Received: by 2002:a05:7412:8d09:b0:fa:4c10:6cad with SMTP id bj9csp378889rdb; Tue, 16 Jan 2024 03:18:05 -0800 (PST) X-Google-Smtp-Source: AGHT+IGvT2SiLhQPvGeMtLbcNp17Yp5pbFkOOCJkNfxEP0VF+1cfcRpCz48mM+4sJsYpSjzbRjiG X-Received: by 2002:a05:6358:4694:b0:174:ee39:d1cf with SMTP id w20-20020a056358469400b00174ee39d1cfmr4553358rwl.51.1705403884925; Tue, 16 Jan 2024 03:18:04 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1705403884; cv=none; d=google.com; s=arc-20160816; b=RGQ/35dUfvP31hZZ1xSIVX33+Wo8V9qhlIKOV+PTeMZOsUsgwCRuGYZh/eYit67MYW vMDblnsY78oLSSsFr1z245wU+JwmFwbF96Lfy98MDNxrBMRZOz6ue743VFdekBJKYo/H NlpF1gEnhaChQnK3TxaQ86r96wqRP2nOZr1KsVGUkBHCKnpBDUHTvx858qA2azr7VhjY 3pVUJh8XUAHDHw418zIXrlcTsr/BE2U5u4KS5MiuA1NupWwwEPkU6TLZA3L3QsYIE54l G54JrqKeqipx2aSK9hLTdLEpksUFGT4Uk0JQe1KfEISPHF6HnsXGbW3xuXI4zwamRVpy X69Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:list-unsubscribe:list-subscribe:list-id:precedence :user-agent:references:in-reply-to:date:cc:to:from:subject :message-id:dkim-signature; bh=SK6gx6g0O9JSiWmXP/5FPXcIdBR9uH8U+TuquhAIE+w=; fh=R66NhruJCWl55ZWxGWlmrFhsYj/zmmZuO3p3Jfs63XM=; b=rFAyujGWBPuuQX9zZ5PqAztj+OH5JcM9f7uhArUuD3CKzaydtdc7VPSFYhqCTKCv36 5wMiG86/DIuFdc7I2BvzLAepZWIHO3vto8Ase5iTRumWzo1VIvB3CgR72iGeJpl6baOV QVSyM14oTwcZ9qjZVGboSWpSHWQQRgkIyWX02T9QkPmCUcL+WiENgZ3fKdY7LfBOdlhF 9vaFBRP8dmS0hdEuQNh1kfnHF9ZwioIfERt3hZ5gmk9WNZ+IKlOW5abuFpipmNUu+XIO 9uIetRXsZqBOk9dmmu7XcV6ckGCLAtr4LdkxGKDiUuIOz8y+5ICHGPWi/aEuxVXYp0z/ Lc8A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@infradead.org header.s=casper.20170209 header.b=VXjeM15G; spf=pass (google.com: domain of linux-kernel+bounces-27304-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) smtp.mailfrom="linux-kernel+bounces-27304-linux.lists.archive=gmail.com@vger.kernel.org" Return-Path: Received: from sy.mirrors.kernel.org (sy.mirrors.kernel.org. [147.75.48.161]) by mx.google.com with ESMTPS id k10-20020a6568ca000000b005cd887d9766si10685689pgt.166.2024.01.16.03.18.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Jan 2024 03:18:04 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-27304-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161; Authentication-Results: mx.google.com; dkim=pass header.i=@infradead.org header.s=casper.20170209 header.b=VXjeM15G; spf=pass (google.com: domain of linux-kernel+bounces-27304-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) smtp.mailfrom="linux-kernel+bounces-27304-linux.lists.archive=gmail.com@vger.kernel.org" Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sy.mirrors.kernel.org (Postfix) with ESMTPS id 04360B22FEF for ; Tue, 16 Jan 2024 11:18:01 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id F212A1B955; Tue, 16 Jan 2024 11:17:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="VXjeM15G" Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 394F91B940; Tue, 16 Jan 2024 11:17:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=casper.srs.