From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x226+iPIxUpblqPXoO9c5TrIW5S8PMSX1GZhJNymB4v5pYko99CHFkBiNqF1uOtxs9Nsgses6 ARC-Seal: i=1; a=rsa-sha256; t=1517213790; cv=none; d=google.com; s=arc-20160816; b=tRS57V1Q4xyJqlkG1VAxrre2eyv4wW2g626HBE1YBk8go49jY7BOwY+3M3zseP4hM+ IUvwXefuoXjIf2/IDP7FzGwAsiOVYt9Bgqn+AfxjpbwIz+dXDh38uWcs9xOOT0loA7qU U514xjlmU6W+LxkUV2aaauP8RDVHdJjpv1+WawSicG9BXFELMZ8qZPKUpEVyBBg4Qr5I bDlhYUCpx2KPOWwwVXlFLCwaEVhQSjr5/qlAmritPtKv2l5MoacSm/L+93rvRoXU5Acb cLBg/qGOj2/bwTs08K+QetYnu+nkqkpasoD+PcpZ2S29pXB3TdWUOh+lgB/3PTiEtSNa JCcQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:date:face:references:in-reply-to:cc:to:from:subject :message-id:dkim-signature:arc-authentication-results; bh=UfGdDlwIiJm2IZ+Tmq09VZHNxIOIPYQIMIxACUj1J7o=; b=YYh+asoQ3KZXvfrkU/b3eJpZQesBlqqkuQh0/Bl4ErCiKJ8HgRLnaDr72oeyqDbGaY 9FGG1Gj7MgjD7vOVwdRMU6zHOTGX3dyPpm7uQmXgp/URvtfURqSagwEoQociOFB0TGw3 khXdc8M0PxXrW7Q7fdm6c7xIUELrjunJUn9EO+RvQcw+d/SmtK+OO0NDEsyp4T3ESgWy JFjzXG7pG5tJygcyYesdaX3rQPKR2SAl7EA1LpTa/3KXKUoVCwtP/bWn5o/FNWexfbU7 WyN9aAo1SXtkX6f60yCEef9kVx4FQ0Bv0USVSXlVXeThiqjv/l0cg1KQmIZWeH99XJTk y8mg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@infradead.org header.s=twosheds.20170209 header.b=HGS1IFqW; spf=pass (google.com: best guess record for domain of batv+012fdbe956077515f1b7+5272+infradead.org+dwmw2@twosheds.srs.infradead.org designates 90.155.92.209 as permitted sender) smtp.mailfrom=BATV+012fdbe956077515f1b7+5272+infradead.org+dwmw2@twosheds.srs.infradead.org Authentication-Results: mx.google.com; dkim=pass header.i=@infradead.org header.s=twosheds.20170209 header.b=HGS1IFqW; spf=pass (google.com: best guess record for domain of batv+012fdbe956077515f1b7+5272+infradead.org+dwmw2@twosheds.srs.infradead.org designates 90.155.92.209 as permitted sender) smtp.mailfrom=BATV+012fdbe956077515f1b7+5272+infradead.org+dwmw2@twosheds.srs.infradead.org Message-ID: <1517213749.6624.103.camel@infradead.org> Subject: Re: [PATCH v2 2/4] x86: vmx: Allow direct access to MSR_IA32_SPEC_CTRL From: David Woodhouse To: KarimAllah Ahmed , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Asit Mallick , Arjan Van De Ven , Dave Hansen , Andi Kleen , Andrea Arcangeli , Linus Torvalds , Tim Chen , Thomas Gleixner , Dan Williams , Jun Nakajima , Paolo Bonzini , Greg KH , Andy Lutomirski , Ashok Raj In-Reply-To: <1517187532-32286-3-git-send-email-karahmed@amazon.de> References: <1517187532-32286-1-git-send-email-karahmed@amazon.de> <1517187532-32286-3-git-send-email-karahmed@amazon.de> Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAG1BMVEUHBwcUFBQpKSlGRkZhYWF9fX2Xl5eysrLMzMxFF+rXAAACaElEQVQ4y21UQXbbIBQE9wJALmAg6ToWON22FrhZthHgbvssUPathC7QWMful2JHSmtWwGg+zPxBCE0DU4QoJQgRgsg4w2gJjBNE8PjFBZgnQMBs+uZ1NQNQjZO3BV4AGDFC0f+l4DBG0VUAM4yv7SO8IgRdHXQ+A78HKL5OAeCfNQV5cHX8DsBUyIJKtYbt98BKaGNCKjfgFVkqYVLbkHKsRsbSCSa0T6npIqLrpRBgQKHUpQmgs9eEKaiUcooE8WWfCGVnBiUcn1uF2XhbfmN9apKnmMP2K4kizKkQWxuaVNOpU2cACIyxO1Po8ETHcXEDMVnozcejkAYA9iaD4pU0ZvNQ8VurNnTuFAYVtuIPUZW25PjDIjQAlGyffIiRQxoWAZBmJ0LTdW2Nyc0iP3DqRhxizvGJkBWZmyFVyZkddWzmBoIBVMpCCJ1CFzl98xav4VJKSSD45KbUT75ixikTphDSRh8+Uz7JLgUTAgAFwzqzjxc/nDY7WUApqY0OMdTwCKZSXplSKkgIRCHElCp8ZnhnKqXuwcNbk1L0VXE+I9alUXoHlLHl3mv7/dWQlJwtjREC7mu9L/U2jQyMUuO2EDS4q9Kl2ddm232bxIE5pjJuVwiljNn/Cfv25/T0cu5cZbwHGVq7h/zp0B4n3S99V/utD+Uo8BiGx9xCsOAV5z7/tjo4Z4z1Lvb90KZ7eFOoOeXOukqF2seo234YYuaQPpRP+cVZU5adT1Edun5Iz3z8fTz3+eSDh0Ip1c7zx1MaijGzTd/3MbRuBHz8cvcVgCMBRpOHvgu59WDhoat+nIZm+LWm9C/aaaGq5DCP9QAAAABJRU5ErkJggg== Content-Type: multipart/signed; micalg="sha-256"; protocol="application/x-pkcs7-signature"; boundary="=-xgsXrhwA+GGYGWEBONvO" Date: Mon, 29 Jan 2018 08:15:49 +0000 Mime-Version: 1.0 X-Mailer: Evolution 3.18.5.2-0ubuntu3.2 X-SRS-Rewrite: SMTP reverse-path rewritten from by twosheds.infradead.org. See http://www.infradead.org/rpr.html X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590886477425007255?= X-GMAIL-MSGID: =?utf-8?q?1590913967700981387?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: --=-xgsXrhwA+GGYGWEBONvO Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, 2018-01-29 at 01:58 +0100, KarimAllah Ahmed wrote: > Add direct access to MSR_IA32_SPEC_CTRL for guests. This is needed for > guests that will only mitigate Spectre V2 through IBRS+IBPB and will not > be using a retpoline+IBPB based approach. >=20 > To avoid the overhead of atomically saving and restoring the > MSR_IA32_SPEC_CTRL for guests that do not actually use the MSR, only > add_atomic_switch_msr when a non-zero is written to it. >=20 > Cc: Asit Mallick > Cc: Arjan Van De Ven > Cc: Dave Hansen > Cc: Andi Kleen > Cc: Andrea Arcangeli > Cc: Linus Torvalds > Cc: Tim Chen > Cc: Thomas Gleixner > Cc: Dan Williams > Cc: Jun Nakajima > Cc: Paolo Bonzini > Cc: David Woodhouse > Cc: Greg KH > Cc: Andy Lutomirski > Cc: Ashok Raj > Signed-off-by: KarimAllah Ahmed >=20 > --- > v2: > - remove 'host_spec_ctrl' in favor of only a comment (dwmw@). > - special case writing '0' in SPEC_CTRL to avoid confusing live-migration > =C2=A0 when the instance never used the MSR (dwmw@). Possibly wants a comment in the code explaining this in slightly more detail. The point being that if we migrate a guest which has never used the MSR, we don't want the act of setting it to zero on resume to flip it into the auto-saved mode. =C2=A0 > - depend on X86_FEATURE_IBRS instead of X86_FEATURE_SPEC_CTRL (dwmw@). > - add MSR_IA32_SPEC_CTRL to the list of MSRs to save (dropped it by accid= ent). > --- > =C2=A0arch/x86/kvm/cpuid.c |=C2=A0=C2=A04 +++- > =C2=A0arch/x86/kvm/vmx.c=C2=A0=C2=A0=C2=A0| 65 ++++++++++++++++++++++++++= ++++++++++++++++++++++++++ > =C2=A0arch/x86/kvm/x86.c=C2=A0=C2=A0=C2=A0|=C2=A0=C2=A01 + > =C2=A03 files changed, 69 insertions(+), 1 deletion(-) >=20 > diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c > index 0099e10..32c0c14 100644 > --- a/arch/x86/kvm/cpuid.c > +++ b/arch/x86/kvm/cpuid.c > @@ -70,6 +70,7 @@ u64 kvm_supported_xcr0(void) > =C2=A0/* These are scattered features in cpufeatures.h. */ > =C2=A0#define KVM_CPUID_BIT_AVX512_4VNNIW=C2=A0=C2=A0=C2=A0=C2=A0=C2=A02 > =C2=A0#define KVM_CPUID_BIT_AVX512_4FMAPS=C2=A0=C2=A0=C2=A0=C2=A0=C2=A03 > +#define KVM_CPUID_BIT_IBRS=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A026 > =C2=A0#define KF(x) bit(KVM_CPUID_BIT_##x) > =C2=A0 > =C2=A0int kvm_update_cpuid(struct kvm_vcpu *vcpu) > @@ -392,7 +393,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_ent= ry2 *entry, u32 function, > =C2=A0 > =C2=A0 /* cpuid 7.0.edx*/ > =C2=A0 const u32 kvm_cpuid_7_0_edx_x86_features =3D > - KF(AVX512_4VNNIW) | KF(AVX512_4FMAPS); > + KF(AVX512_4VNNIW) | KF(AVX512_4FMAPS) | \ > + (boot_cpu_has(X86_FEATURE_IBRS) ? KF(IBRS) : 0); > =C2=A0 /* all calls to cpuid_count() should be made on the same cpu */ > =C2=A0 get_cpu(); I think we need to expose more feature bits than that. See https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?h=3Dx86= /pti&id=3D2961298efe1ea1b6fc0d7ee8b76018fa6c0bcef2 There are three AMD bits for IBRS, IBPB & STIBP which are the user- visible ones in /proc/cpuinfo, and the ones we use within the kernel to indicate the hardware availability (there are separate feature bits for when we're *using* IBPB etc., but that's only because feature bits are the only thing that ALTERNATIVEs can work from). In addition to those bits, Intel has its own. The Intel SPEC_CTRL CPUID bit (which you're