Received-SPF: pass (google.com: domain of linux-kernel+bounces-41965-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Message-ID: <8c29d66d-b17d-4185-988c-de078566d0da@illinois.edu>
Date: Sun, 28 Jan 2024 15:25:59 -0600
User-Agent: Mozilla Thunderbird
Subject: Re: [RFC PATCH 1/2] x86/kprobes: Prohibit kprobing on INT and UD
Content-Language: en-US
To: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>,
        Borislav Petkov <bp@alien8.de>,
        Dave Hansen <dave.hansen@linux.intel.com>, x86@kernel.org,
        "H. Peter Anvin" <hpa@zytor.com>,
        Peter Zijlstra <peterz@infradead.org>,
        linux-trace-kernel@vger.kernel.org, linux-kernel@vger.kernel.org
References: <20240127044124.57594-1-jinghao7@illinois.edu>
 <20240127044124.57594-2-jinghao7@illinois.edu>
 <20240128101912.5ad6717347bd66089ecea03a@kernel.org>
From: Jinghao Jia <jinghao7@illinois.edu>
Autocrypt: addr=jinghao7@illinois.edu; keydata=
 xsFNBGJmFCsBEADTCP2WqIboXB/QxPFGOxAhbbstER2dlqRLID5Rh/lYLiRfTiAe23c4vxNy
 zi+pgSd7aRdmx+OCFZr3YP/SjNDiyI4u1H7RcOe2Zucoh+uWmK2dwrPWSix/ZP91VbHhN12H
 LnHc9PBCVV+14qMfYgmV/JS2274WjzYYXwG19celZbCZ9RplAQ8RGIc9HtBTFFrphyNoJsNS
 I0yCCgr8TnmVcXxibsJ+61QA9XrEtIQubAV19XG9by1bK+VNc0Q+e5gn0MZjksbEDHzrJoR9
 6Oa3E1xVWVmUaUG6lV1W5FvsX1q3GrULv/meuxgLwpj9sPqgdcybQkNvZbEdeKMoRbfP+RSw
 M+S4awIIsORlVOrhbdVoBjqJRGUB+FpmVdW6m1Kf1gpCD7d1Kb3+Pj8iF4oF4m/j2AyZLYt2
 drYWtqvbc6adYkR2sBoBG6/opZzjMtrKycb7KHwR2y6KG9KXuYUdbeTbmpN0do0Adk3LRBEX
 rbt7/6pYYGmN00PlmMihWannS/m7O8i0yeoSv1UZzI2K3D8Z8hzExqToIKe4Lo3rdO5tBiAB
 9IX6U3pF3KXT4E++cTXuTLtEx5B0TsStFFhhmvClN5Wj/sK09ImICsHPZzI2C458oFOr249k
 dHJiJq0ArkX5/AWCRB4CxeOX3Xzq+QT0buYP3lyFSBlAX8+vHQARAQABzSNKaW5naGFvIEpp
 YSA8amluZ2hhbzdAaWxsaW5vaXMuZWR1PsLBkQQTAQgAOxYhBNv2c07SQxSLITfwQS/YbmoX
 DzVGBQJiZhQrAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEC/YbmoXDzVGJssP
 /35kHcXfY7+WExsvNYRxk1N7zgGKv5R38XjXhTix/KCVSWE11kV2SZrvptzNLFSaNSo/5/ho
 nLDPyN6lzYp/QkSjgTR5VwGRPbWgHgD8VCssvwfnqidS8P98xxO6yCinljpT/69hVkZQGtBD
 gfvO58i+xCD2XSXvkwB8xCJzesewLQlVoBiVio/XqG3lpmObD4ajWX20bryN8NXiDU7XLCkw
 w2dnjhbxY5SJ5tcALNLsAthfbLaH7FEF8vV39kSDN8WbVVUEZgBQyb4ccvNJbL/FBSF2Zuqx
 5jFuU0KXTjtSoDgwhFrIRnKOdnUtcYApVGTINLMdPWw4zohj1+C10qAZXAU0yLfgW9Zmfsbz
 8Y85wlHyRZ5PoverBJsHz2X60WMpbKa49Y6QlO2Q6NGMLJePS1l8802gKJIJObSOFndxylzz
 u8NVHADTjZbnS/rTpyQPnxDQHxZ4QBAxrII0EQW/sWITavie4k6Ioq+1MKmPXL8/l9dewFv+
 DS/Fhqn9dtUn60tMhSFvI2POcdsO0ifvh6NbUZicFiBxHW3Z47GYR4ycyPvAC0ZX5meTgZxM
 cFTM4ZdrZ4ad6QFoRKgwc6CWYO04iMA2ZAaMFgRIO/sGcWfkQNYBjhxGgOzv8Jwxqb5ZLDsI
 ckhJHlqtqtmhe9hs5fmgOQ+ngJ5pMtNfHa3nzsFNBGJmFCsBEADHmktrrGPdfz2LE9sFvwEg
 KFWqEAayYqbpeYtKtH2c2LhWpvquOHa8D6/wREl+0bwrrcIpIWuE2l38EX+oEzu5Xyat0LbG
