From 0fd975acaddbd1edf2cb7ae465464e26c730a98d Mon Sep 17 00:00:00 2001 From: Olivier Deprez Date: Tue, 5 Sep 2023 09:38:27 +0200 Subject: [PATCH 1/3] docs: remove unused SPM related diagrams Signed-off-by: Olivier Deprez Change-Id: Ia60c4aa6a0aa0da5765d295e658964e6faa5960a --- .../ffa-ns-interrupt-handling-managed-exit.png | Bin 86234 -> 0 bytes .../ffa-ns-interrupt-handling-sp-preemption.png | Bin 70490 -> 0 bytes 2 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 docs/resources/diagrams/ffa-ns-interrupt-handling-managed-exit.png delete mode 100644 docs/resources/diagrams/ffa-ns-interrupt-handling-sp-preemption.png diff --git a/docs/resources/diagrams/ffa-ns-interrupt-handling-managed-exit.png b/docs/resources/diagrams/ffa-ns-interrupt-handling-managed-exit.png deleted file mode 100644 index 0619cf260bad85fbc60b933bfb64df1d55ca6ae4..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 86234 zcmc$`bx>Se^fd^9;1b*+cnIze4+{`nLU4C?mjrkB#+~5q?$WrsyE`;8otM0s-#=3` zHBri(uhWFc%Zei-;3GglKp;y>h$=!rKu<$JybFPY0lyNXY_ko1 zfOZg;RE7f&PdLM1@N+yzF;zz;8)HWoJ$oYv6KfkQBYFn|dm|%j2U8ozbEpmh2#Ajm zlA=P&u4yN$E}jXyFK?Igi_{(>Fz}>MaHMgRX8~DT!eYlq^XkuLCG|_c8r4k{ERO4o z%GB#nL~VZ{8ht{MukJzd5V_;wK7M^c`zQJX)H~Qg(4*^4_D=hlm(N*TblUZvgI3ZI z6A~2Kf8$YY?;o6xWPgW!o_sRZe@~{w5T-@{8_k3G2k(AAL8-M`u2)c0oH|Sn4@Xi| zQbLsx`hAA|%%4-m)7`H3nB8vEaANSq$-m#nZ4;7{d_ zuD4qLA}J|ZXu!h4A|WHg&-VWJVg?mN{^u0UQVaig&iDVPQRe<D|we!j-@@k(}p zf|3%Agv2NKGdkD?F}VRezoD{I#OiXU34=@1OI3F#fI6-kCGfNE@+HCu*5JT2EqD-3R&eBB@b18E z84UFuB@a{z52Vmb!lYzT_517L~=6 zj@Gzoe0T!U+Hl3j8A8h%~PAPOZk+W|Oi0LF2^k^DU_|gbM zESIa^;Cs=rT(F`l4pQT!FmOs6t~q|*c*)?cwuDZ9c_%3SN=}_0h^FW&XvDk6eI_L% z*z`7>W4|Y=fa8hpopL4!qr*+%(qc~D60iTlDwR6+7fw`{u6~Tmef1}MHTJP76G&;ieK52L3&m*b4aNjJ2pidr zuv8#>T7=Rpn&*7iCbny-*Lj>*P;7o5do^@y)^Dmg+RYBbOn+{-KO)=Tc0o&5ijM|hEq9m|eLnCJ^ zHj2t;H=DBZED6=AZT`x-t&=&Je`###XT86jqmM1!7IKov@>S&lew_YePexbc{2d|d z1j3gdhHbikq?n`9*~1;q-$Ey@Nj7ff_L&@xwl%TYqs03&hS|?8dr>D^s;t_Y@Z26>2*3ie54DH$^`9z2KnkfGNSLkO!JBT_JSQaebVhW{=RkNw4T$qCV$Ad zX>RA8#We0C=`n$0OndhQ7rf(K^DTBw!J&<-Vx7ya1EOivAcyCw$RA{jSBGI!xAwbJj=C?4+NxVX8Y$w)UG4&Ki-WWocVq z86zx}K5knb_+^R2QUxuTGgYO)&1^ctgeS z9~U6Ulf>d%$_#P#bU6d2X~*gYa3SRS7`APduI?=wK~l6htvq23j8aRlgsA(CdR@v! znxi{D;LK}aP3fe-yvqQUbZAHn5cs*d3_xPFX;0lIPVd>r3Nt0wu`v~+_&AgDC-aIY zMhjbKXbVlo4?Mh>@vFWaI;^sLrpx3<=Mju20H?h+MEbV{;T!%Th4+0#8+9 zUDTM3B8*uO?coP>EzD?+pY_t*K&ONq#}i(~#Zc|P^uHb>S$f5Wl& zmAJUx{9?uBG$UwZNa@Usa;Oy?%owntZXc z{J2*T;duMyM;tG$;f@Z#a6(-svq1#ve5l3&j=fY+VO1usNG)C~7Wh@W9pCvTvgrQa*1|i_0wN+jE_-p*{?pn#9(=5Uv5&FOQVQna%n=KYzE*sc%BgT<^T_ zumh1dvT&BgrFto2B`KQ7=6+-}2ko!M<9y$$L(OGcZcbwMh`df5Hyp!eHTxc}-zk@A z;6siq<6X&Hxn1BX#7zv6ALF7lzu&i!d@t3i0<&X$2rLbT4)=cjx3n0H0b!E*K4#LK{uyg|tcGo{`W*DIp>X7 zmpzozD`e+XQmKX388k%z*$7tIyzeu*O`b*^j9_x&EAX>BoBdXLtH#Am8@HM(k>$pW zMeDT?h?G@fhV@2U)|I9%;eAtH_n@k!In1F%X3*f$8xjod`?qN1CTmpj>6kEaPR&(NnL^j zH_A%{Z&w2;XB@w==D6gg3-Qr&PyN7+<5AMsl%~+MDr$oj@!&qrMYCUErWV$KAfM9W zLL+MTgmzqCxgs+x?zz(_dGB+pAM*1flwDx!kt`mm=%!Z>%=_=1t_KDExwM z$v@Qy9%AE&tz&O5Ii;C!Ge)%hAkZ$;1s$1lDNRdMyQ*on!;O#qw8j>6p&Zyl-RqZ2 zz4&gEy<|g1N9LKtspvh|b_+57{h@LfGuG<;`4-u*I{gjfDCq$;<ngWxW6wR@r@OG_d}9&|YW~h%7RI|YA*7Q$|kI z9EH7V7G2OnWWOWZSW3E_Pf1d2)3xbJo%DCSaX!9))W++^!%)X?F|qhM)dQXA7SQ#+ zmau{v>s))lPJl}-uOHY7*`q)N^;h6Em= z-34Cpm0mBA_HP@1D35>LYrmyC=MarG{>kG)bj&$3QJs_;vG*kv$*&+5)$K(KM@?j$ z6dWjLUvXuDa$QId_qYxWJ#jM1Z-#_W-aQY9)b@)$728w(u#IM-_;*WR3k016ffVU{FcJ zIi`?R3wmmVyD>&^GVrp`ON794SYpTN)d%2CwpE93?uWCU`Q#2R?7i4Ec2uoAtY?n1 zA}Em|7tWe<F;<06hU|#7SU*NZaJ5L!gl8R<|JH3&1hr) zCBN{6I1+a4c56m`I zlB$O(yi?5Ww?SdoZVspM_}v`~4XC7(J0C8$Q5D2~zhPfHk^29Nw9ftJxiPt8{SgEy zye`&-2KM&$2kRYgq`xG7C&WnX|4G;-{?=x{-)a8;K$lB@GW_%VT+v7rxmKlKll2NR z4zf=Z`4XJ<-WnJrvRs+Eh4d5oV50l=FVQ9ZAT>Y7vezpeIUfN`n4_= zZ=O>3=wgR*h4UHrjMm;jaNAAAhb1zD2!*dVysXvH*{0vi2cD$VE2SnK_7(m0myhl9 zk4xn@JBEZPq-h;GFfBbyB;-JR@eq%j<>mQ3Z)_4G^aFI!olk}A)6IAquS^K(0xCE- zHNb_Dj|Pb6YfdCOY$moZ+dfn-PH6cu*rh6{SYo@4yq?jS-xyc>w~Ykos1S?ayY&*H z2;u)|@ptR9QgwidGZExUVp@?*dukE9Dnx`m(}>;!Ge}>iF;{PL50L#|+CR7{qNmPj z5Q^J7;jO}Fg!t*03oF;|&Tr*$OeMD5HQYlMDZ8pPdDoE1Q`t6_?kY8x&-d`K-sF7H{!E)J1pGr8MS^;r zR!*sZqYFHOuma3hBPjhy{c^Gk{BshB^7PO2Umy2z)XCaD+`#CB`BVQlXP zrB#)sn~n=n%{PyO&Ua4drXO#IP<{blJ`EzDwW9d2i&d=mEf|1eaW{MMGX8nPsMzR2 z{a$%}vqsYB@B?|jXumiOgt-mQ^W*Zckr#%6ny+l@oF{7|Ml)EKQzT%C z$~7Q9+iTJ29ox05)Unk!$y>mQvj1R^t2TeHx#ns888y>`o;fU(#s#lYn)-U-1|A93 zN>F4E_}yV8*Wsa6AI)mVpigcV(MP}A#aPy3&+FC0OWos?I%BXh3(HVj055mI6y~;S z#YZOp2*dZ|s_ z?YMCbAR`uh-qxpjyLLJwaG)*5`j7d+@@W+>$IDf4;Q%bM29jga)T76R)W`m7Wukm^ zDsU2+^X|dLG^;EqGE91wYj4QIwtmr5D&A!Nqp>G z;NIdz{97Zu(6aA9zcWcw4z3itEC?O5tasOr|aq_#J@u?9y#lQTy`Vs#g4E!Jh! zu2B_EP{f8fNW?xGAI${grNHDCyG4 z|DZ(;eUEKYpH;W&SUxs*#X-G2sd-jSNIeYYa??28A3q+O7hh`}uonF=jRS<{eDy@5 zc9;thT>RA85kWueJ*rS83h2@hh~w56&5I!H`;oa8-VqZ>CAdJeV5g+588V+CqF0Y~ zV7@BwD^#kOwNN1%Cm#s=Z+--4$PcM|i$p2zOs*22_ZY*}D!T^;+iBfi=cqqLH3z?~ z3dRnm4@D-4i5WGXG$9Swzth{nHtbdsQ*QKfee)uaV;I^?{9c|NwK)DXg+7-u)kMZ= zS+N=IGHb8$n3i@oLCxp-D>rwmviFX1QMC_{&z`J=I25&ZYY9$YN!7sk!G&k&(H|a? zlwelKat-sLcDd=F@BzdE)D*rwdJ^+)UPlBi z2C6JSKR^b+;lxA5!;?BVI4GhV^BVw!^fwIc8sLKd;G?h?iDG?a0{yPb^+Xc3tk0Pq z!&#FQgrQ|_ts!!rmaugmd}XvkvXrU8drC@@%QbR`5YXwsN~{g+(kI4Woj4r6-J@+j z8hHPMvfcAU7L3!VpOBj>L$;X6Fbs!bZ#t!oZk(3fdRY7_z6XSaMlQ9@PIde=I|uey zjhIMie_%^cY8?$TGv(52$@hX;Humi0Yw*i1%>0LI;)s(8qGqU8oN0l{gGZ-s0nhPH z0$m+PzPeX@kUQX}?wyR0R>^Wr^!xlW)oPfS`JrjBP69HSD^&|8=5L;62G_;9&kvVD zMP$Fl2X1xKR1;1tWv+0|k}xczIJcWM8aC9HIG)L2g~}JEm{`;(X}kB3x>}* zrG3J0zALLOz*ebGpDp^A8lqb-?vh8)@xN9M4K%YKU!D@0R=O?m^YPW-Ie3x=4DH=T zK&m6RhJ}5ySlmssGHSgzK}ya2atR2FWri9%@qE%~iyuuF-!7kbNw^&CQ7Q`IjRKTQ z45(^~ri={#=qB{N%eMZ%SlglDw$ktQf(LhN5o;NMg&M`!wz{j= z?@=X5UeSuQk+P?ExaDM0*6nmnD6+DW;5KESfU8Qx(_mh^JZ!yx1O1MnqJucFNGN$LJt+04fK zdT(2E1*6_uzT4afsc^5b)<$5WuX&l1hspHwWAyyGQw;l!W*{}~GWK7~tQ@X-xEPJ- zsp@?wt3#%ExyxMPFdTPg`L2c*_F}h#L-FUVua1zR)b59Yntb*Y2G*{rj|xc_D<|B1%q-X##GkR_x9d^zmMwK!lz1yFDJ{OL`#g*&E-5xAAU99VffD`@*_R%o|Y_qNfJ zT=FnJufuxTDmv;~L|5KvFp|wQ00WY5;5I_y)Jl*W?0&PoCdt?Y@Vp6lUj7Y`6!Ox6 zdbmFsgm<#88TYHUVQs~))1NChw6A93Xvpl90RmplU~&Wh1CW^k44^i#_mox4l8UiD zNxMA1+_EAMjzWQV1Rof$Xp-uPTDFVHc!d_5E=~<1|65%LJAz4wBjQ?qUp%|oK~iP} z`9$Bp0clfxRe;0N0>KdvT+%>h6B8Z6AmI;(6<>+lt6AIBx)p$r8hkagyuDa~P4K*! zMPIRIT<@@T%aQ^MTiiRC1(KY)WKX|P&6++>IQ@IY6!X*-K9Dze=D1D>&{$9R3mR<|P^bDG=5ibM+T9 z@%DR(rBqxCLLH+N-95f8#4auT6uqW}qW|MiI0%b|I`E;2?erQVrlud%USi=9k(UfK z!$xF0)g2)|W1^wK^Zk|iR#!r0Wcb+Y;?HU4(a^9*J4@I6{kiUW+Ovnma(*jyd4Rvd z>XZz<+Ipvw($`PgtuaM|AM9(C;8E^iD(y5H)W?x97VJ`hbJ?e2vP5g!z5; z;${XNyKF&N(-Qi9(;*j8y%&#oG*CLa=W8^1r48ko8wfcS5bp)Rd^e(Ks)~|E-j>T<^#Z%zL9%oTUK@Vk&pMihE2z*ygW?w4aI&rQOuaBs)!tv*V z2nKf0(5|kPD4_J#w#xYKh47@lTjiT*Li=4!+b!JFi!OJCzEvK41??dEh5H8lWDvO% z8A)|iDWy{aE6(C{0cNmW&1EutkFsbT#OxozG?%a{BSo$(=MooVzxf{0xI*s9UG{;Jv6ahW935AUnLXVo8L~7srbWZ)0WQ?}xLqkKO>2X>IUPPo~os9MC>z=3keduzNs?Qho zcV*?c0*q^&9y;{46?WD60Z{nBAlil{?a*pQCOW&eIybRHT$!KQffSYLP_FAMrmgY%Q%V?aB!7 zX>=K+2u<203v(lvom~}xQ~3SrY9L|7QBQz8C{LdUE+uu{hRNzxUHi4jmwq;af=ZON zmI)(lcf+xdy}lNWr0lmSeAxciuN=Elt$=)jb^hVC&?k49K6pgL*wV7jpX;1to?lMM zGTtiF1fz(0?YKi=^N2Iob%!}iTutkU;=n2$6Db-zOj_oqJ#8}v^3R!v;e*LwkZsfudPshq`szbQOtS$gW|zCRuk z22ahw6AsikYP=j$Go%u?8!!@)kULs>GO(`5d;@BZ@v`DfFHC*0SETb|_0Z$Nbr8QN z>ox8-^sUqdk+v9%CzjiMca+5g35`XhX3t|I1ss2^m zhiSWXSS6*Br17wM<`zRD#P8O*RYPK~u1wius9Mc*&cW4-d|hDgv+8Sk?_eGrbZpw_zr|S=vY^7=GLkUE@C| z_AVXn!`46G5Xc(#{sb(UasVX029vgnV;*xTv)-*8rfEixk}!V$$Uz48V~&I5?a`6> z+@}e%VP5=e1=p5-Hxzo#sqPghBnm~~V4fMNNcCHf`1SYeo-LWub} zMEzmUJ&DynWfv`oSXQ{RAY$vYfKc7N$jGMJ{y;0{1)bP(|ChpI>$MTq;)_yn2ntl^ z_NBu7#Awnk!K3b(eX9V8S%?DC;d&e^OyLA0_fgh~xf_$TYe{hP7o7J^X0W@@*kLJa zLv|GX;z~`ndbLN%JfKu=NkbxCvBTqGn8axS4w|EzF~)! z(--VGWBTm!b~ls#M4&M#165k%DP;8WX?}Tj3SQrF3ZDl}pkDMOZD_XIWg0VA%1!U! zKWp9EUTRe-l4D6Yy2)S@j+p89GrL|ldwCQ zV4r)=*LXY$Vvna=9qlhehKA)14n?9YljGCN7VG_|><`V0y68mYOptOI5_IAY`c>5w;jdE}x8I+t zQZTO5$GJ0vCSaOQ>PidVt(M##5<(#X!YD3TqfNG z{V5(E#l~=BhkXQo8D1yyxZgcIGOz~qd>L<)aPO~+a%x(cndM|PIz!OT(2fL}XX~8f z2AWVa*~_zBGQ(PzRhKt|b{}26U?fABgPxayYL)_3&<$E%Z*4tZJik?ijN_E%x0)j^ zn*-nwk;y)j#e1i;!66^I%bRheNQ6~gzNQ5{yYE0?R}?EmgVkur>_2hZ8!Zn0tjQji zlaD*Balv-f_*#H}?XVW(ycT1f72!wX9LLcSz|CWhMccIlv#{r@iaFhYF*TFEEsNbU z&Vit6fp<+PxD-){24GM0y`pkbVOW+~P`;Y*OxJVNUXFsWMl~8^5(vzhAr%z#di%e` z#$@>SRokqSK#-!)lGZYxmS9OY-nk;McwCH2BHmrgg6-vv_s7An!glipV&jNMnvrMo zZbCs~`v@rZ9|(6oGPiqKmG5EWEQ6=!)UTi6)(||Q%M10?3ob6n3b80Ku=cnVkhl z^!5rTytyi+57Z<4~ zt9Ym{^~gBGts)%0Vw{|ZFF5UnOLkahEAN@Ymq^QF2$U(8SZR67fp9&Is(vb7y##|p z%Q?roHLhf8?Sz4cChTbVDWJ)W3&j>Ev&Wc90Cx@06n&Y53ZBajl)E=ryU-EVThcSt zu!5qUpNDBi;(n)EimixY5P~A;*b)xbOW^s4QDtOg(j(y!5V{X%#>b&f3lOjI_+RNmk(o3W*rdeggp1n3|G7I*);k2l7`_+g#j&A=@xi z8@1<;=&px>FxoGTX`?s245yzKiR#>u(YJF$!XiHM(H&%!QR843=N1=4+9b~ZrWz85 zc;52m zanv6k16R=dneXhk6CL{*jhqQO5;Vmz2b&MMO~S|*a0K7=bY2j)KYJ=8KzyU zF{Z#62fj*g$K+;X##bAOU;-mUOp7~1rsXr=a_q#A;-K51pcPYN-o zM5Y3nnNNYnzJBSdbg5V$KG6div{N-8I~~pwu2(#E1&P^yu9`0zsGHeF`#q9`Lv~s+ zGr3&tvI1U`c~jafSU^?k;j%CfRZBdNu+niqXZNyeQYx@ZVB?y$EnK}AmX=m-hO~TF z7whli!0b&==np|5v?UL^*~^dmyjYtb`OxEPA`PCAqq1t&$N^Y;MhQeYLhN7rE$T%< zK0L#`%0?1+3kvv94ARLsvG+Q|V>d4{$<1q1{2bd#TJn^R4T?oaKcLQ+b= zB33XV$KG(u?=2M0gD`|HtJP1jeX;V;K*=v%p!%QsU> zkqq8S^buCzYnbP?ugQrx!Kt(aT`b&{*J!KN`G1)$IhF>CV7cGfes}rpCn$RTnU0d# z_UIRdjotOZQ&{w&Vk{@pGLb2pnO`uqvPZ|(l5>?Nl1yPo!qxWUm$1kHo8t7(3g9N% zo!zzK0COCuVCtc+Nt~*sjjyrN$R_~)UEAzc+uX|5;08`VwYAM=*AI3cp0&+wu3p|t zORcV+-mTgs))f^mnN4qOjE{fV#K!fY+AZ1v5>Hg_BL9>o^sx%oh;k-PB*H&3=YcT=nD$-T>|t*ec@ z2Q#bdtvgH9`W1oJ_PdLb?d#3!$4ghQhnLe9yi}m^s4<307+&0>f1iGrK8GGhN~J3O z>04bgv&Lw$3{~l}phLLGR#-MBy8-a-ZHQH=@BX&G5_YY`9A=7$@ zj%sA$#Bn4IK2XT?8m5-!+3jP(4qkAiG00$;PO;V{wu_kC2G+tfD}oIz{MXP($iPq& z)45L^DxBAQIAM<$04$0Daddn%S@~%4iQN#w`sac#sjCF0mgV``T~b~$9|HB37M&7P zRHVSjF%Dy#$Oqd1?T=DCs7FUi<*(6?qQ7!LSm4=|*3hmh?OGI9lq?}E><6WlA)%Y{ z+!!IlR&QAVCWC?Q7&1=T&_SH&c;BTo&(&FAW>=kpq| zQ3f@kOl@Z9pr9?=1@LkQA*T?szEs(l$>VCp6#hl96+Y37U3q09eH z7;-sTx-1WTbn)tR8!&-xrU0|#{(n7pP=T7CKYiJz1KdF&v}fKFdOmyRD;Hn|pthH9 z`LJRe)TjkVgpsk)QGjpnGnq$;GKz5fyUMXs=iSq(lgQ;~I60)JB6m*z1i-ZU0Vt0TZy+_6~cV5PZpwn-MkT^iT`G`dpnMODWZnu6>9*Gg4$y}EhWTl z9}vhjgcto)MhoMcnCu)K;XnOZB*DQYD2`@=dX={cc&%4oiC!55x-k>_`{H1x2kJ+t z0dtp|SnJi5W1T9hgEnt5LX8}kSZMHYZN9(vu^+4JaNrgo9%$h{|CcY1V!{* zcz9ImPZ9vE!5CT|miU7~X%4I6d`ssK3j9YBBy5>k6N&#M)yI)jMuu+-FF3LMQc&s% z?JL8LiMhf1&|MC?NbM$rUo87MlVvxDkjSYTBF(0xQy&}p?T~O;+$=R%;^QBX9Da%Q z@V5i)iah%4@BRh=6;S=Fv>_bYB$~fJ^!w&k=Q63{G)EGLc1`~gID<|SW2VnGBv68H z!h35DSl65nooT}xylY#%NCQy=072a&lDFZn+l!dom7qa-~OHREIqMR6D19kFhx;k(D*V3_w?`x6YRC;XR0sKMNqU!PpHAv^Vv zL@av21jFkpv~r0bvV2tZq4>R~?a^80E$}6>@JtPiNWU6lY4W@p&Czv<-CBBAVGp}* zCyu?97T?gQUwC(*g;ilLa8O~p0cn9N_&kD8B&UnzNp5M69Zv>+%D5xoES*k$VE+>p z61jX>lZTo5gUuS~IKh+0gOuS7@>fqs>eSG=;_@LOub@-STQ5LPK+^4zWyyC+Vpt%s z_u-=^L8uzb3!}9A6|y-GZxBs#(JOU~wk-=yh~A0Axcmr?bcfvsIl1R|>+J$}wrCq3 zOaLIbA~Ue{)@emn^SoY5DJ>@qUiUHVIK8CT6k25Q%Q8?LSMLr~#>ZD#r1 z5KaGgx6W$vs`+N?_B8i>qhouy>iBUceNK)(D@~g|JThvJKDR%qe@AFFCsp+?`lRlX ztHr1Ok)*r!mawM2}P`<&xA$UJ%D`=h1V0z$ z_6CHq{i=kji0D!2EW|BU*edLO2BdIiGnmm4m&%1qt_%=2SjJ;p4CZ^)_D)y~B`<)L z^`IW_kt=k|KwV#RpuFZ#J#e^fLArkl;?5k^cPLBB%EQ2O>?6V~2>R*6zAos9rc-uN zpJ}p|>1Lmieq&)`zsBrc@A<;F?)mzjfJ0@wt{)xX#V`=w7FfG*S~3m7xx9@$etufN z(RhWZ*)JnKIIwL9@9$fzh*y!ta!*9V37_b0hsXA~|N-WU&Ro!bki z=D$4qG{w3d11Yqg3H>x}u2xqbXV~ze^V7OFMr?9F))}AQGx6;}c#__aF*TXqT4fdI zCl*lQMBEyu9{Je?)}j+DiLZCv`ispIWeefU*JQ+2XeOhBn3*cP6iuG-+Cl)zUBApM zige9a`O+Z+5s zLsfnWwxzfnF&h5U#pG^;@{xzmH`qV;rLmEy1PJ|5^l~LDV2(^~)>(y1$+}Q^WU$AF zBYm@eMm0+;^n9Tcv-U*wjle4zLzY62F``k_kDg?;GtXt@0{XV_4bK2>nImq>jqzeL zm1pd2REpdKP|Dkoa$c0S-cT6;R;Whp3rTX@gZFph^rI2&cP z{u(7lTfhvGMD4m?Z%^{5d^uUX59l!_9YqP8AE93Vwh6cR)xe7>@*~dXq?3Q&%rt9T zWaWW7oys|6o3k$N%vh2Bx3H9js^Sw@9+@@|RwfTL9p%zIPd6%R!_P7pXx#CCQ;8Uo zu0~rJJ3^?9hkV5Gnwp_QxkmAq2t}Nxp^_;Fg=pItFSf##zj>-j;L^qrVj=-VRRW% ze-a2<3)q*p?Keg5zBg)eVLdHQk9rD}W_UPW%?nJvK#ADsh-wq_TAeRdJ*2Gjp%^M$ z|6%cH_>1GIGB2$MJ}E6Q|52&HOEVJiQIWwtO#$39Vqu`@cMu@Kk=bpjsGu+sMW>=m z9zC5eUd10D1nC(4b8|;Mu~?u(8nZ3*^b^NjJQWEU2rCDBb=H7gpY5&WrC`gW_sV z1JL#x$M5Mx+Y}7!Eco!0Iq6q1%%N~OsS@~>9kjLp<^jS_DYU<71oR~cd2YV8($kBm zgoC}>Sc)9*3s78clV3h0rW8hyIUY5AX`nhsoXmZQg*NwU0{VH1&GVcBhwn)w!qRRy zc7^A8J(-`E-nRcqYU_Qt_kk-%f~U~8N0(A9_5MVlQ?0dT=hmSZ-OHZEm$h3aHD=IK zz6lkZ3ntBSgGFt@-Ukb}Fn1gNGN8x$WM@Y~azq(SGJ5c_-h^@s9#gRNS%jMqC4e@} zjF&%zxhdM`IW|-Rx29dI(Xv0DCNK-T4xr57Vk?!j+#z!R>n8SwOW0L zonY=ry#~K7@Nb~-lP1*eb5=JmHB7hn|5Gyx-L&j@#vs4iTA@oeDjuCvdeO$<>3YFxKTVAfEqO(A=0` zX0h^`31DioyPUut`OuYwF8H7b;fXw=dOPbdn#vOtxRf#qs0;SSF{-hNiHG;FJ&5wD zU2Jf%d_1(=R_>XV06^l>s$MLp(LEggNJVDDJ3%in_n)U?nT(yZUe985BLTZO|78lW1d#Ix+_aqLdXP`)%0_XT#*w zQNKR(rtN}DN}w4zA4_;+#w6H5OXqZ0+{!`K#+tw?Kf$fs$39O%`k!1S@GGYSt#t{d zYSqE1sc=u>ghHctg$w8zl22+b6UvY5I&@c4s%`K6PDB(dXt)T2;8zOP40YUCQxpV4 zz7o>-zxdpp@$&s*vDtpOmj>qDfB5*pJqcw>6dD>DO$<|LKC;}1-om5ILJf5G%VMC; zC0{}TQ^6fA9wl2u7~bFihGVzY2b#%0(chnR=T-AN!yxxK_dch|-dE!@zI@A%t~qSG z!Cr}e>!}ZX)}wwcK;P0>i1TDm%soRQ>oB(>ll1oU zG%;QW1Yq@xtT!{aTL30@Q`KTAG#62jA4}o1tf(^ArIXaFP2Ca3rCrKl-e^YW7#*Cc zJ3P@+e}Z5yGntw9p%b0XC5iJJvtPGj!