setting above) indicates *both* IBRS and IBPB capability. The kernel sets the corresponding AMD bits when it sees SPEC_CTRL. Likewise Intel has a different bit for STIBP. You could construct a set of CPUID bits for the guest based on what the host has. So all three of the AMD IBRS/IBPB/STIBP bits in 80000008/EBX should just be passed through, and you could set the Intel SPEC_CTRL bit (7/EDX bit 26 that you're looking at above) only when you have X86_FEATURE_IBPB && X86_FEATURE_IBRS. And the Intel STIBP when you have X86_FEATURE_STIBP. The Intel ARCH_CAPABILITIES CPUID bit is separate. Pass that through if you have it, and expose the corresponding MSR read-only. > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > index aa8638a..dac564d 100644 > --- a/arch/x86/kvm/vmx.c > +++ b/arch/x86/kvm/vmx.c > @@ -920,6 +920,8 @@ static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, b= ool masked); > =C2=A0static bool nested_vmx_is_page_fault_vmexit(struct vmcs12 *vmcs12, > =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0u16 error_code); > =C2=A0static void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu); > +static void __always_inline vmx_disable_intercept_for_msr(unsigned long = *msr_bitmap, > + =C2=A0=C2=A0u32 msr, int type); > =C2=A0 > =C2=A0static DEFINE_PER_CPU(struct vmcs *, vmxarea); > =C2=A0static DEFINE_PER_CPU(struct vmcs *, current_vmcs); Perhaps move that whole function further up? > =C2=A0static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_o= ffset) > =C2=A0{ > =C2=A0 u64 guest_efer =3D vmx->vcpu.arch.efer; > @@ -3203,7 +3227,9 @@ static inline bool vmx_feature_control_msr_valid(st= ruct kvm_vcpu *vcpu, > =C2=A0 */ > =C2=A0static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_= info) > =C2=A0{ > + u64 spec_ctrl =3D 0; Could you ditch this additional variable and... > =C2=A0 struct shared_msr_entry *msr; > + struct vcpu_vmx *vmx =3D to_vmx(vcpu); > =C2=A0 > =C2=A0 switch (msr_info->index) { > =C2=A0#ifdef CONFIG_X86_64 > @@ -3223,6 +3249,20 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, stru= ct msr_data *msr_info) > =C2=A0 case MSR_IA32_TSC: > =C2=A0 msr_info->data =3D guest_read_tsc(vcpu); > =C2=A0 break; > + case MSR_IA32_SPEC_CTRL: > + if (!msr_info->host_initiated && > + =C2=A0=C2=A0=C2=A0=C2=A0!guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) > + return 1; > + > + /* > + =C2=A0* If the MSR is not in the atomic list yet, then the guest > + =C2=A0* never wrote