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=MIME-Version:Content-Type:References: In-Reply-To:Date:Cc:To:From:Subject:Message-ID:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=SK6gx6g0O9JSiWmXP/5FPXcIdBR9uH8U+TuquhAIE+w=; b=VXjeM15GPpqINP9mSZ7arMsL4Z kI6v3hxZvNUoxsKkkdrfsbVFAOuFg6Qxk1/y7/c8pZpnz3S64DwGX8vwQ+9T5rbEtnaDK11r6emGQ AzSsQFu9runRzOcORRmKdthQ6abRkQgt7LUHIc/CQzk9ySM55oQa02BA+c1RHzltY61tZgvGl1Zy4 6vuqnTYAkPAPuFBjOqyrFpeohCP6X97YhqcYWG9rIeenbi8G7Ns468g46ZIFre+Cin8kwrtrcoXUs ByOOIN7ARBwoDnJ3Eimu9pHOUFEob3Zp2AtNksZVaJK7jAqeGBGM+nQ1TtwPVKs7DibXnCotgll7+ nD72MZyw==; Received: from [54.239.6.184] (helo=daas-dns-lhr50-9.e-lhr50.amazon.com) by casper.infradead.org with esmtpsa (Exim 4.94.2 #2 (Red Hat Linux)) id 1rPhRv-00Cmmx-IP; Tue, 16 Jan 2024 11:17:43 +0000 Message-ID: <78d43f46d3a0e6368cdcc28a67a102da8599034f.camel@infradead.org> Subject: Re: [PATCH v3] KVM: x86/xen: improve accuracy of Xen timers From: David Woodhouse To: paul@xen.org, kvm@vger.kernel.org, linux-kernel Cc: Sean Christopherson , Paolo Bonzini , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" Date: Tue, 16 Jan 2024 12:17:42 +0100 In-Reply-To: References: Content-Type: multipart/signed; micalg="sha-256"; protocol="application/pkcs7-signature"; boundary="=-wBkOHYCZim5yjylDsUJB" User-Agent: Evolution 3.44.4-0ubuntu2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-SRS-Rewrite: SMTP reverse-path rewritten from by casper.infradead.org. See http://www.infradead.org/rpr.html --=-wBkOHYCZim5yjylDsUJB Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, 2023-12-15 at 09:07 +0000, Durrant, Paul wrote: > On 14/12/2023 16:54, David Woodhouse wrote: > > From: David Woodhouse > >=20 > > A test program such as http://david.woodhou.se/timerlat.c=C2=A0confirms= user > > reports that timers are increasingly inaccurate as the lifetime of a > > guest increases. Reporting the actual delay observed when asking for > > 100=C2=B5s of sleep, it starts off OK on a newly-launched guest but get= s > > worse over time, giving incorrect sleep times: > >=20 > > root@ip-10-0-193-21:~# ./timerlat -c -n 5 > > 00000000 latency 103243/100000 (3.2430%) > > 00000001 latency 103243/100000 (3.2430%) > > 00000002 latency 103242/100000 (3.2420%) > > 00000003 latency 103245/100000 (3.2450%) > > 00000004 latency 103245/100000 (3.2450%) > >=20 > > The biggest problem is that get_kvmclock_ns() returns inaccurate values > > when the guest TSC is scaled. The guest sees a TSC value scaled from th= e > > host TSC by a mul/shift conversion (hopefully done in hardware). The > > guest then converts