 vjdaDyq/h1muEi61poEUz/DmKAM+t0w9M+FBh9Uvdw5sTNKvSgaliHI2x6vpJt8EMt2FRMzQ
 qaCfDDvFIxYjtLHENnC8510Yu4HIhJcTvHErOu2b5vAg69wrmpXxyCZVL8qesXUsQQ+NXByZ
 ahT9uRSi9D/19Pkgf7uH9AvMKpsbnWpj3Nt0KXusa7q0SJ6ndZFoNI9rrUsP7IBRWb5h86Q9
 kexMtHoH9GZqsm9lobRu28Z9b/65Ih660c02OusPDVS41aPXhB7T1E7kle5qz4/TSLbuZW6V
 QVpHPKCk4WyLHikwSoeQ7mY8RE/3/xLL5jFkyHgvgK4kNJikQYEsRPmnG6j0hrLC5PPNC9T8
 NnaxpS+u9FAptmhtGxam3J1z1SKuggvrvwm+W/opWUht8MXFri08SGfw6jouLKva27GukRAG
 fA6vxycZ15w1jA3qaHxxr0Io8dlFq3XC4DIY7dCGY7hgWE+AI08Gg/fDZBhlVRlNR6qJOrd4
 UghTkWSGkNNDylo1DR4owwullflaGJ70HBTf7kMb+jHz52VQVX7V4kBDHbBMXsIGmMmTqAKw
 5+go59sGUlphkwARAQABwsF2BBgBCAAgFiEE2/ZzTtJDFIshN/BBL9huahcPNUYFAmJmFCsC
 GwwACgkQL9huahcPNUY9YQ//ZAtnmAtPZNShs6E4M9IWao8y8jNXhN5ERErnL8V3BovKQQyN
 /+ogy6IFlssyQbjz2Q5B+5bKitVVFw9k/wK8bnS3TMlptahSLyD+pv3pv6F2JBZcjSap9/Sx
 oLzL7Gv7tZPFRA8DdKrA8kGFjWzuH4obGE8K/qapdYgPYpUtjfLC8jVieZ6RMPV10GBjkIII
 MTU7Rgr/BOz0gRm+VnvEg3T5hZLMS2APPdOwwcVjteVz68OGMlhWxyeItdyL9y/bM6b93k7o
 0cBFBrZEjZZtK3QBGL8mq8uRu7RWb6qG5K3YMg3ccJWO7oFhsbKEOQSUFI1vp7H8quRCwDHn
 GYFDxX+gx7nm7eURvgYYr+rN9xkQUKvRa/R7i8TKkdsYUMAnXHsyyNUW8lgh14EKmDd99U+E
 n9Dscfu/R/Ne/n/NpEpPcWmYfFE5vAUa3Mx+5WBzA+qLb4fUa5VtLomLso+/jf4Vf3epUT8d
 mLgXMG27L9/eYEDR5/RSkdi8FBzkbOpuFsoeGEFmAFBgBxbNe9KuUQRH1dicnsuRpBmElHeo
 o7jc2Rfr9CJl5B7wrSs5jC2UbRcmOR8kIWNOebxP2b5tcRLJcU4b//E5hbwkaJTsAwLBNrfy
 kjbbUMJwLp0QlMt2z2YYHIcx6WkKlaouaPfg06CnTz8cz2dpcbvhi0xfBp8=
In-Reply-To: <20240128101912.5ad6717347bd66089ecea03a@kernel.org>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------VBPF9Wx84JQ0QpTl970cFOqB"
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?REpMZTVzdmhvRWhsc0V4NEFKd0J3d0JJejhhV2Y3aGtLck9vM3kzSHhsRHRx?=
 =?utf-8?B?WXdydkM4c0JyYjkreW51Wk9GYXFsVjZiMmxOOE5lbjRKdFZ1cFdzSitacCth?=
 =?utf-8?B?Vmg0amU0Uk8xM3IveFZjWEkxU2pPRVBPc2laeTFZWXpRTjFqL1VZRmNlZWw4?=
 =?utf-8?B?clRFYnBoblBhSHI0YVJVZGpzUm9mYlVMcUE5a0RsdjVlMm52aWdmZTBOSUp3?=
 =?utf-8?B?RCt1VnhVdmxWNFZoa05Vd2h4VFJIODZJc1lRMmgyQ0NyOHE4ODNuSWx2SmlX?=
 =?utf-8?B?dGgydlV0cWU3eTJodHVqT3lNd3hlL3JtY2JlWHBMUEROcm5yNkpETStCNko4?=
 =?utf-8?B?QmxtRUVlOTJIWmRCeGVkeDhoS0Q2VXZGZW1vbmNqRjdIVnJTVkNMeTMvYzhC?=
 =?utf-8?B?d1pRRUdwWElvVFdralVrbDEyejNLS0FnM1NoYXRZeE05VG9vK2phTFk3RnpV?=
 =?utf-8?B?WXgweXh4YmEwa3FFYTQvQjQwTW9jQXF0cXpndjdhY2RxaExEZUtzNzkxc2Y4?=
 =?utf-8?B?dnhoRVJaeVlSS3AxMG9HcW1DOWlBNnJsaTUweHpPdEhqSUZXdzNlNWR4djVL?=
 =?utf-8?B?cUhkOVVFTjlQTFV2S3cyZFM2eEFKejJtVVVnTkFVNDBEZTdiTWlBZlFZdEVQ?=
 =?utf-8?B?VFNFV2NFSWxQd3d3RkliU0UxZTA2b29nZU5FcnFQbTl1cTh2UHExWmU3SU5M?=
 =?utf-8?B?RnVQa0ttTFU3M1pEcHRKZHpEVm9VeVNIQmx3Z2o5TnJSRG1PUWhNSEZMbHM1?=
 =?utf-8?B?ZWxRcXh0Z2pQVUlJYlBSWjRzbWg0dnhOdmZNbjYydHVYQndZK3Z6cUdRRG1y?=
 =?utf-8?B?dm1vSUpicVJDQjVWdVl5OU9oc0N4bnduWlJXbHFSVU9ic1c4QkhnQVRiRmxR?=