a non-zero value to it yet i.e. the MSR value is > + =C2=A0* '0'. > + =C2=A0*/ ... =C2=A0 =C2=A0 if (read_atomic_switch_msr(vmx, MSR_IA32_SPEC_CTRL, &msr_info= ->data, NULL)) msr_info->data =3D 0; --=-xgsXrhwA+GGYGWEBONvO Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCEFQw ggUxMIIEGaADAgECAhBNRhEyk/HZ7naOeTHWrzuAMA0GCSqGSIb3DQEBCwUAMIGXMQswCQYDVQQG EwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYD VQQKExFDT01PRE8gQ0EgTGltaXRlZDE9MDsGA1UEAxM0Q09NT0RPIFJTQSBDbGllbnQgQXV0aGVu dGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTAeFw0xNzEyMjEwMDAwMDBaFw0xODEyMjEyMzU5 NTlaMCQxIjAgBgkqhkiG9w0BCQEWE2R3bXcyQGluZnJhZGVhZC5vcmcwggEiMA0GCSqGSIb3DQEB AQUAA4IBDwAwggEKAoIBAQDgzLNWa18DNpGUj/ZeH0Sgz53ESIbzdPw3OJeuNP6jZhxZojbyfxbM hETscxI/Hj6UZ4a7sHm5BkVjlsB1Af2Za/PXUt8MmLAcPMHkMPGunvkUibEvblDvpqMkQZlaZM+t 5PqFmWkbehLaEvbpNY7dmEAAeKh4klTzJzrr5AAzaCQ32cA2e3+DEIv5O5l9ViMIjy/JM+xMQrfX 3PZ0chY1PaVWjg59d4Uno+5LRDbgCnPkKJX4ysBGadibjBGQGJEZCjh94iiEebn2KsRLvtrJ72Ph 3W2HDEdngW3YP0wujFQVs81U7L8XN3kdPRsa9zNqGtYQP/+1KMMJQ57hnfi9AgMBAAGjggHpMIIB 5TAfBgNVHSMEGDAWgBSCr2yM+MX+lmF86B89K3FIXsSLwDAdBgNVHQ4EFgQUpL+/5lli9jmj2KHj ryyhnB2xRt0wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwIAYDVR0lBBkwFwYIKwYBBQUH AwQGCysGAQQBsjEBAwUCMBEGCWCGSAGG+EIBAQQEAwIFIDBGBgNVHSAEPzA9MDsGDCsGAQQBsjEB AgEBATArMCkGCCsGAQUFBwIBFh1odHRwczovL3NlY3VyZS5jb21vZG8ubmV0L0NQUzBaBgNVHR8E UzBRME+gTaBLhklodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9SU0FDbGllbnRBdXRoZW50 aWNhdGlvbmFuZFNlY3VyZUVtYWlsQ0EuY3JsMIGLBggrBgEFBQcBAQR/MH0wVQYIKwYBBQUHMAKG SWh0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUNsaWVudEF1dGhlbnRpY2F0aW9uYW5k U2VjdXJlRW1haWxDQS5jcnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTAe BgNVHREEFzAVgRNkd213MkBpbmZyYWRlYWQub3JnMA0GCSqGSIb3DQEBCwUAA4IBAQCK28BdbVJ9 QKQqTDfXwogAYiRBEGptfE1Bjy4F5vC6eWJqOJ15vunxjLwdbZYb4L0qrJlh+ZHHHlbIK8uEZu7N XHUntmWMbGbZiu7JgrbSXJK1ct9gxrN/sdWYJ+JDjVHg7GfDTvTTPa26JMRqJsO1TjjyDX7A3K39 TjV8C0hqXvwF9BsNf+qBeWO6GVzJ5572awY221hc1umibmZaKV4fg+7fS7qscx5TSuIc6uvMBQhm 7NQiCq6euMMWBDUDlotQCDW0ilm0OuLW3IVLuZCm6Msc+6hT9+dCT4JUvxTHZnnO7uLCxV+Ujad+ PH3itRm38i96p2zvwgLr8vwWA0ckMIIFMTCCBBmgAwIBAgIQTUYRMpPx2e52jnkx1q87gDANBgkq hkiG9w0BAQsFADCBlzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQ MA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxPTA7BgNVBAMTNENP TU9ETyBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0EwHhcNMTcx MjIxMDAwMDAwWhcNMTgxMjIxMjM1OTU5WjAkMSIwIAYJKoZIhvcNAQkBFhNkd213MkBpbmZyYWRl