if *vlan_proto* is different from + * **ETH_P_8021Q** and **ETH_P_8021AD**, it is considered to + * be **ETH_P_8021Q**. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_vlan_push)(struct __sk_buff *skb, __be16 vlan_proto, __u16 vlan_tci) = (void *) 18; + +/* + * bpf_skb_vlan_pop + * + * Pop a VLAN header from the packet associated to *skb*. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_vlan_pop)(struct __sk_buff *skb) = (void *) 19; + +/* + * bpf_skb_get_tunnel_key + * + * Get tunnel metadata. This helper takes a pointer *key* to an + * empty **struct bpf_tunnel_key** of **size**, that will be + * filled with tunnel metadata for the packet associated to *skb*. + * The *flags* can be set to **BPF_F_TUNINFO_IPV6**, which + * indicates that the tunnel is based on IPv6 protocol instead of + * IPv4. + * + * The **struct bpf_tunnel_key** is an object that generalizes the + * principal parameters used by various tunneling protocols into a + * single struct. This way, it can be used to easily make a + * decision based on the contents of the encapsulation header, + * "summarized" in this struct. In particular, it holds the IP + * address of the remote end (IPv4 or IPv6, depending on the case) + * in *key*\ **->remote_ipv4** or *key*\ **->remote_ipv6**. Also, + * this struct exposes the *key*\ **->tunnel_id**, which is + * generally mapped to a VNI (Virtual Network Identifier), making + * it programmable together with the **bpf_skb_set_tunnel_key**\ + * () helper. + * + * Let's imagine that the following code is part of a program + * attached to the TC ingress interface, on one end of a GRE + * tunnel, and is supposed to filter out all messages coming from + * remote ends with IPv4 address other than 10.0.0.1: + * + * :: + * + * int ret; + * struct bpf_tunnel_key key = {}; + * + * ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), 0); + * if (ret < 0) + * return TC_ACT_SHOT; // drop packet + * + * if (key.remote_ipv4 != 0x0a000001) + * return TC_ACT_SHOT; // drop packet + * + * return TC_ACT_OK; // accept packet + * + * This interface can also be used with all encapsulation devices + * that can operate in "collect metadata" mode: instead of having + * one network device per specific configuration, the "collect + * metadata" mode only requires a single device where the + * configuration can be extracted from this helper. + * + * This can be used together with various tunnels such as VXLan, + * Geneve, GRE or IP in IP (IPIP). + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_get_tunnel_key)(struct __sk_buff *skb, struct bpf_tunnel_key *key, __u32 size, __u64 flags) = (void *) 20; + +/* + * bpf_skb_set_tunnel_key + * + * Populate tunnel metadata for packet associated to *skb.* The + * tunnel metadata is set to the contents of *key*, of *size*. The + * *flags* can be set to a combination of the following values: + * + * **BPF_F_TUNINFO_IPV6** + * Indicate that the tunnel is based on IPv6 protocol + * instead of IPv4. + * **BPF_F_ZERO_CSUM_TX** + * For IPv4 packets, add a flag to tunnel metadata + * indicating that checksum computation should be skipped + * and checksum set to zeroes. + * **BPF_F_DONT_FRAGMENT** + * Add a flag to tunnel metadata indicating that the + * packet should not be fragmented. + * **BPF_F_SEQ_NUMBER** + * Add a flag to tunnel metadata indicating that a + * sequence number should be added to tunnel header before + * sending the packet. This flag was added for GRE + * encapsulation, but might be used with other protocols + * as well in the future. + * + * Here is a typical usage on the transmit path: + * + * :: + * + * struct bpf_tunnel_key key; + * populate key ... + * bpf_skb_set_tunnel_key(skb, &key, sizeof(key), 0); + * bpf_clone_redirect(skb, vxlan_dev_ifindex, 0); + * + * See also the description of the **bpf_skb_get_tunnel_key**\ () + * helper for additional information. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_set_tunnel_key)(struct __sk_buff *skb, struct bpf_tunnel_key *key, __u32 size, __u64 flags) = (void *) 21; + +/* + * bpf_perf_event_read + * + * Read the value of a perf event counter. This helper relies on a + * *map* of type **BPF_MAP_TYPE_PERF_EVENT_ARRAY**. The nature of + * the perf event counter is selected when *map* is updated with + * perf event file descriptors. The *map* is an array whose size + * is the number of available CPUs, and each cell contains a value + * relative to one CPU. The value to retrieve is indicated by + * *flags*, that contains the index of the CPU to look up, masked + * with **BPF_F_INDEX_MASK**. Alternatively, *flags* can be set to + * **BPF_F_CURRENT_CPU** to indicate that the value for the + * current CPU should be retrieved. + * + * Note that before Linux 4.13, only hardware perf event can be + * retrieved. + * + * Also, be aware that the newer helper + * **bpf_perf_event_read_value**\ () is recommended over + * **bpf_perf_event_read**\ () in general. The latter has some ABI + * quirks where error and counter value are used as a return code + * (which is wrong to do since ranges may overlap). This issue is + * fixed with **bpf_perf_event_read_value**\ (), which at the same + * time provides more features over the **bpf_perf_event_read**\ + * () interface. Please refer to the description of + * **bpf_perf_event_read_value**\ () for details. + * + * Returns + * The value of the perf event counter read from the map, or a + * negative error code in case of failure. + */ +static __u64 (*bpf_perf_event_read)(void *map, __u64 flags) = (void *) 22; + +/* + * bpf_redirect + * + * Redirect the packet to another net device of index *ifindex*. + * This helper is somewhat similar to **bpf_clone_redirect**\ + * (), except that the packet is not cloned, which provides + * increased performance. + * + * Except for XDP, both ingress and egress interfaces can be used + * for redirection. The **BPF_F_INGRESS** value in *flags* is used + * to make the distinction (ingress path is selected if the flag + * is present, egress path otherwise). Currently, XDP only + * supports redirection to the egress interface, and accepts no + * flag at all. + * + * The same effect can also be attained with the more generic + * **bpf_redirect_map**\ (), which uses a BPF map to store the + * redirect target instead of providing it directly to the helper. + * + * Returns + * For XDP, the helper returns **XDP_REDIRECT** on success or + * **XDP_ABORTED** on error. For other program types, the values + * are **TC_ACT_REDIRECT** on success or **TC_ACT_SHOT** on + * error. + */ +static long (*bpf_redirect)(__u32 ifindex, __u64 flags) = (void *) 23; + +/* + * bpf_get_route_realm + * + * Retrieve the realm or the route, that is to say the + * **tclassid** field of the destination for the *skb*. The + * identifier retrieved is a user-provided tag, similar to the + * one used with the net_cls cgroup (see description for + * **bpf_get_cgroup_classid**\ () helper), but here this tag is + * held by a route (a destination entry), not by a task. + * + * Retrieving this identifier works with the clsact TC egress hook + * (see also **tc-bpf(8)**), or alternatively on conventional + * classful egress qdiscs, but not on TC ingress path. In case of + * clsact TC egress hook, this has the advantage that, internally, + * the destination entry has not been dropped yet in the transmit + * path. Therefore, the destination entry does not need to be + * artificially held via **netif_keep_dst**\ () for a classful + * qdisc until the *skb* is freed. + * + * This helper is available only if the kernel was compiled with + * **CONFIG_IP_ROUTE_CLASSID** configuration option. + * + * Returns + * The realm of the route for the packet associated to *skb*, or 0 + * if none was found. + */ +static __u32 (*bpf_get_route_realm)(struct __sk_buff *skb) = (void *) 24; + +/* + * bpf_perf_event_output + * + * Write raw *data* blob into a special BPF perf event held by + * *map* of type **BPF_MAP_TYPE_PERF_EVENT_ARRAY**. This perf + * event must have the following attributes: **PERF_SAMPLE_RAW** + * as **sample_type**, **PERF_TYPE_SOFTWARE** as **type**, and + * **PERF_COUNT_SW_BPF_OUTPUT** as **config**. + * + * The *flags* are used to indicate the index in *map* for which + * the value must be put, masked with **BPF_F_INDEX_MASK**. + * Alternatively, *flags* can be set to **BPF_F_CURRENT_CPU** + * to indicate that the index of the current CPU core should be + * used. + * + * The value to write, of *size*, is passed through eBPF stack and + * pointed by *data*. + * + * The context of the program *ctx* needs also be passed to the + * helper. + * + * On user space, a program willing to read the values needs to + * call **perf_event_open**\ () on the perf event (either for + * one or for all CPUs) and to store the file descriptor into the + * *map*. This must be done before the eBPF program can send data + * into it. An example is available in file + * *samples/bpf/trace_output_user.c* in the Linux kernel source + * tree (the eBPF program counterpart is in + * *samples/bpf/trace_output_kern.c*). + * + * **bpf_perf_event_output**\ () achieves better performance + * than **bpf_trace_printk**\ () for sharing data with user + * space, and is much better suitable for streaming data from eBPF + * programs. + * + * Note that this helper is not restricted to tracing use cases + * and can be used with programs attached to TC or XDP as well, + * where it allows for passing data to user space listeners. Data + * can be: + * + * * Only custom structs, + * * Only the packet payload, or + * * A combination of both. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_perf_event_output)(void *ctx, void *map, __u64 flags, void *data, __u64 size) = (void *) 25; + +/* + * bpf_skb_load_bytes + * + * This helper was provided as an easy way to load data from a + * packet. It can be used to load *len* bytes from *offset* from + * the packet associated to *skb*, into the buffer pointed by + * *to*. + * + * Since Linux 4.7, usage of this helper has mostly been replaced + * by "direct packet access", enabling packet data to be + * manipulated with *skb*\ **->data** and *skb*\ **->data_end** + * pointing respectively to the first byte of packet data and to + * the byte after the last byte of packet data. However, it + * remains useful if one wishes to read large quantities of data + * at once from a packet into the eBPF stack. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_load_bytes)(const void *skb, __u32 offset, void *to, __u32 len) = (void *) 26; + +/* + * bpf_get_stackid + * + * Walk a user or a kernel stack and return its id. To achieve + * this, the helper needs *ctx*, which is a pointer to the context + * on which the tracing program is executed, and a pointer to a + * *map* of type **BPF_MAP_TYPE_STACK_TRACE**. + * + * The last argument, *flags*, holds the number of stack frames to + * skip (from 0 to 255), masked with + * **BPF_F_SKIP_FIELD_MASK**. The next bits can be used to set + * a combination of the following flags: + * + * **BPF_F_USER_STACK** + * Collect a user space stack instead of a kernel stack. + * **BPF_F_FAST_STACK_CMP** + * Compare stacks by hash only. + * **BPF_F_REUSE_STACKID** + * If two different stacks hash into the same *stackid*, + * discard the old one. + * + * The stack id retrieved is a 32 bit long integer handle which + * can be further combined with other data (including other stack + * ids) and used as a key into maps. This can be useful for + * generating a variety of graphs (such as flame graphs or off-cpu + * graphs). + * + * For walking a stack, this helper is an improvement over + * **bpf_probe_read**\ (), which can be used with unrolled loops + * but is not efficient and consumes a lot of eBPF instructions. + * Instead, **bpf_get_stackid**\ () can collect up to + * **PERF_MAX_STACK_DEPTH** both kernel and user frames. Note that + * this limit can be controlled with the **sysctl** program, and + * that it should be manually increased in order to profile long + * user stacks (such as stacks for Java programs). To do so, use: + * + * :: + * + * # sysctl kernel.perf_event_max_stack= + * + * Returns + * The positive or null stack id on success, or a negative error + * in case of failure. + */ +static long (*bpf_get_stackid)(void *ctx, void *map, __u64 flags) = (void *) 27; + +/* + * bpf_csum_diff + * + * Compute a checksum difference, from the raw buffer pointed by + * *from*, of length *from_size* (that must be a multiple of 4), + * towards the raw buffer pointed by *to*, of size *to_size* + * (same remark). An optional *seed* can be added to the value + * (this can be cascaded, the seed may come from a previous call + * to the helper). + * + * This is flexible enough to be used in several ways: + * + * * With *from_size* == 0, *to_size* > 0 and *seed* set to + * checksum, it can be used when pushing new data. + * * With *from_size* > 0, *to_size* == 0 and *seed* set to + * checksum, it can be used when removing data from a packet. + * * With *from_size* > 0, *to_size* > 0 and *seed* set to 0, it + * can be used to compute a diff. Note that *from_size* and + * *to_size* do not need to be equal. + * + * This helper can be used in combination with + * **bpf_l3_csum_replace**\ () and **bpf_l4_csum_replace**\ (), to + * which one can feed in the difference computed with + * **bpf_csum_diff**\ (). + * + * Returns + * The checksum result, or a negative error code in case of + * failure. + */ +static __s64 (*bpf_csum_diff)(__be32 *from, __u32 from_size, __be32 *to, __u32 to_size, __wsum seed) = (void *) 28; + +/* + * bpf_skb_get_tunnel_opt + * + * Retrieve tunnel options metadata for the packet associated to + * *skb*, and store the raw tunnel option data to the buffer *opt* + * of *size*. + * + * This helper can be used with encapsulation devices that can + * operate in "collect metadata" mode (please refer to the related + * note in the description of **bpf_skb_get_tunnel_key**\ () for + * more details). A particular example where this can be used is + * in combination with the Geneve encapsulation protocol, where it + * allows for pushing (with **bpf_skb_get_tunnel_opt**\ () helper) + * and retrieving arbitrary TLVs (Type-Length-Value headers) from + * the eBPF program. This allows for full customization of these + * headers. + * + * Returns + * The size of the option data retrieved. + */ +static long (*bpf_skb_get_tunnel_opt)(struct __sk_buff *skb, void *opt, __u32 size) = (void *) 29; + +/* + * bpf_skb_set_tunnel_opt + * + * Set tunnel options metadata for the packet associated to *skb* + * to the option data contained in the raw buffer *opt* of *size*. + * + * See also the description of the **bpf_skb_get_tunnel_opt**\ () + * helper for additional information. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_set_tunnel_opt)(struct __sk_buff *skb, void *opt, __u32 size) = (void *) 30; + +/* + * bpf_skb_change_proto + * + * Change the protocol of the *skb* to *proto*. Currently + * supported are transition from IPv4 to IPv6, and from IPv6 to + * IPv4. The helper takes care of the groundwork for the + * transition, including resizing the socket buffer. The eBPF + * program is expected to fill the new headers, if any, via + * **skb_store_bytes**\ () and to recompute the checksums with + * **bpf_l3_csum_replace**\ () and **bpf_l4_csum_replace**\ + * (). The main case for this helper is to perform NAT64 + * operations out of an eBPF program. + * + * Internally, the GSO type is marked as dodgy so that headers are + * checked and segments are recalculated by the GSO/GRO engine. + * The size for GSO target is adapted as well. + * + * All values for *flags* are reserved for future usage, and must + * be left at zero. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_change_proto)(struct __sk_buff *skb, __be16 proto, __u64 flags) = (void *) 31; + +/* + * bpf_skb_change_type + * + * Change the packet type for the packet associated to *skb*. This + * comes down to setting *skb*\ **->pkt_type** to *type*, except + * the eBPF program does not have a write access to *skb*\ + * **->pkt_type** beside this helper. Using a helper here allows + * for graceful handling of errors. + * + * The major use case is to change incoming *skb*s to + * **PACKET_HOST** in a programmatic way instead of having to + * recirculate via **redirect**\ (..., **BPF_F_INGRESS**), for + * example. + * + * Note that *type* only allows certain values. At this time, they + * are: + * + * **PACKET_HOST** + * Packet is for us. + * **PACKET_BROADCAST** + * Send packet to all. + * **PACKET_MULTICAST** + * Send packet to group. + * **PACKET_OTHERHOST** + * Send packet to someone else. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_change_type)(struct __sk_buff *skb, __u32 type) = (void *) 32; + +/* + * bpf_skb_under_cgroup + * + * Check whether *skb* is a descendant of the cgroup2 held by + * *map* of type **BPF_MAP_TYPE_CGROUP_ARRAY**, at *index*. + * + * Returns + * The return value depends on the result of the test, and can be: + * + * * 0, if the *skb* failed the cgroup2 descendant test. + * * 1, if the *skb* succeeded the cgroup2 descendant test. + * * A negative error code, if an error occurred. + */ +static long (*bpf_skb_under_cgroup)(struct __sk_buff *skb, void *map, __u32 index) = (void *) 33; + +/* + * bpf_get_hash_recalc + * + * Retrieve the hash of the packet, *skb*\ **->hash**. If it is + * not set, in particular if the hash was cleared due to mangling, + * recompute this hash. Later accesses to the hash can be done + * directly with *skb*\ **->hash**. + * + * Calling **bpf_set_hash_invalid**\ (), changing a packet + * prototype with **bpf_skb_change_proto**\ (), or calling + * **bpf_skb_store_bytes**\ () with the + * **BPF_F_INVALIDATE_HASH** are actions susceptible to clear + * the hash and to trigger a new computation for the next call to + * **bpf_get_hash_recalc**\ (). + * + * Returns + * The 32-bit hash. + */ +static __u32 (*bpf_get_hash_recalc)(struct __sk_buff *skb) = (void *) 34; + +/* + * bpf_get_current_task + * + * + * Returns + * A pointer to the current task struct. + */ +static __u64 (*bpf_get_current_task)(void) = (void *) 35; + +/* + * bpf_probe_write_user + * + * Attempt in a safe way to write *len* bytes from the buffer + * *src* to *dst* in memory. It only works for threads that are in + * user context, and *dst* must be a valid user space address. + * + * This helper should not be used to implement any kind of + * security mechanism because of TOC-TOU attacks, but rather to + * debug, divert, and manipulate execution of semi-cooperative + * processes. + * + * Keep in mind that this feature is meant for experiments, and it + * has a risk of crashing the system and running programs. + * Therefore, when an eBPF program using this helper is attached, + * a warning including PID and process name is printed to kernel + * logs. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_probe_write_user)(void *dst, const void *src, __u32 len) = (void *) 36; + +/* + * bpf_current_task_under_cgroup + * + * Check whether the probe is being run is the context of a given + * subset of the cgroup2 hierarchy. The cgroup2 to test is held by + * *map* of type **BPF_MAP_TYPE_CGROUP_ARRAY**, at *index*. + * + * Returns + * The return value depends on the result of the test, and can be: + * + * * 0, if current task belongs to the cgroup2. + * * 1, if current task does not belong to the cgroup2. + * * A negative error code, if an error occurred. + */ +static long (*bpf_current_task_under_cgroup)(void *map, __u32 index) = (void *) 37; + +/* + * bpf_skb_change_tail + * + * Resize (trim or grow) the packet associated to *skb* to the + * new *len*. The *flags* are reserved for future usage, and must + * be left at zero. + * + * The basic idea is that the helper performs the needed work to + * change the size of the packet, then the eBPF program rewrites + * the rest via helpers like **bpf_skb_store_bytes**\ (), + * **bpf_l3_csum_replace**\ (), **bpf_l3_csum_replace**\ () + * and others. This helper is a slow path utility intended for + * replies with control messages. And because it is targeted for + * slow path, the helper itself can afford to be slow: it + * implicitly linearizes, unclones and drops offloads from the + * *skb*. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_change_tail)(struct __sk_buff *skb, __u32 len, __u64 flags) = (void *) 38; + +/* + * bpf_skb_pull_data + * + * Pull in non-linear data in case the *skb* is non-linear and not + * all of *len* are part of the linear section. Make *len* bytes + * from *skb* readable and writable. If a zero value is passed for + * *len*, then the whole length of the *skb* is pulled. + * + * This helper is only needed for reading and writing with direct + * packet access. + * + * For direct packet access, testing that offsets to access + * are within packet boundaries (test on *skb*\ **->data_end**) is + * susceptible to fail if offsets are invalid, or if the requested + * data is in non-linear parts of the *skb*. On failure the + * program can just bail out, or in the case of a non-linear + * buffer, use a helper to make the data available. The + * **bpf_skb_load_bytes**\ () helper is a first solution to access + * the data. Another one consists in using **bpf_skb_pull_data** + * to pull in once the non-linear parts, then retesting and + * eventually access the data. + * + * At the same time, this also makes sure the *skb* is uncloned, + * which is a necessary condition for direct write. As this needs + * to be an invariant for the write part only, the verifier + * detects writes and adds a prologue that is calling + * **bpf_skb_pull_data()** to effectively unclone the *skb* from + * the very beginning in case it is indeed cloned. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_pull_data)(struct __sk_buff *skb, __u32 len) = (void *) 39; + +/* + * bpf_csum_update + * + * Add the checksum *csum* into *skb*\ **->csum** in case the + * driver has supplied a checksum for the entire packet into that + * field. Return an error otherwise. This helper is intended to be + * used in combination with **bpf_csum_diff**\ (), in particular + * when the checksum needs to be updated after data has been + * written into the packet through direct packet access. + * + * Returns + * The checksum on success, or a negative error code in case of + * failure. + */ +static __s64 (*bpf_csum_update)(struct __sk_buff *skb, __wsum csum) = (void *) 40; + +/* + * bpf_set_hash_invalid + * + * Invalidate the current *skb*\ **->hash**. It can be used after + * mangling on headers through direct packet access, in order to + * indicate that the hash is outdated and to trigger a + * recalculation the next time the kernel tries to access this + * hash or when the **bpf_get_hash_recalc**\ () helper is called. + * + */ +static void (*bpf_set_hash_invalid)(struct __sk_buff *skb) = (void *) 41; + +/* + * bpf_get_numa_node_id + * + * Return the id of the current NUMA node. The primary use case + * for this helper is the selection of sockets for the local NUMA + * node, when the program is attached to sockets using the + * **SO_ATTACH_REUSEPORT_EBPF** option (see also **socket(7)**), + * but the helper is also available to other eBPF program types, + * similarly to **bpf_get_smp_processor_id**\ (). + * + * Returns + * The id of current NUMA node. + */ +static long (*bpf_get_numa_node_id)(void) = (void *) 42; + +/* + * bpf_skb_change_head + * + * Grows headroom of packet associated to *skb* and adjusts the + * offset of the MAC header accordingly, adding *len* bytes of + * space. It automatically extends and reallocates memory as + * required. + * + * This helper can be used on a layer 3 *skb* to push a MAC header + * for redirection into a layer 2 device. + * + * All values for *flags* are reserved for future usage, and must + * be left at zero. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_change_head)(struct __sk_buff *skb, __u32 len, __u64 flags) = (void *) 43; + +/* + * bpf_xdp_adjust_head + * + * Adjust (move) *xdp_md*\ **->data** by *delta* bytes. Note that + * it is possible to use a negative value for *delta*. This helper + * can be used to prepare the packet for pushing or popping + * headers. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_xdp_adjust_head)(struct xdp_md *xdp_md, int delta) = (void *) 44; + +/* + * bpf_probe_read_str + * + * Copy a NUL terminated string from an unsafe kernel address + * *unsafe_ptr* to *dst*. See **bpf_probe_read_kernel_str**\ () for + * more details. + * + * Generally, use **bpf_probe_read_user_str**\ () or + * **bpf_probe_read_kernel_str**\ () instead. + * + * Returns + * On success, the strictly positive length of the string, + * including the trailing NUL character. On error, a negative + * value. + */ +static long (*bpf_probe_read_str)(void *dst, __u32 size, const void *unsafe_ptr) = (void *) 45; + +/* + * bpf_get_socket_cookie + * + * If the **struct sk_buff** pointed by *skb* has a known socket, + * retrieve the cookie (generated by the kernel) of this socket. + * If no cookie has been set yet, generate a new cookie. Once + * generated, the socket cookie remains stable for the life of the + * socket. This helper can be useful for monitoring per socket + * networking traffic statistics as it provides a global socket + * identifier that can be assumed unique. + * + * Returns + * A 8-byte long unique number on success, or 0 if the socket + * field is missing inside *skb*. + */ +static __u64 (*bpf_get_socket_cookie)(void *ctx) = (void *) 46; + +/* + * bpf_get_socket_uid + * + * + * Returns + * The owner UID of the socket associated to *skb*. If the socket + * is **NULL**, or if it is not a full socket (i.e. if it is a + * time-wait or a request socket instead), **overflowuid** value + * is returned (note that **overflowuid** might also be the actual + * UID value for the socket). + */ +static __u32 (*bpf_get_socket_uid)(struct __sk_buff *skb) = (void *) 47; + +/* + * bpf_set_hash + * + * Set the full hash for *skb* (set the field *skb*\ **->hash**) + * to value *hash*. + * + * Returns + * 0 + */ +static long (*bpf_set_hash)(struct __sk_buff *skb, __u32 hash) = (void *) 48; + +/* + * bpf_setsockopt + * + * Emulate a call to **setsockopt()** on the socket associated to + * *bpf_socket*, which must be a full socket. The *level* at + * which the option resides and the name *optname* of the option + * must be specified, see **setsockopt(2)** for more information. + * The option value of length *optlen* is pointed by *optval*. + * + * *bpf_socket* should be one of the following: + * + * * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**. + * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT** + * and **BPF_CGROUP_INET6_CONNECT**. + * + * This helper actually implements a subset of **setsockopt()**. + * It supports the following *level*\ s: + * + * * **SOL_SOCKET**, which supports the following *optname*\ s: + * **SO_RCVBUF**, **SO_SNDBUF**, **SO_MAX_PACING_RATE**, + * **SO_PRIORITY**, **SO_RCVLOWAT**, **SO_MARK**, + * **SO_BINDTODEVICE**, **SO_KEEPALIVE**. + * * **IPPROTO_TCP**, which supports the following *optname*\ s: + * **TCP_CONGESTION**, **TCP_BPF_IW**, + * **TCP_BPF_SNDCWND_CLAMP**, **TCP_SAVE_SYN**, + * **TCP_KEEPIDLE**, **TCP_KEEPINTVL**, **TCP_KEEPCNT**, + * **TCP_SYNCNT**, **TCP_USER_TIMEOUT**, **TCP_NOTSENT_LOWAT**. + * * **IPPROTO_IP**, which supports *optname* **IP_TOS**. + * * **IPPROTO_IPV6**, which supports *optname* **IPV6_TCLASS**. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_setsockopt)(void *bpf_socket, int level, int optname, void *optval, int optlen) = (void *) 49; + +/* + * bpf_skb_adjust_room + * + * Grow or shrink the room for data in the packet associated to + * *skb* by *len_diff*, and according to the selected *mode*. + * + * By default, the helper will reset any offloaded checksum + * indicator of the skb to CHECKSUM_NONE. This can be avoided + * by the following flag: + * + * * **BPF_F_ADJ_ROOM_NO_CSUM_RESET**: Do not reset offloaded + * checksum data of the skb to CHECKSUM_NONE. + * + * There are two supported modes at this time: + * + * * **BPF_ADJ_ROOM_MAC**: Adjust room at the mac layer + * (room space is added or removed below the layer 2 header). + * + * * **BPF_ADJ_ROOM_NET**: Adjust room at the network layer + * (room space is added or removed below the layer 3 header). + * + * The following flags are supported at this time: + * + * * **BPF_F_ADJ_ROOM_FIXED_GSO**: Do not adjust gso_size. + * Adjusting mss in this way is not allowed for datagrams. + * + * * **BPF_F_ADJ_ROOM_ENCAP_L3_IPV4**, + * **BPF_F_ADJ_ROOM_ENCAP_L3_IPV6**: + * Any new space is reserved to hold a tunnel header. + * Configure skb offsets and other fields accordingly. + * + * * **BPF_F_ADJ_ROOM_ENCAP_L4_GRE**, + * **BPF_F_ADJ_ROOM_ENCAP_L4_UDP**: + * Use with ENCAP_L3 flags to further specify the tunnel type. + * + * * **BPF_F_ADJ_ROOM_ENCAP_L2**\ (*len*): + * Use with ENCAP_L3/L4 flags to further specify the tunnel + * type; *len* is the length of the inner MAC header. + * + * * **BPF_F_ADJ_ROOM_ENCAP_L2_ETH**: + * Use with BPF_F_ADJ_ROOM_ENCAP_L2 flag to further specify the + * L2 type as Ethernet. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_adjust_room)(struct __sk_buff *skb, __s32 len_diff, __u32 mode, __u64 flags) = (void *) 50; + +/* + * bpf_redirect_map + * + * Redirect the packet to the endpoint referenced by *map* at + * index *key*. Depending on its type, this *map* can contain + * references to net devices (for forwarding packets through other + * ports), or to CPUs (for redirecting XDP frames to another CPU; + * but this is only implemented for native XDP (with driver + * support) as of this writing). + * + * The lower two bits of *flags* are used as the return code if + * the map lookup fails. This is so that the return value can be + * one of the XDP program return codes up to **XDP_TX**, as chosen + * by the caller. The higher bits of *flags* can be set to + * BPF_F_BROADCAST or BPF_F_EXCLUDE_INGRESS as defined below. + * + * With BPF_F_BROADCAST the packet will be broadcasted to all the + * interfaces in the map, with BPF_F_EXCLUDE_INGRESS the ingress + * interface will be excluded when do broadcasting. + * + * See also **bpf_redirect**\ (), which only supports redirecting + * to an ifindex, but doesn't require a map to do so. + * + * Returns + * **XDP_REDIRECT** on success, or the value of the two lower bits + * of the *flags* argument on error. + */ +static long (*bpf_redirect_map)(void *map, __u32 key, __u64 flags) = (void *) 51; + +/* + * bpf_sk_redirect_map + * + * Redirect the packet to the socket referenced by *map* (of type + * **BPF_MAP_TYPE_SOCKMAP**) at index *key*. Both ingress and + * egress interfaces can be used for redirection. The + * **BPF_F_INGRESS** value in *flags* is used to make the + * distinction (ingress path is selected if the flag is present, + * egress path otherwise). This is the only flag supported for now. + * + * Returns + * **SK_PASS** on success, or **SK_DROP** on error. + */ +static long (*bpf_sk_redirect_map)(struct __sk_buff *skb, void *map, __u32 key, __u64 flags) = (void *) 52; + +/* + * bpf_sock_map_update + * + * Add an entry to, or update a *map* referencing sockets. The + * *skops* is used as a new value for the entry associated to + * *key*. *flags* is one of: + * + * **BPF_NOEXIST** + * The entry for *key* must not exist in the map. + * **BPF_EXIST** + * The entry for *key* must already exist in the map. + * **BPF_ANY** + * No condition on the existence of the entry for *key*. + * + * If the *map* has eBPF programs (parser and verdict), those will + * be inherited by the socket being added. If the socket is + * already attached to eBPF programs, this results in an error. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_sock_map_update)(struct bpf_sock_ops *skops, void *map, void *key, __u64 flags) = (void *) 53; + +/* + * bpf_xdp_adjust_meta + * + * Adjust the address pointed by *xdp_md*\ **->data_meta** by + * *delta* (which can be positive or negative). Note that this + * operation modifies the address stored in *xdp_md*\ **->data**, + * so the latter must be loaded only after the helper has been + * called. + * + * The use of *xdp_md*\ **->data_meta** is optional and programs + * are not required to use it. The rationale is that when the + * packet is processed with XDP (e.g. as DoS filter), it is + * possible to push further meta data along with it before passing + * to the stack, and to give the guarantee that an ingress eBPF + * program attached as a TC classifier on the same device can pick + * this up for further post-processing. Since TC works with socket + * buffers, it remains possible to set from XDP the **mark** or + * **priority** pointers, or other pointers for the socket buffer. + * Having this scratch space generic and programmable allows for + * more flexibility as the user is free to store whatever meta + * data they need. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_xdp_adjust_meta)(struct xdp_md *xdp_md, int delta) = (void *) 54; + +/* + * bpf_perf_event_read_value + * + * Read the value of a perf event counter, and store it into *buf* + * of size *buf_size*. This helper relies on a *map* of type + * **BPF_MAP_TYPE_PERF_EVENT_ARRAY**. The nature of the perf event + * counter is selected when *map* is updated with perf event file + * descriptors. The *map* is an array whose size is the number of + * available CPUs, and each cell contains a value relative to one + * CPU. The value to retrieve is indicated by *flags*, that + * contains the index of the CPU to look up, masked with + * **BPF_F_INDEX_MASK**. Alternatively, *flags* can be set to + * **BPF_F_CURRENT_CPU** to indicate that the value for the + * current CPU should be retrieved. + * + * This helper behaves in a way close to + * **bpf_perf_event_read**\ () helper, save that instead of + * just returning the value observed, it fills the *buf* + * structure. This allows for additional data to be retrieved: in + * particular, the enabled and running times (in *buf*\ + * **->enabled** and *buf*\ **->running**, respectively) are + * copied. In general, **bpf_perf_event_read_value**\ () is + * recommended over **bpf_perf_event_read**\ (), which has some + * ABI issues and provides fewer functionalities. + * + * These values are interesting, because hardware PMU (Performance + * Monitoring Unit) counters are limited resources. When there are + * more PMU based perf events opened than available counters, + * kernel will multiplex these events so each event gets certain + * percentage (but not all) of the PMU time. In case that + * multiplexing happens, the number of samples or counter value + * will not reflect the case compared to when no multiplexing + * occurs. This makes comparison between different runs difficult. + * Typically, the counter value should be normalized before + * comparing to other experiments. The usual normalization is done + * as follows. + * + * :: + * + * normalized_counter = counter * t_enabled / t_running + * + * Where t_enabled is the time enabled for event and t_running is + * the time running for event since last normalization. The + * enabled and running times are accumulated since the perf event + * open. To achieve scaling factor between two invocations of an + * eBPF program, users can use CPU id as the key (which is + * typical for perf array usage model) to remember the previous + * value and do the calculation inside the eBPF program. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_perf_event_read_value)(void *map, __u64 flags, struct bpf_perf_event_value *buf, __u32 buf_size) = (void *) 55; + +/* + * bpf_perf_prog_read_value + * + * For en eBPF program attached to a perf event, retrieve the + * value of the event counter associated to *ctx* and store it in + * the structure pointed by *buf* and of size *buf_size*. Enabled + * and running times are also stored in the structure (see + * description of helper **bpf_perf_event_read_value**\ () for + * more details). + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_perf_prog_read_value)(struct bpf_perf_event_data *ctx, struct bpf_perf_event_value *buf, __u32 buf_size) = (void *) 56; + +/* + * bpf_getsockopt + * + * Emulate a call to **getsockopt()** on the socket associated to + * *bpf_socket*, which must be a full socket. The *level* at + * which the option resides and the name *optname* of the option + * must be specified, see **getsockopt(2)** for more information. + * The retrieved value is stored in the structure pointed by + * *opval* and of length *optlen*. + * + * *bpf_socket* should be one of the following: + * + * * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**. + * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT** + * and **BPF_CGROUP_INET6_CONNECT**. + * + * This helper actually implements a subset of **getsockopt()**. + * It supports the following *level*\ s: + * + * * **IPPROTO_TCP**, which supports *optname* + * **TCP_CONGESTION**. + * * **IPPROTO_IP**, which supports *optname* **IP_TOS**. + * * **IPPROTO_IPV6**, which supports *optname* **IPV6_TCLASS**. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_getsockopt)(void *bpf_socket, int level, int optname, void *optval, int optlen) = (void *) 57; + +/* + * bpf_override_return + * + * Used for error injection, this helper uses kprobes to override + * the return value of the probed function, and to set it to *rc*. + * The first argument is the context *regs* on which the kprobe + * works. + * + * This helper works by setting the PC (program counter) + * to an override function which is run in place of the original + * probed function. This means the probed function is not run at + * all. The replacement function just returns with the required + * value. + * + * This helper has security implications, and thus is subject to + * restrictions. It is only available if the kernel was compiled + * with the **CONFIG_BPF_KPROBE_OVERRIDE** configuration + * option, and in this case it only works on functions tagged with + * **ALLOW_ERROR_INJECTION** in the kernel code. + * + * Also, the helper is only available for the architectures having + * the CONFIG_FUNCTION_ERROR_INJECTION option. As of this writing, + * x86 architecture is the only one to support this feature. + * + * Returns + * 0 + */ +static long (*bpf_override_return)(struct pt_regs *regs, __u64 rc) = (void *) 58; + +/* + * bpf_sock_ops_cb_flags_set + * + * Attempt to set the value of the **bpf_sock_ops_cb_flags** field + * for the full TCP socket associated to *bpf_sock_ops* to + * *argval*. + * + * The primary use of this field is to determine if there should + * be calls to eBPF programs of type + * **BPF_PROG_TYPE_SOCK_OPS** at various points in the TCP + * code. A program of the same type can change its value, per + * connection and as necessary, when the connection is + * established. This field is directly accessible for reading, but + * this helper must be used for updates in order to return an + * error if an eBPF program tries to set a callback that is not + * supported in the current kernel. + * + * *argval* is a flag array which can combine these flags: + * + * * **BPF_SOCK_OPS_RTO_CB_FLAG** (retransmission time out) + * * **BPF_SOCK_OPS_RETRANS_CB_FLAG** (retransmission) + * * **BPF_SOCK_OPS_STATE_CB_FLAG** (TCP state change) + * * **BPF_SOCK_OPS_RTT_CB_FLAG** (every RTT) + * + * Therefore, this function can be used to clear a callback flag by + * setting the appropriate bit to zero. e.g. to disable the RTO + * callback: + * + * **bpf_sock_ops_cb_flags_set(bpf_sock,** + * **bpf_sock->bpf_sock_ops_cb_flags & ~BPF_SOCK_OPS_RTO_CB_FLAG)** + * + * Here are some examples of where one could call such eBPF + * program: + * + * * When RTO fires. + * * When a packet is retransmitted. + * * When the connection terminates. + * * When a packet is sent. + * * When a packet is received. + * + * Returns + * Code **-EINVAL** if the socket is not a full TCP socket; + * otherwise, a positive number containing the bits that could not + * be set is returned (which comes down to 0 if all bits were set + * as required). + */ +static long (*bpf_sock_ops_cb_flags_set)(struct bpf_sock_ops *bpf_sock, int argval) = (void *) 59; + +/* + * bpf_msg_redirect_map + * + * This helper is used in programs implementing policies at the + * socket level. If the message *msg* is allowed to pass (i.e. if + * the verdict eBPF program returns **SK_PASS**), redirect it to + * the socket referenced by *map* (of type + * **BPF_MAP_TYPE_SOCKMAP**) at index *key*. Both ingress and + * egress interfaces can be used for redirection. The + * **BPF_F_INGRESS** value in *flags* is used to make the + * distinction (ingress path is selected if the flag is present, + * egress path otherwise). This is the only flag supported for now. + * + * Returns + * **SK_PASS** on success, or **SK_DROP** on error. + */ +static long (*bpf_msg_redirect_map)(struct sk_msg_md *msg, void *map, __u32 key, __u64 flags) = (void *) 60; + +/* + * bpf_msg_apply_bytes + * + * For socket policies, apply the verdict of the eBPF program to + * the next *bytes* (number of bytes) of message *msg*. + * + * For example, this helper can be used in the following cases: + * + * * A single **sendmsg**\ () or **sendfile**\ () system call + * contains multiple logical messages that the eBPF program is + * supposed to read and for which it should apply a verdict. + * * An eBPF program only cares to read the first *bytes* of a + * *msg*. If the message has a large payload, then setting up + * and calling the eBPF program repeatedly for all bytes, even + * though the verdict is already known, would create unnecessary + * overhead. + * + * When called from within an eBPF program, the helper sets a + * counter internal to the BPF infrastructure, that is used to + * apply the last verdict to the next *bytes*. If *bytes* is + * smaller than the current data being processed from a + * **sendmsg**\ () or **sendfile**\ () system call, the first + * *bytes* will be sent and the eBPF program will be re-run with + * the pointer for start of data pointing to byte number *bytes* + * **+ 1**. If *bytes* is larger than the current data being + * processed, then the eBPF verdict will be applied to multiple + * **sendmsg**\ () or **sendfile**\ () calls until *bytes* are + * consumed. + * + * Note that if a socket closes with the internal counter holding + * a non-zero value, this is not a problem because data is not + * being buffered for *bytes* and is sent as it is received. + * + * Returns + * 0 + */ +static long (*bpf_msg_apply_bytes)(struct sk_msg_md *msg, __u32 bytes) = (void *) 61; + +/* + * bpf_msg_cork_bytes + * + * For socket policies, prevent the execution of the verdict eBPF + * program for message *msg* until *bytes* (byte number) have been + * accumulated. + * + * This can be used when one needs a specific number of bytes + * before a verdict can be assigned, even if the data spans + * multiple **sendmsg**\ () or **sendfile**\ () calls. The extreme + * case would be a user calling **sendmsg**\ () repeatedly with + * 1-byte long message segments. Obviously, this is bad for + * performance, but it is still valid. If the eBPF program needs + * *bytes* bytes to validate a header, this helper can be used to + * prevent the eBPF program to be called again until *bytes* have + * been accumulated. + * + * Returns + * 0 + */ +static long (*bpf_msg_cork_bytes)(struct sk_msg_md *msg, __u32 bytes) = (void *) 62; + +/* + * bpf_msg_pull_data + * + * For socket policies, pull in non-linear data from user space + * for *msg* and set pointers *msg*\ **->data** and *msg*\ + * **->data_end** to *start* and *end* bytes offsets into *msg*, + * respectively. + * + * If a program of type **BPF_PROG_TYPE_SK_MSG** is run on a + * *msg* it can only parse data that the (**data**, **data_end**) + * pointers have already consumed. For **sendmsg**\ () hooks this + * is likely the first scatterlist element. But for calls relying + * on the **sendpage** handler (e.g. **sendfile**\ ()) this will + * be the range (**0**, **0**) because the data is shared with + * user space and by default the objective is to avoid allowing + * user space to modify data while (or after) eBPF verdict is + * being decided. This helper can be used to pull in data and to + * set the start and end pointer to given values. Data will be + * copied if necessary (i.e. if data was not linear and if start + * and end pointers do not point to the same chunk). + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * All values for *flags* are reserved for future usage, and must + * be left at zero. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_msg_pull_data)(struct sk_msg_md *msg, __u32 start, __u32 end, __u64 flags) = (void *) 63; + +/* + * bpf_bind + * + * Bind the socket associated to *ctx* to the address pointed by + * *addr*, of length *addr_len*. This allows for making outgoing + * connection from the desired IP address, which can be useful for + * example when all processes inside a cgroup should use one + * single IP address on a host that has multiple IP configured. + * + * This helper works for IPv4 and IPv6, TCP and UDP sockets. The + * domain (*addr*\ **->sa_family**) must be **AF_INET** (or + * **AF_INET6**). It's advised to pass zero port (**sin_port** + * or **sin6_port**) which triggers IP_BIND_ADDRESS_NO_PORT-like + * behavior and lets the kernel efficiently pick up an unused + * port as long as 4-tuple is unique. Passing non-zero port might + * lead to degraded performance. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_bind)(struct bpf_sock_addr *ctx, struct sockaddr *addr, int addr_len) = (void *) 64; + +/* + * bpf_xdp_adjust_tail + * + * Adjust (move) *xdp_md*\ **->data_end** by *delta* bytes. It is + * possible to both shrink and grow the packet tail. + * Shrink done via *delta* being a negative integer. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_xdp_adjust_tail)(struct xdp_md *xdp_md, int delta) = (void *) 65; + +/* + * bpf_skb_get_xfrm_state + * + * Retrieve the XFRM state (IP transform framework, see also + * **ip-xfrm(8)**) at *index* in XFRM "security path" for *skb*. + * + * The retrieved value is stored in the **struct bpf_xfrm_state** + * pointed by *xfrm_state* and of length *size*. + * + * All values for *flags* are reserved for future usage, and must + * be left at zero. + * + * This helper is available only if the kernel was compiled with + * **CONFIG_XFRM** configuration option. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_get_xfrm_state)(struct __sk_buff *skb, __u32 index, struct bpf_xfrm_state *xfrm_state, __u32 size, __u64 flags) = (void *) 66; + +/* + * bpf_get_stack + * + * Return a user or a kernel stack in bpf program provided buffer. + * To achieve this, the helper needs *ctx*, which is a pointer + * to the context on which the tracing program is executed. + * To store the stacktrace, the bpf program provides *buf* with + * a nonnegative *size*. + * + * The last argument, *flags*, holds the number of stack frames to + * skip (from 0 to 255), masked with + * **BPF_F_SKIP_FIELD_MASK**. The next bits can be used to set + * the following flags: + * + * **BPF_F_USER_STACK** + * Collect a user space stack instead of a kernel stack. + * **BPF_F_USER_BUILD_ID** + * Collect buildid+offset instead of ips for user stack, + * only valid if **BPF_F_USER_STACK** is also specified. + * + * **bpf_get_stack**\ () can collect up to + * **PERF_MAX_STACK_DEPTH** both kernel and user frames, subject + * to sufficient large buffer size. Note that + * this limit can be controlled with the **sysctl** program, and + * that it should be manually increased in order to profile long + * user stacks (such as stacks for Java programs). To do so, use: + * + * :: + * + * # sysctl kernel.perf_event_max_stack= + * + * Returns + * A non-negative value equal to or less than *size* on success, + * or a negative error in case of failure. + */ +static long (*bpf_get_stack)(void *ctx, void *buf, __u32 size, __u64 flags) = (void *) 67; + +/* + * bpf_skb_load_bytes_relative + * + * This helper is similar to **bpf_skb_load_bytes**\ () in that + * it provides an easy way to load *len* bytes from *offset* + * from the packet associated to *skb*, into the buffer pointed + * by *to*. The difference to **bpf_skb_load_bytes**\ () is that + * a fifth argument *start_header* exists in order to select a + * base offset to start from. *start_header* can be one of: + * + * **BPF_HDR_START_MAC** + * Base offset to load data from is *skb*'s mac header. + * **BPF_HDR_START_NET** + * Base offset to load data from is *skb*'s network header. + * + * In general, "direct packet access" is the preferred method to + * access packet data, however, this helper is in particular useful + * in socket filters where *skb*\ **->data** does not always point + * to the start of the mac header and where "direct packet access" + * is not available. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_load_bytes_relative)(const void *skb, __u32 offset, void *to, __u32 len, __u32 start_header) = (void *) 68; + +/* + * bpf_fib_lookup + * + * Do FIB lookup in kernel tables using parameters in *params*. + * If lookup is successful and result shows packet is to be + * forwarded, the neighbor tables are searched for the nexthop. + * If successful (ie., FIB lookup shows forwarding and nexthop + * is resolved), the nexthop address is returned in ipv4_dst + * or ipv6_dst based on family, smac is set to mac address of + * egress device, dmac is set to nexthop mac address, rt_metric + * is set to metric from route (IPv4/IPv6 only), and ifindex + * is set to the device index of the nexthop from the FIB lookup. + * + * *plen* argument is the size of the passed in struct. + * *flags* argument can be a combination of one or more of the + * following values: + * + * **BPF_FIB_LOOKUP_DIRECT** + * Do a direct table lookup vs full lookup using FIB + * rules. + * **BPF_FIB_LOOKUP_OUTPUT** + * Perform lookup from an egress perspective (default is + * ingress). + * + * *ctx* is either **struct xdp_md** for XDP programs or + * **struct sk_buff** tc cls_act programs. + * + * Returns + * * < 0 if any input argument is invalid + * * 0 on success (packet is forwarded, nexthop neighbor exists) + * * > 0 one of **BPF_FIB_LKUP_RET_** codes explaining why the + * packet is not forwarded or needs assist from full stack + * + * If lookup fails with BPF_FIB_LKUP_RET_FRAG_NEEDED, then the MTU + * was exceeded and output params->mtu_result contains the MTU. + */ +static long (*bpf_fib_lookup)(void *ctx, struct bpf_fib_lookup *params, int plen, __u32 flags) = (void *) 69; + +/* + * bpf_sock_hash_update + * + * Add an entry to, or update a sockhash *map* referencing sockets. + * The *skops* is used as a new value for the entry associated to + * *key*. *flags* is one of: + * + * **BPF_NOEXIST** + * The entry for *key* must not exist in the map. + * **BPF_EXIST** + * The entry for *key* must already exist in the map. + * **BPF_ANY** + * No condition on the existence of the entry for *key*. + * + * If the *map* has eBPF programs (parser and verdict), those will + * be inherited by the socket being added. If the socket is + * already attached to eBPF programs, this results in an error. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_sock_hash_update)(struct bpf_sock_ops *skops, void *map, void *key, __u64 flags) = (void *) 70; + +/* + * bpf_msg_redirect_hash + * + * This helper is used in programs implementing policies at the + * socket level. If the message *msg* is allowed to pass (i.e. if + * the verdict eBPF program returns **SK_PASS**), redirect it to + * the socket referenced by *map* (of type + * **BPF_MAP_TYPE_SOCKHASH**) using hash *key*. Both ingress and + * egress interfaces can be used for redirection. The + * **BPF_F_INGRESS** value in *flags* is used to make the + * distinction (ingress path is selected if the flag is present, + * egress path otherwise). This is the only flag supported for now. + * + * Returns + * **SK_PASS** on success, or **SK_DROP** on error. + */ +static long (*bpf_msg_redirect_hash)(struct sk_msg_md *msg, void *map, void *key, __u64 flags) = (void *) 71; + +/* + * bpf_sk_redirect_hash + * + * This helper is used in programs implementing policies at the + * skb socket level. If the sk_buff *skb* is allowed to pass (i.e. + * if the verdict eBPF program returns **SK_PASS**), redirect it + * to the socket referenced by *map* (of type + * **BPF_MAP_TYPE_SOCKHASH**) using hash *key*. Both ingress and + * egress interfaces can be used for redirection. The + * **BPF_F_INGRESS** value in *flags* is used to make the + * distinction (ingress path is selected if the flag is present, + * egress otherwise). This is the only flag supported for now. + * + * Returns + * **SK_PASS** on success, or **SK_DROP** on error. + */ +static long (*bpf_sk_redirect_hash)(struct __sk_buff *skb, void *map, void *key, __u64 flags) = (void *) 72; + +/* + * bpf_lwt_push_encap + * + * Encapsulate the packet associated to *skb* within a Layer 3 + * protocol header. This header is provided in the buffer at + * address *hdr*, with *len* its size in bytes. *type* indicates + * the protocol of the header and can be one of: + * + * **BPF_LWT_ENCAP_SEG6** + * IPv6 encapsulation with Segment Routing Header + * (**struct ipv6_sr_hdr**). *hdr* only contains the SRH, + * the IPv6 header is computed by the kernel. + * **BPF_LWT_ENCAP_SEG6_INLINE** + * Only works if *skb* contains an IPv6 packet. Insert a + * Segment Routing Header (**struct ipv6_sr_hdr**) inside + * the IPv6 header. + * **BPF_LWT_ENCAP_IP** + * IP encapsulation (GRE/GUE/IPIP/etc). The outer header + * must be IPv4 or IPv6, followed by zero or more + * additional headers, up to **LWT_BPF_MAX_HEADROOM** + * total bytes in all prepended headers. Please note that + * if **skb_is_gso**\ (*skb*) is true, no more than two + * headers can be prepended, and the inner header, if + * present, should be either GRE or UDP/GUE. + * + * **BPF_LWT_ENCAP_SEG6**\ \* types can be called by BPF programs + * of type **BPF_PROG_TYPE_LWT_IN**; **BPF_LWT_ENCAP_IP** type can + * be called by bpf programs of types **BPF_PROG_TYPE_LWT_IN** and + * **BPF_PROG_TYPE_LWT_XMIT**. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_lwt_push_encap)(struct __sk_buff *skb, __u32 type, void *hdr, __u32 len) = (void *) 73; + +/* + * bpf_lwt_seg6_store_bytes + * + * Store *len* bytes from address *from* into the packet + * associated to *skb*, at *offset*. Only the flags, tag and TLVs + * inside the outermost IPv6 Segment Routing Header can be + * modified through this helper. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_lwt_seg6_store_bytes)(struct __sk_buff *skb, __u32 offset, const void *from, __u32 len) = (void *) 74; + +/* + * bpf_lwt_seg6_adjust_srh + * + * Adjust the size allocated to TLVs in the outermost IPv6 + * Segment Routing Header contained in the packet associated to + * *skb*, at position *offset* by *delta* bytes. Only offsets + * after the segments are accepted. *delta* can be as well + * positive (growing) as negative (shrinking). + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_lwt_seg6_adjust_srh)(struct __sk_buff *skb, __u32 offset, __s32 delta) = (void *) 75; + +/* + * bpf_lwt_seg6_action + * + * Apply an IPv6 Segment Routing action of type *action* to the + * packet associated to *skb*. Each action takes a parameter + * contained at address *param*, and of length *param_len* bytes. + * *action* can be one of: + * + * **SEG6_LOCAL_ACTION_END_X** + * End.X action: Endpoint with Layer-3 cross-connect. + * Type of *param*: **struct in6_addr**. + * **SEG6_LOCAL_ACTION_END_T** + * End.T action: Endpoint with specific IPv6 table lookup. + * Type of *param*: **int**. + * **SEG6_LOCAL_ACTION_END_B6** + * End.B6 action: Endpoint bound to an SRv6 policy. + * Type of *param*: **struct ipv6_sr_hdr**. + * **SEG6_LOCAL_ACTION_END_B6_ENCAP** + * End.B6.Encap action: Endpoint bound to an SRv6 + * encapsulation policy. + * Type of *param*: **struct ipv6_sr_hdr**. + * + * A call to this helper is susceptible to change the underlying + * packet buffer. Therefore, at load time, all checks on pointers + * previously done by the verifier are invalidated and must be + * performed again, if the helper is used in combination with + * direct packet access. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_lwt_seg6_action)(struct __sk_buff *skb, __u32 action, void *param, __u32 param_len) = (void *) 76; + +/* + * bpf_rc_repeat + * + * This helper is used in programs implementing IR decoding, to + * report a successfully decoded repeat key message. This delays + * the generation of a key up event for previously generated + * key down event. + * + * Some IR protocols like NEC have a special IR message for + * repeating last button, for when a button is held down. + * + * The *ctx* should point to the lirc sample as passed into + * the program. + * + * This helper is only available is the kernel was compiled with + * the **CONFIG_BPF_LIRC_MODE2** configuration option set to + * "**y**". + * + * Returns + * 0 + */ +static long (*bpf_rc_repeat)(void *ctx) = (void *) 77; + +/* + * bpf_rc_keydown + * + * This helper is used in programs implementing IR decoding, to + * report a successfully decoded key press with *scancode*, + * *toggle* value in the given *protocol*. The scancode will be + * translated to a keycode using the rc keymap, and reported as + * an input key down event. After a period a key up event is + * generated. This period can be extended by calling either + * **bpf_rc_keydown**\ () again with the same values, or calling + * **bpf_rc_repeat**\ (). + * + * Some protocols include a toggle bit, in case the button was + * released and pressed again between consecutive scancodes. + * + * The *ctx* should point to the lirc sample as passed into + * the program. + * + * The *protocol* is the decoded protocol number (see + * **enum rc_proto** for some predefined values). + * + * This helper is only available is the kernel was compiled with + * the **CONFIG_BPF_LIRC_MODE2** configuration option set to + * "**y**". + * + * Returns + * 0 + */ +static long (*bpf_rc_keydown)(void *ctx, __u32 protocol, __u64 scancode, __u32 toggle) = (void *) 78; + +/* + * bpf_skb_cgroup_id + * + * Return the cgroup v2 id of the socket associated with the *skb*. + * This is roughly similar to the **bpf_get_cgroup_classid**\ () + * helper for cgroup v1 by providing a tag resp. identifier that + * can be matched on or used for map lookups e.g. to implement + * policy. The cgroup v2 id of a given path in the hierarchy is + * exposed in user space through the f_handle API in order to get + * to the same 64-bit id. + * + * This helper can be used on TC egress path, but not on ingress, + * and is available only if the kernel was compiled with the + * **CONFIG_SOCK_CGROUP_DATA** configuration option. + * + * Returns + * The id is returned or 0 in case the id could not be retrieved. + */ +static __u64 (*bpf_skb_cgroup_id)(struct __sk_buff *skb) = (void *) 79; + +/* + * bpf_get_current_cgroup_id + * + * + * Returns + * A 64-bit integer containing the current cgroup id based + * on the cgroup within which the current task is running. + */ +static __u64 (*bpf_get_current_cgroup_id)(void) = (void *) 80; + +/* + * bpf_get_local_storage + * + * Get the pointer to the local storage area. + * The type and the size of the local storage is defined + * by the *map* argument. + * The *flags* meaning is specific for each map type, + * and has to be 0 for cgroup local storage. + * + * Depending on the BPF program type, a local storage area + * can be shared between multiple instances of the BPF program, + * running simultaneously. + * + * A user should care about the synchronization by himself. + * For example, by using the **BPF_ATOMIC** instructions to alter + * the shared data. + * + * Returns + * A pointer to the local storage area. + */ +static void *(*bpf_get_local_storage)(void *map, __u64 flags) = (void *) 81; + +/* + * bpf_sk_select_reuseport + * + * Select a **SO_REUSEPORT** socket from a + * **BPF_MAP_TYPE_REUSEPORT_SOCKARRAY** *map*. + * It checks the selected socket is matching the incoming + * request in the socket buffer. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_sk_select_reuseport)(struct sk_reuseport_md *reuse, void *map, void *key, __u64 flags) = (void *) 82; + +/* + * bpf_skb_ancestor_cgroup_id + * + * Return id of cgroup v2 that is ancestor of cgroup associated + * with the *skb* at the *ancestor_level*. The root cgroup is at + * *ancestor_level* zero and each step down the hierarchy + * increments the level. If *ancestor_level* == level of cgroup + * associated with *skb*, then return value will be same as that + * of **bpf_skb_cgroup_id**\ (). + * + * The helper is useful to implement policies based on cgroups + * that are upper in hierarchy than immediate cgroup associated + * with *skb*. + * + * The format of returned id and helper limitations are same as in + * **bpf_skb_cgroup_id**\ (). + * + * Returns + * The id is returned or 0 in case the id could not be retrieved. + */ +static __u64 (*bpf_skb_ancestor_cgroup_id)(struct __sk_buff *skb, int ancestor_level) = (void *) 83; + +/* + * bpf_sk_lookup_tcp + * + * Look for TCP socket matching *tuple*, optionally in a child + * network namespace *netns*. The return value must be checked, + * and if non-**NULL**, released via **bpf_sk_release**\ (). + * + * The *ctx* should point to the context of the program, such as + * the skb or socket (depending on the hook in use). This is used + * to determine the base network namespace for the lookup. + * + * *tuple_size* must be one of: + * + * **sizeof**\ (*tuple*\ **->ipv4**) + * Look for an IPv4 socket. + * **sizeof**\ (*tuple*\ **->ipv6**) + * Look for an IPv6 socket. + * + * If the *netns* is a negative signed 32-bit integer, then the + * socket lookup table in the netns associated with the *ctx* + * will be used. For the TC hooks, this is the netns of the device + * in the skb. For socket hooks, this is the netns of the socket. + * If *netns* is any other signed 32-bit value greater than or + * equal to zero then it specifies the ID of the netns relative to + * the netns associated with the *ctx*. *netns* values beyond the + * range of 32-bit integers are reserved for future use. + * + * All values for *flags* are reserved for future usage, and must + * be left at zero. + * + * This helper is available only if the kernel was compiled with + * **CONFIG_NET** configuration option. + * + * Returns + * Pointer to **struct bpf_sock**, or **NULL** in case of failure. + * For sockets with reuseport option, the **struct bpf_sock** + * result is from *reuse*\ **->socks**\ [] using the hash of the + * tuple. + */ +static struct bpf_sock *(*bpf_sk_lookup_tcp)(void *ctx, struct bpf_sock_tuple *tuple, __u32 tuple_size, __u64 netns, __u64 flags) = (void *) 84; + +/* + * bpf_sk_lookup_udp + * + * Look for UDP socket matching *tuple*, optionally in a child + * network namespace *netns*. The return value must be checked, + * and if non-**NULL**, released via **bpf_sk_release**\ (). + * + * The *ctx* should point to the context of the program, such as + * the skb or socket (depending on the hook in use). This is used + * to determine the base network namespace for the lookup. + * + * *tuple_size* must be one of: + * + * **sizeof**\ (*tuple*\ **->ipv4**) + * Look for an IPv4 socket. + * **sizeof**\ (*tuple*\ **->ipv6**) + * Look for an IPv6 socket. + * + * If the *netns* is a negative signed 32-bit integer, then the + * socket lookup table in the netns associated with the *ctx* + * will be used. For the TC hooks, this is the netns of the device + * in the skb. For socket hooks, this is the netns of the socket. + * If *netns* is any other signed 32-bit value greater than or + * equal to zero then it specifies the ID of the netns relative to + * the netns associated with the *ctx*. *netns* values beyond the + * range of 32-bit integers are reserved for future use. + * + * All values for *flags* are reserved for future usage, and must + * be left at zero. + * + * This helper is available only if the kernel was compiled with + * **CONFIG_NET** configuration option. + * + * Returns + * Pointer to **struct bpf_sock**, or **NULL** in case of failure. + * For sockets with reuseport option, the **struct bpf_sock** + * result is from *reuse*\ **->socks**\ [] using the hash of the + * tuple. + */ +static struct bpf_sock *(*bpf_sk_lookup_udp)(void *ctx, struct bpf_sock_tuple *tuple, __u32 tuple_size, __u64 netns, __u64 flags) = (void *) 85; + +/* + * bpf_sk_release + * + * Release the reference held by *sock*. *sock* must be a + * non-**NULL** pointer that was returned from + * **bpf_sk_lookup_xxx**\ (). + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_sk_release)(void *sock) = (void *) 86; + +/* + * bpf_map_push_elem + * + * Push an element *value* in *map*. *flags* is one of: + * + * **BPF_EXIST** + * If the queue/stack is full, the oldest element is + * removed to make room for this. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_map_push_elem)(void *map, const void *value, __u64 flags) = (void *) 87; + +/* + * bpf_map_pop_elem + * + * Pop an element from *map*. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_map_pop_elem)(void *map, void *value) = (void *) 88; + +/* + * bpf_map_peek_elem + * + * Get an element from *map* without removing it. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_map_peek_elem)(void *map, void *value) = (void *) 89; + +/* + * bpf_msg_push_data + * + * For socket policies, insert *len* bytes into *msg* at offset + * *start*. + * + * If a program of type **BPF_PROG_TYPE_SK_MSG** is run on a + * *msg* it may want to insert metadata or options into the *msg*. + * This can later be read and used by any of the lower layer BPF + * hooks. + * + * This helper may fail if under memory pressure (a malloc + * fails) in these cases BPF programs will get an appropriate + * error and BPF programs will need to handle them. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_msg_push_data)(struct sk_msg_md *msg, __u32 start, __u32 len, __u64 flags) = (void *) 90; + +/* + * bpf_msg_pop_data + * + * Will remove *len* bytes from a *msg* starting at byte *start*. + * This may result in **ENOMEM** errors under certain situations if + * an allocation and copy are required due to a full ring buffer. + * However, the helper will try to avoid doing the allocation + * if possible. Other errors can occur if input parameters are + * invalid either due to *start* byte not being valid part of *msg* + * payload and/or *pop* value being to large. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_msg_pop_data)(struct sk_msg_md *msg, __u32 start, __u32 len, __u64 flags) = (void *) 91; + +/* + * bpf_rc_pointer_rel + * + * This helper is used in programs implementing IR decoding, to + * report a successfully decoded pointer movement. + * + * The *ctx* should point to the lirc sample as passed into + * the program. + * + * This helper is only available is the kernel was compiled with + * the **CONFIG_BPF_LIRC_MODE2** configuration option set to + * "**y**". + * + * Returns + * 0 + */ +static long (*bpf_rc_pointer_rel)(void *ctx, __s32 rel_x, __s32 rel_y) = (void *) 92; + +/* + * bpf_spin_lock + * + * Acquire a spinlock represented by the pointer *lock*, which is + * stored as part of a value of a map. Taking the lock allows to + * safely update the rest of the fields in that value. The + * spinlock can (and must) later be released with a call to + * **bpf_spin_unlock**\ (\ *lock*\ ). + * + * Spinlocks in BPF programs come with a number of restrictions + * and constraints: + * + * * **bpf_spin_lock** objects are only allowed inside maps of + * types **BPF_MAP_TYPE_HASH** and **BPF_MAP_TYPE_ARRAY** (this + * list could be extended in the future). + * * BTF description of the map is mandatory. + * * The BPF program can take ONE lock at a time, since taking two + * or more could cause dead locks. + * * Only one **struct bpf_spin_lock** is allowed per map element. + * * When the lock is taken, calls (either BPF to BPF or helpers) + * are not allowed. + * * The **BPF_LD_ABS** and **BPF_LD_IND** instructions are not + * allowed inside a spinlock-ed region. + * * The BPF program MUST call **bpf_spin_unlock**\ () to release + * the lock, on all execution paths, before it returns. + * * The BPF program can access **struct bpf_spin_lock** only via + * the **bpf_spin_lock**\ () and **bpf_spin_unlock**\ () + * helpers. Loading or storing data into the **struct + * bpf_spin_lock** *lock*\ **;** field of a map is not allowed. + * * To use the **bpf_spin_lock**\ () helper, the BTF description + * of the map value must be a struct and have **struct + * bpf_spin_lock** *anyname*\ **;** field at the top level. + * Nested lock inside another struct is not allowed. + * * The **struct bpf_spin_lock** *lock* field in a map value must + * be aligned on a multiple of 4 bytes in that value. + * * Syscall with command **BPF_MAP_LOOKUP_ELEM** does not copy + * the **bpf_spin_lock** field to user space. + * * Syscall with command **BPF_MAP_UPDATE_ELEM**, or update from + * a BPF program, do not update the **bpf_spin_lock** field. + * * **bpf_spin_lock** cannot be on the stack or inside a + * networking packet (it can only be inside of a map values). + * * **bpf_spin_lock** is available to root only. + * * Tracing programs and socket filter programs cannot use + * **bpf_spin_lock**\ () due to insufficient preemption checks + * (but this may change in the future). + * * **bpf_spin_lock** is not allowed in inner maps of map-in-map. + * + * Returns + * 0 + */ +static long (*bpf_spin_lock)(struct bpf_spin_lock *lock) = (void *) 93; + +/* + * bpf_spin_unlock + * + * Release the *lock* previously locked by a call to + * **bpf_spin_lock**\ (\ *lock*\ ). + * + * Returns + * 0 + */ +static long (*bpf_spin_unlock)(struct bpf_spin_lock *lock) = (void *) 94; + +/* + * bpf_sk_fullsock + * + * This helper gets a **struct bpf_sock** pointer such + * that all the fields in this **bpf_sock** can be accessed. + * + * Returns + * A **struct bpf_sock** pointer on success, or **NULL** in + * case of failure. + */ +static struct bpf_sock *(*bpf_sk_fullsock)(struct bpf_sock *sk) = (void *) 95; + +/* + * bpf_tcp_sock + * + * This helper gets a **struct bpf_tcp_sock** pointer from a + * **struct bpf_sock** pointer. + * + * Returns + * A **struct bpf_tcp_sock** pointer on success, or **NULL** in + * case of failure. + */ +static struct bpf_tcp_sock *(*bpf_tcp_sock)(struct bpf_sock *sk) = (void *) 96; + +/* + * bpf_skb_ecn_set_ce + * + * Set ECN (Explicit Congestion Notification) field of IP header + * to **CE** (Congestion Encountered) if current value is **ECT** + * (ECN Capable Transport). Otherwise, do nothing. Works with IPv6 + * and IPv4. + * + * Returns + * 1 if the **CE** flag is set (either by the current helper call + * or because it was already present), 0 if it is not set. + */ +static long (*bpf_skb_ecn_set_ce)(struct __sk_buff *skb) = (void *) 97; + +/* + * bpf_get_listener_sock + * + * Return a **struct bpf_sock** pointer in **TCP_LISTEN** state. + * **bpf_sk_release**\ () is unnecessary and not allowed. + * + * Returns + * A **struct bpf_sock** pointer on success, or **NULL** in + * case of failure. + */ +static struct bpf_sock *(*bpf_get_listener_sock)(struct bpf_sock *sk) = (void *) 98; + +/* + * bpf_skc_lookup_tcp + * + * Look for TCP socket matching *tuple*, optionally in a child + * network namespace *netns*. The return value must be checked, + * and if non-**NULL**, released via **bpf_sk_release**\ (). + * + * This function is identical to **bpf_sk_lookup_tcp**\ (), except + * that it also returns timewait or request sockets. Use + * **bpf_sk_fullsock**\ () or **bpf_tcp_sock**\ () to access the + * full structure. + * + * This helper is available only if the kernel was compiled with + * **CONFIG_NET** configuration option. + * + * Returns + * Pointer to **struct bpf_sock**, or **NULL** in case of failure. + * For sockets with reuseport option, the **struct bpf_sock** + * result is from *reuse*\ **->socks**\ [] using the hash of the + * tuple. + */ +static struct bpf_sock *(*bpf_skc_lookup_tcp)(void *ctx, struct bpf_sock_tuple *tuple, __u32 tuple_size, __u64 netns, __u64 flags) = (void *) 99; + +/* + * bpf_tcp_check_syncookie + * + * Check whether *iph* and *th* contain a valid SYN cookie ACK for + * the listening socket in *sk*. + * + * *iph* points to the start of the IPv4 or IPv6 header, while + * *iph_len* contains **sizeof**\ (**struct iphdr**) or + * **sizeof**\ (**struct ip6hdr**). + * + * *th* points to the start of the TCP header, while *th_len* + * contains **sizeof**\ (**struct tcphdr**). + * + * Returns + * 0 if *iph* and *th* are a valid SYN cookie ACK, or a negative + * error otherwise. + */ +static long (*bpf_tcp_check_syncookie)(void *sk, void *iph, __u32 iph_len, struct tcphdr *th, __u32 th_len) = (void *) 100; + +/* + * bpf_sysctl_get_name + * + * Get name of sysctl in /proc/sys/ and copy it into provided by + * program buffer *buf* of size *buf_len*. + * + * The buffer is always NUL terminated, unless it's zero-sized. + * + * If *flags* is zero, full name (e.g. "net/ipv4/tcp_mem") is + * copied. Use **BPF_F_SYSCTL_BASE_NAME** flag to copy base name + * only (e.g. "tcp_mem"). + * + * Returns + * Number of character copied (not including the trailing NUL). + * + * **-E2BIG** if the buffer wasn't big enough (*buf* will contain + * truncated name in this case). + */ +static long (*bpf_sysctl_get_name)(struct bpf_sysctl *ctx, char *buf, unsigned long buf_len, __u64 flags) = (void *) 101; + +/* + * bpf_sysctl_get_current_value + * + * Get current value of sysctl as it is presented in /proc/sys + * (incl. newline, etc), and copy it as a string into provided + * by program buffer *buf* of size *buf_len*. + * + * The whole value is copied, no matter what file position user + * space issued e.g. sys_read at. + * + * The buffer is always NUL terminated, unless it's zero-sized. + * + * Returns + * Number of character copied (not including the trailing NUL). + * + * **-E2BIG** if the buffer wasn't big enough (*buf* will contain + * truncated name in this case). + * + * **-EINVAL** if current value was unavailable, e.g. because + * sysctl is uninitialized and read returns -EIO for it. + */ +static long (*bpf_sysctl_get_current_value)(struct bpf_sysctl *ctx, char *buf, unsigned long buf_len) = (void *) 102; + +/* + * bpf_sysctl_get_new_value + * + * Get new value being written by user space to sysctl (before + * the actual write happens) and copy it as a string into + * provided by program buffer *buf* of size *buf_len*. + * + * User space may write new value at file position > 0. + * + * The buffer is always NUL terminated, unless it's zero-sized. + * + * Returns + * Number of character copied (not including the trailing NUL). + * + * **-E2BIG** if the buffer wasn't big enough (*buf* will contain + * truncated name in this case). + * + * **-EINVAL** if sysctl is being read. + */ +static long (*bpf_sysctl_get_new_value)(struct bpf_sysctl *ctx, char *buf, unsigned long buf_len) = (void *) 103; + +/* + * bpf_sysctl_set_new_value + * + * Override new value being written by user space to sysctl with + * value provided by program in buffer *buf* of size *buf_len*. + * + * *buf* should contain a string in same form as provided by user + * space on sysctl write. + * + * User space may write new value at file position > 0. To override + * the whole sysctl value file position should be set to zero. + * + * Returns + * 0 on success. + * + * **-E2BIG** if the *buf_len* is too big. + * + * **-EINVAL** if sysctl is being read. + */ +static long (*bpf_sysctl_set_new_value)(struct bpf_sysctl *ctx, const char *buf, unsigned long buf_len) = (void *) 104; + +/* + * bpf_strtol + * + * Convert the initial part of the string from buffer *buf* of + * size *buf_len* to a long integer according to the given base + * and save the result in *res*. + * + * The string may begin with an arbitrary amount of white space + * (as determined by **isspace**\ (3)) followed by a single + * optional '**-**' sign. + * + * Five least significant bits of *flags* encode base, other bits + * are currently unused. + * + * Base must be either 8, 10, 16 or 0 to detect it automatically + * similar to user space **strtol**\ (3). + * + * Returns + * Number of characters consumed on success. Must be positive but + * no more than *buf_len*. + * + * **-EINVAL** if no valid digits were found or unsupported base + * was provided. + * + * **-ERANGE** if resulting value was out of range. + */ +static long (*bpf_strtol)(const char *buf, unsigned long buf_len, __u64 flags, long *res) = (void *) 105; + +/* + * bpf_strtoul + * + * Convert the initial part of the string from buffer *buf* of + * size *buf_len* to an unsigned long integer according to the + * given base and save the result in *res*. + * + * The string may begin with an arbitrary amount of white space + * (as determined by **isspace**\ (3)). + * + * Five least significant bits of *flags* encode base, other bits + * are currently unused. + * + * Base must be either 8, 10, 16 or 0 to detect it automatically + * similar to user space **strtoul**\ (3). + * + * Returns + * Number of characters consumed on success. Must be positive but + * no more than *buf_len*. + * + * **-EINVAL** if no valid digits were found or unsupported base + * was provided. + * + * **-ERANGE** if resulting value was out of range. + */ +static long (*bpf_strtoul)(const char *buf, unsigned long buf_len, __u64 flags, unsigned long *res) = (void *) 106; + +/* + * bpf_sk_storage_get + * + * Get a bpf-local-storage from a *sk*. + * + * Logically, it could be thought of getting the value from + * a *map* with *sk* as the **key**. From this + * perspective, the usage is not much different from + * **bpf_map_lookup_elem**\ (*map*, **&**\ *sk*) except this + * helper enforces the key must be a full socket and the map must + * be a **BPF_MAP_TYPE_SK_STORAGE** also. + * + * Underneath, the value is stored locally at *sk* instead of + * the *map*. The *map* is used as the bpf-local-storage + * "type". The bpf-local-storage "type" (i.e. the *map*) is + * searched against all bpf-local-storages residing at *sk*. + * + * *sk* is a kernel **struct sock** pointer for LSM program. + * *sk* is a **struct bpf_sock** pointer for other program types. + * + * An optional *flags* (**BPF_SK_STORAGE_GET_F_CREATE**) can be + * used such that a new bpf-local-storage will be + * created if one does not exist. *value* can be used + * together with **BPF_SK_STORAGE_GET_F_CREATE** to specify + * the initial value of a bpf-local-storage. If *value* is + * **NULL**, the new bpf-local-storage will be zero initialized. + * + * Returns + * A bpf-local-storage pointer is returned on success. + * + * **NULL** if not found or there was an error in adding + * a new bpf-local-storage. + */ +static void *(*bpf_sk_storage_get)(void *map, void *sk, void *value, __u64 flags) = (void *) 107; + +/* + * bpf_sk_storage_delete + * + * Delete a bpf-local-storage from a *sk*. + * + * Returns + * 0 on success. + * + * **-ENOENT** if the bpf-local-storage cannot be found. + * **-EINVAL** if sk is not a fullsock (e.g. a request_sock). + */ +static long (*bpf_sk_storage_delete)(void *map, void *sk) = (void *) 108; + +/* + * bpf_send_signal + * + * Send signal *sig* to the process of the current task. + * The signal may be delivered to any of this process's threads. + * + * Returns + * 0 on success or successfully queued. + * + * **-EBUSY** if work queue under nmi is full. + * + * **-EINVAL** if *sig* is invalid. + * + * **-EPERM** if no permission to send the *sig*. + * + * **-EAGAIN** if bpf program can try again. + */ +static long (*bpf_send_signal)(__u32 sig) = (void *) 109; + +/* + * bpf_tcp_gen_syncookie + * + * Try to issue a SYN cookie for the packet with corresponding + * IP/TCP headers, *iph* and *th*, on the listening socket in *sk*. + * + * *iph* points to the start of the IPv4 or IPv6 header, while + * *iph_len* contains **sizeof**\ (**struct iphdr**) or + * **sizeof**\ (**struct ip6hdr**). + * + * *th* points to the start of the TCP header, while *th_len* + * contains the length of the TCP header. + * + * Returns + * On success, lower 32 bits hold the generated SYN cookie in + * followed by 16 bits which hold the MSS value for that cookie, + * and the top 16 bits are unused. + * + * On failure, the returned value is one of the following: + * + * **-EINVAL** SYN cookie cannot be issued due to error + * + * **-ENOENT** SYN cookie should not be issued (no SYN flood) + * + * **-EOPNOTSUPP** kernel configuration does not enable SYN cookies + * + * **-EPROTONOSUPPORT** IP packet version is not 4 or 6 + */ +static __s64 (*bpf_tcp_gen_syncookie)(void *sk, void *iph, __u32 iph_len, struct tcphdr *th, __u32 th_len) = (void *) 110; + +/* + * bpf_skb_output + * + * Write raw *data* blob into a special BPF perf event held by + * *map* of type **BPF_MAP_TYPE_PERF_EVENT_ARRAY**. This perf + * event must have the following attributes: **PERF_SAMPLE_RAW** + * as **sample_type**, **PERF_TYPE_SOFTWARE** as **type**, and + * **PERF_COUNT_SW_BPF_OUTPUT** as **config**. + * + * The *flags* are used to indicate the index in *map* for which + * the value must be put, masked with **BPF_F_INDEX_MASK**. + * Alternatively, *flags* can be set to **BPF_F_CURRENT_CPU** + * to indicate that the index of the current CPU core should be + * used. + * + * The value to write, of *size*, is passed through eBPF stack and + * pointed by *data*. + * + * *ctx* is a pointer to in-kernel struct sk_buff. + * + * This helper is similar to **bpf_perf_event_output**\ () but + * restricted to raw_tracepoint bpf programs. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_skb_output)(void *ctx, void *map, __u64 flags, void *data, __u64 size) = (void *) 111; + +/* + * bpf_probe_read_user + * + * Safely attempt to read *size* bytes from user space address + * *unsafe_ptr* and store the data in *dst*. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_probe_read_user)(void *dst, __u32 size, const void *unsafe_ptr) = (void *) 112; + +/* + * bpf_probe_read_kernel + * + * Safely attempt to read *size* bytes from kernel space address + * *unsafe_ptr* and store the data in *dst*. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_probe_read_kernel)(void *dst, __u32 size, const void *unsafe_ptr) = (void *) 113; + +/* + * bpf_probe_read_user_str + * + * Copy a NUL terminated string from an unsafe user address + * *unsafe_ptr* to *dst*. The *size* should include the + * terminating NUL byte. In case the string length is smaller than + * *size*, the target is not padded with further NUL bytes. If the + * string length is larger than *size*, just *size*-1 bytes are + * copied and the last byte is set to NUL. + * + * On success, returns the number of bytes that were written, + * including the terminal NUL. This makes this helper useful in + * tracing programs for reading strings, and more importantly to + * get its length at runtime. See the following snippet: + * + * :: + * + * SEC("kprobe/sys_open") + * void bpf_sys_open(struct pt_regs *ctx) + * { + * char buf[PATHLEN]; // PATHLEN is defined to 256 + * int res = bpf_probe_read_user_str(buf, sizeof(buf), + * ctx->di); + * + * // Consume buf, for example push it to + * // userspace via bpf_perf_event_output(); we + * // can use res (the string length) as event + * // size, after checking its boundaries. + * } + * + * In comparison, using **bpf_probe_read_user**\ () helper here + * instead to read the string would require to estimate the length + * at compile time, and would often result in copying more memory + * than necessary. + * + * Another useful use case is when parsing individual process + * arguments or individual environment variables navigating + * *current*\ **->mm->arg_start** and *current*\ + * **->mm->env_start**: using this helper and the return value, + * one can quickly iterate at the right offset of the memory area. + * + * Returns + * On success, the strictly positive length of the output string, + * including the trailing NUL character. On error, a negative + * value. + */ +static long (*bpf_probe_read_user_str)(void *dst, __u32 size, const void *unsafe_ptr) = (void *) 114; + +/* + * bpf_probe_read_kernel_str + * + * Copy a NUL terminated string from an unsafe kernel address *unsafe_ptr* + * to *dst*. Same semantics as with **bpf_probe_read_user_str**\ () apply. + * + * Returns + * On success, the strictly positive length of the string, including + * the trailing NUL character. On error, a negative value. + */ +static long (*bpf_probe_read_kernel_str)(void *dst, __u32 size, const void *unsafe_ptr) = (void *) 115; + +/* + * bpf_tcp_send_ack + * + * Send out a tcp-ack. *tp* is the in-kernel struct **tcp_sock**. + * *rcv_nxt* is the ack_seq to be sent out. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_tcp_send_ack)(void *tp, __u32 rcv_nxt) = (void *) 116; + +/* + * bpf_send_signal_thread + * + * Send signal *sig* to the thread corresponding to the current task. + * + * Returns + * 0 on success or successfully queued. + * + * **-EBUSY** if work queue under nmi is full. + * + * **-EINVAL** if *sig* is invalid. + * + * **-EPERM** if no permission to send the *sig*. + * + * **-EAGAIN** if bpf program can try again. + */ +static long (*bpf_send_signal_thread)(__u32 sig) = (void *) 117; + +/* + * bpf_jiffies64 + * + * Obtain the 64bit jiffies + * + * Returns + * The 64 bit jiffies + */ +static __u64 (*bpf_jiffies64)(void) = (void *) 118; + +/* + * bpf_read_branch_records + * + * For an eBPF program attached to a perf event, retrieve the + * branch records (**struct perf_branch_entry**) associated to *ctx* + * and store it in the buffer pointed by *buf* up to size + * *size* bytes. + * + * Returns + * On success, number of bytes written to *buf*. On error, a + * negative value. + * + * The *flags* can be set to **BPF_F_GET_BRANCH_RECORDS_SIZE** to + * instead return the number of bytes required to store all the + * branch entries. If this flag is set, *buf* may be NULL. + * + * **-EINVAL** if arguments invalid or **size** not a multiple + * of **sizeof**\ (**struct perf_branch_entry**\ ). + * + * **-ENOENT** if architecture does not support branch records. + */ +static long (*bpf_read_branch_records)(struct bpf_perf_event_data *ctx, void *buf, __u32 size, __u64 flags) = (void *) 119; + +/* + * bpf_get_ns_current_pid_tgid + * + * Returns 0 on success, values for *pid* and *tgid* as seen from the current + * *namespace* will be returned in *nsdata*. + * + * Returns + * 0 on success, or one of the following in case of failure: + * + * **-EINVAL** if dev and inum supplied don't match dev_t and inode number + * with nsfs of current task, or if dev conversion to dev_t lost high bits. + * + * **-ENOENT** if pidns does not exists for the current task. + */ +static long (*bpf_get_ns_current_pid_tgid)(__u64 dev, __u64 ino, struct bpf_pidns_info *nsdata, __u32 size) = (void *) 120; + +/* + * bpf_xdp_output + * + * Write raw *data* blob into a special BPF perf event held by + * *map* of type **BPF_MAP_TYPE_PERF_EVENT_ARRAY**. This perf + * event must have the following attributes: **PERF_SAMPLE_RAW** + * as **sample_type**, **PERF_TYPE_SOFTWARE** as **type**, and + * **PERF_COUNT_SW_BPF_OUTPUT** as **config**. + * + * The *flags* are used to indicate the index in *map* for which + * the value must be put, masked with **BPF_F_INDEX_MASK**. + * Alternatively, *flags* can be set to **BPF_F_CURRENT_CPU** + * to indicate that the index of the current CPU core should be + * used. + * + * The value to write, of *size*, is passed through eBPF stack and + * pointed by *data*. + * + * *ctx* is a pointer to in-kernel struct xdp_buff. + * + * This helper is similar to **bpf_perf_eventoutput**\ () but + * restricted to raw_tracepoint bpf programs. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_xdp_output)(void *ctx, void *map, __u64 flags, void *data, __u64 size) = (void *) 121; + +/* + * bpf_get_netns_cookie + * + * Retrieve the cookie (generated by the kernel) of the network + * namespace the input *ctx* is associated with. The network + * namespace cookie remains stable for its lifetime and provides + * a global identifier that can be assumed unique. If *ctx* is + * NULL, then the helper returns the cookie for the initial + * network namespace. The cookie itself is very similar to that + * of **bpf_get_socket_cookie**\ () helper, but for network + * namespaces instead of sockets. + * + * Returns + * A 8-byte long opaque number. + */ +static __u64 (*bpf_get_netns_cookie)(void *ctx) = (void *) 122; + +/* + * bpf_get_current_ancestor_cgroup_id + * + * Return id of cgroup v2 that is ancestor of the cgroup associated + * with the current task at the *ancestor_level*. The root cgroup + * is at *ancestor_level* zero and each step down the hierarchy + * increments the level. If *ancestor_level* == level of cgroup + * associated with the current task, then return value will be the + * same as that of **bpf_get_current_cgroup_id**\ (). + * + * The helper is useful to implement policies based on cgroups + * that are upper in hierarchy than immediate cgroup associated + * with the current task. + * + * The format of returned id and helper limitations are same as in + * **bpf_get_current_cgroup_id**\ (). + * + * Returns + * The id is returned or 0 in case the id could not be retrieved. + */ +static __u64 (*bpf_get_current_ancestor_cgroup_id)(int ancestor_level) = (void *) 123; + +/* + * bpf_sk_assign + * + * Helper is overloaded depending on BPF program type. This + * description applies to **BPF_PROG_TYPE_SCHED_CLS** and + * **BPF_PROG_TYPE_SCHED_ACT** programs. + * + * Assign the *sk* to the *skb*. When combined with appropriate + * routing configuration to receive the packet towards the socket, + * will cause *skb* to be delivered to the specified socket. + * Subsequent redirection of *skb* via **bpf_redirect**\ (), + * **bpf_clone_redirect**\ () or other methods outside of BPF may + * interfere with successful delivery to the socket. + * + * This operation is only valid from TC ingress path. + * + * The *flags* argument must be zero. + * + * Returns + * 0 on success, or a negative error in case of failure: + * + * **-EINVAL** if specified *flags* are not supported. + * + * **-ENOENT** if the socket is unavailable for assignment. + * + * **-ENETUNREACH** if the socket is unreachable (wrong netns). + * + * **-EOPNOTSUPP** if the operation is not supported, for example + * a call from outside of TC ingress. + * + * **-ESOCKTNOSUPPORT** if the socket type is not supported + * (reuseport). + */ +static long (*bpf_sk_assign)(void *ctx, void *sk, __u64 flags) = (void *) 124; + +/* + * bpf_ktime_get_boot_ns + * + * Return the time elapsed since system boot, in nanoseconds. + * Does include the time the system was suspended. + * See: **clock_gettime**\ (**CLOCK_BOOTTIME**) + * + * Returns + * Current *ktime*. + */ +static __u64 (*bpf_ktime_get_boot_ns)(void) = (void *) 125; + +/* + * bpf_seq_printf + * + * **bpf_seq_printf**\ () uses seq_file **seq_printf**\ () to print + * out the format string. + * The *m* represents the seq_file. The *fmt* and *fmt_size* are for + * the format string itself. The *data* and *data_len* are format string + * arguments. The *data* are a **u64** array and corresponding format string + * values are stored in the array. For strings and pointers where pointees + * are accessed, only the pointer values are stored in the *data* array. + * The *data_len* is the size of *data* in bytes. + * + * Formats **%s**, **%p{i,I}{4,6}** requires to read kernel memory. + * Reading kernel memory may fail due to either invalid address or + * valid address but requiring a major memory fault. If reading kernel memory + * fails, the string for **%s** will be an empty string, and the ip + * address for **%p{i,I}{4,6}** will be 0. Not returning error to + * bpf program is consistent with what **bpf_trace_printk**\ () does for now. + * + * Returns + * 0 on success, or a negative error in case of failure: + * + * **-EBUSY** if per-CPU memory copy buffer is busy, can try again + * by returning 1 from bpf program. + * + * **-EINVAL** if arguments are invalid, or if *fmt* is invalid/unsupported. + * + * **-E2BIG** if *fmt* contains too many format specifiers. + * + * **-EOVERFLOW** if an overflow happened: The same object will be tried again. + */ +static long (*bpf_seq_printf)(struct seq_file *m, const char *fmt, __u32 fmt_size, const void *data, __u32 data_len) = (void *) 126; + +/* + * bpf_seq_write + * + * **bpf_seq_write**\ () uses seq_file **seq_write**\ () to write the data. + * The *m* represents the seq_file. The *data* and *len* represent the + * data to write in bytes. + * + * Returns + * 0 on success, or a negative error in case of failure: + * + * **-EOVERFLOW** if an overflow happened: The same object will be tried again. + */ +static long (*bpf_seq_write)(struct seq_file *m, const void *data, __u32 len) = (void *) 127; + +/* + * bpf_sk_cgroup_id + * + * Return the cgroup v2 id of the socket *sk*. + * + * *sk* must be a non-**NULL** pointer to a socket, e.g. one + * returned from **bpf_sk_lookup_xxx**\ (), + * **bpf_sk_fullsock**\ (), etc. The format of returned id is + * same as in **bpf_skb_cgroup_id**\ (). + * + * This helper is available only if the kernel was compiled with + * the **CONFIG_SOCK_CGROUP_DATA** configuration option. + * + * Returns + * The id is returned or 0 in case the id could not be retrieved. + */ +static __u64 (*bpf_sk_cgroup_id)(void *sk) = (void *) 128; + +/* + * bpf_sk_ancestor_cgroup_id + * + * Return id of cgroup v2 that is ancestor of cgroup associated + * with the *sk* at the *ancestor_level*. The root cgroup is at + * *ancestor_level* zero and each step down the hierarchy + * increments the level. If *ancestor_level* == level of cgroup + * associated with *sk*, then return value will be same as that + * of **bpf_sk_cgroup_id**\ (). + * + * The helper is useful to implement policies based on cgroups + * that are upper in hierarchy than immediate cgroup associated + * with *sk*. + * + * The format of returned id and helper limitations are same as in + * **bpf_sk_cgroup_id**\ (). + * + * Returns + * The id is returned or 0 in case the id could not be retrieved. + */ +static __u64 (*bpf_sk_ancestor_cgroup_id)(void *sk, int ancestor_level) = (void *) 129; + +/* + * bpf_ringbuf_output + * + * Copy *size* bytes from *data* into a ring buffer *ringbuf*. + * If **BPF_RB_NO_WAKEUP** is specified in *flags*, no notification + * of new data availability is sent. + * If **BPF_RB_FORCE_WAKEUP** is specified in *flags*, notification + * of new data availability is sent unconditionally. + * If **0** is specified in *flags*, an adaptive notification + * of new data availability is sent. + * + * An adaptive notification is a notification sent whenever the user-space + * process has caught up and consumed all available payloads. In case the user-space + * process is still processing a previous payload, then no notification is needed + * as it will process the newly added payload automatically. + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_ringbuf_output)(void *ringbuf, void *data, __u64 size, __u64 flags) = (void *) 130; + +/* + * bpf_ringbuf_reserve + * + * Reserve *size* bytes of payload in a ring buffer *ringbuf*. + * *flags* must be 0. + * + * Returns + * Valid pointer with *size* bytes of memory available; NULL, + * otherwise. + */ +static void *(*bpf_ringbuf_reserve)(void *ringbuf, __u64 size, __u64 flags) = (void *) 131; + +/* + * bpf_ringbuf_submit + * + * Submit reserved ring buffer sample, pointed to by *data*. + * If **BPF_RB_NO_WAKEUP** is specified in *flags*, no notification + * of new data availability is sent. + * If **BPF_RB_FORCE_WAKEUP** is specified in *flags*, notification + * of new data availability is sent unconditionally. + * If **0** is specified in *flags*, an adaptive notification + * of new data availability is sent. + * + * See 'bpf_ringbuf_output()' for the definition of adaptive notification. + * + * Returns + * Nothing. Always succeeds. + */ +static void (*bpf_ringbuf_submit)(void *data, __u64 flags) = (void *) 132; + +/* + * bpf_ringbuf_discard + * + * Discard reserved ring buffer sample, pointed to by *data*. + * If **BPF_RB_NO_WAKEUP** is specified in *flags*, no notification + * of new data availability is sent. + * If **BPF_RB_FORCE_WAKEUP** is specified in *flags*, notification + * of new data availability is sent unconditionally. + * If **0** is specified in *flags*, an adaptive notification + * of new data availability is sent. + * + * See 'bpf_ringbuf_output()' for the definition of adaptive notification. + * + * Returns + * Nothing. Always succeeds. + */ +static void (*bpf_ringbuf_discard)(void *data, __u64 flags) = (void *) 133; + +/* + * bpf_ringbuf_query + * + * Query various characteristics of provided ring buffer. What + * exactly is queries is determined by *flags*: + * + * * **BPF_RB_AVAIL_DATA**: Amount of data not yet consumed. + * * **BPF_RB_RING_SIZE**: The size of ring buffer. + * * **BPF_RB_CONS_POS**: Consumer position (can wrap around). + * * **BPF_RB_PROD_POS**: Producer(s) position (can wrap around). + * + * Data returned is just a momentary snapshot of actual values + * and could be inaccurate, so this facility should be used to + * power heuristics and for reporting, not to make 100% correct + * calculation. + * + * Returns + * Requested value, or 0, if *flags* are not recognized. + */ +static __u64 (*bpf_ringbuf_query)(void *ringbuf, __u64 flags) = (void *) 134; + +/* + * bpf_csum_level + * + * Change the skbs checksum level by one layer up or down, or + * reset it entirely to none in order to have the stack perform + * checksum validation. The level is applicable to the following + * protocols: TCP, UDP, GRE, SCTP, FCOE. For example, a decap of + * | ETH | IP | UDP | GUE | IP | TCP | into | ETH | IP | TCP | + * through **bpf_skb_adjust_room**\ () helper with passing in + * **BPF_F_ADJ_ROOM_NO_CSUM_RESET** flag would require one call + * to **bpf_csum_level**\ () with **BPF_CSUM_LEVEL_DEC** since + * the UDP header is removed. Similarly, an encap of the latter + * into the former could be accompanied by a helper call to + * **bpf_csum_level**\ () with **BPF_CSUM_LEVEL_INC** if the + * skb is still intended to be processed in higher layers of the + * stack instead of just egressing at tc. + * + * There are three supported level settings at this time: + * + * * **BPF_CSUM_LEVEL_INC**: Increases skb->csum_level for skbs + * with CHECKSUM_UNNECESSARY. + * * **BPF_CSUM_LEVEL_DEC**: Decreases skb->csum_level for skbs + * with CHECKSUM_UNNECESSARY. + * * **BPF_CSUM_LEVEL_RESET**: Resets skb->csum_level to 0 and + * sets CHECKSUM_NONE to force checksum validation by the stack. + * * **BPF_CSUM_LEVEL_QUERY**: No-op, returns the current + * skb->csum_level. + * + * Returns + * 0 on success, or a negative error in case of failure. In the + * case of **BPF_CSUM_LEVEL_QUERY**, the current skb->csum_level + * is returned or the error code -EACCES in case the skb is not + * subject to CHECKSUM_UNNECESSARY. + */ +static long (*bpf_csum_level)(struct __sk_buff *skb, __u64 level) = (void *) 135; + +/* + * bpf_skc_to_tcp6_sock + * + * Dynamically cast a *sk* pointer to a *tcp6_sock* pointer. + * + * Returns + * *sk* if casting is valid, or **NULL** otherwise. + */ +static struct tcp6_sock *(*bpf_skc_to_tcp6_sock)(void *sk) = (void *) 136; + +/* + * bpf_skc_to_tcp_sock + * + * Dynamically cast a *sk* pointer to a *tcp_sock* pointer. + * + * Returns + * *sk* if casting is valid, or **NULL** otherwise. + */ +static struct tcp_sock *(*bpf_skc_to_tcp_sock)(void *sk) = (void *) 137; + +/* + * bpf_skc_to_tcp_timewait_sock + * + * Dynamically cast a *sk* pointer to a *tcp_timewait_sock* pointer. + * + * Returns + * *sk* if casting is valid, or **NULL** otherwise. + */ +static struct tcp_timewait_sock *(*bpf_skc_to_tcp_timewait_sock)(void *sk) = (void *) 138; + +/* + * bpf_skc_to_tcp_request_sock + * + * Dynamically cast a *sk* pointer to a *tcp_request_sock* pointer. + * + * Returns + * *sk* if casting is valid, or **NULL** otherwise. + */ +static struct tcp_request_sock *(*bpf_skc_to_tcp_request_sock)(void *sk) = (void *) 139; + +/* + * bpf_skc_to_udp6_sock + * + * Dynamically cast a *sk* pointer to a *udp6_sock* pointer. + * + * Returns + * *sk* if casting is valid, or **NULL** otherwise. + */ +static struct udp6_sock *(*bpf_skc_to_udp6_sock)(void *sk) = (void *) 140; + +/* + * bpf_get_task_stack + * + * Return a user or a kernel stack in bpf program provided buffer. + * To achieve this, the helper needs *task*, which is a valid + * pointer to **struct task_struct**. To store the stacktrace, the + * bpf program provides *buf* with a nonnegative *size*. + * + * The last argument, *flags*, holds the number of stack frames to + * skip (from 0 to 255), masked with + * **BPF_F_SKIP_FIELD_MASK**. The next bits can be used to set + * the following flags: + * + * **BPF_F_USER_STACK** + * Collect a user space stack instead of a kernel stack. + * **BPF_F_USER_BUILD_ID** + * Collect buildid+offset instead of ips for user stack, + * only valid if **BPF_F_USER_STACK** is also specified. + * + * **bpf_get_task_stack**\ () can collect up to + * **PERF_MAX_STACK_DEPTH** both kernel and user frames, subject + * to sufficient large buffer size. Note that + * this limit can be controlled with the **sysctl** program, and + * that it should be manually increased in order to profile long + * user stacks (such as stacks for Java programs). To do so, use: + * + * :: + * + * # sysctl kernel.perf_event_max_stack= + * + * Returns + * A non-negative value equal to or less than *size* on success, + * or a negative error in case of failure. + */ +static long (*bpf_get_task_stack)(struct task_struct *task, void *buf, __u32 size, __u64 flags) = (void *) 141; + +/* + * bpf_load_hdr_opt + * + * Load header option. Support reading a particular TCP header + * option for bpf program (**BPF_PROG_TYPE_SOCK_OPS**). + * + * If *flags* is 0, it will search the option from the + * *skops*\ **->skb_data**. The comment in **struct bpf_sock_ops** + * has details on what skb_data contains under different + * *skops*\ **->op**. + * + * The first byte of the *searchby_res* specifies the + * kind that it wants to search. + * + * If the searching kind is an experimental kind + * (i.e. 253 or 254 according to RFC6994). It also + * needs to specify the "magic" which is either + * 2 bytes or 4 bytes. It then also needs to + * specify the size of the magic by using + * the 2nd byte which is "kind-length" of a TCP + * header option and the "kind-length" also + * includes the first 2 bytes "kind" and "kind-length" + * itself as a normal TCP header option also does. + * + * For example, to search experimental kind 254 with + * 2 byte magic 0xeB9F, the searchby_res should be + * [ 254, 4, 0xeB, 0x9F, 0, 0, .... 0 ]. + * + * To search for the standard window scale option (3), + * the *searchby_res* should be [ 3, 0, 0, .... 0 ]. + * Note, kind-length must be 0 for regular option. + * + * Searching for No-Op (0) and End-of-Option-List (1) are + * not supported. + * + * *len* must be at least 2 bytes which is the minimal size + * of a header option. + * + * Supported flags: + * + * * **BPF_LOAD_HDR_OPT_TCP_SYN** to search from the + * saved_syn packet or the just-received syn packet. + * + * + * Returns + * > 0 when found, the header option is copied to *searchby_res*. + * The return value is the total length copied. On failure, a + * negative error code is returned: + * + * **-EINVAL** if a parameter is invalid. + * + * **-ENOMSG** if the option is not found. + * + * **-ENOENT** if no syn packet is available when + * **BPF_LOAD_HDR_OPT_TCP_SYN** is used. + * + * **-ENOSPC** if there is not enough space. Only *len* number of + * bytes are copied. + * + * **-EFAULT** on failure to parse the header options in the + * packet. + * + * **-EPERM** if the helper cannot be used under the current + * *skops*\ **->op**. + */ +static long (*bpf_load_hdr_opt)(struct bpf_sock_ops *skops, void *searchby_res, __u32 len, __u64 flags) = (void *) 142; + +/* + * bpf_store_hdr_opt + * + * Store header option. The data will be copied + * from buffer *from* with length *len* to the TCP header. + * + * The buffer *from* should have the whole option that + * includes the kind, kind-length, and the actual + * option data. The *len* must be at least kind-length + * long. The kind-length does not have to be 4 byte + * aligned. The kernel will take care of the padding + * and setting the 4 bytes aligned value to th->doff. + * + * This helper will check for duplicated option + * by searching the same option in the outgoing skb. + * + * This helper can only be called during + * **BPF_SOCK_OPS_WRITE_HDR_OPT_CB**. + * + * + * Returns + * 0 on success, or negative error in case of failure: + * + * **-EINVAL** If param is invalid. + * + * **-ENOSPC** if there is not enough space in the header. + * Nothing has been written + * + * **-EEXIST** if the option already exists. + * + * **-EFAULT** on failrue to parse the existing header options. + * + * **-EPERM** if the helper cannot be used under the current + * *skops*\ **->op**. + */ +static long (*bpf_store_hdr_opt)(struct bpf_sock_ops *skops, const void *from, __u32 len, __u64 flags) = (void *) 143; + +/* + * bpf_reserve_hdr_opt + * + * Reserve *len* bytes for the bpf header option. The + * space will be used by **bpf_store_hdr_opt**\ () later in + * **BPF_SOCK_OPS_WRITE_HDR_OPT_CB**. + * + * If **bpf_reserve_hdr_opt**\ () is called multiple times, + * the total number of bytes will be reserved. + * + * This helper can only be called during + * **BPF_SOCK_OPS_HDR_OPT_LEN_CB**. + * + * + * Returns + * 0 on success, or negative error in case of failure: + * + * **-EINVAL** if a parameter is invalid. + * + * **-ENOSPC** if there is not enough space in the header. + * + * **-EPERM** if the helper cannot be used under the current + * *skops*\ **->op**. + */ +static long (*bpf_reserve_hdr_opt)(struct bpf_sock_ops *skops, __u32 len, __u64 flags) = (void *) 144; + +/* + * bpf_inode_storage_get + * + * Get a bpf_local_storage from an *inode*. + * + * Logically, it could be thought of as getting the value from + * a *map* with *inode* as the **key**. From this + * perspective, the usage is not much different from + * **bpf_map_lookup_elem**\ (*map*, **&**\ *inode*) except this + * helper enforces the key must be an inode and the map must also + * be a **BPF_MAP_TYPE_INODE_STORAGE**. + * + * Underneath, the value is stored locally at *inode* instead of + * the *map*. The *map* is used as the bpf-local-storage + * "type". The bpf-local-storage "type" (i.e. the *map*) is + * searched against all bpf_local_storage residing at *inode*. + * + * An optional *flags* (**BPF_LOCAL_STORAGE_GET_F_CREATE**) can be + * used such that a new bpf_local_storage will be + * created if one does not exist. *value* can be used + * together with **BPF_LOCAL_STORAGE_GET_F_CREATE** to specify + * the initial value of a bpf_local_storage. If *value* is + * **NULL**, the new bpf_local_storage will be zero initialized. + * + * Returns + * A bpf_local_storage pointer is returned on success. + * + * **NULL** if not found or there was an error in adding + * a new bpf_local_storage. + */ +static void *(*bpf_inode_storage_get)(void *map, void *inode, void *value, __u64 flags) = (void *) 145; + +/* + * bpf_inode_storage_delete + * + * Delete a bpf_local_storage from an *inode*. + * + * Returns + * 0 on success. + * + * **-ENOENT** if the bpf_local_storage cannot be found. + */ +static int (*bpf_inode_storage_delete)(void *map, void *inode) = (void *) 146; + +/* + * bpf_d_path + * + * Return full path for given **struct path** object, which + * needs to be the kernel BTF *path* object. The path is + * returned in the provided buffer *buf* of size *sz* and + * is zero terminated. + * + * + * Returns + * On success, the strictly positive length of the string, + * including the trailing NUL character. On error, a negative + * value. + */ +static long (*bpf_d_path)(struct path *path, char *buf, __u32 sz) = (void *) 147; + +/* + * bpf_copy_from_user + * + * Read *size* bytes from user space address *user_ptr* and store + * the data in *dst*. This is a wrapper of **copy_from_user**\ (). + * + * Returns + * 0 on success, or a negative error in case of failure. + */ +static long (*bpf_copy_from_user)(void *dst, __u32 size, const void *user_ptr) = (void *) 148; + +/* + * bpf_snprintf_btf + * + * Use BTF to store a string representation of *ptr*->ptr in *str*, + * using *ptr*->type_id. This value should specify the type + * that *ptr*->ptr points to. LLVM __builtin_btf_type_id(type, 1) + * can be used to look up vmlinux BTF type ids. Traversing the + * data structure using BTF, the type information and values are + * stored in the first *str_size* - 1 bytes of *str*. Safe copy of + * the pointer data is carried out to avoid kernel crashes during + * operation. Smaller types can use string space on the stack; + * larger programs can use map data to store the string + * representation. + * + * The string can be subsequently shared with userspace via + * bpf_perf_event_output() or ring buffer interfaces. + * bpf_trace_printk() is to be avoided as it places too small + * a limit on string size to be useful. + * + * *flags* is a combination of + * + * **BTF_F_COMPACT** + * no formatting around type information + * **BTF_F_NONAME** + * no struct/union member names/types + * **BTF_F_PTR_RAW** + * show raw (unobfuscated) pointer values; + * equivalent to printk specifier %px. + * **BTF_F_ZERO** + * show zero-valued struct/union members; they + * are not displayed by default + * + * + * Returns + * The number of bytes that were written (or would have been + * written if output had to be truncated due to string size), + * or a negative error in cases of failure. + */ +static long (*bpf_snprintf_btf)(char *str, __u32 str_size, struct btf_ptr *ptr, __u32 btf_ptr_size, __u64 flags) = (void *) 149; + +/* + * bpf_seq_printf_btf + * + * Use BTF to write to seq_write a string representation of + * *ptr*->ptr, using *ptr*->type_id as per bpf_snprintf_btf(). + * *flags* are identical to those used for bpf_snprintf_btf. + * + * Returns + * 0 on success or a negative error in case of failure. + */ +static long (*bpf_seq_printf_btf)(struct seq_file *m, struct btf_ptr *ptr, __u32 ptr_size, __u64 flags) = (void *) 150; + +/* + * bpf_skb_cgroup_classid + * + * See **bpf_get_cgroup_classid**\ () for the main description. + * This helper differs from **bpf_get_cgroup_classid**\ () in that + * the cgroup v1 net_cls class is retrieved only from the *skb*'s + * associated socket instead of the current process. + * + * Returns + * The id is returned or 0 in case the id could not be retrieved. + */ +static __u64 (*bpf_skb_cgroup_classid)(struct __sk_buff *skb) = (void *) 151; + +/* + * bpf_redirect_neigh + * + * Redirect the packet to another net device of index *ifindex* + * and fill in L2 addresses from neighboring subsystem. This helper + * is somewhat similar to **bpf_redirect**\ (), except that it + * populates L2 addresses as well, meaning, internally, the helper + * relies on the neighbor lookup for the L2 address of the nexthop. + * + * The helper will perform a FIB lookup based on the skb's + * networking header to get the address of the next hop, unless + * this is supplied by the caller in the *params* argument. The + * *plen* argument indicates the len of *params* and should be set + * to 0 if *params* is NULL. + * + * The *flags* argument is reserved and must be 0. The helper is + * currently only supported for tc BPF program types, and enabled + * for IPv4 and IPv6 protocols. + * + * Returns + * The helper returns **TC_ACT_REDIRECT** on success or + * **TC_ACT_SHOT** on error. + */ +static long (*bpf_redirect_neigh)(__u32 ifindex, struct bpf_redir_neigh *params, int plen, __u64 flags) = (void *) 152; + +/* + * bpf_per_cpu_ptr + * + * Take a pointer to a percpu ksym, *percpu_ptr*, and return a + * pointer to the percpu kernel variable on *cpu*. A ksym is an + * extern variable decorated with '__ksym'. For ksym, there is a + * global var (either static or global) defined of the same name + * in the kernel. The ksym is percpu if the global var is percpu. + * The returned pointer points to the global percpu var on *cpu*. + * + * bpf_per_cpu_ptr() has the same semantic as per_cpu_ptr() in the + * kernel, except that bpf_per_cpu_ptr() may return NULL. This + * happens if *cpu* is larger than nr_cpu_ids. The caller of + * bpf_per_cpu_ptr() must check the returned value. + * + * Returns + * A pointer pointing to the kernel percpu variable on *cpu*, or + * NULL, if *cpu* is invalid. + */ +static void *(*bpf_per_cpu_ptr)(const void *percpu_ptr, __u32 cpu) = (void *) 153; + +/* + * bpf_this_cpu_ptr + * + * Take a pointer to a percpu ksym, *percpu_ptr*, and return a + * pointer to the percpu kernel variable on this cpu. See the + * description of 'ksym' in **bpf_per_cpu_ptr**\ (). + * + * bpf_this_cpu_ptr() has the same semantic as this_cpu_ptr() in + * the kernel. Different from **bpf_per_cpu_ptr**\ (), it would + * never return NULL. + * + * Returns + * A pointer pointing to the kernel percpu variable on this cpu. + */ +static void *(*bpf_this_cpu_ptr)(const void *percpu_ptr) = (void *) 154; + +/* + * bpf_redirect_peer + * + * Redirect the packet to another net device of index *ifindex*. + * This helper is somewhat similar to **bpf_redirect**\ (), except + * that the redirection happens to the *ifindex*' peer device and + * the netns switch takes place from ingress to ingress without + * going through the CPU's backlog queue. + * + * The *flags* argument is reserved and must be 0. The helper is + * currently only supported for tc BPF program types at the ingress + * hook and for veth device types. The peer device must reside in a + * different network namespace. + * + * Returns + * The helper returns **TC_ACT_REDIRECT** on success or + * **TC_ACT_SHOT** on error. + */ +static long (*bpf_redirect_peer)(__u32 ifindex, __u64 flags) = (void *) 155; + +/* + * bpf_task_storage_get + * + * Get a bpf_local_storage from the *task*. + * + * Logically, it could be thought of as getting the value from + * a *map* with *task* as the **key**. From this + * perspective, the usage is not much different from + * **bpf_map_lookup_elem**\ (*map*, **&**\ *task*) except this + * helper enforces the key must be an task_struct and the map must also + * be a **BPF_MAP_TYPE_TASK_STORAGE**. + * + * Underneath, the value is stored locally at *task* instead of + * the *map*. The *map* is used as the bpf-local-storage + * "type". The bpf-local-storage "type" (i.e. the *map*) is + * searched against all bpf_local_storage residing at *task*. + * + * An optional *flags* (**BPF_LOCAL_STORAGE_GET_F_CREATE**) can be + * used such that a new bpf_local_storage will be + * created if one does not exist. *value* can be used + * together with **BPF_LOCAL_STORAGE_GET_F_CREATE** to specify + * the initial value of a bpf_local_storage. If *value* is + * **NULL**, the new bpf_local_storage will be zero initialized. + * + * Returns + * A bpf_local_storage pointer is returned on success. + * + * **NULL** if not found or there was an error in adding + * a new bpf_local_storage. + */ +static void *(*bpf_task_storage_get)(void *map, struct task_struct *task, void *value, __u64 flags) = (void *) 156; + +/* + * bpf_task_storage_delete + * + * Delete a bpf_local_storage from a *task*. + * + * Returns + * 0 on success. + * + * **-ENOENT** if the bpf_local_storage cannot be found. + */ +static long (*bpf_task_storage_delete)(void *map, struct task_struct *task) = (void *) 157; + +/* + * bpf_get_current_task_btf + * + * Return a BTF pointer to the "current" task. + * This pointer can also be used in helpers that accept an + * *ARG_PTR_TO_BTF_ID* of type *task_struct*. + * + * Returns + * Pointer to the current task. + */ +static struct task_struct *(*bpf_get_current_task_btf)(void) = (void *) 158; + +/* + * bpf_bprm_opts_set + * + * Set or clear certain options on *bprm*: + * + * **BPF_F_BPRM_SECUREEXEC** Set the secureexec bit + * which sets the **AT_SECURE** auxv for glibc. The bit + * is cleared if the flag is not specified. + * + * Returns + * **-EINVAL** if invalid *flags* are passed, zero otherwise. + */ +static long (*bpf_bprm_opts_set)(struct linux_binprm *bprm, __u64 flags) = (void *) 159; + +/* + * bpf_ktime_get_coarse_ns + * + * Return a coarse-grained version of the time elapsed since + * system boot, in nanoseconds. Does not include time the system + * was suspended. + * + * See: **clock_gettime**\ (**CLOCK_MONOTONIC_COARSE**) + * + * Returns + * Current *ktime*. + */ +static __u64 (*bpf_ktime_get_coarse_ns)(void) = (void *) 160; + +/* + * bpf_ima_inode_hash + * + * Returns the stored IMA hash of the *inode* (if it's avaialable). + * If the hash is larger than *size*, then only *size* + * bytes will be copied to *dst* + * + * Returns + * The **hash_algo** is returned on success, + * **-EOPNOTSUP** if IMA is disabled or **-EINVAL** if + * invalid arguments are passed. + */ +static long (*bpf_ima_inode_hash)(struct inode *inode, void *dst, __u32 size) = (void *) 161; + +/* + * bpf_sock_from_file + * + * If the given file represents a socket, returns the associated + * socket. + * + * Returns + * A pointer to a struct socket on success or NULL if the file is + * not a socket. + */ +static struct socket *(*bpf_sock_from_file)(struct file *file) = (void *) 162; + +/* + * bpf_check_mtu + * + * Check packet size against exceeding MTU of net device (based + * on *ifindex*). This helper will likely be used in combination + * with helpers that adjust/change the packet size. + * + * The argument *len_diff* can be used for querying with a planned + * size change. This allows to check MTU prior to changing packet + * ctx. Providing an *len_diff* adjustment that is larger than the + * actual packet size (resulting in negative packet size) will in + * principle not exceed the MTU, why it is not considered a + * failure. Other BPF-helpers are needed for performing the + * planned size change, why the responsability for catch a negative + * packet size belong in those helpers. + * + * Specifying *ifindex* zero means the MTU check is performed + * against the current net device. This is practical if this isn't + * used prior to redirect. + * + * On input *mtu_len* must be a valid pointer, else verifier will + * reject BPF program. If the value *mtu_len* is initialized to + * zero then the ctx packet size is use. When value *mtu_len* is + * provided as input this specify the L3 length that the MTU check + * is done against. Remember XDP and TC length operate at L2, but + * this value is L3 as this correlate to MTU and IP-header tot_len + * values which are L3 (similar behavior as bpf_fib_lookup). + * + * The Linux kernel route table can configure MTUs on a more + * specific per route level, which is not provided by this helper. + * For route level MTU checks use the **bpf_fib_lookup**\ () + * helper. + * + * *ctx* is either **struct xdp_md** for XDP programs or + * **struct sk_buff** for tc cls_act programs. + * + * The *flags* argument can be a combination of one or more of the + * following values: + * + * **BPF_MTU_CHK_SEGS** + * This flag will only works for *ctx* **struct sk_buff**. + * If packet context contains extra packet segment buffers + * (often knows as GSO skb), then MTU check is harder to + * check at this point, because in transmit path it is + * possible for the skb packet to get re-segmented + * (depending on net device features). This could still be + * a MTU violation, so this flag enables performing MTU + * check against segments, with a different violation + * return code to tell it apart. Check cannot use len_diff. + * + * On return *mtu_len* pointer contains the MTU value of the net + * device. Remember the net device configured MTU is the L3 size, + * which is returned here and XDP and TC length operate at L2. + * Helper take this into account for you, but remember when using + * MTU value in your BPF-code. + * + * + * Returns + * * 0 on success, and populate MTU value in *mtu_len* pointer. + * + * * < 0 if any input argument is invalid (*mtu_len* not updated) + * + * MTU violations return positive values, but also populate MTU + * value in *mtu_len* pointer, as this can be needed for + * implementing PMTU handing: + * + * * **BPF_MTU_CHK_RET_FRAG_NEEDED** + * * **BPF_MTU_CHK_RET_SEGS_TOOBIG** + */ +static long (*bpf_check_mtu)(void *ctx, __u32 ifindex, __u32 *mtu_len, __s32 len_diff, __u64 flags) = (void *) 163; + +/* + * bpf_for_each_map_elem + * + * For each element in **map**, call **callback_fn** function with + * **map**, **callback_ctx** and other map-specific parameters. + * The **callback_fn** should be a static function and + * the **callback_ctx** should be a pointer to the stack. + * The **flags** is used to control certain aspects of the helper. + * Currently, the **flags** must be 0. + * + * The following are a list of supported map types and their + * respective expected callback signatures: + * + * BPF_MAP_TYPE_HASH, BPF_MAP_TYPE_PERCPU_HASH, + * BPF_MAP_TYPE_LRU_HASH, BPF_MAP_TYPE_LRU_PERCPU_HASH, + * BPF_MAP_TYPE_ARRAY, BPF_MAP_TYPE_PERCPU_ARRAY + * + * long (\*callback_fn)(struct bpf_map \*map, const void \*key, void \*value, void \*ctx); + * + * For per_cpu maps, the map_value is the value on the cpu where the + * bpf_prog is running. + * + * If **callback_fn** return 0, the helper will continue to the next + * element. If return value is 1, the helper will skip the rest of + * elements and return. Other return values are not used now. + * + * + * Returns + * The number of traversed map elements for success, **-EINVAL** for + * invalid **flags**. + */ +static long (*bpf_for_each_map_elem)(void *map, void *callback_fn, void *callback_ctx, __u64 flags) = (void *) 164; + +/* + * bpf_snprintf + * + * Outputs a string into the **str** buffer of size **str_size** + * based on a format string stored in a read-only map pointed by + * **fmt**. + * + * Each format specifier in **fmt** corresponds to one u64 element + * in the **data** array. For strings and pointers where pointees + * are accessed, only the pointer values are stored in the *data* + * array. The *data_len* is the size of *data* in bytes. + * + * Formats **%s** and **%p{i,I}{4,6}** require to read kernel + * memory. Reading kernel memory may fail due to either invalid + * address or valid address but requiring a major memory fault. If + * reading kernel memory fails, the string for **%s** will be an + * empty string, and the ip address for **%p{i,I}{4,6}** will be 0. + * Not returning error to bpf program is consistent with what + * **bpf_trace_printk**\ () does for now. + * + * + * Returns + * The strictly positive length of the formatted string, including + * the trailing zero character. If the return value is greater than + * **str_size**, **str** contains a truncated string, guaranteed to + * be zero-terminated except when **str_size** is 0. + * + * Or **-EBUSY** if the per-CPU memory copy buffer is busy. + */ +static long (*bpf_snprintf)(char *str, __u32 str_size, const char *fmt, __u64 *data, __u32 data_len) = (void *) 165; + +/* + * bpf_sys_bpf + * + * Execute bpf syscall with given arguments. + * + * Returns + * A syscall result. + */ +static long (*bpf_sys_bpf)(__u32 cmd, void *attr, __u32 attr_size) = (void *) 166; + +/* + * bpf_btf_find_by_name_kind + * + * Find BTF type with given name and kind in vmlinux BTF or in module's BTFs. + * + * Returns + * Returns btf_id and btf_obj_fd in lower and upper 32 bits. + */ +static long (*bpf_btf_find_by_name_kind)(char *name, int name_sz, __u32 kind, int flags) = (void *) 167; + +/* + * bpf_sys_close + * + * Execute close syscall for given FD. + * + * Returns + * A syscall result. + */ +static long (*bpf_sys_close)(__u32 fd) = (void *) 168; + +/* + * bpf_timer_init + * + * Initialize the timer. + * First 4 bits of *flags* specify clockid. + * Only CLOCK_MONOTONIC, CLOCK_REALTIME, CLOCK_BOOTTIME are allowed. + * All other bits of *flags* are reserved. + * The verifier will reject the program if *timer* is not from + * the same *map*. + * + * Returns + * 0 on success. + * **-EBUSY** if *timer* is already initialized. + * **-EINVAL** if invalid *flags* are passed. + * **-EPERM** if *timer* is in a map that doesn't have any user references. + * The user space should either hold a file descriptor to a map with timers + * or pin such map in bpffs. When map is unpinned or file descriptor is + * closed all timers in the map will be cancelled and freed. + */ +static long (*bpf_timer_init)(struct bpf_timer *timer, void *map, __u64 flags) = (void *) 169; + +/* + * bpf_timer_set_callback + * + * Configure the timer to call *callback_fn* static function. + * + * Returns + * 0 on success. + * **-EINVAL** if *timer* was not initialized with bpf_timer_init() earlier. + * **-EPERM** if *timer* is in a map that doesn't have any user references. + * The user space should either hold a file descriptor to a map with timers + * or pin such map in bpffs. When map is unpinned or file descriptor is + * closed all timers in the map will be cancelled and freed. + */ +static long (*bpf_timer_set_callback)(struct bpf_timer *timer, void *callback_fn) = (void *) 170; + +/* + * bpf_timer_start + * + * Set timer expiration N nanoseconds from the current time. The + * configured callback will be invoked in soft irq context on some cpu + * and will not repeat unless another bpf_timer_start() is made. + * In such case the next invocation can migrate to a different cpu. + * Since struct bpf_timer is a field inside map element the map + * owns the timer. The bpf_timer_set_callback() will increment refcnt + * of BPF program to make sure that callback_fn code stays valid. + * When user space reference to a map reaches zero all timers + * in a map are cancelled and corresponding program's refcnts are + * decremented. This is done to make sure that Ctrl-C of a user + * process doesn't leave any timers running. If map is pinned in + * bpffs the callback_fn can re-arm itself indefinitely. + * bpf_map_update/delete_elem() helpers and user space sys_bpf commands + * cancel and free the timer in the given map element. + * The map can contain timers that invoke callback_fn-s from different + * programs. The same callback_fn can serve different timers from + * different maps if key/value layout matches across maps. + * Every bpf_timer_set_callback() can have different callback_fn. + * + * + * Returns + * 0 on success. + * **-EINVAL** if *timer* was not initialized with bpf_timer_init() earlier + * or invalid *flags* are passed. + */ +static long (*bpf_timer_start)(struct bpf_timer *timer, __u64 nsecs, __u64 flags) = (void *) 171; + +/* + * bpf_timer_cancel + * + * Cancel the timer and wait for callback_fn to finish if it was running. + * + * Returns + * 0 if the timer was not active. + * 1 if the timer was active. + * **-EINVAL** if *timer* was not initialized with bpf_timer_init() earlier. + * **-EDEADLK** if callback_fn tried to call bpf_timer_cancel() on its + * own timer which would have led to a deadlock otherwise. + */ +static long (*bpf_timer_cancel)(struct bpf_timer *timer) = (void *) 172; + +/* + * bpf_get_func_ip + * + * Get address of the traced function (for tracing and kprobe programs). + * + * Returns + * Address of the traced function. + */ +static __u64 (*bpf_get_func_ip)(void *ctx) = (void *) 173; + +/* + * bpf_get_attach_cookie + * + * Get bpf_cookie value provided (optionally) during the program + * attachment. It might be different for each individual + * attachment, even if BPF program itself is the same. + * Expects BPF program context *ctx* as a first argument. + * + * Supported for the following program types: + * - kprobe/uprobe; + * - tracepoint; + * - perf_event. + * + * Returns + * Value specified by user at BPF link creation/attachment time + * or 0, if it was not specified. + */ +static __u64 (*bpf_get_attach_cookie)(void *ctx) = (void *) 174; + +/* + * bpf_task_pt_regs + * + * Get the struct pt_regs associated with **task**. + * + * Returns + * A pointer to struct pt_regs. + */ +static long (*bpf_task_pt_regs)(struct task_struct *task) = (void *) 175; + + diff --git a/include/libbpf/bpf_helpers.h b/include/libbpf/bpf_helpers.h new file mode 100644 index 000000000..b9987c3ef --- /dev/null +++ b/include/libbpf/bpf_helpers.h @@ -0,0 +1,227 @@ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ +#ifndef __BPF_HELPERS__ +#define __BPF_HELPERS__ + +/* + * Note that bpf programs need to include either + * vmlinux.h (auto-generated from BTF) or linux/types.h + * in advance since bpf_helper_defs.h uses such types + * as __u64. + */ +#include "bpf_helper_defs.h" + +#define __uint(name, val) int (*name)[val] +#define __type(name, val) typeof(val) *name +#define __array(name, val) typeof(val) *name[] + +/* Helper macro to print out debug messages */ +#define bpf_printk(fmt, ...) \ +({ \ + char ____fmt[] = fmt; \ + bpf_trace_printk(____fmt, sizeof(____fmt), \ + ##__VA_ARGS__); \ +}) + +/* + * Helper macro to place programs, maps, license in + * different sections in elf_bpf file. Section names + * are interpreted by libbpf depending on the context (BPF programs, BPF maps, + * extern variables, etc). + * To allow use of SEC() with externs (e.g., for extern .maps declarations), + * make sure __attribute__((unused)) doesn't trigger compilation warning. + */ +#define SEC(name) \ + _Pragma("GCC diagnostic push") \ + _Pragma("GCC diagnostic ignored \"-Wignored-attributes\"") \ + __attribute__((section(name), used)) \ + _Pragma("GCC diagnostic pop") \ + +/* Avoid 'linux/stddef.h' definition of '__always_inline'. */ +#undef __always_inline +#define __always_inline inline __attribute__((always_inline)) + +#ifndef __noinline +#define __noinline __attribute__((noinline)) +#endif +#ifndef __weak +#define __weak __attribute__((weak)) +#endif + +/* + * Use __hidden attribute to mark a non-static BPF subprogram effectively + * static for BPF verifier's verification algorithm purposes, allowing more + * extensive and permissive BPF verification process, taking into account + * subprogram's caller context. + */ +#define __hidden __attribute__((visibility("hidden"))) + +/* When utilizing vmlinux.h with BPF CO-RE, user BPF programs can't include + * any system-level headers (such as stddef.h, linux/version.h, etc), and + * commonly-used macros like NULL and KERNEL_VERSION aren't available through + * vmlinux.h. This just adds unnecessary hurdles and forces users to re-define + * them on their own. So as a convenience, provide such definitions here. + */ +#ifndef NULL +#define NULL ((void *)0) +#endif + +#ifndef KERNEL_VERSION +#define KERNEL_VERSION(a, b, c) (((a) << 16) + ((b) << 8) + ((c) > 255 ? 255 : (c))) +#endif + +/* + * Helper macros to manipulate data structures + */ +#ifndef offsetof +#define offsetof(TYPE, MEMBER) ((unsigned long)&((TYPE *)0)->MEMBER) +#endif +#ifndef container_of +#define container_of(ptr, type, member) \ + ({ \ + void *__mptr = (void *)(ptr); \ + ((type *)(__mptr - offsetof(type, member))); \ + }) +#endif + +/* + * Helper macro to throw a compilation error if __bpf_unreachable() gets + * built into the resulting code. This works given BPF back end does not + * implement __builtin_trap(). This is useful to assert that certain paths + * of the program code are never used and hence eliminated by the compiler. + * + * For example, consider a switch statement that covers known cases used by + * the program. __bpf_unreachable() can then reside in the default case. If + * the program gets extended such that a case is not covered in the switch + * statement, then it will throw a build error due to the default case not + * being compiled out. + */ +#ifndef __bpf_unreachable +# define __bpf_unreachable() __builtin_trap() +#endif + +/* + * Helper function to perform a tail call with a constant/immediate map slot. + */ +#if __clang_major__ >= 8 && defined(__bpf__) +static __always_inline void +bpf_tail_call_static(void *ctx, const void *map, const __u32 slot) +{ + if (!