{Q2iNalL_KMdKHPU6fbTe8sV5Yj6id(~bI zIF%o;H5!)O-w1gs)RLo?{eL_Wg}8Xh$i6~`5?Yz92q0X)O$T~(jqdU)B%XBIeuwGgxhaT1SL zZX2p=>x`l9h-KBbZ0`Mrsc{svnCa~L7nR>tKDQM@*ox(PoZACPC1M*68MO;<Fs`xLQkD2l3XGT{Q*p)5?phgGDlv{={mlS_gfuuVu_-TmTvE3Vi zH;wl6l<;}PAan!|0N`NR3yn4L#CU%PfGb#ovZCHoK3)UrAPNduVQAlic{*c`3KdfEO z9kJ9`V|gxnh0Wgweg9sx<$G)_(N}-0DH)9GBIY9OcdZVOmy2x_9CoqoTR3;_(&537 zjtBUDKksp)HY*$jsecLQC-|G+N(tBXEu#jS(>FTHA1`72!a6h9jaq!L)T<>zcX|#W zECv68*%#X|t;T6Z!mlx#jg1}{8al8-_0%%T8gvc;njbSb9(J?Ts`=?jqU%1mSf6FMd_-|2YoyNrp*chH z^gR_O$&J8rCc6(v;?Uqpe@FS^$=_k;_c9Zj6642r#7#8G{Fs& zC5kV4*QeA@r{{#9D$#gPI>MhuO!516YAiOBN>yW_LvSXK%UurFNw+Y|_w!!!8Eu8e zo&CA&B{cXm*#^Xro{m*>tYGBB?~C5EAp4HJ2tK*gM>p#edpJPBSun>!y1bFd_(g2< z!RX}gD+^% ziQ>Z~?~JYv@0CugJnA+;9T*S=Db~I)y-B9yJ#`C`qJs zWZtTjp5-NHFUE96Eutv5Pp1Mp+82_udJGJ&)n4yO9?Y5o3Q&>tcCvn8WWd%W=M}b_ z3|lh7`w(;=NI{K11i)!>^AD}eWxTDpdDo@AZ3R)WzW)3<6N2{>g*MA-ri`_i4+Dk>Wl5o{P1OS`gOCdYvyxn`}X4%`^0TM zaCzGu;!{|`3d5uhfUrL9yhsy8rULX5+YozRDcFS9T%0?S|QQU6ME zF{~1nq94iKIgLcm3tYXZO6v2fY=PF;WsAVET21`fu#XfJa3?4y&TR>C)16bnXL5A; zEgi?7w#Vh^19#H(=vF48{jrBAYPECa!5f8tC9M4%f_GhfdIW#h8)&T_5kTWU>jnc=I#+2ZMr=Clx7OEpQ0cXn+L_P3xUovzs+HN0$m$ev z6XwV&EyC>Ji@PICo1@*o){VZ}VTY+uR9W47+aq|XLJ5bI&j+gzc`)lvxYdU9T}pLh zV@f)PM={MGra9L~mpK$v56=c|t{$1ftAj67mm{o&bUK-w&5ys$DiiB$SZRA|ja|M5 zOk7o?m_w$fV}qOC>)f0W{-Vf_UG_CwDvV2*3`ueNdcoymW*h7kJVNF6Woob3do%*P z@M*ms^BO&T%AWu;)nDuv$c{urzbM({3WO{I%)$7o!z`FZ5Th7(2PCZnM80N+=%HrI z`Wdq!Ic)$J#joymN0)A3JEQ^q0S$tKK>qDY;%hz?bViTR21Z`su1CYgh=~q!g@{t% zzbZRqr#^12YX09MamK7R!7rK zW|*8PRvx`~Hz)6i-93oY)qBy<&^y<{1^w!0!ueRL5#iw-Kj0maQ4EIAc1BL?4d~Ou zudGnvCK_}gmIaGss|yJs@j3@q*&09{(JF%*XP@(!PD}U6t;S0D9{2Q7aM5Zzo~f*H zC(~hseA=_`b}4IIw>-i#TLUw-AF0PC_M6I2Q)=?+ZO&mhj31u00>SzR9zEM&S7$jg z-a;K|0X)EkNcVDypH96cDB(C3ya-AbGH6Sb6L6>~?A&v#HeAif?XE47$LV5#J;fKF zZqaJXjl6!8o~l7yh|}gV95Ffn>9=mO6PKVNDryR`*#+qj%?O!8 zXMSYN^L-`SH{g5TMM)gh?i=LTM|W3F-7~tr+>^dGsyR%Ol+L&%IF6kj{6F}5>$oW2 zpl{Sf8j+F?3F+<<5NQyQ?(Xhfq#NljDe3O+&ZWB>mXKKTy-|P9d!ElZpTmF4-Z9r) zGvAqOYAX;-g`^gwpw$pi_S)bGq)NWLb565PLd-_>kBHA2aC9d24c?Ovp?HEo-zO zSisu;rK%HQ*H(PG%!VAR#q|j?L0Xj9=#)}j3M$-!LFe0jQ{#M|;P?(xUq!uo8F z$#w!a3=4YTu;Ypi!%|2nPfgE18dkAE6+D$bel2 ztlJ9spn_;2FR(v&txX4|%LJj@1ff%PpH+kFo5V8qNJkiwsBxO0;K3C96c9_3L(ff} zlAPEc)iyz%Ra5T?dl`W|@vxb3nuBs`3c@OveU5PuYnWTPd(nG6dibr#VI*^O^*qR7 zyVB@F5L43G&!E+6V=eDNuu=OZL)n5kV6xRu8D;1eKCfq>F7mMaSmzytdUlLTx{&$( z98;>xY4+*CQtz!UQE|T^f2n<2yeaUPTL? z1^dxJk6Vk>L0(2_^`T$hSOpGS_A>AuCO>k?m~*soVuk5120lBB25ki7+g<-o#}xx@ z3R{{I`pO1f0+!_geYa}7R>(?@8g$U-S>7WH5k*b<#q9 zx???)jt_VikCF#&TPs6dMI88jyQLvc60}Iz^mq_rEPCj`=8+ zSZJPkGb6Tj?rX6#Z_nk`H$`r&){o>AGsiCUll&YOwOkwEhWjsJ zyV~^HHW^FVV#=&GO8If9uC!IkAb)rmBc$j>+&%~(TpbKsVcd!csVh`_Mn)DpS+!T& ztp2cA8EUdmW3p1ozI1R~ce@gj0NolzG;@MGjSH^D0^DGEz?MF4KUeSt5P#jra_NuIAkZAfF&y167uuzS;d(K z`Y}D+0{pqgbrWVyiIn!i{Hr7fRS6$OHR+wsx2TaghcSHHZk`}tHpiEpAA93j{c(-Z z32joEFFI)o`v|`eNh*5YfYiq;vCG?$4@bVPs{v)TX=xqX-tsP_MwBa_a#!_?VPE$t zK7W%zp*(*U0@4%@N9}jXqK7hzzGUz=v6~~Sa=Mx2wPHIM%T@4>n`YI%k%R&rQMUK^VfKbXbK z!2Y8ft;^s1i}jbQm}7^Ji8*)zc3s`_XUw_77AVFWdTqIoltm-fDtFmkaXh{}h}II@ z8Be>=qT1ZvYg7aVP7*0hFb}_*Na4FzMfLny)dQQOcSx!4wEf((xs?#>(GA0oSZdc{ z%^2s6L8Z>}sQb-z&K<*!)*aK4<^1b!5ATfd!BVn}+8j2ozk#)dAjoW%v^`a9KMk07 zWE;bNU{;k_tzB8D%|>l!Y20PX6%DpBE1@TyyUF3@frfxDDpKA$+n#Q|*Wd?SLj#2>%3Dvyj`PdVO4mrQJ zam&vz-9{V%95jSrtw9xV0d+j_=^N*;R-(S7rIC-x~!=_fv z-|Cp>i#JcZ(eEnc^?DF`|v!QrA-=UT}`Tg^{7tff}o0?4b zi4|hR9KXXI8#FmynFYi?S`d(Us~hfqUQeHGs@HLI_&N^l-@T3#wv3? z(6n7LOk6!wejYC%YJ4(YO4up(Q(<_eSdW{RiKatUlPlh?^n)e$lOn-C7KTz@*GgfAJ);aw{Gd@kCc|)VkdYon5 z{{Hpi;4wD++3vN%=4-Nv+o?`2Z1qgt#?6AN;B|L$F1)J6VN zelvSIA6qBMh_!WSE?{qWQ23=@#Qw0p1>2ABQiMix4O$7!x2W^vzpPZ@D2nH6+v>GB z7q%Y;rq^c1COy5k4RIt|)B?v1h%^q~#98^~dDF#^2Tv)s%!HX#0|T9ya)TbcK9Z1B zix0zs&)6%8=R#1YQVhp?uca)^#0SaQLXnb{TjyTFC4H{-6>yFq{(Wal)|%};%B|(J z)z3%^$FrTBs_Q7}kvhY#DK#!gPtOm+MjD6~Q$;hG?rR^Vt|{}>L%rvYPpuje@+=AP zTJ-|6-_>Z-=O^-oX2hj{t0Z~1JrzqtIi<6A^dQ@``pHrpKhZRFm=-Rt8O$BT0&7o< zh?JL~Ebx>b$PpDHtu;6*QM+*g{Y6M93?{!QSB^1H2|H9oFk?U3_79m~|E2wPzf8>p z{4tm<>_NR@Y2%{YLIzWen+X{OZ3&QyF(L{Z*>+!;#g@e;qgZUpsA2V3k>{)7eG%)^b_+f*sf!gdZj^*; zSu7&jaGPbN96Nc!*y^W4={McEuN#-X2&OW4s-+h^)iapJ7QlfkqOT2fC*V}y`!;JsMkETn=SV?Dtn}*e*8L>m`p{2Qv4hXE=6G_}SUJmePWu3fj|j9J z`*D5pY^ceD)M`O04)<^zzy1btWo@z%{QHm@_Q(OBoql1+%#PyZdg)+qDvS2Cov%Vp zvC{bzhN&p5&VIK3vjP);Mb8YyvTnuE)u_wqaM+|BOZMZ%OB44d{=WHzv05b>JCOQd zo=mIgJhT}0{Lp9+f}kQh8|`LU+`B+8Y4rHB6iUPvd)$00%YmgX%rlVJMWnLUGpa(#|2{1<%C*Z8f=4qX_Ah7!V35DqEZuJrt9m7 zBVqSxpiu0GQWaR*GXSpq-VEj1NzJ{=>!Ovk?~rdwI)ERWuVdQP$ROd&BJ224>xOS4 zf;AXCL`F+X2!1DG9z#CQOQ5DNaT8`K);hk$+abQeSbBDpz+cPKyzS7^y!~E^R)>Yq znHB}H>5_D(>MNuI3wl|xaainxO&_~t;yZRZ(CczOa5jy^abUN65n;Q0(L0Yl3I*Mw z>^vTgU1`?P@%#qimZyHPvC5O(YWm8#urRu{OiylW#W_kvLh^#a;*>4Ty>&DGTXP-5 z$id?K!YOZ^@>N!kYe@zq1j~qgmkH@gzzzrGd70SNo(&B*?@o{)duf=|4{1hr9Bxq- zsiX^L-Jre-c%|d;O1oOol1?GMb0A8gf03(+H;&mj_YpWPdd$z9J3Y0y@x9_!k4Xd>)Rc&6+0;eoxS{P}OemAm^ zZf_v$^a`=F&9r*`G?r%2_&rRwCK}qy$_bCb`_5+tjp^U+VJXa_er0|h?P?ymd&%|gT|I^I&s__UdrCP8)tMacFHf0Rm-Ap&3=Ka2S5a=ftS2!D*@;bH1YOYw@oC};u{ltQetxq7Q`bOspaFBMYcHd*aKc5 zSV1C}rGn@)_UX;H&b#t%0(!r0vgTEIlmLfr^hOVKbT{OOl|czDnh#u5hm~GMt1i=$+El>#sMP%JDMX{h{NCkHkCmx3Tj|?HNt+J5;$DyKYZJ`Ln@xuAqG#Vorj67Po%}h+p_o9&5DB*$!@LS|!@|eGk60TqiA?-mdeKs*T64o%riwQI z&OY=lF#KuuZCX<%1-D$Ki`9)OW)VQYkFsE=-~dK}3Jpvc$)P*D5xyQw)jGY8suJ|8 zL`Zjr{JAn0YsA(vHCJ>@N;?2ALz*qoWFYfg4{!qfmG{$pp?wFSOtbi$U*+Jzs2io| z(B{>Id6%9$(|Wl$-czcdWQvldPfUQ-&qOgqK+rcedzh?~vlMs2Kg5lV(=bp`v6Cy4 z$3u_4=BQuyZgPr7#m@NJ=p*J}c?1eVl^*&QlinJeX59r3kl@VU53rY{#r-@{AwXKI zIgu9Q!TIWSN(*u2li2dH>i-?}$_W;5D{xxBzN(*z*d1O8-_wJ_#cO6ovTP*!& z>Oxuf_oLwl!*Lpkq3JbA24*!A48;CpWj{U$R>R0jKPWf*0P4o)Vh^h$FjC+yx)t{p zcRl_9D4y>N`qynmg^Ite3qDSv;+)BRYq2r?&6BVDZE+F#MTg5n9H04oVt=E&V!7@x z+q-=cG;HiI8+}nasWa-cN#!rqOkPVpWfg<}_V47sV_f@=p1#g7Izc=?D9;@ktg1+&_2V!8LFo!ppa?v0((-Q=c((Xt7;=I2Xq8Z*oh1j!XYR); zUtkc+QKfk>EqyN_POS?R)Pr%vTfV>a4+qZ2(YyJfaaI^P4GFxBpM$b#(Qs383h+{L{uU#N z#@fu9eF=0FwYO)%#>Rfi^#PdvR!S3S)&S0diu(H5e`w2p`?rW&&I}(OED8SYMES&6 zp?{239WH8+uQs1&i}cp zyQ`}V^ymqC>K7ql{nx{uKgBWxwCetkY)qQ|k+W=)f6FM&pTtnmP2I& z{TVMVH-*Du+*W6^Aw8Qb6o8zUkHZQ6U*s93Iv&lRj&MV+0X`G67(I>m{^slN0%$3a zPQ^q+6H--8Y8?cUVv#t4yx@^fm?5#DJh=5OL_n;_sLrDv1_;CdS%X~G>o;#UPMtr} z(2x=lwXJLcPw2yz)|totrFY=p#BG4VN#I9ntD9IaY;U5{`y>#7lg_fTvikb^Uu!Kj z{=}Y0j5z#Ej55Zts0mwkb!03Lszs1O%BFevY+Bj{v*YN-L=?ArM;F##s zyKM*lV-FTSez7pDY2eRw!H1h6*1H|O9}>tA45Zu|1m$g72%07`KGN8H`MG) z_F%Y$MbP8@qU%9%UOq`a9P)57CIP|m6K6heBIf>~W`qk0g_4hnyZvlz|q0p!wr3CHU%EN%H4AwWku ze_|7=Kqn7Sp$iQ0cfYniJ3ki_7e9021aukWp9Og3XOcI#-W`I?X8s;v_@6z_?)g_f zEZCo70{lJDZ4_PJLRy)fPgXxDmTR?oHWN|<#W(qYRsoM9A^Bu%{83m~SoJPHsYtat zSilD+GB(zs>+)!!R$f_oH?QCcd!+x`r9J_ieHC7S6}?{1Uy91e@SCQO?&xjwgn9lF z2l!_Dk8gO{48^YQr`=cyxh{+M2h+veVN-w*rr`X0m z#(cHfW7J!A^V!wBfu}c)Y(xJ1%E9LmbN~?c6BVV36sbLKFLSI`TFe(}!bVcL<<-@P zvc;mSegXsiCqMoX@XaDLLc-BsvRMGQ84Sh&;Fd4OGE{l9wY7D6P}+L77C;D~^$1vo zzj)aT0L837FdkVcohO}oeREI>Xv^fM$jHdUl~%w$rA&F=or*L#L8P6Xuh%R93H2-j z<~wHV{?+ZkJ^|og@Zf?ufQq`qiorkN^q)CGv5Y{1M@!Xs3QIDB?Of@pX%D$*#YmF)O`tqxVn=LGF)x@4k!&k^MLV4)&9mg zG=a$gzS3y)@{bw&b8Ad&Z1-xrPyfKcnG>a4NEkM=f2L3XU}OOWq{`7rn=F{~!B&BbmgqM?`!jP-1jFhYb&W0RNSq?ZeKm*>UHHS4YGdA+N9&(Smzh7O*$XZHnuNu|}QJGX*WTvt~ z_#eXm!eVxe(0MMUWFeQ?bW!_}BN$*VC|*tqQE;AOBHtrl>K2L3BSz5C9iK~m{#h^T zkyHgT0oHgkW$FmGCWGUlnZn(BU}MB@;Aoz7MK0LiRk0a}S~2Q&!TvRIWdGI?^OK=? zKXvImCn!+VBI}RIB_YZAzk7zWP-|s0Q=;*Ee`;_gCnb`H({IxNFE7HUTl`ZUz8MA{ z(CDi0&ovaK4A_>8E?{&y)2C~>)-6)(<`!XWHup5aDJ3+jMP2fxZrzm>x}_v|y64}_ zPf<#oZIx;OV!M1$_;vvyk@WZTEp)TBY}C7AV#fR46?@;Mn5YLxg7{u<(G%xIDFHzT zKza%gbPPbp~Moz zNQ{}%{5Y(*V$#ZiRtn#Wz7y1Z_T+WU^|8^t7acF*B(1@voFrI3|stY zI$h0(Rt4RBp9_-zTKh;KudfgW(37^@?Dj`gqsxuv zkk+ec z)IkU7^@vy6^o`~GLRDnUNx$*{pPXEiHRsQ&pEgj>BX)N+Fz9UR$QM@PoJzk^=SL@- z<3mT7IM{19xCPos28C~z7C){Ij-SRRh2$G=F)6yOI+t>w=Bp+#|Cyzj9dmN>WPEHI zmmcVHdZ?(V*7MRmb+1p>o{aH}#UhUjWKHFzgoX6_?_csJ+XqQKI?#Anxue_CWEi0v z3j?oAo?&)yFL#KnJOs3cF>l3L9x-DeOGUG9OUWgB9?lqWl1>g*TdM(aVYJrmpq|2`N2IpMyo&r zRlWqSa~-E2YflY&JdSE#L>LS{CSfYaRpMig=3SoHaj4w51u+zu36ZEHzsO3S*tvPE z;8-eZ^Psk}ctgF&=(AJ8ov!F02xkq03NB*TOHb>m>4;YEsZ5nAHTGIcYuh5USi5#A zoa7bN=nioDou{DAFyh64V^26p9fG_%sMc$Ag`BCe^!3Gy4$)m(GWwB)(a4B~hGQ4u zV-1yd^Ddp?tgayJ{y<1s(`%gzH~ajIlBP zWu&g2(khW3X*irD+~{}|7#4N`fcDn*+%>t=ogL+cB{WFH)qHzEo-@(Ki?HQ74NJO%MXZGHLzLEJ96YL=g74wkIZ7=om071 z?Hk@RGON#vqZ;XlTX($=y+^5nCKKD&gcs-AkAyGj+!Lj2u&luvqvOQOV#m{3(B0vk zdeb$w>wD%eQ;g4E26TR3TN+Vf57z}P;kxV(iUgjU8{F7AosagG60v)-%3BphyzWcA z1tHcSu9%1OrK>$cQ5t&DE1)|l@9l(P$G1|vTJEa9TkXWF&+Oo|j97H`B@?WbUJx5x z_BNeIpbn{=!-cfg1>f}U^XVI&90+}=GtlMpNK5bUonhl_cXtRlZfE0b-cvkWf@~L4 zj()9L=RIz{dU=eyp(C*)Rb*z5^_X^zVy;GU(zWu?-KpefBR$cGh+MMlrWtt~dw%c| zkpPOL_S4l4jD`Z{W%9{M=N}nkW<^zL-{g)#onLr?&$ytkXtcHw#hOc)NSL>|63JPo?!@ zjclKWm-sC7THh<+*B5nOG(DU&h9-mfhZ|9{9uJKeLtnD&GNz#V$W*C&2Mklo1s>QE zXQd@~p?M&uUKxI&AjsIGMRPe{NDXcJ@Ek!~8PU2_UuE`{Vv9|GJLgivM7<^xe~rrz zEs9Z+bAPiSefpKAYh;HOhn9WC z%-bh7UQyZs+@(1izZ}(>*K9O3Y&q#KKDvdGOgA(7Q)|shhPdUO9j$P`bB-zyKW?XD zW4rf@jYw6RXmP`}^-S%<(DE3Z;cd}f3W<+jOt#}*yYnE~X}&>Yj%&nT?A7$RTKv`K zGW@N@^OTqEM%8A;7rSXTYg1Os=?FFnWv_>KkM9tM?5d2Ulvm9th1xd zRONZiE%?x>i7Bhx-u;XX^YU zgSV5)2TabNBjnoEh{BR4yG>tBIDOu8)B8|vLc*qnlYiS3P^&P=TiWM>5Px#8?p`!Z zZ(u(ocbb{?nw_5`sUasiGq~xpVAG{EaRjIX{^O!>j*pLL=jGithT@o9oEc0ODn)d4 zeFhviIl7i5t<$T=+vmN%MqM7(jS*KTjod19tDk8?B8lO==o4pdST{=QyG1OWkagY9 zP!`e6Ru>x6vh4|vd1WTDmZN)Hd@U%r9bGalUw3jr_%Opk{#eWDBR?G|vv(R#@jcrV z-!&Uh)l3s-S|;wcS+CpUtlDfmcXz8T|FF`PG#k^!B;PrgRF$2NG%z(&no@u-Bt4%}#5x*6E8}D~a8@if%rdo4yulV<&PP z?7D8Mh!wksGfz$rhhpawgFM`7qf@MO%@$L745SbCCw!1Eolr{Osz=VGmDUBPUE%y2 zye^6z;O`>dJ$!HA@9!)=taGe)_VS8(t|- znD#tUYoeMee(>ie^W+OuW_j`0*m#i^xXY5OlRbH?cdkWd@9EwptFHYrK#(R)_lrQ* zZ$mhMJ+PyWXaX^&;(S@Hz;RY=?)YV+MR3p_^U8-p8*@`$+k4G+jmixrmF@-2R(<(a z>G04X@yx3atM6yHF-PGw8%$8^>-j>fD-&wZ=~P+sMe%ewM|jJ$Irp4f_v?2s8nj+R z(Gy_4XcIj*7}0$t{Py_zoLq6U+9+4C`&^UxZ%ho85}0+qHJr-o(@SvubheK15$m}^ zv4beN{C2r~KEmu&X}8nPyZ7cJOM856x(2rs>U$gs_1)9FeE#5KR^CQGJ#+PeE9NW4 zV|tq$e-faE4pIt+SZ|P!YhHAt>Lj7!36?#d-JjU&XlE%dfJ>^#JKtX@q_lK@lP&`a z^K1tlQ;ooN7U{?Hd?50A_HxMk1-v9IZER+O%iN~(pv^k`q~WXB#dM$^cekGjw=(dD zCeWKN#a(Z7n7jz;r2d`avI2+Y|BGqLew5n2HANcFKS)Jclo1d67lwYchAAf)kbn0? z1pw2&{^zhD4ks#d-a1-#7*Db!yZS-5w z$8}R23et(IdJGV9F?BoJ~?MT?y*`4W7JLRU;HQg&$87Nhx0~X3jv2m zQO-GIht5WKb_Xi?L3b(WZ)vVMz*}^W5|gJmzpNfEe}SG`p|b_AXfe!TQitjM@S%yN zfv*Lr)UNwPB%!5vb@z)Ocj9diEe~h&vkxCr%7l1x@OGHaqF&LcfL*qRr_kfLx+Iea zQZ@GFAnRANHVh2q%7_dhA3t)K`qz9=?)U&#>*aJMeHjC<20z`>eouJVX23{E^RehU z#ir!=_uhI}qXYa34JC$b;%&ms$c)Hqjy(0`tT*w@I8o?^hci|BMa_gsPugY9LHVa6zRdjTqub5s1I%* z38Kx80!4u!goXWoVq5dj)r><`5(Rd+`a0#e`-yAep31_8IDN8w;(-d3? zU27%0iyuTOCB^B3M%)LOdEyO=$f%1x7CW8ApW|ptsf}zpEpG)Z!7X0jkg=3KQw|dQ z6%mqicRj(&Q(H_4=V7_FUqURxzn*|lUu5->8RVH}2C=nPgIF^udW=5uiR-T7%IFcg zy;*s@MlSVy-syiq`B+>vxl!O&y4_v>xG@#^vj6S?!#;SxXd^V@nynP~UbjWB#AV$N zpGr{;MCX3@n(lUui+pi1fEb~~K%3++;fj+`YDFq_kZ*lC4LM_X7vZ)2>i4U3L&b>J z^A%i3)?<_tHjajeotwf8Z|STHz4l@12WOihb{@Na*oxx@?@Quam9sriA^~R#f;Yd; z@fx$zX0_8kpf3u^o^ns2?7$dcl4i&>4#E%JG-V!2JeATJ*_q zwHDP8FWlvw;VTLzyHm-Qgy^td>@W7I{#E#%>>ykl47~s+(%hjuJBd^YY<`Fl7wjY zi@)2IvX@WaLOidXN<8R&{Zj+ZW=27qX?)1rOSfdLtvr5t1WbVk;N&`6{;xiPnWan{ zVC!Shv0aPjB_AJx>8G7Fr_-ZHu2YLr%AwP`)0B@2`Cl!t#;9~?(nmrvHqhu#PHX8; z`<|n;!{OKOo(A2Wx37_=5J}Y3Hbg%*-!U&)LcMI9ejDxWWaX=AY+M!`q$!|~+lT}s94{hxL& zU1PuSWPT8z(~8Fx>Vjgarj*TTq)!_&GqcHT8L^6rN}hV5sKLLe7L()Q?1!2FKfm!R z6Yz%`U~qaEm&5+I-8+q5kDdvqULc7Z*vI())jAcGWH?oz5Q@(oH&v)~+Zcnhu@$ei z9Szw&?Mb$p0D3n}8%NyGw02@;(z)-Nfw=u6Zi8ZfJpvZ(mXC-N>iHD{wu|iQxIovb z{?YcW4T5qihIl}L8}n*YMilY)fV%V9lYO3CsZlarN&W|0JMtDF?+rPwW2s3g_bx+Fb13Qp z-@^_mSM|OkD;9@;2w~FD^&1#D3Z`H4CB(Kh3|FnAV>j%KZYRBmY3{7RS^k&*Sjyjk zu)${$5wqvs@JSptBvK>!ZDnQ5Ve}zegvUg+mLFV^5xW@9p&My%O&sRL2bF_tY;(7* zgf4sDCPV7S#1<1c)5n!xuafM5riW*T0#$XD+%HQlC9aN3&ZhKc^SR3iWHIU8ruF6K z@&n*8={HgzR?b>$C&ClTmg6ge=>0uA%}^}Jz;C{o3%MdAkzegN6wPKnV6Kb!pYFu- zU#7<{7U6)oYX=3nnXtxFRTsaU0`*(i@xyzQ7jO+wGv$2>R)^b+O=!p=sB7W*3llyf|2gWbsNZUg#V|2R zLyLA^*_?AhxDb)JxkS0Uu-iG=70vIm*UEHRCEb??0@O;5kFa@2 z!mP+2+JCmZ++CQ5Z{bmFsqsfQ;`Lu%2((7<^1Bv53W7S)nt5`4s!F7s46Zv)8R%=pP;?bCHrww-i2j{(+eaE$q9KTa0zo`p z`q9OHRiQUR0Dr^Y--&9V$vai3 z_Fx(KB)7y~g)hLMlyrRkV*1sH>PQp6d6jDunuYG;VX7W!SERBLtwj70*+#DD&)D4l zJ^Lc7K#H-W$~FNIK_I)J_h1Q9l2g&VwCe9Mil8Xb$w!INaWJtfNgWPx zs$gv-w&-}~e)!-(kvJ_nLipCd8^BMbFBvaI$T}%xq={XyK?H}?H2RMfv_rV9SWc2J z8<608IASkO)W?5&mXUEEi?8R^HoY2_?q;mRdO1Q}S@4}UboL9Ty97#E>-(RD7UM4? z^*A&$94ayj8?Mq>%_onX=r?Yc4j_Uf@P89)pTpP2zK(tg!+|!&FsmvmVuoPR8+Q1@ z4LxS~U&68?^h>cbcBsGN7KfC9jX!C;04<44tdqHVJ-}WqU$gd3 zl>eNGLd7FJ@Vf$Fd5pBMIir8AIay~_DJ@0R(4hh_IQDkiT@eFF1ppjYf zLP;W!>!-&1l7gFvjq8KO!L$LnMR?AEMKxIgVOardNRfK1fr+J^A@bx<>^8xc_@~7r zwV|Q(#JDW$keA)GeRWq457xf0eZQ^O&fR&AH&CxaA-9Vswxc_qZ$OY{=_)6l0w^`D=sfEHbpe+hb;+BMCQ7XHGYcy5>@5Ffz6eOcCUH=h7oV zCX_6ELzJ^vyKK(Wd;3vtSh}o_AjXJ>H5?e??p5Cd zTJbjGn_&i!3#7uloj6#aEbO{kyuyM-1n9KnVj(tyu*8}_Ze25}q6^TjxtBlP1K)aF`=B_ep5q#BzXF( z__x*ccgSP7EO*RXU>RqDe^zlcTkb=pP_VkY`^zy#a$99Zd31j-zlItTm?1#5|O9jm)^!kq9lsTkY+O; z;!X4*GZ{aZ!b^|O*{BXd%B?JhId=tfrccMuSqEsOw}vRRxJvS1rUs>q2j+FExaW=tYydE+l5?vXjiO$E~SK$baKPgE>|h?