that guest TSC value into nanoseconds using the > > mul/shift conversion given to it by the KVM pvclock information. > >=20 > > But get_kvmclock_ns() performs only a single conversion directly from > > host TSC to nanoseconds, giving a different result. A test program at > > http://david.woodhou.se/tsdrift.c=C2=A0demonstrates the cumulative erro= r > > over a day. > >=20 > > It's non-trivial to fix get_kvmclock_ns(), although I'll come back to > > that. The actual guest hv_clock is per-CPU, and *theoretically* each > > vCPU could be running at a *different* frequency. But this patch is > > needed anyway because... > >=20 > > The other issue with Xen timers was that the code would snapshot the > > host CLOCK_MONOTONIC at some point in time, and then... after a few > > interrupts may have occurred, some preemption perhaps... would also rea= d > > the guest's kvmclock. Then it would proceed under the false assumption > > that those two happened at the *same* time. Any time which *actually* > > elapsed between reading the two clocks was introduced as inaccuracies > > in the time at which the timer fired. > >=20 > > Fix it to use a variant of kvm_get_time_and_clockread(), which reads th= e > > host TSC just *once*, then use the returned TSC value to calculate the > > kvmclock (making sure to do that the way the guest would instead of > > making the same mistake get_kvmclock_ns() does). > >=20 > > Sadly, hrtimers based on CLOCK_MONOTONIC_RAW are not supported, so Xen > > timers still have to use CLOCK_MONOTONIC. In practice the difference > > between the two won't matter over the timescales involved, as the > > *absolute* values don't matter; just the delta. > >=20 > > This does mean a new variant of kvm_get_time_and_clockread() is needed; > > called kvm_get_monotonic_and_clockread() because that's what it does. > >=20 > > Fixes: 536395260582 ("KVM: x86/xen: handle PV timers oneshot mode") > > Signed-off-by: David Woodhouse > > --- > > v3: > > =C2=A0=C2=A0=C2=A0 =E2=80=A2 Rebase and repost. > >=20 > > v2: > > =C2=A0=C2=A0=C2=A0 =E2=80=A2 Fall back to get_kvmclock_ns() if vcpu-arc= h.hv_clock isn't set up > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 yet, with a big comment explaining why t= hat's actually OK. > > =C2=A0=C2=A0=C2=A0 =E2=80=A2 Fix do_monotonic() *not* to add the boot t= ime offset. > > =C2=A0=C2=A0=C2=A0 =E2=80=A2 Rename do_monotonic_raw() =E2=86=92 do_kvm= clock_base() and add a comment > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 to make it clear that it *does* add the = boot time offset. That > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 was just left as a bear trap for the unw= ary developer, wasn't it? > >=20 > > =C2=A0 =C2=A0arch/x86/kvm/x86.c |=C2=A0 61 +++++++++++++++++++++-- > > =C2=A0 =C2=A0arch/x86/kvm/x86.h |=C2=A0=C2=A0 1 + > > =C2=A0 =C2=A0arch/x86/kvm/xen.c | 121 +++++++++++++++++++++++++++++++++= +----------- > > =C2=A0 =C2=A03 files changed, 149 insertions(+), 34 deletions(-) > >=20 >=20 > Reviewed-by: Paul Durrant Ping? --=-wBkOHYCZim5yjylDsUJB Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCEkQw ggYQMIID+KADAgECAhBNlCwQ1DvglAnFgS06KwZPMA0GCSqGSIb3DQEBDAUAMIGIMQswCQYDVQQG EwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkxHjAcBgNVBAoT FVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRydXN0IFJTQSBDZXJ0aWZpY2F0 aW9uIEF1dGhvcml0eTAeFw0xODExMDIwMDAwMDBaFw0zMDEyMzEyMzU5NTlaMIGWMQswCQYDVQQG EwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYD VQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENsaWVudCBBdXRoZW50 aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAyjztlApB/975Rrno1jvm2pK/KxBOqhq8gr2+JhwpKirSzZxQgT9tlC7zl6hn1fXjSo5MqXUf ItMltrMaXqcESJuK8dtK56NCSrq4iDKaKq9NxOXFmqXX2zN8HHGjQ2b2Xv0v1L5Nk1MQPKA19xeW QcpGEGFUUd0kN+oHox+L9aV1rjfNiCj3bJk6kJaOPabPi2503nn/ITX5e8WfPnGw4VuZ79Khj1YB rf24k5Ee1sLTHsLtpiK9OjG4iQRBdq6Z/TlVx/hGAez5h36bBJMxqdHLpdwIUkTqT8se3ed0PewD ch/8kHPo5fZl5u1B0ecpq/sDN/5sCG52Ds+QU5O5EwIDAQABo4IBZDCCAWAwHwYDVR0jBBgwFoAU U3m/WqorSs9UgOHYm8Cd8rIDZsswHQYDVR0OBBYEFAnA8vwL2pTbX/4r36iZQs/J4K0AMA4GA1Ud DwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEF BQcDBDARBgNVHSAECjAIMAYGBFUdIAAwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDovL2NybC51c2Vy dHJ1c3QuY29tL1VTRVJUcnVzdFJTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHYGCCsGAQUF BwEBBGowaDA/BggrBgEFBQcwAoYzaHR0cDovL2NydC51c2VydHJ1c3QuY29tL1VTRVJUcnVzdFJT QUFkZFRydXN0Q0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29tMA0G CSqGSIb3DQEBDAUAA4ICAQBBRHUAqznCFfXejpVtMnFojADdF9d6HBA4kMjjsb0XMZHztuOCtKF+ xswhh2GqkW5JQrM8zVlU+A2VP72Ky2nlRA1GwmIPgou74TZ/XTarHG8zdMSgaDrkVYzz1g3nIVO9 IHk96VwsacIvBF8JfqIs+8aWH2PfSUrNxP6Ys7U0sZYx4rXD6+cqFq/ZW5BUfClN/rhk2ddQXyn7 kkmka2RQb9d90nmNHdgKrwfQ49mQ2hWQNDkJJIXwKjYA6VUR/fZUFeCUisdDe/0ABLTI+jheXUV1 eoYV7lNwNBKpeHdNuO6Aacb533JlfeUHxvBz9OfYWUiXu09sMAviM11Q0DuMZ5760CdO2VnpsXP4 KxaYIhvqPqUMWqRdWyn7crItNkZeroXaecG03i3mM7dkiPaCkgocBg0EBYsbZDZ8bsG3a08LwEsL 1Ygz3SBsyECa0waq4hOf/Z85F2w2ZpXfP+w8q4ifwO90SGZZV+HR/Jh6rEaVPDRF/CEGVqR1hiuQ OZ1YL5ezMTX0ZSLwrymUE0pwi/KDaiYB15uswgeIAcA6JzPFf9pLkAFFWs1QNyN++niFhsM47qod x/PL+5jR87myx5uYdBEQkkDc+lKB1Wct6ucXqm2EmsaQ0M95QjTmy+rDWjkDYdw3Ms6mSWE3Bn7i 5ZgtwCLXgAIe5W8mybM2JzCCBhQwggT8oAMCAQICEQDGvhmWZ0DEAx0oURL6O6l+MA0GCSqGSIb3 DQEBCwUAMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD VQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28g UlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMB4XDTIyMDEwNzAw MDAwMFoXDTI1MDEwNjIzNTk1OVowJDEiMCAGCSqGSIb3DQEJARYTZHdtdzJAaW5mcmFkZWFkLm9y ZzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALQ3GpC2bomUqk+91wLYBzDMcCj5C9m6 oZaHwvmIdXftOgTbCJXADo6G9T7BBAebw2JV38EINgKpy/ZHh7htyAkWYVoFsFPrwHounto8xTsy SSePMiPlmIdQ10BcVSXMUJ3Juu16GlWOnAMJY2oYfEzmE7uT9YgcBqKCo65pTFmOnR/VVbjJk4K2 xE34GC2nAdUQkPFuyaFisicc6HRMOYXPuF0DuwITEKnjxgNjP+qDrh0db7PAjO1D4d5ftfrsf+kd RR4gKVGSk8Tz2WwvtLAroJM4nXjNPIBJNT4w/FWWc/5qPHJy2U+eITZ5LLE5s45mX2oPFknWqxBo bQZ8a9dsZ3dSPZBvE9ZrmtFLrVrN4eo1jsXgAp1+p7bkfqd3BgBEmfsYWlBXO8rVXfvPgLs32VdV NZxb/CDWPqBsiYv0Hv3HPsz07j5b+/cVoWqyHDKzkaVbxfq/7auNVRmPB3v5SWEsH8xi4Bez2V9U KxfYCnqsjp8RaC2/khxKt0A552Eaxnz/4ly/2C7wkwTQnBmdlFYhAflWKQ03Ufiu8t3iBE3VJbc2 5oMrglj7TRZrmKq3CkbFnX0fyulB+kHimrt6PIWn7kgyl9aelIl6vtbhMA+l0nfrsORMa4kobqQ5 C5rveVgmcIad67EDa+UqEKy/GltUwlSh6xy+TrK1tzDvAgMBAAGjggHMMIIByDAfBgNVHSMEGDAW gBQJwPL8C9qU21/+K9+omULPyeCtADAdBgNVHQ4EFgQUzMeDMcimo0oz8o1R1Nver3ZVpSkwDgYD VR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMC MEAGA1UdIAQ5MDcwNQYMKwYBBAGyMQECAQEBMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2VjdGln by5jb20vQ1BTMFoGA1UdHwRTMFEwT6BNoEuGSWh0dHA6Ly9jcmwuc2VjdGlnby5jb20vU2VjdGln b1JTQUNsaWVudEF1dGhlbnRpY2F0aW9uYW5kU2VjdXJlRW1haWxDQS5jcmwwgYoGCCsGAQUFBwEB BH4wfDBVBggrBgEFBQcwAoZJaHR0cDovL2NydC5zZWN0aWdvLmNvbS9TZWN0aWdvUlNBQ2xpZW50 QXV0aGVudGljYXRpb25hbmRTZWN1cmVFbWFpbENBLmNydDAjBggrBgEFBQcwAYYXaHR0cDovL29j c3Auc2VjdGlnby5jb20wHgYDVR0RBBcwFYETZHdtdzJAaW5mcmFkZWFkLm9yZzANBgkqhkiG9w0B AQsFAAOCAQEAyW6MUir5dm495teKqAQjDJwuFCi35h4xgnQvQ/fzPXmtR9t54rpmI2TfyvcKgOXp qa7BGXNFfh1JsqexVkIqZP9uWB2J+uVMD+XZEs/KYNNX2PvIlSPrzIB4Z2wyIGQpaPLlYflrrVFK v9CjT2zdqvy2maK7HKOQRt3BiJbVG5lRiwbbygldcALEV9ChWFfgSXvrWDZspnU3Gjw/rMHrGnql Htlyebp3pf3fSS9kzQ1FVtVIDrL6eqhTwJxe+pXSMMqFiN0whpBtXdyDjzBtQTaZJ7zTT/vlehc/ tDuqZwGHm/YJy883Ll+GP3NvOkgaRGWEuYWJJ6hFCkXYjyR9IzCCBhQwggT8oAMCAQICEQDGvhmW Z0DEAx0oURL6O6l+MA0GCSqGSIb3DQEBCwUAMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3Jl YXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0 ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJl IEVtYWlsIENBMB4XDTIyMDEwNzAwMDAwMFoXDTI1MDEwNjIzNTk1OVowJDEiMCAGCSqGSIb3DQEJ ARYTZHdtdzJAaW5mcmFkZWFkLm9yZzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALQ3 GpC2bomUqk+91wLYBzDMcCj5C9m6oZaHwvmIdXftOgTbCJXADo6G9T7BBAebw2JV38EINgKpy/ZH h7htyAkWYVoFsFPrwHounto8xTsySSePMiPlmIdQ10BcVSXMUJ3Juu16GlWOnAMJY2oYfEzmE7uT 9YgcBqKCo65pTFmOnR/VVbjJk4K2xE34GC2nAdUQkPFuyaFisicc6HRMOYXPuF0DuwITEKnjxgNj P+qDrh0db7PAjO1D4d5ftfrsf+kdRR4gKVGSk8Tz2WwvtLAroJM4nXjNPIBJNT4w/FWWc/5qPHJy 2U+eITZ5LLE5s45mX2oPFknWqxBobQZ8a9dsZ3dSPZBvE9ZrmtFLrVrN4eo1jsXgAp1+p7bkfqd3 BgBEmfsYWlBXO8rVXfvPgLs32VdVNZxb/CDWPqBsiYv0Hv3HPsz07j5b+/cVoWqyHDKzkaVbxfq/ 7auNVRmPB3v5SWEsH8xi4Bez2V9UKxfYCnqsjp8RaC2/khxKt0A552Eaxnz/4ly/2C7wkwTQnBmd lFYhAflWKQ03Ufiu8t3iBE3VJbc25oMrglj7TRZrmKq3CkbFnX0fyulB+kHimrt6PIWn7kgyl9ae