__builtin_constant_p(slot)) + __bpf_unreachable(); + + /* + * Provide a hard guarantee that LLVM won't optimize setting r2 (map + * pointer) and r3 (constant map index) from _different paths_ ending + * up at the _same_ call insn as otherwise we won't be able to use the + * jmpq/nopl retpoline-free patching by the x86-64 JIT in the kernel + * given they mismatch. See also d2e4c1e6c294 ("bpf: Constant map key + * tracking for prog array pokes") for details on verifier tracking. + * + * Note on clobber list: we need to stay in-line with BPF calling + * convention, so even if we don't end up using r0, r4, r5, we need + * to mark them as clobber so that LLVM doesn't end up using them + * before / after the call. + */ + asm volatile("r1 = %[ctx]\n\t" + "r2 = %[map]\n\t" + "r3 = %[slot]\n\t" + "call 12" + :: [ctx]"r"(ctx), [map]"r"(map), [slot]"i"(slot) + : "r0", "r1", "r2", "r3", "r4", "r5"); +} +#endif + +/* + * Helper structure used by eBPF C program + * to describe BPF map attributes to libbpf loader + */ +struct bpf_map_def { + unsigned int type; + unsigned int key_size; + unsigned int value_size; + unsigned int max_entries; + unsigned int map_flags; +}; + +enum libbpf_pin_type { + LIBBPF_PIN_NONE, + /* PIN_BY_NAME: pin maps by name (in /sys/fs/bpf by default) */ + LIBBPF_PIN_BY_NAME, +}; + +enum libbpf_tristate { + TRI_NO = 0, + TRI_YES = 1, + TRI_MODULE = 2, +}; + +#define __kconfig __attribute__((section(".kconfig"))) +#define __ksym __attribute__((section(".ksyms"))) + +#ifndef ___bpf_concat +#define ___bpf_concat(a, b) a ## b +#endif +#ifndef ___bpf_apply +#define ___bpf_apply(fn, n) ___bpf_concat(fn, n) +#endif +#ifndef ___bpf_nth +#define ___bpf_nth(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _a, _b, _c, N, ...) N +#endif +#ifndef ___bpf_narg +#define ___bpf_narg(...) \ + ___bpf_nth(_, ##__VA_ARGS__, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) +#endif + +#define ___bpf_fill0(arr, p, x) do {} while (0) +#define ___bpf_fill1(arr, p, x) arr[p] = x +#define ___bpf_fill2(arr, p, x, args...) arr[p] = x; ___bpf_fill1(arr, p + 1, args) +#define ___bpf_fill3(arr, p, x, args...) arr[p] = x; ___bpf_fill2(arr, p + 1, args) +#define ___bpf_fill4(arr, p, x, args...) arr[p] = x; ___bpf_fill3(arr, p + 1, args) +#define ___bpf_fill5(arr, p, x, args...) arr[p] = x; ___bpf_fill4(arr, p + 1, args) +#define ___bpf_fill6(arr, p, x, args...) arr[p] = x; ___bpf_fill5(arr, p + 1, args) +#define ___bpf_fill7(arr, p, x, args...) arr[p] = x; ___bpf_fill6(arr, p + 1, args) +#define ___bpf_fill8(arr, p, x, args...) arr[p] = x; ___bpf_fill7(arr, p + 1, args) +#define ___bpf_fill9(arr, p, x, args...) arr[p] = x; ___bpf_fill8(arr, p + 1, args) +#define ___bpf_fill10(arr, p, x, args...) arr[p] = x; ___bpf_fill9(arr, p + 1, args) +#define ___bpf_fill11(arr, p, x, args...) arr[p] = x; ___bpf_fill10(arr, p + 1, args) +#define ___bpf_fill12(arr, p, x, args...) arr[p] = x; ___bpf_fill11(arr, p + 1, args) +#define ___bpf_fill(arr, args...) \ + ___bpf_apply(___bpf_fill, ___bpf_narg(args))(arr, 0, args) + +/* + * BPF_SEQ_PRINTF to wrap bpf_seq_printf to-be-printed values + * in a structure. + */ +#define BPF_SEQ_PRINTF(seq, fmt, args...) \ +({ \ + static const char ___fmt[] = fmt; \ + unsigned long long ___param[___bpf_narg(args)]; \ + \ + _Pragma("GCC diagnostic push") \ + _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ + ___bpf_fill(___param, args); \ + _Pragma("GCC diagnostic pop") \ + \ + bpf_seq_printf(seq, ___fmt, sizeof(___fmt), \ + ___param, sizeof(___param)); \ +}) + +/* + * BPF_SNPRINTF wraps the bpf_snprintf helper with variadic arguments instead of + * an array of u64. + */ +#define BPF_SNPRINTF(out, out_size, fmt, args...) \ +({ \ + static const char ___fmt[] = fmt; \ + unsigned long long ___param[___bpf_narg(args)]; \ + \ + _Pragma("GCC diagnostic push") \ + _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ + ___bpf_fill(___param, args); \ + _Pragma("GCC diagnostic pop") \ + \ + bpf_snprintf(out, out_size, ___fmt, \ + ___param, sizeof(___param)); \ +}) + +#endif diff --git a/include/libbpf/bpf_tracing.h b/include/libbpf/bpf_tracing.h new file mode 100644 index 000000000..d6bfbe009 --- /dev/null +++ b/include/libbpf/bpf_tracing.h @@ -0,0 +1,460 @@ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ +#ifndef __BPF_TRACING_H__ +#define __BPF_TRACING_H__ + +/* Scan the ARCH passed in from ARCH env variable (see Makefile) */ +#if defined(__TARGET_ARCH_x86) + #define bpf_target_x86 + #define bpf_target_defined +#elif defined(__TARGET_ARCH_s390) + #define bpf_target_s390 + #define bpf_target_defined +#elif defined(__TARGET_ARCH_arm) + #define bpf_target_arm + #define bpf_target_defined +#elif defined(__TARGET_ARCH_arm64) + #define bpf_target_arm64 + #define bpf_target_defined +#elif defined(__TARGET_ARCH_mips) + #define bpf_target_mips + #define bpf_target_defined +#elif defined(__TARGET_ARCH_powerpc) + #define bpf_target_powerpc + #define bpf_target_defined +#elif defined(__TARGET_ARCH_sparc) + #define bpf_target_sparc + #define bpf_target_defined +#else + +/* Fall back to what the compiler says */ +#if defined(__x86_64__) + #define bpf_target_x86 + #define bpf_target_defined +#elif defined(__s390__) + #define bpf_target_s390 + #define bpf_target_defined +#elif defined(__arm__) + #define bpf_target_arm + #define bpf_target_defined +#elif defined(__aarch64__) + #define bpf_target_arm64 + #define bpf_target_defined +#elif defined(__mips__) + #define bpf_target_mips + #define bpf_target_defined +#elif defined(__powerpc__) + #define bpf_target_powerpc + #define bpf_target_defined +#elif defined(__sparc__) + #define bpf_target_sparc + #define bpf_target_defined +#endif /* no compiler target */ + +#endif + +#ifndef __BPF_TARGET_MISSING +#define __BPF_TARGET_MISSING "GCC error \"Must specify a BPF target arch via __TARGET_ARCH_xxx\"" +#endif + +#if defined(bpf_target_x86) + +#if defined(__KERNEL__) || defined(__VMLINUX_H__) + +#define PT_REGS_PARM1(x) ((x)->di) +#define PT_REGS_PARM2(x) ((x)->si) +#define PT_REGS_PARM3(x) ((x)->dx) +#define PT_REGS_PARM4(x) ((x)->cx) +#define PT_REGS_PARM5(x) ((x)->r8) +#define PT_REGS_RET(x) ((x)->sp) +#define PT_REGS_FP(x) ((x)->bp) +#define PT_REGS_RC(x) ((x)->ax) +#define PT_REGS_SP(x) ((x)->sp) +#define PT_REGS_IP(x) ((x)->ip) + +#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), di) +#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), si) +#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), dx) +#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((x), cx) +#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), r8) +#define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), sp) +#define PT_REGS_FP_CORE(x) BPF_CORE_READ((x), bp) +#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), ax) +#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), sp) +#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), ip) + +#else + +#ifdef __i386__ +/* i386 kernel is built with -mregparm=3 */ +#define PT_REGS_PARM1(x) ((x)->eax) +#define PT_REGS_PARM2(x) ((x)->edx) +#define PT_REGS_PARM3(x) ((x)->ecx) +#define PT_REGS_PARM4(x) 0 +#define PT_REGS_PARM5(x) 0 +#define PT_REGS_RET(x) ((x)->esp) +#define PT_REGS_FP(x) ((x)->ebp) +#define PT_REGS_RC(x) ((x)->eax) +#define PT_REGS_SP(x) ((x)->esp) +#define PT_REGS_IP(x) ((x)->eip) + +#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), eax) +#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), edx) +#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), ecx) +#define PT_REGS_PARM4_CORE(x) 0 +#define PT_REGS_PARM5_CORE(x) 0 +#define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), esp) +#define PT_REGS_FP_CORE(x) BPF_CORE_READ((x), ebp) +#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), eax) +#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), esp) +#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), eip) + +#else + +#define PT_REGS_PARM1(x) ((x)->rdi) +#define PT_REGS_PARM2(x) ((x)->rsi) +#define PT_REGS_PARM3(x) ((x)->rdx) +#define PT_REGS_PARM4(x) ((x)->rcx) +#define PT_REGS_PARM5(x) ((x)->r8) +#define PT_REGS_RET(x) ((x)->rsp) +#define PT_REGS_FP(x) ((x)->rbp) +#define PT_REGS_RC(x) ((x)->rax) +#define PT_REGS_SP(x) ((x)->rsp) +#define PT_REGS_IP(x) ((x)->rip) + +#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), rdi) +#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), rsi) +#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), rdx) +#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((x), rcx) +#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), r8) +#define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), rsp) +#define PT_REGS_FP_CORE(x) BPF_CORE_READ((x), rbp) +#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), rax) +#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), rsp) +#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), rip) + +#endif +#endif + +#elif defined(bpf_target_s390) + +/* s390 provides user_pt_regs instead of struct pt_regs to userspace */ +struct pt_regs; +#define PT_REGS_S390 const volatile user_pt_regs +#define PT_REGS_PARM1(x) (((PT_REGS_S390 *)(x))->gprs[2]) +#define PT_REGS_PARM2(x) (((PT_REGS_S390 *)(x))->gprs[3]) +#define PT_REGS_PARM3(x) (((PT_REGS_S390 *)(x))->gprs[4]) +#define PT_REGS_PARM4(x) (((PT_REGS_S390 *)(x))->gprs[5]) +#define PT_REGS_PARM5(x) (((PT_REGS_S390 *)(x))->gprs[6]) +#define PT_REGS_RET(x) (((PT_REGS_S390 *)(x))->gprs[14]) +/* Works only with CONFIG_FRAME_POINTER */ +#define PT_REGS_FP(x) (((PT_REGS_S390 *)(x))->gprs[11]) +#define PT_REGS_RC(x) (((PT_REGS_S390 *)(x))->gprs[2]) +#define PT_REGS_SP(x) (((PT_REGS_S390 *)(x))->gprs[15]) +#define PT_REGS_IP(x) (((PT_REGS_S390 *)(x))->psw.addr) + +#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[2]) +#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[3]) +#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[4]) +#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[5]) +#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[6]) +#define PT_REGS_RET_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[14]) +#define PT_REGS_FP_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[11]) +#define PT_REGS_RC_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[2]) +#define PT_REGS_SP_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[15]) +#define PT_REGS_IP_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), psw.addr) + +#elif defined(bpf_target_arm) + +#define PT_REGS_PARM1(x) ((x)->uregs[0]) +#define PT_REGS_PARM2(x) ((x)->uregs[1]) +#define PT_REGS_PARM3(x) ((x)->uregs[2]) +#define PT_REGS_PARM4(x) ((x)->uregs[3]) +#define PT_REGS_PARM5(x) ((x)->uregs[4]) +#define PT_REGS_RET(x) ((x)->uregs[14]) +#define PT_REGS_FP(x) ((x)->uregs[11]) /* Works only with CONFIG_FRAME_POINTER */ +#define PT_REGS_RC(x) ((x)->uregs[0]) +#define PT_REGS_SP(x) ((x)->uregs[13]) +#define PT_REGS_IP(x) ((x)->uregs[12]) + +#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), uregs[0]) +#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), uregs[1]) +#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), uregs[2]) +#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((x), uregs[3]) +#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), uregs[4]) +#define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), uregs[14]) +#define PT_REGS_FP_CORE(x) BPF_CORE_READ((x), uregs[11]) +#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), uregs[0]) +#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), uregs[13]) +#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), uregs[12]) + +#elif defined(bpf_target_arm64) + +/* arm64 provides struct user_pt_regs instead of struct pt_regs to userspace */ +struct pt_regs; +#define PT_REGS_ARM64 const volatile struct user_pt_regs +#define PT_REGS_PARM1(x) (((PT_REGS_ARM64 *)(x))->regs[0]) +#define PT_REGS_PARM2(x) (((PT_REGS_ARM64 *)(x))->regs[1]) +#define PT_REGS_PARM3(x) (((PT_REGS_ARM64 *)(x))->regs[2]) +#define PT_REGS_PARM4(x) (((PT_REGS_ARM64 *)(x))->regs[3]) +#define PT_REGS_PARM5(x) (((PT_REGS_ARM64 *)(x))->regs[4]) +#define PT_REGS_RET(x) (((PT_REGS_ARM64 *)(x))->regs[30]) +/* Works only with CONFIG_FRAME_POINTER */ +#define PT_REGS_FP(x) (((PT_REGS_ARM64 *)(x))->regs[29]) +#define PT_REGS_RC(x) (((PT_REGS_ARM64 *)(x))->regs[0]) +#define PT_REGS_SP(x) (((PT_REGS_ARM64 *)(x))->sp) +#define PT_REGS_IP(x) (((PT_REGS_ARM64 *)(x))->pc) + +#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[0]) +#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[1]) +#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[2]) +#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[3]) +#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[4]) +#define PT_REGS_RET_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[30]) +#define PT_REGS_FP_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[29]) +#define PT_REGS_RC_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[0]) +#define PT_REGS_SP_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), sp) +#define PT_REGS_IP_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), pc) + +#elif defined(bpf_target_mips) + +#define PT_REGS_PARM1(x) ((x)->regs[4]) +#define PT_REGS_PARM2(x) ((x)->regs[5]) +#define PT_REGS_PARM3(x) ((x)->regs[6]) +#define PT_REGS_PARM4(x) ((x)->regs[7]) +#define PT_REGS_PARM5(x) ((x)->regs[8]) +#define PT_REGS_RET(x) ((x)->regs[31]) +#define PT_REGS_FP(x) ((x)->regs[30]) /* Works only with CONFIG_FRAME_POINTER */ +#define PT_REGS_RC(x) ((x)->regs[2]) +#define PT_REGS_SP(x) ((x)->regs[29]) +#define PT_REGS_IP(x) ((x)->cp0_epc) + +#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), regs[4]) +#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), regs[5]) +#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), regs[6]) +#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((x), regs[7]) +#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), regs[8]) +#define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), regs[31]) +#define PT_REGS_FP_CORE(x) BPF_CORE_READ((x), regs[30]) +#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), regs[2]) +#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), regs[29]) +#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), cp0_epc) + +#elif defined(bpf_target_powerpc) + +#define PT_REGS_PARM1(x) ((x)->gpr[3]) +#define PT_REGS_PARM2(x) ((x)->gpr[4]) +#define PT_REGS_PARM3(x) ((x)->gpr[5]) +#define PT_REGS_PARM4(x) ((x)->gpr[6]) +#define PT_REGS_PARM5(x) ((x)->gpr[7]) +#define PT_REGS_RC(x) ((x)->gpr[3]) +#define PT_REGS_SP(x) ((x)->sp) +#define PT_REGS_IP(x) ((x)->nip) + +#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), gpr[3]) +#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), gpr[4]) +#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), gpr[5]) +#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((x), gpr[6]) +#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), gpr[7]) +#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), gpr[3]) +#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), sp) +#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), nip) + +#elif defined(bpf_target_sparc) + +#define PT_REGS_PARM1(x) ((x)->u_regs[UREG_I0]) +#define PT_REGS_PARM2(x) ((x)->u_regs[UREG_I1]) +#define PT_REGS_PARM3(x) ((x)->u_regs[UREG_I2]) +#define PT_REGS_PARM4(x) ((x)->u_regs[UREG_I3]) +#define PT_REGS_PARM5(x) ((x)->u_regs[UREG_I4]) +#define PT_REGS_RET(x) ((x)->u_regs[UREG_I7]) +#define PT_REGS_RC(x) ((x)->u_regs[UREG_I0]) +#define PT_REGS_SP(x) ((x)->u_regs[UREG_FP]) + +#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I0]) +#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I1]) +#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I2]) +#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I3]) +#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I4]) +#define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I7]) +#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I0]) +#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), u_regs[UREG_FP]) + +/* Should this also be a bpf_target check for the sparc case? */ +#if defined(__arch64__) +#define PT_REGS_IP(x) ((x)->tpc) +#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), tpc) +#else +#define PT_REGS_IP(x) ((x)->pc) +#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), pc) +#endif + +#endif + +#if defined(bpf_target_powerpc) +#define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = (ctx)->link; }) +#define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP +#elif defined(bpf_target_sparc) +#define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = PT_REGS_RET(ctx); }) +#define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP +#elif defined(bpf_target_defined) +#define BPF_KPROBE_READ_RET_IP(ip, ctx) \ + ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)PT_REGS_RET(ctx)); }) +#define BPF_KRETPROBE_READ_RET_IP(ip, ctx) \ + ({ bpf_probe_read_kernel(&(ip), sizeof(ip), \ + (void *)(PT_REGS_FP(ctx) + sizeof(ip))); }) +#endif + +#if !defined(bpf_target_defined) + +#define PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM2(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM3(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM4(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM5(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_RET(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_FP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_RC(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_SP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_IP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) + +#define PT_REGS_PARM1_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM2_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM3_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM4_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM5_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_RET_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_FP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_RC_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_SP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_IP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) + +#define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) + +#endif /* !defined(bpf_target_defined) */ + +#ifndef ___bpf_concat +#define ___bpf_concat(a, b) a ## b +#endif +#ifndef ___bpf_apply +#define ___bpf_apply(fn, n) ___bpf_concat(fn, n) +#endif +#ifndef ___bpf_nth +#define ___bpf_nth(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _a, _b, _c, N, ...) N +#endif +#ifndef ___bpf_narg +#define ___bpf_narg(...) \ + ___bpf_nth(_, ##__VA_ARGS__, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) +#endif + +#define ___bpf_ctx_cast0() ctx +#define ___bpf_ctx_cast1(x) ___bpf_ctx_cast0(), (void *)ctx[0] +#define ___bpf_ctx_cast2(x, args...) ___bpf_ctx_cast1(args), (void *)ctx[1] +#define ___bpf_ctx_cast3(x, args...) ___bpf_ctx_cast2(args), (void *)ctx[2] +#define ___bpf_ctx_cast4(x, args...) ___bpf_ctx_cast3(args), (void *)ctx[3] +#define ___bpf_ctx_cast5(x, args...) ___bpf_ctx_cast4(args), (void *)ctx[4] +#define ___bpf_ctx_cast6(x, args...) ___bpf_ctx_cast5(args), (void *)ctx[5] +#define ___bpf_ctx_cast7(x, args...) ___bpf_ctx_cast6(args), (void *)ctx[6] +#define ___bpf_ctx_cast8(x, args...) ___bpf_ctx_cast7(args), (void *)ctx[7] +#define ___bpf_ctx_cast9(x, args...) ___bpf_ctx_cast8(args), (void *)ctx[8] +#define ___bpf_ctx_cast10(x, args...) ___bpf_ctx_cast9(args), (void *)ctx[9] +#define ___bpf_ctx_cast11(x, args...) ___bpf_ctx_cast10(args), (void *)ctx[10] +#define ___bpf_ctx_cast12(x, args...) ___bpf_ctx_cast11(args), (void *)ctx[11] +#define ___bpf_ctx_cast(args...) \ + ___bpf_apply(___bpf_ctx_cast, ___bpf_narg(args))(args) + +/* + * BPF_PROG is a convenience wrapper for generic tp_btf/fentry/fexit and + * similar kinds of BPF programs, that accept input arguments as a single + * pointer to untyped u64 array, where each u64 can actually be a typed + * pointer or integer of different size. Instead of requring user to write + * manual casts and work with array elements by index, BPF_PROG macro + * allows user to declare a list of named and typed input arguments in the + * same syntax as for normal C function. All the casting is hidden and + * performed transparently, while user code can just assume working with + * function arguments of specified type and name. + * + * Original raw context argument is preserved as well as 'ctx' argument. + * This is useful when using BPF helpers that expect original context + * as one of the parameters (e.g., for bpf_perf_event_output()). + */ +#define BPF_PROG(name, args...) \ +name(unsigned long long *ctx); \ +static __attribute__((always_inline)) typeof(name(0)) \ +____##name(unsigned long long *ctx, ##args); \ +typeof(name(0)) name(unsigned long long *ctx) \ +{ \ + _Pragma("GCC diagnostic push") \ + _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ + return ____##name(___bpf_ctx_cast(args)); \ + _Pragma("GCC diagnostic pop") \ +} \ +static __attribute__((always_inline)) typeof(name(0)) \ +____##name(unsigned long long *ctx, ##args) + +struct pt_regs; + +#define ___bpf_kprobe_args0() ctx +#define ___bpf_kprobe_args1(x) \ + ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx) +#define ___bpf_kprobe_args2(x, args...) \ + ___bpf_kprobe_args1(args), (void *)PT_REGS_PARM2(ctx) +#define ___bpf_kprobe_args3(x, args...) \ + ___bpf_kprobe_args2(args), (void *)PT_REGS_PARM3(ctx) +#define ___bpf_kprobe_args4(x, args...) \ + ___bpf_kprobe_args3(args), (void *)PT_REGS_PARM4(ctx) +#define ___bpf_kprobe_args5(x, args...) \ + ___bpf_kprobe_args4(args), (void *)PT_REGS_PARM5(ctx) +#define ___bpf_kprobe_args(args...) \ + ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args) + +/* + * BPF_KPROBE serves the same purpose for kprobes as BPF_PROG for + * tp_btf/fentry/fexit BPF programs. It hides the underlying platform-specific + * low-level way of getting kprobe input arguments from struct pt_regs, and + * provides a familiar typed and named function arguments syntax and + * semantics of accessing kprobe input paremeters. + * + * Original struct pt_regs* context is preserved as 'ctx' argument. This might + * be necessary when using BPF helpers like bpf_perf_event_output(). + */ +#define BPF_KPROBE(name, args...) \ +name(struct pt_regs *ctx); \ +static __attribute__((always_inline)) typeof(name(0)) \ +____##name(struct pt_regs *ctx, ##args); \ +typeof(name(0)) name(struct pt_regs *ctx) \ +{ \ + _Pragma("GCC diagnostic push") \ + _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ + return ____##name(___bpf_kprobe_args(args)); \ + _Pragma("GCC diagnostic pop") \ +} \ +static __attribute__((always_inline)) typeof(name(0)) \ +____##name(struct pt_regs *ctx, ##args) + +#define ___bpf_kretprobe_args0() ctx +#define ___bpf_kretprobe_args1(x) \ + ___bpf_kretprobe_args0(), (void *)PT_REGS_RC(ctx) +#define ___bpf_kretprobe_args(args...) \ + ___bpf_apply(___bpf_kretprobe_args, ___bpf_narg(args))(args) + +/* + * BPF_KRETPROBE is similar to BPF_KPROBE, except, it only provides optional + * return value (in addition to `struct pt_regs *ctx`), but no input + * arguments, because they will be clobbered by the time probed function + * returns. + */ +#define BPF_KRETPROBE(name, args...) \ +name(struct pt_regs *ctx); \ +static __attribute__((always_inline)) typeof(name(0)) \ +____##name(struct pt_regs *ctx, ##args); \ +typeof(name(0)) name(struct pt_regs *ctx) \ +{ \ + _Pragma("GCC diagnostic push") \ + _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ + return ____##name(___bpf_kretprobe_args(args)); \ + _Pragma("GCC diagnostic pop") \ +} \ +static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args) + +#endif diff --git a/include/libbpf/btf.h b/include/libbpf/btf.h new file mode 100644 index 000000000..4a711f990 --- /dev/null +++ b/include/libbpf/btf.h @@ -0,0 +1,403 @@ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ +/* Copyright (c) 2018 Facebook */ + +#ifndef __LIBBPF_BTF_H +#define __LIBBPF_BTF_H + +#include +#include +#include +#include + +#include "libbpf_common.h" + +#ifdef __cplusplus +extern "C" { +#endif + +#define BTF_ELF_SEC ".BTF" +#define BTF_EXT_ELF_SEC ".BTF.ext" +#define MAPS_ELF_SEC ".maps" + +struct btf; +struct btf_ext; +struct btf_type; + +struct bpf_object; + +enum btf_endianness { + BTF_LITTLE_ENDIAN = 0, + BTF_BIG_ENDIAN = 1, +}; + +LIBBPF_API void btf__free(struct btf *btf); + +LIBBPF_API struct btf *btf__new(const void *data, __u32 size); +LIBBPF_API struct btf *btf__new_split(const void *data, __u32 size, struct btf *base_btf); +LIBBPF_API struct btf *btf__new_empty(void); +LIBBPF_API struct btf *btf__new_empty_split(struct btf *base_btf); + +LIBBPF_API struct btf *btf__parse(const char *path, struct btf_ext **btf_ext); +LIBBPF_API struct btf *btf__parse_split(const char *path, struct btf *base_btf); +LIBBPF_API struct btf *btf__parse_elf(const char *path, struct btf_ext **btf_ext); +LIBBPF_API struct btf *btf__parse_elf_split(const char *path, struct btf *base_btf); +LIBBPF_API struct btf *btf__parse_raw(const char *path); +LIBBPF_API struct btf *btf__parse_raw_split(const char *path, struct btf *base_btf); + +LIBBPF_API struct btf *btf__load_vmlinux_btf(void); +LIBBPF_API struct btf *btf__load_module_btf(const char *module_name, struct btf *vmlinux_btf); +LIBBPF_API struct btf *libbpf_find_kernel_btf(void); + +LIBBPF_API struct btf *btf__load_from_kernel_by_id(__u32 id); +LIBBPF_API struct btf *btf__load_from_kernel_by_id_split(__u32 id, struct btf *base_btf); +LIBBPF_API int btf__get_from_id(__u32 id, struct btf **btf); + +LIBBPF_API int btf__finalize_data(struct bpf_object *obj, struct btf *btf); +LIBBPF_API int btf__load(struct btf *btf); +LIBBPF_API int btf__load_into_kernel(struct btf *btf); +LIBBPF_API __s32 btf__find_by_name(const struct btf *btf, + const char *type_name); +LIBBPF_API __s32 btf__find_by_name_kind(const struct btf *btf, + const char *type_name, __u32 kind); +LIBBPF_API __u32 btf__get_nr_types(const struct btf *btf); +LIBBPF_API const struct btf *btf__base_btf(const struct btf *btf); +LIBBPF_API const struct btf_type *btf__type_by_id(const struct btf *btf, + __u32 id); +LIBBPF_API size_t btf__pointer_size(const struct btf *btf); +LIBBPF_API int btf__set_pointer_size(struct btf *btf, size_t ptr_sz); +LIBBPF_API enum btf_endianness btf__endianness(const struct btf *btf); +LIBBPF_API int btf__set_endianness(struct btf *btf, enum btf_endianness endian); +LIBBPF_API __s64 btf__resolve_size(const struct btf *btf, __u32 type_id); +LIBBPF_API int btf__resolve_type(const struct btf *btf, __u32 type_id); +LIBBPF_API int btf__align_of(const struct btf *btf, __u32 id); +LIBBPF_API int btf__fd(const struct btf *btf); +LIBBPF_API void btf__set_fd(struct btf *btf, int fd); +LIBBPF_API const void *btf__get_raw_data(const struct btf *btf, __u32 *size); +LIBBPF_API const char *btf__name_by_offset(const struct btf *btf, __u32 offset); +LIBBPF_API const char *btf__str_by_offset(const struct btf *btf, __u32 offset); +LIBBPF_API int btf__get_map_kv_tids(const struct btf *btf, const char *map_name, + __u32 expected_key_size, + __u32 expected_value_size, + __u32 *key_type_id, __u32 *value_type_id); + +LIBBPF_API struct btf_ext *btf_ext__new(__u8 *data, __u32 size); +LIBBPF_API void btf_ext__free(struct btf_ext *btf_ext); +LIBBPF_API const void *btf_ext__get_raw_data(const struct btf_ext *btf_ext, + __u32 *size); +LIBBPF_API LIBBPF_DEPRECATED("btf_ext__reloc_func_info was never meant as a public API and has wrong assumptions embedded in it; it will be removed in the future libbpf versions") +int btf_ext__reloc_func_info(const struct btf *btf, + const struct btf_ext *btf_ext, + const char *sec_name, __u32 insns_cnt, + void **func_info, __u32 *cnt); +LIBBPF_API LIBBPF_DEPRECATED("btf_ext__reloc_line_info was never meant as a public API and has wrong assumptions embedded in it; it will be removed in the future libbpf versions") +int btf_ext__reloc_line_info(const struct btf *btf, + const struct btf_ext *btf_ext, + const char *sec_name, __u32 insns_cnt, + void **line_info, __u32 *cnt); +LIBBPF_API __u32 btf_ext__func_info_rec_size(const struct btf_ext *btf_ext); +LIBBPF_API __u32 btf_ext__line_info_rec_size(const struct btf_ext *btf_ext); + +LIBBPF_API int btf__find_str(struct btf *btf, const char *s); +LIBBPF_API int btf__add_str(struct btf *btf, const char *s); +LIBBPF_API int btf__add_type(struct btf *btf, const struct btf *src_btf, + const struct btf_type *src_type); + +LIBBPF_API int btf__add_int(struct btf *btf, const char *name, size_t byte_sz, int encoding); +LIBBPF_API int btf__add_float(struct btf *btf, const char *name, size_t byte_sz); +LIBBPF_API int btf__add_ptr(struct btf *btf, int ref_type_id); +LIBBPF_API int btf__add_array(struct btf *btf, + int index_type_id, int elem_type_id, __u32 nr_elems); +/* struct/union construction APIs */ +LIBBPF_API int btf__add_struct(struct btf *btf, const char *name, __u32 sz); +LIBBPF_API int btf__add_union(struct btf *btf, const char *name, __u32 sz); +LIBBPF_API int btf__add_field(struct btf *btf, const char *name, int field_type_id, + __u32 bit_offset, __u32 bit_size); + +/* enum construction APIs */ +LIBBPF_API int btf__add_enum(struct btf *btf, const char *name, __u32 bytes_sz); +LIBBPF_API int btf__add_enum_value(struct btf *btf, const char *name, __s64 value); + +enum btf_fwd_kind { + BTF_FWD_STRUCT = 0, + BTF_FWD_UNION = 1, + BTF_FWD_ENUM = 2, +}; + +LIBBPF_API int btf__add_fwd(struct btf *btf, const char *name, enum btf_fwd_kind fwd_kind); +LIBBPF_API int btf__add_typedef(struct btf *btf, const char *name, int ref_type_id); +LIBBPF_API int btf__add_volatile(struct btf *btf, int ref_type_id); +LIBBPF_API int btf__add_const(struct btf *btf, int ref_type_id); +LIBBPF_API int btf__add_restrict(struct btf *btf, int ref_type_id); + +/* func and func_proto construction APIs */ +LIBBPF_API int btf__add_func(struct btf *btf, const char *name, + enum btf_func_linkage linkage, int proto_type_id); +LIBBPF_API int btf__add_func_proto(struct btf *btf, int ret_type_id); +LIBBPF_API int btf__add_func_param(struct btf *btf, const char *name, int type_id); + +/* var & datasec construction APIs */ +LIBBPF_API int btf__add_var(struct btf *btf, const char *name, int linkage, int type_id); +LIBBPF_API int btf__add_datasec(struct btf *btf, const char *name, __u32 byte_sz); +LIBBPF_API int btf__add_datasec_var_info(struct btf *btf, int var_type_id, + __u32 offset, __u32 byte_sz); + +struct btf_dedup_opts { + unsigned int dedup_table_size; + bool dont_resolve_fwds; +}; + +LIBBPF_API int btf__dedup(struct btf *btf, struct btf_ext *btf_ext, + const struct btf_dedup_opts *opts); + +struct btf_dump; + +struct btf_dump_opts { + void *ctx; +}; + +typedef void (*btf_dump_printf_fn_t)(void *ctx, const char *fmt, va_list args); + +LIBBPF_API struct btf_dump *btf_dump__new(const struct btf *btf, + const struct btf_ext *btf_ext, + const struct btf_dump_opts *opts, + btf_dump_printf_fn_t printf_fn); +LIBBPF_API void btf_dump__free(struct btf_dump *d); + +LIBBPF_API int btf_dump__dump_type(struct btf_dump *d, __u32 id); + +struct btf_dump_emit_type_decl_opts { + /* size of this struct, for forward/backward compatiblity */ + size_t sz; + /* optional field name for type declaration, e.g.: + * - struct my_struct + * - void (*)(int) + * - char (*)[123] + */ + const char *field_name; + /* extra indentation level (in number of tabs) to emit for multi-line + * type declarations (e.g., anonymous struct); applies for lines + * starting from the second one (first line is assumed to have + * necessary indentation already + */ + int indent_level; + /* strip all the const/volatile/restrict mods */ + bool strip_mods; + size_t :0; +}; +#define btf_dump_emit_type_decl_opts__last_field strip_mods + +LIBBPF_API int +btf_dump__emit_type_decl(struct btf_dump *d, __u32 id, + const struct btf_dump_emit_type_decl_opts *opts); + + +struct btf_dump_type_data_opts { + /* size of this struct, for forward/backward compatibility */ + size_t sz; + const char *indent_str; + int indent_level; + /* below match "show" flags for bpf_show_snprintf() */ + bool compact; /* no newlines/indentation */ + bool skip_names; /* skip member/type names */ + bool emit_zeroes; /* show 0-valued fields */ + size_t :0; +}; +#define btf_dump_type_data_opts__last_field emit_zeroes + +LIBBPF_API int +btf_dump__dump_type_data(struct btf_dump *d, __u32 id, + const void *data, size_t data_sz, + const struct btf_dump_type_data_opts *opts); + +/* + * A set of helpers for easier BTF types handling + */ +static inline __u16 btf_kind(const struct btf_type *t) +{ + return BTF_INFO_KIND(t->info); +} + +static inline __u16 btf_vlen(const struct btf_type *t) +{ + return BTF_INFO_VLEN(t->info); +} + +static inline bool btf_kflag(const struct btf_type *t) +{ + return BTF_INFO_KFLAG(t->info); +} + +static inline bool btf_is_void(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_UNKN; +} + +static inline bool btf_is_int(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_INT; +} + +static inline bool btf_is_ptr(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_PTR; +} + +static inline bool btf_is_array(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_ARRAY; +} + +static inline bool btf_is_struct(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_STRUCT; +} + +static inline bool btf_is_union(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_UNION; +} + +static inline bool btf_is_composite(const struct btf_type *t) +{ + __u16 kind = btf_kind(t); + + return kind == BTF_KIND_STRUCT || kind == BTF_KIND_UNION; +} + +static inline bool btf_is_enum(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_ENUM; +} + +static inline bool btf_is_fwd(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_FWD; +} + +static inline bool btf_is_typedef(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_TYPEDEF; +} + +static inline bool btf_is_volatile(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_VOLATILE; +} + +static inline bool btf_is_const(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_CONST; +} + +static inline bool btf_is_restrict(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_RESTRICT; +} + +static inline bool btf_is_mod(const struct btf_type *t) +{ + __u16 kind = btf_kind(t); + + return kind == BTF_KIND_VOLATILE || + kind == BTF_KIND_CONST || + kind == BTF_KIND_RESTRICT; +} + +static inline bool btf_is_func(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_FUNC; +} + +static inline bool btf_is_func_proto(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_FUNC_PROTO; +} + +static inline bool btf_is_var(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_VAR; +} + +static inline bool btf_is_datasec(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_DATASEC; +} + +static inline bool btf_is_float(const struct btf_type *t) +{ + return btf_kind(t) == BTF_KIND_FLOAT; +} + +static inline __u8 btf_int_encoding(const struct btf_type *t) +{ + return BTF_INT_ENCODING(*(__u32 *)(t + 1)); +} + +static inline __u8 btf_int_offset(const struct btf_type *t) +{ + return BTF_INT_OFFSET(*(__u32 *)(t + 1)); +} + +static inline __u8 btf_int_bits(const struct btf_type *t) +{ + return BTF_INT_BITS(*(__u32 *)(t + 1)); +} + +static inline struct btf_array *btf_array(const struct btf_type *t) +{ + return (struct btf_array *)(t + 1); +} + +static inline struct btf_enum *btf_enum(const struct btf_type *t) +{ + return (struct btf_enum *)(t + 1); +} + +static inline struct btf_member *btf_members(const struct btf_type *t) +{ + return (struct btf_member *)(t + 1); +} + +/* Get bit offset of a member with specified index. */ +static inline __u32 btf_member_bit_offset(const struct btf_type *t, + __u32 member_idx) +{ + const struct btf_member *m = btf_members(t) + member_idx; + bool kflag = btf_kflag(t); + + return kflag ? BTF_MEMBER_BIT_OFFSET(m->offset) : m->offset; +} +/* + * Get bitfield size of a member, assuming t is BTF_KIND_STRUCT or + * BTF_KIND_UNION. If member is not a bitfield, zero is returned. + */ +static inline __u32 btf_member_bitfield_size(const struct btf_type *t, + __u32 member_idx) +{ + const struct btf_member *m = btf_members(t) + member_idx; + bool kflag = btf_kflag(t); + + return kflag ? BTF_MEMBER_BITFIELD_SIZE(m->offset) : 0; +} + +static inline struct btf_param *btf_params(const struct btf_type *t) +{ + return (struct btf_param *)(t + 1); +} + +static inline struct btf_var *btf_var(const struct btf_type *t) +{ + return (struct btf_var *)(t + 1); +} + +static inline struct btf_var_secinfo * +btf_var_secinfos(const struct btf_type *t) +{ + return (struct btf_var_secinfo *)(t + 1); +} + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif /* __LIBBPF_BTF_H */ diff --git a/include/libbpf/libbpf.h b/include/libbpf/libbpf.h new file mode 100644 index 000000000..2f6f0e15d --- /dev/null +++ b/include/libbpf/libbpf.h @@ -0,0 +1,922 @@ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ + +/* + * Common eBPF ELF object loading operations. + * + * Copyright (C) 2013-2015 Alexei Starovoitov + * Copyright (C) 2015 Wang Nan + * Copyright (C) 2015 Huawei Inc. + */ +#ifndef __LIBBPF_LIBBPF_H +#define __LIBBPF_LIBBPF_H + +#include +#include +#include +#include +#include // for size_t +#include + +#include "libbpf_common.h" +#include "libbpf_legacy.h" + +#ifdef __cplusplus +extern "C" { +#endif + +enum libbpf_errno { + __LIBBPF_ERRNO__START = 4000, + + /* Something wrong in libelf */ + LIBBPF_ERRNO__LIBELF = __LIBBPF_ERRNO__START, + LIBBPF_ERRNO__FORMAT, /* BPF object format invalid */ + LIBBPF_ERRNO__KVERSION, /* Incorrect or no 'version' section */ + LIBBPF_ERRNO__ENDIAN, /* Endian mismatch */ + LIBBPF_ERRNO__INTERNAL, /* Internal error in libbpf */ + LIBBPF_ERRNO__RELOC, /* Relocation failed */ + LIBBPF_ERRNO__LOAD, /* Load program failure for unknown reason */ + LIBBPF_ERRNO__VERIFY, /* Kernel verifier blocks program loading */ + LIBBPF_ERRNO__PROG2BIG, /* Program too big */ + LIBBPF_ERRNO__KVER, /* Incorrect kernel version */ + LIBBPF_ERRNO__PROGTYPE, /* Kernel doesn't support this program type */ + LIBBPF_ERRNO__WRNGPID, /* Wrong pid in netlink message */ + LIBBPF_ERRNO__INVSEQ, /* Invalid netlink sequence */ + LIBBPF_ERRNO__NLPARSE, /* netlink parsing error */ + __LIBBPF_ERRNO__END, +}; + +LIBBPF_API int libbpf_strerror(int err, char *buf, size_t size); + +enum libbpf_print_level { + LIBBPF_WARN, + LIBBPF_INFO, + LIBBPF_DEBUG, +}; + +typedef int (*libbpf_print_fn_t)(enum libbpf_print_level level, + const char *, va_list ap); + +LIBBPF_API libbpf_print_fn_t libbpf_set_print(libbpf_print_fn_t fn); + +/* Hide internal to user */ +struct bpf_object; + +struct bpf_object_open_attr { + const char *file; + enum bpf_prog_type prog_type; +}; + +struct bpf_object_open_opts { + /* size of this struct, for forward/backward compatiblity */ + size_t sz; + /* object name override, if provided: + * - for object open from file, this will override setting object + * name from file path's base name; + * - for object open from memory buffer, this will specify an object + * name and will override default "-" name; + */ + const char *object_name; + /* parse map definitions non-strictly, allowing extra attributes/data */ + bool relaxed_maps; + /* DEPRECATED: handle CO-RE relocations non-strictly, allowing failures. + * Value is ignored. Relocations always are processed non-strictly. + * Non-relocatable instructions are replaced with invalid ones to + * prevent accidental errors. + * */ + bool relaxed_core_relocs; + /* maps that set the 'pinning' attribute in their definition will have + * their pin_path attribute set to a file in this directory, and be + * auto-pinned to that path on load; defaults to "/sys/fs/bpf". + */ + const char *pin_root_path; + __u32 attach_prog_fd; + /* Additional kernel config content that augments and overrides + * system Kconfig for CONFIG_xxx externs. + */ + const char *kconfig; + /* Path to the custom BTF to be used for BPF CO-RE relocations. + * This custom BTF completely replaces the use of vmlinux BTF + * for the purpose of CO-RE relocations. + * NOTE: any other BPF feature (e.g., fentry/fexit programs, + * struct_ops, etc) will need actual kernel BTF at /sys/kernel/btf/vmlinux. + */ + const char *btf_custom_path; +}; +#define bpf_object_open_opts__last_field btf_custom_path + +LIBBPF_API struct bpf_object *bpf_object__open(const char *path); +LIBBPF_API struct bpf_object * +bpf_object__open_file(const char *path, const struct bpf_object_open_opts *opts); +LIBBPF_API struct bpf_object * +bpf_object__open_mem(const void *obj_buf, size_t obj_buf_sz, + const struct bpf_object_open_opts *opts); + +/* deprecated bpf_object__open variants */ +LIBBPF_API struct bpf_object * +bpf_object__open_buffer(const void *obj_buf, size_t obj_buf_sz, + const char *name); +LIBBPF_API struct bpf_object * +bpf_object__open_xattr(struct bpf_object_open_attr *attr); + +enum libbpf_pin_type { + LIBBPF_PIN_NONE, + /* PIN_BY_NAME: pin maps by name (in /sys/fs/bpf by default) */ + LIBBPF_PIN_BY_NAME, +}; + +/* pin_maps and unpin_maps can both be called with a NULL path, in which case + * they will use the pin_path attribute of each map (and ignore all maps that + * don't have a pin_path set). + */ +LIBBPF_API int bpf_object__pin_maps(struct bpf_object *obj, const char *path); +LIBBPF_API int bpf_object__unpin_maps(struct bpf_object *obj, + const char *path); +LIBBPF_API int bpf_object__pin_programs(struct bpf_object *obj, + const char *path); +LIBBPF_API int bpf_object__unpin_programs(struct bpf_object *obj, + const char *path); +LIBBPF_API int bpf_object__pin(struct bpf_object *object, const char *path); +LIBBPF_API void bpf_object__close(struct bpf_object *object); + +struct bpf_object_load_attr { + struct bpf_object *obj; + int log_level; + const char *target_btf_path; +}; + +/* Load/unload object into/from kernel */ +LIBBPF_API int bpf_object__load(struct bpf_object *obj); +LIBBPF_API int bpf_object__load_xattr(struct bpf_object_load_attr *attr); +LIBBPF_API int bpf_object__unload(struct bpf_object *obj); + +LIBBPF_API const char *bpf_object__name(const struct bpf_object *obj); +LIBBPF_API unsigned int bpf_object__kversion(const struct bpf_object *obj); +LIBBPF_API int bpf_object__set_kversion(struct bpf_object *obj, __u32 kern_version); + +struct btf; +LIBBPF_API struct btf *bpf_object__btf(const struct bpf_object *obj); +LIBBPF_API int bpf_object__btf_fd(const struct bpf_object *obj); + +LIBBPF_API struct bpf_program * +bpf_object__find_program_by_title(const struct bpf_object *obj, + const char *title); +LIBBPF_API struct bpf_program * +bpf_object__find_program_by_name(const struct bpf_object *obj, + const char *name); + +LIBBPF_API struct bpf_object *bpf_object__next(struct bpf_object *prev); +#define bpf_object__for_each_safe(pos, tmp) \ + for ((pos) = bpf_object__next(NULL), \ + (tmp) = bpf_object__next(pos); \ + (pos) != NULL; \ + (pos) = (tmp), (tmp) = bpf_object__next(tmp)) + +typedef void (*bpf_object_clear_priv_t)(struct bpf_object *, void *); +LIBBPF_API int bpf_object__set_priv(struct bpf_object *obj, void *priv, + bpf_object_clear_priv_t clear_priv); +LIBBPF_API void *bpf_object__priv(const struct bpf_object *prog); + +LIBBPF_API int +libbpf_prog_type_by_name(const char *name, enum bpf_prog_type *prog_type, + enum bpf_attach_type *expected_attach_type); +LIBBPF_API int libbpf_attach_type_by_name(const char *name, + enum bpf_attach_type *attach_type); +LIBBPF_API int libbpf_find_vmlinux_btf_id(const char *name, + enum bpf_attach_type attach_type); + +/* Accessors of bpf_program */ +struct bpf_program; +LIBBPF_API struct bpf_program *bpf_program__next(struct bpf_program *prog, + const struct bpf_object *obj); + +#define bpf_object__for_each_program(pos, obj) \ + for ((pos) = bpf_program__next(NULL, (obj)); \ + (pos) != NULL; \ + (pos) = bpf_program__next((pos), (obj))) + +LIBBPF_API struct bpf_program *bpf_program__prev(struct bpf_program *prog, + const struct bpf_object *obj); + +typedef void (*bpf_program_clear_priv_t)(struct bpf_program *, void *); + +LIBBPF_API int bpf_program__set_priv(struct bpf_program *prog, void *priv, + bpf_program_clear_priv_t clear_priv); + +LIBBPF_API void *bpf_program__priv(const struct bpf_program *prog); +LIBBPF_API void bpf_program__set_ifindex(struct bpf_program *prog, + __u32 ifindex); + +LIBBPF_API const char *bpf_program__name(const struct bpf_program *prog); +LIBBPF_API const char *bpf_program__section_name(const struct bpf_program *prog); +LIBBPF_API LIBBPF_DEPRECATED("BPF program title is confusing term; please use bpf_program__section_name() instead") +const char *bpf_program__title(const struct bpf_program *prog, bool needs_copy); +LIBBPF_API bool bpf_program__autoload(const struct bpf_program *prog); +LIBBPF_API int bpf_program__set_autoload(struct bpf_program *prog, bool autoload); + +/* returns program size in bytes */ +LIBBPF_API size_t bpf_program__size(const struct bpf_program *prog); + +LIBBPF_API int bpf_program__load(struct bpf_program *prog, char *license, + __u32 kern_version); +LIBBPF_API int bpf_program__fd(const struct bpf_program *prog); +LIBBPF_API int bpf_program__pin_instance(struct bpf_program *prog, + const char *path, + int instance); +LIBBPF_API int bpf_program__unpin_instance(struct bpf_program *prog, + const char *path, + int instance); +LIBBPF_API int bpf_program__pin(struct bpf_program *prog, const char *path); +LIBBPF_API int bpf_program__unpin(struct bpf_program *prog, const char *path); +LIBBPF_API void bpf_program__unload(struct bpf_program *prog); + +struct bpf_link; + +LIBBPF_API struct bpf_link *bpf_link__open(const char *path); +LIBBPF_API int bpf_link__fd(const struct bpf_link *link); +LIBBPF_API const char *bpf_link__pin_path(const struct bpf_link *link); +LIBBPF_API int bpf_link__pin(struct bpf_link *link, const char *path); +LIBBPF_API int bpf_link__unpin(struct bpf_link *link); +LIBBPF_API int bpf_link__update_program(struct bpf_link *link, + struct bpf_program *prog); +LIBBPF_API void bpf_link__disconnect(struct bpf_link *link); +LIBBPF_API int bpf_link__detach(struct bpf_link *link); +LIBBPF_API int bpf_link__destroy(struct bpf_link *link); + +LIBBPF_API struct bpf_link * +bpf_program__attach(struct bpf_program *prog); + +struct bpf_perf_event_opts { + /* size of this struct, for forward/backward compatiblity */ + size_t sz; + /* custom user-provided value fetchable through bpf_get_attach_cookie() */ + __u64 bpf_cookie; +}; +#define bpf_perf_event_opts__last_field bpf_cookie + +LIBBPF_API struct bpf_link * +bpf_program__attach_perf_event(struct bpf_program *prog, int pfd); + +LIBBPF_API struct bpf_link * +bpf_program__attach_perf_event_opts(struct bpf_program *prog, int pfd, + const struct bpf_perf_event_opts *opts); + +struct bpf_kprobe_opts { + /* size of this struct, for forward/backward compatiblity */ + size_t sz; + /* custom user-provided value fetchable through bpf_get_attach_cookie() */ + __u64 bpf_cookie; + /* function's offset to install kprobe to */ + unsigned long offset; + /* kprobe is return probe */ + bool retprobe; + size_t :0; +}; +#define bpf_kprobe_opts__last_field retprobe + +LIBBPF_API struct bpf_link * +bpf_program__attach_kprobe(struct bpf_program *prog, bool retprobe, + const char *func_name); +LIBBPF_API struct bpf_link * +bpf_program__attach_kprobe_opts(struct bpf_program *prog, + const char *func_name, + const struct bpf_kprobe_opts *opts); + +struct bpf_uprobe_opts { + /* size of this struct, for forward/backward compatiblity */ + size_t sz; + /* offset of kernel reference counted USDT semaphore, added in + * a6ca88b241d5 ("trace_uprobe: support reference counter in fd-based uprobe") + */ + size_t ref_ctr_offset; + /* custom user-provided value fetchable through bpf_get_attach_cookie() */ + __u64 bpf_cookie; + /* uprobe is return probe, invoked at function return time */ + bool retprobe; + size_t :0; +}; +#define bpf_uprobe_opts__last_field retprobe + +LIBBPF_API struct bpf_link * +bpf_program__attach_uprobe(struct bpf_program *prog, bool retprobe, + pid_t pid, const char *binary_path, + size_t func_offset); +LIBBPF_API struct bpf_link * +bpf_program__attach_uprobe_opts(struct bpf_program *prog, pid_t pid, + const char *binary_path, size_t func_offset, + const struct bpf_uprobe_opts *opts); + +struct bpf_tracepoint_opts { + /* size of this struct, for forward/backward compatiblity */ + size_t sz; + /* custom user-provided value fetchable through bpf_get_attach_cookie() */ + __u64 bpf_cookie; +}; +#define bpf_tracepoint_opts__last_field bpf_cookie + +LIBBPF_API struct bpf_link * +bpf_program__attach_tracepoint(struct bpf_program *prog, + const char *tp_category, + const char *tp_name); +LIBBPF_API struct bpf_link * +bpf_program__attach_tracepoint_opts(struct bpf_program *prog, + const char *tp_category, + const char *tp_name, + const struct bpf_tracepoint_opts *opts); + +LIBBPF_API struct bpf_link * +bpf_program__attach_raw_tracepoint(struct bpf_program *prog, + const char *tp_name); +LIBBPF_API struct bpf_link * +bpf_program__attach_trace(struct bpf_program *prog); +LIBBPF_API struct bpf_link * +bpf_program__attach_lsm(struct bpf_program *prog); +LIBBPF_API struct bpf_link * +bpf_program__attach_cgroup(struct