 =?utf-8?B?YXlsR0VoQ3F1WkowMTJLYjlZZDFFY3R2M1NKSVZrMTBBMm9qblZYVk03YlZx?=
 =?utf-8?B?cTBDd1VIS3BQVzZlY3JtOUhhTlFSTkhPODA3WDVnUTFqYjU1RVNHWHpVZ2VY?=
 =?utf-8?B?Qytyc2pVcE1ReHY5QUxTdndpZU5LelpyRUwwUzdsYVJmZVdSL2NXTytXWjh0?=
 =?utf-8?B?VzgrcS9IVytUVWhDYVp0cTJRb1I5ZkxtQ0hzeGR2My8wK1dBRExWaGN6WVNO?=
 =?utf-8?B?elpIVWY2dUVUQlBiNGJMb3RkdFR3dFA1aEJuRWtLWmJKODFuemd6dXh1YjRv?=
 =?utf-8?B?b3oyU1ZKQXJoQnZJbzVJSVZ6N0FJM1Iwb1BUa3R1M3ZIcDBIRHhuS1pZRDBi?=
 =?utf-8?B?b2hYbkRWd04zN2ljWkplTEx0R0hDMUJqUmpRTkpqcFpIV2MzRy9wbEVxaTZM?=
 =?utf-8?B?dm5OaW55aUxjZDVzcms4SnRCVnBGbXZXcVhRYWlsVkRQbFlKS0Q1L3JzSzMz?=
 =?utf-8?B?Y2FRVFNvbzh4VndnTEt2d0s5bGVJL1g2VE05UDMwRm1BYUl6bitqajJ4SjhD?=
 =?utf-8?B?RWtiZWJ2amprdDJCWTYrZ3puVE9PTURtUEw1QW5YeUZvZGVxeEZSQjRhanJ1?=
 =?utf-8?B?RE1hb2ZsVFRhNUlSaWVia24wbTkwWWpNdlhSTVVyeTh0NDd3WEZRODJoZk51?=
 =?utf-8?B?eXQ0dklGYkFrc2U5MVl6WmcyQk9xenludkk5OXFyRmpveUwzdHRLc3dUUjFR?=
 =?utf-8?B?VHQ3S2RHcmJHSUZOQ3RFUGtvYnduQnhLcmRQMnh5TGljeEdzRFFHZ3dqV2s1?=
 =?utf-8?B?RDJXR2hGaFg2VWRGQm1tb1V3WWlJMitYT2FMOXo1ZnVtZk92T1A2Z0tFTWFI?=
 =?utf-8?B?VVJObWlTZVZUQldwTTRwZUZDckdUR21OSHBtTCtLVGtOZTJqU0E2MWZxQjRT?=
 =?utf-8?B?Q3lyQkRaK0hWbEkwcnZ4UUxFMWs4eXByUGYwZ1NDcDgzdGJabWRPcVdiSW4r?=
 =?utf-8?B?d0IyOWtTSmpKRzFGaUVUaWhnUzlhZTNFOW9JOENPUkt5d1dHSjZJOGlibVUv?=
 =?utf-8?B?UjM4YUhUTGVoOWd2WEsrN2poWVBuL01yTU9rQ3RuektmZVZJUndZalF6eDdR?=
 =?utf-8?B?MEVwaVRxd01YOEpLbldPckUvMElORDVkVW82Z3VQR1E4d01FNlZRR2pRaUdi?=
 =?utf-8?B?bVBoQTZtWjdYL0dhMW5FMHBuYzFVWWFMaDJ3MVdjeU14dkdtZTh5RUlaWW0r?=
 =?utf-8?B?ZFl6WjhZVGFJRmw1QjByRzNLeFBCNlJDeExaS0lUbjhFSzhjK3Evb09xcjRl?=
 =?utf-8?Q?n1Ix0SH3Ro+wIlFNT5RpTZjRHA5gfOGd95HBMPSIfGDJ?=
X-OriginatorOrg: illinois.edu
X-MS-Exchange-CrossTenant-Network-Message-Id: 4f28132c-6a2b-48a8-0e60-08dc2047b9af
X-MS-Exchange-CrossTenant-AuthSource: IA1PR11MB7272.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jan 2024 21:26:01.0866
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 44467e6f-462c-4ea2-823f-7800de5434e3
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: CCyyMnJ46PiLDINL+k0J6hOzaPk8eYCViQTvo9KCR3ntwfZzkn/NipZdW20sOMNrREsz/CneeCU2tV+94UJqTg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR11MB7992
X-Proofpoint-ORIG-GUID: Do_UOlnmRfc2me_o7Or8VIR7fqrn1xFd
X-Proofpoint-GUID: Do_UOlnmRfc2me_o7Or8VIR7fqrn1xFd
X-Spam-Details: rule=cautious_plus_nq_notspam policy=cautious_plus_nq score=0 clxscore=1015
 bulkscore=0 priorityscore=1501 spamscore=0 mlxscore=0 impostorscore=0
 mlxlogscore=999 malwarescore=0 lowpriorityscore=0 adultscore=0
 suspectscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx
 scancount=1 engine=8.12.0-2311290000 definitions=main-2401280162
X-Spam-Score: 0
X-Spam-OrigSender: jinghao7@illinois.edu
X-Spam-Bar: 