lIl6vtbhMA+l0nfrsORMa4kobqQ5C5rveVgmcIad67EDa+UqEKy/GltUwlSh6xy+TrK1tzDvAgMB AAGjggHMMIIByDAfBgNVHSMEGDAWgBQJwPL8C9qU21/+K9+omULPyeCtADAdBgNVHQ4EFgQUzMeD Mcimo0oz8o1R1Nver3ZVpSkwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYw FAYIKwYBBQUHAwQGCCsGAQUFBwMCMEAGA1UdIAQ5MDcwNQYMKwYBBAGyMQECAQEBMCUwIwYIKwYB BQUHAgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMFoGA1UdHwRTMFEwT6BNoEuGSWh0dHA6Ly9j cmwuc2VjdGlnby5jb20vU2VjdGlnb1JTQUNsaWVudEF1dGhlbnRpY2F0aW9uYW5kU2VjdXJlRW1h aWxDQS5jcmwwgYoGCCsGAQUFBwEBBH4wfDBVBggrBgEFBQcwAoZJaHR0cDovL2NydC5zZWN0aWdv LmNvbS9TZWN0aWdvUlNBQ2xpZW50QXV0aGVudGljYXRpb25hbmRTZWN1cmVFbWFpbENBLmNydDAj BggrBgEFBQcwAYYXaHR0cDovL29jc3Auc2VjdGlnby5jb20wHgYDVR0RBBcwFYETZHdtdzJAaW5m cmFkZWFkLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAyW6MUir5dm495teKqAQjDJwuFCi35h4xgnQv Q/fzPXmtR9t54rpmI2TfyvcKgOXpqa7BGXNFfh1JsqexVkIqZP9uWB2J+uVMD+XZEs/KYNNX2PvI lSPrzIB4Z2wyIGQpaPLlYflrrVFKv9CjT2zdqvy2maK7HKOQRt3BiJbVG5lRiwbbygldcALEV9Ch WFfgSXvrWDZspnU3Gjw/rMHrGnqlHtlyebp3pf3fSS9kzQ1FVtVIDrL6eqhTwJxe+pXSMMqFiN0w hpBtXdyDjzBtQTaZJ7zTT/vlehc/tDuqZwGHm/YJy883Ll+GP3NvOkgaRGWEuYWJJ6hFCkXYjyR9 IzGCBMcwggTDAgEBMIGsMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVz dGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMT NVNlY3RpZ28gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhEA xr4ZlmdAxAMdKFES+jupfjANBglghkgBZQMEAgEFAKCCAeswGAYJKoZIhvcNAQkDMQsGCSqGSIb3 DQEHATAcBgkqhkiG9w0BCQUxDxcNMjQwMTE2MTExNzQyWjAvBgkqhkiG9w0BCQQxIgQg9BTjuXnY p5Iin267dpz0Z4hCzyHDp35CEDLHjvDPwLQwgb0GCSsGAQQBgjcQBDGBrzCBrDCBljELMAkGA1UE BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYG A1UEChMPU2VjdGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBDbGllbnQgQXV0aGVu dGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRAMa+GZZnQMQDHShREvo7qX4wgb8GCyqGSIb3 DQEJEAILMYGvoIGsMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVy MRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNl Y3RpZ28gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhEAxr4Z lmdAxAMdKFES+jupfjANBgkqhkiG9w0BAQEFAASCAgBXwCMXIx6ktsiS5gw8Bw6s4riFGYPeRTsu v81aV7MghC8eKCzSFLFNwEyTMhUqaaVdFJVy+wY+4Z6Vxz2osLyvG3+8Oa8WRURgYoxdzHXEcKBi HPB8LoxzwhjczxTtJWyi1XKOV07MLVuxfN4bqaNEiWNAVCy+K9S3gTtSV83gKXJPe0I/Mu1l34ev mQE7ijM8B9OEiohWoWL27yp2XNjKObdWsxDx7U+tdgqELF9dmY3Jc2Qahe8LaugPG4TSVMtqoVld zjwS8vQlQVDee5STD5LdyOJq5PEeDiVbRdQoLxb7Fq3253Xc8CzFNC6alKlq9RWOZCD3Ro9o8L9p EAPJYzlhEXezDj0l5VwK+D2EiO63G2J1UAGpseoK7UqM0cR8QLU8FFeL+6TRZg33Nuk2DUsxeLPJ /O3UlZbPYKa1BAdreTYKIv4p867J95ZOXH0PyDVAvZtIAxhLcG9hLku8NQ6gKaGfmmmJpAHapMwo sXEzXDVUT4lZrB+cETTXsOnq+7gTF/JExtPB1LMyq+VVN1V6pzbw/T4cCwUu3Q163ApBz6ec54DY hVainVoeBizlu8EoJ2vM4CNLbpjQcbF31MsVgcYDTBVpQZPkI4Zs2hLCMqJugML18//GVZ3Uk7PP FmvugLx3sKyhv9jmydimy/NELhHUbq82MTxd8Xxo+gAAAAAAAA== --=-wBkOHYCZim5yjylDsUJB--