bpf_program *prog, int cgroup_fd); +LIBBPF_API struct bpf_link * +bpf_program__attach_netns(struct bpf_program *prog, int netns_fd); +LIBBPF_API struct bpf_link * +bpf_program__attach_xdp(struct bpf_program *prog, int ifindex); +LIBBPF_API struct bpf_link * +bpf_program__attach_freplace(struct bpf_program *prog, + int target_fd, const char *attach_func_name); + +struct bpf_map; + +LIBBPF_API struct bpf_link *bpf_map__attach_struct_ops(struct bpf_map *map); + +struct bpf_iter_attach_opts { + size_t sz; /* size of this struct for forward/backward compatibility */ + union bpf_iter_link_info *link_info; + __u32 link_info_len; +}; +#define bpf_iter_attach_opts__last_field link_info_len + +LIBBPF_API struct bpf_link * +bpf_program__attach_iter(struct bpf_program *prog, + const struct bpf_iter_attach_opts *opts); + +struct bpf_insn; + +/* + * Libbpf allows callers to adjust BPF programs before being loaded + * into kernel. One program in an object file can be transformed into + * multiple variants to be attached to different hooks. + * + * bpf_program_prep_t, bpf_program__set_prep and bpf_program__nth_fd + * form an API for this purpose. + * + * - bpf_program_prep_t: + * Defines a 'preprocessor', which is a caller defined function + * passed to libbpf through bpf_program__set_prep(), and will be + * called before program is loaded. The processor should adjust + * the program one time for each instance according to the instance id + * passed to it. + * + * - bpf_program__set_prep: + * Attaches a preprocessor to a BPF program. The number of instances + * that should be created is also passed through this function. + * + * - bpf_program__nth_fd: + * After the program is loaded, get resulting FD of a given instance + * of the BPF program. + * + * If bpf_program__set_prep() is not used, the program would be loaded + * without adjustment during bpf_object__load(). The program has only + * one instance. In this case bpf_program__fd(prog) is equal to + * bpf_program__nth_fd(prog, 0). + */ + +struct bpf_prog_prep_result { + /* + * If not NULL, load new instruction array. + * If set to NULL, don't load this instance. + */ + struct bpf_insn *new_insn_ptr; + int new_insn_cnt; + + /* If not NULL, result FD is written to it. */ + int *pfd; +}; + +/* + * Parameters of bpf_program_prep_t: + * - prog: The bpf_program being loaded. + * - n: Index of instance being generated. + * - insns: BPF instructions array. + * - insns_cnt:Number of instructions in insns. + * - res: Output parameter, result of transformation. + * + * Return value: + * - Zero: pre-processing success. + * - Non-zero: pre-processing error, stop loading. + */ +typedef int (*bpf_program_prep_t)(struct bpf_program *prog, int n, + struct bpf_insn *insns, int insns_cnt, + struct bpf_prog_prep_result *res); + +LIBBPF_API int bpf_program__set_prep(struct bpf_program *prog, int nr_instance, + bpf_program_prep_t prep); + +LIBBPF_API int bpf_program__nth_fd(const struct bpf_program *prog, int n); + +/* + * Adjust type of BPF program. Default is kprobe. + */ +LIBBPF_API int bpf_program__set_socket_filter(struct bpf_program *prog); +LIBBPF_API int bpf_program__set_tracepoint(struct bpf_program *prog); +LIBBPF_API int bpf_program__set_raw_tracepoint(struct bpf_program *prog); +LIBBPF_API int bpf_program__set_kprobe(struct bpf_program *prog); +LIBBPF_API int bpf_program__set_lsm(struct bpf_program *prog); +LIBBPF_API int bpf_program__set_sched_cls(struct bpf_program *prog); +LIBBPF_API int bpf_program__set_sched_act(struct bpf_program *prog); +LIBBPF_API int bpf_program__set_xdp(struct bpf_program *prog); +LIBBPF_API int bpf_program__set_perf_event(struct bpf_program *prog); +LIBBPF_API int bpf_program__set_tracing(struct bpf_program *prog); +LIBBPF_API int bpf_program__set_struct_ops(struct bpf_program *prog); +LIBBPF_API int bpf_program__set_extension(struct bpf_program *prog); +LIBBPF_API int bpf_program__set_sk_lookup(struct bpf_program *prog); + +LIBBPF_API enum bpf_prog_type bpf_program__get_type(const struct bpf_program *prog); +LIBBPF_API void bpf_program__set_type(struct bpf_program *prog, + enum bpf_prog_type type); + +LIBBPF_API enum bpf_attach_type +bpf_program__get_expected_attach_type(const struct bpf_program *prog); +LIBBPF_API void +bpf_program__set_expected_attach_type(struct bpf_program *prog, + enum bpf_attach_type type); + +LIBBPF_API int +bpf_program__set_attach_target(struct bpf_program *prog, int attach_prog_fd, + const char *attach_func_name); + +LIBBPF_API bool bpf_program__is_socket_filter(const struct bpf_program *prog); +LIBBPF_API bool bpf_program__is_tracepoint(const struct bpf_program *prog); +LIBBPF_API bool bpf_program__is_raw_tracepoint(const struct bpf_program *prog); +LIBBPF_API bool bpf_program__is_kprobe(const struct bpf_program *prog); +LIBBPF_API bool bpf_program__is_lsm(const struct bpf_program *prog); +LIBBPF_API bool bpf_program__is_sched_cls(const struct bpf_program *prog); +LIBBPF_API bool bpf_program__is_sched_act(const struct bpf_program *prog); +LIBBPF_API bool bpf_program__is_xdp(const struct bpf_program *prog); +LIBBPF_API bool bpf_program__is_perf_event(const struct bpf_program *prog); +LIBBPF_API bool bpf_program__is_tracing(const struct bpf_program *prog); +LIBBPF_API bool bpf_program__is_struct_ops(const struct bpf_program *prog); +LIBBPF_API bool bpf_program__is_extension(const struct bpf_program *prog); +LIBBPF_API bool bpf_program__is_sk_lookup(const struct bpf_program *prog); + +/* + * No need for __attribute__((packed)), all members of 'bpf_map_def' + * are all aligned. In addition, using __attribute__((packed)) + * would trigger a -Wpacked warning message, and lead to an error + * if -Werror is set. + */ +struct bpf_map_def { + unsigned int type; + unsigned int key_size; + unsigned int value_size; + unsigned int max_entries; + unsigned int map_flags; +}; + +/* + * The 'struct bpf_map' in include/linux/bpf.h is internal to the kernel, + * so no need to worry about a name clash. + */ +LIBBPF_API struct bpf_map * +bpf_object__find_map_by_name(const struct bpf_object *obj, const char *name); + +LIBBPF_API int +bpf_object__find_map_fd_by_name(const struct bpf_object *obj, const char *name); + +/* + * Get bpf_map through the offset of corresponding struct bpf_map_def + * in the BPF object file. + */ +LIBBPF_API struct bpf_map * +bpf_object__find_map_by_offset(struct bpf_object *obj, size_t offset); + +LIBBPF_API struct bpf_map * +bpf_map__next(const struct bpf_map *map, const struct bpf_object *obj); +#define bpf_object__for_each_map(pos, obj) \ + for ((pos) = bpf_map__next(NULL, (obj)); \ + (pos) != NULL; \ + (pos) = bpf_map__next((pos), (obj))) +#define bpf_map__for_each bpf_object__for_each_map + +LIBBPF_API struct bpf_map * +bpf_map__prev(const struct bpf_map *map, const struct bpf_object *obj); + +/* get/set map FD */ +LIBBPF_API int bpf_map__fd(const struct bpf_map *map); +LIBBPF_API int bpf_map__reuse_fd(struct bpf_map *map, int fd); +/* get map definition */ +LIBBPF_API const struct bpf_map_def *bpf_map__def(const struct bpf_map *map); +/* get map name */ +LIBBPF_API const char *bpf_map__name(const struct bpf_map *map); +/* get/set map type */ +LIBBPF_API enum bpf_map_type bpf_map__type(const struct bpf_map *map); +LIBBPF_API int bpf_map__set_type(struct bpf_map *map, enum bpf_map_type type); +/* get/set map size (max_entries) */ +LIBBPF_API __u32 bpf_map__max_entries(const struct bpf_map *map); +LIBBPF_API int bpf_map__set_max_entries(struct bpf_map *map, __u32 max_entries); +LIBBPF_API int bpf_map__resize(struct bpf_map *map, __u32 max_entries); +/* get/set map flags */ +LIBBPF_API __u32 bpf_map__map_flags(const struct bpf_map *map); +LIBBPF_API int bpf_map__set_map_flags(struct bpf_map *map, __u32 flags); +/* get/set map NUMA node */ +LIBBPF_API __u32 bpf_map__numa_node(const struct bpf_map *map); +LIBBPF_API int bpf_map__set_numa_node(struct bpf_map *map, __u32 numa_node); +/* get/set map key size */ +LIBBPF_API __u32 bpf_map__key_size(const struct bpf_map *map); +LIBBPF_API int bpf_map__set_key_size(struct bpf_map *map, __u32 size); +/* get/set map value size */ +LIBBPF_API __u32 bpf_map__value_size(const struct bpf_map *map); +LIBBPF_API int bpf_map__set_value_size(struct bpf_map *map, __u32 size); +/* get map key/value BTF type IDs */ +LIBBPF_API __u32 bpf_map__btf_key_type_id(const struct bpf_map *map); +LIBBPF_API __u32 bpf_map__btf_value_type_id(const struct bpf_map *map); +/* get/set map if_index */ +LIBBPF_API __u32 bpf_map__ifindex(const struct bpf_map *map); +LIBBPF_API int bpf_map__set_ifindex(struct bpf_map *map, __u32 ifindex); + +typedef void (*bpf_map_clear_priv_t)(struct bpf_map *, void *); +LIBBPF_API int bpf_map__set_priv(struct bpf_map *map, void *priv, + bpf_map_clear_priv_t clear_priv); +LIBBPF_API void *bpf_map__priv(const struct bpf_map *map); +LIBBPF_API int bpf_map__set_initial_value(struct bpf_map *map, + const void *data, size_t size); +LIBBPF_API const void *bpf_map__initial_value(struct bpf_map *map, size_t *psize); +LIBBPF_API bool bpf_map__is_offload_neutral(const struct bpf_map *map); +LIBBPF_API bool bpf_map__is_internal(const struct bpf_map *map); +LIBBPF_API int bpf_map__set_pin_path(struct bpf_map *map, const char *path); +LIBBPF_API const char *bpf_map__get_pin_path(const struct bpf_map *map); +LIBBPF_API const char *bpf_map__pin_path(const struct bpf_map *map); +LIBBPF_API bool bpf_map__is_pinned(const struct bpf_map *map); +LIBBPF_API int bpf_map__pin(struct bpf_map *map, const char *path); +LIBBPF_API int bpf_map__unpin(struct bpf_map *map, const char *path); + +LIBBPF_API int bpf_map__set_inner_map_fd(struct bpf_map *map, int fd); +LIBBPF_API struct bpf_map *bpf_map__inner_map(struct bpf_map *map); + +LIBBPF_API long libbpf_get_error(const void *ptr); + +struct bpf_prog_load_attr { + const char *file; + enum bpf_prog_type prog_type; + enum bpf_attach_type expected_attach_type; + int ifindex; + int log_level; + int prog_flags; +}; + +LIBBPF_API int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr, + struct bpf_object **pobj, int *prog_fd); +LIBBPF_API int bpf_prog_load(const char *file, enum bpf_prog_type type, + struct bpf_object **pobj, int *prog_fd); + +/* XDP related API */ +struct xdp_link_info { + __u32 prog_id; + __u32 drv_prog_id; + __u32 hw_prog_id; + __u32 skb_prog_id; + __u8 attach_mode; +}; + +struct bpf_xdp_set_link_opts { + size_t sz; + int old_fd; + size_t :0; +}; +#define bpf_xdp_set_link_opts__last_field old_fd + +LIBBPF_API int bpf_set_link_xdp_fd(int ifindex, int fd, __u32 flags); +LIBBPF_API int bpf_set_link_xdp_fd_opts(int ifindex, int fd, __u32 flags, + const struct bpf_xdp_set_link_opts *opts); +LIBBPF_API int bpf_get_link_xdp_id(int ifindex, __u32 *prog_id, __u32 flags); +LIBBPF_API int bpf_get_link_xdp_info(int ifindex, struct xdp_link_info *info, + size_t info_size, __u32 flags); + +/* TC related API */ +enum bpf_tc_attach_point { + BPF_TC_INGRESS = 1 << 0, + BPF_TC_EGRESS = 1 << 1, + BPF_TC_CUSTOM = 1 << 2, +}; + +#define BPF_TC_PARENT(a, b) \ + ((((a) << 16) & 0xFFFF0000U) | ((b) & 0x0000FFFFU)) + +enum bpf_tc_flags { + BPF_TC_F_REPLACE = 1 << 0, +}; + +struct bpf_tc_hook { + size_t sz; + int ifindex; + enum bpf_tc_attach_point attach_point; + __u32 parent; + size_t :0; +}; +#define bpf_tc_hook__last_field parent + +struct bpf_tc_opts { + size_t sz; + int prog_fd; + __u32 flags; + __u32 prog_id; + __u32 handle; + __u32 priority; + size_t :0; +}; +#define bpf_tc_opts__last_field priority + +LIBBPF_API int bpf_tc_hook_create(struct bpf_tc_hook *hook); +LIBBPF_API int bpf_tc_hook_destroy(struct bpf_tc_hook *hook); +LIBBPF_API int bpf_tc_attach(const struct bpf_tc_hook *hook, + struct bpf_tc_opts *opts); +LIBBPF_API int bpf_tc_detach(const struct bpf_tc_hook *hook, + const struct bpf_tc_opts *opts); +LIBBPF_API int bpf_tc_query(const struct bpf_tc_hook *hook, + struct bpf_tc_opts *opts); + +/* Ring buffer APIs */ +struct ring_buffer; + +typedef int (*ring_buffer_sample_fn)(void *ctx, void *data, size_t size); + +struct ring_buffer_opts { + size_t sz; /* size of this struct, for forward/backward compatiblity */ +}; + +#define ring_buffer_opts__last_field sz + +LIBBPF_API struct ring_buffer * +ring_buffer__new(int map_fd, ring_buffer_sample_fn sample_cb, void *ctx, + const struct ring_buffer_opts *opts); +LIBBPF_API void ring_buffer__free(struct ring_buffer *rb); +LIBBPF_API int ring_buffer__add(struct ring_buffer *rb, int map_fd, + ring_buffer_sample_fn sample_cb, void *ctx); +LIBBPF_API int ring_buffer__poll(struct ring_buffer *rb, int timeout_ms); +LIBBPF_API int ring_buffer__consume(struct ring_buffer *rb); +LIBBPF_API int ring_buffer__epoll_fd(const struct ring_buffer *rb); + +/* Perf buffer APIs */ +struct perf_buffer; + +typedef void (*perf_buffer_sample_fn)(void *ctx, int cpu, + void *data, __u32 size); +typedef void (*perf_buffer_lost_fn)(void *ctx, int cpu, __u64 cnt); + +/* common use perf buffer options */ +struct perf_buffer_opts { + /* if specified, sample_cb is called for each sample */ + perf_buffer_sample_fn sample_cb; + /* if specified, lost_cb is called for each batch of lost samples */ + perf_buffer_lost_fn lost_cb; + /* ctx is provided to sample_cb and lost_cb */ + void *ctx; +}; + +LIBBPF_API struct perf_buffer * +perf_buffer__new(int map_fd, size_t page_cnt, + const struct perf_buffer_opts *opts); + +enum bpf_perf_event_ret { + LIBBPF_PERF_EVENT_DONE = 0, + LIBBPF_PERF_EVENT_ERROR = -1, + LIBBPF_PERF_EVENT_CONT = -2, +}; + +struct perf_event_header; + +typedef enum bpf_perf_event_ret +(*perf_buffer_event_fn)(void *ctx, int cpu, struct perf_event_header *event); + +/* raw perf buffer options, giving most power and control */ +struct perf_buffer_raw_opts { + /* perf event attrs passed directly into perf_event_open() */ + struct perf_event_attr *attr; + /* raw event callback */ + perf_buffer_event_fn event_cb; + /* ctx is provided to event_cb */ + void *ctx; + /* if cpu_cnt == 0, open all on all possible CPUs (up to the number of + * max_entries of given PERF_EVENT_ARRAY map) + */ + int cpu_cnt; + /* if cpu_cnt > 0, cpus is an array of CPUs to open ring buffers on */ + int *cpus; + /* if cpu_cnt > 0, map_keys specify map keys to set per-CPU FDs for */ + int *map_keys; +}; + +LIBBPF_API struct perf_buffer * +perf_buffer__new_raw(int map_fd, size_t page_cnt, + const struct perf_buffer_raw_opts *opts); + +LIBBPF_API void perf_buffer__free(struct perf_buffer *pb); +LIBBPF_API int perf_buffer__epoll_fd(const struct perf_buffer *pb); +LIBBPF_API int perf_buffer__poll(struct perf_buffer *pb, int timeout_ms); +LIBBPF_API int perf_buffer__consume(struct perf_buffer *pb); +LIBBPF_API int perf_buffer__consume_buffer(struct perf_buffer *pb, size_t buf_idx); +LIBBPF_API size_t perf_buffer__buffer_cnt(const struct perf_buffer *pb); +LIBBPF_API int perf_buffer__buffer_fd(const struct perf_buffer *pb, size_t buf_idx); + +typedef enum bpf_perf_event_ret + (*bpf_perf_event_print_t)(struct perf_event_header *hdr, + void *private_data); +LIBBPF_API enum bpf_perf_event_ret +bpf_perf_event_read_simple(void *mmap_mem, size_t mmap_size, size_t page_size, + void **copy_mem, size_t *copy_size, + bpf_perf_event_print_t fn, void *private_data); + +struct bpf_prog_linfo; +struct bpf_prog_info; + +LIBBPF_API void bpf_prog_linfo__free(struct bpf_prog_linfo *prog_linfo); +LIBBPF_API struct bpf_prog_linfo * +bpf_prog_linfo__new(const struct bpf_prog_info *info); +LIBBPF_API const struct bpf_line_info * +bpf_prog_linfo__lfind_addr_func(const struct bpf_prog_linfo *prog_linfo, + __u64 addr, __u32 func_idx, __u32 nr_skip); +LIBBPF_API const struct bpf_line_info * +bpf_prog_linfo__lfind(const struct bpf_prog_linfo *prog_linfo, + __u32 insn_off, __u32 nr_skip); + +/* + * Probe for supported system features + * + * Note that running many of these probes in a short amount of time can cause + * the kernel to reach the maximal size of lockable memory allowed for the + * user, causing subsequent probes to fail. In this case, the caller may want + * to adjust that limit with setrlimit(). + */ +LIBBPF_API bool bpf_probe_prog_type(enum bpf_prog_type prog_type, + __u32 ifindex); +LIBBPF_API bool bpf_probe_map_type(enum bpf_map_type map_type, __u32 ifindex); +LIBBPF_API bool bpf_probe_helper(enum bpf_func_id id, + enum bpf_prog_type prog_type, __u32 ifindex); +LIBBPF_API bool bpf_probe_large_insn_limit(__u32 ifindex); + +/* + * Get bpf_prog_info in continuous memory + * + * struct bpf_prog_info has multiple arrays. The user has option to choose + * arrays to fetch from kernel. The following APIs provide an uniform way to + * fetch these data. All arrays in bpf_prog_info are stored in a single + * continuous memory region. This makes it easy to store the info in a + * file. + * + * Before writing bpf_prog_info_linear to files, it is necessary to + * translate pointers in bpf_prog_info to offsets. Helper functions + * bpf_program__bpil_addr_to_offs() and bpf_program__bpil_offs_to_addr() + * are introduced to switch between pointers and offsets. + * + * Examples: + * # To fetch map_ids and prog_tags: + * __u64 arrays = (1UL << BPF_PROG_INFO_MAP_IDS) | + * (1UL << BPF_PROG_INFO_PROG_TAGS); + * struct bpf_prog_info_linear *info_linear = + * bpf_program__get_prog_info_linear(fd, arrays); + * + * # To save data in file + * bpf_program__bpil_addr_to_offs(info_linear); + * write(f, info_linear, sizeof(*info_linear) + info_linear->data_len); + * + * # To read data from file + * read(f, info_linear, ); + * bpf_program__bpil_offs_to_addr(info_linear); + */ +enum bpf_prog_info_array { + BPF_PROG_INFO_FIRST_ARRAY = 0, + BPF_PROG_INFO_JITED_INSNS = 0, + BPF_PROG_INFO_XLATED_INSNS, + BPF_PROG_INFO_MAP_IDS, + BPF_PROG_INFO_JITED_KSYMS, + BPF_PROG_INFO_JITED_FUNC_LENS, + BPF_PROG_INFO_FUNC_INFO, + BPF_PROG_INFO_LINE_INFO, + BPF_PROG_INFO_JITED_LINE_INFO, + BPF_PROG_INFO_PROG_TAGS, + BPF_PROG_INFO_LAST_ARRAY, +}; + +struct bpf_prog_info_linear { + /* size of struct bpf_prog_info, when the tool is compiled */ + __u32 info_len; + /* total bytes allocated for data, round up to 8 bytes */ + __u32 data_len; + /* which arrays are included in data */ + __u64 arrays; + struct bpf_prog_info info; + __u8 data[]; +}; + +LIBBPF_API struct bpf_prog_info_linear * +bpf_program__get_prog_info_linear(int fd, __u64 arrays); + +LIBBPF_API void +bpf_program__bpil_addr_to_offs(struct bpf_prog_info_linear *info_linear); + +LIBBPF_API void +bpf_program__bpil_offs_to_addr(struct bpf_prog_info_linear *info_linear); + +/* + * A helper function to get the number of possible CPUs before looking up + * per-CPU maps. Negative errno is returned on failure. + * + * Example usage: + * + * int ncpus = libbpf_num_possible_cpus(); + * if (ncpus < 0) { + * // error handling + * } + * long values[ncpus]; + * bpf_map_lookup_elem(per_cpu_map_fd, key, values); + * + */ +LIBBPF_API int libbpf_num_possible_cpus(void); + +struct bpf_map_skeleton { + const char *name; + struct bpf_map **map; + void **mmaped; +}; + +struct bpf_prog_skeleton { + const char *name; + struct bpf_program **prog; + struct bpf_link **link; +}; + +struct bpf_object_skeleton { + size_t sz; /* size of this struct, for forward/backward compatibility */ + + const char *name; + const void *data; + size_t data_sz; + + struct bpf_object **obj; + + int map_cnt; + int map_skel_sz; /* sizeof(struct bpf_skeleton_map) */ + struct bpf_map_skeleton *maps; + + int prog_cnt; + int prog_skel_sz; /* sizeof(struct bpf_skeleton_prog) */ + struct bpf_prog_skeleton *progs; +}; + +LIBBPF_API int +bpf_object__open_skeleton(struct bpf_object_skeleton *s, + const struct bpf_object_open_opts *opts); +LIBBPF_API int bpf_object__load_skeleton(struct bpf_object_skeleton *s); +LIBBPF_API int bpf_object__attach_skeleton(struct bpf_object_skeleton *s); +LIBBPF_API void bpf_object__detach_skeleton(struct bpf_object_skeleton *s); +LIBBPF_API void bpf_object__destroy_skeleton(struct bpf_object_skeleton *s); + +struct gen_loader_opts { + size_t sz; /* size of this struct, for forward/backward compatiblity */ + const char *data; + const char *insns; + __u32 data_sz; + __u32 insns_sz; +}; + +#define gen_loader_opts__last_field insns_sz +LIBBPF_API int bpf_object__gen_loader(struct bpf_object *obj, + struct gen_loader_opts *opts); + +enum libbpf_tristate { + TRI_NO = 0, + TRI_YES = 1, + TRI_MODULE = 2, +}; + +struct bpf_linker_opts { + /* size of this struct, for forward/backward compatiblity */ + size_t sz; +}; +#define bpf_linker_opts__last_field sz + +struct bpf_linker_file_opts { + /* size of this struct, for forward/backward compatiblity */ + size_t sz; +}; +#define bpf_linker_file_opts__last_field sz + +struct bpf_linker; + +LIBBPF_API struct bpf_linker *bpf_linker__new(const char *filename, struct bpf_linker_opts *opts); +LIBBPF_API int bpf_linker__add_file(struct bpf_linker *linker, + const char *filename, + const struct bpf_linker_file_opts *opts); +LIBBPF_API int bpf_linker__finalize(struct bpf_linker *linker); +LIBBPF_API void bpf_linker__free(struct bpf_linker *linker); + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif /* __LIBBPF_LIBBPF_H */ diff --git a/include/libbpf/libbpf_common.h b/include/libbpf/libbpf_common.h new file mode 100644 index 000000000..947d8bd8a --- /dev/null +++ b/include/libbpf/libbpf_common.h @@ -0,0 +1,42 @@ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ + +/* + * Common user-facing libbpf helpers. + * + * Copyright (c) 2019 Facebook + */ + +#ifndef __LIBBPF_LIBBPF_COMMON_H +#define __LIBBPF_LIBBPF_COMMON_H + +#include + +#ifndef LIBBPF_API +#define LIBBPF_API __attribute__((visibility("default"))) +#endif + +#define LIBBPF_DEPRECATED(msg) __attribute__((deprecated(msg))) + +/* Helper macro to declare and initialize libbpf options struct + * + * This dance with uninitialized declaration, followed by memset to zero, + * followed by assignment using compound literal syntax is done to preserve + * ability to use a nice struct field initialization syntax and **hopefully** + * have all the padding bytes initialized to zero. It's not guaranteed though, + * when copying literal, that compiler won't copy garbage in literal's padding + * bytes, but that's the best way I've found and it seems to work in practice. + * + * Macro declares opts struct of given type and name, zero-initializes, + * including any extra padding, it with memset() and then assigns initial + * values provided by users in struct initializer-syntax as varargs. + */ +#define DECLARE_LIBBPF_OPTS(TYPE, NAME, ...) \ + struct TYPE NAME = ({ \ + memset(&NAME, 0, sizeof(struct TYPE)); \ + (struct TYPE) { \ + .sz = sizeof(struct TYPE), \ + __VA_ARGS__ \ + }; \ + }) + +#endif /* __LIBBPF_LIBBPF_COMMON_H */ diff --git a/include/libbpf/libbpf_legacy.h b/include/libbpf/libbpf_legacy.h new file mode 100644 index 000000000..df0d03dcf --- /dev/null +++ b/include/libbpf/libbpf_legacy.h @@ -0,0 +1,59 @@ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ + +/* + * Libbpf legacy APIs (either discouraged or deprecated, as mentioned in [0]) + * + * [0] https://docs.google.com/document/d/1UyjTZuPFWiPFyKk1tV5an11_iaRuec6U-ZESZ54nNTY + * + * Copyright (C) 2021 Facebook + */ +#ifndef __LIBBPF_LEGACY_BPF_H +#define __LIBBPF_LEGACY_BPF_H + +#include +#include +#include +#include +#include "libbpf_common.h" + +#ifdef __cplusplus +extern "C" { +#endif + +enum libbpf_strict_mode { + /* Turn on all supported strict features of libbpf to simulate libbpf + * v1.0 behavior. + * This will be the default behavior in libbpf v1.0. + */ + LIBBPF_STRICT_ALL = 0xffffffff, + + /* + * Disable any libbpf 1.0 behaviors. This is the default before libbpf + * v1.0. It won't be supported anymore in v1.0, please update your + * code so that it handles LIBBPF_STRICT_ALL mode before libbpf v1.0. + */ + LIBBPF_STRICT_NONE = 0x00, + /* + * Return NULL pointers on error, not ERR_PTR(err). + * Additionally, libbpf also always sets errno to corresponding Exx + * (positive) error code. + */ + LIBBPF_STRICT_CLEAN_PTRS = 0x01, + /* + * Return actual error codes from low-level APIs directly, not just -1. + * Additionally, libbpf also always sets errno to corresponding Exx + * (positive) error code. + */ + LIBBPF_STRICT_DIRECT_ERRS = 0x02, + + __LIBBPF_STRICT_LAST, +}; + +LIBBPF_API int libbpf_set_strict_mode(enum libbpf_strict_mode mode); + + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif /* __LIBBPF_LEGACY_BPF_H */ diff --git a/include/libbpf/libbpf_version.h b/include/libbpf/libbpf_version.h new file mode 100644 index 000000000..0fefefc35 --- /dev/null +++ b/include/libbpf/libbpf_version.h @@ -0,0 +1,9 @@ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ +/* Copyright (C) 2021 Facebook */ +#ifndef __LIBBPF_VERSION_H +#define __LIBBPF_VERSION_H + +#define LIBBPF_MAJOR_VERSION 0 +#define LIBBPF_MINOR_VERSION 7 + +#endif /* __LIBBPF_VERSION_H */ diff --git a/include/libbpf/skel_internal.h b/include/libbpf/skel_internal.h new file mode 100644 index 000000000..b22b50c1b --- /dev/null +++ b/include/libbpf/skel_internal.h @@ -0,0 +1,123 @@ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ +/* Copyright (c) 2021 Facebook */ +#ifndef __SKEL_INTERNAL_H +#define __SKEL_INTERNAL_H + +#include +#include +#include + +/* This file is a base header for auto-generated *.lskel.h files. + * Its contents will change and may become part of auto-generation in the future. + * + * The layout of bpf_[map|prog]_desc and bpf_loader_ctx is feature dependent + * and will change from one version of libbpf to another and features + * requested during loader program generation. + */ +struct bpf_map_desc { + union { + /* input for the loader prog */ + struct { + __aligned_u64 initial_value; + __u32 max_entries; + }; + /* output of the loader prog */ + struct { + int map_fd; + }; + }; +}; +struct bpf_prog_desc { + int prog_fd; +}; + +struct bpf_loader_ctx { + size_t sz; + __u32 log_level; + __u32 log_size; + __u64 log_buf; +}; + +struct bpf_load_and_run_opts { + struct bpf_loader_ctx *ctx; + const void *data; + const void *insns; + __u32 data_sz; + __u32 insns_sz; + const char *errstr; +}; + +static inline int skel_sys_bpf(enum bpf_cmd cmd, union bpf_attr *attr, + unsigned int size) +{ + return syscall(__NR_bpf, cmd, attr, size); +} + +static inline int skel_closenz(int fd) +{ + if (fd > 0) + return close(fd); + return -EINVAL; +} + +static inline int bpf_load_and_run(struct bpf_load_and_run_opts *opts) +{ + int map_fd = -1, prog_fd = -1, key = 0, err; + union bpf_attr attr; + + map_fd = bpf_create_map_name(BPF_MAP_TYPE_ARRAY, "__loader.map", 4, + opts->data_sz, 1, 0); + if (map_fd < 0) { + opts->errstr = "failed to create loader map"; + err = -errno; + goto out; + } + + err = bpf_map_update_elem(map_fd, &key, opts->data, 0); + if (err < 0) { + opts->errstr = "failed to update loader map"; + err = -errno; + goto out; + } + + memset(&attr, 0, sizeof(attr)); + attr.prog_type = BPF_PROG_TYPE_SYSCALL; + attr.insns = (long) opts->insns; + attr.insn_cnt = opts->insns_sz / sizeof(struct bpf_insn); + attr.license = (long) "Dual BSD/GPL"; + memcpy(attr.prog_name, "__loader.prog", sizeof("__loader.prog")); + attr.fd_array = (long) &map_fd; + attr.log_level = opts->ctx->log_level; + attr.log_size = opts->ctx->log_size; + attr.log_buf = opts->ctx->log_buf; + attr.prog_flags = BPF_F_SLEEPABLE; + prog_fd = skel_sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr)); + if (prog_fd < 0) { + opts->errstr = "failed to load loader prog"; + err = -errno; + goto out; + } + + memset(&attr, 0, sizeof(attr)); + attr.test.prog_fd = prog_fd; + attr.test.ctx_in = (long) opts->ctx; + attr.test.ctx_size_in = opts->ctx->sz; + err = skel_sys_bpf(BPF_PROG_RUN, &attr, sizeof(attr)); + if (err < 0 || (int)attr.test.retval < 0) { + opts->errstr = "failed to execute loader prog"; + if (err < 0) + err = -errno; + else + err = (int)attr.test.retval; + goto out; + } + err = 0; +out: + if (map_fd >= 0) + close(map_fd); + if (prog_fd >= 0) + close(prog_fd); + return err; +} + +#endif diff --git a/include/libbpf/xsk.h b/include/libbpf/xsk.h new file mode 100644 index 000000000..01c12dca9 --- /dev/null +++ b/include/libbpf/xsk.h @@ -0,0 +1,322 @@ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ + +/* + * AF_XDP user-space access library. + * + * Copyright (c) 2018 - 2019 Intel Corporation. + * Copyright (c) 2019 Facebook + * + * Author(s): Magnus Karlsson + */ + +#ifndef __LIBBPF_XSK_H +#define __LIBBPF_XSK_H + +#include +#include +#include +#include + +#include "libbpf.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* Load-Acquire Store-Release barriers used by the XDP socket + * library. The following macros should *NOT* be considered part of + * the xsk.h API, and is subject to change anytime. + * + * LIBRARY INTERNAL + */ + +#define __XSK_READ_ONCE(x) (*(volatile typeof(x) *)&x) +#define __XSK_WRITE_ONCE(x, v) (*(volatile typeof(x) *)&x) = (v) + +#if defined(__i386__) || defined(__x86_64__) +# define libbpf_smp_store_release(p, v) \ + do { \ + asm volatile("" : : : "memory"); \ + __XSK_WRITE_ONCE(*p, v); \ + } while (0) +# define libbpf_smp_load_acquire(p) \ + ({ \ + typeof(*p) ___p1 = __XSK_READ_ONCE(*p); \ + asm volatile("" : : : "memory"); \ + ___p1; \ + }) +#elif defined(__aarch64__) +# define libbpf_smp_store_release(p, v) \ + asm volatile ("stlr %w1, %0" : "=Q" (*p) : "r" (v) : "memory") +# define libbpf_smp_load_acquire(p) \ + ({ \ + typeof(*p) ___p1; \ + asm volatile ("ldar %w0, %1" \ + : "=r" (___p1) : "Q" (*p) : "memory"); \ + ___p1; \ + }) +#elif defined(__riscv) +# define libbpf_smp_store_release(p, v) \ + do { \ + asm volatile ("fence rw,w" : : : "memory"); \ + __XSK_WRITE_ONCE(*p, v); \ + } while (0) +# define libbpf_smp_load_acquire(p) \ + ({ \ + typeof(*p) ___p1 = __XSK_READ_ONCE(*p); \ + asm volatile ("fence r,rw" : : : "memory"); \ + ___p1; \ + }) +#endif + +#ifndef libbpf_smp_store_release +#define libbpf_smp_store_release(p, v) \ + do { \ + __sync_synchronize(); \ + __XSK_WRITE_ONCE(*p, v); \ + } while (0) +#endif + +#ifndef libbpf_smp_load_acquire +#define libbpf_smp_load_acquire(p) \ + ({ \ + typeof(*p) ___p1 = __XSK_READ_ONCE(*p); \ + __sync_synchronize(); \ + ___p1; \ + }) +#endif + +/* LIBRARY INTERNAL -- END */ + +/* Do not access these members directly. Use the functions below. */ +#define DEFINE_XSK_RING(name) \ +struct name { \ + __u32 cached_prod; \ + __u32 cached_cons; \ + __u32 mask; \ + __u32 size; \ + __u32 *producer; \ + __u32 *consumer; \ + void *ring; \ + __u32 *flags; \ +} + +DEFINE_XSK_RING(xsk_ring_prod); +DEFINE_XSK_RING(xsk_ring_cons); + +/* For a detailed explanation on the memory barriers associated with the + * ring, please take a look at net/xdp/xsk_queue.h. + */ + +struct xsk_umem; +struct xsk_socket; + +static inline __u64 *xsk_ring_prod__fill_addr(struct xsk_ring_prod *fill, + __u32 idx) +{ + __u64 *addrs = (__u64 *)fill->ring; + + return &addrs[idx & fill->mask]; +} + +static inline const __u64 * +xsk_ring_cons__comp_addr(const struct xsk_ring_cons *comp, __u32 idx) +{ + const __u64 *addrs = (const __u64 *)comp->ring; + + return &addrs[idx & comp->mask]; +} + +static inline struct xdp_desc *xsk_ring_prod__tx_desc(struct xsk_ring_prod *tx, + __u32 idx) +{ + struct xdp_desc *descs = (struct xdp_desc *)tx->ring; + + return &descs[idx & tx->mask]; +} + +static inline const struct xdp_desc * +xsk_ring_cons__rx_desc(const struct xsk_ring_cons *rx, __u32 idx) +{ + const struct xdp_desc *descs = (const struct xdp_desc *)rx->ring; + + return &descs[idx & rx->mask]; +} + +static inline int xsk_ring_prod__needs_wakeup(const struct xsk_ring_prod *r) +{ + return *r->flags & XDP_RING_NEED_WAKEUP; +} + +static inline __u32 xsk_prod_nb_free(struct xsk_ring_prod *r, __u32 nb) +{ + __u32 free_entries = r->cached_cons - r->cached_prod; + + if (free_entries >= nb) + return free_entries; + + /* Refresh the local tail pointer. + * cached_cons is r->size bigger than the real consumer pointer so + * that this addition can be avoided in the more frequently + * executed code that computs free_entries in the beginning of + * this function. Without this optimization it whould have been + * free_entries = r->cached_prod - r->cached_cons + r->size. + */ + r->cached_cons = libbpf_smp_load_acquire(r->consumer); + r->cached_cons += r->size; + + return r->cached_cons - r->cached_prod; +} + +static inline __u32 xsk_cons_nb_avail(struct xsk_ring_cons *r, __u32 nb) +{ + __u32 entries = r->cached_prod - r->cached_cons; + + if (entries == 0) { + r->cached_prod = libbpf_smp_load_acquire(r->producer); + entries = r->cached_prod - r->cached_cons; + } + + return (entries > nb) ? nb : entries; +} + +static inline __u32 xsk_ring_prod__reserve(struct xsk_ring_prod *prod, __u32 nb, __u32 *idx) +{ + if (xsk_prod_nb_free(prod, nb) < nb) + return 0; + + *idx = prod->cached_prod; + prod->cached_prod += nb; + + return nb; +} + +static inline void xsk_ring_prod__submit(struct xsk_ring_prod *prod, __u32 nb) +{ + /* Make sure everything has been written to the ring before indicating + * this to the kernel by writing the producer pointer. + */ + libbpf_smp_store_release(prod->producer, *prod->producer + nb); +} + +static inline __u32 xsk_ring_cons__peek(struct xsk_ring_cons *cons, __u32 nb, __u32 *idx) +{ + __u32 entries = xsk_cons_nb_avail(cons, nb); + + if (entries > 0) { + *idx = cons->cached_cons; + cons->cached_cons += entries; + } + + return entries; +} + +static inline void xsk_ring_cons__cancel(struct xsk_ring_cons *cons, __u32 nb) +{ + cons->cached_cons -= nb; +} + +static inline void xsk_ring_cons__release(struct xsk_ring_cons *cons, __u32 nb) +{ + /* Make sure data has been read before indicating we are done + * with the entries by updating the consumer pointer. + */ + libbpf_smp_store_release(cons->consumer, *cons->consumer + nb); + +} + +static inline void *xsk_umem__get_data(void *umem_area, __u64 addr) +{ + return &((char *)umem_area)[addr]; +} + +static inline __u64 xsk_umem__extract_addr(__u64 addr) +{ + return addr & XSK_UNALIGNED_BUF_ADDR_MASK; +} + +static inline __u64 xsk_umem__extract_offset(__u64 addr) +{ + return addr >> XSK_UNALIGNED_BUF_OFFSET_SHIFT; +} + +static inline __u64 xsk_umem__add_offset_to_addr(__u64 addr) +{ + return xsk_umem__extract_addr(addr) + xsk_umem__extract_offset(addr); +} + +LIBBPF_API int xsk_umem__fd(const struct xsk_umem *umem); +LIBBPF_API int xsk_socket__fd(const struct xsk_socket *xsk); + +#define XSK_RING_CONS__DEFAULT_NUM_DESCS 2048 +#define XSK_RING_PROD__DEFAULT_NUM_DESCS 2048 +#define XSK_UMEM__DEFAULT_FRAME_SHIFT 12 /* 4096 bytes */ +#define XSK_UMEM__DEFAULT_FRAME_SIZE (1 << XSK_UMEM__DEFAULT_FRAME_SHIFT) +#define XSK_UMEM__DEFAULT_FRAME_HEADROOM 0 +#define XSK_UMEM__DEFAULT_FLAGS 0 + +struct xsk_umem_config { + __u32 fill_size; + __u32 comp_size; + __u32 frame_size; + __u32 frame_headroom; + __u32 flags; +}; + +LIBBPF_API int xsk_setup_xdp_prog(int ifindex, + int *xsks_map_fd); +LIBBPF_API int xsk_socket__update_xskmap(struct xsk_socket *xsk, + int xsks_map_fd); + +/* Flags for the libbpf_flags field. */ +#define XSK_LIBBPF_FLAGS__INHIBIT_PROG_LOAD (1 << 0) + +struct xsk_socket_config { + __u32 rx_size; + __u32 tx_size; + __u32 libbpf_flags; + __u32 xdp_flags; + __u16 bind_flags; +}; + +/* Set config to NULL to get the default configuration. */ +LIBBPF_API int xsk_umem__create(struct xsk_umem **umem, + void *umem_area, __u64 size, + struct xsk_ring_prod *fill, + struct xsk_ring_cons *comp, + const struct xsk_umem_config *config); +LIBBPF_API int xsk_umem__create_v0_0_2(struct xsk_umem **umem, + void *umem_area, __u64 size, + struct xsk_ring_prod *fill, + struct xsk_ring_cons *comp, + const struct xsk_umem_config *config); +LIBBPF_API int xsk_umem__create_v0_0_4(struct xsk_umem **umem, + void *umem_area, __u64 size, + struct xsk_ring_prod *fill, + struct xsk_ring_cons *comp, + const struct xsk_umem_config *config); +LIBBPF_API int xsk_socket__create(struct xsk_socket **xsk, + const char *ifname, __u32 queue_id, + struct xsk_umem *umem, + struct xsk_ring_cons *rx, + struct xsk_ring_prod *tx, + const struct xsk_socket_config *config); +LIBBPF_API int +xsk_socket__create_shared(struct xsk_socket **xsk_ptr, + const char *ifname, + __u32 queue_id, struct xsk_umem *umem, + struct xsk_ring_cons *rx, + struct xsk_ring_prod *tx, + struct xsk_ring_prod *fill, + struct xsk_ring_cons *comp, + const struct xsk_socket_config *config); + +/* Returns 0 for success and -EBUSY if the umem is still in use. */ +LIBBPF_API int xsk_umem__delete(struct xsk_umem *umem); +LIBBPF_API void xsk_socket__delete(struct xsk_socket *xsk); + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif /* __LIBBPF_XSK_H */ diff --git a/include/span_context.h b/include/span_context.h new file mode 100644 index 000000000..571d29278 --- /dev/null +++ b/include/span_context.h @@ -0,0 +1,74 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include "utils.h" + +#define SPAN_CONTEXT_STRING_SIZE 55 +#define MAX_CONCURRENT_SPANS 100 + +struct span_context +{ + unsigned char TraceID[TRACE_ID_SIZE]; + unsigned char SpanID[SPAN_ID_SIZE]; +}; + +struct +{ + __uint(type, BPF_MAP_TYPE_HASH); + __type(key, void *); + __type(value, struct span_context); + __uint(max_entries, MAX_CONCURRENT_SPANS); + __uint(pinning, LIBBPF_PIN_BY_NAME); +} spans_in_progress SEC(".maps"); + +static __always_inline struct span_context generate_span_context() +{ + struct span_context context = {}; + generate_random_bytes(context.TraceID, TRACE_ID_SIZE); + generate_random_bytes(context.SpanID, SPAN_ID_SIZE); + return context; +} + +static __always_inline void span_context_to_w3c_string(struct span_context *ctx, char *buff) +{ + // W3C format: version (2 chars) - trace id (32 chars) - span id (16 chars) - sampled (2 chars) + char *out = buff; + + // Write version + *out++ = '0'; + *out++ = '0'; + *out++ = '-'; + + // Write trace id + bytes_to_hex_string(ctx->TraceID, TRACE_ID_SIZE, out); + out += TRACE_ID_STRING_SIZE; + *out++ = '-'; + + // Write span id + bytes_to_hex_string(ctx->SpanID, SPAN_ID_SIZE, out); + out += SPAN_ID_STRING_SIZE; + *out++ = '-'; + + // Write sampled + *out++ = '0'; + *out = '1'; +} + +static __always_inline void w3c_string_to_span_context(char *str, struct span_context *ctx) +{ + u32 trace_id_start_pos = 3; + u32 span_id_start_pod = 36; + hex_string_to_bytes(str + trace_id_start_pos, TRACE_ID_STRING_SIZE, ctx->TraceID); + hex_string_to_bytes(str + span_id_start_pod, SPAN_ID_STRING_SIZE, ctx->SpanID); +} diff --git a/include/utils.h b/include/utils.h new file mode 100644 index 000000000..287dfe07e --- /dev/null +++ b/include/utils.h @@ -0,0 +1,77 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include "bpf_helpers.h" + +#define TRACE_ID_SIZE 16 +#define TRACE_ID_STRING_SIZE 32 +#define SPAN_ID_SIZE 8 +#define SPAN_ID_STRING_SIZE 16 + +static __always_inline bool bpf_memcmp(char *s1, char *s2, s32 size) +{ + for (int i = 0; i < size; i++) + { + if (s1[i] != s2[i]) + { + return false; + } + } + + return true; +} + +static __always_inline void generate_random_bytes(unsigned char *buff, u32 size) +{ + for (int i = 0; i < (size / 4); i++) + { + u32 random = bpf_get_prandom_u32(); + buff[(4 * i)] = (random >> 24) & 0xFF; + buff[(4 * i) + 1] = (random >> 16) & 0xFF; + buff[(4 * i) + 2] = (random >> 8) & 0xFF; + buff[(4 * i) + 3] = random & 0xFF; + } +} + +char hex[16] = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'}; +static __always_inline void bytes_to_hex_string(unsigned char *pin, u32 size, char *out) +{ + char *pout = out; + int out_index = 0; + for (u32 i = 0; i < size; i++) + { + *pout++ = hex[(*pin >> 4) & 0xF]; + *pout++ = hex[(*pin++) & 0xF]; + } +} + +static __always_inline void hex_string_to_bytes(char *str, u32 size, unsigned char *out) +{ + for (int i = 0; i < (size / 2); i++) + { + char ch0 = str[2 * i]; + char ch1 = str[2 * i + 1]; + u8 nib0 = (ch0 & 0xF) + (ch0 >> 6) | ((ch0 >> 3) & 0x8); + u8 nib1 = (ch1 & 0xF) + (ch1 >> 6) | ((ch1 >> 3) & 0x8); + out[i] = (nib0 << 4) | nib1; + } +} + +static __always_inline void copy_byte_arrays(unsigned char *src, unsigned char *dst, u32 size) +{ + for (int i = 0; i < size; i++) + { + dst[i] = src[i]; + } +} diff --git a/pkg/errors/errors.go b/pkg/errors/errors.go new file mode 100644 index 000000000..61b01ad3d --- /dev/null +++ b/pkg/errors/errors.go @@ -0,0 +1,23 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package errors + +import "errors" + +// ErrInterrupted can be used as an error to signal that a process was +// interrupted but didn't fail in any other way. +var ErrInterrupted = errors.New("interrupted") +var ErrProcessNotFound = errors.New("process_not_found") +var ErrABIWrongInstruction = errors.New("could not detect ABI, got wrong instruction") diff --git a/pkg/inject/data.go b/pkg/inject/data.go new file mode 100644 index 000000000..ab380074b --- /dev/null +++ b/pkg/inject/data.go @@ -0,0 +1,35 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package inject + +type TrackedOffsets struct { + Data []TrackedLibrary `json:"data"` +} + +type TrackedLibrary struct { + Name string `json:"name"` + DataMembers []TrackedDataMember `json:"data_members"` +} + +type TrackedDataMember struct { + Struct string `json:"struct"` + Field string `json:"field_name"` + Offsets []VersionedOffset `json:"offsets"` +} + +type VersionedOffset struct { + Offset uint64 `json:"offset"` + Version string `json:"version"` +} diff --git a/pkg/inject/injector.go b/pkg/inject/injector.go new file mode 100644 index 000000000..50921a917 --- /dev/null +++ b/pkg/inject/injector.go @@ -0,0 +1,118 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package inject + +import ( + _ "embed" + "encoding/json" + "runtime" + + "github.com/cilium/ebpf" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/process" +) + +var ( + //go:embed offset_results.json + offsetsData string +) + +type Injector struct { + data *TrackedOffsets + isRegAbi bool + TotalCPUs uint32 + StartAddr uint64 + EndAddr uint64 +} + +func New(target *process.TargetDetails) (*Injector, error) { + var offsets TrackedOffsets + err := json.Unmarshal([]byte(offsetsData), &offsets) + if err != nil { + return nil, err + } + + return &Injector{ + data: &offsets, + isRegAbi: target.IsRegistersABI(), + TotalCPUs: uint32(runtime.NumCPU()), + StartAddr: target.AllocationDetails.Addr, + EndAddr: target.AllocationDetails.EndAddr, + }, nil +} + +type loadBpfFunc func() (*ebpf.CollectionSpec, error) + +type InjectStructField struct { + VarName string + StructName string + Field string +} + +func (i *Injector) Inject(loadBpf loadBpfFunc, library string, libVersion string, fields []*InjectStructField, initAlloc bool) (*ebpf.CollectionSpec, error) { + spec, err := loadBpf() + if err != nil { + return nil, err + } + + injectedVars := make(map[string]interface{}) + + for _, dm := range fields { + offset, found := i.getFieldOffset(library, libVersion, dm.StructName, dm.Field) + if !found { + log.Logger.V(0).Info("could not find offset", "lib", library, "version", libVersion, "struct", dm.StructName, "field", dm.Field) + } else { + injectedVars[dm.VarName] = offset + } + } + + i.addCommonInjections(injectedVars, initAlloc) + log.Logger.V(0).Info("Injecting variables", "vars", injectedVars) + if len(injectedVars) > 0 { + err = spec.RewriteConstants(injectedVars) + if err != nil { + return nil, err + } + } + + return spec, nil +} + +func (i *Injector) addCommonInjections(varsMap map[string]interface{}, initAlloc bool) { + varsMap["is_registers_abi"] = i.isRegAbi + if initAlloc { + varsMap["total_cpus"] = i.TotalCPUs + varsMap["start_addr"] = i.StartAddr + varsMap["end_addr"] = i.EndAddr + } +} + +func (i *Injector) getFieldOffset(libName string, libVersion string, structName string, fieldName string) (uint64, bool) { + for _, l := range i.data.Data { + if l.Name == libName { + for _, dm := range l.DataMembers { + if dm.Struct == structName && dm.Field == fieldName { + for _, o := range dm.Offsets { + if o.Version == libVersion { + return o.Offset, true + } + } + } + } + } + } + + return 0, false +} diff --git a/pkg/inject/offset_results.json b/pkg/inject/offset_results.json new file mode 100755 index 000000000..ec2586740 --- /dev/null +++ b/pkg/inject/offset_results.json @@ -0,0 +1,5510 @@ +{ + "data": [ + { + "name": "go", + "data_members": [ + { + "struct": "net/http.Request", + "field_name": "RemoteAddr", + "offsets": [ + { + "offset": 176, + "version": "1.19.1" + }, + { + "offset": 176, + "version": "1.19" + }, + { + "offset": 176, + "version": "1.18.6" + }, + { + "offset": 176, + "version": "1.18.5" + }, + { + "offset": 176, + "version": "1.18.4" + }, + { + "offset": 176, + "version": "1.18.3" + }, + { + "offset": 176, + "version": "1.18.2" + }, + { + "offset": 176, + "version": "1.18.1" + }, + { + "offset": 176, + "version": "1.18" + }, + { + "offset": 176, + "version": "1.17.13" + }, + { + "offset": 176, + "version": "1.17.12" + }, + { + "offset": 176, + "version": "1.17.11" + }, + { + "offset": 176, + "version": "1.17.10" + }, + { + "offset": 176, + "version": "1.17.9" + }, + { + "offset": 176, + "version": "1.17.8" + }, + { + "offset": 176, + "version": "1.17.7" + }, + { + "offset": 176, + "version": "1.17.6" + }, + { + "offset": 176, + "version": "1.17.5" + }, + { + "offset": 176, + "version": "1.17.4" + }, + { + "offset": 176, + "version": "1.17.3" + }, + { + "offset": 176, + "version": "1.17.2" + }, + { + "offset": 176, + "version": "1.17.1" + }, + { + "offset": 176, + "version": "1.17" + }, + { + "offset": 176, + "version": "1.16.15" + }, + { + "offset": 176, + "version": "1.16.14" + }, + { + "offset": 176, + "version": "1.16.13" + }, + { + "offset": 