#lGqZ(V-Ud5Y&fvaMW(^JMEV1 z^hWcXg0-EqrWhCv!#&315qvV;8~btR_niw`aFbFjl^?-*?<7Cx)#_fQKXs&f6Ed^_ zqfOu#omoKWdvKV^zDBApW{~Uk-Uuoe>yI&Ojh=9sLY7*+&&!i$@l?DsGaiyxoHHix z>%7|)iXIm91NC*7%@$#NPsMkp^=nmR4f<@!-99r^E>PUL3k{g`d;w}RIDf#z=Yr=d z3Q!CPj`hD*)(qV-Cl<6$C*ttJFz>$P-;bsD_c5W7jh8O7y5}L6*60p$3tIUh`HSg+ zqc!Yf2i2pTyOJ)S#Fv^)3$Vj0^gAyJp@_5A@f>BeuU?~;O`}~_H{%8V+~K+7iyR(a ztn&U0u2Yl*Kt0RT4!p;G^X5%BK6kETC>}L2@pr&+Wc0jqu10Bsnf!eC@^NV9nmBspd~u2Y<}W z5wokw)!7>2bcz}OSZ2+^`Spu+I9_%~_06~_LKMi|!~u!CWIi{GZ?Ra~l!&>`O&?`l zEF>b`&Ga5EnxC(DVmbWOS-w=m6j3%45xQ{6)nH1op|OG{!LR|thITJ3(u+{CH%xE$b((sV-^{g33efr#)yElP9cZ0}z!@ zkrivHPEP3~m}Xm^a3M5oC^4?#{`N|~LSHNxo${w+Oi^Za-kDoB2j2}(fMc`pfngkJ zOKIw)^-;(pK|}35bpYuE!p@@MD_;8GG;{ioPNCftN&(x%UUt0#d|{HgJG7xUhXxS~lCr0d+rKxtHMeWQl) z=4|>X=PWR=2*}Gyu;(Y5p#=+w?wAoemtNbU1w>>xdc;~Bfq0*ZTYEX!V34wH4>kQ+ zQMBjFMf#6-CLO6(oa`tbPTunrvgFK+l|l^{wU@671VgYvdWxrZ+sK8`iMP_J(r*&R zGeqzmt4q9%@-%-Rv8U_7X^$N|XKr%+X5`a~#Y;hFsL|)DD0w8YAnO)1g`Vdz|o1g-DctHK-~T_@B^N_|{p4O9zi zWuDQ}2`WWXJ+H+sgAkXFEI34LdB!P2X?Mbp*+M*qWF^JNK#$ZfU!;qi)1=(x}XQ@8FIdGqUxCx&&20FaA&!oRN$F_|ue!mjb zlb>^p1|Iwob6EL(VzyBG##B}Lw=(0Km+V^R!G;dF66g{jMRmS`re!3`4c)NBdZgC_ ztlL>o5tn&-;>uF|PdxE8p_v*N>zlPKodf;&5m!bw98~!DglUI*59_TAO-o^E7mv8h zCMuQOgl-8Zw@wgd_YIGSlyk}~HsMpnJU$kaF)}|350j^#95&-|bI2=tcol+)w<V`wK)WJu^H{VNOWT9i%&K=7Xd9C*d)pfhE%Qml2!3*bhqSE zdPb1$Yy15#&5;3f_vS$)KJCvwCZsBlRC!!Q@m~4RGAG#aoGzNXmJo7w2&ZD@EG|-J zd=K#tt)>US2X=$RE;naLo8c`U-Vjjt0@(R#bOdpbX7aqxW##z+$T~&czgudiWg?o| zL||aHwsoa9F;%2EpEn2IYKvlYd<8bwsX4sJ`D+key8Eyf(`A>&eQE~ud=GqrHDb>9 zDI<>;n&jTOxXf+x&>8POH5>v--WFb`Es*nLwp%0?L7sr=_Pg-mof8L=y={< znK2}nP}Vt}=G=wkver%Rc4XkB?l$EzSMx7P6s=kCB|Uyfk9V6c?r3!zSV&{cUkxZ- zAbr8^Z>`@zaZyGy?xUY$ocj$W+%i|0AtH__4I`1Dhz54ET*Mlu^v1EjoRFvZ_rOL)bqKXarAPcDAbA^pt(XdAiJu5|*U4KmMeRF^L)nZ=LmC#h+ z_KIB23SwNKlGAeZI{Iuf-y}k3O2?D8G|Mw_k#SVRk^-n23C}2}_ufiJGdYzuQ61(G z6U@I-u6Up}ohPlVj71n>!znZFuV{op^e2t*1xprL!sB46YeYQ+W6-ThfUbk2}keav1!Kdw8-to;G2!uZccdU%4YX7MC6BHX*2q z2l6Z0Hupo7JeEU-$ZiEOel6c}fq+aaolWmmLhiZ?tJ+^E_ zdYk@CXknuD_w()Q>)`bGlswNo40X}Fw4XCsZxC%LRJh3knJGP5Sa~*gFS4y#V19FH zz;{=%h&$c7SWmzKE)xmXSM)7m2#b-CQT4{=M*#r=8m+Wt&yRweJU7XCoM<@|4>!uD zSOm#;(&S3@=$Sr(l`I~c%(31G2Se8#}KYsc}Ep||ECnQt< zcq?OSknme$=ln8QZhn{v>LI@nM=-x0unAAUDF*LM2!zMGsZi2?}8$nY5i0=(E?blxj{HZ1p^-%Cn zHPeNMtoED?W}JI5k`IJBZR*EFVV`n?P2e7J1-eyNtf^?b{|{Sl9ahyBv<)jrN(m?p z(%m2pN_TfkOLw<)gCHd#-5}ka(kb2DDIMQB{@&+$pX>VGKm5nT*=O&yX3gAl&por1 zA~A?8qdqIJR$=u$Ui@M5<~u{4p7<^}nnrrD``jV#{cw-)y^Vh)_KgiG0deFH;twgi zJ8fcT&y~MCC=iTr1BRlbB`r^oDsHmZ|g!hPKbmFmX{fjGTNCW66%@ z%GJ?kSnGnqPO?z^#|Zl`Z&I_GFRbcnk}FR8dJmSy$$}b`HCB6>6`j4@dm_|H$v-l& z(@)7hI9$62C4DhK`l-(Uqmq)@L5hyetR7Z~uA%}~eklDNgI;FOp@^5Xgd&}kmDc)B z#=9{C!?=+;O8X+ZhQXQHgx;owK&<5cD)spcRn&E(ew zYjE$4ur!Gf+?`A-Ha(lS)}=|d&u+}k{*>49ydi0Hq3K$thc>&if?v@o8WqzbVaB$u z)Ze3MJ+l@IW){)_DY6i-0 zZ>e8LB1_*Fb$LXbQ7plTB^@bE~aGdA>IR-VSE z4{8|ZtnLd$hsl3nuS<3nY3w@1q_B>+i+khR+v)lwm#k`d zSsSUYN%h`;=RD@s2)$c$l=1biEh*GqxX1RuyOWBmfwzAy3x<2V{IM@viDW#GbE|Uw z#5g){4VO4!Wz%~b+lWl8GySG^RjgO~50{z}feu-*%0xz5I%3C447i*agZaU){{Cij zmAMamSPda>k=yPPtQUAHEvq>qM|>o&?|R0T@BCwK1%Cb2RNzlt3Nyfc|HM{x7q#~D zPxu^bqkz`$iO6NvHUpK&j)*-Tyo@wG`44l)W}2zt?>fG%%n{zeU@+DzO=Y8kx4W90 z{mogFO(|y;8Y(!R`PzAb^~-Y%OF3mME$k|q6V%HmQQqd)b|IkPA(bx^CCBG29#ycJ zd4;vUd}|lNFEZxBI*X;`TPt)gzfAVm!ku15pBs61ApSA@rc4Io*lQ}CCTjel$_ht7 zpv*7-0`>||cjj6q+~X*v-u5eL@DoW#o%^46is(<Z_ch<|casgseH)v@J9*@iOS zP6%6nJ8gT@Y*_U9?#ebQ@5ZW!?+UprqDItT<9As}%XvvsQTS$Ep#K-GIwY7QIwtlS zGM{mmvwi-cnsUra$J8`!4A!1h?#Yo%xr+~DY01LKtT0vPE4JKr1RTRhl(vV(=Sei% zuEPy?1Gg7nDdp1T%XRti2?)%li{4h541XgehNQ%u7clVMO2ov(EWDbV+$mpQ(s7=? zUin)lIW%JCIer0s=k>_?#(L?-dFSPJt*t0=`efA|%l7*zJoY%<&@e)ZtvhB5ag}w{ zh|JNF$($(x`ivFZ-n)iuf!fq|n?#3IN$pzC+jK=9v!;=VsOeR` zdVZ5NWW9G~xZ-blV1%^s?Ial0H>3|ve6|Nke3)!(8JAB4{DtNlJsVx&!nqq;snm@g zYLxm{)_H16@x`mYVrkqDCnDk3#AM47U0m$HRIXNHBI}MjO^HjMzRC|QPCp&SyQQTU z5}G7lE0_Neh-YiHCs!H~UG>&RJpohs@0$*!y;Ia%rH91)&niCf;R3}b!a8dKXd1b8 z8@-qe+DRcH@Pa}@2*}7VKgDB7*sK?Cda^(ILD5jYg}8(5!^0sUO9o+s6hu+G!&&C$ zmX_%#65#|^yT7ZGT!fz7l(~G;)Eu9QP+`gHhEpX;qtW=z+e|gf-7ohOcU4txcsJ=X z+CD_OecKrR()b>I>8p`5`^9!J9=Er+Ay0YR$V_$O{0DL(c7BcSR=IaAm4*Aaukt7t z5?=Pyq7w}*cfeICg~qSVptOfo5T9KbVt*sroMR<}K2ghjdMugGI1`Xrh1s4nP%n zhym-+a`^zNlNybV)KZBIx#rVFpd0Unl$6wWMMMC}%D?HSKhM?Mkw)UOe`}i-4B_pM zA9xg-^j3gNh}3G|LB6|CeHYO`7076`cutGC`zvacW_xOjR@lDMC@Ei}LH~i!rv0<{ zUgpjdqJUAX8u57<_+7L}irYGT7Z;aW>m?eZkw7%TO-@DW`)H&yOuEanrfvp77@jgrw0nK$5YJ&;SE(w)R{d!J$2od=jM`2wd&Rn z4@(4TAV|`Q#dKaNnvl<6G@b9}?yiV{d^7~9O>F3KRyvJz{e&v(#P}FrFl2`fbDt^E zn5e1J#g-!vKivC~m^y4Ny8RewUMs|VaA%@5Cf+0>@_`6Lu$kHG?$T|~l$MtE;qlSV z&Q5_k7UW~G+yJdwue6prBTZYaw5Dm+nCsivlsm`s8a@LtFi%Q00VpofvlwBCpBdcfhRlCxgqX(+nwzC7mR@2HE!XQ?^$mk)mP_y>_V zA}u-^RU{1a<;UXb^NnZ$18eK3;9xk=7ofzI2JYaD250+L8Pq7i0;uu?i3bn%kv4ep zeiIPv%ymgY6EtF`&O;zxPTG0>=EYD7`)eN`ABa2{z=1-gd=${cqR5pAxeN=~bW9Oq zZf@2tw+JmyPhQYU(mOgTcSJ=((3!yhsQnfzuKmQ~ziZ~wX=p3C7!&AKbNfA7+)<>c zKE;!7q!`5IZB)k}J`k)pG5EoT2t3g9_rz7BekR zHcLjK@C{VAMatADthOvow z^x1rsDJp2y>6xBZ0e2Ufel6*7tZvIWy^z>JlR<|7DmNO$QekF6Vr%$|=uh*HLmQ7F zfml7&Q_-xM27k|X-R8YyiR_YA{~m-gH#g5LwYi{QURM!G(<<%JLSqh(8N(BURv(ct zChvzEwe*wu8rrh5vTBQ&DA0RT93u?^o%r&F+ho|g;U7dS{$IZuh2+O_)o-38dV4SP zlzuuvocpug&^1%xP|?{CKU7Q^(ErGyBF$RJ?bo(Jne*I^gm1cRf;@i5zGou^ug?aW z!MXuQV>X@zBdH+wGkiW4FgPK+d^Rb%<&Na*;UKxy92Fzhr1$+1 zM`~)St&58qPndXiPRm64;BmtwO)XVVb^-PXL2J5|6+E%9EO8GTv2c_UI9&sGQR}Q+hqyKz3{UF~l&Bk(Rt5Q5M}qho_ozPBtslu( z6z3*_fERfMNEpFQ^>^>ymFTvlyo82bU0dr&pw~J-+#D4QxvZ$H%u+6#vf0e}$T%_3 z(cw3k$XHCU5y|6rPR5-UHSnDlvd#+QVI!EOyASI-a2(lOjZZ5anzQE*1teft-{w(o z4^vhAf()_nG1-Z=UHSbY&%9g@9ve82=_uj|>5hq8YTcedQi~DA@;)B(zBhs)mc$O=v_^D-W;u8y zB+$A+0h-;!jyOR;I!6O}%s*EX!NEXACLCr)BDC*w!_fEjX>0rlyCxfKU2Tj(3R>qE z$K5eM;MF0mOF-RH>WmLr;()j~rSu=HN1cJMfi@a~7Qk0Xjnvx1!sw;!KA-8Ci~YL+ zu=xQB5FrfcATa2UAqG`omH%$w1*m8oFE(U5M{v-Pk-ZWS5MaY?&_TmdDwg5`)+0N$ z75wiSbd){>Aj;%>-kt+dMTO_B{oVCRv~IZ?&o^M$+H~dbCN=AnI9x9b7oIJAf z*74Rnq5|%8%jhK(_<0(|9Qga|lYBs(fDX^}@3d+L`udswOr;^l-yhoLWLczqW+yaV z6Eq~Ha@s*LGBVa==SU27sn?G3lsHGwxg4DHMOkqP-JD6`@QZ0XLdg;K7GB+9U&2}k ztcX<9_VxB?e@6npNRX365x}H*d%k73P;1qEz3k!Y;ZddE1$(|TTK?ZJMu=t;`#e1? zHaNghQc~7z7&VQJ$)|j<3TtRM!xUII#F&bT*+O!MMmTGf*3l9yL4k%<(aZR{byR;l z18vEh_DO*rSf^3p;`4M08i^Xv8Et@um@MFiAyR9pM3$$cQb;WM*334=%E`$ohI+=v z%AQV=@j^@OH5&!uHG^22>qzf_YL77ZD>sOdWAlk9Knw&d1mqe5&kssR;=oAklbaQ# zJx*6&!l4p&_w|V#QBj*KXH(byaR#S!PySSgheS?5xSUnK!P04&MpYH^rC4f~Atm@& zi_4Rh3}74^M@Pfa0#D*VMKK*k27+m#t)t`SfBB-bR-JWER~NL_Lh6D;fvul`<&8C? zN0jA`g7mQtwf**%8{1`(SYXi>t7jBX-3iN{&*W{^!YQ3}0<(a$UZ<9r_-;=xqYyDr^egtv~1bBFPo?eRvPRyS| zRmUK8RqY6`UDs(Mr`N3RKjmW3YaKc)$2!$-r_@NIGsIP~{`7Z$x`Ahn5H!~+^F)E= z4@0^D@PeC=knnK1cm7uuC$Y~&Czm{3_Bdg7 zzx?v=Xyr*T%fQFdwme=fK#bb`uQ^B;gJtuTAVv*Ont&B%1`bS?U?5_BeSHCe$fhEx zSd>v$5OONFljJ|!rvB%hGy@Ue8azKert*0t)LJc|V_;-ElY#RoIxs#S3zoN#fK&?x z1_q}GO-{cVILJPr%)wzX3Yk{`TcHFo*8b_k!^2tNYCe4U06;6J+>i??`0Rj-hi7NM zjTm^cNIZ^ppt^R(j2-lPIO|L0_e#-eaxNqgfhT5>29;64O?ML$6FR-t)U~c)CD1kx zfS4p`*_@6d4?yb-*}T$E*VosFKxD8AM*F-KXWS#&jsDqb#(!Q7b`kb;JCL6f=QA2V zTp!=ncyv?lvN}Z_p6<2BdS2bW_!D$2nEm_iiGbsncjVjwkyzN^--9EBWii>U3xmSk zSAbtKGc%P76-AEJAz6yBHDjLfG)?+RydxRgA^!bya|%r1dF^S4N6CUig3!z%FsHt2 z>$CUV38Az;gPlei?W>)oaA%h|yvd5+n=2nK8E#8|Recyezd$7Jc2JaN6}-B-T5NKW zJHi(HWj;+)Lz=Tdnc*q8)){E_rv!&qwdAMSWS+Sgx}cFiXdY$pxH?q62A?Dkp^{Gw z{r*j@Hk$kn9lf(R5|7m@T@H%oOyXlMoj9516L)Ylw{o_~>kOof4X`_|B{fF3ArTp* zP59>nVgOCeHhAJEBuvC9!0T)0B$)(YiYV}WMH3xfSs}v0!kVu(>jGVkd*j)`kSMQl z2rlt(+J#zpys^6a9>^X{qN1W2YE9>fd>;G?3#qpT6G5o%7Xk-E2te>8WeJqSYWDh2W123?TY<#L%h*0S+)B5H5fQ(&l-&H|gM1 zE(Zx-kO-fyk|&MR+1UvXIBGC1W7mFKr>S%8cG11Ay`-(@SZgo zZT82OXjBD(HsT_P6;4QpnE{A1+S?lhvDMvO@odpZ`=v-od?<;<+mQjhdB^A|YNV+3 zYkOP_3=DL1bdZQ00qlXp?MMZNP^j>Pfi*~en8p-@Z=afq?+M2Oj!Pzu+lkZVIQ1Wd z+GJ|5OER^!W%>^p_ium$+jq9nH&9uN& zF1Cjuu^c{DXtS1U5@eWW%gtPQdBEJ>d_^JP{z-)hI3-oc{foS{wfr9~Kyw1b9g^U* zwzdWY1x*yIF}`EaF8CL^xjtI|V5O&`5?4LL8CvM40#^$ZfgFC3?mCJ~B_{2Uz_OEM8vT0_8$h5k}WmO6&FkKeVWDErj9U2z)-`B+< zUq8cTU|;}PB^aa)>pMGrpg=VRi5`OBZRR7@0QBIjQ`_fEY86G6zd0P)y= z&x~ABT8aRS&~~j8{EYp@w#+|6bnOD$?I2>4oRowO=8FWDmzRTW6aNEx_0=2f$=BA_ z{-F&ch+`(6=m$A1@bzPr#!~x#N(Vti{Lio2$Xjdpe(sARP%c(Q1^@;)^H@5Nw80|d zb_3T668ZqN-`@ai63m$dP#1^alM@-2Z54Fi|J%f~Al?kt;aRL41Qe9sl@&eUP;!cV zo}cjf+~a{6{`0B25WpPJ?~BTR;|uI?vPgyYgXQece|u-+t6EI1*Xk*{#6$m|3IyEl zrYnG`5kvy%e$a5ZUN5!aWADWw55dyk*B3negX7|?kBHS~nHRFV=*;Zw=CUKZ6kMdM1Wz?uXkaE@9E6E1FKP<#7F_rLpr85u;|+uQ%n z!AExhNQLvh)2M`j!4=LY%Q7IZ4v7Yy269*}*TL3S)4Jm#!Gf!NS!%3-Y!R!RoE$*Y zeE>22TVF=;(Q5qTC6^Ty;0sBRK@KuoV}X^%&PCi=qC5W&qU2q(jc0N=ZqHdYd<&wY4?d zmoeXinet)+31GVKShw}l0rdsm1yn#F6yiv$R)!B;0Yqa7F&y}hVP;%mmj-VdVza2! zwX`6az_@vh=kw!rwbeobn5SZYcWL&YOBC$YmVS+h2+V{@)37%}AJkn_1$=ZNVV$_A zIyDC%U6vB1O>S^_-74jI!SD?*%flZe03eM1=LZ*;X$eZ*Omq5uAcaPDTF~jsp9DX%y@$&;@5XBN4Oo3=D)- z81}JzZhwJ7$P4jF!h{rEyn$#WKUB)JlYxPqK3=bYaUq|PVEzBOUZWW1cavq>4V~aP z6za9L0;A}!2GBZMESm5QCT0#WQg8{#sd0stjHl}8@Q34a+(iQ*g`9yw_83oPSlftF|oTi33=qZ&>V*1pYiYZti_|F3dnbl~T zjHF6{fC)yEFo1b8b&w0$$antr8oI0J`X0X3H!*~7k^fEk;xWRlZCNm}!-4-{oJdOK zlf+;BsF~E_-3)^4`vZ%jBx-dwy`iHVC9eG}&Q=qs7B35h`DsEaC8Z&&R4Uy}VglF^ zgZqX)Gt_(@vE8YUf?cfcPF&H<$bXTLk#hmARoB#nxO%$3$4w{e2M2=ybU;pGzrPW? z9C3jB@1LLiskG~vfN2;2;LXBZjppY2G+^F1b274De5GtY{oU_vns~jVuT!zf#aUTP z>dL#`_`6yh-X_=`&9q(RNd)q_BZ_8~@ehGk&&-ReRY*Bz#Grwe72>cukGA)dT2Fp5!vyEs>k25JiTOm zLaO3^#pG;*WKFPBX|Bpx#7)8A+hgx`|7!W*gI^8Ny}{l&Ubt36j^@ws#|tV-jP@fZ zs{=!~EY`kGw(PYPe2}PQ?L({AVzoV-zXk`#2>1zzgD}E+q(9c0>0Y>g9pvnzD-JDhYdI0s8-*zM#MN{Ass;)- zM4RJlg~y5hf-QRH;2i~Z&dVgFl09|7KbP6n_MzYX^G_|pl!BKG8#2gMy$2hzn}!XD z95Cb1FIR|AyDM9>*>Q`VOB$Nv-sqD5Vs%+<8B_n*7x`FqlVi*-$+hs=#5^i8oTp|X z^7B&iE}4~ZRbwQ1Sgrsq1Cg=rNl?69MeopJ5Y!g##rQ+^q6}}qUkOgUUZ>o(g}~pY zW?_ZK{D^HE64wYnI5VQC#{k_?@312~k1GEgq&NjC#qR(d2R@f%0ST8agwNyZwC(xv zzccu6J7b}h3*`O$;ZQ4W*92jauzfpX9HB^w1I8!gbGjnl*9IZwm$`kjvWs@ZxA9&sK zGPhX%#;VtfvhglBBCRGSkX3B5rIYVNG-CTfoXn!chE{n6CM4d%L(*Ab;sf*ZDZsU! zgU%obF#bOl(oY=rmbMqffYa;ie8avdkg4H2T;#Yc3Wij3I&32Ws$Rw^0}>1YsOG?+ zQsHKJsP?r&r7xJzWY3*WQKfr&CHCYBRqJG?y+HHV>-$$%H??lZg*Q=z4Zb7AbmhGt zGQSKbu+85ihuJ3@)I6Trm|Q))N=ix2>JF@UJk$0@ee})3^?mh}>Jc6IMsy8vhcm+OL)snBAUIRP(G{+(}AmNp~}IzgogrqTI6b*0U zd>@cuBQAHI3aSV!kQjUX9n0eP<&rx1x? zb!@>C)VrPUt-1#w>4+Dzz*3RYAV&JbuHwJ;g8=(FyuBQi4J`(Y^?$EubB!z3KYvKgM?Chx+{ zDnNBxomBe2RnFc|_xkO=U$dODXNF=Ql#S8!kdDN&$-Oznui2)-thES07F2xhfa1T~ zC52#edoD;#MHnS#{L2lPF?S38L5e9_wU%rDKyCsWN%1b}9BUagK^sa}^DUcm=|e=3 zb8-vb%&KxW-%&9Sg_fH7hFjPr;{`}`GYKDHwYSU8=tn1teu*fioZ-;K= z;d;<%2fNL(x!5WZA}KREm$Mm3-`y+bx_Z;qARgH@({2FxWI@bfxQ ze+uOY&KkVfI);`mv$)QpV#{%oE4pLUcmB)-ec;?htrh->%OO`oe6_oTxujJiewo&N z{i*s}Z!XucS^b3Hh?o0n2}j4~8O|TMxYQNxDzXqDYm@8MV1{3HX@?Iv@E*D-NFbms# z9?j^scrD)|8d`#va`%~aWtc}oyU_cg+KnPTlv}!oubQ$));0(`%kY~u+kc`S8RcJ9 zIm(lx$xiiGxGA|A6p?-mJo%!2 z{Mx&mFOIe8ZY>759M{}A8w8y{9LX>&>E&!587VTR751l??(9D#)25aY|3`+*m->HY z$a?d=BPYu{t9sXN2Ith-=I#^qN_r{p-1)JmaYuERsGDp_fB^aPDV^K|r=+@3w&Zu3 zHINF%Q!7DI!D&cR&;#c50zbJnUuQF#!fvrURftinTB-SdR0uxuxd#&iPD4rV>rSJb-d9f>ws1&&Ls8t&W(W| zwo1~e@K#ZQ*3Sp!NzzCX!}C8y5TihT^ycC%+-^+|l?q+5eMST87Ovyw;EBtx+6T1=FRMs;Y-Qxwm6alVQJgA5 zcmz*-izT+TCmpCA`NY;szKk`n_f+o7k`Ah+c+niseEy)LWNWh~1sZ}-{uB5X4yv;> z^UFpta4x8C z{}ogN-h2Ti5(tU|EC4wZlRN~RA~D;t76|Z}r1yBWkCx!6zg?K>{mIwRF((l1u>L@> zJmff!2*Vw*Hn^|KyU3C1t4quINM&Zj$aft*nk{xO@sLR?TSx6*@Ha&><^L#!jJCO@ z8g2OD&dol$9MQ~RsF)c%rFZ=#Py987?TUU8pvGN*b6jP(=T3r7kllpVJu0@&OuY~T z8_3puh$9-AW$mcx#QOUT5f}NVy1v!-+KMPHuO!p|TH1bFPxdWudCuCyI^uSHnw0eX zP))$Fhr3>wDPD{+RTr^kdzzQ1>u{L}uj3QIiO0xYV?W%e!oXTNQF6RJ`Q1cmQ9slaEMhnk=gv>_$^I(Kq)_uFUTVJ_V2@iPg~Cq zg&grWcb9uz{jsF~vXUPA0hdgWO6z8WL>iyl5uS*Ms7$wI01%er<|&G}K}QoDH2$!KO| z*?bhi&yss{xrB7pgZcAlj6a^^rA$rURMl<5iTj_ektb`ma&1g4Li;TrVmeJ{lpoxF zj-~On(Y;&^VAyy!f+IHp;9T6@gcecUu`cvGWca8))N?$?tB3`SU-g71IfoS!5%9wO zGIU}3QGT6kvzEUydcYW1`6SMJMbEQ#kQ&(bYg8?TJ|z}xlqNApx`XLx>`$j`pzw|B zJyYv9A5q2b7-875wcw4SaDvuwaD6e|jNYdEe+p&ohWOBWbFHg0Ql4Gj-)q)i&-zqKaHHERO^8u8(_520O1F*K2a}oD zwaCep7I-~1$$1qV@dXRU7oSBE)vC!5d) zE{N05Zp|he+`diI1MO7R|CSVYaR2``#cmT>KVTETj(oYK42|#%czIEB5J}0>GcppT zkS)smW$eB4@nRu_j$t6{skW5w{~eT0zr3aIxPQS0+9*H#^iruI-Bbs;7i9b?A)otL zjsyl^CVl;d{z#wE1@wz*=7 zBTK$HleNH`jc*p+z6M&Ms3s??{&Un~%+ymcprD@PGe4QXd)sWrRhsk;bf^p^v+6DV zq!$W4TbX$I0{Ytf9=9#e@aAVEpLHKai*x<)AZBWcOHRcSMJF6ZC?1!i__tcEs|D=*muZbL_E-g!j+w69OB%@z|WDs|_ ziff30E>o+f&aKXc={k<5{qqaQT^1IX)^E{y1fKmwRT*Pxb@iCI-LU~#)yK+2gVNeU z=T^pD;I8Qz7!s)N#H|+xb{Q+vwK%LZ)k?tR<5=Q!u9)(2Mo<}`)2I}NaBkY75c)=c zlmGsZ)nq8iudc3c=rxJ3?qxGt!tBM@*$c6EmM1Olcn%(aI_`#O=q$Cd&y!Jmst1Y# z8+bbbQ`FxtUSrry#>tuF>+6dpV1d}M;d)K<^h6z#{OoZ#(R#MyZM1d;N9C+isBop> zQ{hzRH*~uMXn_q)5AVGkV9V^q}0XrgneY^xIle;P@ z;@aOfW+v?|mTeY`W)NLX>;yX+4LWaE>;8pj=kDj?;@T=mH-qREc-_z$8Oxv3*~$lF z3YTVQ?QpX3R1Ng-1k4kw$&crWEFaxo`z#Gc&(x8gd3@;6XjF@-u@VkW70=mw$`S0{6s`D+qDJyJT4!nz5cRQ{ zPlbRCg~enD`(OS7`r1MM!k_?*9Kz^>iWQiw`+4@4K7{fQ(WcEuzF7RF4?Ud1F2&-K z2s`5ogFmknF5xFNSMBr??zlUvhT7Mo#@h3755D!(LC%Z+Sy^Lat|J;s%ICeHR;)Jx zt?|LIh-x{Th3Z1ayRr+7W;arw$a2|S#~`^I+IX2YSZ$A6CEBL25E3cCqWXb8?y-D1 zB5fU=f1nfwQ>e&7^fl;V_%Kth2bpI*RR-RpRAurzpov6|+x7H4sMHl6vpVj|Q^=;? z1fhp6n*1rzcmVG%0unc=BdQl{Hp{6Hhu7-m0Zt}YsA|fi?Zw<>Ihz!3Uu%(MX(;Mm z&4$gkt48j|>=$RBbCl)RhuC(TRED(1&1A{nKs{wFOXM{-C?&2rXt#ReprWFJ|BDa& z9We<)9MC_#3x7usDSwe*#c)CDc8PXQPR5|D9}pZ2s%3a!#Q4ARS3^`>97dh>k|Gc6 z3sgeh_jGhfL_`@JE3WGef0r+vd;DZSU5_7-s;?S$=~YnUXOJk-Tm$8GA}t+Wov+Vi z1)4vDC-FvtUgpPOW=~aS(Bn;V0E&?jpw4J}zA5n!kG}kGGmR`P20?}IS6yA-;9xiy zT@EQ-2$zB4YLa1)oAq2}AgF(Wg37%K-pIC!(PTB>+6or!a6+B@4UO%*5A85TUA^dp zlr7@tfy)oGfsxtIS+8>n)AO3z*Pk}vt1JdDf0x=0{jjjbCh+j^0COxmfHV3B-(ddL z9~b@+!Djy`DSI(wm%Yv6${E1hA zo6ZAC4;d}@Na5@I>o1-%=0s0q(CFS9oTw{&{8-^j{;njn#V}guS0c9ZR0ut;2i<4l zf)JAT&XFl8wg6L8ssk%FH6CIY6| zc~i5?8T#1Uw7qut33M7?Loq0`tQKnP-TxL9DH&h~-O?z>8)#~3;sRa*1{F2>+^YVk zhEbK?7MPSLU3G1!g!tS_l1i*S^ANasLp5ZnJzHb=i!Ne*WKW!tMv_*Fw;a!KA!rI2IKv{ZgSHzXPCVq z8C|J7BzRhEgYV*5$PP+InGz-uuZ~nG&3p|zG#^%gwP*j@bhWb@7wugxeUyLB(tNZ_ zO+tZtYjOzt-1#6%|EaHhx=(cMarkxo~e5kC$ z;TVr7>l3f-NNHZ-nc#Oa3epCv-1zivPaM?lq$;JI6p96@9gcSE-zU;-VYf(b8*v{qpzI zm4d8da-3@H0i3twPcBbv-g?fk9?%~Q2hvH^|8!vTzAD%}<)bia7LgS;gNyqgEkI<1 zft}k4p>{}d7)n=Dr>r%FZl(w5d`8*J>t_k4E4E8%1g{1@zCyL=;#iFz>M