--------------VBPF9Wx84JQ0QpTl970cFOqB
Content-Type: multipart/mixed; boundary="------------EWNTiMAG0EiD9ghrNOmNd94i";
 protected-headers="v1"
From: Jinghao Jia <jinghao7@illinois.edu>
To: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>,
 Borislav Petkov <bp@alien8.de>, Dave Hansen <dave.hansen@linux.intel.com>,
 x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
 Peter Zijlstra <peterz@infradead.org>, linux-trace-kernel@vger.kernel.org,
 linux-kernel@vger.kernel.org
Message-ID: <8c29d66d-b17d-4185-988c-de078566d0da@illinois.edu>
Subject: Re: [RFC PATCH 1/2] x86/kprobes: Prohibit kprobing on INT and UD
References: <20240127044124.57594-1-jinghao7@illinois.edu>
 <20240127044124.57594-2-jinghao7@illinois.edu>
 <20240128101912.5ad6717347bd66089ecea03a@kernel.org>
In-Reply-To: <20240128101912.5ad6717347bd66089ecea03a@kernel.org>

--------------EWNTiMAG0EiD9ghrNOmNd94i
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable


On 1/27/24 19:19, Masami Hiramatsu (Google) wrote:
> On Fri, 26 Jan 2024 22:41:23 -0600
> Jinghao Jia <jinghao7@illinois.edu> wrote:
>=20
>> Both INTs (INT n, INT1, INT3, INTO) and UDs (UD0, UD1, UD2) serve
>> special purposes in the kernel, e.g., INT3 is used by KGDB and UD2 is
>> involved in LLVM-KCFI instrumentation. At the same time, attaching
>> kprobes on these instructions (particularly UDs) will pollute the stac=
k
>> trace dumped in the kernel ring buffer, since the exception is trigger=
ed
>> in the copy buffer rather than the original location.
>>
>> Check for INTs and UDs in can_probe and reject any kprobes trying to
>> attach to these instructions.
>>
>=20
> Thanks for implement this check!
>=20