176, + "version": "1.16.12" + }, + { + "offset": 176, + "version": "1.16.11" + }, + { + "offset": 176, + "version": "1.16.10" + }, + { + "offset": 176, + "version": "1.16.9" + }, + { + "offset": 176, + "version": "1.16.8" + }, + { + "offset": 176, + "version": "1.16.7" + }, + { + "offset": 176, + "version": "1.16.6" + }, + { + "offset": 176, + "version": "1.16.5" + }, + { + "offset": 176, + "version": "1.16.4" + }, + { + "offset": 176, + "version": "1.16.3" + }, + { + "offset": 176, + "version": "1.16.2" + }, + { + "offset": 176, + "version": "1.16.1" + }, + { + "offset": 176, + "version": "1.16" + }, + { + "offset": 176, + "version": "1.15.15" + }, + { + "offset": 176, + "version": "1.15.14" + }, + { + "offset": 176, + "version": "1.15.13" + }, + { + "offset": 176, + "version": "1.15.12" + }, + { + "offset": 176, + "version": "1.15.11" + }, + { + "offset": 176, + "version": "1.15.10" + }, + { + "offset": 176, + "version": "1.15.9" + }, + { + "offset": 176, + "version": "1.15.8" + }, + { + "offset": 176, + "version": "1.15.7" + }, + { + "offset": 176, + "version": "1.15.6" + }, + { + "offset": 176, + "version": "1.15.5" + }, + { + "offset": 176, + "version": "1.15.4" + }, + { + "offset": 176, + "version": "1.15.3" + }, + { + "offset": 176, + "version": "1.15.2" + }, + { + "offset": 176, + "version": "1.15.1" + }, + { + "offset": 176, + "version": "1.15" + }, + { + "offset": 176, + "version": "1.14.15" + }, + { + "offset": 176, + "version": "1.14.14" + }, + { + "offset": 176, + "version": "1.14.13" + }, + { + "offset": 176, + "version": "1.14.12" + }, + { + "offset": 176, + "version": "1.14.11" + }, + { + "offset": 176, + "version": "1.14.10" + }, + { + "offset": 176, + "version": "1.14.9" + }, + { + "offset": 176, + "version": "1.14.8" + }, + { + "offset": 176, + "version": "1.14.7" + }, + { + "offset": 176, + "version": "1.14.6" + }, + { + "offset": 176, + "version": "1.14.5" + }, + { + "offset": 176, + "version": "1.14.4" + }, + { + "offset": 176, + "version": "1.14.3" + }, + { + "offset": 176, + "version": "1.14.2" + }, + { + "offset": 176, + "version": "1.14.1" + }, + { + "offset": 176, + "version": "1.14" + }, + { + "offset": 176, + "version": "1.13.15" + }, + { + "offset": 176, + "version": "1.13.14" + }, + { + "offset": 176, + "version": "1.13.13" + }, + { + "offset": 176, + "version": "1.13.12" + }, + { + "offset": 176, + "version": "1.13.11" + }, + { + "offset": 176, + "version": "1.13.10" + }, + { + "offset": 176, + "version": "1.13.9" + }, + { + "offset": 176, + "version": "1.13.8" + }, + { + "offset": 176, + "version": "1.13.7" + }, + { + "offset": 176, + "version": "1.13.6" + }, + { + "offset": 176, + "version": "1.13.5" + }, + { + "offset": 176, + "version": "1.13.4" + }, + { + "offset": 176, + "version": "1.13.3" + }, + { + "offset": 176, + "version": "1.13.2" + }, + { + "offset": 176, + "version": "1.13.1" + }, + { + "offset": 176, + "version": "1.13" + }, + { + "offset": 176, + "version": "1.12.17" + }, + { + "offset": 176, + "version": "1.12.16" + }, + { + "offset": 176, + "version": "1.12.15" + }, + { + "offset": 176, + "version": "1.12.14" + }, + { + "offset": 176, + "version": "1.12.13" + }, + { + "offset": 176, + "version": "1.12.12" + }, + { + "offset": 176, + "version": "1.12.11" + }, + { + "offset": 176, + "version": "1.12.10" + }, + { + "offset": 176, + "version": "1.12.9" + }, + { + "offset": 176, + "version": "1.12.8" + }, + { + "offset": 176, + "version": "1.12.7" + }, + { + "offset": 176, + "version": "1.12.6" + }, + { + "offset": 176, + "version": "1.12.5" + }, + { + "offset": 176, + "version": "1.12.4" + }, + { + "offset": 176, + "version": "1.12.3" + }, + { + "offset": 176, + "version": "1.12.2" + }, + { + "offset": 176, + "version": "1.12.1" + }, + { + "offset": 176, + "version": "1.12" + } + ] + }, + { + "struct": "net/http.Request", + "field_name": "ctx", + "offsets": [ + { + "offset": 232, + "version": "1.19.1" + }, + { + "offset": 232, + "version": "1.19" + }, + { + "offset": 232, + "version": "1.18.6" + }, + { + "offset": 232, + "version": "1.18.5" + }, + { + "offset": 232, + "version": "1.18.4" + }, + { + "offset": 232, + "version": "1.18.3" + }, + { + "offset": 232, + "version": "1.18.2" + }, + { + "offset": 232, + "version": "1.18.1" + }, + { + "offset": 232, + "version": "1.18" + }, + { + "offset": 232, + "version": "1.17.13" + }, + { + "offset": 232, + "version": "1.17.12" + }, + { + "offset": 232, + "version": "1.17.11" + }, + { + "offset": 232, + "version": "1.17.10" + }, + { + "offset": 232, + "version": "1.17.9" + }, + { + "offset": 232, + "version": "1.17.8" + }, + { + "offset": 232, + "version": "1.17.7" + }, + { + "offset": 232, + "version": "1.17.6" + }, + { + "offset": 232, + "version": "1.17.5" + }, + { + "offset": 232, + "version": "1.17.4" + }, + { + "offset": 232, + "version": "1.17.3" + }, + { + "offset": 232, + "version": "1.17.2" + }, + { + "offset": 232, + "version": "1.17.1" + }, + { + "offset": 232, + "version": "1.17" + }, + { + "offset": 232, + "version": "1.16.15" + }, + { + "offset": 232, + "version": "1.16.14" + }, + { + "offset": 232, + "version": "1.16.13" + }, + { + "offset": 232, + "version": "1.16.12" + }, + { + "offset": 232, + "version": "1.16.11" + }, + { + "offset": 232, + "version": "1.16.10" + }, + { + "offset": 232, + "version": "1.16.9" + }, + { + "offset": 232, + "version": "1.16.8" + }, + { + "offset": 232, + "version": "1.16.7" + }, + { + "offset": 232, + "version": "1.16.6" + }, + { + "offset": 232, + "version": "1.16.5" + }, + { + "offset": 232, + "version": "1.16.4" + }, + { + "offset": 232, + "version": "1.16.3" + }, + { + "offset": 232, + "version": "1.16.2" + }, + { + "offset": 232, + "version": "1.16.1" + }, + { + "offset": 232, + "version": "1.16" + }, + { + "offset": 232, + "version": "1.15.15" + }, + { + "offset": 232, + "version": "1.15.14" + }, + { + "offset": 232, + "version": "1.15.13" + }, + { + "offset": 232, + "version": "1.15.12" + }, + { + "offset": 232, + "version": "1.15.11" + }, + { + "offset": 232, + "version": "1.15.10" + }, + { + "offset": 232, + "version": "1.15.9" + }, + { + "offset": 232, + "version": "1.15.8" + }, + { + "offset": 232, + "version": "1.15.7" + }, + { + "offset": 232, + "version": "1.15.6" + }, + { + "offset": 232, + "version": "1.15.5" + }, + { + "offset": 232, + "version": "1.15.4" + }, + { + "offset": 232, + "version": "1.15.3" + }, + { + "offset": 232, + "version": "1.15.2" + }, + { + "offset": 232, + "version": "1.15.1" + }, + { + "offset": 232, + "version": "1.15" + }, + { + "offset": 232, + "version": "1.14.15" + }, + { + "offset": 232, + "version": "1.14.14" + }, + { + "offset": 232, + "version": "1.14.13" + }, + { + "offset": 232, + "version": "1.14.12" + }, + { + "offset": 232, + "version": "1.14.11" + }, + { + "offset": 232, + "version": "1.14.10" + }, + { + "offset": 232, + "version": "1.14.9" + }, + { + "offset": 232, + "version": "1.14.8" + }, + { + "offset": 232, + "version": "1.14.7" + }, + { + "offset": 232, + "version": "1.14.6" + }, + { + "offset": 232, + "version": "1.14.5" + }, + { + "offset": 232, + "version": "1.14.4" + }, + { + "offset": 232, + "version": "1.14.3" + }, + { + "offset": 232, + "version": "1.14.2" + }, + { + "offset": 232, + "version": "1.14.1" + }, + { + "offset": 232, + "version": "1.14" + }, + { + "offset": 232, + "version": "1.13.15" + }, + { + "offset": 232, + "version": "1.13.14" + }, + { + "offset": 232, + "version": "1.13.13" + }, + { + "offset": 232, + "version": "1.13.12" + }, + { + "offset": 232, + "version": "1.13.11" + }, + { + "offset": 232, + "version": "1.13.10" + }, + { + "offset": 232, + "version": "1.13.9" + }, + { + "offset": 232, + "version": "1.13.8" + }, + { + "offset": 232, + "version": "1.13.7" + }, + { + "offset": 232, + "version": "1.13.6" + }, + { + "offset": 232, + "version": "1.13.5" + }, + { + "offset": 232, + "version": "1.13.4" + }, + { + "offset": 232, + "version": "1.13.3" + }, + { + "offset": 232, + "version": "1.13.2" + }, + { + "offset": 232, + "version": "1.13.1" + }, + { + "offset": 232, + "version": "1.13" + }, + { + "offset": 232, + "version": "1.12.17" + }, + { + "offset": 232, + "version": "1.12.16" + }, + { + "offset": 232, + "version": "1.12.15" + }, + { + "offset": 232, + "version": "1.12.14" + }, + { + "offset": 232, + "version": "1.12.13" + }, + { + "offset": 232, + "version": "1.12.12" + }, + { + "offset": 232, + "version": "1.12.11" + }, + { + "offset": 232, + "version": "1.12.10" + }, + { + "offset": 232, + "version": "1.12.9" + }, + { + "offset": 232, + "version": "1.12.8" + }, + { + "offset": 232, + "version": "1.12.7" + }, + { + "offset": 232, + "version": "1.12.6" + }, + { + "offset": 232, + "version": "1.12.5" + }, + { + "offset": 232, + "version": "1.12.4" + }, + { + "offset": 232, + "version": "1.12.3" + }, + { + "offset": 232, + "version": "1.12.2" + }, + { + "offset": 232, + "version": "1.12.1" + }, + { + "offset": 232, + "version": "1.12" + } + ] + }, + { + "struct": "net/url.URL", + "field_name": "Path", + "offsets": [ + { + "offset": 56, + "version": "1.19.1" + }, + { + "offset": 56, + "version": "1.19" + }, + { + "offset": 56, + "version": "1.18.6" + }, + { + "offset": 56, + "version": "1.18.5" + }, + { + "offset": 56, + "version": "1.18.4" + }, + { + "offset": 56, + "version": "1.18.3" + }, + { + "offset": 56, + "version": "1.18.2" + }, + { + "offset": 56, + "version": "1.18.1" + }, + { + "offset": 56, + "version": "1.18" + }, + { + "offset": 56, + "version": "1.17.13" + }, + { + "offset": 56, + "version": "1.17.12" + }, + { + "offset": 56, + "version": "1.17.11" + }, + { + "offset": 56, + "version": "1.17.10" + }, + { + "offset": 56, + "version": "1.17.9" + }, + { + "offset": 56, + "version": "1.17.8" + }, + { + "offset": 56, + "version": "1.17.7" + }, + { + "offset": 56, + "version": "1.17.6" + }, + { + "offset": 56, + "version": "1.17.5" + }, + { + "offset": 56, + "version": "1.17.4" + }, + { + "offset": 56, + "version": "1.17.3" + }, + { + "offset": 56, + "version": "1.17.2" + }, + { + "offset": 56, + "version": "1.17.1" + }, + { + "offset": 56, + "version": "1.17" + }, + { + "offset": 56, + "version": "1.16.15" + }, + { + "offset": 56, + "version": "1.16.14" + }, + { + "offset": 56, + "version": "1.16.13" + }, + { + "offset": 56, + "version": "1.16.12" + }, + { + "offset": 56, + "version": "1.16.11" + }, + { + "offset": 56, + "version": "1.16.10" + }, + { + "offset": 56, + "version": "1.16.9" + }, + { + "offset": 56, + "version": "1.16.8" + }, + { + "offset": 56, + "version": "1.16.7" + }, + { + "offset": 56, + "version": "1.16.6" + }, + { + "offset": 56, + "version": "1.16.5" + }, + { + "offset": 56, + "version": "1.16.4" + }, + { + "offset": 56, + "version": "1.16.3" + }, + { + "offset": 56, + "version": "1.16.2" + }, + { + "offset": 56, + "version": "1.16.1" + }, + { + "offset": 56, + "version": "1.16" + }, + { + "offset": 56, + "version": "1.15.15" + }, + { + "offset": 56, + "version": "1.15.14" + }, + { + "offset": 56, + "version": "1.15.13" + }, + { + "offset": 56, + "version": "1.15.12" + }, + { + "offset": 56, + "version": "1.15.11" + }, + { + "offset": 56, + "version": "1.15.10" + }, + { + "offset": 56, + "version": "1.15.9" + }, + { + "offset": 56, + "version": "1.15.8" + }, + { + "offset": 56, + "version": "1.15.7" + }, + { + "offset": 56, + "version": "1.15.6" + }, + { + "offset": 56, + "version": "1.15.5" + }, + { + "offset": 56, + "version": "1.15.4" + }, + { + "offset": 56, + "version": "1.15.3" + }, + { + "offset": 56, + "version": "1.15.2" + }, + { + "offset": 56, + "version": "1.15.1" + }, + { + "offset": 56, + "version": "1.15" + }, + { + "offset": 56, + "version": "1.14.15" + }, + { + "offset": 56, + "version": "1.14.14" + }, + { + "offset": 56, + "version": "1.14.13" + }, + { + "offset": 56, + "version": "1.14.12" + }, + { + "offset": 56, + "version": "1.14.11" + }, + { + "offset": 56, + "version": "1.14.10" + }, + { + "offset": 56, + "version": "1.14.9" + }, + { + "offset": 56, + "version": "1.14.8" + }, + { + "offset": 56, + "version": "1.14.7" + }, + { + "offset": 56, + "version": "1.14.6" + }, + { + "offset": 56, + "version": "1.14.5" + }, + { + "offset": 56, + "version": "1.14.4" + }, + { + "offset": 56, + "version": "1.14.3" + }, + { + "offset": 56, + "version": "1.14.2" + }, + { + "offset": 56, + "version": "1.14.1" + }, + { + "offset": 56, + "version": "1.14" + }, + { + "offset": 56, + "version": "1.13.15" + }, + { + "offset": 56, + "version": "1.13.14" + }, + { + "offset": 56, + "version": "1.13.13" + }, + { + "offset": 56, + "version": "1.13.12" + }, + { + "offset": 56, + "version": "1.13.11" + }, + { + "offset": 56, + "version": "1.13.10" + }, + { + "offset": 56, + "version": "1.13.9" + }, + { + "offset": 56, + "version": "1.13.8" + }, + { + "offset": 56, + "version": "1.13.7" + }, + { + "offset": 56, + "version": "1.13.6" + }, + { + "offset": 56, + "version": "1.13.5" + }, + { + "offset": 56, + "version": "1.13.4" + }, + { + "offset": 56, + "version": "1.13.3" + }, + { + "offset": 56, + "version": "1.13.2" + }, + { + "offset": 56, + "version": "1.13.1" + }, + { + "offset": 56, + "version": "1.13" + }, + { + "offset": 56, + "version": "1.12.17" + }, + { + "offset": 56, + "version": "1.12.16" + }, + { + "offset": 56, + "version": "1.12.15" + }, + { + "offset": 56, + "version": "1.12.14" + }, + { + "offset": 56, + "version": "1.12.13" + }, + { + "offset": 56, + "version": "1.12.12" + }, + { + "offset": 56, + "version": "1.12.11" + }, + { + "offset": 56, + "version": "1.12.10" + }, + { + "offset": 56, + "version": "1.12.9" + }, + { + "offset": 56, + "version": "1.12.8" + }, + { + "offset": 56, + "version": "1.12.7" + }, + { + "offset": 56, + "version": "1.12.6" + }, + { + "offset": 56, + "version": "1.12.5" + }, + { + "offset": 56, + "version": "1.12.4" + }, + { + "offset": 56, + "version": "1.12.3" + }, + { + "offset": 56, + "version": "1.12.2" + }, + { + "offset": 56, + "version": "1.12.1" + }, + { + "offset": 56, + "version": "1.12" + } + ] + }, + { + "struct": "runtime.g", + "field_name": "goid", + "offsets": [ + { + "offset": 152, + "version": "1.19.1" + }, + { + "offset": 152, + "version": "1.19" + }, + { + "offset": 152, + "version": "1.18.6" + }, + { + "offset": 152, + "version": "1.18.5" + }, + { + "offset": 152, + "version": "1.18.4" + }, + { + "offset": 152, + "version": "1.18.3" + }, + { + "offset": 152, + "version": "1.18.2" + }, + { + "offset": 152, + "version": "1.18.1" + }, + { + "offset": 152, + "version": "1.18" + }, + { + "offset": 152, + "version": "1.17.13" + }, + { + "offset": 152, + "version": "1.17.12" + }, + { + "offset": 152, + "version": "1.17.11" + }, + { + "offset": 152, + "version": "1.17.10" + }, + { + "offset": 152, + "version": "1.17.9" + }, + { + "offset": 152, + "version": "1.17.8" + }, + { + "offset": 152, + "version": "1.17.7" + }, + { + "offset": 152, + "version": "1.17.6" + }, + { + "offset": 152, + "version": "1.17.5" + }, + { + "offset": 152, + "version": "1.17.4" + }, + { + "offset": 152, + "version": "1.17.3" + }, + { + "offset": 152, + "version": "1.17.2" + }, + { + "offset": 152, + "version": "1.17.1" + }, + { + "offset": 152, + "version": "1.17" + }, + { + "offset": 152, + "version": "1.16.15" + }, + { + "offset": 152, + "version": "1.16.14" + }, + { + "offset": 152, + "version": "1.16.13" + }, + { + "offset": 152, + "version": "1.16.12" + }, + { + "offset": 152, + "version": "1.16.11" + }, + { + "offset": 152, + "version": "1.16.10" + }, + { + "offset": 152, + "version": "1.16.9" + }, + { + "offset": 152, + "version": "1.16.8" + }, + { + "offset": 152, + "version": "1.16.7" + }, + { + "offset": 152, + "version": "1.16.6" + }, + { + "offset": 152, + "version": "1.16.5" + }, + { + "offset": 152, + "version": "1.16.4" + }, + { + "offset": 152, + "version": "1.16.3" + }, + { + "offset": 152, + "version": "1.16.2" + }, + { + "offset": 152, + "version": "1.16.1" + }, + { + "offset": 152, + "version": "1.16" + }, + { + "offset": 152, + "version": "1.15.15" + }, + { + "offset": 152, + "version": "1.15.14" + }, + { + "offset": 152, + "version": "1.15.13" + }, + { + "offset": 152, + "version": "1.15.12" + }, + { + "offset": 152, + "version": "1.15.11" + }, + { + "offset": 152, + "version": "1.15.10" + }, + { + "offset": 152, + "version": "1.15.9" + }, + { + "offset": 152, + "version": "1.15.8" + }, + { + "offset": 152, + "version": "1.15.7" + }, + { + "offset": 152, + "version": "1.15.6" + }, + { + "offset": 152, + "version": "1.15.5" + }, + { + "offset": 152, + "version": "1.15.4" + }, + { + "offset": 152, + "version": "1.15.3" + }, + { + "offset": 152, + "version": "1.15.2" + }, + { + "offset": 152, + "version": "1.15.1" + }, + { + "offset": 152, + "version": "1.15" + }, + { + "offset": 152, + "version": "1.14.15" + }, + { + "offset": 152, + "version": "1.14.14" + }, + { + "offset": 152, + "version": "1.14.13" + }, + { + "offset": 152, + "version": "1.14.12" + }, + { + "offset": 152, + "version": "1.14.11" + }, + { + "offset": 152, + "version": "1.14.10" + }, + { + "offset": 152, + "version": "1.14.9" + }, + { + "offset": 152, + "version": "1.14.8" + }, + { + "offset": 152, + "version": "1.14.7" + }, + { + "offset": 152, + "version": "1.14.6" + }, + { + "offset": 152, + "version": "1.14.5" + }, + { + "offset": 152, + "version": "1.14.4" + }, + { + "offset": 152, + "version": "1.14.3" + }, + { + "offset": 152, + "version": "1.14.2" + }, + { + "offset": 152, + "version": "1.14.1" + }, + { + "offset": 152, + "version": "1.14" + }, + { + "offset": 152, + "version": "1.13.15" + }, + { + "offset": 152, + "version": "1.13.14" + }, + { + "offset": 152, + "version": "1.13.13" + }, + { + "offset": 152, + "version": "1.13.12" + }, + { + "offset": 152, + "version": "1.13.11" + }, + { + "offset": 152, + "version": "1.13.10" + }, + { + "offset": 152, + "version": "1.13.9" + }, + { + "offset": 152, + "version": "1.13.8" + }, + { + "offset": 152, + "version": "1.13.7" + }, + { + "offset": 152, + "version": "1.13.6" + }, + { + "offset": 152, + "version": "1.13.5" + }, + { + "offset": 152, + "version": "1.13.4" + }, + { + "offset": 152, + "version": "1.13.3" + }, + { + "offset": 152, + "version": "1.13.2" + }, + { + "offset": 152, + "version": "1.13.1" + }, + { + "offset": 152, + "version": "1.13" + }, + { + "offset": 152, + "version": "1.12.17" + }, + { + "offset": 152, + "version": "1.12.16" + }, + { + "offset": 152, + "version": "1.12.15" + }, + { + "offset": 152, + "version": "1.12.14" + }, + { + "offset": 152, + "version": "1.12.13" + }, + { + "offset": 152, + "version": "1.12.12" + }, + { + "offset": 152, + "version": "1.12.11" + }, + { + "offset": 152, + "version": "1.12.10" + }, + { + "offset": 152, + "version": "1.12.9" + }, + { + "offset": 152, + "version": "1.12.8" + }, + { + "offset": 152, + "version": "1.12.7" + }, + { + "offset": 152, + "version": "1.12.6" + }, + { + "offset": 152, + "version": "1.12.5" + }, + { + "offset": 152, + "version": "1.12.4" + }, + { + "offset": 152, + "version": "1.12.3" + }, + { + "offset": 152, + "version": "1.12.2" + }, + { + "offset": 152, + "version": "1.12.1" + }, + { + "offset": 152, + "version": "1.12" + } + ] + }, + { + "struct": "net/http.Request", + "field_name": "Method", + "offsets": [ + { + "offset": 0, + "version": "1.19.1" + }, + { + "offset": 0, + "version": "1.19" + }, + { + "offset": 0, + "version": "1.18.6" + }, + { + "offset": 0, + "version": "1.18.5" + }, + { + "offset": 0, + "version": "1.18.4" + }, + { + "offset": 0, + "version": "1.18.3" + }, + { + "offset": 0, + "version": "1.18.2" + }, + { + "offset": 0, + "version": "1.18.1" + }, + { + "offset": 0, + "version": "1.18" + }, + { + "offset": 0, + "version": "1.17.13" + }, + { + "offset": 0, + "version": "1.17.12" + }, + { + "offset": 0, + "version": "1.17.11" + }, + { + "offset": 0, + "version": "1.17.10" + }, + { + "offset": 0, + "version": "1.17.9" + }, + { + "offset": 0, + "version": "1.17.8" + }, + { + "offset": 0, + "version": "1.17.7" + }, + { + "offset": 0, + "version": "1.17.6" + }, + { + "offset": 0, + "version": "1.17.5" + }, + { + "offset": 0, + "version": "1.17.4" + }, + { + "offset": 0, + "version": "1.17.3" + }, + { + "offset": 0, + "version": "1.17.2" + }, + { + "offset": 0, + "version": "1.17.1" + }, + { + "offset": 0, + "version": "1.17" + }, + { + "offset": 0, + "version": "1.16.15" + }, + { + "offset": 0, + "version": "1.16.14" + }, + { + "offset": 0, + "version": "1.16.13" + }, + { + "offset": 0, + "version": "1.16.12" + }, + { + "offset": 0, + "version": "1.16.11" + }, + { + "offset": 0, + "version": "1.16.10" + }, + { + "offset": 0, + "version": "1.16.9" + }, + { + "offset": 0, + "version": "1.16.8" + }, + { + "offset": 0, + "version": "1.16.7" + }, + { + "offset": 0, + "version": "1.16.6" + }, + { + "offset": 0, + "version": "1.16.5" + }, + { + "offset": 0, + "version": "1.16.4" + }, + { + "offset": 0, + "version": "1.16.3" + }, + { + "offset": 0, + "version": "1.16.2" + }, + { + "offset": 0, + "version": "1.16.1" + }, + { + "offset": 0, + "version": "1.16" + }, + { + "offset": 0, + "version": "1.15.15" + }, + { + "offset": 0, + "version": "1.15.14" + }, + { + "offset": 0, + "version": "1.15.13" + }, + { + "offset": 0, + "version": "1.15.12" + }, + { + "offset": 0, + "version": "1.15.11" + }, + { + "offset": 0, + "version": "1.15.10" + }, + { + "offset": 0, + "version": "1.15.9" + }, + { + "offset": 0, + "version": "1.15.8" + }, + { + "offset": 0, + "version": "1.15.7" + }, + { + "offset": 0, + "version": "1.15.6" + }, + { + "offset": 0, + "version": "1.15.5" + }, + { + "offset": 0, + "version": "1.15.4" + }, + { + "offset": 0, + "version": "1.15.3" + }, + { + "offset": 0, + "version": "1.15.2" + }, + { + "offset": 0, + "version": "1.15.1" + }, + { + "offset": 0, + "version": "1.15" + }, + { + "offset": 0, + "version": "1.14.15" + }, + { + "offset": 0, + "version": "1.14.14" + }, + { + "offset": 0, + "version": "1.14.13" + }, + { + "offset": 0, + "version": "1.14.12" + }, + { + "offset": 0, + "version": "1.14.11" + }, + { + "offset": 0, + "version": "1.14.10" + }, + { + "offset": 0, + "version": "1.14.9" + }, + { + "offset": 0, + "version": "1.14.8" + }, + { + "offset": 0, + "version": "1.14.7" + }, + { + "offset": 0, + "version": "1.14.6" + }, + { + "offset": 0, + "version": "1.14.5" + }, + { + "offset": 0, + "version": "1.14.4" + }, + { + "offset": 0, + "version": "1.14.3" + }, + { + "offset": 0, + "version": "1.14.2" + }, + { + "offset": 0, + "version": "1.14.1" + }, + { + "offset": 0, + "version": "1.14" + }, + { + "offset": 0, + "version": "1.13.15" + }, + { + "offset": 0, + "version": "1.13.14" + }, + { + "offset": 0, + "version": "1.13.13" + }, + { + "offset": 0, + "version": "1.13.12" + }, + { + "offset": 0, + "version": "1.13.11" + }, + { + "offset": 0, + "version": "1.13.10" + }, + { + "offset": 0, + "version": "1.13.9" + }, + { + "offset": 0, + "version": "1.13.8" + }, + { + "offset": 0, + "version": "1.13.7" + }, + { + "offset": 0, + "version": "1.13.6" + }, + { + "offset": 0, + "version": "1.13.5" + }, + { + "offset": 0, + "version": "1.13.4" + }, + { + "offset": 0, + "version": "1.13.3" + }, + { + "offset": 0, + "version": "1.13.2" + }, + { + "offset": 0, + "version": "1.13.1" + }, + { + "offset": 0, + "version": "1.13" + }, + { + "offset": 0, + "version": "1.12.17" + }, + { + "offset": 0, + "version": "1.12.16" + }, + { + "offset": 0, + "version": "1.12.15" + }, + { + "offset": 0, + "version": "1.12.14" + }, + { + "offset": 0, + "version": "1.12.13" + }, + { + "offset": 0, + "version": "1.12.12" + }, + { + "offset": 0, + "version": "1.12.11" + }, + { + "offset": 0, + "version": "1.12.10" + }, + { + "offset": 0, + "version": "1.12.9" + }, + { + "offset": 0, + "version": "1.12.8" + }, + { + "offset": 0, + "version": "1.12.7" + }, + { + "offset": 0, + "version": "1.12.6" + }, + { + "offset": 0, + "version": "1.12.5" + }, + { + "offset": 0, + "version": "1.12.4" + }, + { + "offset": 0, + "version": "1.12.3" + }, + { + "offset": 0, + "version": "1.12.2" + }, + { + "offset": 0, + "version": "1.12.1" + }, + { + "offset": 0, + "version": "1.12" + } + ] + }, + { + "struct": "net/http.Request", + "field_name": "URL", + "offsets": [ + { + "offset": 16, + "version": "1.19.1" + }, + { + "offset": 16, + "version": "1.19" + }, + { + "offset": 16, + "version": "1.18.6" + }, + { + "offset": 16, + "version": "1.18.5" + }, + { + "offset": 16, + "version": "1.18.4" + }, + { + "offset": 16, + "version": "1.18.3" + }, + { + "offset": 16, + "version": "1.18.2" + }, + { + "offset": 16, + "version": "1.18.1" + }, + { + "offset": 16, + "version": "1.18" + }, + { + "offset": 16, + "version": "1.17.13" + }, + { + "offset": 16, + "version": "1.17.12" + }, + { + "offset": 16, + "version": "1.17.11" + }, + { + "offset": 16, + "version": "1.17.10" + }, + { + "offset": 16, + "version": "1.17.9" + }, + { + "offset": 16, + "version": "1.17.8" + }, + { + "offset": 16, + "version": "1.17.7" + }, + { + "offset": 16, + "version": "1.17.6" + }, + { + "offset": 16, + "version": "1.17.5" + }, + { + "offset": 16, + "version": "1.17.4" + }, + { + "offset": 16, + "version": "1.17.3" + }, + { + "offset": 16, + "version": "1.17.2" + }, + { + "offset": 16, + "version": "1.17.1" + }, + { + "offset": 16, + "version": "1.17" + }, + { + "offset": 16, + "version": "1.16.15" + }, + { + "offset": 16, + "version": "1.16.14" + }, + { + "offset": 16, + "version": "1.16.13" + }, + { + "offset": 16, + "version": "1.16.12" + }, + { + "offset": 16, + "version": "1.16.11" + }, + { + "offset": 16, + "version": "1.16.10" + }, + { + "offset": 16, + "version": "1.16.9" + }, + { + "offset": 16, + "version": "1.16.8" + }, + { + "offset": 16, + "version": "1.16.7" + }, + { + "offset": 16, + "version": "1.16.6" + }, + { + "offset": 16, + "version": "1.16.5" + }, + { + "offset": 16, + "version": "1.16.4" + }, + { + "offset": 16, + "version": "1.16.3" + }, + { + "offset": 16, + "version": "1.16.2" + }, + { + "offset": 16, + "version": "1.16.1" + }, + { + "offset": 16, + "version": "1.16" + }, + { + "offset": 16, + "version": "1.15.15" + }, + { + "offset": 16, + "version": "1.15.14" + }, + { + "offset": 16, + "version": "1.15.13" + }, + { + "offset": 16, + "version": "1.15.12" + }, + { + "offset": 16, + "version": "1.15.11" + }, + { + "offset": 16, + "version": "1.15.10" + }, + { + "offset": 16, + "version": "1.15.9" + }, + { + "offset": 16, + "version": "1.15.8" + }, + { + "offset": 16, + "version": "1.15.7" + }, + { + "offset": 16, + "version": "1.15.6" + }, + { + "offset": 16, + "version": "1.15.5" + }, + { + "offset": 16, + "version": "1.15.4" + }, + { + "offset": 16, + "version": "1.15.3" + }, + { + "offset": 16, + "version": "1.15.2" + }, + { + "offset": 16, + "version": "1.15.1" + }, + { + "offset": 16, + "version": "1.15" + }, + { + "offset": 16, + "version": "1.14.15" + }, + { + "offset": 16, + "version": "1.14.14" + }, + { + "offset": 16, + "version": "1.14.13" + }, + { + "offset": 16, + "version": "1.14.12" + }, + { + "offset": 16, + "version": "1.14.11" + }, + { + "offset": 16, + "version": "1.14.10" + }, + { + "offset": 16, + "version": "1.14.9" + }, + { + "offset": 16, + "version": "1.14.8" + }, + { + "offset": 16, + "version": "1.14.7" + }, + { + "offset": 16, + "version": "1.14.6" + }, + { + "offset": 16, + "version": "1.14.5" + }, + { + "offset": 16, + "version": "1.14.4" + }, + { + "offset": 16, + "version": "1.14.3" + }, + { + "offset": 16, + "version": "1.14.2" + }, + { + "offset": 16, + "version": "1.14.1" + }, + { + "offset": 16, + "version": "1.14" + }, + { + "offset": 16, + "version": "1.13.15" + }, + { + "offset": 16, + "version": "1.13.14" + }, + { + "offset": 16, + "version": "1.13.13" + }, + { + "offset": 16, + "version": "1.13.12" + }, + { + "offset": 16, + "version": "1.13.11" + }, + { + "offset": 16, + "version": "1.13.10" + }, + { + "offset": 16, + "version": "1.13.9" + }, + { + "offset": 16, + "version": "1.13.8" + }, + { + "offset": 16, + "version": "1.13.7" + }, + { + "offset": 16, + "version": "1.13.6" + }, + { + "offset": 16, + "version": "1.13.5" + }, + { + "offset": 16, + "version": "1.13.4" + }, + { + "offset": 16, + "version": "1.13.3" + }, + { + "offset": 16, + "version": "1.13.2" + }, + { + "offset": 16, + "version": "1.13.1" + }, + { + "offset": 16, + "version": "1.13" + }, + { + "offset": 16, + "version": "1.12.17" + }, + { + "offset": 16, + "version": "1.12.16" + }, + { + "offset": 16, + "version": "1.12.15" + }, + { + "offset": 16, + "version": "1.12.14" + }, + { + "offset": 16, + "version": "1.12.13" + }, + { + "offset": 16, + "version": "1.12.12" + }, + { + "offset": 16, + "version": "1.12.11" + }, + { + "offset": 16, + "version": "1.12.10" + }, + { + "offset": 16, + "version": "1.12.9" + }, + { + "offset": 16, + "version": "1.12.8" + }, + { + "offset": 16, + "version": "1.12.7" + }, + { + "offset": 16, + "version": "1.12.6" + }, + { + "offset": 16, + "version": "1.12.5" + }, + { + "offset": 16, + "version": "1.12.4" + }, + { + "offset": 16, + "version": "1.12.3" + }, + { + "offset": 16, + "version": "1.12.2" + }, + { + "offset": 16, + "version": "1.12.1" + }, + { + "offset": 16, + "version": "1.12" + } + ] + } + ] + }, + { + "name": "google.golang.org/grpc", + "data_members": [ + { + "struct": "google.golang.org/grpc/internal/transport.Stream", + "field_name": "ctx", + "offsets": [ + { + "offset": 32, + "version": "v1.3.0" + }, + { + "offset": 32, + "version": "v1.4.0" + }, + { + "offset": 32, + "version": "v1.4.1" + }, + { + "offset": 32, + "version": "v1.4.2" + }, + { + "offset": 32, + "version": "v1.5.0" + }, + { + "offset": 32, + "version": "v1.5.1" + }, + { + "offset": 32, + "version": "v1.5.2" + }, + { + "offset": 32, + "version": "v1.6.0" + }, + { + "offset": 32, + "version": "v1.7.0" + }, + { + "offset": 32, + "version": "v1.7.1" + }, + { + "offset": 32, + "version": "v1.7.2" + }, + { + "offset": 32, + "version": "v1.7.3" + }, + { + "offset": 32, + "version": "v1.7.4" + }, + { + "offset": 32, + "version": "v1.7.5" + }, + { + "offset": 32, + "version": "v1.8.0" + }, + { + "offset": 32, + "version": "v1.8.2" + }, + { + "offset": 32, + "version": "v1.9.0" + }, + { + "offset": 32, + "version": "v1.9.1" + }, + { + "offset": 32, + "version": "v1.9.2" + }, + { + "offset": 32, + "version": "v1.10.0" + }, + { + "offset": 32, + "version": "v1.10.1" + }, + { + "offset": 32, + "version": "v1.11.0" + }, + { + "offset": 32, + "version": "v1.11.1" + }, + { + "offset": 32, + "version": "v1.11.2" + }, + { + "offset": 32, + "version": "v1.11.3" + }, + { + "offset": 32, + "version": "v1.12.0" + }, + { + "offset": 32, + "version": "v1.12.1" + }, + { + "offset": 32, + "version": "v1.12.2" + }, + { + "offset": 32, + "version": "v1.13.0" + }, + { + "offset": 32, + "version": "v1.14.0" + }, + { + "offset": 24, + "version": "v1.15.0" + }, + { + "offset": 24, + "version": "v1.16.0" + }, + { + "offset": 24, + "version": "v1.17.0" + }, + { + "offset": 24, + "version": "v1.18.0" + }, + { + "offset": 24, + "version": "v1.18.1" + }, + { + "offset": 24, + "version": "v1.19.0" + }, + { + "offset": 24, + "version": "v1.19.1" + }, + { + "offset": 24, + "version": "v1.20.0" + }, + { + "offset": 24, + "version": "v1.20.1" + }, + { + "offset": 24, + "version": "v1.21.0" + }, + { + "offset": 24, + "version": "v1.21.1" + }, + { + "offset": 24, + "version": "v1.21.2" + }, + { + "offset": 24, + "version": "v1.21.3" + }, + { + "offset": 24, + "version": "v1.21.4" + }, + { + "offset": 24, + "version": "v1.22.0" + }, + { + "offset": 24, + "version": "v1.22.1" + }, + { + "offset": 24, + "version": "v1.22.2" + }, + { + "offset": 24, + "version": "v1.22.3" + }, + { + "offset": 24, + "version": "v1.23.0" + }, + { + "offset": 24, + "version": "v1.23.1" + }, + { + "offset": 24, + "version": "v1.24.0" + }, + { + "offset": 32, + "version": "v1.25.0" + }, + { + "offset": 32, + "version": "v1.25.1" + }, + { + "offset": 32, + "version": "v1.26.0" + }, + { + "offset": 32, + "version": "v1.27.0-pre" + }, + { + "offset": 32, + "version": "v1.27.0" + }, + { + "offset": 32, + "version": "v1.27.1" + }, + { + "offset": 32, + "version": "v1.28.0-pre" + }, + { + "offset": 32, + "version": "v1.28.0" + }, + { + "offset": 32, + "version": "v1.28.1" + }, + { + "offset": 32, + "version": "v1.29.0-dev" + }, + { + "offset": 32, + "version": "v1.29.0" + }, + { + "offset": 32, + "version": "v1.29.1" + }, + { + "offset": 32, + "version": "v1.30.0-dev" + }, + { + "offset": 32, + "version": "v1.30.0-dev.1" + }, + { + "offset": 32, + "version": "v1.30.0" + }, + { + "offset": 32, + "version": "v1.30.1" + }, + { + "offset": 32, + "version": "v1.31.0-dev" + }, + { + "offset": 32, + "version": "v1.31.0" + }, + { + "offset": 32, + "version": "v1.31.1" + }, + { + "offset": 32, + "version": "v1.32.0-dev" + }, + { + "offset": 32, + "version": "v1.32.0" + }, + { + "offset": 32, + "version": "v1.33.0-dev" + }, + { + "offset": 32, + "version": "v1.33.0" + }, + { + "offset": 32, + "version": "v1.33.1" + }, + { + "offset": 32, + "version": "v1.33.2" + }, + { + "offset": 32, + "version": "v1.33.3" + }, + { + "offset": 32, + "version": "v1.34.0-dev" + }, + { + "offset": 32, + "version": "v1.34.0" + }, + { + "offset": 32, + "version": "v1.34.1" + }, + { + "offset": 32, + "version": "v1.34.2" + }, + { + "offset": 32, + "version": "v1.35.0-dev" + }, + { + "offset": 32, + "version": "v1.35.0" + }, + { + "offset": 32, + "version": "v1.35.1" + }, + { + "offset": 32, + "version": "v1.36.0-dev" + }, + { + "offset": 32, + "version": "v1.36.0" + }, + { + "offset": 32, + "version": "v1.36.1" + }, + { + "offset": 32, + "version": "v1.37.0-dev" + }, + { + "offset": 32, + "version": "v1.37.0" + }, + { + "offset": 32, + "version": "v1.37.1" + }, + { + "offset": 32, + "version": "v1.38.0-dev" + }, + { + "offset": 32, + "version": "v1.38.0" + }, + { + "offset": 32, + "version": "v1.38.1" + }, + { + "offset": 32, + "version": "v1.39.0-dev" + }, + { + "offset": 32, + "version": "v1.39.0" + }, + { + "offset": 32, + "version": "v1.39.1" + }, + { + "offset": 32, + "version": "v1.40.0-dev" + }, + { + "offset": 32, + "version": "v1.40.0" + }, + { + "offset": 32, + "version": "v1.40.1" + }, + { + "offset": 32, + "version": "v1.41.0-dev" + }, + { + "offset": 32, + "version": "v1.41.0" + }, + { + "offset": 32, + "version": "v1.41.1" + }, + { + "offset": 32, + "version": "v1.42.0-dev" + }, + { + "offset": 32, + "version": "v1.42.0" + }, + { + "offset": 32, + "version": "v1.43.0-dev" + }, + { + "offset": 32, + "version": "v1.43.0" + }, + { + "offset": 32, + "version": "v1.44.0-dev" + }, + { + "offset": 32, + "version": "v1.44.0" + }, + { + "offset": 32, + "version": "v1.45.0-dev" + }, + { + "offset": 32, + "version": "v1.45.0" + }, + { + "offset": 32, + "version": "v1.46.0-dev" + }, + { + "offset": 32, + "version": "v1.46.0" + }, + { + "offset": 32, + "version": "v1.46.1" + }, + { + "offset": 32, + "version": "v1.46.2" + }, + { + "offset": 32, + "version": "v1.47.0-dev" + }, + { + "offset": 32, + "version": "v1.47.0" + }, + { + "offset": 32, + "version": "v1.48.0-dev" + }, + { + "offset": 32, + "version": "v1.48.0" + }, + { + "offset": 32, + "version": "v1.49.0-dev" + }, + { + "offset": 32, + "version": "v1.49.0" + }, + { + "offset": 32, + "version": "v1.50.0-dev" + } + ] + }, + { + "struct": "google.golang.org/grpc.ClientConn", + "field_name": "target", + "offsets": [ + { + "offset": 24, + "version": "v1.3.0" + }, + { + "offset": 24, + "version": "v1.4.0" + }, + { + "offset": 24, + "version": "v1.4.1" + }, + { + "offset": 24, + "version": "v1.4.2" + }, + { + "offset": 24, + "version": "v1.5.0" + }, + { + "offset": 24, + "version": "v1.5.1" + }, + { + "offset": 24, + "version": "v1.5.2" + }, + { + "offset": 24, + "version": "v1.6.0" + }, + { + "offset": 24, + "version": "v1.7.0" + }, + { + "offset": 24, + "version": "v1.7.1" + }, + { + "offset": 24, + "version": "v1.7.2" + }, + { + "offset": 24, + "version": "v1.7.3" + }, + { + "offset": 24, + "version": "v1.7.4" + }, + { + "offset": 24, + "version": "v1.7.5" + }, + { + "offset": 24, + "version": "v1.8.0" + }, + { + "offset": 24, + "version": "v1.8.2" + }, + { + "offset": 24, + "version": "v1.9.0" + }, + { + "offset": 24, + "version": "v1.9.1" + }, + { + "offset": 24, + "version": "v1.9.2" + }, + { + "offset": 24, + "version": "v1.10.0" + }, + { + "offset": 24, + "version": "v1.10.1" + }, + { + "offset": 24, + "version": "v1.11.0" + }, + { + "offset": 24, + "version": "v1.11.1" + }, + { + "offset": 24, + "version": "v1.11.2" + }, + { + "offset": 24, + "version": "v1.11.3" + }, + { + "offset": 24, + "version": "v1.12.0" + }, + { + "offset": 24, + "version": "v1.12.1" + }, + { + "offset": 24, + "version": "v1.12.2" + }, + { + "offset": 24, + "version": "v1.13.0" + }, + { + "offset": 24, + "version": "v1.14.0" + }, + { + "offset": 24, + "version": "v1.15.0" + }, + { + "offset": 24, + "version": "v1.16.0" + }, + { + "offset": 24, + "version": "v1.17.0" + }, + { + "offset": 24, + "version": "v1.18.0" + }, + { + "offset": 24, + "version": "v1.18.1" + }, + { + "offset": 24, + "version": "v1.19.0" + }, + { + "offset": 24, + "version": "v1.19.1" + }, + { + "offset": 24, + "version": "v1.20.0" + }, + { + "offset": 24, + "version": "v1.20.1" + }, + { + "offset": 24, + "version": "v1.21.0" + }, + { + "offset": 24, + "version": "v1.21.1" + }, + { + "offset": 24, + "version": "v1.21.2" + }, + { + "offset": 24, + "version": "v1.21.3" + }, + { + "offset": 24, + "version": "v1.21.4" + }, + { + "offset": 24, + "version": "v1.22.0" + }, + { + "offset": 24, + "version": "v1.22.1" + }, + { + "offset": 24, + "version": "v1.22.2" + }, + { + "offset": 24, + "version": "v1.22.3" + }, + { + "offset": 24, + "version": "v1.23.0" + }, + { + "offset": 24, + "version": "v1.23.1" + }, + { + "offset": 24, + "version": "v1.24.0" + }, + { + "offset": 24, + "version": "v1.25.0" + }, + { + "offset": 24, + "version": "v1.25.1" + }, + { + "offset": 24, + "version": "v1.26.0" + }, + { + "offset": 24, + "version": "v1.27.0-pre" + }, + { + "offset": 24, + "version": "v1.27.0" + }, + { + "offset": 24, + "version": "v1.27.1" + }, + { + "offset": 24, + "version": "v1.28.0-pre" + }, + { + "offset": 24, + "version": "v1.28.0" + }, + { + "offset": 24, + "version": "v1.28.1" + }, + { + "offset": 24, + "version": "v1.29.0-dev" + }, + { + "offset": 24, + "version": "v1.29.0" + }, + { + "offset": 24, + "version": "v1.29.1" + }, + { + "offset": 24, + "version": "v1.30.0-dev" + }, + { + "offset": 24, + "version": "v1.30.0-dev.1" + }, + { + "offset": 24, + "version": "v1.30.0" + }, + { + "offset": 24, + "version": "v1.30.1" + }, + { + "offset": 24, + "version": "v1.31.0-dev" + }, + { + "offset": 24, + "version": "v1.31.0" + }, + { + "offset": 24, + "version": "v1.31.1" + }, + { + "offset": 24, + "version": "v1.32.0-dev" + }, + { + "offset": 24, + "version": "v1.32.0" + }, + { + "offset": 24, + "version": "v1.33.0-dev" + }, + { + "offset": 24, + "version": "v1.33.0" + }, + { + "offset": 24, + "version": "v1.33.1" + }, + { + "offset": 24, + "version": "v1.33.2" + }, + { + "offset": 24, + "version": "v1.33.3" + }, + { + "offset": 24, + "version": "v1.34.0-dev" + }, + { + "offset": 24, + "version": "v1.34.0" + }, + { + "offset": 24, + "version": "v1.34.1" + }, + { + "offset": 24, + "version": "v1.34.2" + }, + { + "offset": 24, + "version": "v1.35.0-dev" + }, + { + "offset": 24, + "version": "v1.35.0" + }, + { + "offset": 24, + "version": "v1.35.1" + }, + { + "offset": 24, + "version": "v1.36.0-dev" + }, + { + "offset": 24, + "version": "v1.36.0" + }, + { + "offset": 24, + "version": "v1.36.1" + }, + { + "offset": 24, + "version": "v1.37.0-dev" + }, + { + "offset": 24, + "version": "v1.37.0" + }, + { + "offset": 24, + "version": "v1.37.1" + }, + { + "offset": 24, + "version": "v1.38.0-dev" + }, + { + "offset": 24, + "version": "v1.38.0" + }, + { + "offset": 24, + "version": "v1.38.1" + }, + { + "offset": 24, + "version": "v1.39.0-dev" + }, + { + "offset": 24, + "version": "v1.39.0" + }, + { + "offset": 24, + "version": "v1.39.1" + }, + { + "offset": 24, + "version": "v1.40.0-dev" + }, + { + "offset": 24, + "version": "v1.40.0" + }, + { + "offset": 24, + "version": "v1.40.1" + }, + { + "offset": 24, + "version": "v1.41.0-dev" + }, + { + "offset": 24, + "version": "v1.41.0" + }, + { + "offset": 24, + "version": "v1.41.1" + }, + { + "offset": 24, + "version": "v1.42.0-dev" + }, + { + "offset": 24, + "version": "v1.42.0" + }, + { + "offset": 24, + "version": "v1.43.0-dev" + }, + { + "offset": 24, + "version": "v1.43.0" + }, + { + "offset": 24, + "version": "v1.44.0-dev" + }, + { + "offset": 24, + "version": "v1.44.0" + }, + { + "offset": 24, + "version": "v1.45.0-dev" + }, + { + "offset": 24, + "version": "v1.45.0" + }, + { + "offset": 24, + "version": "v1.46.0-dev" + }, + { + "offset": 24, + "version": "v1.46.0" + }, + { + "offset": 24, + "version": "v1.46.1" + }, + { + "offset": 24, + "version": "v1.46.2" + }, + { + "offset": 24, + "version": "v1.47.0-dev" + }, + { + "offset": 24, + "version": "v1.47.0" + }, + { + "offset": 24, + "version": "v1.48.0-dev" + }, + { + "offset": 24, + "version": "v1.48.0" + }, + { + "offset": 24, + "version": "v1.49.0-dev" + }, + { + "offset": 24, + "version": "v1.49.0" + }, + { + "offset": 24, + "version": "v1.50.0-dev" + } + ] + }, + { + "struct": "golang.org/x/net/http2.MetaHeadersFrame", + "field_name": "Fields", + "offsets": [ + { + "offset": 8, + "version": "v1.3.0" + }, + { + "offset": 8, + "version": "v1.4.0" + }, + { + "offset": 8, + "version": "v1.4.1" + }, + { + "offset": 8, + "version": "v1.4.2" + }, + { + "offset": 8, + "version": "v1.5.0" + }, + { + "offset": 8, + "version": "v1.5.1" + }, + { + "offset": 8, + "version": "v1.5.2" + }, + { + "offset": 8, + "version": "v1.6.0" + }, + { + "offset": 8, + "version": "v1.7.0" + }, + { + "offset": 8, + "version": "v1.7.1" + }, + { + "offset": 8, + "version": "v1.7.2" + }, + { + "offset": 8, + "version": "v1.7.3" + }, + { + "offset": 8, + "version": "v1.7.4" + }, + { + "offset": 8, + "version": "v1.7.5" + }, + { + "offset": 8, + "version": "v1.8.0" + }, + { + "offset": 8, + "version": "v1.8.2" + }, + { + "offset": 8, + "version": "v1.9.0" + }, + { + "offset": 8, + "version": "v1.9.1" + }, + { + "offset": 8, + "version": "v1.9.2" + }, + { + "offset": 8, + "version": "v1.10.0" + }, + { + "offset": 8, + "version": "v1.10.1" + }, + { + "offset": 8, + "version": "v1.11.0" + }, + { + "offset": 8, + "version": "v1.11.1" + }, + { + "offset": 8, + "version": "v1.11.2" + }, + { + "offset": 8, + "version": "v1.11.3" + }, + { + "offset": 8, + "version": "v1.12.0" + }, + { + "offset": 8, + "version": "v1.12.1" + }, + { + "offset": 8, + "version": "v1.12.2" + }, + { + "offset": 8, + "version": "v1.13.0" + }, + { + "offset": 8, + "version": "v1.14.0" + }, + { + "offset": 8, + "version": "v1.15.0" + }, + { + "offset": 8, + "version": "v1.16.0" + }, + { + "offset": 8, + "version": "v1.17.0" + }, + { + "offset": 8, + "version": "v1.18.0" + }, + { + "offset": 8, + "version": "v1.18.1" + }, + { + "offset": 8, + "version": "v1.19.0" + }, + { + "offset": 8, + "version": "v1.19.1" + }, + { + "offset": 8, + "version": "v1.20.0" + }, + { + "offset": 8, + "version": "v1.20.1" + }, + { + "offset": 8, + "version": "v1.21.0" + }, + { + "offset": 8, + "version": "v1.21.1" + }, + { + "offset": 8, + "version": "v1.21.2" + }, + { + "offset": 8, + "version": "v1.21.3" + }, + { + "offset": 8, + "version": "v1.21.4" + }, + { + "offset": 8, + "version": "v1.22.0" + }, + { + "offset": 8, + "version": "v1.22.1" + }, + { + "offset": 8, + "version": "v1.22.2" + }, + { + "offset": 8, + "version": "v1.22.3" + }, + { + "offset": 8, + "version": "v1.23.0" + }, + { + "offset": 8, + "version": "v1.23.1" + }, + { + "offset": 8, + "version": "v1.24.0" + }, + { + "offset": 8, + "version": "v1.25.0" + }, + { + "offset": 8, + "version": "v1.25.1" + }, + { + "offset": 8, + "version": "v1.26.0" + }, + { + "offset": 8, + "version": "v1.27.0-pre" + }, + { + "offset": 8, + "version": "v1.27.0" + }, + { + "offset": 8, + "version": "v1.27.1" + }, + { + "offset": 8, + "version": "v1.28.0-pre" + }, + { + "offset": 8, + "version": "v1.28.0" + }, + { + "offset": 8, + "version": "v1.28.1" + }, + { + "offset": 8, + "version": "v1.29.0-dev" + }, + { + "offset": 8, + "version": "v1.29.0" + }, + { + "offset": 8, + "version": "v1.29.1" + }, + { + "offset": 8, + "version": "v1.30.0-dev" + }, + { + "offset": 8, + "version": "v1.30.0-dev.1" + }, + { + "offset": 8, + "version": "v1.30.0" + }, + { + "offset": 8, + "version": "v1.30.1" + }, + { + "offset": 8, + "version": "v1.31.0-dev" + }, + { + "offset": 8, + "version": "v1.31.0" + }, + { + "offset": 8, + "version": "v1.31.1" + }, + { + "offset": 8, + "version": "v1.32.0-dev" + }, + { + "offset": 8, + "version": "v1.32.0" + }, + { + "offset": 8, + "version": "v1.33.0-dev" + }, + { + "offset": 8, + "version": "v1.33.0" + }, + { + "offset": 8, + "version": "v1.33.1" + }, + { + "offset": 8, + "version": "v1.33.2" + }, + { + "offset": 8, + "version": "v1.33.3" + }, + { + "offset": 8, + "version": "v1.34.0-dev" + }, + { + "offset": 8, + "version": "v1.34.0" + }, + { + "offset": 8, + "version": "v1.34.1" + }, + { + "offset": 8, + "version": "v1.34.2" + }, + { + "offset": 8, + "version": "v1.35.0-dev" + }, + { + "offset": 8, + "version": "v1.35.0" + }, + { + "offset": 8, + "version": "v1.35.1" + }, + { + "offset": 8, + "version": "v1.36.0-dev" + }, + { + "offset": 8, + "version": "v1.36.0" + }, + { + "offset": 8, + "version": "v1.36.1" + }, + { + "offset": 8, + "version": "v1.37.0-dev" + }, + { + "offset": 8, + "version": "v1.37.0" + }, + { + "offset": 8, + "version": "v1.37.1" + }, + { + "offset": 