&X_PLM7GDz?EJwWAx9r2!#Nv@1T^9Mat|x*>H;+sVM0{`piE<*IVF-O+mvz-K zpKx<@V20F;N z-OdQ-bekaB_=>tQR11Gdq+S}*wi5V02pp6jb^rshu(RiaQ&PzNHb_5-F;Eq+C(i#VrYQG)3r)AD0@N5p|AE7pTf|KS*U;UOr+cC-D?7ye^D|C$n3T zv@sS55fc{v?bx@H7U3FI&25vdR!Oq`En^6-x-jm|S!zfLuTS1Z`Gu!ag1FDoji0%N zZTCUbI3sG#ZFhr6E3(KdcGP(sy{X=d#QMRwDOU{hdQ79A`70B!s z2I9?{sPp%0lcv=9qTjeiy1t#e{SrqVzXAU9k`oR8~a*7Ewun?(z&h zJUSY0bg}?%XONsO+$0t<@FWSD^h>wq;uof46O7Z>dehhSFmrpkOZ96MU zv#a-K6@T!iMWSt!@+dC)di4G0<4|?+l%Y?n%MxFVzwHq7$l^J{!mPFnx=h(vMonQM zgb{_)VZ7qGW++Ja#N|O1=rffIQ^Xf^Cg|cBM6s>-zV%xwXvXD)M3h316je?cYv+*# z)sRE)q47fP@Z!LKK;x)~FeMsh?QHBz&5KWMk)M>hny)p_#w^&-c~I{3FGJqgG7moR zGUh4(M8v4I;=#T}I znC__tfe;i!vjFu)Gw7$^syvuL-vwknXLo-sRPsqE518e2vF^Be-^+*&Rpq-9#^p>^ zq+@P;o*#x=9u^UAYK6PEq0JOAqhQH>B}*0XOSz^)ICb6&)8=!?F)QWISaWmm<+` zAz$!JTA|KC^vk#@lRM{3P%IizxP!-YJ5SQjzDtFIdyS4gj2cnHUr$(i5w_KI3(T$Y zwWU&HL?T%ze0=P-@n1JFx8gN4m?Oc#!!t55fvBt2fpX{c@={n)@e_0&3sM(TSb_Uu z_0OO0oz*loBwh;(SP_2vAh4k?f}fvGT?6_-4Ng}(k_3EOi|eM9@1;420fcD0je*Mzb? z%kla^B&zQ$A%m3@?PfO-nPtS&5UwLHuh?MkAO@k3ID1HJ}QIRa%PvLG#bgB*5sK9!I(@Uo$B^BtCXTI<>JZFQW z&ywdNw9q!60b>4dHi0n7f zF(%Wm7v6c$V8;t!aCqT<+>Fz+B*wkb?wY>+OB~v%Ud;J${-Q-sj`SQaFGG7)x>SkWKIOteteO)rm@8{hXEEV;=YUTJ z%RbiKfkV)E)#=MGTTqr5Y)A^unMZ+?Mu_fRHb6Ht zW*Pdeuy=QNNg#)Yyy66($60!M??ozuw#i9HM}>RA!FoUnmy#4p_ZWZVSVNC+z#T(R zs9#%FxT;^QWJpYG>`N%PO!1DAxQy5}ryEf^q|tkRI6nh)``@UAadsAHm;9^afr(W!}c+Gkx3k|Ax z$qT*c>0x`(tRNME5Yk?tB4_ugjoq0&vf*h&Mj`}-Mu6!X$g1_ZGhwA7%fcA`{mm?q zBFrPP$JZKJ_Emz|^m{J}I7@Hzulf|^^sV1Pv@_%x^eI+34*HQa?!nl&z ztrG)Bn+L%i8=O)8Ah89CEYR%l3xvMy%gegcX5b@b*CM(+7+Ba!Fo<8MNPQ$jH)P$6h4qAf{h{B zp(8@nxwbU>_P_vn+EZz=QU~t0%CSBsQwYMv4(hr1>sDx{6*ib{XyGv%C#+UfJ zUvY#`3`}PgIh|CyhWR|~qz*%nS5#g`Uv>(8(a18}IT^3MxK2X+c=bfwSvT5ugVVIe zVf)Jb(Fwn6h^8a!+l$LxX2L#nd5JOsPWq_}?5Nn9N;tf@^|oIG@Lrnp-)Z-18G4;n zFORY=#kLNe-IBPY+C!Y@+M4h={oqqz6AC7Kk&p0_vV7OJ!ZLoK8-f*K()*>~6{HXR z?k?!00W@OSz9V*!J`FD^DJf7fiIQ7kl_n(wWkWl46km5QtJVGT()O5Qnf@v)gQYrr zZ}>Nmv;W)i=W8REDb^XkloSTKA6Fe={Ykur1*@J&r;jBiTaf|0Oek)(Oo{%A6-%vl)G%wd4lLpGn!oOF(MLTU zBxF)N&WF|L@QN)C)c4t%1{K(l^at<*@8eW9U!Hd}F-^Uc`zD7UT;NABFv~HwMSr+%W^_j0CJcu z(-n5Wh`WuQktzK81cTw|Q(NZVhZjpjlBzE@Yl^$v9#ky}w4lFs+v2~LdlgVKKA?-L zefRd^%^k({Qwpo^WW3XCy`AA73j)y(DkcaLvKp2Lf>ejmav7aNc5K_XH|>3WaQyri z%s$6-(gZwc$C3;=UX~!L1nE~o3gxEwH9(VC%uN71D&jC8V8~ta9)UOyOlP9))al0W zHelx5^O-__$5%ma=)!?jZrajq65-J{^OcG`i-Wzs{U`PZ~74f-9eOu|9d zeK#p`c3*UDkQSckb_DBp?fkAy^Ro>{VcOCJ=zn^~k^IP|YM z8$@j*p7HW)_r>ylr?;Yot@p<~1%-wB09?@w`=eWLh_}`D?XWxoz{E7kyyQsk_~pLL45syRa(QcC&(z8}$$>`@!7I z%*SA%o_}}Nl-+teZI?Cp1-JYBs(4Vur8FAb+PN2z`dKKvM&qkBgd&=!#Ex191)lKuB27405!(|A> z{o`V?pE15|n~fUC$7pM34f&|bJG>Fw*Qo{cd6JzmqnVVL%z8kLndW7F&ChC&>UoV| zPT%fQwQ*?bHwx&1QMDv~nylw73`B|Icb0H&xMyT$67=)hjC?bF$#qzYq;JI6TfZ+4grP-;upB=LTd{GWD-+22G!J?)Xw162 z{l=e}#y1oKCwE7mC%^ib!<*5TZShjqsJJ(_y-0w-HFlK9dYk^-ii)JbZEWNw>qB~5 zw@!La@80B3!;D%r$(vV26fAir!&c&!{1JluMn2ypgYV4I^Z)o?nY2-Q3I14e3f=hI zukTIPq7vggpACK45*foO;h^cwVX+~lH|F=0K(^}2V$Ks6B_RFu5Kb+(x7gUBtoMU* z`6uclp<1QG9l!|RtarX$iiOV8kbf}2g}`VWJUl!w$Tu4}G1sd@93ZfGkN&-979Zlm z8K9w|fe)@{jY7p7@)T{prB}Zrlww% zwYmGvu(W@akEkz9w7oK5c~!eKUYER>ZMvR<{bZRUtva7JeF=f30e~(KcFXa{boQB$UdmoCX_KboD#j(~TS>ypPS33RivS!XV zH*q<0KY-qLg6^~aGWtrnR&bSdSA~losrjK*ILe5Oe3vv{XT&SsHW!3UO2$>Yus5lR zrG4s6C6S|Qoh~ms)HB90;!x>CW;C@FW;zhA*kv-Q?|nI}aO&(sN=Bc-eu(mmajjd@po;-QC^N-AK2jba!`ybR!*tNOyyTAgy#rcZu{}`*+TnxjFaF{m;?a^0D^% z)_ULPeWH!zjoxyfG{SquhhZlDW)y&_4uVp}#LliJ1m$&wfHgWxX5GMNEkS3q9#ZkO zH(W|~KU)|5YVx_?3Lhg?O<+q$@Tx6;rC>OcNr;p+B*pPyW^-DDiX&deRfE&?GwKGN)S_3sfk_Y?M=U(9X@D^c#t zp-#Jph{uR3a5i{F@+Tg6^=5RPG9GC;uv$`*@jrWv{U872go!-qzf=Fd)qe={^+?a$ z5BDot53z9MRga^Xi8z654J_q&w)L-%08%A^ud^I(L*~oAVRLywZAJMVfx3)Fd2L4b zH(x=rOcGbxQcHEwoPx&fN<1)8T6M`%tD?}}@bSc8>zU4~CUck#W#A8B9lrr)OnAaR zTtJZF{P@oqkjN|lYp{^sy#+oSu&_mdus77HpBX8(sYD?3Puy`$R{EMqyOpU2#xPPX zv+D~Zf%bG{dyvHLm-&5evx1N_giD*c56<+|`1FIpvp<9M^67HRM6L%5SaRv<5l3G~ zWh?d9!aDp^o8u}^sN#9`v-(2`MsH=cgz#BYizKnFA8a0b57$uUxtyH4!7SSa^h1BrYV7_xVXU8LB`g}nz0(zgeMKmC22 zIe&(^M_%a6oBBET=zO4FT`2uMIdqb!{-m6S@n3(y28)I8`d6dP8zA9{0@;_8KrP$c z++3v`Yl%r%jA(>R+eVl=yM7cRFL3F~zU6|2I7k$% zu91xPhoz#FibBmH$yQl`P>%?zh@YUtJxmE&N?5m(V2&?HT|G%WD8b+)E(PntXw35Z z5$8u1C%lJ;2Oh5jk?lfF<)K?9D>QA-mFm~^iv0rI@G93D1poip$*@Urc%B+))*9dg z8n}ds37KA_bs z@mALI@Fuo3>*An4inlUcZ&;}R%xJhtGDNACJp_T&Y@3XSD+mwD(JXw-mWV~9JyAxz zSMzj??&{QjW&HIODhC(WAP}fV;d5G&0piX40ox8eCw{ctflFczZdj;}1}=dai>Gr$ z^*>SC;Sv9vBb}N8g{c3Is!WOpfC#Hrs#AM;d6|H*7r;t1-Q`h=e*(P{o4IsfV$eh; zd+6KQO!aXR-Y-HiHY16ok$~mJ#l?kWtRv?o46}a`bUnn`nF_t2>*-Va=qOzFbdPr^ zM9xk9cBqSq{=Gqbne}h6FbVC1&F`!D75cnKn2T|N_3pn(gg!YJu-FbV|D2u0g6?^3 zeiN~Lo~tFgr_AHyi?V&lh8ajRAqP;I{8JW zIluT)wOIeXAmdx%aEuM4Agl)%IwsJ@fZu-*_>Qvym8(|yAR9_C$L~ZRpc(I)SVlrZ z5(hQ!cqg%UZatw-TL_AgqS;JIMSC#uG=4Z@^xxhf8j<3+$WIrT zk{B_DbRW9?u%cfpq%-vaN}CgakDV@YcPF$JR(#N&qlgkFD4wRTTCEmedBlh?)W{b1 zPxXYmYmV(n_5ROA;I^3o@!pug5McyJbLv4Ds>kP1fE!kJ4l60h$-UFj!Q*jUGuXA? z>DTW2YJ9sr--`dM(H{xUaauZ!CXd}`N>0%QgVNz;1X!V>%9 z^QXHd$i)jpJil5TNr7*MW*(Xb8s8Iv^>lkg)hwOHdcQzAZi1{_aUG-=SkDEd0=I)1 zSa2XgM8tz;^^jQ>l$fTbW>MlU*#0n}0AwzY%dFD^8{&2cq2w*p8de`_;zd-N z{0DMH(7$zecZYDwz+GXz+{|p$?NV}su;#=pAk$U~$-kSPZP#(PC` z@L$R+kztqsf$sil2QP4f0Ui8Vl>jyP9bME&h8lt05RjP-^!I-TKk9qq67$GGQUP1V zf*_GTJ0fL-ulZ=7RmGYkwfLmHm=z_D1FZ%RIKHDr{O=)&^i|5?^s;(n_cm8ajd%Fy z7CUQvXudYV8GNRzvo4OEA2gSYjo~4WQHJ6d44*nv^&P&%Wx{@UBJ2F-CLA1LK)^KC z%ns?{dx0iq;!Fn-prSy_H`W**qk`aCKKhHu2YG5s127aqTFYB7+AWZl^uO}YXMW=b zQpDq>Cgj_*b!~SB#qhy_#$aTDR_@TWYy(r{dnlPez3AfG(kg{`dQMO?XsRA~xtQU@ z2`=?1%AjJ|Yy9F5NPJsfK-mz6SsKVJZq5$hq`Ztl$$K*Vu)10}>AZ2-?L{KaZJ(*b zD^-rki1A29UC>+q&-KMDZhz@jbDCQb3)Z{O7GVrG#M4$WqRJw&4ALpa<7m7EF!J;k zj*Ldj(4wn9_ISy!7%b;;-mSPHo>~e8_Y@O&slohP(QNb+=pWGzPI^;39kQ%CcSKJc zQJfMK8BhQttGbl!w+h*rKpu-K>~q~)BoPT-A8;W=` zya9tEv*=JW6G<*?fincd#ST^|PSo(>d;Uvs!Cp;oGVAkFf?C)UVPs_x$AwcQ?h+cR z_-A*S>syi_`O3iU!PBnH=^ZSiFoTeSPiU#WoTBKTc-FTc7KUA%5wk|?y}Y=wX1=I9k1dd4;Y6wRu}3DqVs972eIvNpBf8Cng_gbGAS1IsS}C& zGH@i`ki_)Ovvt9}Yt!_KI`J{tU5vhX|C*d2wyUL3<~yAxYekM1a;rxT`es`WAMxMU zR|J|YVazW5x`@ z_yV3$%qpZ9tvChx$&$kBt|+(R%jhY3hLD|?U=(_?_3_4aRslm zs2)c=#ETgsex_EuTOK6%yGmm|zVl0H?*ZTIF%sQ}yZV*CJ3CjL-Nt#SD9f&JBCF)) z3Fekc{5#ZS3>+A=z3zl0;h{Ric(SCq;Xkft7k3!E7yo`p5EGE}Z02#nEw4~-glTOO ztDVCdOy3u_F4y2arTLJ`;GhJV+avE+#*(QohDs6BqUiY%q0fpKKkARf*eJqM4irD- zU|<;|KH)q^;Vc!5;Zo>3h7ENNh~{(*6dF_$99D4Kp$Htg%65Aows1lPo$vPA{fiip zSa!xwIK>O6iSTwzPU)=*Wexe87|MK$*HKp28}8>R4twG>>r_!k;}vi8>xBxtA+K6o z#w@5$rXlq0O<{VRzwmrtrRTsTt#-Y07^Q8twK&sshz&Dt99nC3hpcW@p3NGJytC&$ zEE(Dj?VYJk6CY6?Ka9-f`|p<+3nvJ?3M7@d%9{pewPIfWG}tYwxLqR9BZGMXf5$tsk91|BDOo4h%L~3|b*VVM<|P zLyI=hlBL2zc9#FdC*iG8wzo2Xc9fi+9s%@o>1xRT|KL~~JM}rm)>d!xaeLubU)G`f z_-7ryPJDG`)==#SQ@-<<%f?%ThseMEW1bE=Us+L-i@-Q?SA!^fk#L|{be#SVwlK^2 z^Rb)TaT`?d6w|cTvtG>&anK>}UXiP4;EFPtlQ?FW?xNc_?O?p=Vc1XTgP;47q<*!U z6TVlu4Z3)F#WpjII6Fo22OC*baw5z(5ti?Ah5!Z^-lSn2yY;)rXXCS*R^!3?;MfHc zc;Q9rUu>TV){YBe+RC>YT*x|6bA$QG&rEq)pt?^Q-!>M)mj8bE8lZ}bz)##dAsEyv zk;7J_{EQBV(}f<>@*`%&7&~&q`DEI)PmYS05Xtz3`PVlO5xDt8ne)z5ClX(xvtKVm zu9Oj#vLD#5KU#5bUEiy1L?$}QX}qClVNWY5MalE_CFjNpraIL>_;Nh^5ZxgphbnHn z;rfZ=^5HU4?67Vmx$sg)AV*p9n|9-nVJKhl+jul3h7Wo9v%3j;gNO{X`(Nk$aK;L0 zaYL=23JIwGxP7-+gGNFTkZUpfAekyJ1AmA`>s0`3t9^#*d5A;vZiz9ZTlFG#b zSP6sgPi!Xon;LBtpq_-PS-F31%bA=?_4G^_{nixtB@@b5#N1?U6si~hTTG^ZO5+cy zzKx6in=NmcL%j2IbJ6j&>5HQGR2X<_4ewlSZgx)^{b#4RiXA05Ho`S6_Ss|7b{ZIT z?THVo<#K-|KNiSF)5VKN;9;`bD(2_MSKjR3xN%)_7z%VG?zUwm2hA2M>*wRN$G`FP zP9bmOOr&wwC+}2#U5HW4yjZ{Usl?&#gkk~S@vf4DeJ1^;&}zTih5J_!=~i6wtcZ- zk3CtzyB`&LAFXW5`jT637<^Q}$6)*CyscYLP1e_ylanjT7xqm7+`FNXk!l*m-5e}@ zd^sp2zaN?G67x13#)w6#vIhqT@`(>XiJAzA-Lf={=Y`{brGO(R1IjiQtvFD-f;{=O z6b`efsL5P@iG_uQ)b#ZCaMQEelYSzD`Q)=N#{ zE=9szhuxIG8LPCxZ-u29wNHGe_5kVj{F3UC_+Ib`1O9tn294UjH6vC9H|6@#rE_%2 zlt)rIrb-G98%Vsh<1jI~}V2*By+t{I!N82hD zeMgu4_D_SWsy%7Yy-a=Z;n;Dv>n}OQSc&iWvD_fxbW&1(fOgC$4fbYT=X=H*K2)9! z+2h89{IS~trhMheeX&Vl?V0dY@%P(=1K@ZbN^wpuTSk(bGZ6_dFqV;6)=8$B!sH`A z&~z4EwrYo9ODv7=aLZ$z1-mA?W#{5gj}pPIab z1tTZtCmO{}G2kjyY&Df%$%46?1KLPMZw_|$BJDaOdf`*xhHDMVBKbspffyEotZ(3- z-)e)7=KIuC9SVh2-UA|&&5G{bD}Ok{JguCtT%4Pw7o$^ueBt$<`Bb@ZH~g6|qiu@W za#{HJsYItrTClIa(gf zFr0Y9yS-#r#mv-y=it0Fez^S)ESyA%bo`#oOxA(BEK{Y#EX7WX1bwW{&{!qjat+^8 z+C4lf`<9%EaBj%@SASo%uZRelF;X~@zxeP!(8IHrWuS2P6hwcSo#^Z840)=4!eHx% zMW12WNMvu8&li@6(BAAZfzI0X`Ky~w5DSkR>ddu;IaA|fx@@Mh?+m5BzTw`9(rICl z8H*hIqd27$HY^v#(WpBZ#e?p2?iJApv}&mNi_zDK8>eOr)Zr6wf2f=#DI#UX6QZ%_p%7Wxoe(3e6(n?HP(KqLX z7JkE4W?|?Sv)zJFUa5>=VpF=s=H4+hZtmctI-`vy6gE2Bz4P7u4i{*TeEiUxH}88H zmvEKluvx3-7l_dad@+e|Vmh+Es2L-a7^6!46J*zGbcA7ELr9o(@4Jg2KQ^X6{)iaV zIF2Bk0hM_Z>}x(fA_fKdLh1)zD`^A`*WWCUpG|Un zhaC=Jh;9T?+;VC<Jc_>Ol>Ld z9{p3uIW>hjku?46*c2l&dVJF#@GA`MFno{!2j3{taj^fq^UM_^ zlRI>=#vAWU7~}77$Z?B8m^`OWWiM9q0@C~TU-07$Uz;ZVG2qH!6cqfOX7;=;4Ulv) zrY9RK;154XRP$g5G=G?A-+C9>K;xlP9+680o8RoN{HaK}Fl%NyeC zh8`9m2o8nfUJ@)C^9u~i_m3w1s1NwRRg2`ZfxVVj7?iwC{Q04 zx$KNNIXm|O*DXlk*?$0rd@0kglJEUBJ>XEH0C9BbFthLwr$@$6+#d`6@w-LNP=R8k zrjLu#0L6n~TaVYXDi%Lqp$GR*|L{H!Pw>f)+vl%!(hY!bM=NIY)z{{#{fzDo9XX+2 zJ^gV|1a=+s&#cktmbyHLdK64~QE=zW(Jt3b5$&@Z_d7W`SsJl9J1h@or_hAYW&G}% zO_)JO)Rf^+%7(;;-mJ1zhpOAiJ@WL*z6Ajb;RA&v74^>er%tFp8w!NEknJn?V=^>6 zrW?=g|2hj|H}%Z@bXr0*s3e8zLG8fAZY8ktsD1T%>8l5EczOkrswQR)hMBxx?#xOo}xYDjYhxI~tb(>F{; zKZ+@EI^qxwVzKkdOW6_>9eb2X@vGuSVl)kZ>6;V&Qg2ev%X2Ff%>Et;XM18}rk-80 z+;L;>cT1)YH@?-tGn`#nKYjHjmF-WGleovPqSr)QGPhF4S)8q`^C2>{@YWx~>DQp? zMJ-%IigQ=S5`iZOkRL%*5dR(?ih-}=|7foVy|JHDKij@@8>>!H|Z#Kmiq;`H$gc**Xz4-;l+Axl_2R z>)Up^iHjB$#xM^vt!)IJl`=>V@A7t(sR*U`nd&#@MHSd7fL%MzP+@e>UZ%l zbkwl)ulK*_t*NV1tSKNHw{10MP;R3=me-7|M>MG_+~dAiS%Iq4SgX+8;5L~~qbvVB zsKw|ISXt~78GU}nhWTvc=zMF27jkRgJEb2OqFt_ux1xh=wX>RZJ7nJA&G9z27ipde zR`t;s7ZU}=y-x#cjW%sSlS1!=%`+UAfjW0Em)`f>AfWk;n*T3eO&F0}8EZH7K4&_d zWGhDs36mJhzgn?RQC7h&Xtu@mw7*E#x>h%ScH%<}I)~>k`E}HhQZz0D#AM}^;hYIv zU^{B^4w4zY2(GYRkk@114iHk%AJcldXD4uyUc$Y{lrvW}c5%IJD2eVab|OpERbfZx3#xOM{2fCE^MXCsQG@I%-@YP z@pAA-r!V1c%z37Q^U?zyjORi^h+`v-&%f}k#J8sy(vt%fH@B+2MzuOI1sZDG>7RS3 zhAZZ4S<9YXka`jupr1TnzgtXg8vYN;0fFf?X$DVH4F0tU{qA{P@I3 z>w}~G>Fo!{^9@sq53d+CThvugt2YESek?T9`&erY5*I|{2VY<)i1Z*Us8++QR3Rog zu_I{%$U{CGZK?g&_AJh{ls>L+lvy#RGd0p)ZOOZpMoNP}a2Xo^vz1TIVSp%K00Q=_ z*`5&CFTT#I2_x=h^F|04-#E`c3bDUvffJX*rl=~4x@@@XzYlf`9FtubZ)i-rDKyFy z-?_PQ0Z-PNLrs@+AGn{}&%ZGFRU==PH9y3c46xZ>LcS49NS5B=nKk`Zo{>$(yS~Scn8PnCS zkh(~(d>A@Zdirpx_Y=7>5E#nEgXWm|%VyK9d;U7=>9!I}E*uv(!@?()s$r6=4-9zh zdML;69meUVSC7W*R8D*~4GslL&sVs1e0i@;->bcbO1ei1e0f5$S$Yp5JH+mKes)sB zeaQ_so>Cs@rf-;Dr-wSdCxSvN^Y>$Of3len=0#qOB-~1Rfts61S?~LvbiPLux8H@r zTcUOT1Z?Td9e0)u)I3{%kMHqU=vvL=Aq(lKzf!gr4cp5PHBD~nyzUv`^WujQ7nEt_ z+)Df zGdV9>8^lEem`E2kce_NN6+cM_)WK>==tFlm35&aS`vqv5z(KIGT%CnelQRM*H~;x3Dxm>PtV}PHz3dHo1cGcYg1%Gn+7&!XycqWrtjR5j&c z!oJ$A!JZ6c1Z{7b%+J8A3gEB_YWQ%Wy%q^C{343>BJg+C+2a=mpVmp}&db_>sEy%I zanlLKmB%Z3#hmt{#Tl^)&+kSBoBR6QXgrkY<^z3J`}~twLVQt!6ix?w&Kx!{wM4`e zywMsWcV%zcd3o$GK1oSPzyQ}jfarn*WePAmfC}RDkVy0pKoIUi3GEufo0UdCb9f5= zB6!;8{v;lCpEy8D3-i^I^=GNV^vDOM|F>zWN>?fLNLv7&*Ed#=2~UZK$ZhtDFK=Hv zI+D?uyb(9jG20hV(Yb&!fvy{c`AT8NxNz+z^|-%gZI>ArsC?YpN9D_hPx|h4QPS1E zS!0GX?sKsp2DQ_0`+VrPzvK&e^&TvLmsBFBD%_pW^Ii*vC;B3p*y-XQwuXFSq%}PV zy!Jb3+a+=fO&SjXI@3H5bhH!VZoqGn-x<*8C~yHF|P_thDNr z*CU@T8?PPmy(>!-t&4M5oI5d_NLtc8&K}|)t!_#qa8PaZe)=3%jV2c!dN!J=(5=cT z-tk#9{7hJCtdedLDxb|h>9E<0_&wKEM&sOxf3tKIQX(lCZDo^^7v_cf(S>kFq8g@o zW+7<)4`+We6SdGmv!PUADWgs>k#~6{iwW_J@{E&4z9g#u!F!Qe2P*}Lz$sS*RUo}; zLxWy;byH4S2mvZOo9Wq(;H<=a{S!MYMSUi%^HG6l0gvD|g;LAg6dej0Wt~XNy}a?9 z57(#v*s3W0$XYMOMBLYu-8?IN?{HQ6=5(ygGAtCW|K;-o><=2l8vAs;xBv}t2Zr?Q zYz9{+V)+to23simcrrB#_zW-@2*I;qoX(u z);N5zE~L4rsJ?9Es=pMHOA8^^L~5MpgrLbw#nOMWRJW9dqmJ~|&x_HUUq~P#U(I4^RBDSsI*K&;N-%E*cK77elH+H&{Gkr_ zTx3OsNJ@OPfmkfXy!rwuuWjdCjnyYRvZhp$RBj_a)KXIvWkc(>kjRSW`6{XF5`|B> zlexOH+vwhWCRWjiaZfP1ZdIqyePy`Lk-fB>l~kq^e_h2@oZo;xv+n$kODvMIe!%u# z<#dW^Tk7=};@M~d-GfiSDf*quWgso7rt6~FRIV9sNnSYEr;nCf%M z$3J^E3O-owGj#@u(nK*uAuPJF3-Ci-wG2Li7DA#5)iUm%Y3Ac(HK@pfB_k(nn~Ovm zJZ67{iL*5Kyo1bQ6=(3;vDxwkxGNOfZ7I}en@S?