You are very welcome :)

>=20
>> Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
>> Signed-off-by: Jinghao Jia <jinghao7@illinois.edu>
>> ---
>>  arch/x86/kernel/kprobes/core.c | 33 ++++++++++++++++++++++++++-------=

>>  1 file changed, 26 insertions(+), 7 deletions(-)
>>
>> diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/=
core.c
>> index e8babebad7b8..792b38d22126 100644
>> --- a/arch/x86/kernel/kprobes/core.c
>> +++ b/arch/x86/kernel/kprobes/core.c
>> @@ -252,6 +252,22 @@ unsigned long recover_probed_instruction(kprobe_o=
pcode_t *buf, unsigned long add
>>  	return __recover_probed_insn(buf, addr);
>>  }
>> =20
>> +static inline int is_exception_insn(struct insn *insn)
>> +{
>> +	if (insn->opcode.bytes[0] =3D=3D 0x0f) {
>> +		/* UD0 / UD1 / UD2 */
>> +		return insn->opcode.bytes[1] =3D=3D 0xff ||
>> +		       insn->opcode.bytes[1] =3D=3D 0xb9 ||
>> +		       insn->opcode.bytes[1] =3D=3D 0x0b;
>> +	} else {
>=20
> If "else" block just return, you don't need this "else".
>=20
> bool func()
> {
> 	if (cond)
> 		return ...
>=20
> 	return ...
> }
>=20
> Is preferrable because this puts "return val" always at the end of non-=
void
> function.
>=20

I will fix this in the v2.