8, + "version": "v1.38.0-dev" + }, + { + "offset": 8, + "version": "v1.38.0" + }, + { + "offset": 8, + "version": "v1.38.1" + }, + { + "offset": 8, + "version": "v1.39.0-dev" + }, + { + "offset": 8, + "version": "v1.39.0" + }, + { + "offset": 8, + "version": "v1.39.1" + }, + { + "offset": 8, + "version": "v1.40.0-dev" + }, + { + "offset": 8, + "version": "v1.40.0" + }, + { + "offset": 8, + "version": "v1.40.1" + }, + { + "offset": 8, + "version": "v1.41.0-dev" + }, + { + "offset": 8, + "version": "v1.41.0" + }, + { + "offset": 8, + "version": "v1.41.1" + }, + { + "offset": 8, + "version": "v1.42.0-dev" + }, + { + "offset": 8, + "version": "v1.42.0" + }, + { + "offset": 8, + "version": "v1.43.0-dev" + }, + { + "offset": 8, + "version": "v1.43.0" + }, + { + "offset": 8, + "version": "v1.44.0-dev" + }, + { + "offset": 8, + "version": "v1.44.0" + }, + { + "offset": 8, + "version": "v1.45.0-dev" + }, + { + "offset": 8, + "version": "v1.45.0" + }, + { + "offset": 8, + "version": "v1.46.0-dev" + }, + { + "offset": 8, + "version": "v1.46.0" + }, + { + "offset": 8, + "version": "v1.46.1" + }, + { + "offset": 8, + "version": "v1.46.2" + }, + { + "offset": 8, + "version": "v1.47.0-dev" + }, + { + "offset": 8, + "version": "v1.47.0" + }, + { + "offset": 8, + "version": "v1.48.0-dev" + }, + { + "offset": 8, + "version": "v1.48.0" + }, + { + "offset": 8, + "version": "v1.49.0-dev" + }, + { + "offset": 8, + "version": "v1.49.0" + }, + { + "offset": 8, + "version": "v1.50.0-dev" + } + ] + }, + { + "struct": "golang.org/x/net/http2.FrameHeader", + "field_name": "StreamID", + "offsets": [ + { + "offset": 8, + "version": "v1.3.0" + }, + { + "offset": 8, + "version": "v1.4.0" + }, + { + "offset": 8, + "version": "v1.4.1" + }, + { + "offset": 8, + "version": "v1.4.2" + }, + { + "offset": 8, + "version": "v1.5.0" + }, + { + "offset": 8, + "version": "v1.5.1" + }, + { + "offset": 8, + "version": "v1.5.2" + }, + { + "offset": 8, + "version": "v1.6.0" + }, + { + "offset": 8, + "version": "v1.7.0" + }, + { + "offset": 8, + "version": "v1.7.1" + }, + { + "offset": 8, + "version": "v1.7.2" + }, + { + "offset": 8, + "version": "v1.7.3" + }, + { + "offset": 8, + "version": "v1.7.4" + }, + { + "offset": 8, + "version": "v1.7.5" + }, + { + "offset": 8, + "version": "v1.8.0" + }, + { + "offset": 8, + "version": "v1.8.2" + }, + { + "offset": 8, + "version": "v1.9.0" + }, + { + "offset": 8, + "version": "v1.9.1" + }, + { + "offset": 8, + "version": "v1.9.2" + }, + { + "offset": 8, + "version": "v1.10.0" + }, + { + "offset": 8, + "version": "v1.10.1" + }, + { + "offset": 8, + "version": "v1.11.0" + }, + { + "offset": 8, + "version": "v1.11.1" + }, + { + "offset": 8, + "version": "v1.11.2" + }, + { + "offset": 8, + "version": "v1.11.3" + }, + { + "offset": 8, + "version": "v1.12.0" + }, + { + "offset": 8, + "version": "v1.12.1" + }, + { + "offset": 8, + "version": "v1.12.2" + }, + { + "offset": 8, + "version": "v1.13.0" + }, + { + "offset": 8, + "version": "v1.14.0" + }, + { + "offset": 8, + "version": "v1.15.0" + }, + { + "offset": 8, + "version": "v1.16.0" + }, + { + "offset": 8, + "version": "v1.17.0" + }, + { + "offset": 8, + "version": "v1.18.0" + }, + { + "offset": 8, + "version": "v1.18.1" + }, + { + "offset": 8, + "version": "v1.19.0" + }, + { + "offset": 8, + "version": "v1.19.1" + }, + { + "offset": 8, + "version": "v1.20.0" + }, + { + "offset": 8, + "version": "v1.20.1" + }, + { + "offset": 8, + "version": "v1.21.0" + }, + { + "offset": 8, + "version": "v1.21.1" + }, + { + "offset": 8, + "version": "v1.21.2" + }, + { + "offset": 8, + "version": "v1.21.3" + }, + { + "offset": 8, + "version": "v1.21.4" + }, + { + "offset": 8, + "version": "v1.22.0" + }, + { + "offset": 8, + "version": "v1.22.1" + }, + { + "offset": 8, + "version": "v1.22.2" + }, + { + "offset": 8, + "version": "v1.22.3" + }, + { + "offset": 8, + "version": "v1.23.0" + }, + { + "offset": 8, + "version": "v1.23.1" + }, + { + "offset": 8, + "version": "v1.24.0" + }, + { + "offset": 8, + "version": "v1.25.0" + }, + { + "offset": 8, + "version": "v1.25.1" + }, + { + "offset": 8, + "version": "v1.26.0" + }, + { + "offset": 8, + "version": "v1.27.0-pre" + }, + { + "offset": 8, + "version": "v1.27.0" + }, + { + "offset": 8, + "version": "v1.27.1" + }, + { + "offset": 8, + "version": "v1.28.0-pre" + }, + { + "offset": 8, + "version": "v1.28.0" + }, + { + "offset": 8, + "version": "v1.28.1" + }, + { + "offset": 8, + "version": "v1.29.0-dev" + }, + { + "offset": 8, + "version": "v1.29.0" + }, + { + "offset": 8, + "version": "v1.29.1" + }, + { + "offset": 8, + "version": "v1.30.0-dev" + }, + { + "offset": 8, + "version": "v1.30.0-dev.1" + }, + { + "offset": 8, + "version": "v1.30.0" + }, + { + "offset": 8, + "version": "v1.30.1" + }, + { + "offset": 8, + "version": "v1.31.0-dev" + }, + { + "offset": 8, + "version": "v1.31.0" + }, + { + "offset": 8, + "version": "v1.31.1" + }, + { + "offset": 8, + "version": "v1.32.0-dev" + }, + { + "offset": 8, + "version": "v1.32.0" + }, + { + "offset": 8, + "version": "v1.33.0-dev" + }, + { + "offset": 8, + "version": "v1.33.0" + }, + { + "offset": 8, + "version": "v1.33.1" + }, + { + "offset": 8, + "version": "v1.33.2" + }, + { + "offset": 8, + "version": "v1.33.3" + }, + { + "offset": 8, + "version": "v1.34.0-dev" + }, + { + "offset": 8, + "version": "v1.34.0" + }, + { + "offset": 8, + "version": "v1.34.1" + }, + { + "offset": 8, + "version": "v1.34.2" + }, + { + "offset": 8, + "version": "v1.35.0-dev" + }, + { + "offset": 8, + "version": "v1.35.0" + }, + { + "offset": 8, + "version": "v1.35.1" + }, + { + "offset": 8, + "version": "v1.36.0-dev" + }, + { + "offset": 8, + "version": "v1.36.0" + }, + { + "offset": 8, + "version": "v1.36.1" + }, + { + "offset": 8, + "version": "v1.37.0-dev" + }, + { + "offset": 8, + "version": "v1.37.0" + }, + { + "offset": 8, + "version": "v1.37.1" + }, + { + "offset": 8, + "version": "v1.38.0-dev" + }, + { + "offset": 8, + "version": "v1.38.0" + }, + { + "offset": 8, + "version": "v1.38.1" + }, + { + "offset": 8, + "version": "v1.39.0-dev" + }, + { + "offset": 8, + "version": "v1.39.0" + }, + { + "offset": 8, + "version": "v1.39.1" + }, + { + "offset": 8, + "version": "v1.40.0-dev" + }, + { + "offset": 8, + "version": "v1.40.0" + }, + { + "offset": 8, + "version": "v1.40.1" + }, + { + "offset": 8, + "version": "v1.41.0-dev" + }, + { + "offset": 8, + "version": "v1.41.0" + }, + { + "offset": 8, + "version": "v1.41.1" + }, + { + "offset": 8, + "version": "v1.42.0-dev" + }, + { + "offset": 8, + "version": "v1.42.0" + }, + { + "offset": 8, + "version": "v1.43.0-dev" + }, + { + "offset": 8, + "version": "v1.43.0" + }, + { + "offset": 8, + "version": "v1.44.0-dev" + }, + { + "offset": 8, + "version": "v1.44.0" + }, + { + "offset": 8, + "version": "v1.45.0-dev" + }, + { + "offset": 8, + "version": "v1.45.0" + }, + { + "offset": 8, + "version": "v1.46.0-dev" + }, + { + "offset": 8, + "version": "v1.46.0" + }, + { + "offset": 8, + "version": "v1.46.1" + }, + { + "offset": 8, + "version": "v1.46.2" + }, + { + "offset": 8, + "version": "v1.47.0-dev" + }, + { + "offset": 8, + "version": "v1.47.0" + }, + { + "offset": 8, + "version": "v1.48.0-dev" + }, + { + "offset": 8, + "version": "v1.48.0" + }, + { + "offset": 8, + "version": "v1.49.0-dev" + }, + { + "offset": 8, + "version": "v1.49.0" + }, + { + "offset": 8, + "version": "v1.50.0-dev" + } + ] + }, + { + "struct": "google.golang.org/grpc/internal/transport.Stream", + "field_name": "method", + "offsets": [ + { + "offset": 80, + "version": "v1.3.0" + }, + { + "offset": 80, + "version": "v1.4.0" + }, + { + "offset": 80, + "version": "v1.4.1" + }, + { + "offset": 80, + "version": "v1.4.2" + }, + { + "offset": 80, + "version": "v1.5.0" + }, + { + "offset": 80, + "version": "v1.5.1" + }, + { + "offset": 80, + "version": "v1.5.2" + }, + { + "offset": 80, + "version": "v1.6.0" + }, + { + "offset": 80, + "version": "v1.7.0" + }, + { + "offset": 80, + "version": "v1.7.1" + }, + { + "offset": 80, + "version": "v1.7.2" + }, + { + "offset": 80, + "version": "v1.7.3" + }, + { + "offset": 80, + "version": "v1.7.4" + }, + { + "offset": 80, + "version": "v1.7.5" + }, + { + "offset": 80, + "version": "v1.8.0" + }, + { + "offset": 80, + "version": "v1.8.2" + }, + { + "offset": 80, + "version": "v1.9.0" + }, + { + "offset": 80, + "version": "v1.9.1" + }, + { + "offset": 80, + "version": "v1.9.2" + }, + { + "offset": 80, + "version": "v1.10.0" + }, + { + "offset": 80, + "version": "v1.10.1" + }, + { + "offset": 80, + "version": "v1.11.0" + }, + { + "offset": 80, + "version": "v1.11.1" + }, + { + "offset": 80, + "version": "v1.11.2" + }, + { + "offset": 80, + "version": "v1.11.3" + }, + { + "offset": 80, + "version": "v1.12.0" + }, + { + "offset": 80, + "version": "v1.12.1" + }, + { + "offset": 80, + "version": "v1.12.2" + }, + { + "offset": 80, + "version": "v1.13.0" + }, + { + "offset": 80, + "version": "v1.14.0" + }, + { + "offset": 64, + "version": "v1.15.0" + }, + { + "offset": 64, + "version": "v1.16.0" + }, + { + "offset": 64, + "version": "v1.17.0" + }, + { + "offset": 64, + "version": "v1.18.0" + }, + { + "offset": 64, + "version": "v1.18.1" + }, + { + "offset": 64, + "version": "v1.19.0" + }, + { + "offset": 64, + "version": "v1.19.1" + }, + { + "offset": 64, + "version": "v1.20.0" + }, + { + "offset": 64, + "version": "v1.20.1" + }, + { + "offset": 64, + "version": "v1.21.0" + }, + { + "offset": 64, + "version": "v1.21.1" + }, + { + "offset": 64, + "version": "v1.21.2" + }, + { + "offset": 64, + "version": "v1.21.3" + }, + { + "offset": 64, + "version": "v1.21.4" + }, + { + "offset": 64, + "version": "v1.22.0" + }, + { + "offset": 64, + "version": "v1.22.1" + }, + { + "offset": 64, + "version": "v1.22.2" + }, + { + "offset": 64, + "version": "v1.22.3" + }, + { + "offset": 64, + "version": "v1.23.0" + }, + { + "offset": 64, + "version": "v1.23.1" + }, + { + "offset": 64, + "version": "v1.24.0" + }, + { + "offset": 72, + "version": "v1.25.0" + }, + { + "offset": 72, + "version": "v1.25.1" + }, + { + "offset": 72, + "version": "v1.26.0" + }, + { + "offset": 72, + "version": "v1.27.0-pre" + }, + { + "offset": 72, + "version": "v1.27.0" + }, + { + "offset": 72, + "version": "v1.27.1" + }, + { + "offset": 72, + "version": "v1.28.0-pre" + }, + { + "offset": 72, + "version": "v1.28.0" + }, + { + "offset": 72, + "version": "v1.28.1" + }, + { + "offset": 72, + "version": "v1.29.0-dev" + }, + { + "offset": 72, + "version": "v1.29.0" + }, + { + "offset": 72, + "version": "v1.29.1" + }, + { + "offset": 72, + "version": "v1.30.0-dev" + }, + { + "offset": 72, + "version": "v1.30.0-dev.1" + }, + { + "offset": 72, + "version": "v1.30.0" + }, + { + "offset": 72, + "version": "v1.30.1" + }, + { + "offset": 72, + "version": "v1.31.0-dev" + }, + { + "offset": 72, + "version": "v1.31.0" + }, + { + "offset": 72, + "version": "v1.31.1" + }, + { + "offset": 72, + "version": "v1.32.0-dev" + }, + { + "offset": 72, + "version": "v1.32.0" + }, + { + "offset": 72, + "version": "v1.33.0-dev" + }, + { + "offset": 72, + "version": "v1.33.0" + }, + { + "offset": 72, + "version": "v1.33.1" + }, + { + "offset": 72, + "version": "v1.33.2" + }, + { + "offset": 72, + "version": "v1.33.3" + }, + { + "offset": 72, + "version": "v1.34.0-dev" + }, + { + "offset": 72, + "version": "v1.34.0" + }, + { + "offset": 72, + "version": "v1.34.1" + }, + { + "offset": 72, + "version": "v1.34.2" + }, + { + "offset": 72, + "version": "v1.35.0-dev" + }, + { + "offset": 72, + "version": "v1.35.0" + }, + { + "offset": 72, + "version": "v1.35.1" + }, + { + "offset": 72, + "version": "v1.36.0-dev" + }, + { + "offset": 72, + "version": "v1.36.0" + }, + { + "offset": 72, + "version": "v1.36.1" + }, + { + "offset": 72, + "version": "v1.37.0-dev" + }, + { + "offset": 80, + "version": "v1.37.0" + }, + { + "offset": 80, + "version": "v1.37.1" + }, + { + "offset": 80, + "version": "v1.38.0-dev" + }, + { + "offset": 80, + "version": "v1.38.0" + }, + { + "offset": 80, + "version": "v1.38.1" + }, + { + "offset": 80, + "version": "v1.39.0-dev" + }, + { + "offset": 80, + "version": "v1.39.0" + }, + { + "offset": 80, + "version": "v1.39.1" + }, + { + "offset": 80, + "version": "v1.40.0-dev" + }, + { + "offset": 80, + "version": "v1.40.0" + }, + { + "offset": 80, + "version": "v1.40.1" + }, + { + "offset": 80, + "version": "v1.41.0-dev" + }, + { + "offset": 80, + "version": "v1.41.0" + }, + { + "offset": 80, + "version": "v1.41.1" + }, + { + "offset": 80, + "version": "v1.42.0-dev" + }, + { + "offset": 80, + "version": "v1.42.0" + }, + { + "offset": 80, + "version": "v1.43.0-dev" + }, + { + "offset": 80, + "version": "v1.43.0" + }, + { + "offset": 80, + "version": "v1.44.0-dev" + }, + { + "offset": 80, + "version": "v1.44.0" + }, + { + "offset": 80, + "version": "v1.45.0-dev" + }, + { + "offset": 80, + "version": "v1.45.0" + }, + { + "offset": 80, + "version": "v1.46.0-dev" + }, + { + "offset": 80, + "version": "v1.46.0" + }, + { + "offset": 80, + "version": "v1.46.1" + }, + { + "offset": 80, + "version": "v1.46.2" + }, + { + "offset": 80, + "version": "v1.47.0-dev" + }, + { + "offset": 80, + "version": "v1.47.0" + }, + { + "offset": 80, + "version": "v1.48.0-dev" + }, + { + "offset": 80, + "version": "v1.48.0" + }, + { + "offset": 80, + "version": "v1.49.0-dev" + }, + { + "offset": 80, + "version": "v1.49.0" + }, + { + "offset": 80, + "version": "v1.50.0-dev" + } + ] + }, + { + "struct": "google.golang.org/grpc/internal/transport.Stream", + "field_name": "id", + "offsets": [ + { + "offset": 0, + "version": "v1.3.0" + }, + { + "offset": 0, + "version": "v1.4.0" + }, + { + "offset": 0, + "version": "v1.4.1" + }, + { + "offset": 0, + "version": "v1.4.2" + }, + { + "offset": 0, + "version": "v1.5.0" + }, + { + "offset": 0, + "version": "v1.5.1" + }, + { + "offset": 0, + "version": "v1.5.2" + }, + { + "offset": 0, + "version": "v1.6.0" + }, + { + "offset": 0, + "version": "v1.7.0" + }, + { + "offset": 0, + "version": "v1.7.1" + }, + { + "offset": 0, + "version": "v1.7.2" + }, + { + "offset": 0, + "version": "v1.7.3" + }, + { + "offset": 0, + "version": "v1.7.4" + }, + { + "offset": 0, + "version": "v1.7.5" + }, + { + "offset": 0, + "version": "v1.8.0" + }, + { + "offset": 0, + "version": "v1.8.2" + }, + { + "offset": 0, + "version": "v1.9.0" + }, + { + "offset": 0, + "version": "v1.9.1" + }, + { + "offset": 0, + "version": "v1.9.2" + }, + { + "offset": 0, + "version": "v1.10.0" + }, + { + "offset": 0, + "version": "v1.10.1" + }, + { + "offset": 0, + "version": "v1.11.0" + }, + { + "offset": 0, + "version": "v1.11.1" + }, + { + "offset": 0, + "version": "v1.11.2" + }, + { + "offset": 0, + "version": "v1.11.3" + }, + { + "offset": 0, + "version": "v1.12.0" + }, + { + "offset": 0, + "version": "v1.12.1" + }, + { + "offset": 0, + "version": "v1.12.2" + }, + { + "offset": 0, + "version": "v1.13.0" + }, + { + "offset": 0, + "version": "v1.14.0" + }, + { + "offset": 0, + "version": "v1.15.0" + }, + { + "offset": 0, + "version": "v1.16.0" + }, + { + "offset": 0, + "version": "v1.17.0" + }, + { + "offset": 0, + "version": "v1.18.0" + }, + { + "offset": 0, + "version": "v1.18.1" + }, + { + "offset": 0, + "version": "v1.19.0" + }, + { + "offset": 0, + "version": "v1.19.1" + }, + { + "offset": 0, + "version": "v1.20.0" + }, + { + "offset": 0, + "version": "v1.20.1" + }, + { + "offset": 0, + "version": "v1.21.0" + }, + { + "offset": 0, + "version": "v1.21.1" + }, + { + "offset": 0, + "version": "v1.21.2" + }, + { + "offset": 0, + "version": "v1.21.3" + }, + { + "offset": 0, + "version": "v1.21.4" + }, + { + "offset": 0, + "version": "v1.22.0" + }, + { + "offset": 0, + "version": "v1.22.1" + }, + { + "offset": 0, + "version": "v1.22.2" + }, + { + "offset": 0, + "version": "v1.22.3" + }, + { + "offset": 0, + "version": "v1.23.0" + }, + { + "offset": 0, + "version": "v1.23.1" + }, + { + "offset": 0, + "version": "v1.24.0" + }, + { + "offset": 0, + "version": "v1.25.0" + }, + { + "offset": 0, + "version": "v1.25.1" + }, + { + "offset": 0, + "version": "v1.26.0" + }, + { + "offset": 0, + "version": "v1.27.0-pre" + }, + { + "offset": 0, + "version": "v1.27.0" + }, + { + "offset": 0, + "version": "v1.27.1" + }, + { + "offset": 0, + "version": "v1.28.0-pre" + }, + { + "offset": 0, + "version": "v1.28.0" + }, + { + "offset": 0, + "version": "v1.28.1" + }, + { + "offset": 0, + "version": "v1.29.0-dev" + }, + { + "offset": 0, + "version": "v1.29.0" + }, + { + "offset": 0, + "version": "v1.29.1" + }, + { + "offset": 0, + "version": "v1.30.0-dev" + }, + { + "offset": 0, + "version": "v1.30.0-dev.1" + }, + { + "offset": 0, + "version": "v1.30.0" + }, + { + "offset": 0, + "version": "v1.30.1" + }, + { + "offset": 0, + "version": "v1.31.0-dev" + }, + { + "offset": 0, + "version": "v1.31.0" + }, + { + "offset": 0, + "version": "v1.31.1" + }, + { + "offset": 0, + "version": "v1.32.0-dev" + }, + { + "offset": 0, + "version": "v1.32.0" + }, + { + "offset": 0, + "version": "v1.33.0-dev" + }, + { + "offset": 0, + "version": "v1.33.0" + }, + { + "offset": 0, + "version": "v1.33.1" + }, + { + "offset": 0, + "version": "v1.33.2" + }, + { + "offset": 0, + "version": "v1.33.3" + }, + { + "offset": 0, + "version": "v1.34.0-dev" + }, + { + "offset": 0, + "version": "v1.34.0" + }, + { + "offset": 0, + "version": "v1.34.1" + }, + { + "offset": 0, + "version": "v1.34.2" + }, + { + "offset": 0, + "version": "v1.35.0-dev" + }, + { + "offset": 0, + "version": "v1.35.0" + }, + { + "offset": 0, + "version": "v1.35.1" + }, + { + "offset": 0, + "version": "v1.36.0-dev" + }, + { + "offset": 0, + "version": "v1.36.0" + }, + { + "offset": 0, + "version": "v1.36.1" + }, + { + "offset": 0, + "version": "v1.37.0-dev" + }, + { + "offset": 0, + "version": "v1.37.0" + }, + { + "offset": 0, + "version": "v1.37.1" + }, + { + "offset": 0, + "version": "v1.38.0-dev" + }, + { + "offset": 0, + "version": "v1.38.0" + }, + { + "offset": 0, + "version": "v1.38.1" + }, + { + "offset": 0, + "version": "v1.39.0-dev" + }, + { + "offset": 0, + "version": "v1.39.0" + }, + { + "offset": 0, + "version": "v1.39.1" + }, + { + "offset": 0, + "version": "v1.40.0-dev" + }, + { + "offset": 0, + "version": "v1.40.0" + }, + { + "offset": 0, + "version": "v1.40.1" + }, + { + "offset": 0, + "version": "v1.41.0-dev" + }, + { + "offset": 0, + "version": "v1.41.0" + }, + { + "offset": 0, + "version": "v1.41.1" + }, + { + "offset": 0, + "version": "v1.42.0-dev" + }, + { + "offset": 0, + "version": "v1.42.0" + }, + { + "offset": 0, + "version": "v1.43.0-dev" + }, + { + "offset": 0, + "version": "v1.43.0" + }, + { + "offset": 0, + "version": "v1.44.0-dev" + }, + { + "offset": 0, + "version": "v1.44.0" + }, + { + "offset": 0, + "version": "v1.45.0-dev" + }, + { + "offset": 0, + "version": "v1.45.0" + }, + { + "offset": 0, + "version": "v1.46.0-dev" + }, + { + "offset": 0, + "version": "v1.46.0" + }, + { + "offset": 0, + "version": "v1.46.1" + }, + { + "offset": 0, + "version": "v1.46.2" + }, + { + "offset": 0, + "version": "v1.47.0-dev" + }, + { + "offset": 0, + "version": "v1.47.0" + }, + { + "offset": 0, + "version": "v1.48.0-dev" + }, + { + "offset": 0, + "version": "v1.48.0" + }, + { + "offset": 0, + "version": "v1.49.0-dev" + }, + { + "offset": 0, + "version": "v1.49.0" + }, + { + "offset": 0, + "version": "v1.50.0-dev" + } + ] + } + ] + } + ] +} \ No newline at end of file diff --git a/pkg/instrumentors/allocator/allocator_linux.go b/pkg/instrumentors/allocator/allocator_linux.go new file mode 100644 index 000000000..16cdfa7af --- /dev/null +++ b/pkg/instrumentors/allocator/allocator_linux.go @@ -0,0 +1,58 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package allocator + +import ( + "os" + + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/bpffs" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/context" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" + "golang.org/x/sys/unix" +) + +type Allocator struct{} + +func New() *Allocator { + return &Allocator{} +} + +func (a *Allocator) Load(ctx *context.InstrumentorContext) error { + logger := log.Logger.WithName("allocator") + logger.V(0).Info("Loading allocator", "start_addr", + ctx.TargetDetails.AllocationDetails.Addr, "end_addr", ctx.TargetDetails.AllocationDetails.EndAddr) + + err := a.mountBpfFS() + if err != nil { + return err + } + + return nil +} + +func (a *Allocator) mountBpfFS() error { + _, err := os.Stat(bpffs.BpfFsPath) + if err != nil { + if os.IsNotExist(err) { + if err := os.MkdirAll(bpffs.BpfFsPath, 0755); err != nil { + return err + } + } else { + return err + } + } + + return unix.Mount(bpffs.BpfFsPath, bpffs.BpfFsPath, "bpf", 0, "") +} diff --git a/pkg/instrumentors/api.go b/pkg/instrumentors/api.go new file mode 100644 index 000000000..cc826db7b --- /dev/null +++ b/pkg/instrumentors/api.go @@ -0,0 +1,28 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package instrumentors + +import ( + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/context" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/events" +) + +type Instrumentor interface { + LibraryName() string + FuncNames() []string + Load(ctx *context.InstrumentorContext) error + Run(eventsChan chan<- *events.Event) + Close() +} diff --git a/pkg/instrumentors/bpf/github.com/gorilla/mux/bpf/probe.bpf.c b/pkg/instrumentors/bpf/github.com/gorilla/mux/bpf/probe.bpf.c new file mode 100644 index 000000000..ff47baeaf --- /dev/null +++ b/pkg/instrumentors/bpf/github.com/gorilla/mux/bpf/probe.bpf.c @@ -0,0 +1,106 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include "arguments.h" +#include "span_context.h" +#include "go_context.h" + +char __license[] SEC("license") = "Dual MIT/GPL"; + +#define MAX_SIZE 100 +#define MAX_CONCURRENT 50 + +struct http_request_t { + u64 start_time; + u64 end_time; + char method[MAX_SIZE]; + char path[MAX_SIZE]; + struct span_context sc; +}; + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __type(key, void*); + __type(value, struct http_request_t); + __uint(max_entries, MAX_CONCURRENT); +} context_to_http_events SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); +} events SEC(".maps"); + +// Injected in init +volatile const u64 method_ptr_pos; +volatile const u64 url_ptr_pos; +volatile const u64 path_ptr_pos; +volatile const u64 ctx_ptr_pos; + +// This instrumentation attaches uprobe to the following function: +// func (mux *ServeMux) ServeHTTP(w ResponseWriter, r *Request) +SEC("uprobe/GorillaMux_ServeHTTP") +int uprobe_GorillaMux_ServeHTTP(struct pt_regs *ctx) { + u64 request_pos = 4; + struct http_request_t httpReq = {}; + httpReq.start_time = bpf_ktime_get_boot_ns(); + + // Get request struct + void* req_ptr = get_argument(ctx, request_pos); + + // Get method from request + void* method_ptr = 0; + bpf_probe_read(&method_ptr, sizeof(method_ptr), (void *)(req_ptr+method_ptr_pos)); + u64 method_len = 0; + bpf_probe_read(&method_len, sizeof(method_len), (void *)(req_ptr+(method_ptr_pos+8))); + u64 method_size = sizeof(httpReq.method); + method_size = method_size < method_len ? method_size : method_len; + bpf_probe_read(&httpReq.method, method_size, method_ptr); + + // get path from Request.URL + void *url_ptr = 0; + bpf_probe_read(&url_ptr, sizeof(url_ptr), (void *)(req_ptr+url_ptr_pos)); + void* path_ptr = 0; + bpf_probe_read(&path_ptr, sizeof(path_ptr), (void *)(url_ptr+path_ptr_pos)); + u64 path_len = 0; + bpf_probe_read(&path_len, sizeof(path_len), (void *)(url_ptr+(path_ptr_pos+8))); + u64 path_size = sizeof(httpReq.path); + path_size = path_size < path_len ? path_size : path_len; + bpf_probe_read(&httpReq.path, path_size, path_ptr); + + // Get Request.ctx + void *ctx_iface = 0; + bpf_probe_read(&ctx_iface, sizeof(ctx_iface), (void *)(req_ptr+ctx_ptr_pos+8)); + + // Write event + httpReq.sc = generate_span_context(); + bpf_map_update_elem(&context_to_http_events, &ctx_iface, &httpReq, 0); + long res = bpf_map_update_elem(&spans_in_progress, &ctx_iface, &httpReq.sc, 0); + return 0; +} + +SEC("uprobe/GorillaMux_ServeHTTP") +int uprobe_GorillaMux_ServeHTTP_Returns(struct pt_regs *ctx) { + u64 request_pos = 4; + void* req_ptr = get_argument(ctx, request_pos); + void *ctx_iface = 0; + bpf_probe_read(&ctx_iface, sizeof(ctx_iface), (void *)(req_ptr+ctx_ptr_pos+8)); + + void* httpReq_ptr = bpf_map_lookup_elem(&context_to_http_events, &ctx_iface); + struct http_request_t httpReq = {}; + bpf_probe_read(&httpReq, sizeof(httpReq), httpReq_ptr); + httpReq.end_time = bpf_ktime_get_boot_ns(); + bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &httpReq, sizeof(httpReq)); + bpf_map_delete_elem(&context_to_http_events, &ctx_iface); + bpf_map_delete_elem(&spans_in_progress, &ctx_iface); + return 0; +} \ No newline at end of file diff --git a/pkg/instrumentors/bpf/github.com/gorilla/mux/probe.go b/pkg/instrumentors/bpf/github.com/gorilla/mux/probe.go new file mode 100644 index 000000000..0a6149230 --- /dev/null +++ b/pkg/instrumentors/bpf/github.com/gorilla/mux/probe.go @@ -0,0 +1,210 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package mux + +import ( + "bytes" + "encoding/binary" + "errors" + "os" + + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/bpffs" + + "github.com/cilium/ebpf" + "github.com/cilium/ebpf/link" + "github.com/cilium/ebpf/perf" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/inject" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/context" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/events" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" + "go.opentelemetry.io/otel/attribute" + semconv "go.opentelemetry.io/otel/semconv/v1.7.0" + "go.opentelemetry.io/otel/trace" + "golang.org/x/sys/unix" +) + +//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -target bpfel -cc clang -cflags $CFLAGS bpf ./bpf/probe.bpf.c + +type HttpEvent struct { + StartTime uint64 + EndTime uint64 + Method [100]byte + Path [100]byte + SpanContext context.EbpfSpanContext +} + +type gorillaMuxInstrumentor struct { + bpfObjects *bpfObjects + uprobe link.Link + returnProbs []link.Link + eventsReader *perf.Reader +} + +func New() *gorillaMuxInstrumentor { + return &gorillaMuxInstrumentor{} +} + +func (g *gorillaMuxInstrumentor) LibraryName() string { + return "github.com/gorilla/mux" +} + +func (g *gorillaMuxInstrumentor) FuncNames() []string { + return []string{"github.com/gorilla/mux.(*Router).ServeHTTP"} +} + +func (g *gorillaMuxInstrumentor) Load(ctx *context.InstrumentorContext) error { + spec, err := ctx.Injector.Inject(loadBpf, "go", ctx.TargetDetails.GoVersion.Original(), []*inject.InjectStructField{ + { + VarName: "method_ptr_pos", + StructName: "net/http.Request", + Field: "Method", + }, + { + VarName: "url_ptr_pos", + StructName: "net/http.Request", + Field: "URL", + }, + { + VarName: "ctx_ptr_pos", + StructName: "net/http.Request", + Field: "ctx", + }, + { + VarName: "path_ptr_pos", + StructName: "net/url.URL", + Field: "Path", + }, + }, false) + + if err != nil { + return err + } + + g.bpfObjects = &bpfObjects{} + err = spec.LoadAndAssign(g.bpfObjects, &ebpf.CollectionOptions{ + Maps: ebpf.MapOptions{ + PinPath: bpffs.BpfFsPath, + }, + }) + if err != nil { + return err + } + + offset, err := ctx.TargetDetails.GetFunctionOffset(g.FuncNames()[0]) + if err != nil { + return err + } + + up, err := ctx.Executable.Uprobe("", g.bpfObjects.UprobeGorillaMuxServeHTTP, &link.UprobeOptions{ + Offset: offset, + }) + if err != nil { + return err + } + + g.uprobe = up + retOffsets, err := ctx.TargetDetails.GetFunctionReturns(g.FuncNames()[0]) + if err != nil { + return err + } + + for _, ret := range retOffsets { + retProbe, err := ctx.Executable.Uprobe("", g.bpfObjects.UprobeGorillaMuxServeHTTP_Returns, &link.UprobeOptions{ + Offset: ret, + }) + if err != nil { + return err + } + g.returnProbs = append(g.returnProbs, retProbe) + } + + rd, err := perf.NewReader(g.bpfObjects.Events, os.Getpagesize()) + if err != nil { + return err + } + g.eventsReader = rd + + return nil +} + +func (g *gorillaMuxInstrumentor) Run(eventsChan chan<- *events.Event) { + logger := log.Logger.WithName("gorilla/mux-instrumentor") + var event HttpEvent + for { + record, err := g.eventsReader.Read() + if err != nil { + if errors.Is(err, perf.ErrClosed) { + return + } + logger.Error(err, "error reading from perf reader") + continue + } + + if record.LostSamples != 0 { + logger.V(0).Info("perf event ring buffer full", "dropped", record.LostSamples) + continue + } + + if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.LittleEndian, &event); err != nil { + logger.Error(err, "error parsing perf event") + continue + } + + eventsChan <- g.convertEvent(&event) + } +} + +func (g *gorillaMuxInstrumentor) convertEvent(e *HttpEvent) *events.Event { + method := unix.ByteSliceToString(e.Method[:]) + path := unix.ByteSliceToString(e.Path[:]) + + sc := trace.NewSpanContext(trace.SpanContextConfig{ + TraceID: e.SpanContext.TraceID, + SpanID: e.SpanContext.SpanID, + TraceFlags: trace.FlagsSampled, + }) + + return &events.Event{ + Library: g.LibraryName(), + Name: path, + Kind: trace.SpanKindServer, + StartTime: int64(e.StartTime), + EndTime: int64(e.EndTime), + SpanContext: &sc, + Attributes: []attribute.KeyValue{ + semconv.HTTPMethodKey.String(method), + semconv.HTTPTargetKey.String(path), + }, + } +} + +func (g *gorillaMuxInstrumentor) Close() { + log.Logger.V(0).Info("closing gorilla/mux instrumentor") + if g.eventsReader != nil { + g.eventsReader.Close() + } + + if g.uprobe != nil { + g.uprobe.Close() + } + + for _, r := range g.returnProbs { + r.Close() + } + + if g.bpfObjects != nil { + g.bpfObjects.Close() + } +} diff --git a/pkg/instrumentors/bpf/google/golang/org/grpc/bpf/probe.bpf.c b/pkg/instrumentors/bpf/google/golang/org/grpc/bpf/probe.bpf.c new file mode 100644 index 000000000..3d3e5b38a --- /dev/null +++ b/pkg/instrumentors/bpf/google/golang/org/grpc/bpf/probe.bpf.c @@ -0,0 +1,190 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include "arguments.h" +#include "go_types.h" +#include "span_context.h" +#include "go_context.h" + +char __license[] SEC("license") = "Dual MIT/GPL"; + +#define MAX_SIZE 50 +#define MAX_CONCURRENT 50 +#define MAX_HEADERS_BUFF_SIZE 500 + +struct grpc_request_t +{ + u64 start_time; + u64 end_time; + char method[MAX_SIZE]; + char target[MAX_SIZE]; + struct span_context sc; + struct span_context psc; +}; + +struct hpack_header_field +{ + struct go_string name; + struct go_string value; + bool sensitive; +}; + +struct +{ + __uint(type, BPF_MAP_TYPE_HASH); + __type(key, void *); + __type(value, struct grpc_request_t); + __uint(max_entries, MAX_CONCURRENT); +} context_to_grpc_events SEC(".maps"); + +struct headers_buff +{ + unsigned char buff[MAX_HEADERS_BUFF_SIZE]; +}; + +struct +{ + __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); + __type(key, s32); + __type(value, struct headers_buff); + __uint(max_entries, 1); +} headers_buff_map SEC(".maps"); + +struct +{ + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); +} events SEC(".maps"); + +// Injected in init +volatile const u64 clientconn_target_ptr_pos; + +// This instrumentation attaches uprobe to the following function: +// func (cc *ClientConn) Invoke(ctx context.Context, method string, args, reply interface{}, opts ...CallOption) error +SEC("uprobe/ClientConn_Invoke") +int uprobe_ClientConn_Invoke(struct pt_regs *ctx) +{ + // positions + u64 clientconn_pos = 1; + u64 context_pos = 3; + u64 method_ptr_pos = 4; + u64 method_len_pos = 5; + + struct grpc_request_t grpcReq = {}; + grpcReq.start_time = bpf_ktime_get_boot_ns(); + + // Read Method + void *method_ptr = get_argument(ctx, method_ptr_pos); + u64 method_len = (u64)get_argument(ctx, method_len_pos); + u64 method_size = sizeof(grpcReq.method); + method_size = method_size < method_len ? method_size : method_len; + bpf_probe_read(&grpcReq.method, method_size, method_ptr); + + // Read ClientConn.Target + void *clientconn_ptr = get_argument(ctx, clientconn_pos); + void *target_ptr = 0; + bpf_probe_read(&target_ptr, sizeof(target_ptr), (void *)(clientconn_ptr + (clientconn_target_ptr_pos))); + u64 target_len = 0; + bpf_probe_read(&target_len, sizeof(target_len), (void *)(clientconn_ptr + (clientconn_target_ptr_pos + 8))); + u64 target_size = sizeof(grpcReq.target); + target_size = target_size < target_len ? target_size : target_len; + bpf_probe_read(&grpcReq.target, target_size, target_ptr); + + // Write event + void *context_ptr = get_argument(ctx, context_pos); + bpf_map_update_elem(&context_to_grpc_events, &context_ptr, &grpcReq, 0); + return 0; +} + +SEC("uprobe/ClientConn_Invoke") +int uprobe_ClientConn_Invoke_Returns(struct pt_regs *ctx) +{ + u64 context_pos = 3; + void *context_ptr = get_argument(ctx, context_pos); + void *grpcReq_ptr = bpf_map_lookup_elem(&context_to_grpc_events, &context_ptr); + struct grpc_request_t grpcReq = {}; + bpf_probe_read(&grpcReq, sizeof(grpcReq), grpcReq_ptr); + + grpcReq.end_time = bpf_ktime_get_boot_ns(); + bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &grpcReq, sizeof(grpcReq)); + bpf_map_delete_elem(&context_to_grpc_events, &context_ptr); + + return 0; +} + +// func (t *http2Client) createHeaderFields(ctx context.Context, callHdr *CallHdr) ([]hpack.HeaderField, error) +SEC("uprobe/Http2Client_createHeaderFields") +int uprobe_Http2Client_CreateHeaderFields(struct pt_regs *ctx) +{ + // Read slice + s32 context_pointer_pos = 3; + struct go_slice slice = {}; + struct go_slice_user_ptr slice_user_ptr = {}; + if (is_registers_abi) + { + slice.array = (void *)ctx->rax; + slice.len = (s32)ctx->rbx; + slice.cap = (s32)ctx->rcx; + slice_user_ptr.array = &ctx->rax; + slice_user_ptr.len = &ctx->rbx; + slice_user_ptr.cap = &ctx->rcx; + } + else + { + u64 slice_pointer_pos = 5; + s32 slice_len_pos = 6; + s32 slice_cap_pos = 7; + slice.array = get_argument(ctx, slice_pointer_pos); + slice.len = (s32)get_argument(ctx, slice_len_pos); + slice.cap = (s32)get_argument(ctx, slice_cap_pos); + slice_user_ptr.array = (void *)ctx->rsp + (slice_pointer_pos * 8); + slice_user_ptr.len = (void *)ctx->rsp + (slice_len_pos * 8); + slice_user_ptr.cap = (void *)ctx->rsp + (slice_cap_pos * 8); + } + char key[11] = "traceparent"; + struct go_string key_str = write_user_go_string(key, sizeof(key)); + + // Get grpc request struct + void *context_ptr = 0; + bpf_probe_read(&context_ptr, sizeof(context_ptr), (void *)(ctx->rsp + (context_pointer_pos * 8))); + void *parent_ctx = find_context_in_map(context_ptr, &context_to_grpc_events); + void *grpcReq_ptr = bpf_map_lookup_elem(&context_to_grpc_events, &parent_ctx); + struct grpc_request_t grpcReq = {}; + bpf_probe_read(&grpcReq, sizeof(grpcReq), grpcReq_ptr); + + // Get parent if exists + void *parent_span_ctx = find_context_in_map(context_ptr, &spans_in_progress); + if (parent_span_ctx != NULL) + { + void *psc_ptr = bpf_map_lookup_elem(&spans_in_progress, &parent_span_ctx); + bpf_probe_read(&grpcReq.psc, sizeof(grpcReq.psc), psc_ptr); + copy_byte_arrays(grpcReq.psc.TraceID, grpcReq.sc.TraceID, TRACE_ID_SIZE); + generate_random_bytes(grpcReq.sc.SpanID, SPAN_ID_SIZE); + } + else + { + grpcReq.sc = generate_span_context(); + } + + // Write headers + char val[SPAN_CONTEXT_STRING_SIZE]; + span_context_to_w3c_string(&grpcReq.sc, val); + struct go_string val_str = write_user_go_string(val, sizeof(val)); + struct hpack_header_field hf = {}; + hf.name = key_str; + hf.value = val_str; + append_item_to_slice(&slice, &hf, sizeof(hf), &slice_user_ptr, &headers_buff_map); + bpf_map_update_elem(&context_to_grpc_events, &parent_ctx, &grpcReq, 0); + + return 0; +} \ No newline at end of file diff --git a/pkg/instrumentors/bpf/google/golang/org/grpc/probe.go b/pkg/instrumentors/bpf/google/golang/org/grpc/probe.go new file mode 100644 index 000000000..caa45593d --- /dev/null +++ b/pkg/instrumentors/bpf/google/golang/org/grpc/probe.go @@ -0,0 +1,248 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package grpc + +import ( + "bytes" + "encoding/binary" + "errors" + "os" + "strings" + + "github.com/cilium/ebpf" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/bpffs" + + "github.com/cilium/ebpf/link" + "github.com/cilium/ebpf/perf" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/inject" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/context" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/events" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" + "go.opentelemetry.io/otel/attribute" + semconv "go.opentelemetry.io/otel/semconv/v1.4.0" + "go.opentelemetry.io/otel/trace" + "golang.org/x/sys/unix" +) + +//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -target bpfel -cc clang -cflags $CFLAGS bpf ./bpf/probe.bpf.c + +type GrpcEvent struct { + StartTime uint64 + EndTime uint64 + Method [50]byte + Target [50]byte + SpanContext context.EbpfSpanContext + ParentSpanContext context.EbpfSpanContext +} + +type grpcInstrumentor struct { + bpfObjects *bpfObjects + uprobe link.Link + returnProbs []link.Link + writeHeadersProbe []link.Link + eventsReader *perf.Reader +} + +func New() *grpcInstrumentor { + return &grpcInstrumentor{} +} + +func (g *grpcInstrumentor) LibraryName() string { + return "google.golang.org/grpc" +} + +func (g *grpcInstrumentor) FuncNames() []string { + return []string{"google.golang.org/grpc.(*ClientConn).Invoke", + "google.golang.org/grpc/internal/transport.(*http2Client).createHeaderFields"} +} + +func (g *grpcInstrumentor) Load(ctx *context.InstrumentorContext) error { + libVersion, exists := ctx.TargetDetails.Libraries[g.LibraryName()] + if !exists { + libVersion = "" + } + spec, err := ctx.Injector.Inject(loadBpf, g.LibraryName(), libVersion, []*inject.InjectStructField{ + { + VarName: "clientconn_target_ptr_pos", + StructName: "google.golang.org/grpc.ClientConn", + Field: "target", + }, + }, true) + + if err != nil { + return err + } + + g.bpfObjects = &bpfObjects{} + err = spec.LoadAndAssign(g.bpfObjects, &ebpf.CollectionOptions{ + Maps: ebpf.MapOptions{ + PinPath: bpffs.BpfFsPath, + }, + }) + if err != nil { + return err + } + + offset, err := ctx.TargetDetails.GetFunctionOffset(g.FuncNames()[0]) + if err != nil { + return err + } + + up, err := ctx.Executable.Uprobe("", g.bpfObjects.UprobeClientConnInvoke, &link.UprobeOptions{ + Offset: offset, + }) + if err != nil { + return err + } + + g.uprobe = up + retOffsets, err := ctx.TargetDetails.GetFunctionReturns(g.FuncNames()[0]) + if err != nil { + return err + } + + for _, ret := range retOffsets { + retProbe, err := ctx.Executable.Uprobe("", g.bpfObjects.UprobeClientConnInvokeReturns, &link.UprobeOptions{ + Offset: ret, + }) + if err != nil { + return err + } + g.returnProbs = append(g.returnProbs, retProbe) + } + + rd, err := perf.NewReader(g.bpfObjects.Events, os.Getpagesize()) + if err != nil { + return err + } + g.eventsReader = rd + + // Write headers probe + whOffsets, err := ctx.TargetDetails.GetFunctionReturns(g.FuncNames()[1]) + if err != nil { + return err + } + for _, whOffset := range whOffsets { + whProbe, err := ctx.Executable.Uprobe("", g.bpfObjects.UprobeHttp2ClientCreateHeaderFields, &link.UprobeOptions{ + Offset: whOffset, + }) + if err != nil { + return err + } + + g.writeHeadersProbe = append(g.writeHeadersProbe, whProbe) + } + + return nil +} + +func (g *grpcInstrumentor) Run(eventsChan chan<- *events.Event) { + logger := log.Logger.WithName("grpc-instrumentor") + var event GrpcEvent + for { + record, err := g.eventsReader.Read() + if err != nil { + if errors.Is(err, perf.ErrClosed) { + return + } + logger.Error(err, "error reading from perf reader") + continue + } + + if record.LostSamples != 0 { + logger.V(0).Info("perf event ring buffer full", "dropped", record.LostSamples) + continue + } + + if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.LittleEndian, &event); err != nil { + logger.Error(err, "error parsing perf event") + continue + } + + eventsChan <- g.convertEvent(&event) + } +} + +// According to https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/trace/semantic_conventions/rpc.md +func (g *grpcInstrumentor) convertEvent(e *GrpcEvent) *events.Event { + method := unix.ByteSliceToString(e.Method[:]) + target := unix.ByteSliceToString(e.Target[:]) + var attrs []attribute.KeyValue + + // remove port + if parts := strings.Split(target, ":"); len(parts) > 1 { + target = parts[0] + attrs = append(attrs, semconv.NetPeerPortKey.String(parts[1])) + } + + attrs = append(attrs, semconv.RPCSystemKey.String("grpc"), + semconv.RPCServiceKey.String(method), + semconv.NetPeerIPKey.String(target), + semconv.NetPeerNameKey.String(target)) + + sc := trace.NewSpanContext(trace.SpanContextConfig{ + TraceID: e.SpanContext.TraceID, + SpanID: e.SpanContext.SpanID, + TraceFlags: trace.FlagsSampled, + }) + + var pscPtr *trace.SpanContext + if e.ParentSpanContext.TraceID.IsValid() { + psc := trace.NewSpanContext(trace.SpanContextConfig{ + TraceID: e.ParentSpanContext.TraceID, + SpanID: e.ParentSpanContext.SpanID, + TraceFlags: trace.FlagsSampled, + Remote: true, + }) + pscPtr = &psc + } else { + pscPtr = nil + } + + log.Logger.V(0).Info("got spancontext", "trace_id", e.SpanContext.TraceID.String(), "span_id", e.SpanContext.SpanID.String()) + return &events.Event{ + Library: g.LibraryName(), + Name: method, + Kind: trace.SpanKindClient, + StartTime: int64(e.StartTime), + EndTime: int64(e.EndTime), + Attributes: attrs, + SpanContext: &sc, + ParentSpanContext: pscPtr, + } +} + +func (g *grpcInstrumentor) Close() { + log.Logger.V(0).Info("closing gRPC instrumentor") + if g.eventsReader != nil { + g.eventsReader.Close() + } + + if g.uprobe != nil { + g.uprobe.Close() + } + + for _, r := range g.returnProbs { + r.Close() + } + + for _, r := range g.writeHeadersProbe { + r.Close() + } + + if g.bpfObjects != nil { + g.bpfObjects.Close() + } +} diff --git a/pkg/instrumentors/bpf/google/golang/org/grpc/server/bpf/probe.bpf.c b/pkg/instrumentors/bpf/google/golang/org/grpc/server/bpf/probe.bpf.c new file mode 100644 index 000000000..a63cc2ed2 --- /dev/null +++ b/pkg/instrumentors/bpf/google/golang/org/grpc/server/bpf/probe.bpf.c @@ -0,0 +1,219 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include "arguments.h" +#include "go_types.h" +#include "span_context.h" + +char __license[] SEC("license") = "Dual MIT/GPL"; + +#define MAX_SIZE 100 +#define MAX_CONCURRENT 50 +#define MAX_HEADERS 20 +#define MAX_HEADER_STRING 50 +#define W3C_KEY_LENGTH 11 +#define W3C_VAL_LENGTH 55 + +struct grpc_request_t +{ + u64 start_time; + u64 end_time; + char method[MAX_SIZE]; + struct span_context sc; + struct span_context psc; +}; + +struct +{ + __uint(type, BPF_MAP_TYPE_HASH); + __type(key, void *); + __type(value, struct grpc_request_t); + __uint(max_entries, MAX_CONCURRENT); +} context_to_grpc_events SEC(".maps"); + +struct +{ + __uint(type, BPF_MAP_TYPE_HASH); + __type(key, u32); + __type(value, struct grpc_request_t); + __uint(max_entries, MAX_CONCURRENT); +} streamid_to_grpc_events SEC(".maps"); + +struct +{ + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); +} events SEC(".maps"); + +struct hpack_header_field +{ + struct go_string name; + struct go_string value; + bool sensitive; +}; + +// Injected in init +volatile const u64 stream_method_ptr_pos; +volatile const u64 frame_fields_pos; +volatile const u64 frame_stream_id_pod; +volatile const u64 stream_id_pos; +volatile const u64 stream_ctx_pos; + +// This instrumentation attaches uprobe to the following function: +// func (s *Server) handleStream(t transport.ServerTransport, stream *transport.Stream, trInfo *traceInfo) { +SEC("uprobe/server_handleStream") +int uprobe_server_handleStream(struct pt_regs *ctx) +{ + u64 stream_pos = 4; + void *stream_ptr = get_argument(ctx, stream_pos); + + // Get parent context if exists + u32 stream_id = 0; + bpf_probe_read(&stream_id, sizeof(stream_id), (void *)(stream_ptr + stream_id_pos)); + void *grpcReq_ptr = bpf_map_lookup_elem(&streamid_to_grpc_events, &stream_id); + struct grpc_request_t grpcReq = {}; + if (grpcReq_ptr != NULL) + { + bpf_probe_read(&grpcReq, sizeof(grpcReq), grpcReq_ptr); + bpf_map_delete_elem(&streamid_to_grpc_events, &stream_id); + copy_byte_arrays(grpcReq.psc.TraceID, grpcReq.sc.TraceID, TRACE_ID_SIZE); + generate_random_bytes(grpcReq.sc.SpanID, SPAN_ID_SIZE); + } + else + { + grpcReq.sc = generate_span_context(); + } + + // Set attributes + grpcReq.start_time = bpf_ktime_get_boot_ns(); + void *method_ptr = 0; + bpf_probe_read(&method_ptr, sizeof(method_ptr), (void *)(stream_ptr + stream_method_ptr_pos)); + u64 method_len = 0; + bpf_probe_read(&method_len, sizeof(method_len), (void *)(stream_ptr + (stream_method_ptr_pos + 8))); + u64 method_size = sizeof(grpcReq.method); + method_size = method_size < method_len ? method_size : method_len; + bpf_probe_read(&grpcReq.method, method_size, method_ptr); + + // Write event + void *ctx_iface = 0; + bpf_probe_read(&ctx_iface, sizeof(ctx_iface), (void *)(stream_ptr + stream_ctx_pos)); + void *ctx_instance = 0; + bpf_probe_read(&ctx_instance, sizeof(ctx_instance), (void *)(ctx_iface + 8)); + bpf_map_update_elem(&context_to_grpc_events, &ctx_instance, &grpcReq, 0); + bpf_map_update_elem(&spans_in_progress, &ctx_instance, &grpcReq.sc, 0); + return 0; +} + +SEC("uprobe/server_handleStream") +int uprobe_server_handleStream_ByRegisters(struct pt_regs *ctx) +{ + void *stream_ptr = (void *)(ctx->rdi); + + // Get parent context if exists + u32 stream_id = 0; + bpf_probe_read(&stream_id, sizeof(stream_id), (void *)(stream_ptr + stream_id_pos)); + void *grpcReq_ptr = bpf_map_lookup_elem(&streamid_to_grpc_events, &stream_id); + struct grpc_request_t grpcReq = {}; + if (grpcReq_ptr != NULL) + { + bpf_probe_read(&grpcReq, sizeof(grpcReq), grpcReq_ptr); + bpf_map_delete_elem(&streamid_to_grpc_events, &stream_id); + copy_byte_arrays(grpcReq.psc.TraceID, grpcReq.sc.TraceID, TRACE_ID_SIZE); + generate_random_bytes(grpcReq.sc.SpanID, SPAN_ID_SIZE); + } + else + { + grpcReq.sc = generate_span_context(); + } + + // Set attributes + grpcReq.start_time = bpf_ktime_get_boot_ns(); + void *method_ptr = 0; + bpf_probe_read(&method_ptr, sizeof(method_ptr), (void *)(stream_ptr + stream_method_ptr_pos)); + u64 method_len = 0; + bpf_probe_read(&method_len, sizeof(method_len), (void *)(stream_ptr + (stream_method_ptr_pos + 8))); + u64 method_size = sizeof(grpcReq.method); + method_size = method_size < method_len ? method_size : method_len; + bpf_probe_read(&grpcReq.method, method_size, method_ptr); + + // Write event + void *ctx_iface = 0; + bpf_probe_read(&ctx_iface, sizeof(ctx_iface), (void *)(stream_ptr + stream_ctx_pos)); + void *ctx_instance = 0; + bpf_probe_read(&ctx_instance, sizeof(ctx_instance), (void *)(ctx_iface + 8)); + bpf_map_update_elem(&context_to_grpc_events, &ctx_instance, &grpcReq, 0); + bpf_map_update_elem(&spans_in_progress, &ctx_instance, &grpcReq.sc, 0); + return 0; +} + +SEC("uprobe/server_handleStream") +int uprobe_server_handleStream_Returns(struct pt_regs *ctx) +{ + u64 stream_pos = 4; + void *stream_ptr = get_argument(ctx, stream_pos); + void *ctx_iface = 0; + bpf_probe_read(&ctx_iface, sizeof(ctx_iface), (void *)(stream_ptr + stream_ctx_pos)); + void *ctx_instance = 0; + bpf_probe_read(&ctx_instance, sizeof(ctx_instance), (void *)(ctx_iface + 8)); + + void *grpcReq_ptr = bpf_map_lookup_elem(&context_to_grpc_events, &ctx_instance); + struct grpc_request_t grpcReq = {}; + bpf_probe_read(&grpcReq, sizeof(grpcReq), grpcReq_ptr); + + grpcReq.end_time = bpf_ktime_get_boot_ns(); + bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &grpcReq, sizeof(grpcReq)); + bpf_map_delete_elem(&context_to_grpc_events, &ctx_instance); + bpf_map_delete_elem(&spans_in_progress, &ctx_instance); + return 0; +} + +// func (d *decodeState) decodeHeader(frame *http2.MetaHeadersFrame) error +SEC("uprobe/decodeState_decodeHeader") +int uprobe_decodeState_decodeHeader(struct pt_regs *ctx) +{ + u64 frame_pos = 2; + void *frame_ptr = get_argument(ctx, frame_pos); + struct go_slice header_fields = {}; + bpf_probe_read(&header_fields, sizeof(header_fields), (void *)(frame_ptr + frame_fields_pos)); + char key[W3C_KEY_LENGTH] = "traceparent"; + for (s32 i = 0; i < MAX_HEADERS; i++) + { + if (i >= header_fields.len) + { + break; + } + struct hpack_header_field hf = {}; + long res = bpf_probe_read(&hf, sizeof(hf), (void *)(header_fields.array + (i * sizeof(hf)))); + if (hf.name.len == W3C_KEY_LENGTH && hf.value.len == W3C_VAL_LENGTH) + { + char current_key[W3C_KEY_LENGTH]; + bpf_probe_read(current_key, sizeof(current_key), hf.name.str); + if (bpf_memcmp(key, current_key, sizeof(key))) + { + char val[W3C_VAL_LENGTH]; + bpf_probe_read(val, W3C_VAL_LENGTH, hf.value.str); + + // Get stream id + void *headers_frame = NULL; + bpf_probe_read(&headers_frame, sizeof(headers_frame), frame_ptr); + u32 stream_id = 0; + bpf_probe_read(&stream_id, sizeof(stream_id), (void *)(headers_frame + frame_stream_id_pod)); + struct grpc_request_t grpcReq = {}; + w3c_string_to_span_context(val, &grpcReq.psc); + bpf_map_update_elem(&streamid_to_grpc_events, &stream_id, &grpcReq, 0); + } + } + } + + return 0; +} \ No newline at end of file diff --git a/pkg/instrumentors/bpf/google/golang/org/grpc/server/probe.go b/pkg/instrumentors/bpf/google/golang/org/grpc/server/probe.go new file mode 100644 index 000000000..fba869b87 --- /dev/null +++ b/pkg/instrumentors/bpf/google/golang/org/grpc/server/probe.go @@ -0,0 +1,258 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package server + +import ( + "bytes" + "encoding/binary" + "errors" + "os" + + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/bpffs" + + "github.com/cilium/ebpf" + "github.com/cilium/ebpf/link" + "github.com/cilium/ebpf/perf" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/inject" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/context" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/events" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" + "go.opentelemetry.io/otel/attribute" + semconv "go.opentelemetry.io/otel/semconv/v1.7.0" + "go.opentelemetry.io/otel/trace" + "golang.org/x/sys/unix" +) + +//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -target bpfel -cc clang -cflags $CFLAGS bpf ./bpf/probe.bpf.c + +type GrpcEvent struct { + StartTime uint64 + EndTime uint64 + Method [100]byte + SpanContext context.EbpfSpanContext + ParentSpanContext context.EbpfSpanContext +} + +type grpcServerInstrumentor struct { + bpfObjects *bpfObjects + uprobe link.Link + returnProbs []link.Link + headersProbe link.Link + eventsReader *perf.Reader +} + +func New() *grpcServerInstrumentor { + return &grpcServerInstrumentor{} +} + +func (g *grpcServerInstrumentor) LibraryName() string { + return "google.golang.org/grpc/server" +} + +func (g *grpcServerInstrumentor) FuncNames() []string { + return []string{"google.golang.org/grpc.