`hG!!7d8q|bKeRmyR5%wS_q1@}ge_AceO$LT4*^Ta}0vDy9X6sg~f_9@0y zRbg^zRPg5%Z{74leXZuWWM~+L633Sl={L>mpC#KQ6$S=%1dt=SN?V znN@f2$htjRtn1D(DRMTZOA4)(hnLlnNmHZXTDK>>wU^#IXT#VmzmS!a~_|`%q!u{w# zC_=U>O;bSQt7_`^Bq0E z<(i@V4@ok$2DwI2sxWcvF6FSGdQzRQ7H#~h@u30 z)2R#}5u;$D-dKN98nJQPC`f%}Ml*efe~)fNLV1xx3n=jPF53_sj-h9y zJUwAe$vwq09-U|}6mUxM0Ec)T9i85xA=rn%C!q}u4gU$PM=gM%uDDB+Y37wgJd$8O>i{+^ zAP=siC5#(x&{Y?d-eUf2gT+!&mZ9G3z+3o&);M>#F@ktn)2mLf)AW>j!>M80<#Q7P zT;hFhPve2pa}ltm{tq;uiIk-117==7f#pN)ZDUgtJ2=d-Mif<4WPtJ0`!9N>aoBx1 zbC5o66Vk^~^hv7(T$1$z7&i(P_1vaC2xUcA5UG1Qd%vC&n^9e+=-}KNuc;eGS*bBp z{RqUnS)$a<*AnVgEJkiGQ6jWABTb%&)IIJ@M6HUv;MX&cQS4Ae4ZCIC^F02vSG+4lq(B$&3&@_e*u3LbPJH} z*v!@uU!yoiW=!{(ZC+RYa}E)F9{UiUj>R~2QeHEKUkafC0pEKz-@kS>I`!g!KnPf_ zTc@W94y)}uk3voxz3PTSqJIA{fEhI#$R3vV32KG)@zD!WK^Q(nZAoUh#q1J}xKR3G zI_-{3GA`1c;k-y%>|acN(D=IgUZ?P|a9(F)klgH-oVGR zBO%UHe-U%9wM=iT!O3Xd5d8YLJNf_t>IY(|%cqH-KQTb^2BU|fxw$zCK1T_c4Z9S^ zn>V3AuSiBmM^~N%2SqC4r)v7XiYBaW_JbW-SGd(hB~azOTbb2ISml5{Vg4m7Jdu(3 zgu}TW@rXnm{#H!>AAk8GHYIO3OpZvGcFTtBj#vnZuc+Aje<5#G_#H({{U_<9z*!6N zYyeq5h+umUfwPSq<10K2U{c`)Jl|PCQdTM}EAaqxwbJbO@86ri{Xu>V1&V8fZxJ0v z{%>T6g#@$bkAC}4QWNFp|D_%HGDU1~4>(R=g|YILaoYvIXj zf%tz{cs7dat9RMJH%?y;WSf4uU@;>T;QkiIv$lQEL}s^o0j2lly_wiRVg_BokliYx z@X`U<^)&~|UmSBqLgCJi8~EnaR`|smWb#8%w7^`H-s~B)Po5Wthtl0Ba;dgm;sA-3tkBPrYKpet^CVs^nI+yeH^Kkn z0z`0F4ziG~&-}17@&Q>B_jc;Y5)u;fii%8E%~>hHlpOhBfB%o5`6;+XH1jA1*err5 z&05}r?agK!aeeIu_S0){cJ_l~)6~SI@IMqeDLXp`FhKjKr`6^w*^Hs#;Uf(^%b$R` zMnXcB-Y>T22}Ob~gxASNB~hQT)qLJoQke989EvcLsMDT1l9C)^`5W=1!Gu63C0V5| z*%u=J1{xN-tw(ivJY#&t1o?6v#ID8qoSiXPg>R?hL9lYBom~5NeQG-VdCOi zC70RF_5{B8_lT}E&A5Hgs?kXX6~o2g8x;&(+?I9M9032RGRX0daww&wR=<7)O%m|W z6qwFQ0Mqk-z!jTgF3Ozswtjc7-y}0wi)o-qCu{eKR_EK`wC`p?DErTwtwyI0Sdb-}GoOi56b^^yV*C}s`3MH|GdaXJrvH{zzzE0Km?{6!_aPj1XQUoxI zdRyRkDc3%d>vLF{8*qOhLzhe?mvV_T&LyXwuiEZrQ>L6J4>sBU!WTk_H6n;EfP7H5 z(~Eu4$k)Do>>Q2a4S9VfS7gm*S-mJ5X=OG>>)v8OI#_oNd(yx~MHX$mIwdSl`d2eBDPMt`twEChSH z8pU_9PIz97QkU)v)S#Z#c%?q7tc`U!Dw?ewzDCM*;;^st3F`AK>vnk66Yn1scpI39 zDEc&7`)a3h@y?ROeE$1=Jps z#;d8%PkLE|UY2bPJeDO4>L0X4{CB)XI`{mV)1Q;ow9}~(>~cJ4?I(TWjJNci=YNFq z-Tc#OX33h!nG%(p!dEbz6wK8YfO-vHK=P!L!f2<1^<>3*^1no+-!vsgE`DQ z7c9sFW+RIh+@vCxSjZ{1=V$06=ijq@Ykfz1tUWaRC$mXJ2AkWLv)tC1JDa|tz2vZm zzvMOZE=n0pUvahP`M^%C-Eb@_cI3SY)g@LKBYYJMb-NxY3J$wcF#3xl;!gn-RY`&L z61zs9)q>;%@V>YdHRUXPxFhJUT~K3@rNbjTxFyZ(V3}{M62qJ%;7W)dc=q3?KqYe` z+FNlO>IQ#mfA4?zCvs3L@T&kmS&RTLip5r=^FvIdlM9wyv>di@JzQx>G?Q_2NXgUI z(Ck4Y)h@BBqto1>l7nRgty9HYxI6VcgUqswf~n}psz%Q#lV9K8zW(UB zQS(m;*p1k(*Y$|UAN-;d?dW-ki>@BfB~=(R2Lq+0AdLu zPRcvuGyFdQ2 z>WLFRD?pc&7^5W-rfp%*L|^UN&G_JY0(p8GEdETd@q(a7$&I7YZ3ZIGDSX8S#+j8qJi=^Qi~Tm3G3U@-j6ZIjPZ(eH^V- zfy?imHG2NF!mOyb6BA{$3#5!U7kIQ*Mos@~qQWP#M!e zEGjy3QuiX=ZIYQM=#g^JW_U+1(-^=cry#O9pu7C??DdaTy6YOchnDzJ6UuC|@PU5^ z!GU04V=s{E=Fi-Dw%UqL4+^atNx$RhZ?<$d6gr)+WZ*hQ1a{bscE3}4p6?+W4f0$R zzu%WpPqyWJ`V8~>75=}s45Mk=9%r6LZeKbw^Rjd~5AF-jR0 z%gxVd@m`i|kMA3?P45m{isky!{G7DRC%YY>RJtAs>bf4WVQPhQkPDvDLgH(8w=^2| zc)o~@Hta8SvLQB*Y<|&ga=FDQS(sdT$+$|aZ~mW@vFM4zK%6h&>daX4 z$stc%m){%4y;vaK;cL0&Per#J(V3|yXJCi{Zkv$O1QLU~HRSMv9Q^w9=HLA5Gfj%# z*erdck($k6!ls+BDgE|yo0@4iKL1Obm)(ZsPu|W; zvb9w{-{0=JH!{wJ$j~Gd_xH+pKQvgiJ;N7}Br~SYBRnmr+rUnJlXhdE0t; zbF1qvA!-z`&BH>d9))xx;Ii6LFx_HD9@lNgZOL@Bwoyo;80@GSM@cnuLI*Z2O3)mjyOQM9y{C)v8F?t|gH zZ0;-CcIY_e`Y#X9EHhA_8C}*+GSoO3vfLYbws3LvGpH=YfEgP;5RifrkeRjT(FIb? zQppL#SUlM0^RqY+y%03#$6|p<4ZPc_a%7y(VoZ$ZN7-<70r=rQnn(d_GSG3>Cr%+S?*C&Xc4?u{s zAW#j2$U&-p$hy)jAC>({qio#{k-`?-&$)xXtM?!#z`VlH1Ypq0+FxmrOoi26cc|JT<<@i5-_138n+@120mYr5Pstdwu= z=WIE9LO+HK9jzWG1+IzN!xYB%mgGEBN)Q-9+$E)S+y?Mqhj?3pu(k+b04O7n&H-sW z9>HH9kZ1sM0A;E)cvx?_<_sG(ZqAk*tA!JjzL%TL&Z9MxfZ+Elw+HYm^Cf(>E|hX( zF{*Tf3anj&z=qjorIj7DE~Nm=2bDKUOl)j1U=JlHfETMoh|aT)A^jSD`}DYPC~=D7 zV(!TMWnkpMh@WSs68x<1!nZ3DpyaX!VZOQB(Ncj6;tixL0iPqoO}8=S@$(VXMtP2IZJy%T zvH_LfOfrPt(*1a;0P(5^h@01WA3Wk~gHjFfA%XM{zFFywj}rI!oEa36UiO&&OYxln z#)3$e`<)nREIu*iELE~>2e=U{FFZZ8k#sHILQgEYnSY_wXk89A9uCw6Zr4T`wR)uGNkFZ?u4X9Te!`r_5lcoLK029hsHI8~T0UHha_l75Q(P%|QXK zR303R99+og$A7L`6q`<1JyS%ZXYhn%_b8LCqPYi;;Po4G9w8nHLwwV^|2cO5S3M@B{6BAWD3=R zHFlh?1e?!O_sBfMoXOxP__lF&kYZs=Czq0-RiqkaRp6fvO0OhHk|ls6Wn~~MoI2pL z3HKU2lOcre3~&P*-~db-@Q++6hbR7jeBJzmpl>d*bGjJ9)c{Q$@Ko#rML95;6aKGp zE*2x&A#^LW%8}-(F-mqBd0Qmr7BrZruhU`)dli^HlsQd$bx@}-3r99M+GVueg*=9N zKho4sMSE(woX*Xp|46Apld$np#$-9$9UlAa?JzTj-nyTSdq;lJ`!T%2{SHIqSaC3E`djomuz8U*w4R{9eza7xthM zp^5*VdsjtEU2&b&SjiDa zibJC65za7k828Nv+oN*uec=)6%XWTq8l98avuYofX02|>828l1ifad_-FX*EZhK0Y z+m*r?BLq?ylXgFxGX)(zB(51GeO~PsCj#9#n*V3;BFYDu{qUI$R7u8J>xwxrmu9;k zS=a4glr8%A#%8r%khlt)3eR7NxUMICbRG4>aoOA=uxK5XG`hRI6{gk?QZ-;_n0Jso z(kqQZmUMo^U*!Bcerq6PclRu1z!zQehpb2yUoTHLs}C9X=hb|=Nn;X;voGF`}BwbNQ4$%n<=Bk%JL`__Si z)LY#$u&sVDXjb%s>x6GF*A=qOy|&|dqkyFtWQ!*hVl=5#OKd`kVJXP0jkwpb$a1@W zq}eW;G+%ZN-B+_C476vEPIH<5YV*=&gQ!q`e%ZnK%W+G0!##WLnu67XFJF}`{ZkH4 z*~6M0tDexT`gkoRI%iOD+0YxKSvQc%C_)ouOXM0mSM~*$av7~{b=ckjQNJBWq@~bS@9se}V zUO|o4Jf7;OKW;xl^_{F=40WzHR+1_-aT2Q8?5pF@!bgdAu{RaJ3iEvVp6b}*w3G&) zn-IUO{g(WZmP#i2^zORK4OSssn`9ljdc<&9FDtvt_6N!72rPcydB&IkV2! zATWCtT{Q=X<_HMTOMpBz95vJC$&2BSP7mCl)&2?u+RVxZWMXv2h*fzrVYcO5o1MtD z=6hAYJMSLf2yuSoepr{oFElxN$XdQPfeDk-6HF@?xsT>@#86u6#pMhz)9&&a)Up+? zeiQM{OUhY~t4d0dY@)WHjNRQla~6${8RLz@akrqT=QsbzTL<~2f);Q26t^$~ug!22 zVu4gpom_&@YAJyPDmi{uXJXf3A(aBc$?a?8S`ZQ=GDdk8Z~2(W_$w6;?$uzLLofG> ze^QREg;_(s6UE0p|B1kR;r`4}7R~gD?7H#`e{no z&bBghdhelmoIZIKLWLv!`=&edoSQ`huE#l$z6w!EM4}Nx4&9bj4}Hj?>n3@;b}i^? z`8=7MRqzS}HxQ0@#T&QF7KaK?BN@4!Yh%cpQzH-4axoF^N;Q4 z@ZERr#2sktmX}Lee%%`a1o>D>KknTt8|$IVhh8JlPHbQ4ev~V_6jfQeqwN7UlQZuS z(l<*OU=f*qOD?4u2DMU1A=s@&z4=vQ9%+#cZdx5+bpc5W`=5=n5WtLIhjt$^%Z*8x zB^KN6$ZN7_Cm^Z)Z|(hMP#w<`KMLa>AVBZ~B*EP^cp$h#aF^h2!JXjl?(P~Kg1ZHG z3+@)|?jhgb^W3Ui|F`$mrKo~)c6N4Wrn{&6(>>jicYmgdRlNij>g=z-e!6^?8arJ} z==Ontl}OC~1^EIZr%mr3J{=Q#U>^%ZsMNc-f?c+~p!${O0{8W}NTgjLX$84}$<-1U zb=e()eOe&}12Uv|b1PD*K4kdo8tb96VKzwbFDtiwp95O?-n`ed+MpSQ(jFqrohMZdegNs>U-u6w&Fa^fn?JdQV}uW82UXB zMBe;(G0b&XR(p516-lL1rkZB}h$16#$^Ns&GJD*aBFe6!iz~u2>Oyz6cn0hW-QycW zeWdt2v*Us^tx8&XNRrn0%J#d!a6QiVskNk)8H4^h75P@>ltPdQ6tueCUrWUen(I8A z7~F#(dt~?GFH6vI2EL5aKjEzyGU<45WEv4TV<_iAIUdgDi&lSw65!P1I^}&JuSIiQ zE6)4W1>XJF-8SM#eSzKwq0;^e(o5Ve@xNeK4xO_@fbi>{pOJoSF;ITI*^g zLCo{8@Lsymk0OZb-cle-2V2Ui7s;Ro4%5{SNR*V?9g@Qm@gZ~YMjuioK+lUTvg1uVw?v zUvxyQIamh-^2issNdch;KvnFCw-R|rPWvl+7srp4x4bekloA&wcL?NQr8QS~1mAb^ z@RqkiB^&NzMp{z7IX4S1{kdX*q6i>pd##saTh;wUTbrQ_5#Wspb;&IIsqUokP#58J(MRN3s#E(h-N#2=j3%8W47$N8+>>t)xQXUa*40Zn+;%$Odfw7 zxE=m<0yY5dCl|(SIaJyqT5$zbu~O9%Ta{r46T6-GJ-V5^)^Rpq_PIkWS6h<-*RFh% zjUKqjD^Q>lXJ4$@*SuiIqXH0HG0Yz*eoG-6v&8{A85f|E8z0SAgKP5wuE8q6AQR36 zUYwMwAH3rNNFU&lDsNoP0W4=QME##f3b-<2HwwVhc0Ryb3#0LV25Z&8T7%IYAOq;D z3Pie}v^4^56HQ>%AOtye*HM=## z^q~%UxnsqJ8ACww+G*YbAbrOd%5dPVE-(PM3jhX-hU0_t$Ab+cV08C@7m8qC>`S~a zEV2S%@Qd|F0V0EF`*mAZ08*oy07wA1E-7$`C^jw*>(%U1$S?usLV;cd?81>s?gsD( z&f8`C1)zcgScC&AX$p7&nl-b90stp47Esx@5C}Q|3Q&^2LRNX7hQW;YiG-UwWlqN{ z9UNB%WS#VUx}N)IbX<^fkVKJEMIyjJp%8LL{SWVmAQT6T{D1b*G*04lZp zY1^$R;4lQ_(;*j_Fh7AYYT%51I#6^IppvgKK;-qm;a3>H_KpLT(cT`6RRjE7fD(%e zc;WsTL{xJZ?6QF32MLRWwZ0X}UjUrYs56@l0V;&N1*%o;s{$ff)cV)$4>Iv7AAlul zpHf~)`y-GS01UVQ$VC>=7HseW^*BVh6XGoGHiL`+lN=hXIy;2z1Nl?HMIV7G7huF6 z3@~uV#F+x*H1!s+Jeh`?&j3#G1B`m`s3ib|`ffW`7I6Cw)nU@iggL+fV?+CU)2Y??*N*e00xC}?P>FQ+$I>3V)$+hU0tB>TrE>La1TtW16}0t$ znTt_vaiRl42y%d>X}uVt0TKy*;Z{hH`hN-&U@`JqyTP1^K_(HW3k3F9%vbpU@~|4< zrGKOnApxE{MDNG@OK@>)>aP`2K&~cWO_cwU;upXdCLU8KONq4^fTNuSq?G})B2fMP z^XpnWDA{rVYjuU@yyn3Hbea$3O$XNy2K=C$|7bPWmj!sfLJED$5%cQzLpq??cOQ_Y z0qoNS#!e09^gKUqV2cCi(BfEez#Qj$uz2;r?pdt-WCK>jC3x93<8sox z*R&PEgAmm7x<6MW#>M>#=U5$>{i*}nr;K3+yP-)z3cVrklKDKifowy2F_QG)oTC4l z*BcFE1KD#%0Bo##n4yCZAnJd&7>NNDi0*-)$AxMGcwW}Wo&UuG08A6&KnO5@K7grD z0LUTO_5y0vPywZMfms?Nb-o1T8D0W|4jKRY(Gef1kimNyFh4_rK&F9R zK&l%6*cx!gfnmy))F>J}9l%8{5-O@68dl8#;BqqteJDeT48#C~)%g5(eZc~7`D@yA z!IDx?umEzL13&5l{q!_Y=1O zefM*%DS`XW>)DP-pQ`Q$FADh6I{4Gz8wBtT;Hf)`i_ij-An?)1m&Zw>pZ%p53;@N% z37*VTy{;v28_Il(!Cn%R!E&`Cci{it8Wp%X?p0I*?cp~f(qmA!!B`8>Rel$Uhb+JM zzlTBtZ<*(Z=-;zplPCNqv*A?2@E1}oaqxxn+I;(CtqEYVDO^* zw<9g_CBnVL*Ib87n)!DqK-5N_MV!|cp$464!1;fdFJ#O9E+pIm1>E%zPXdGQ##6Qk znp4A3SD@HlblmY!#j4Ogn?~*Rs~80)+hAOlWuvWs<56QhjyziCBNYzVS_5teX%x7_ z#PWHY6Z_jyh;oPLY4-h_VFwE_nZS+lu1bD^HIppWVlfIpLjJc*7wuY08{s}tgn=3v zf%A{iGNe?AHUIkCu_T!59DWH1Vax6h2M8mkrt@Eaan5u)Fv8F9bl(MriNJ4w_8*Du zNCQMc1rL@Q;C)u9U5>CrYm#z`>4PzlUH=pN4J=>ABNq_o778$|8%#z9);@w-Lb;Lp zW?D95ZKT`xC#Jaov)$0^NLP8YXi52>Ph8Jup)DKko|kKH;l(#W#po)Mb{k!rJ3K!|0m0&qd*MjwDS4 zvX$W=hvMDQ&JrGn1#P7C-?;X|Uqm-xN^@O3h}DVKJdotx+N#4C#23Uisp_lmf8>y+Qy=KMZzy#w5?ruU_1zgnWwd<>vP))&#T zjAz#N;#(2^Y9ZozMB4T%Bwg^0JQ4l2^0q<2qJp2*5ID47Z<1<_ZgL}Pz5f6+<}FD- zKqj(CbT1)rZWt{26tIL?8ziVnQ=~O|PNgQx zdQ!%nK<+Pn!ptB*D0LRDPLX?HMX>N&>j=VQ=(??44-CqZ5>>BWVSGls`v^zh1Q}xV ze(o)fFMFh5DsaxR4xz6VcD8g+AQ=uuQaDokY(UrL1=Mssw5%*3;hGG{C2n6klVogK z$wbJ?$sH0|Yn^7_>p@8U;e?ORXQ!m`0BbenjIIw!jW7<^X`L-hS8*eb;X>@O1-4n^ zl2`hn{q6qB-+7m8<60}MW3^Iv*2~QK{DG5~uTY3s?QplNAWZ7*CzKXvK`B}+Yj|nV zPXB1e(vPfE=`35~L!7TOvoppFB*7}zOclh75vdufJD+&y63nIN&sweX7OU%i-nhtfBGi`R@ z(XZc!;URmK1^wBSYy0T%f`g?Ay`|%?X0Ll`MX8C0uLWy)aKdjjg`f0H(=p=p+f zE~zXD;-+eiA&agNLp--PVLH%X+n^6Kyw7z673`Zjh(C)6Z_zVePnCF0e>8z3CH>0G!j4FhntfSdgqX#*_Kj8aiXK9&`1$%_^iwk49Xwr_yq zdgE}m-KwjXI(G>vdETR&lq4W-9{8YpB|r-nF%hO*iUpS1op~F`Q(PYeHrx}V;^-iu zu*xTWQ9;x-Mo&oCBkALDjYJea9|&Lm?4&776q|x)1c{>OM!9NT@y_MLuUY@v6wps8 z4K@OHa^c>;FPc4c=nxniLG?BdPjc?EeoDEF%g)5K?jV`gx8E~s3pLGVcTZCOg>TysU=2p3uMU-$p>i8t{jI zJ@-`a22JiMjFm5&ByHv$hL;r8bc8h&9sbeN2O~a7Mg-E%vdoR4#4PnL=yuWGEK#;3 zeqwA|zaeF`bJ#=&)j(e8`f=~Y@SB$=fH6a=2&txX%vJ|Snz@=&P0ZexXx)4u)=9Xa zbe)!MoxX*t@YttbEDtppbK|Aj`UxIp5;cy{<-r2u{OS^6V&SJSAWu$3 z!0&YCs#FtP6dokXHGL>5;;7$nY8ShT#Dkr0%YnDrG(>t4*BfNG0 z2D$ometJYmN{u(Z{5==F=oKl=QZcBOOU6mOkh@ae1VlkdY>Ip*z_u6xV-l?6lm4J&q>mz5pE<=7+0b#X*PH_+rmwOJ$_coxwJYk=RN6 z1HA-kXPWYMv!npa-itP%BPOeRwe>xv;(2C&|E_Ga=Vrx7qG?b%8NyBpv3uF3k%IAh z`OC-4WKz&#nQc@R&CYG*8?oki`(ZfeBdIz1J6BSvRH)&voek;e$`B!6{TI`-q|FC# zytf0+Cc>!*7LPE!by>0aAWIs3YFmWQc~AL{oZZn=c;QwK^MC*_^FYUj;n%CLOj z(cF6&F~8axY1m$GuZ9O#J}Dx1?|W=q@uE4?2E2vV>ocgLgQK^OmubcfEZ0z|kguBP z3JR7nNY8;l4-TC0!I8b@L^)c8LDUPThO#w^W-m?c|=8;rH zt;0tx-+;zWS^oUXHbw~B-fUf3(o_G@QoRjoRaV6IpXe1wu=L}3n&i$2rY(h+a*-MC zaq}T2I1zh)?cg70QmXuQJSBZ~5hdc!hyV*Nu79T#W^VX>YrD%64ylm# z0E8fMS3QZWoX7os#YyXG<0aHM zbm1UpNse|zzQOYL{ZaKy0~}UXnx8H>eniDS_4e)6eF&_(oISj~km`0f=^=39b9_T=5B%fU#=6aQ745ij7F#rom`Tap%t%z3>uPBiFWojpOW)w z&1O%|WxHJXh>sAK!YL@^Jqe-;J=gk6D!Nh$u zf<GT9818tA*$@34tF*3U<*~aq!!sZ=1n3FP5>w-6i%(JR_>Z^IUaQ|@ zuP7|URuz%*Z#_+Q$B)xBZkA8*63428sFYxbM0*%QHyYFBc-EfBtu-LbV@Mj1eg%17 z4Rz$Q4mU_s1?@6eB$FEzveD>m9QpC{dtfP*Ll@R_>POoJ=!#GhAR{|<=egRtBhO_%7!z51kIb0lVcwVw67h~S zQg;X#P;!+ZLbJ=sk@<&i>!sba@tO@;1o#_^&rw>L-lXk>$;^lLl>!hEl`yk1(o~Zr zX;84t>L?&#D6(t~VwZb0)fQCaw&V*M^f&otT~sE5mkn~1Z9I(_dK-*)bcj&zi!^C= z9yAUXOnVOmA2q7X$jk0=2swy%t^M6cv+UH(wF`3B5u=Fb(@+TJpc71ocx&pVLQ8HT z_$fX`-D9F%whBxtHh=5X&}1dK6qW#t?9y<>jd-#kdX*ukfSWhWF52h^*FN9#6|sj- z-7z0;NFL8%Xz@_vX@qBFRQYgzTlgfEOgudbABACi*H8$p6R4ge`^%2`FjGQYSNdgo z`ZQN|ZSnU|)sxh{^Sp=h)OvHCo^9}S1Zw!~iV�9BB}9WqMs~1`NyS@+;d0=F}5XKW4sSlkM7AWqZc)4K$e&qXB$u5 z0c!pwF}LvkcR2@2+DvGT@c<#N2{_o{PNVVeI_Hg4HAW+Le}gO+Oj7x3^P@bo?OrFp~LGc1GMr z9WUt$`mqTc|JdU#ra$|*U@GevVw^W$CWus#z=bwER){R?UV7qD&Swe_hoqh2(O2z{XL~`VnhIw3ZqKyL3=*OV(%mqCb(-3Jrr_Nv06(D#MXC=0vKp8S5;b zZ&7xH;KoQvbqHw&MEVzR&Sglv(@X10Qb<#0gRBt{dIrPZ4 zvM+x`3R&6DOoSy-Fr;d^ITZ+2im4$%!p}rz;?Y~gwZW{H67$C+78W98J+uqfFe3x3 zc{c1-B9z=r|8Xy=`a}ub=f6lQWYyNABV|al-s=5b5t)ik8)Y-NNXEt-+t-ZO@003K zx&@2eAPG&_vX^@sr+`O9i1gP773At|irxK$PE(_v`e7IJW@}?O-^N{*v!}O)3`AC< zgW_n?(^$Gb-OgB#g+&8{NT7TCH_ooyh31A{C%m{cJ6rq+4s;CzP2cw2*r(wkkh@PYV@6NprwEy(fBp@hXfp5_&F0hQ{@_zqVD6lVH0t_2;^*O71+X)&Hd zCgB8H0ceYDG%Bh112VQBOQraI{E6-CM#Xt@lNEk{Kdb)(#nDUk7DFHfz09?bRK&-f z53k@{f6bKEMps3&Of>Q@q13{uwIqR<547&~haMehpV*k@co}xE|3mS1>^4$0PQS|S zH1sQ2f&B=;hND2Apu+Ud#Z3PvOIO6rUVd)!e;8%+d{;=3@H?e150_Ju)VTW)Kx1%w zt5={K{J&Aue@y{E@V_UBE5N<-H4ynAD89i+LHsoeZE-FFILMLX;DZZbFQE=$7XNkN zI^p|fY5$WM{e4dBdq5Iw@K0lZ;TCH6hbI9+dR&CYS5x)ikUiH3Yx!3&5WsR@S?d4% z`2V1-|5HQxXw|mT9HoWby(#SLTcL_AzItmV~ z1Ad1{hU;?W+UF^eeu;eH4*WM4845Muo@sS@n2#y3kl^l4^WV_Tyk3c^5l_Z|Z7%LN zRcn_4L$$THw5)?mCE{6yw~|Noa@oFDux zmEV8hGl07OhtvIk4S|LEKTnU5whJ$&HCOVZNGju>rDL_G38!|CDkc%6v~J5-4)n1G z@0h8^)bR>>5z1W$BK0V&ea7aHSE{Zd?_ntN=%U>L4L;s)TxB-H+MNdBxnjo8@P+?KUC|BCEN5`-;C+rZN0g~=}<T;4zdn-OqyNE-wFjTaNmF!$@`cf#ORaw%J@d2U zy6_&2p&q@Tqb)5J@k=^8 zk!tH673&w4ZW+I0)gS{_!!QsWhhoJ08QNI3Xv#3=v#9GWn17)zr3|iZ%?R2I>Eq2JO$N51n)xx zR~}FKZexG)+zgUs{(GtY7VjIHf*Kbo_(yX?6U|w<$8^LIjx1bDc6AecHtJvd2wr{V zry~jNWHpo@%qh3{lE+sRKgGF6c%QOg^gNkeCAWF=Ihks#cuoDTyDjYMosCT1ZwTF* z>s>M3z!|%u>bhFu^41?3Zg9iH<1HL&BZhVL?d(QtZq65+9M&kKp{g2Y25N*GzI5stnn-@c=f@E5i1W`&GU;p86oY9fiK7 zG=$&vZ}+7LL|ZmxE6c0%XLX6Gy?9c0h9emDTiYHPcphzYnt)11C2^eW+5<$PzD< z{WlkH!HK9}xMT0EnUtHYVPuQ~MoGWHQ%GQ2>w+V>=Vta}QNk{-8KtHhrJzQP?cFXM zTe{<)K{^j>(@DE@XqJ9PCL0EmT+9KTR&pypldARHh9=6dcQrr>PGaj$U&$cc>%P!R zbuZWVbfxZ{k>MTN`oF|hCj`1@ZTMacQA>Md?eArnVI}AKM)y7%hn;?2@al?4=V?eq z2QSiqTL$bwyD7AzJ+h}Jr?)td!M*F?!