YWQub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4MyzVmtfAzaRlI/2Xh9EoM+d xEiG83T8NziXrjT+o2YcWaI28n8WzIRE7HMSPx4+lGeGu7B5uQZFY5bAdQH9mWvz11LfDJiwHDzB 5DDxrp75FImxL25Q76ajJEGZWmTPreT6hZlpG3oS2hL26TWO3ZhAAHioeJJU8yc66+QAM2gkN9nA Nnt/gxCL+TuZfVYjCI8vyTPsTEK319z2dHIWNT2lVo4OfXeFJ6PuS0Q24Apz5CiV+MrARmnYm4wR kBiRGQo4feIohHm59irES77aye9j4d1thwxHZ4Ft2D9MLoxUFbPNVOy/Fzd5HT0bGvczahrWED// tSjDCUOe4Z34vQIDAQABo4IB6TCCAeUwHwYDVR0jBBgwFoAUgq9sjPjF/pZhfOgfPStxSF7Ei8Aw HQYDVR0OBBYEFKS/v+ZZYvY5o9ih468soZwdsUbdMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8E AjAAMCAGA1UdJQQZMBcGCCsGAQUFBwMEBgsrBgEEAbIxAQMFAjARBglghkgBhvhCAQEEBAMCBSAw RgYDVR0gBD8wPTA7BgwrBgEEAbIxAQIBAQEwKzApBggrBgEFBQcCARYdaHR0cHM6Ly9zZWN1cmUu Y29tb2RvLm5ldC9DUFMwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2NybC5jb21vZG9jYS5jb20v Q09NT0RPUlNBQ2xpZW50QXV0aGVudGljYXRpb25hbmRTZWN1cmVFbWFpbENBLmNybDCBiwYIKwYB BQUHAQEEfzB9MFUGCCsGAQUFBzAChklodHRwOi8vY3J0LmNvbW9kb2NhLmNvbS9DT01PRE9SU0FD bGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3VyZUVtYWlsQ0EuY3J0MCQGCCsGAQUFBzABhhhodHRw Oi8vb2NzcC5jb21vZG9jYS5jb20wHgYDVR0RBBcwFYETZHdtdzJAaW5mcmFkZWFkLm9yZzANBgkq hkiG9w0BAQsFAAOCAQEAitvAXW1SfUCkKkw318KIAGIkQRBqbXxNQY8uBebwunliajideb7p8Yy8 HW2WG+C9KqyZYfmRxx5WyCvLhGbuzVx1J7ZljGxm2YruyYK20lyStXLfYMazf7HVmCfiQ41R4Oxn w0700z2tuiTEaibDtU448g1+wNyt/U41fAtIal78BfQbDX/qgXljuhlcyeee9msGNttYXNbpom5m WileH4Pu30u6rHMeU0riHOrrzAUIZuzUIgqunrjDFgQ1A5aLUAg1tIpZtDri1tyFS7mQpujLHPuo U/fnQk+CVL8Ux2Z5zu7iwsVflI2nfjx94rUZt/Iveqds78IC6/L8FgNHJDCCBeYwggPOoAMCAQIC EGqb4Tg7/ytrnwHV2binUlYwDQYJKoZIhvcNAQEMBQAwgYUxCzAJBgNVBAYTAkdCMRswGQYDVQQI ExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBD QSBMaW1pdGVkMSswKQYDVQQDEyJDT01PRE8gUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4X DTEzMDExMDAwMDAwMFoXDTI4MDEwOTIzNTk1OVowgZcxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJH cmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBM aW1pdGVkMT0wOwYDVQQDEzRDT01PRE8gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2Vj dXJlIEVtYWlsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvrOeV6wodnVAFsc4 A5jTxhh2IVDzJXkLTLWg0X06WD6cpzEup/Y0dtmEatrQPTRI5Or1u6zf+bGBSyD9aH95dDSmeny1 nxdlYCeXIoymMv6pQHJGNcIDpFDIMypVpVSRsivlJTRENf+RKwrB6vcfWlP8dSsE3Rfywq09N0Zf xcBa39V0wsGtkGWC+eQKiz4pBZYKjrc5NOpG9qrxpZxyb4o4yNNwTqzaaPpGRqXB7IMjtf7tTmU2 jqPMLxFNe1VXj9XB1rHvbRikw8lBoNoSWY66nJN/VCJv5ym6Q0mdCbDKCMPybTjoNCQuelc0IAaO 4nLUXk0BOSxSxt8kCvsUtQIDAQABo4IBPDCCATgwHwYDVR0jBBgwFoAUu69+Aj36pvE8hI6t7jiY 