(*Server).handleStream", + "google.golang.org/grpc/internal/transport.(*decodeState).decodeHeader"} +} + +func (g *grpcServerInstrumentor) Load(ctx *context.InstrumentorContext) error { + targetLib := "google.golang.org/grpc" + libVersion, exists := ctx.TargetDetails.Libraries[targetLib] + if !exists { + libVersion = "" + } + spec, err := ctx.Injector.Inject(loadBpf, "google.golang.org/grpc", libVersion, []*inject.InjectStructField{ + { + VarName: "stream_method_ptr_pos", + StructName: "google.golang.org/grpc/internal/transport.Stream", + Field: "method", + }, + { + VarName: "stream_id_pos", + StructName: "google.golang.org/grpc/internal/transport.Stream", + Field: "id", + }, + { + VarName: "stream_ctx_pos", + StructName: "google.golang.org/grpc/internal/transport.Stream", + Field: "ctx", + }, + { + VarName: "frame_fields_pos", + StructName: "golang.org/x/net/http2.MetaHeadersFrame", + Field: "Fields", + }, + { + VarName: "frame_stream_id_pod", + StructName: "golang.org/x/net/http2.FrameHeader", + Field: "StreamID", + }, + }, true) + + if err != nil { + return err + } + + g.bpfObjects = &bpfObjects{} + err = spec.LoadAndAssign(g.bpfObjects, &ebpf.CollectionOptions{ + Maps: ebpf.MapOptions{ + PinPath: bpffs.BpfFsPath, + }, + }) + if err != nil { + return err + } + + offset, err := ctx.TargetDetails.GetFunctionOffset(g.FuncNames()[0]) + if err != nil { + return err + } + + var uprobeObj *ebpf.Program + if ctx.TargetDetails.IsRegistersABI() { + uprobeObj = g.bpfObjects.UprobeServerHandleStreamByRegisters + } else { + uprobeObj = g.bpfObjects.UprobeServerHandleStream + } + + up, err := ctx.Executable.Uprobe("", uprobeObj, &link.UprobeOptions{ + Offset: offset, + }) + if err != nil { + return err + } + + g.uprobe = up + retOffsets, err := ctx.TargetDetails.GetFunctionReturns(g.FuncNames()[0]) + if err != nil { + return err + } + + for _, ret := range retOffsets { + retProbe, err := ctx.Executable.Uprobe("", g.bpfObjects.UprobeServerHandleStreamReturns, &link.UprobeOptions{ + Offset: ret, + }) + if err != nil { + return err + } + g.returnProbs = append(g.returnProbs, retProbe) + } + + headerOffset, err := ctx.TargetDetails.GetFunctionOffset(g.FuncNames()[1]) + if err != nil { + return err + } + hProbe, err := ctx.Executable.Uprobe("", g.bpfObjects.UprobeDecodeStateDecodeHeader, &link.UprobeOptions{ + Offset: headerOffset, + }) + if err != nil { + return err + } + g.headersProbe = hProbe + + rd, err := perf.NewReader(g.bpfObjects.Events, os.Getpagesize()) + if err != nil { + return err + } + g.eventsReader = rd + + return nil +} + +func (g *grpcServerInstrumentor) Run(eventsChan chan<- *events.Event) { + logger := log.Logger.WithName("grpc-server-instrumentor") + var event GrpcEvent + for { + record, err := g.eventsReader.Read() + if err != nil { + if errors.Is(err, perf.ErrClosed) { + return + } + logger.Error(err, "error reading from perf reader") + continue + } + + if record.LostSamples != 0 { + logger.V(0).Info("perf event ring buffer full", "dropped", record.LostSamples) + continue + } + + if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.LittleEndian, &event); err != nil { + logger.Error(err, "error parsing perf event") + continue + } + + eventsChan <- g.convertEvent(&event) + } +} + +func (g *grpcServerInstrumentor) convertEvent(e *GrpcEvent) *events.Event { + method := unix.ByteSliceToString(e.Method[:]) + + sc := trace.NewSpanContext(trace.SpanContextConfig{ + TraceID: e.SpanContext.TraceID, + SpanID: e.SpanContext.SpanID, + TraceFlags: trace.FlagsSampled, + }) + + var pscPtr *trace.SpanContext + if e.ParentSpanContext.TraceID.IsValid() { + psc := trace.NewSpanContext(trace.SpanContextConfig{ + TraceID: e.ParentSpanContext.TraceID, + SpanID: e.ParentSpanContext.SpanID, + TraceFlags: trace.FlagsSampled, + Remote: true, + }) + pscPtr = &psc + } else { + pscPtr = nil + } + + return &events.Event{ + Library: g.LibraryName(), + Name: method, + Kind: trace.SpanKindServer, + StartTime: int64(e.StartTime), + EndTime: int64(e.EndTime), + Attributes: []attribute.KeyValue{ + semconv.RPCSystemKey.String("grpc"), + semconv.RPCServiceKey.String(method), + }, + ParentSpanContext: pscPtr, + SpanContext: &sc, + } +} + +func (g *grpcServerInstrumentor) Close() { + log.Logger.V(0).Info("closing gRPC server instrumentor") + if g.eventsReader != nil { + g.eventsReader.Close() + } + + if g.uprobe != nil { + g.uprobe.Close() + } + + for _, r := range g.returnProbs { + r.Close() + } + + if g.headersProbe != nil { + g.headersProbe.Close() + } + + if g.bpfObjects != nil { + g.bpfObjects.Close() + } +} diff --git a/pkg/instrumentors/bpf/net/http/server/bpf/probe.bpf.c b/pkg/instrumentors/bpf/net/http/server/bpf/probe.bpf.c new file mode 100644 index 000000000..d7617b97c --- /dev/null +++ b/pkg/instrumentors/bpf/net/http/server/bpf/probe.bpf.c @@ -0,0 +1,111 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include "arguments.h" +#include "span_context.h" +#include "go_context.h" + +char __license[] SEC("license") = "Dual MIT/GPL"; + +#define MAX_SIZE 100 +#define MAX_CONCURRENT 50 + +struct http_request_t +{ + u64 start_time; + u64 end_time; + char method[MAX_SIZE]; + char path[MAX_SIZE]; + struct span_context sc; +}; + +struct +{ + __uint(type, BPF_MAP_TYPE_HASH); + __type(key, void *); + __type(value, struct http_request_t); + __uint(max_entries, MAX_CONCURRENT); +} context_to_http_events SEC(".maps"); + +struct +{ + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); +} events SEC(".maps"); + +// Injected in init +volatile const u64 method_ptr_pos; +volatile const u64 url_ptr_pos; +volatile const u64 path_ptr_pos; +volatile const u64 ctx_ptr_pos; + +// This instrumentation attaches uprobe to the following function: +// func (mux *ServeMux) ServeHTTP(w ResponseWriter, r *Request) +SEC("uprobe/ServerMux_ServeHTTP") +int uprobe_ServerMux_ServeHTTP(struct pt_regs *ctx) +{ + u64 request_pos = 4; + struct http_request_t httpReq = {}; + httpReq.start_time = bpf_ktime_get_boot_ns(); + + // Get request struct + void *req_ptr = get_argument(ctx, request_pos); + + // Get method from request + void *method_ptr = 0; + bpf_probe_read(&method_ptr, sizeof(method_ptr), (void *)(req_ptr + method_ptr_pos)); + u64 method_len = 0; + bpf_probe_read(&method_len, sizeof(method_len), (void *)(req_ptr + (method_ptr_pos + 8))); + u64 method_size = sizeof(httpReq.method); + method_size = method_size < method_len ? method_size : method_len; + bpf_probe_read(&httpReq.method, method_size, method_ptr); + + // get path from Request.URL + void *url_ptr = 0; + bpf_probe_read(&url_ptr, sizeof(url_ptr), (void *)(req_ptr + url_ptr_pos)); + void *path_ptr = 0; + bpf_probe_read(&path_ptr, sizeof(path_ptr), (void *)(url_ptr + path_ptr_pos)); + u64 path_len = 0; + bpf_probe_read(&path_len, sizeof(path_len), (void *)(url_ptr + (path_ptr_pos + 8))); + u64 path_size = sizeof(httpReq.path); + path_size = path_size < path_len ? path_size : path_len; + bpf_probe_read(&httpReq.path, path_size, path_ptr); + + // Get Request.ctx + void *ctx_iface = 0; + bpf_probe_read(&ctx_iface, sizeof(ctx_iface), (void *)(req_ptr + ctx_ptr_pos + 8)); + + // Write event + httpReq.sc = generate_span_context(); + bpf_map_update_elem(&context_to_http_events, &ctx_iface, &httpReq, 0); + long res = bpf_map_update_elem(&spans_in_progress, &ctx_iface, &httpReq.sc, 0); + return 0; +} + +SEC("uprobe/ServerMux_ServeHTTP") +int uprobe_ServerMux_ServeHTTP_Returns(struct pt_regs *ctx) +{ + u64 request_pos = 4; + void *req_ptr = get_argument(ctx, request_pos); + void *ctx_iface = 0; + bpf_probe_read(&ctx_iface, sizeof(ctx_iface), (void *)(req_ptr + ctx_ptr_pos + 8)); + + void *httpReq_ptr = bpf_map_lookup_elem(&context_to_http_events, &ctx_iface); + struct http_request_t httpReq = {}; + bpf_probe_read(&httpReq, sizeof(httpReq), httpReq_ptr); + httpReq.end_time = bpf_ktime_get_boot_ns(); + bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &httpReq, sizeof(httpReq)); + bpf_map_delete_elem(&context_to_http_events, &ctx_iface); + bpf_map_delete_elem(&spans_in_progress, &ctx_iface); + return 0; +} \ No newline at end of file diff --git a/pkg/instrumentors/bpf/net/http/server/probe.go b/pkg/instrumentors/bpf/net/http/server/probe.go new file mode 100644 index 000000000..847cde639 --- /dev/null +++ b/pkg/instrumentors/bpf/net/http/server/probe.go @@ -0,0 +1,210 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package server + +import ( + "bytes" + "encoding/binary" + "errors" + "os" + + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/bpffs" + + "github.com/cilium/ebpf" + "github.com/cilium/ebpf/link" + "github.com/cilium/ebpf/perf" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/inject" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/context" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/events" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" + "go.opentelemetry.io/otel/attribute" + semconv "go.opentelemetry.io/otel/semconv/v1.7.0" + "go.opentelemetry.io/otel/trace" + "golang.org/x/sys/unix" +) + +//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -target bpfel -cc clang -cflags $CFLAGS bpf ./bpf/probe.bpf.c + +type HttpEvent struct { + StartTime uint64 + EndTime uint64 + Method [100]byte + Path [100]byte + SpanContext context.EbpfSpanContext +} + +type httpServerInstrumentor struct { + bpfObjects *bpfObjects + uprobe link.Link + returnProbs []link.Link + eventsReader *perf.Reader +} + +func New() *httpServerInstrumentor { + return &httpServerInstrumentor{} +} + +func (h *httpServerInstrumentor) LibraryName() string { + return "net/http" +} + +func (h *httpServerInstrumentor) FuncNames() []string { + return []string{"net/http.(*ServeMux).ServeHTTP"} +} + +func (h *httpServerInstrumentor) Load(ctx *context.InstrumentorContext) error { + spec, err := ctx.Injector.Inject(loadBpf, "go", ctx.TargetDetails.GoVersion.Original(), []*inject.InjectStructField{ + { + VarName: "method_ptr_pos", + StructName: "net/http.Request", + Field: "Method", + }, + { + VarName: "url_ptr_pos", + StructName: "net/http.Request", + Field: "URL", + }, + { + VarName: "ctx_ptr_pos", + StructName: "net/http.Request", + Field: "ctx", + }, + { + VarName: "path_ptr_pos", + StructName: "net/url.URL", + Field: "Path", + }, + }, false) + + if err != nil { + return err + } + + h.bpfObjects = &bpfObjects{} + err = spec.LoadAndAssign(h.bpfObjects, &ebpf.CollectionOptions{ + Maps: ebpf.MapOptions{ + PinPath: bpffs.BpfFsPath, + }, + }) + if err != nil { + return err + } + + offset, err := ctx.TargetDetails.GetFunctionOffset(h.FuncNames()[0]) + if err != nil { + return err + } + + up, err := ctx.Executable.Uprobe("", h.bpfObjects.UprobeServerMuxServeHTTP, &link.UprobeOptions{ + Offset: offset, + }) + if err != nil { + return err + } + + h.uprobe = up + retOffsets, err := ctx.TargetDetails.GetFunctionReturns(h.FuncNames()[0]) + if err != nil { + return err + } + + for _, ret := range retOffsets { + retProbe, err := ctx.Executable.Uprobe("", h.bpfObjects.UprobeServerMuxServeHTTP_Returns, &link.UprobeOptions{ + Offset: ret, + }) + if err != nil { + return err + } + h.returnProbs = append(h.returnProbs, retProbe) + } + + rd, err := perf.NewReader(h.bpfObjects.Events, os.Getpagesize()) + if err != nil { + return err + } + h.eventsReader = rd + + return nil +} + +func (h *httpServerInstrumentor) Run(eventsChan chan<- *events.Event) { + logger := log.Logger.WithName("net/http-instrumentor") + var event HttpEvent + for { + record, err := h.eventsReader.Read() + if err != nil { + if errors.Is(err, perf.ErrClosed) { + return + } + logger.Error(err, "error reading from perf reader") + continue + } + + if record.LostSamples != 0 { + logger.V(0).Info("perf event ring buffer full", "dropped", record.LostSamples) + continue + } + + if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.LittleEndian, &event); err != nil { + logger.Error(err, "error parsing perf event") + continue + } + + eventsChan <- h.convertEvent(&event) + } +} + +func (h *httpServerInstrumentor) convertEvent(e *HttpEvent) *events.Event { + method := unix.ByteSliceToString(e.Method[:]) + path := unix.ByteSliceToString(e.Path[:]) + + sc := trace.NewSpanContext(trace.SpanContextConfig{ + TraceID: e.SpanContext.TraceID, + SpanID: e.SpanContext.SpanID, + TraceFlags: trace.FlagsSampled, + }) + + return &events.Event{ + Library: h.LibraryName(), + Name: path, + Kind: trace.SpanKindServer, + StartTime: int64(e.StartTime), + EndTime: int64(e.EndTime), + SpanContext: &sc, + Attributes: []attribute.KeyValue{ + semconv.HTTPMethodKey.String(method), + semconv.HTTPTargetKey.String(path), + }, + } +} + +func (h *httpServerInstrumentor) Close() { + log.Logger.V(0).Info("closing net/http instrumentor") + if h.eventsReader != nil { + h.eventsReader.Close() + } + + if h.uprobe != nil { + h.uprobe.Close() + } + + for _, r := range h.returnProbs { + r.Close() + } + + if h.bpfObjects != nil { + h.bpfObjects.Close() + } +} diff --git a/pkg/instrumentors/bpffs/bpfsfs.go b/pkg/instrumentors/bpffs/bpfsfs.go new file mode 100644 index 000000000..45cb5047f --- /dev/null +++ b/pkg/instrumentors/bpffs/bpfsfs.go @@ -0,0 +1,19 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package bpffs + +const ( + BpfFsPath = "/sys/fs/bpf" +) diff --git a/pkg/instrumentors/context/inst_context.go b/pkg/instrumentors/context/inst_context.go new file mode 100644 index 000000000..219717807 --- /dev/null +++ b/pkg/instrumentors/context/inst_context.go @@ -0,0 +1,27 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package context + +import ( + "github.com/cilium/ebpf/link" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/inject" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/process" +) + +type InstrumentorContext struct { + TargetDetails *process.TargetDetails + Executable *link.Executable + Injector *inject.Injector +} diff --git a/pkg/instrumentors/context/span_context.go b/pkg/instrumentors/context/span_context.go new file mode 100644 index 000000000..f25457f72 --- /dev/null +++ b/pkg/instrumentors/context/span_context.go @@ -0,0 +1,22 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package context + +import "go.opentelemetry.io/otel/trace" + +type EbpfSpanContext struct { + TraceID trace.TraceID + SpanID trace.SpanID +} diff --git a/pkg/instrumentors/events/event.go b/pkg/instrumentors/events/event.go new file mode 100644 index 000000000..59044f916 --- /dev/null +++ b/pkg/instrumentors/events/event.go @@ -0,0 +1,31 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package events + +import ( + "go.opentelemetry.io/otel/attribute" + "go.opentelemetry.io/otel/trace" +) + +type Event struct { + Library string + Name string + Attributes []attribute.KeyValue + Kind trace.SpanKind + StartTime int64 + EndTime int64 + SpanContext *trace.SpanContext + ParentSpanContext *trace.SpanContext +} diff --git a/pkg/instrumentors/manager.go b/pkg/instrumentors/manager.go new file mode 100644 index 000000000..956c71c26 --- /dev/null +++ b/pkg/instrumentors/manager.go @@ -0,0 +1,114 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package instrumentors + +import ( + "fmt" + + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/allocator" + gorillaMux "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/bpf/github.com/gorilla/mux" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/bpf/google/golang/org/grpc" + grpcServer "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/bpf/google/golang/org/grpc/server" + httpServer "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/bpf/net/http/server" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/events" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/opentelemetry" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/process" +) + +type instrumentorsManager struct { + instrumentors map[string]Instrumentor + done chan bool + incomingEvents chan *events.Event + otelController *opentelemetry.Controller + allocator *allocator.Allocator +} + +func NewManager(otelController *opentelemetry.Controller) (*instrumentorsManager, error) { + m := &instrumentorsManager{ + instrumentors: make(map[string]Instrumentor), + done: make(chan bool, 1), + incomingEvents: make(chan *events.Event), + otelController: otelController, + allocator: allocator.New(), + } + + err := registerInstrumentors(m) + if err != nil { + return nil, err + } + + return m, nil +} + +func (m *instrumentorsManager) registerInstrumentor(instrumentor Instrumentor) error { + if _, exists := m.instrumentors[instrumentor.LibraryName()]; exists { + return fmt.Errorf("library %s registered twice, aborting", instrumentor.LibraryName()) + } + + m.instrumentors[instrumentor.LibraryName()] = instrumentor + return nil +} + +func (m *instrumentorsManager) GetRelevantFuncs() map[string]interface{} { + funcsMap := make(map[string]interface{}) + for _, i := range m.instrumentors { + for _, f := range i.FuncNames() { + funcsMap[f] = nil + } + } + + return funcsMap +} + +func (m *instrumentorsManager) FilterUnusedInstrumentors(target *process.TargetDetails) { + existingFuncMap := make(map[string]interface{}) + for _, f := range target.Functions { + existingFuncMap[f.Name] = nil + } + + for name, inst := range m.instrumentors { + allFuncExists := true + for _, instF := range inst.FuncNames() { + if _, exists := existingFuncMap[instF]; !exists { + allFuncExists = false + break + } + } + + if !allFuncExists { + log.Logger.V(1).Info("filtering unused instrumentation", "name", name) + delete(m.instrumentors, name) + } + } +} + +func registerInstrumentors(m *instrumentorsManager) error { + insts := []Instrumentor{ + grpc.New(), + grpcServer.New(), + httpServer.New(), + gorillaMux.New(), + } + + for _, i := range insts { + err := m.registerInstrumentor(i) + if err != nil { + return err + } + } + + return nil +} diff --git a/pkg/instrumentors/runner.go b/pkg/instrumentors/runner.go new file mode 100644 index 000000000..ef261ae95 --- /dev/null +++ b/pkg/instrumentors/runner.go @@ -0,0 +1,105 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package instrumentors + +import ( + "fmt" + + "github.com/cilium/ebpf/link" + "github.com/cilium/ebpf/rlimit" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/inject" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/context" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/process" +) + +func (m *instrumentorsManager) Run(target *process.TargetDetails) error { + if len(m.instrumentors) == 0 { + log.Logger.V(0).Info("there are no avilable instrumentations for target process") + return nil + } + + err := m.load(target) + if err != nil { + return err + } + + for _, i := range m.instrumentors { + go i.Run(m.incomingEvents) + } + + for { + select { + case <-m.done: + log.Logger.V(0).Info("shutting down all instrumentors due to signal") + m.cleanup() + return nil + case e := <-m.incomingEvents: + m.otelController.Trace(e) + } + } +} + +func (m *instrumentorsManager) load(target *process.TargetDetails) error { + // Allow the current process to lock memory for eBPF resources. + if err := rlimit.RemoveMemlock(); err != nil { + return err + } + + injector, err := inject.New(target) + if err != nil { + return err + } + + exe, err := link.OpenExecutable(fmt.Sprintf("/proc/%d/exe", target.PID)) + if err != nil { + return err + } + ctx := &context.InstrumentorContext{ + TargetDetails: target, + Executable: exe, + Injector: injector, + } + + if err := m.allocator.Load(ctx); err != nil { + log.Logger.Error(err, "failed to load allocator") + return err + } + + // Load instrumentors + for name, i := range m.instrumentors { + log.Logger.V(0).Info("loading instrumentor", "name", name) + err := i.Load(ctx) + if err != nil { + log.Logger.Error(err, "error while loading instrumentors, cleaning up", "name", name) + m.cleanup() + return err + } + } + + log.Logger.V(0).Info("loaded instrumentors to memory", "total_instrumentors", len(m.instrumentors)) + return nil +} + +func (m *instrumentorsManager) cleanup() { + close(m.incomingEvents) + for _, i := range m.instrumentors { + i.Close() + } +} + +func (m *instrumentorsManager) Close() { + m.done <- true +} diff --git a/pkg/log/logger.go b/pkg/log/logger.go new file mode 100644 index 000000000..9d3e75743 --- /dev/null +++ b/pkg/log/logger.go @@ -0,0 +1,33 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package log + +import ( + "github.com/go-logr/logr" + "github.com/go-logr/zapr" + "go.uber.org/zap" +) + +var Logger logr.Logger + +func Init() error { + zapLog, err := zap.NewProduction() + if err != nil { + return err + } + + Logger = zapr.NewLogger(zapLog) + return nil +} diff --git a/pkg/opentelemetry/controller.go b/pkg/opentelemetry/controller.go new file mode 100644 index 000000000..fe50349ca --- /dev/null +++ b/pkg/opentelemetry/controller.go @@ -0,0 +1,213 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package opentelemetry + +import ( + "context" + "fmt" + "os" + "runtime" + "time" + + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/events" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" + "github.com/prometheus/procfs" + "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc" + "go.opentelemetry.io/otel/sdk/resource" + sdktrace "go.opentelemetry.io/otel/sdk/trace" + semconv "go.opentelemetry.io/otel/semconv/v1.7.0" + "go.opentelemetry.io/otel/trace" + "golang.org/x/sys/unix" + "google.golang.org/grpc" +) + +const ( + otelEndpointEnvVar = "OTEL_EXPORTER_OTLP_ENDPOINT" + otelServiceNameEnvVar = "OTEL_SERVICE_NAME" +) + +type Controller struct { + tracerProvider trace.TracerProvider + tracersMap map[string]trace.Tracer + bootTime int64 +} + +func (c *Controller) getTracer(libName string) trace.Tracer { + t, exists := c.tracersMap[libName] + if exists { + return t + } + + newTracer := c.tracerProvider.Tracer(libName) + c.tracersMap[libName] = newTracer + return newTracer +} + +func (c *Controller) Trace(event *events.Event) { + log.Logger.V(0).Info("got event", "attrs", event.Attributes) + ctx := context.Background() + + if event.SpanContext == nil { + log.Logger.V(0).Info("got event without context - dropping") + return + } + + // TODO: handle remote parent + if event.ParentSpanContext != nil { + ctx = trace.ContextWithSpanContext(ctx, *event.ParentSpanContext) + } + + ctx = ContextWithEbpfEvent(ctx, *event) + _, span := c.getTracer(event.Library). + Start(ctx, event.Name, + trace.WithAttributes(event.Attributes...), + trace.WithSpanKind(event.Kind), + trace.WithTimestamp(c.convertTime(event.StartTime))) + span.End(trace.WithTimestamp(c.convertTime(event.EndTime))) +} + +func (c *Controller) convertTime(t int64) time.Time { + return time.Unix(0, c.bootTime+t) +} + +func NewController() (*Controller, error) { + endpoint, exists := os.LookupEnv(otelEndpointEnvVar) + if !exists { + return nil, fmt.Errorf("%s env var must be set", otelEndpointEnvVar) + } + + serviceName, exists := os.LookupEnv(otelServiceNameEnvVar) + if !exists { + return nil, fmt.Errorf("%s env var must be set", otelServiceNameEnvVar) + } + + ctx := context.Background() + res, err := resource.New(ctx, + resource.WithAttributes( + semconv.ServiceNameKey.String(serviceName), + semconv.TelemetrySDKLanguageGo, + ), + ) + if err != nil { + return nil, err + } + + log.Logger.V(0).Info("Establishing connection to OpenTelemetry collector ...") + timeoutContext, cancel := context.WithTimeout(ctx, time.Second*10) + defer cancel() + conn, err := grpc.DialContext(timeoutContext, endpoint, grpc.WithInsecure(), grpc.WithBlock()) + if err != nil { + log.Logger.Error(err, "unable to connect to OpenTelemetry collector", "addr", endpoint) + return nil, err + } + + traceExporter, err := otlptracegrpc.New(ctx, + otlptracegrpc.WithGRPCConn(conn), + ) + + if err != nil { + return nil, err + } + + bsp := sdktrace.NewBatchSpanProcessor(traceExporter) + tracerProvider := sdktrace.NewTracerProvider( + sdktrace.WithSampler(sdktrace.AlwaysSample()), + sdktrace.WithResource(res), + sdktrace.WithSpanProcessor(bsp), + sdktrace.WithIDGenerator(NewEbpfSourceIDGenerator()), + ) + + bt, err := estimateBootTimeOffset() + if err != nil { + return nil, err + } + + return &Controller{ + tracerProvider: tracerProvider, + tracersMap: make(map[string]trace.Tracer), + bootTime: bt, + }, nil +} + +func getBootTime() (*time.Time, error) { + fs, err := procfs.NewDefaultFS() + if err != nil { + return nil, err + } + + stat, err := fs.Stat() + if err != nil { + return nil, err + } + + boot := time.Unix(int64(stat.BootTime), 0) + return &boot, nil +} + +func getBootTimeSyscall() (int64, error) { + var ts unix.Timespec + err := unix.ClockGettime(unix.CLOCK_MONOTONIC, &ts) + now := time.Now().UnixNano() + if err != nil { + return 0, fmt.Errorf("could not get boot time: %s", err) + } + + return now - unix.TimespecToNsec(ts), nil +} + +func estimateBootTimeOffset() (bootTimeOffset int64, err error) { + // The datapath is currently using ktime_get_boot_ns for the pcap timestamp, + // which corresponds to CLOCK_BOOTTIME. To be able to convert the the + // CLOCK_BOOTTIME to CLOCK_REALTIME (i.e. a unix timestamp). + + // There can be an arbitrary amount of time between the execution of + // time.Now() and unix.ClockGettime() below, especially under scheduler + // pressure during program startup. To reduce the error introduced by these + // delays, we pin the current Go routine to its OS thread and measure the + // clocks multiple times, taking only the smallest observed difference + // between the two values (which implies the smallest possible delay + // between the two snapshots). + var minDiff int64 = 1<<63 - 1 + estimationRounds := 25 + runtime.LockOSThread() + defer runtime.UnlockOSThread() + for round := 0; round < estimationRounds; round++ { + var bootTimespec unix.Timespec + + // Ideally we would use __vdso_clock_gettime for both clocks here, + // to have as little overhead as possible. + // time.Now() will actually use VDSO on Go 1.9+, but calling + // unix.ClockGettime to obtain CLOCK_BOOTTIME is a regular system call + // for now. + unixTime := time.Now() + err = unix.ClockGettime(unix.CLOCK_BOOTTIME, &bootTimespec) + if err != nil { + return 0, err + } + + offset := unixTime.UnixNano() - bootTimespec.Nano() + diff := offset + if diff < 0 { + diff = -diff + } + + if diff < minDiff { + minDiff = diff + bootTimeOffset = offset + } + } + + return bootTimeOffset, nil +} diff --git a/pkg/opentelemetry/id_generator.go b/pkg/opentelemetry/id_generator.go new file mode 100644 index 000000000..ec8319ad7 --- /dev/null +++ b/pkg/opentelemetry/id_generator.go @@ -0,0 +1,66 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package opentelemetry + +import ( + "context" + + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/instrumentors/events" + "go.opentelemetry.io/otel/trace" +) + +type eBPFSourceIDGenerator struct{} + +type ebpfEventKey struct{} + +func NewEbpfSourceIDGenerator() *eBPFSourceIDGenerator { + return &eBPFSourceIDGenerator{} +} + +func ContextWithEbpfEvent(ctx context.Context, event events.Event) context.Context { + return context.WithValue(ctx, ebpfEventKey{}, event) +} + +func EventFromContext(ctx context.Context) *events.Event { + val := ctx.Value(ebpfEventKey{}) + if val == nil { + return nil + } + + event, ok := val.(events.Event) + if !ok { + return nil + } + + return &event +} + +func (e *eBPFSourceIDGenerator) NewIDs(ctx context.Context) (trace.TraceID, trace.SpanID) { + event := EventFromContext(ctx) + if event == nil || event.SpanContext == nil { + return trace.TraceID{}, trace.SpanID{} + } + + return event.SpanContext.TraceID(), event.SpanContext.SpanID() +} + +func (e *eBPFSourceIDGenerator) NewSpanID(ctx context.Context, traceID trace.TraceID) trace.SpanID { + event := EventFromContext(ctx) + if event == nil { + return trace.SpanID{} + } + + return event.SpanContext.SpanID() +} diff --git a/pkg/process/analyze.go b/pkg/process/analyze.go new file mode 100644 index 000000000..e0a908224 --- /dev/null +++ b/pkg/process/analyze.go @@ -0,0 +1,205 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package process + +import ( + "debug/elf" + "debug/gosym" + "errors" + "fmt" + "os" + + "github.com/prometheus/procfs" + + "github.com/hashicorp/go-version" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" + "golang.org/x/arch/x86/x86asm" +) + +type TargetDetails struct { + PID int + Functions []*Func + GoVersion *version.Version + Libraries map[string]string + AllocationDetails *AllocationDetails +} + +type AllocationDetails struct { + Addr uint64 + EndAddr uint64 +} + +type Func struct { + Name string + Offset uint64 + ReturnOffsets []uint64 +} + +func (t *TargetDetails) IsRegistersABI() bool { + regAbiMinVersion, _ := version.NewVersion("1.17") + return t.GoVersion.GreaterThanOrEqual(regAbiMinVersion) +} + +func (t *TargetDetails) GetFunctionOffset(name string) (uint64, error) { + for _, f := range t.Functions { + if f.Name == name { + return f.Offset, nil + } + } + + return 0, fmt.Errorf("could not find offset for function %s", name) +} + +func (t *TargetDetails) GetFunctionReturns(name string) ([]uint64, error) { + for _, f := range t.Functions { + if f.Name == name { + return f.ReturnOffsets, nil + } + } + + return nil, fmt.Errorf("could not find returns for function %s", name) +} + +func (a *processAnalyzer) findKeyvalMmap(pid int) (uintptr, uintptr) { + fs, err := procfs.NewProc(pid) + if err != nil { + panic(err) + } + + maps, err := fs.ProcMaps() + if err != nil { + panic(err) + } + + for _, m := range maps { + if m.Perms != nil && m.Perms.Read && m.Perms.Write && m.Perms.Execute { + log.Logger.Info("found addr of keyval map", "addr", m.StartAddr) + return m.StartAddr, m.EndAddr + } + } + panic(errors.New("cant find keyval map")) +} + +func (a *processAnalyzer) Analyze(pid int, relevantFuncs map[string]interface{}) (*TargetDetails, error) { + result := &TargetDetails{ + PID: pid, + } + + f, err := os.Open(fmt.Sprintf("/proc/%d/exe", pid)) + if err != nil { + return nil, err + } + + defer f.Close() + elfF, err := elf.NewFile(f) + if err != nil { + return nil, err + } + + goVersion, modules, err := a.getModuleDetails(elfF) + if err != nil { + return nil, err + } + result.GoVersion = goVersion + result.Libraries = modules + + start, end := a.findKeyvalMmap(pid) + result.AllocationDetails = &AllocationDetails{ + Addr: uint64(start), + EndAddr: uint64(end), + } + + var pclndat []byte + if sec := elfF.Section(".gopclntab"); sec != nil { + pclndat, err = sec.Data() + if err != nil { + return nil, err + } + } + + sec := elfF.Section(".gosymtab") + if sec == nil { + return nil, fmt.Errorf("%s section not found in target binary, make sure this is a Go application", ".gosymtab") + } + symTabRaw, err := sec.Data() + pcln := gosym.NewLineTable(pclndat, elfF.Section(".text").Addr) + symTab, err := gosym.NewTable(symTabRaw, pcln) + if err != nil { + return nil, err + } + + for _, f := range symTab.Funcs { + + if _, exists := relevantFuncs[f.Name]; exists { + start, returns, err := a.findFuncOffset(&f, elfF) + if err != nil { + return nil, err + } + + log.Logger.V(0).Info("found relevant function for instrumentation", "function", f.Name, "returns", len(returns)) + function := &Func{ + Name: f.Name, + Offset: start, + ReturnOffsets: returns, + } + + result.Functions = append(result.Functions, function) + } + } + + return result, nil +} + +func (a *processAnalyzer) findFuncOffset(f *gosym.Func, elfF *elf.File) (uint64, []uint64, error) { + off := f.Value + for _, prog := range elfF.Progs { + if prog.Type != elf.PT_LOAD || (prog.Flags&elf.PF_X) == 0 { + continue + } + + // For more info on this calculation: stackoverflow.com/a/40249502 + if prog.Vaddr <= f.Value && f.Value < (prog.Vaddr+prog.Memsz) { + off = f.Value - prog.Vaddr + prog.Off + + funcLen := f.End - f.Entry + data := make([]byte, funcLen) + _, err := prog.ReadAt(data, int64(f.Value-prog.Vaddr)) + if err != nil { + log.Logger.Error(err, "error while finding function return") + return 0, nil, err + } + + var returns []uint64 + for i := 0; i < int(funcLen); { + inst, err := x86asm.Decode(data[i:], 64) + if err != nil { + log.Logger.Error(err, "error while finding function return") + return 0, nil, err + } + + if inst.Op == x86asm.RET { + returns = append(returns, off+uint64(i)) + } + + i += inst.Len + } + + return off, returns, nil + } + + } + + return 0, nil, fmt.Errorf("prog not found") +} diff --git a/pkg/process/args.go b/pkg/process/args.go new file mode 100644 index 000000000..223af5d1d --- /dev/null +++ b/pkg/process/args.go @@ -0,0 +1,47 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package process + +import ( + "errors" + "os" +) + +const ( + ExePathEnvVar = "OTEL_TARGET_EXE" +) + +type TargetArgs struct { + ExePath string +} + +func (t *TargetArgs) Validate() error { + if t.ExePath == "" { + return errors.New("target binary path not specified") + } + + return nil +} + +func ParseTargetArgs() *TargetArgs { + result := &TargetArgs{} + + val, exists := os.LookupEnv(ExePathEnvVar) + if exists { + result.ExePath = val + } + + return result +} diff --git a/pkg/process/discover.go b/pkg/process/discover.go new file mode 100644 index 000000000..bb599c973 --- /dev/null +++ b/pkg/process/discover.go @@ -0,0 +1,116 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package process + +import ( + "io" + "io/ioutil" + "os" + "path" + "strconv" + "strings" + "time" + + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/errors" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" +) + +type processAnalyzer struct { + done chan bool + pidTickerChan <-chan time.Time +} + +func NewAnalyzer() *processAnalyzer { + return &processAnalyzer{ + done: make(chan bool, 1), + pidTickerChan: time.NewTicker(2 * time.Second).C, + } +} + +func (a *processAnalyzer) DiscoverProcessID(target *TargetArgs) (int, error) { + for { + select { + case <-a.done: + log.Logger.V(0).Info("stopping process id discovery due to kill signal") + return 0, errors.ErrInterrupted + case <-a.pidTickerChan: + pid, err := a.findProcessID(target) + if err != nil { + if err == errors.ErrProcessNotFound { + log.Logger.V(0).Info("process not found yet, trying again soon", "exe_path", target.ExePath) + } else { + log.Logger.Error(err, "error while searching for process", "exe_path", target.ExePath) + } + } else { + log.Logger.V(0).Info("found process", "pid", pid) + return pid, nil + } + } + } +} + +func (a *processAnalyzer) findProcessID(target *TargetArgs) (int, error) { + proc, err := os.Open("/proc") + if err != nil { + return 0, err + } + + for { + dirs, err := proc.Readdir(15) + if err == io.EOF { + break + } + if err != nil { + return 0, err + } + + for _, di := range dirs { + if !di.IsDir() { + continue + } + + dname := di.Name() + if dname[0] < '0' || dname[0] > '9' { + continue + } + + pid, err := strconv.Atoi(dname) + if err != nil { + return 0, err + } + + exeName, err := os.Readlink(path.Join("/proc", dname, "exe")) + if err != nil { + // Read link may fail if target process runs not as root + cmdLine, err := ioutil.ReadFile(path.Join("/proc", dname, "cmdline")) + if err != nil { + return 0, err + } + + if strings.Contains(string(cmdLine), target.ExePath) { + return pid, nil + } + } else if exeName == target.ExePath { + return pid, nil + } + } + } + + return 0, errors.ErrProcessNotFound +} + +func (a *processAnalyzer) Close() { + a.done <- true +} diff --git a/pkg/process/module.go b/pkg/process/module.go new file mode 100644 index 000000000..7e4b3d03b --- /dev/null +++ b/pkg/process/module.go @@ -0,0 +1,201 @@ +// Copyright The OpenTelemetry Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package process + +import ( + "bytes" + "debug/elf" + "encoding/binary" + "errors" + "fmt" + "strings" + + "github.com/hashicorp/go-version" + "github.com/open-telemetry/opentelemetry-go-instrumentation/pkg/log" +) + +// The build info blob left by the linker is identified by +// a 16-byte header, consisting of buildInfoMagic (14 bytes), +// the binary's pointer size (1 byte), +// and whether the binary is big endian (1 byte). +var buildInfoMagic = []byte("\xff Go buildinf:") +var errNotGoExe = errors.New("not a Go executable") + +func (a *processAnalyzer) getModuleDetails(f *elf.File) (*version.Version, map[string]string, error) { + goVersion, modules, err := getGoDetails(f) + if err != nil { + return nil, nil, err + } + + v, err := parseGoVersion(goVersion) + if err != nil { + return nil, nil, err + } + + log.Logger.V(1).Info("go version detected", "version", goVersion) + modsMap := parseModules(modules) + return v, modsMap, nil +} + +func parseGoVersion(vers string) (*version.Version, error) { + vers = strings.ReplaceAll(vers, "go", "") + return version.NewVersion(vers) +} + +func getGoDetails(f *elf.File) (string, string, error) { + // Read the first 64kB of text to find the build info blob. + text := dataStart(f) + data, err := readData(f, text, 64*1024) + if err != nil { + return "", "", err + } + const ( + buildInfoAlign = 16 + buildInfoSize = 32 + ) + for { + i := bytes.Index(data, buildInfoMagic) + if i < 0 || len(data)-i < buildInfoSize { + return "", "", errNotGoExe + } + if i%buildInfoAlign == 0 && len(data)-i >= buildInfoSize { + data = data[i:] + break + } + data = data[(i+buildInfoAlign-1)&^buildInfoAlign:] + } + + // Decode the blob. + // The first 14 bytes are buildInfoMagic. + // The next two bytes indicate pointer size in bytes (4 or 8) and endianness + // (0 for little, 1 for big). + // Two virtual addresses to Go strings follow that: runtime.buildVersion, + // and runtime.modinfo. + // On 32-bit platforms, the last 8 bytes are unused. + // If the endianness has the 2 bit set, then the pointers are zero + // and the 32-byte header is followed by varint-prefixed string data + // for the two string values we care about. + ptrSize := int(data[14]) + var vers, mod string + if data[15]&2 != 0 { + vers, data = decodeString(data[32:]) + mod, data = decodeString(data) + } else { + bigEndian := data[15] != 0 + var bo binary.ByteOrder + if bigEndian { + bo = binary.BigEndian + } else { + bo = binary.LittleEndian + } + var readPtr func([]byte) uint64 + if ptrSize == 4 { + readPtr = func(b []byte) uint64 { return uint64(bo.Uint32(b)) } + } else { + readPtr = bo.Uint64 + } + vers = readString(f, ptrSize, readPtr, readPtr(data[16:])) + mod = readString(f, ptrSize, readPtr, readPtr(data[16+ptrSize:])) + } + if vers == "" { + return "", "", errNotGoExe + } + if len(mod) >= 33 && mod[len(mod)-17] == '\n' { + // Strip module framing: sentinel strings delimiting the module info. + // These are cmd/go/internal/modload.infoStart and infoEnd. + mod = mod[16 : len(mod)-16] + } else { + mod = "" + } + + return vers, mod, nil +} + +func dataStart(f *elf.File) uint64 { + for _, s := range f.Sections { + if s.Name == ".go.buildinfo" { + return s.Addr + } + } + for _, p := range f.Progs { + if p.Type == elf.PT_LOAD && p.Flags&(elf.PF_X|elf.PF_W) == elf.PF_W { + return p.Vaddr + } + } + return 0 +} + +func readData(f *elf.File, addr, size uint64) ([]byte, error) { + for _, prog := range f.Progs { + if prog.Vaddr <= addr && addr <= prog.Vaddr+prog.Filesz-1 { + n := prog.Vaddr + prog.Filesz - addr + if n > size { + n = size + } + data := make([]byte, n) + _, err := prog.ReadAt(data, int64(addr-prog.Vaddr)) + if err != nil { + return nil, err + } + return data, nil + } + } + return nil, fmt.Errorf("address not mapped") +} + +// readString returns the string at address addr in the executable x. +func readString(f *elf.File, ptrSize int, readPtr func([]byte) uint64, addr uint64) string { + hdr, err := readData(f, addr, uint64(2*ptrSize)) + if err != nil || len(hdr) < 2*ptrSize { + return "" + } + dataAddr := readPtr(hdr) + dataLen := readPtr(hdr[ptrSize:]) + data, err := readData(f, dataAddr, dataLen) + if err != nil || uint64(len(data)) < dataLen { + return "" + } + return string(data) +} + +func parseModules(mod string) map[string]string { + lines := strings.Split(mod, "\n") + result := make(map[string]string) + for _, line := range lines { + parts := strings.Fields(line) + if len(parts) > 1 { + modType := parts[0] + modPackage := parts[1] + if modType == "dep" { + v := "" + if len(parts) > 2 { + v = parts[2] + } + + result[modPackage] = v + } + } + } + + return result +} + +func decodeString(data []byte) (s string, rest []byte) { + u, n := binary.Uvarint(data) + if n <= 0 || u >= uint64(len(data)-n) { + return "", nil + } + return string(data[n : uint64(n)+u]), data[uint64(n)+u:] +}