`*2}_GazGBPrwIc#Zo)beXj+Yx2;FmSQpn zk)PvABqHMTdan?^w?b5-JJiCbHeR*^ED9jA{acS_Uc_J#ETSg|Uwc#Tpdr|+#^8F( zV2wSryMaB^_iqHc+K*eB7HNLH+#q`y&TPav zM}tmHb!sUc(7^CQ(3@imKmze79xu@6cNGg-_jzIe8WN|osdDbFmU|NjUt#d$Mee)H z)wu2=y5^aj$6E*pv@7w?f=Y^{=Arl}4)m30w`0d?BjFD-lHw#xI_6Njw|!*XNw&`q z&8c(Tky5|2B~|2UX{#6uP`?4yA$M|Z^a!xnBEHyiRmIHm93ifbTBiMB*Hh&VsN1tJ zi_{&Qo5r20QKIJ_jQX{|e}b~A7!_f#ch)-+&05Rdze~l7S9id0l``dUZ4n~9DK6wx za3U!;K08sKCN(m?)b>+e9r|wv`$UJU2_I^kq+{mbNcx`a%YpMe*R0>}lkfeZ&V*Mg z*0lfY5{ZYQ&5R4%kHPG^9ckbUNgwTV+hWzTlwGPSI7;D~pq3dr)PCq&u}j*5oD@r` zaiO2@%Q%kxW|nTIz9~#ZUi9rKL^n~7x+?4ExB$Ke{|Dx8&|Z0XN7Cc*(t?EUy3#$6 zPesXYG1&v`gP%b>GIi>~aMC6DRB)tE4RJmn(d18Sg<%{!e7!mr(!R%C*O}0kOy*^S z4(hiaqi&!R8;hyGxA}VPsg0ah?G0T_j&S}xQ|_St_-WI9UBCN;3d?dbMIG++w4lKa zQ5=WUlNx)r1}dIryA$)kbE7bGtMeycd8(0vuseMLPtU5C`-1Z~F2$!n7X3#PizUto zvqe=@%gFVLl59g9S@mtnb(aD9XBjn=X&o|$Lvak`y1tfBWF)i&eveP7m2F*B(m@NH zx5A>~f1_MAKB_L(Bg{4atv&m^S{XOIAp;glLP_hcSvO;}a^sPP1Jw~%M;xif(V23m z`>+2C}`su@7o$cZ8iiu+Ll{ ziRMeGbQF}~_$@!)dpe_=kKHrT?GQ*m$2*pKkz{)lw6_fnC;y!j!syWX3rcVJWUV6R zaWDO0uhDv4A$;)YR4d@30j zErYu!7u@VMt@qhiEoDgy0o@^7i^*zsgfE|;It$ctlf1NLnZ|F=Xyc*Rr2c9w-+hVH z|C+W5E9K!=V8y~BceKxJ2Jueuh%!O>P@aWfGpxPu4KJ3XZGY`7?hOd#{n1~>z<8Hd z?dz|?3*VU$TVz%poRmn;ao_V)3NA2RdGPdBf3+=GGHJ2FFD^9fU3R${*)y#3thNe;mcYZ#h91?si%z$Oh~3e=(wTd(}Hz2PvXHh(5lQec7JnS`SP)P zdgh=DwGLGq|8mBfv2E>(Sp6teslBmaj?nh|W4u04_90U7)PBpDu%r*sq<=;PiN;Kp z^OtpQmjp7_>FD23-s%R=M^N-a-5x6^7f;S)=GN{ge37b&Ji?r=P9@LEA-1$vyZ_pJ z?JoMfe>2vv3=bF*P~TH7xzcy(+=?~w zi(O9V%t8zf=Cyg>%C=i5zwJ21&~ab>2^xN0?#VJ?n3%CNhFesKV~9PtFzO9-zsH&& z%Z8Rq`?I}};@g6Tj)6To@xE6+V|6oG$^WE{TTTh`DO^%BWYR#s4Z}$Bn2+5Ee^Z^D zXH{S~Qs#8+!d1%%dlL`6mEb|O#7)lB!(4ra}lt!j%Du3v?i;uGRu<(YUq zT;1}NBZsHeT!xS%mxO5!G+j$0ChhmvoNR=Tq5sfHZ=j8+ zF6<>C#?QMSa)ZL(_l;BK<)dLrd z1?v-C$a6w12xtq^SL=dJMUmF$Qg&B;OULK(0v;}z@YIy-_XD>KeElE3(1GO&f?jJP z(u^!I3pu0TWVYItl&uNf!Rgng$4I1J>3d~svnp0mR9MO?+3@!#taK4Z5JMH`nNGFokju{S)Y$@Z1?cqp>5Hdo)tty>n1 zTpOE5I=X*y;svqaX8XTyu`D>oLc*#O5gboXTKZ!vev71b{rtx2lY+d&yDs|CpOfp$ zcAU@6dUd*?C9I}$xI2x+3vDmt!tNpYO>Nbb<$d%8v$e^X^Shul878`0#gK;n(sa;L zkI=mRbmDWQ(870xAjuc)I;t~6q9tD}xeT0HsdmOsiLoCO|B<8ifq-QlA;JiDys2s< zqr|4T(@As2iCEnDpWOTFL=8jMq8;Q6n9qsxZNOVUg@Ty&R0h3j4OAt$rCyS2avLvu z*!g>qO(9g}Momb<%TKD@X4!L;<2AAckHV^RCcQmp1{eqVs8ngSM>emXv1JPEWv)y} zN4`)6$13t+JxS+S8}$e2jF`14L9Ee**~SSP4C)N*=|_KdD4T?_M`a+_XdKO@a$ z7K?D%1Y@F|@#W|)7_D)Q*=A;IWRVK1Tt0M49n>L8IHc?FC0@g=hch~_tKABky8R+V z&Dg^B_*C3V`Z% z#7yj`Lxhgv%0fvf5{1p+oCW_aNx#m|=D}#m*R2cpG#}bg2F6$eC~PQ$I0}6;j;OnK z9M&BkQDg*ds+|i}fy{tsBUx13b@5K#fRnNPW1GsaiO1=uqs%!U403-3X*>q^6{Pb& z6QV*dKLzLepqCleLn@uQ5Z_h4lca7{Lk-;?)(nvt`Rk&zUn zkkkNqdFIsK6^K~Nl>#cAA!N-zOXm1N&OSHK=)}C?jPm$T(!w2b=0L~ZwLLgA|!bfA9dUt4JoI) zH{~pl4H6A*vr}ZV8!{Xmg0}`v!YvkUW47&h&#clm^OBSeemdFtm@ldR1d@wlsvTH% zo4ncJ?HK1IOod-_p|0#|jQvMp9ZEhwLm)xcZ6qd8wU()aBL_8po=XXnr3R2HWp6rj z-9y9*I(qi4*LvI>IGrW0^bN;DlAZfrW@5dYE+$;q!_uWrReb6gVhAcJ<(sQVBcFA& zbGnl}EQmBXE?X`(bDJHgQv7}Mi`6Usgz5>}b{j;&V>(&tUk>f4e(Bqoa75QKTKAa? zOF#-I*!-m?L&OtVVefGnD6s+?ksd5!YbBOzx4<}LO`pg4ozYE&q8t85HwG z_9ZKf?2(qA1LDg~mzpplexHASx!{FI)!A++U?mFu%~EVdMA`mL^Uqt{zL>m|u!T>l zW6BAN<*qdNt!gM5PtaD{yyHJ|O`7Z&l7+0V^(Ti!u3YrC@h`1wE##}-WTX?S5i`f$ zqd6+!?}(G#z*U*;b!YGO9k6m4nHCKG$r+>YFQnTSYzRS1Ht<9Td88 z{%b}zIiVPmy4Fd3=)07@QZ2vg-MMH5ReteX;=ZFFdi%6LSwVd$g#m58CsT8+8VufR z>hN}K?g+gKbWKsI468=JYh1>pSjF>kxvR9`pwWW8SW5ed92^i0MdoG3WGiLqSPCRo z?&X|BiknbwvgB9Cm*9Zy>UK{`19NZyy4qO1AVZ^n?tJHbWVbpmB9|d|iJPEFir_#x zDbm`;ErH%6Gg+G=X?i~Du$S4&M7f&3tI%w-eH~flDA;iP072hT1&d1l2e${Gp7+{= z%Wvuw=L*mI^0A3<6B|&IZ>5Tb!OQs*3~_tV*di+Y9!JqGUy3}@>XlPvxIxMjIZuO{ zQ&oO^Ay2Q0N6*?~O4wCN{O(;P)og10mk_y!SXs3;Bcj;TKa_GM?4ZX+rb}Vx=XcJx zrLX3ph-L^J&h(Dib{!oh^ho7s>tSY`8am3nGbsq*;=EfAk|(D(C<)w;c~ zl}c0wlWc00*%`D*Ue@*Wyj#K|!+VqB-^sRuvv|v65|)o@aVdlyY94dsp+*|)3VTnt z=P|L*Ta_w}0`*SFO1aY&7|P0yfXB36NfLH8=ciY}(n{1d#YM^I>%z#=(u76kgJ6U$ z{#!h^BGE9)Tr)cJqGuC~(I(CJ{)`MF$}9vyDzCCJIE>WxyMz}0X#4oO2af90;slW; zk?mPqqm712@F0aOQ+a|>L%YO#|NG(>i+t-hvJGET#*-2FsZ%zfrnie2OcmWwUasdy z7G|}o6M2FI2Jj?8(&^eTco@{wDdhG{2bbo$Xc1sFg&C=578u}gaXy-|C z>XzQ%c3|*T<|XrsIFt12AX;HQLf04j+$+D#b8Nrl1y#!4VL%Cl>%IJG+{aK#qJqC= zs*Wh$qU*CYjvy#6=w~KjjTv9U8ZCJ18J<{GN=$!J%4BgSLGaT$STEGXir87faHoFZ z1n*tL_O@ce|3;x5(dD!FtMifC>xh8qsUA^Bs8w`^=Vj*?1IGkjosPLp(Q@z*YV&pp zw;uDt$p@PM;W^zXr0$3SH&?<_6@dT#qcQ|N60Udursv;RKL2~p|Jxs*(LPj0VCemQ R*@6Im#6@I2R|x6){$H86Ys~-v diff --git a/docs/resources/diagrams/ffa-ns-interrupt-handling-sp-preemption.png b/docs/resources/diagrams/ffa-ns-interrupt-handling-sp-preemption.png deleted file mode 100644 index f110028897e017127fa0296c2645a4f3fbe15a4b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 70490 zcmd421yEaU6gEf;#T|-E@#2!=R*IJZrMSCGaF;^S;_lD_MOxh5Qe09rxVyVUHvPVS z|NrmK?99&W?(E)~B$Ld0bMJfJ_dMr3&p9{ZgOV&3IvF|w0s@x2oYY4I1SA*&!gFU- zWcV*FM&_3A4H2KQ&Q{~hBzgijISe~(%fbl896q~>0S1pGIO);_6Q9PjTD z&-Z>c_rFu*$iJT`|94J7^v4^f|IQhgVSXU^?;Pv=|5q+!ues=5*yhX+hR7G0w!HPV z=kpE9+sX2I#xEuo$e=D`t2yJm*S>M*2w+UKUXGm&68%aUF-y#|XSiHFI(BC62^Hxh z72|7O>Oi=5vVz~bZ13FMi+|@N z;|cO>Ym9a9) zn!axq7%y}66|Uo7JXjmhC~v$WS|vSr8sVd*br!LntAN|3->K55>-nhgajQju*wfAW zG>7WOn>CA(FH?hM&wU)CYgT-Y0%p8B9WjUj4v~F( zfN)KIpRTrWl#li|SYC;_Ob;P0_@7bxy`u6Ax7w)W6;bqI39Tl3BZuXfy9XiuU=zjIU$_q&?WDm;L(|lrMTR%a66;qLRRAO2Azp z^~|gsOLt5Bwd=;YTn3iUC_&QX_Nkl>o&CZmpAPq&wr!`<%}h&&wbm%?;M>_#v~c>S zWk;%8Uk101=`#S1d&8>FDmh#FIetE}JDt#Pl-w0h@5d)|B6XY6$nfyLPGtSL)KyWr zr>`dKv;t_Ru1H4{H-gh)_)+58yH_6?1^_)`UN_;KOltzto_1?6aWcTBU}Wc^0{w?M zNk48*gYj5n2pj#znXISF1Jcs%yq9N@*kC11fTe_}C*PK8<&ad^FpyU9K6|1iJ*Yby zH&xoAmNef+P=TLJYSO>!^YIPO-XSxP+y}#Ynyz%$Xo-@L$gay)k%6x6bj*z^46(?# z8wx2h-YZiXi1I;k=~~SFFul)V0P{sx6%UBFrSsqF+2>p76c=M&-T9NKw&@Zq@?_Vt+VA${z3x)9ud|_8LSnnd|ps$f+ zBh`G0j`(?{MCCTRK1FP?DzeUZL{2Ex1`b?LrFNl+s3KaJudiI3_@9V>;y>{!$O$_+)nK0 zo?dobzX(7Gorsv=BETmKYD&-0@9|1%JT%)VJj4=dv*TnlBR?D%{L-~xl_@hfHL@WN zB3hGg36Tx$qx760OOjXm^71<4W$7tN5)o150P5yA%F*{@{~r{`{N<@K>{Yjmao9D&UycfbtqibA)}P*-(aO((SVof4psrDhQg9x-TWyYY3ZS_$-3Bm&6 z(zGZt>XLUd;O5Bn$839*@YuKAluF^R7+u0VXc{u#$$hBw(ey}UN1LEN+?C_LFIB_? zCjIO15Zq=ecHD76wqC?;Hqd;S1f5(zB_lE5R|26z&0QS|EpTklFiN;Q7=;0L$LmU8 z&Qn+FuW5?H>LU2U>RpIoou%0pLWVvxi#Yz#ZR%k$%S(G*tQ_ypnc9fDs7tUXSuz^f83pkMjJ*~1R=S7f~_zAlaUc$|?P6Do^EC(Oqt5SvzE1azY zJDzvI=mzV8Y!@&YpBEdZoZ@Qd4q>sj(tr?7y}{zHi4G(zq=lPlEAC}`06P`m2JuIm zFXlH(cww}(MS#Cq(s-c&->}6R)axeKgFMwukY4P0DZQ&Q&F?q4dxI>k4*UkCQs1w> zfee=|?%konrzDII5571g)}byK3K}|c?`>oKZ1H-8vAQ{x?%mY%!CeaJPhiGys&^V$ zq&ATQx<_5GJiBHpS4#^D3B@q3_sncF;ZSd6$?}#o4B-cjhfVXt8SW@u%k2mL_RY^K zRrk*U%4h@{YDPA>(i(OE-jZlab~ zZW!GeN7pR8PI>e?_*|h=Zbelj%#Xht{KF_{|>NYHfMFFJb7KAf(%s;qUT!XAV~cE|HoHbIR9N6-_KJ`0 zOFJCwHWl!y)~HkkCnzF+6CIbE$!utb|I)FNjK}>6uaJgc)R*I}jS%||dDN4Kl(aVjOQ$~jgk`|7pE#Jb!vkWeH|0avfSAe5+ zLukNAzXwbX!b@r#7KPb4Xh42onfHS8sT?>N>>2(Hup(Z zuetI^mp_k(AU<}YO&CTHT z&HQbk7R$IC7Ejtmk8M=j4@$%!_mgu=$mv6p;!Qexuz4YY4bO~z8Uz_60JUJC;%S@8 zaJu289IpBHDToIVR^vUkUg_RaId0lHE7fuGELZ#*Jylv?BF~o6Ma(}L!XmkA7l>~8 zLbv{?us$LqI)mj0*5|#T3X=Qu&y!23zndyQVJ)E|n==?8w}#a=CHbE+4r1HLUXzph zZSF_;9ut*Ecx4HX?nkxxq9q!7N2Q_*JFm-fI=a0{^4IV529ZE5sMQptX>M)XkYf93 zzE=h2!kvj+@(-1WnS~k#*dvTQiCj*qmgyJv?}BS4v`((9OgFw_($RD;S84-8XNio0 zJ>+=r^mzt7?eua~_LiUvy6Semo)B{xrFX@vwsmCfs}V8~1(-=|UFGBn#blk&J-9r{pSfh;Hul z*1S2?{GZgZy8b^}D*Myuk^^1y*yfODE_@w<}}5^X%1feDTJKsxAPsXv-5by z|DPDHx&7huKjxSV67{*N^uFA)nE%z&GuG~RPoNh656t{SAL7?dMzaJlDTQih`IJR3 z3G-!R#Ux(-!{M#|;b{L1mCOA9l9$7m`u{Thx3wkyHGx1q0tI(ZK2;<{vT1I-zhFJ5qxvH zo@t+$lj9%s11~;hyy|{$nnNNc$k3PY<-SmZJ1H$~*}K2PaR~^(Q<{d0bLRipjp8l2 z|G$t9fB%164@o52eprQ#b(!SvKVmrXPmH!4xsBq~tz@3#oU#1XDLA*=+p+QoMln3! zK#6MxqK;pHs`3XynbN8v8#u4}@VyWdDcN1nk2AIfz0RHtfo;^}|M& zNp)OWwtR5OX8C%!0ESkaVJvSOQ~FhkV908e>F-=vw_ybk>`jl-jD9QYj=SA41}tXz z$DwIy?Ss0-t(^+v^t?Ul)>w3aD(lQt>VVvpE@clqk3$lwUFx^$Dq=t73k`GSSiYdo ztO#C^iijotKCq)5X)mxWqS8j44ifoEeCCoK5u8Plr@PZIoZyY6+#AmT-m;7C$TFj7u@iVr8i$Scg#TOf8w)8zNTjvj=penwDk2${1 zsH=?p3TIzRu6IY{Fg_Y-i}i#7v&+nnCUDN=7n>f8KjD~fm77`K@Ee9TM737oa6d$G z{0hBUBd3sTc!Hk&(zLy;^SOqI%q)f;hkz>0MirvSW}Ue;?@T_9<6o8FfW$EUg2ot1 z@gO>Qh2`yi-gEswmlV<=bk=+ag32G(1c#d!y+jf$nAUzc9XN7q4(O5B4+nfG76kus zws#s1B^xQkmgD62+_GpK zUUUaBk?>BZ?mwL)GW=9X^EE^tT5e7^#u+KNN)@v`Cv|b6=J2!Q3rrOsonfxIFKohkm^? z+<_?6xe=__Dmm22!7n=1flK%}62#_X?5sg=&IQoFTp4Xhy#cCTIv6h?LMmUo6RJ8~ zTV8!)VH0(hYv6VB$FVi&h|ujLfAC+kTOzv~a)tV5xycA*w&)GYRw!=lDu5VG;9C_N zG0Ymllu=x|qcfE1<56=UAUC_`BEftzG2|tu?a~9Q@(4fRCRx7K!*)A#?*6(cc3J16 zzxXpco7YX*Y>nG5tA??*Mgz7!p9XxtU*bhrKlTrg2Lac=S9IhV4I_+J3Nqh76-6HM zlUbK?yO`+KuL{o}1!`i&Z4)Xiy3b9$TxZ(oQ#Mo%YRBoAD1}#qvYHjOUBg`~P5Gs; zT0Tk4YS;dD4u)?(=ZqiaE~jh1ObUl}72kg1Bo)Pvz^YSKF_@kE{*NKwoGB}z+Cs%P zLdoogS!X~KvG3ah4kX0p7nA1=S|g*{Zd2bY~6KBi2XJxLnCbZEVVO|0K zqB{Ic*MAgItx|j$Fg#@7V6EA$yUaTGybRG6fHX$mBfn5Nc3ipH?4yu1DSdHW&u(}9 zzcP8yN;^mEl)4(ZMG$Q_d5{7GU(ENKX)mvQWpw`vIRGIIRdMLmm`QieY$Pxj{CYfsUs;N<~$=?%Cx3PB*w2BK@Dbf#EMca^(@(l zc_kSKGDVB;e;`t}fA{Ka4yw>}@vS1Q%2QNdRp@uV?(?T7vBpJ*yl#I}FCuuxWX(-> z%fu84;%fugw;C=~?#f2tOmb3z+hFr=AFvG1jXM0OQEk7RX{|U|-ZXZs;xvjOBFKghX%+cGAy%+?VRbfgV8D}XO)e@hy`%{J)Ix4=dQ2_R zI4gg;W}0LH%dX47VD5Mst}y9o;aoq2$09mKoy^x%tF* zdC4Ip8&dx<1U@G3L|F+_l~B}&!Q_cMx5rjg@3%Q6XyKl=$5``p)sz_b&K7^uLfZfj z+XuNxwDc`5=`8cfM=Ay-oFmv$Ux((!%8>^sFL8D#rTaNwW%)Qv=hYv&jUFbwT4JPs_T;TSEhPqLi^|mp{ZAbsZVJOTMYVeLbD5?`bK3No!5G!B z{H$4UT4znp1NcWvXkP0}&*z~D6N(*ow6uM?_V(=a4IogxqNk_8w{PeY1@<@XMywS| zY(}!$FDcja<)YDh%!Doow9CNqwK9JyH??F82+l!TyGz2UZy}n5>}95wr(luW{16vI zpNyaR*Y|N&NguT;@q}Vu(M=+0$&C)Ys{9cg6a>0iOBa-S+SNT8twy{g+)iFW6N=4B zDqJ26osTAFRVne?nQut%Dg0TK*s$<-ZHa* z&J9pHKjU_bWY$`xSxKO1)(YIq1OJ?_OX>-6)B5N#FqttAH_BoZDS$-C)vCrm$9s=i zCYH)Chy~x8^w!qne1XZUbWu-64=B*)@{ubu(?GGfy3k<4ACBuf@zW291ihR^IHVdV zwvmh{2jXHyg^iBvKHf0o%-tJNrui}J8SLcB*rY` zP1>umeKSjxu!?RciKuili9y(3{Skr^C<452Kx9LOi4{Oqi zmw6gMGmSZvhj@O58s4%p@Rlry-d{;h*Pq+H{`z(Joy}4#`L z$pH(CQ5%1hZ4CiVn!BwUVM52W!bv#A$15@8V-Hed*?`VQ*utnG!O>>-jQ8}&Q(S|E zU9SzFF=R)+dFpFv@u%oQrHlPHpJDuKAQAUIFZ#+r(hBjx3GsWt&G#abs%vkyMUdG= zas}Y5O}CM8%jrm<0&sQ40QBGGHefmEkEU+xoEod#A9~K`Nk@{D{JV0t&v<&VvMOA{ ztxGfNaah9USYemA;=vGZxH|heb!j`PS48InO|&3ub5V%mYa{n1?{`6n{R6;m==MoH zc8$*P!JMjsTG}#*ACA`XMBju11fA@5F9uHY%Ucr~#YG{0ZP=9M+ph;roA?t-4{rQG zO15N8r0%}eM{Bd<43A`vP5-D@bnM&w?&Z858?o#DE06QzGY?1ldVXCmFk24Ii9(}S z>e6dGPlMdk9960tNs4%*vs~|=g|#T0y>{1@9~#+6wFIuFo{#_9CQYx7@BnpW7zcQ! zDGze4)j|E0YX{yH4ZjIe9nB6^9{6Qa9g@<2WFt$dYy{* zPYUSb#q-&pZ4AH#ikR?uQ^%3@Ao`q;4Y-Psl}rUS*}jpk$P_m_IqtAK zJ?}r=)^tODxzFRZdi9Kb9LA8}u~K$FYCE;8j~8F~ItJI8*{x@T^BmVvg>mFS_D?)7 zDrsofAC0MI@wQ+x<;z6F!7@9a<|%)ghw6z|vcf#9g~aL!_)SK+jK&|ZS})D<)OoRm z7^U#0I5tRxFKyc3h4grhLb-PZA&r__s%rK|$cVK6^#Xje)xh!9X(9O|p_JIo>JQ0I zyq7zoxZe*YwW#^y&r-6X@Hh-G9MuQ=b?gt^wh7gHin^p8t@NPX+Ravl!H2jWjz3G> zoq@h`ZCU)+@6)@*I3b`Zl{@2gh0a?$XQ4LVzDpxJ@5%Am5#Fr*;3XU*gXB(B9&D7 zIvoDouP^*!I>8Yq`yF{#chlv6q&y`)!_no=@jBswk@q(B`c`rX>DJjZ_4!%i4=(7R zo$(tjrLZNQt}J4ODRhTyyzUZ3{0*wp`@?aa0f|-fv9K};c$~YhOti(SB@4?O%D94=mGD9|$xYeKnp4%Co)gFj%b%w4G7$k;=%h_7%<`%+dEmfd6)6|mk$I-$+1l(PP zZ{{sUTR|}b|M&#H+z^_?ou83nlow-sE9cGf#yQq zP;Gd%B2$m(f$x`-S6rKSC%H3DD!=B7!Qw07Aort~fu(d)QU)QlZz!tU-nYR~RQjj; zM_o;2Pc68xM}xVyn4Wt!?Y#J6vB_R*S|vIIPBsPA|5az=6P5165ylhqXEct!T1mdB zLEl<&ZrV-2m4FQkgkC7pS4VX2n{8Zqdf6P%n&g2`uCE2Rp7Q2GaPf$K6|#TF^toXz zCtZkEk({X1Cg9>8X}-i61ppZdnB&EK1#LP44!`Dn4jL%y}-n**39#i>75-OqYMmfZ%d8RtxySJZB-xucM zE<+)CPe1-dKR4j^7-J)rSrx@0U&YR2KMR2>*+4x9S$}w4w7r;|oSvX5r);ZEtg2rr zZdo?-jMcqqu$!Q2Ppe4@8LF?chf)PSe+);(p=HVkh>6up&fU+k2kYqho=*rFwA||@ ztScQ9%lD%us(n*wvhfy&=+op};ZJX_1i?+!QJTVjPC z&b_g=*p~;O=hG^c&L}UF-GW1re{+b0i=mB;7#N0kMBfdH5+2WhVMiUG`hTlhdN;!T zM&ZK^R7N1nfpJ(Tq|db0otd_%wDJ`-hbW+=ZU`4I{*glDu7a5_Gr71QH;+~lq4-C+ z>1B)!QH;Kny}oF+iKHNaJ?7h^&^WiyjZ`wEs0Lc?Ey>(8+Xrd}xd0g_{i+N71SaF175f#&YukXkV!IygGYW>t zHVDI4_^!j4yvj?H7xwffR$OnUtxf??(7f%;s~v7qL7Uy(-PY4y@{#)8#g=QdABFbT zHW!92@Kr&DgV#4ndWVKEc*@!S=tZ|)$k_vNV4!38a_+;(^$LJ(=riO?Uta8V)?4sg zh(X3wSpInvLCN%LfuGiSKBb2y^n9unYj}A1*Pfzz+A!l>2uk84bLh%fI&$7LlGUMu zT+N9FSly+) zDxl7F%*{RJqEbJNJLmGKK`%Au-snl7er(-^hS7%(2aMZ9zRJSNtm?zdNho=mpZ$&O z3%u-?3UizCuJR(Te&A^%v}p+$Hv8@&R;Z(FzL|`j*Zsha z`C3b}S5v&qbgbI`U`}6Au2LNC?H9xEd;Kx#I7b)>gc}ZNLGun&u!(edM&dzHu_AR^ zeV=*jd)95ivPkqiac=B1i{#-E==sBzS+_cJD)GJc<)U{rOzhM7echFuFo6mk%1Hp7 zZWAUPeC_@VP9CNCundzrEh}O?U`u$Y8-lG3r5$I*)^`ZT?e_ioE-oc-`KU^7p@FUh zZ8dDlvTbN+f|`RCjws@W_f9`A)l9fEXLNK%TnNx#Yu7|(%z1ZrKaW7gp($~pAR4NA z(TE_%2RJ;S+OlWaykf0U9$UeAz5HuflV4RHbyhiRWCidjXq3>nYPR3#1-x0tMmKm( z!%)MN9Rpz;MDV1f!ZgGvTK?q<*CxaMLIwi`WGp}t?c|!Fb2$~;>F~t6P3@p$vyWju z{f!5&#VdB^gf79;tklf6Uk%q)xeT+kq|~E7CvB*{i4wxrbKpdte0QKmr53JR_G^3ZsCnoh=xDy)_v30Mi!)7CuzYqn(e&ddsFyRIK7N>O~^`O+6mH9F|1ITdS>&sC za9`n>MLWb-jKvd$bElO+{#;qLmhf;2jK3KF-l_y{3hvC2;IJ3?RMT+GsRvSb0i^ytbrCTDfJFE_Xh= zna~lFEqEHc{f&RSw%<#MFfsNetC5TXzXEqQ9>Fb!k;S&)l6fe z3-8S-(N3LIayrsCO}A?-3qbmYN} zBs7&On^wEYntydwLbg@4j3Ornul=Fc6H8D(AD%}-_^R?NniMGX*EFiE4$<3h!a@T1 z8R91gMnP>Y`xZo8ZZ^CrN7j1h6-U1w&Qe;$l53$BT>jnf3;kyT$w3h}Zg0K~m^^Q_ zyDN{n=z~}~UM;0nEWGQso!4$L!XT%tqCe~?HCj~C81^th`Ze|lH0-ph&B-{%xHT?E z%v}=HyOzQ?