>> +		/* INT3 / INT n / INTO / INT1 */
>> +		return insn->opcode.bytes[0] =3D=3D 0xcc ||
>> +		       insn->opcode.bytes[0] =3D=3D 0xcd ||
>> +		       insn->opcode.bytes[0] =3D=3D 0xce ||
>> +		       insn->opcode.bytes[0] =3D=3D 0xf1;
>> +	}
>> +}
>> +
>>  /* Check if paddr is at an instruction boundary */
>>  static int can_probe(unsigned long paddr)
>>  {
>> @@ -294,6 +310,16 @@ static int can_probe(unsigned long paddr)
>>  #endif
>>  		addr +=3D insn.length;
>>  	}
>> +	__addr =3D recover_probed_instruction(buf, addr);
>> +	if (!__addr)
>> +		return 0;
>> +
>> +	if (insn_decode_kernel(&insn, (void *)__addr) < 0)
>> +		return 0;
>> +
>> +	if (is_exception_insn(&insn))
>> +		return 0;
>> +
>=20
> Please don't put this outside of decoding loop. You should put these in=

> the loop which decodes the instruction from the beginning of the functi=
on.
> Since the x86 instrcution is variable length, can_probe() needs to chec=
k
> whether that the address is instruction boundary and decodable.
>=20
> Thank you,

If my understanding is correct then this is trying to decode the kprobe
target instruction, given that it is after the main decoding loop.  Here =
I
hoisted the decoding logic out of the if(IS_ENABLED(CONFIG_CFI_CLANG))
block so that we do not need to decode the same instruction twice.  I lef=
t
the main decoding loop unchanged so it is still decoding the function fro=
m
the start and should handle instruction boundaries. Are there any caveats=

that I missed?

--Jinghao

>=20
>>  	if (IS_ENABLED(CONFIG_CFI_CLANG)) {
>>  		/*
>>  		 * The compiler generates the following instruction sequence
>> @@ -308,13 +334,6 @@ static int can_probe(unsigned long paddr)
>>  		 * Also, these movl and addl are used for showing expected
>>  		 * type. So those must not be touched.
>>  		 */
>> -		__addr =3D recover_probed_instruction(buf, addr);
>> -		if (!__addr)
>> -			return 0;
>> -
>> -		if (insn_decode_kernel(&insn, (void *)__addr) < 0)
>> -			return 0;
>> -
>>  		if (insn.opcode.value =3D=3D 0xBA)
>>  			offset =3D 12;
>>  		else if (insn.opcode.value =3D=3D 0x3)
>> --=20
>> 2.43.0
>>
>=20
>=20

--------------EWNTiMAG0EiD9ghrNOmNd94i--

--------------VBPF9Wx84JQ0QpTl970cFOqB
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEE2/ZzTtJDFIshN/BBL9huahcPNUYFAmW2xmcFAwAAAAAACgkQL9huahcPNUYT
gg//ebb8+xpW43FCUQpu9Y0ov4EXDQ0RlpvU+w+sSSbmmtLEtKW0xw82Rigg/0VvMkA1h9NFLViW
G3OEVZMDODf6jDzyIMeDqe8nz5TAVI4/ersvJPmijz77jN3knlvZLoNamNCaXFtu4PXRK0qbZipd
Q7mIjiOrB6ShYQxU6aEcZpRqFnOgv/s2X3MomRZVBiOo4hu4pJAJwwjWGnVSUrPwcVCrn49HbcDg
L39/bSGhw7NXxECdig+8wAGLHEg6sIWLkTDB4Ab4WRE4bjDR/VF98MM8JBLibUVBxfvtGdowY5WH
82NLPYlnBXM3fCzOw7uqowph43pjBIboMc/4pfwf96ECC2v8T+qJvIOP/MWNzbh1ZNN/Jq9k+kfD
XGqjz52zT9MSKMAK72OS7L7kfIJSVblHiEJlLJPATqfEyn3BGDI8BTSLiffJ+DsQ2LKNkEerxMFO
2C6K7ZUY/d/ovEQI2RncMwKCYrGbOfCgJ18nE6tKxDoXrusG36L++56QIl6EGlM7qR6nM+z6dJhd
n29F/IwKyFBy/eXOTd85K1lTemmRmHbA1wiWyerhWBWKqQw5yq5WEfh6p/FHlT3ND8veNpRGj+ZE
pTS68GChpGhmDLJ/NQOD3dpvSHzYOXkAOZH/LDU2iz1MZ2c1akr4RYbUKHZOWdnOc0ftjc1zyqe8
Wu8=
=Hn/Q
-----END PGP SIGNATURE-----

--------------VBPF9Wx84JQ0QpTl970cFOqB--