7NkyMtQwHQYDVR0OBBYEFIKvbIz4xf6WYXzoHz0rcUhexIvAMA4GA1UdDwEB/wQEAwIBhjASBgNV HRMBAf8ECDAGAQH/AgEAMBEGA1UdIAQKMAgwBgYEVR0gADBMBgNVHR8ERTBDMEGgP6A9hjtodHRw Oi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBx BggrBgEFBQcBAQRlMGMwOwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9E T1JTQUFkZFRydXN0Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20w DQYJKoZIhvcNAQEMBQADggIBAHhcsoEoNE887l9Wzp+XVuyPomsX9vP2SQgG1NgvNc3fQP7TcePo 7EIMERoh42awGGsma65u/ITse2hKZHzT0CBxhuhb6txM1n/y78e/4ZOs0j8CGpfb+SJA3GaBQ+39 4k+z3ZByWPQedXLL1OdK8aRINTsjk/H5Ns77zwbjOKkDamxlpZ4TKSDMKVmU/PUWNMKSTvtlenlx Bhh7ETrN543j/Q6qqgCWgWuMAXijnRglp9fyadqGOncjZjaaSOGTTFB+E2pvOUtY+hPebuPtTbq7 vODqzCM6ryEhNhzf+enm0zlpXK7q332nXttNtjv7VFNYG+I31gnMrwfHM5tdhYF/8v5UY5g2xANP ECTQdu9vWPoqNSGDt87b3gXb1AiGGaI06vzgkejL580ul+9hz9D0S0U4jkhJiA7EuTecP/CFtR72 uYRBcunwwH3fciPjviDDAI9SnC/2aPY8ydehzuZutLbZdRJ5PDEJM/1tyZR2niOYihZ+FCbtf3D9 mB12D4ln9icgc7CwaxpNSCPt8i/GqK2HsOgkL3VYnwtx7cJUmpvVdZ4ognzgXtgtdk3ShrtOS1iA N2ZBXFiRmjVzmehoMof06r1xub+85hFQzVxZx5/bRaTKTlL8YXLI8nAbR9HWdFqzcOoB/hxfEyIQ px9/s81rgzdEZOofSlZHynoSMYIDxzCCA8MCAQEwgawwgZcxCzAJBgNVBAYTAkdCMRswGQYDVQQI ExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBD QSBMaW1pdGVkMT0wOwYDVQQDEzRDT01PRE8gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQg U2VjdXJlIEVtYWlsIENBAhBNRhEyk/HZ7naOeTHWrzuAMA0GCWCGSAFlAwQCAQUAoIIB6zAYBgkq hkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xODAxMjkwODE1NDlaMC8GCSqG SIb3DQEJBDEiBCA7fXftVFolYJXqIdrVYKhefQX16nn46gUQ9xiwJPZKBTCBvQYJKwYBBAGCNxAE MYGvMIGsMIGXMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD VQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDE9MDsGA1UEAxM0Q09NT0RP IFJTQSBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIQTUYRMpPx2e52 jnkx1q87gDCBvwYLKoZIhvcNAQkQAgsxga+ggawwgZcxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJH cmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBM aW1pdGVkMT0wOwYDVQQDEzRDT01PRE8gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2Vj dXJlIEVtYWlsIENBAhBNRhEyk/HZ7naOeTHWrzuAMA0GCSqGSIb3DQEBAQUABIIBAJVZTt0ohI5b fNluAYBiGTEpyRFu9WlrtdLWWbrvwYeJrZfUlukWz9bxjS6I71Pb9W2uVhbG6W6eZovzR0aNZwaG zy7dUYQfJgT+ei6BUMHEb7KGHIJxlWoODu8xZ3Wyv+d1yF8rga6iwjjAdqpy62muF0HZAoRe0X/Y 4bJQW1zrIWTsBlhccNst2eW5DcqgyzRHFSEGZCEb4lhtZAbZxE4ohCkI77WzkhIhIo35nCNLJZBa 6kZPjrfNnyYQ2ZtYS09tnqfe3+lTJeLardh5KQ/9ImdFqGpfXFbqFoqprj2/JoVs14h0LPR3iJQw qcyZ+YbDhqQUxuDIliVqCsPo9Z4AAAAAAAA= --=-xgsXrhwA+GGYGWEBONvO--