_G!7Y)9DG;#n8H5rcJpL&%6lF|EUkJXy^Rh@a9=N|E#iNa0oI!5gBU4 zO0kEEfk8+|2PZrS(J3phAKt$@>C%jRhKhNyzO`++V%t#py*9<8sC1=f))vPKRF!sm zZS8AQKY;YCosTW07c6O*`C?gyj}{I4%=G?;p54_Q<9_W7McPO-iWy@hM&yXs@BG8v z%eTTJAWqAkah~=TA7UgetK21&cw<1CGGn*zHi(GTXS0H6MPy(-g0|2oX##=_9pfW zH(0<|%#9I|e0y4g=EB$y{kQr>hH&1e;A=VBT#^xfD0VYRY9tWz!yS%X-hYuRX*>gt zTxvhf4PvzfU8iPn)K6Zus+sYi>AOvu}ZV+ z(SeM1DtNAK1+0D*QFPrnj>pFH?>V)=;R^OVR3HuNqi5*@qy>6c6auIgBiE}sb@g?hEan!8zt0QKksXg{RIfipP z*6Lfg7eHv$BnMmqmi!xEJ}RY*1vr~%vstXI&(*n;_5}uJ9v+k|_T~)g3=Y{fii*`n z&MR7}ks6PEM+!-Gnf~fB^HFcGut!&$+me_8mOV5$TcY>qD@2KjQs;&&(7@xhwpSA{y`+u6`5D!kY*8PZk{SE__R+B4{m$KaL*a)yGDb60 zz`{pajEs{Av?3RvKsMyKd)9nD-3g}WZ_t#Wz3gtWAzc`HGD`GrkCze^a%FZZF-Hp3pu)ZK+F$VWEkh~aZ=iOO z^0_l0l7DiUpKZ!}erzswgOc`jE>}tO`c+#=-Azn*a?EFw)7-$O-d=KdYIxNBu>Z9X9TgT`-`57;rPeX+j4$E*HePjHl+JmkxeT-7`Zw>SloClI zF;nJ@dQIAt?)Hhx804YVlc{BJ5G{P>-JEu$!2J(qv#gr98wXpoxqzfxOB{@+GX_pQ zo)FU8BMT*y51J~mfoPc(FH67uDoE>69WDGGO}YKOeeiKU{{-7)D29oF;s=qPx$cyb z2Ai|-`*5bZA1T8x}ZrT`xs_m5S5 z64L27RH@&M%?#C;PesXOt|*BVaI>8s(p0sSx&RocegdgkuFIcgX1$8_YNJYWHCA}< z<9*$ch!T^NB28{jw-wm}EJ@RMcYnP&5YB5iL(5&L2^w4yZF(A$3c~TYDpjU0vAkEg z*~HdR{9)-=7g79^Al$}%hT7H|5p0LDfnWcUt53Vh}L0A=u0b#PPsYQP?om^W@ic&W$p(j`omhTN~W@{Uw z(~}Ccy5Aw{-kZns4V&=cQ5khP3f_8;vansTh&TX@$2NmylE=BrqCUm_$Uj&FP9EPm zbrsG6v)eS2g5BNAi; zo(@EamZ<>qqmN?kPQ(LklBX_HmDWdm?&|aM4*}@~b$~h}xC@OF{+n48HBITVH0~#B z*J5CF?w)-(K3j42De-7_@*)coOr8G>wOu*&tkN3R8piszz!{j;W7l2HA9ueANqGc| zL}IlpqQG9AOW0q9c+oN;{_K%T%Y6ynEU0b$VovU{e&so^iytzvTX=kX9!qmz8_XV8 z8#bB`zTIa|Yfi=*x~?=g7F1%=^0i0$6&&ZQ?bD1UpQro9&k)!0jOjAa1#LiQv>Vh= zeY9`RR>p6PfkW^876&={;C;g{x{k#f*VrQ40~R7XchiwQxrP}qaD^?Nh>Dgt-W{|$cMNv`wz)_W_PO=yv&Kv z#;{sG0`+TGZ;%5zs`2Mo)1S2^#2#?f;8aQSH2KPH8NcDf6Fbv8qP*4pF2!YZFokJV zn46Z#xwe!^?lrijympd9k1ZbM98>%!>Jg#CkUou{y`Q#c2EjX=2#u9hdh@U zbH`_xp{Zf|TZ}dwLe)_KXP$7y5tuEM{7o{9Z+@$!D97YtXN;*hk1lnoiIQ_!a0iO( zIFR7>%fm|6Q7-P?TS4>LGK+V9BaPXY2W&r0c6%3RN-dn5r2qmN=Xp!u40P@k$%ZMSLB%p`NtB}vSB02i)jV~ITfJf9Q~ zK2tyy*n&Ks0-Cg|%_x0XSh(SBYzm1JdS)%SaE-U7EiXsc@Fs_0e^94|{*U4j`Zt@S zh2Ol{#__f!oQ)zOp*ZbhET8`l2*|6Ro}DxQQ=1d|o7}4rJ|7%-&BBv(5JjJ2HwXTX z12kDXnA%}yhO0b(JBXcue+Kp1)WyM>csVnrr~OB6I%-%b+RwXF}d z(g!xWqqHZsvPODsPn#$4CHzRY)9~$n9uBlszGiJsh(EgDzyA#Y(Nw^hnWj57>{^dU zLa{Ad^yTo=#2f!P5~&WD-dh;QJ?|U6gRJ%_FGD+v^$Z;fDu92LF+KLtU^<-%+WE6e z+{YF%OqTRfkBSjfrBsQm3H^pLcxCckE;HPUQU%gkGx47sexyF7az6P}s#wqabowDpb3K2l_IjasI9qmRedp0__pO)8W7WJqZ1G<~D zB|lyv;G29FSPQSc@?l)g85*hx2-u5BvRSpQoGo>gkD=q{4z(0}O3%#6?k&t#XLl^z z@|@wjvLq@4OzbKP7D!XulN^1!$b8Xy9Y*SV-Q_)9=4KL$!9>IVWyX^{hIjt8KZu6< z$yi9$a{Bj-E`$&lSQL0#fIW9T@!bPyby}!?SgR{Zxaef}##yh=x#=E|W#{XMYzk}2 zdbv-Nrzs+eEJd*Q+Hzpt<#r`7`QXkxfXD@5*P}4rY95@&Jv3A3rwivh5$*5bt_81? zxxJHl?hXC$=E!XtY8mI^N7T~W1}-#Jj00K>Ga^C<8`4uf@QAN5ZPyltnA7V&34wtp zvk;dwdluM?f1*Kj3KwURL7xuRf6K8-1CmZ$m0CZB}02rCjp%v8r8~ zkXVqxep(+jnL4#re6yzMdfKpHtn$-k22(vHMBclvjgdpFPS2l{%ujRgpNo=2lw|n@ z!s5ePvD!We+CR&Ung!Mk#Qw6aA@x=x?@OO618Gy+eh5chX;$fEyk1=`bH0 zVMXjr@$Rj7_kFa56wLUSR)_hxY~ME{Rl*2C6+0ch;X%kU1M51633;Z(LD|>(K?LAT z5V-2mo0;z&O8w%OkzNM~d&+LkE=J$7c z9B8|G=A01J*%BzNY|wL1=L4oN426KH}%S3gH73Q38*Xt=1Vns`3!m~$= z(m8|Ov8!T~7Kn-k(^yh@`)p-&#PL(<#R8a8RbcOFi%kds28-`_#po9WKe2LPt*tza z5|X@wWZFP0)rbTt?rd94;>ZWaM%ch#I-@TYc9b6I)#^sUg&#`=b zLVf-26Yg`A1jv4KMRMFuTZ|f(Q$0{h+ zrwZ)8uZCj{E2(Vk-eI>c9432>NuMpL(oqfVAjVn*WJNQNj8pA1D(2^_|iOZKg zG{r-Ct53VXA%cpv?Xn?QLrX46eooZq6Qg;MV9fU&UeTBHV#Ze!9M7p**Kwi0>kInK zNP=Iaar-Q)K_}rwwU-L$EOJrUj4irv2$0>rUH3f7M~L=9n({YUOczVZTCW7Wqi2No zA*f&P)2uAmIW6W}@%6w2H>c_?1DX1A*^qZo?g%7uF_w;{!IbyZDNCZHfYX(gV-yRM zBCPEqOI_6HdWywTLGXL4EUeGod#sr!PEo75MG37hv2NJ7T`6}2ZZ;E4 zzqf_QSeH+S%jan>CvUJ1SU!e|{j#)%vf#zn|4nxK3i8S$u!LD=T5Ez1d(`1#vZTBh z<>u7oCmiYWAoxuE`#5$fs&eu|qcGO1XptNOTniSf2kD zA6xHy=nDUS{k@@TeYbB`tvXZxJl7KXu-#R;8a0%s06X9Dn3h_T#HO5}7?yI;S^rl3 zLl|BxI4z zTYfN!Dc#Y6BJ`M+R-gFfw)$GTcIExYUIr7RUM}7arQ0KcUhy0BbUYu<-#+2n3+K0M z#T8%$)qW|C=2OjII-UHl6PjD7EPO86H2gdOsyfY~8tp-l{T}19wc2-H(v+F#gC!-P zJP_2XdOSbv4O_IBbv%;5gRuQ@rmobI1NGLhR`UV>ESHrQI&%zdJv)bytmO0EdrQ+x z20OjUU{0?1;Z^KT>8>;91u=pFOGX0s0=D6;S8UB#J$HI)gl|>>KqP5i{zrjA^$RTC z1LjlXU}U_pk3dS4+2}Dp_wQBmrJEw_Bx!jF=}Cj{h3Nr99?(yc*Bp<#@g)PU%IJHy&0d`=ys?%!n%epokq~RpzxT8&ecj| zzTCm(a&iHBn~$ph^#Y(Qb$)elNw3*tCGzKsF5jjS8O-8JkHCrjYSja*FE@~SDpXG* z)cj!Bn1q$fVLH+MBC2Cs#ao){(8rjz_!#Nq^Gqp(nZ*QnTxGm}nPEoWk&0`z06yI`~_!7Ys?&+3lPGf`TdAIFZ6x+kF^Kp0-zbqfw% zt+@QDMLo!)Mi_))fZVXh7W&Ni84;TSPMzB&VUk)EM?+HD2|}n@FMx$9-q0{j(ME5_ zX(sh#=8YXkQMWDb4BbOtwljEbm$!3p8s1~6vrFUGk5gqiQSDo=9(X=XI4+3*qTG}= z;F^ti??O=|dLohp??CEia6k=bGCkq0rCS=(oR@1ui82x%B@&Mw7LXiSvCaGD4fCVM z3i1giuwwb{t11}XUa7&MPXsUR{e515Opl81xYT5Q)Y%#1C%kx`u_jt~Q1YXwupX}h z(y)BcwzX_(Lc5b-0(NMqH(ZZNjAu?hC?T%e8-vaO_O&&z(t`&Oun!cCBN!c4-mD=j zA$F?Pr5~Q>m`>lj6tloGdTOQe!j1KY265`2avgjTDix5A!Ln1I|1T@<;uN$)wTp%+rZ~lJY{M{@2vTS|&p# zfKZfOvH5^%j=Ulao{(+ndf~^h3>(( zT8A`#4t?zZVjWg-$jC`WZN$qPa9G=E$7_5e(n#J`x!kHu#}|$Zm?WI~u=!$p4EPl; zhW%SElWW$m)(k`@71Am`#pV*Rpc|p5lGVzwAyst`|1FV z!Tv#j_BxbcEAFTu*M*qZmYB<>Epx9L-}gd{=926g%?y?mPxJ5lLERlH|F>%<%GNo4 zSL^Z`VS=kq)M;1#JK%ly)%p9{iuP(jN4xmc(7nOqzO{LNm$6_s*oPA?HVq7UwD<## zGJ5*{E{1#nDn|ABG&EDkskYL}ZC1+#|IwJoNLxd4T@(qHA7F!{P%9b#RN-Az3j zZA-!|XgNt9gD>n^qgAPB?-!e&{n_f5>nI}@2dfhFF-k?p45SxFPL5^vCIC}z1n3fO zgsDG9^6ur3Adc4#=>+{W+=2wsOs^bh7rOkUK*;Q7$fUA~+ zQY6_1`HhPRd%sF!so$n&yljT2^erihMaCVz-I^z200YldvUf9EU(D9L9?`g--8jA+ zHNWS;F`|9LxGKOt@j#P#&O5n!7D!h@eLC7uT+UiFHXT+z8~-VFt_(1%V$nm27gY9r zHnPkZy_eMNZFE?*{k}CB<>zc2bYjT&YC(u?U~0w`U}lypju6GueT1Q*A0sq+XVM`} zrxE%587Re=#8okxPLMl;SJ>UB)eCR+O1Dd3G&SLNT! z!B;jyQ`eE+YkvE`F?H2pQGHKeK|!S?q(eeb>5c_f1nCe_K)R9cj+K&br9%Wkq`Nzo zM!H!#msmP>;k}68-}C>cvrv+hCNL;i$_oCy0MeBh-`kh@ITM$ zPgluiYp6c>$+DzDkxeFf_|Cj4Qk-1?)00}5?G9mf!#ba@r9l5ep1Gx9^I=VHo~_^F z)2BzDnM;$36Pni#C}$e|=;%@t{^s`4xJHXf+QLVB_wNW$sV*7P2Sr9^3LSqHAp z_4UMGNm_@K2tOloyR+4GyP9?{{Dvaql_;BpMpqILxH^ucDTJPdi%3P~#gk{o)%AK2LdhAX&S1sn%Ob5OYKj^c>eyqB^`oeqMm+Fo(XZ_5IYvO=&)#4^)*Uk zgG;`ByufN{=049Cz6_h#i|* z%kiZ;or-J`yc1E;(TaCgzwXVpr-`spB2e7|m!fQqdw1O_OL#3bKL*iw&^M^im$=Hk z(5U-*;Eu&fm~OoFVMIE#FjH@lB454!?z=(#GX-`IMkZuejtB!tCYHwVsF=mqY7DL; zl0H}IKzbe88(d2Iijex$2TFPmw;_}hU7n~QLCP-N?@w4LsmGzVBNi8~9nO54qP(M! z<obhpt;k(C0Cv_MK-p#&4nT)v5YHSu-E1BLODJSVMw<% z)Ea!kmd1qBtJf)9^OaMIbbKdLj?_8JA(4v=u}>gbex%iPk5QC6BfyX@7`)6lAhMjT z`psh>VTOH1V3%RmQXG;_rTv$KHD_7lnkw@*zS#_vW#!)yJzGjYo(8v-V*#vBIZ zON+b$;1&?1?eO99rwlT#JEAH?xv^KTCu9PjuRflzWuR?QEG-*;&YHIr0bzN{%jSPs zME-ih{|`NlXDg{c!#zE&-?`HtLL)!>nJ!LcZaUS*exrF(cHSmgIYHVkuRy!jylE|l zNI`599Z>gW?pL_gH!>yLf#sgrHCgvHZprf1*M^bV>}3y;b&yp#GHt2*aZ9nF=SUP^ zb#SSQRtEj?z~p)kJ#VuVR-%8CUbGSm+3hrb#BdqH)7k`4APio2ezu!AW_i6QJB~*x zZ-Sg>vN$b1v(cPfE*tTBM}j+>Hmvqu{3oV-iJ1S*T&)@5ZMl&uq2JuZRTZtRjG+4P zpe27wwI}5XD6xSqeHw#bn}DuZh;owhBx0^aO{gB|e4?ZGo%&E7m`8K&JL1k{d-)SR z=#kS!9nT%gxwePgPm~*Le93irXfeHN5@m$Bga6?1mo0^BXsy|P3B$G4&n*=D)8(UO zpA(FiHm!)rk#lvrkbOP;`XOG`D=XHzs`n}r_tp|z2dW_t#68NPz8?vP;!`?n0uImM zv9H%=4_?3+0|;aF+Ti9txT<_hAK|H^ZFn!+c4Akc&Nj-a!#_^)dGlnUqCLVT3{ zr;;Wc>Jxr&(PS86aG3P@u!ecPw_(c}w|G2H50^>}1}e_Sw^xUb1dMIpZQOahMl#Qj z-=Ml!^DS}F;@8VEvy#f&AE5c7am>II`jZUkbEw-mq{AW^_=LjxL2`+ndr&P`Nf&Q# zZ{oYo*WTNPvZ0xBqZqRM#L;R)srkgJI?3Fz-O`hNOR3f@g4!F2w!g}I<=d;pwC32u zkJDF5^%2$~&R=7j`a@qdi>VJXxTmJcHaQRkVOv5&IWVK_w$+y;*Gi9KJ?$q{-xjxr zLoI1J*iv>g3A&R;zwPF-T1k9jJSpX_erZgPH9uf@8RO~f)_0E)`sX@C2O9(qX-2=E zLh!~^WuZmB_&n;9FHU4?sJoa=FEh~VINkNC z_^2pE>0*QFxiopF)ij#FJh7G!-aP7gf5b#Lta?H6{>E|#;W}^`8@Z%4xbdWm@+C5N znmjf_l(<{5fexLA)K$b)q^wElpl_o3o8eB&$F9hO3+K9TX>+j~Ln4U~uf~YOy{o7i zW-R18tb`zN6G#S^-;Kudr-ZJe)WXk|<$@Jn4e7?>nZ-Kt(4a2;O=vZ6DL{8XFQ&+B zinG=F(XaN;%1N=KA!k|qp3y*$CnX=&!xH@jOJ{fl?kI;uM5u9ImCAcnao6J1S`7Z7 z#k>CZK@T1k8&=H}tM|F$aI>)|^zD?eYxnx1Q5hL$zpKni0@v3E`FFkAZ7_czq7w0Q z8!^O9Fia}w#(eEzh~>}(@A>MW`3XsT=Paa(`xGS`R-Tq(XZ?Mi2|wEK`|bTZZnp`i zgT~%H#qHE)s(3sDD{C?b)fH}!4#nTwT3L)=_N+*k-nKm!ly;XT$}AC)o)9M+(u9?U1W_`hm&)OL+d4pLcQQA+XEZ(oc1aZHVJWN~wA7OcdNzE#vB6&m_egd zt$p@oh?O(HW8Gp)8;0o<01zII@>*Uq5Z0kFi4}XVekY>^7cI4)8&kmqOGmz%6E{il z6JN5lLNG0`dpC>FbH_zhZ$8e@Ug(MNu7X%!?p*a*TP08526kV&4qs9-`=JXJ9UWER zZu^a*tR%b%5USY^+r6<%<`i05CT06P|eqrVzA zhdn4OknM0^u)tC2QI5xOeQ4L&u+tZhQ zGN0Za_K79m(7UrZX(NtU%1fN^I=LqC+N;7xlbx)&+UEuIJ%9n%)qOiUA5@uD3q5OVgdfdEumtL6flz;k{~4S&kbOYk|5$>^en4%p|(zYDqP{O+CACT>0;bKK6g zag2^3Qjq`px+ylg-@st1Hg%S#0<4^&IBv~stYA&1`RHX(_yYz;t_Oi_5m2KR0})S$ zh)jL1#GuGWCjFJ~FpSzOXWVWElbvo&dbytx81*%nkcry4k3LekHPvO_&G)5HW74dS z&Xqm=Uf;a5cxE!2jIspt5h%Cge&W>Z!cu982qzf^Aw~|`jg@=Rl)_tMoZrt1Y=Cz4 z0}cZ;;4w9MP=^WBB7swLTGWDFh%RVVQ}*u*&wT#rbcLjv!^Y_@Je-HGMn)!tQRt;a z225tah-z9s06ii2;rH;7 z{Svn(N1v*E_Bg6RbH_Q(=B1Cr%w^AwTua}cunV8JwjOD5fia(67R^|-e!1FUZ!Z0) z;$U_9^mn@%;-Hbgew?BA5|eXe-lt&Ocgte6wR66RKBO?el$Vy^M9xD&h#Xqw^;qmADj`Fj!LcW z(mRm*{ju0Q{)YY0gz}5&luY69gmYmfqyz3bjwrSThuw?0O#*{9746oDo!-P6H!@ww z!9!Ej7H%O0v0SgFbh1ptzF1n*{=N9Ush)|VhVJ?lYx(y#_x7pMUYUU;qPl}phkT2O zi;bA9KYOmBxRuJ)dHw-;SP!u5qvD8sc$O0F?* zaxp!;Q#2uEt^drzzPFfE^tIm(v;hN1InFr)Aoi55QzGkT)UMX}tC9j!Dut^#B-pgi z_5&aEYu5R_*+a#WfYsaLl|;fsR+I}j32ld2HjjyIj7F%7nt(w7d_nzs9U7&Esu&kj zn|4dC=<#Q&8L)>@1dDn@2L(rpp+<`i@$b}C+elz*i1Q^aa&77uLb~F~)JdvJzErSi zU+205-(el*pv8KRCe(;aS_zw8gfmQrei-%6512zR1v*@(Q;Y0r*_+CPL>l!lw5}h! zL?{Vt5cU%#v=%e(Jsa?*acPQ%E=}cC|2lp98dvsO*ivvb4Kn|d4}ub<=|jdjft*#A zD+wr5W%oup9ft1b#FBsVghcGvTt&bdKKAW{bk}N&6OpH5gJ;eTv}4pDeVN3t1kWcU zib|bggjiRe_mx;2d1)@j{Nz!OSQ?5}YXS$JT|C&#Dq@Q~r)h-7hmOZ+z8CWwlzjXC zQKEP!w{g$&+FiAg&Ul-Z-N=`u&NEHbJs0@wO}xn;+pu6JGPCd>+|Uq(Pf@nvea*~FqIS5j^(&zux2@NIwLB=OC2AlS>H2EaiEJmG2J z)V<#=Np`eg3K!e`Q*;V#CRq1~VM@D%P=xh(dQq6ol{<~n09z~NMEnR-7+t51)Z$hE zi|gr&IF|m^UCbgn=B_)~`NUXfv+wg=12E$(8J&>#wOp+4C3F<2a?)d8JsyLrmqc~Y zi1zjzuObnVBr%nzI3?-@q@w)K4zGLm_~S-SQ$nk+&@i1qjjM-|>-$@6$3owEXJ)=ovd}624ue*c3Oz0g(k~AI zHg#LJV!j`(wY!%xd58Jsjqn(} zn*~#5$|Hcg$c}O22kU7QMNf2}i~c5Q=nYJ!C^o+O3KrprKJz+VidR@DsIyrQSD-l< zDs`wfvpwWz>zq&GgJ|}BmAYy-o;%s~;kLXd9#cPyguwR4D7X_6c!OO>h9XG-lcEYp zeqjG=SKG^!!R=$^k%b?X^T%Gr>MGabQImgGGJY2Ze`&}t(9R6qs>L8DpYyD%{p{^k zM?kq^nQnkf-)v1gyQSZ`gkzK=H3Aa+N+#zZqZmd<$Aw*1vvWO!A;_YxRpHr?l>nLL zix{n@XD{F*!$9XUAdAB91wwg)q3PF+XV#!YHLGVY_`d!rewvTF-r~f|%fZ8)=KqWS z>VXR29fgWj*pLqF4T10sh(T)I6F&uIrN4$}YJU*1?~5)!sa=Q&Z&otw^M^ zZLpyY{=w~Q9i_z2Q`6a>O{-V1RHdqA$hDg}BJSP$rB+k_n6H%Ho+jVVdp`0kgMNoU z=u}8P65q!J>Vuc9GDeVdwYdJ|{)=9Zs0tXYqU_o&CAIQ8O%P*ou8z=9L%~j&_K9ea znc>iQST}O_WU<fn5Fm8?tQk3-%6 zdBG;3!bvdimAY;byR??iB^x!>E-HMvYfoG>CmFw@-Z~u>)agIj1ylB)*j`?(V|+~DdbH;^ zX0UVwmrxv3%qkq}pZx|pH$XVY6|j7_Fc7#aCN_yq>3@GZq0Wdx>3Xd%(;EkHP@C$C zHTyO+DzYSPjFf`vB4JP+UR+c0yY>$^Wen6 zb!0#hxF(UsD&qh>J+zatxp>);GUrZDEHv9n;jGW>2<~kQ6`&XJ>ti64bEqnHs*2A) z^BPPDl2ce~t{=C(w{Xw1kTJ>gPi6aXGyaU9cL|^!M{b{f6+u@KONZzC8c8<0+6ru* zV4(pC`Km(9J*Q7HPX!13ZRBY0ztMRBo<>Zc1L$xl8DljY}>{AjYg zBo3xE8VLmd5FSQ0x~RY+ik6Fd5#jUkcYM~f;+~#FzyMf*dpKJ(?i%}4>t|}tSs|;Z zafS&Z)k>e|TL0Atjjiap1?mk;a=@7VaFF+UCGzf zHeR)#$7Vuu?apx@TxdL6!S)sR#l1purrg6wNPTQF*el%(xWkxb;@N&P2eryAs)DYjTq^n28 zOoK^z<&%sUQDew{ZZ@%nK+*n$cVWhvn2(NUp^3M8b! zZ(dz?PmP)&0DM_&dTW!oUD4XM;IlJJdO=gIKC!ZnzBwpo;S7r9<0)^M%ba++Q9sJU zBuC8|DLc&c=pF6qaEg-g*_A< zR-PY^hpDE8dtP0co6E~+*$$>x*REe#v@{S|ii{>NWY+#BXXgZ`k!<8;)OKP?J{I%o zjm&Pm_POd1ia_V@oBd#nc1xO*{>(c05bPyn6W5nGv7QLC^r5TaTZ%(h6(XFWNPT|Xy` z=#54qrWdVnuTDrP^_H`9QEsbg58Ll0eJtaPcMBa?QB{V@xkRY#1A#uBw^Ppm@{qWG zkSgAC=}(>z4%$GqU%WSWu>#3v0gG|uOyCQ;kS^jfA|~LbW&fK><+^{TJd+5$?bG;c z$9s9#Hq@H)UO|^Hi`FiBC1deV+F<@wjFAC*ja^`{hExH!U$0F9fR@Y6O#hWO6Z2pz zB%lwntlfEB8y5E2EB%3}Ie&dO4fR>na0e>o~1!u2IFbUxt z-y5S^?P*XyPIu_lq2qYh1M8q2(&}FYg03|&7X3M%#n$&Gj^_Cfhs0a@Hd%@=Jz!!+ zG#q6mW6NH39|1I?H}f1^U+|u;y7KA)3MzQlpbg!&CgKXSu)kjzoMVs3t@4##$1b}U7hs8>j&rqgI)OSnm4qqeA9FnEWo%H*ZI){$mdVn-Mxb0oB9h%g8^YBCl zc9k0*IK`JbZN66J!CsD|AaJ`XQF?(|W4)qMX^+A;9TpyJmcLk#X!KZ7Jy4{O+!Fvf zf#NtkT8POlbG3M^R_-pYDu=n)tmcuV8K%`Sfp@q+6M2OIB{?-<*m>3tN)<@O?YQxW z@Vx>QFb|(EpU0yZzknvSwK}0?mG*OPALT_eL2HDMJ8`;#j9*E@?I2VD2cpLXjN8C+ zMRjK;V~Fh&3xO2iVx5Ozn`|j8CjIu}E?l z+Z{_9w`4g-?aRvXOlg5hW#VvFD(@q=Dc^mwb-PaeNZS~%{sv^{3D;h~W(%~)E0C2X zn%a+TsgarSPus_KWBQ4My>p6$^AfT51JW0}pwhuHq;;Q`j)w&!%^>T~c_InR!6Es^ zqeqMVx?%jMq$Q|>cP=>c`EGJbd8E}Y`kzr)~y$PN9r6-pGZyg z-N0^S(F+>4H7)lO5x>bAYt~eK{ZTH@-HR8Ps0kb-l9SKUKv9Q0`@v+YxZRyNqT%76 zSQszT4~j?aOII;p_kh$YIYx*M>Q+n zX?0l@PUt5L183b0DTvs(v@p|An>3?Qn-ed%{!FVEr1J3yokR#3oA+zv95+xhC}G+0C%PR3zY~N;%=v+Z#4T#+@_}=yr_) z47{9o5dnohNVmikwwnh^p6yF%%bXQD_D(vG+kQ^Y^sON9=70|H%V z892kj6Fml-cpekOs?mdbN!yBcYeGFBqABXf7g2nI)g>~Qe}f@c1M!_cokqX2k=lc4 zuk~MvQp}^HqmPM*99MjX%|9?Zi95g4sLYK16(t0Tr=?pW$t_*Yhi3+!eu%@IXpa!)Rqn0uhQ&%`(XlD z+x~zISKGi3r5z9yq?=-YTQhc41gdjaY>QtuLIT;mwD%V>Ft+gA zVm)X1jSSzsX#l{Ay`hCPX3p*A{ucg#Kj5-4F-dXXd=o%``BhA8>{PKny4S@K!bR}rylBt=Vp*GEe*E|mxlD7t??Of= z^%X!L4tc`-x3KL-F;~qSiJME0Ks9Zi6Qr^mE0j@02chc zHBm$ZIq%g)YJUMvo$~Z%P|Q0~+jTMX!+VQEQ$gR5BuR{uutVTQHvr31Q&ag`HN$^p zxa%Pxe|Hl2g#64hxo@8jqBKPy5CBGunAqLm;NUAZDS)LB+&kwtVH(|VH{9Za7WfBM z`hRSYQ~=*F9q&J?$~SqV{vG5$!jkdc2==D%ZQ(x1k&BFs3_e{Env_I-s|HX2YYLzt zAjqATe6fj%-M>HNA+>L8Fs12#i_khDfgZw5%KsL5y>$kVX;|=H!DjlFnp*JlM%1WM{;m`4 z%waLkGCVSZce#DOo_^|*NC*D$R~D(#J7D*LO$IsMb8>RBoT=O?HhlT=rQ%y&x`No$ z)c&$T(d|7hfI2GzfK`AkfTTKBN$gA^=eHtYww6iEg(B z9dFdO?%_@q?4ph++S#G|S-kCxRn_^;=v#EGj)4Ikb!1>`>+7ZEWfU-&1rP~y`miWg zv&b;Yb?9KFVo(d}wrZ1vrTYD-X}t@^YSk&)rBK9vE5t*YHIz z1A{1(?aK&YFcc6a>AcOu55SRjfQC#NZ*S3xii&#}7#Dx7ika#EMEoNQF@Ra#u{D;5 zy5%?Ke;g9L<#+Xe{I)m05xil$|Ln!>thb}qf4{FuNueCi|L8Zdef-z53=jP8Nm^Rk z_V)H-w?mU#aof2ymq9@Q>UZWXtD|m32A>uL(xkeHvxT1iPq6_yCki=j=|h2F>JU(D z`y;^MpIySPcmFasEA@6uW|*kU)AfR?`2#@Htm1&B6CpQJ6cvZMk>sEUFJ8Rh;o}3$ z#M0h7Kq#`P{v8GXyBiFAt0LZ-7k`D(Pjb3v(D0nfNQ2j_Qeti7RVs?{sw|M>dcC+OT2V z^7X$?An1->g+_N*mtKDo@2xqU{s-%Xf3Bmb7;$S~0fPjbRw7Hg8f$$Y&OVr-D=VOw zoZ9@02P5s2BJJ9QKaDS~?4kn8mK>u~A2LOTs!DY|rC$DcD0MM|O}Sn#k-PVq(7i_; zvDT&qnSblv9=KGlQG)qq=;z*ZwwmLQjguNP7fZsL=NrM`!=X6f<15`Vw>%{NXSSey z$=4Wasdi6n;MmVhho8(QQ3Zf(sBN0A)Vu{9_-3-%7ZBXOGp^2rL*neK!?enztfDp< z9?tu;X_r1lj<|T*!r_4?B+FR4t>2^99ZcdMupD<-e&h;_Oh@9_fUj9dz{k|rwS{;- zQUd8!3*1+G^H7;R2f}q1?yAim#T%Pje>|=Ua1bEGe>4)5AQDUpE4I-4{(zOPna3U<-nrd%-GU^|gHa@Mp1Zdd?!7BWcUW zroh+GR<3-s=|PRI33)}H302;1)B_0}^*k@uihT^0d!FSxi(f?R%*;spK_l9x$Cs4y z0ZmaY(g~l~?l2mDO$+F~O6nCqP`3bDN|xsoj29jc2<;K?)|=}B71+mu)-Mg|ame`! z43lSc?_WH3yQHR0&=%YOC3U_5=BIp&ygMmFc72DY-i=-)OjxG@W!GpXJbM1pb=8yU z?s`)zwbBdrR4Zt4mi>qp$)B#e5j4*G@~iz+x^{yb?_b05wNT3R3mKnw%aGi%O77G;+^j5E+Ly zVo}fiN0P>j1Z(96PG6!YFXao}&j>524umv_iHRkRj2LDrtw6QtfL^a;W&Kr4I(tib zGp&PB53S*02Zf4Jz6*|kFN9k~G@wh_v$L_yuN2+0wx>=eq3uh`lNJQB?`br>IcfV?5f1s{5Z>P0D;-@Y3hJ2w@oVOXHZ! z-EgyP=PT_nk?n_k(1^9^WNKQbdBy(9kI3~JsTxOpHWsh&T)WFP@}v?C1=8JPVHbpP z0>*4>I_!!N--*KYdZ^BID}H&(nq_fhdxYb>=lrOXQ|ri{3dMeX9}mfw$^oP1^F%#j zp9Lq@)a;ePJAx%BJMw$sa7)#Ebul0=ir6aH?Wz}Lmz!WSQTmYBBp03ec;SJb?YJ#` zJgzbBjf4>9t^c-9aqU9ELgkB`ITm8DHW!Pm5L$U>&Ti=U@J!)mcLQlG+Bq-sE%Qg3 zjJvC9TqRFe7D`ze@DjTcrXZ~xJu-qjo@@zvGcIWPe9V#~XpO(TBKAZtUUW0w;b*>1 zQi3;^C0uk}BCj0R=MfW}tQ9HNU`XWp{8aZFenv_EiZhNpMIy2bALevY>Y@JraWd7n@J34Wy0!Z(P z6Ec;{Saut4tJzbOhF{q6K9*YFjXlIL3!ZaDl_))U^l7^>6SzF$W4-)~(y`nOO{+QO z+^J+oVAljT%}u@wa`xr<`c`YPgD6$PcSqV!p`D4zfV2K9QJg1C?CcZim%9R_PUoWy zEi|74;1s&1YsgI)CPcIdGjc{;Jucvui?_@B78;&GqzV*9lRs7Zt_AjjrAiNro7n5G zt3m#oPA@ORsH{ggNTyy2P5m42s|V`=9v*$Ku{8)d}^?OAE_69@{dZP zj97f3C*^|)H$B*%k$RkTsl;e}WCH)tw2Xj2I){CQrrqxY=@5%3@cBSG z3FpJsMaKyjZ5A7_8aXfA1G^s7Oq?yCa?UQAAa@-&HkYjzqD`rdWKT1bFXH3kBo!2J ze*XL^@#YQHSP5_(dwb=-Xad8yfXDn;>$s^8C3^BC^}9K;U8Om&i4CdZR_j91E-(N**)KKsJT84%vGOpHH|B=})(U6QspaK>5 zQq8MpWUweZcRL)pH)1Nly%Cs`^jlnTg+W|b#OWAQbThND5H}saUblH8Yx^wO%^BG* zJX4)~9BOi~Nim3kT)P7>^=3~E&bh;Ih4xnht88FRC5BMyIiJ*aviQ?BvV2AYrabmE z-IbfPR+0SHEw44_GuuMFXGQ84Wg5t{a|K@ zKh`d&ZUGqGUd`PcOQ=JoFn_7iEna>Bw0>(8hm#FN(FE99^YveUAz){ybo>sAJWk%u z81%+;lLO#y9u?K_YpZAkG3^W;kqd_F(6j6PDr3(~JCDMPy9yYh#{;b*p5CO_S~c$$ zVYKQy#QDx%Ag9vON!Dr#yfUiKKur2WSaO5PVe%Zx;B7VxrW}XO?G8*z8$GVOl6QRWN~O2|-V6kyXy|vE8z9)At`a-; z#Z3>GQGE1k*cTL+5x6VaTcm`^;LCTBK+wE< zVtp`pF`Zpkp=ncz%X^9R;^!L!tLOT?F1m>BzKX9OYq?fy@Xlw>hom+L4H$(4A2PuZ z9qBfU(X-YJ=~oVgq@(r*pCr;d0_erh%sVr+ykf(3BOVwI{vJG=fbenb+TiIoASFdF zmuQ4hLh>mBUvyeL@XC+At8Jo()!9<<%MURAu%_A*K@mA@87A7V4{jRX9ce~{J#df7 zDWV!kt5LI8Y%=oAWrS>EBDcYs56MqV3%dj_X08CwbCuq38Ikwg)po0aFVla@EkFG-Hm_mkmM^3HR>os0U?17nXCIZ>I%{_3K;Kp01Rk}g zdu~g*x4zs$GwU#LdbviuY7agIi6Zygh;(lfQnJvHn;4t!z?L9_z?*^E1F4&jP1f5} zm%6O(=Q-H;YOX%FGDIgt@aw0+Q5xnU`vXkRi+=LT{^TwfWjlr?iL`f(qg#Ssbl97u z-=3#*Pd^n<`=j>-Gl0``Of3w&s}LA7IDAaq0cLr&!Fy<-c#5-D#;&uzX-56^*Rb!r zgW91v6;owBU%KwRZfB65ADR=|74y}{`cI%$dSNiu8p_y7q7s|A zxH$BjVf&|gU}*ix&yCvl)XLcLL$?tIKC~K&s-7d=15ni-Vs_>50fA_fTp?g(O_d4f zYvfdpB`w!hg6f#IoSXB?l#ebCdx#)9GTs-L_Rh}P@`+r?lNp=$x$mAm z(If^U$D=IXzuL)Q$Q^dw`0lVeI&f{UoRJg3kk0SWbb35B8U8mWXE=O^_*?SgVr#oo zhiWPUJ#xi!ndRP)%jWA29kb1PTVUG4K}t~?Vi?S?ogQxXH!iAnA=uWUE+O>Ah z{Oq#K{3HSlhCGS&7^8!>xK&rLulL6%E6=(|ZkLhi>gqnZ*$tOq!EN1wY^33l%_(!& z&;9D?yqD~rmC+=ka$=P{>+&;h(G2s~?L5Y1QN_ju`82&^Wi5W>s!_Yb%~hG-4u-a6mIv6Uz0T8)agGfJ3%5JNae?XzWe}$GpGIp%Zfz_ABDT_OyUkzkmO?NQ58l@$$oO zqV>V__1PK+6RGHOBY}kvIoKc2uoldCL195bS&W!v=)eYojP9qUrQL9&+u;#0OM;@A z#Jfm+(n(9c6Zn)k>f*RRg5Ipthfa(yB!LP@Lf)m`>P_x<=bdTzY|RLql+J9aa}*#O z7xCpeH>DKh=g7VmlG6=**+v&!A{5(XB1qn# z@n}N#v~0JRo)S##H%HGDS$>!)W6G|DQdxKY2wfVWszpuaQfIra9{y+NXY>wv4)(jw({UQB53(Th1;T0538$wNu$QkYgDZd zf3z>Vb)WXb+N(Paq4;+^R-T1ngqzI?VNUe;oOe4RAfBAuzVr~rcb$9GaxD~kk@d3k zxW~CmE(NTSipI}TR`)Kw%T%n!4P8CRK2wOM%I^1eqNhwcB)0d|lvmdWNn`wgb>G-L zx|l4WW_SRlfjp+5uy7`-X?cd3=JwQndk;S89h`@lpmFJwsVQ77p3*vZIVlj=>A74# z+w;H{#;VmXf#Q3ei=qTpGO8n&6<~EyZEel(7--%c&W;*blW4I%cKE1yKQzdQ2aszc z8Qk~Yr~FHB0F5K}*HtEP=i4Q2XJ?lIh#MT%1cN`f_fzrSYBbCY>m{qi)_5cR$Hi07 z7L$S`ZKdzoWx={es%^L3w)hvnyOT9LeV~t2w)TxX8d#)-5d!l^QrSLs1=XLLY(jwp z4ZJ6evV>;zNS|~}1oqAWF&(5XGwgD*Yr5`8imscy zJ}r16y8iC`MG7WC=2B1-v;sJ0!>=RJUOzBuuUb`xNB;GK%&SmT5q)CPggPYXf$hYTL5WflKhL{{>Lm-t zoR@tbv$EcP7QKI^bFdV9#{xo@$eJ=i;O z<(2Jt%4mJbftFO?I~ZR?GBr=tA5UXx;&go_PkqGt4a1u00tkOSh0{Uat-M99?H4&#BYbxiO5yUs8fvU)49BfPT;vLvCs-qmG7K zMIjI}KZi|%Gdy;mYmq_Qg_6^0#H4nFz<5!|_OT7{>G~EIPY=&M7eHN+rY_ZGgPuP( z%d;J2mqLT2g@(#?yF0OkEwJ@BV_HV{tDA?fQpuVQxm>9DO^JS34aTjMr5o)QpI$T9 z-<=#RGwZ|54=#O|?cib#EB~H8XN`%Sa^l^Ananm@u_MPUx)eLdU&NZwl}iN@h|z1w zEa$(^f;Zm;$cD7}@Tl&M8=di#^pX|v05Y^T)zt26?Kql{Q05-IMBkI!8XuEz zcjy<23#2qB+CHdg@VZqb1k(L=>8he4`9^z0ZES3SFKV`RgpweRj(9*fb$ABxZ04(u zYp#2m;mUBOfzA(co<|Qvx{tCIuXRqP62*|!E<_(xj$)bYt)V&f!}JM)mxW8G^VZJT zZrBQieY0>*Wr?{n7ot<9k+iM8ObT(gg1Hg-5?b=@T}~-uG&rVf zQ;ze>{2eIM+Uw~XXYf#+h1k>6^CpNn-WucnZ$kx-)rEWB<#@Z;jYHB>eBSC3A~zn;GB+r44riVzqKzKyq{nt*--r>Uu(dbyB(7 zt8=8=cqP-Y&y#wYMr{YXoOvH_6KSI8B3;gWmtE#&muVB`nu2DfutSB`f1-Yvdr~$= zGOeb@OZpIW*!KUZeo7X0ue~b1uiY-N5Y!?CFgJSG<0J8Si+v5czOi|M0B~zA` zu*Nwc^a02xPqwLa9L9uzqy!apgYuk97X6%E>&&St@&^Y3!u>u?xCmYgi1s*?k#PJO z#3^<#X`whu_8_(R){;L{=EDvq?bNhs=xwjje5eTu`h9}(JVzKPX2~q}!>^usy(wJ{ zhuW5^cVEw%8_*Pg^M}o6md5(X9g-pUvJ;o$*ULMBs*Uw^sk*H#;wfbFHxI;{G9&QE z-q8L>XNXA5y5{(IOIjr@Dk?kYL8)NbE8%nZ2YGnfGGblgEFKWy-d66*gb!HvEpg0- ztI0dG-|bZ_bvBf`jxM6mPu2J6yqWxH9NKfYp5wMt(YM3yhh~QBd+a)Uvrt@qYi_Y^ zwULv;X?Iw8{D`PUP(3)H0#@@=JrM-cQAx0Bx2Wn zHD;U|Mmc|9zm#~b=cU9g!Bs85#$B@`pXqOX(>t~vxU+Y)>1)K}! zn#t-Y6q3(lxfQ(0@w?$KRr9-A{4j$YGx@LDc0J;DZJ|#pKI8?3r^F8 z6$UNObO*g4lj~!fhiuZfHh4WhytL7hE{k9xGCzAn56g9oC-MD+D{n3}r>2V7ojG)M zKQANV_+0JhFFf^Sks|ZOoEg{Q>$FVS`DA8gPD)LYn4G%Em1I#?yZ&oJZjDtX`@PKs z5zxcXz~R%-WYV^=d!|~Y%O3I;V&oH61Ulg}kR~v%ZZ>TCLX!Lw#gz84N|15$FbIl`6O_)>LN~ljL9SePzgT zpia|q&Mdj7XoI`>v-$Ve1AA!q5ZNhmeiY8(e;+f`dW$~fd`F8@OOtzhQc=`vK3(c? zy}5fT6>XJb*kfzp+W82hntWgwe{LU=|DZ;T%FeO>P4uH9l=mI>OEL+F(<&0KuF@Xey<4@YOSg38vYWyMp_?isHSy6Iuhc;9#j( z3yVnX(V0$Qh=Q3`U+Wl6lj+D$P4cDmV~a_-H$o@Y(ixLho=vOc{eA>W`KCKpu9Tk1 z!@u^!!T3u8wFabAzrQ`L$|JNsug^WSd@!R@zU^ke_fa;zYP5@y4iC7uDDkKoZw1o% zZfvfduBLW5%#TgabDbQp?Q5NxeB_bhA<~ru*HEL22xKB1yXRn3(xR}LNrJ!Y5+R(l z5LbZovxx6%nVQ}F^UhGe^vqcisRc6Ei>7W09Fu)yQc)tRP1^jv0Blv*WeYEHkf{c9 zzb7BE5AhIU|1co4`3UzF3vg=~&p5-g&pCUoeaCfQcPuT^_x@eI zn)F;+Q+)ouAqyKr5AL717;rTDBn8}K$(7UF7Pp=;`CirVD%er2S58a}yR!G#%dkT8Cj@jRQZm zwd3hFL30j9ZE60T**xBK@>L|^f@_s)_Ad_exYV$0%k^v0^sULU)9IBn6tf!`_3{$| zv4*pXDO`c*0aFk1Eb}*ob7cG*T!l-qJoIY`9G8wR)~o9x9H!S~OP4p!)~hVPTs2?1 z?aI{JoxIRyo4}KW2}(~L#}G`3uC`oUUK(86-=Xgce9h~c(^{bf<7S3gzyURcZ04H% zX*VxCW)nN>K<+ss*1IY0k0p=r>Tb)?(rGt7p@nW7jYlG1z;EeC&Iw41+xOac4Y~^R z77rhynby8^uX+FdOD7kR%I>F)&^F44Q7eNY!RXKPNF=;M(piF!pBLeaZfD7H6EqL^ zU{ahRDQm~~5B0emEUecYdhZL#ef<@(#p1%cKUSkPxy;KKEf98&5)@Z|@NoAEr|kjA zoE$EBJ??e& zGF5*k73q?K>N^3g>XX)Dyr)%u$teq^8J0;``mHJUGSFT%#w%o)!Ys>$*k@ZI-(3A*}t9*EvGCltJQ;>eM& za2rR?S#KUeGo8X(_})c)udvvDfa@pYOXJy-5>w9?lXp5T)wx76G+l%!ukpb#8^?1E z^!D0?QY)l8Jv3Tb2PrSlohdj=1G>FRr_6#0xd(UfviM5RqoyzcPKprAWXJ5mVbZK^ z_apV_J{}U5UuyLk2(?WV4Rs$+t(vGCJ)JrKoYeQlzkL7rq?0zd7`Hm}RfN+igI}dz zso626ZlL3*&Ti$2w{e;wi>W99s)5*<#iI?=^)0W{bj7S#o(1q=i;z3g!(I-spf)4k z6%t#}-Q4H-w9Ox8?|$dno)Y&;_h+((L0|YnY0Qea-1k={cOFa>)FJ#;tLvG&!EPbO z@8`lhwmla8^a93cOj=A>C3q_R8jP@L|JvW0v_*ENs|@q_T;3VbzWQ{YHG!f!p&Ass zGE8)^z14I{jd?_Q-c#~CYxDxMUwy$(UW-J0!@MomCQLWObhx;!Xe)G=_2N{jF$%(IsU9}#M>~L#ls_I|EZP)S=_Y6NRB)=_s<*Ssj7Ev*!h|2 zBZUduvVyA_gY3k#{05Zg%nHKIg3^P>IEj!xh)kJPnsFWt=?-@x$0vI!S-Oi+UXSF( z`Rk+b+OF$^OcV$gBSMM!ORZPlmQmc&AMO`9yZ@F-;&W?`i@6*zj`R_QO?-5l$D%9QcCijqLp8}L=2d~n!Qpx0*1@BAR) z!^+iY^u>@)=-a81n3Jqkb1^Buk+lQ4z3ZIk3uV{Bmbo#qq9hV6-w>_s>{c%hR}94^ zaSf!Sx_&Lc&r;qC4>S~iipd(H)gnqc0}fx?IA8EI0yi_L7JqqyO?NON%{*N2ky}7O zpdZ;F>{CzkeTI@M{q+lns-6CXN}^)4YoBE9{WHRva1}ak-I1yKvE9?>VXkv0m)~vg zKUuH*j%OW=#ri6uZjb6{s7IlFhVeO##zBj)0h@-kZNn{cfbPu4kk330!YTGz`rW}X zicH~zDtRI|^I@9@H#ht_(fXA`>t_cbUyC-A;sIq){R}|;p_`dIrb+b#l{9i z6MM_oXhxgbY=LOo9!UG#Ii3w4)<2uRYH-84a2cRtI@xQVI^9N=x1!E*Cbp2-sT3E- zG)HP1kLI`VDWhkKS-tUc|Kb`GyuoM>>_OYX>8Zi_-rRF~<^CNSVHKRd<#8%!XfdA*RtV}08_b*xeGW;y!K`lwxU)@D8X)gUFk1;$VV ziDlS!f7R~B!Jlng_5Bj$iH z{mATYRSR}R=;lzYhwwdFIfA*z*G>_g_tUv7CSNHO*us!JbgSO*u(Hvm!>hE}(t#+$% zhknALp<%_^OhPPMPHZzj7IxeFl8Ks9Ph-_YqlsTk{0oClfG%1O(UZ?D&RcObmtdGZ43n>yVD5ypt&%j@ff(?jW4ro$fU)Ww84 znvJ1za>u>dttgt51#XLF(Hq22^nA&Hua3M1THI0twu{4y<~Llm>I8QqT-~@F5tsw7 zoh^)6ESZd3^DDI`JSOn9$~VUz4=MG<318W2p==JNpFhUB-KG>$x5v*rN3nAyw|5kg z;W@<>FZ`n5MV;dzO~#ZWTnUp9C4XLX`|~25=z^VqZr)Br_n{xGR`h4ZgUrB%Oo6Q( zu}ha^8to!ZP7V5{yTcDLH%IsHpN>@DOO)YF!D|&4#2vml7J0~=BBr*%uRWH(miYT3 z-0||$wXy@u>1(Q<&9mPJ*04H?lri%Qo>1wklFN+(qC4J4*}r6soko}aV{STV|LPXs zO7Mt3`_U|WE&zLlhZM9O?wjqtLyf6wwHQElmW?tJR z!WBim`FJCJ#fM}zKL0Y@G>D8UWp;4cvT5z?KE=j)fzEK__5#n<(sdO7wBkPTbpH-}~xz zDlqL-2!g2A0k67+b$?OV*qYZ1&ntwD$wmGdtR@65b zvzUXq>Q!WOH2WU5!?fW+b;2u`p?Z_i@4gvzqFp%dR=YYF0dag|XZL!9dY(sEg~Uef z#nL`jl9czzgs@}4{5dj$AxX!$?uN<9_{UWFYq7?=<&SceE>{cT!N`8NC061@=xaB* zDwD5Id_~4w{}M`t&2-KVB3h^~|8Ca3kIHRRZScc5<1G_G2%h}L8gV?g6$hHYml>m% z{1+qT@5zKN+}PQhYFc?W5;%Uj+nx^m_~MD+7VJ35=FXbUtafNTebJO0dS4??A^R7* zwxw3*x77KxE366XhcgtaLZ^hGFRd2BlQHauA}FvSiv{QrsA$cw3o1&#?zZa?_M@Yi z!sTXL!xd__AKY!EqC4D?v2 zf7DHvl}D?dZvY|DO3!QVVj=r?+TX{p$8o*GN<-N_1YgnDw3gdo+V5S*WUer_U+)IM zobK^lAFXq1TX7tyWw{@6c;r$2rYyei5w_ZKX!3ALxM-=){+eg|UEo<{?2+X63HLMP zl4YfQn!=m@zlTL^SH;{Nf9qdWnVc8m5om=Ne`KaM{S&&hrINI%z>m9eR`}^E7RmUe zr;f*Aw=Zy9A)W{00YXvH?#jEEqdP*mbkL(&5)vZt{#uRWkb+AL_lNrdilW^;>2azt zht%eFEqN;oTgQZJ>^84HqB{fR(Ix?J*MdX4;{jFXcwZIMw_#88$IGNIg)oWoW<7k_ z#}m0;3`Ozw-%;I9SC{|0R(Bez+OVx~7hZL_ndsC0KBh&s-jXp+E%5hcg+=g;Kytt? zfpwarINe6ba+s2K=|S(x*tvSIA-^Qf-Uo-Fzm#{#5AB@^IZ?epLHi+;AHsDka#tv$!2N}O^Ccy$IW_f6Z#C@w9f>u~a7wN) ztaYShX!u7rB9s=dvqW1iI2Y2HO0^i<JQxC8| zhIUbD=9fhMnCLHZ&Q^Ml?s>>3FFcwW#>G2gzGu?;(0=K3!bD*))gbsWEI5@}%d%%# zY=#!aIen8!i1>nNsPPDMCLcg_D*#tjvqoDmY(B|#ly`DK^JkV z3>^f+<;%N>a$d8HRHY_o+Z>Ee-j;70TDIS0m#}M-;tYDCeUw9Rbt5{IoGVAFG3tqU z0#Ia{YJoDu;-m<=_J;!chFp?m=L|{Hoi8cYqnTm;Y_VPJt+5WS}Q3o zX3^Etvvl5R^+AcEdH*d4ms!Y8IUH#`QyN#j{IkeJp{Awt?C2<#rRDxdlIy*?eHzu` zMPhRh5WFk?B$AYz9M5Y@mCR@V^JA5TMx$GN=ynN ze=4`EF2#2{+_s;C&c;pPP&^EapLY~j_0l8CpFh)l{rXihh27=k^EWTAQQB~cY1btm z+=IizG|Pp?ECVM_eTvoC`?=4FCu_skn z7*u;3fO=lLzhlT>K+NL@38B8u7gZhvgZjB+`QCouHhY+?~h%>S{ZvPNq4L5Cati zulMI0WMyIlQ4uUiW|Nf{sJ+=M#L$=uNF>s}Ae@+J-gk_BQh#Yv_HigSO1j83PJO}1 z*22OficX2H$JS=8HyUKQNBjm1^{!5~{#hwXkXR$18XWLxA`}o5JhZr>qj($qLn55~ zAtGY@cLwaa0vf%l1-{qx6`>y+oIPN4S?F$F3aLZh;M`gm#-;3;h6k|b-|8nZ{)X0=dn2rKT1icRZp%j4U*15dA{FkHzNT^#7 z+AtdoP#}NrWP4(06*QEP*Di-w3pqhqRuW=KDz1bSGx!Pz}z0QpH%&ZK5cS1XA zgd#(!vtGNFu^QL_W9&fSeM& zMm3ACj@8ksgP(QFU-;lUIkeEmeWe_dWjX`x{&*I8T8)ynLo~z|tT3UkhkUj6pp#cyQ zotdCkLxK$v5s}qy^WAj0F_h&|$Q`fCzjWkG%A}}Wx>Lopso`7ROb8;!{(C&uy?;SZ zRkN#JViQW%X(Lq9SG zP(ms_XfP*OQeCMxKh>mqrEGc=xZXZB94+vYbff3o!jd~Qo!)miO&!^$j&CVuD3Nc- zxA-<+aB4{AW{c6gevGK;nRCz5&Np$`h`{_6XVxxHUxD<6pqn;S6IH$fCa;0jKCyE&Ght~BrKji$G@v5}fX-`POko%!ORE&9I3)Y7*}IYHyhmPq3cI~C2mZM`k% z^7Q!C(X69$GmnQmw||fLt<%*hs{o;^e{`z6Vap7000UmPV@xEq{4;#~fV#RmxazD@LE@6}8-%yUGnI^jE+?Nrw+P-_I*T#Px)8*m zFuel8)}Qgr?@u}}z|7qo?IX!fnDcjG-3Pf#HmMHFjwM%~;M54;Seg~5-LwsY+V^XR z=aa?y#JDa3vLqBK2XkGt?EG9IOr4oa~480G@UBTNX^|-4MrA+oIJMg^{SIpG6P9RLq|s!IGfb-_VIaN zW++>>0%^GHNs5FhrB8l&qTb?v)&eNgAFmHk2nZyB^3W`sZJc}@FK<29N!PP19aCTG z5b+}2xmNBy?F$5!qmjRBMt6*WLlRQPP9$tkg(Z4EyH8Ynn%q@ekOyPDnZm-7@Rxs~ zGG((`)oy#!jcgG=VEP~AkmrApL);avr__J$tPo9eW6JZ^T}C^2bB|@jd*}D{vM0?M zG;AJ7cdT$rczshIVjt4OfFnrA*4l?+ZdLuLBnBho^>+7As zP~?8dd;-iyy6Hq=?r5>C`xRRLK*XYPxr-gj>4T5It3B?a5nLok zqyf|~!UbL})Ds8& z0aTgY_MeatLhj|=-DGg|_J?1Rp05*5s43S`kt&NQ>|pvrNid=0MD3SDg<;4NAr)iH zK5U1hEV|OC1{RxLV@+1b>%Od2fw zzK?uFzKT3`WXq(8Emn^xe=Q zY+_!#HMfb!1~G|1K;-meV8G!`$*DN`v$Sr6a?>8|q@PTWX2QH}Depg-J(0rld=cz* zc;0w6eY!@wZ=kdCmH5V{C)BYpQG9x<=vXW})o!6Kx8?HSTVAcFLK&>KJWVL(lAnNNF{l^x$Q z*9L8(dF7msaYvCX#b9fvhf9tD<{C(BwX*NN*sZwyR z!t2Y=Hh2Y(RF*qMjjrR@PF(9L7L=0O2QwRJ4vXCbGJfiHg&s~BrM`5QOA&BZyoqEO zn3#wK=mr7`UH~putC!s>m z=?a_rYHYBhrhz^VwkAU0e#8{2d0nb|sz^2H)!fY2V>$W3d$7n}Z+3l4#%#hLrGftg zujO;k{Hq8b6_V`6i4R;el0S1ceeY(lHXCcPv>Qj`9(kUwu;3k1a5*CO#c-G&l@X6wQ1K6jt-q{q|1id zCDtXdifB6BR!lz!-RczIgjY6#XlYaNS1nk>mCCfUjaw+(*#Dwwk@AHkUtSek!AvJ@ z2qsrn{N;a2O1E&iH5xEtr53$DNx*QbP{Furtok0AS;ww3fJ0SvP%A`tv~&$=iLD;| z#8!PG-#OS1>00Tx&peJESju02b>1(R7`6v-M5gB*tV#gteKIpMGwH;VQ~>3nj%MYD zbB+t|i$AqIuTa>%j{qa@HL z`!X7%k13;_ot;Z;)}(H3Z)rg#>;3!p4aI>@OX7+J;k;yG3I!HF`{E4`RH{Rm0NS1- z9@RHA#0$D|fq00VfuSFsLf`5HBKTiXMWF(yAEpd}h*6!^hfstiD*6u{kN6B2j@EiY z5Y`_mZ#B*Vt^q(izaKwd{QUXzAO2l;b9bMrFpZsJg)k%^gp)@=)dkD^{Jh=XY`nMk zL%83}pxuSqiz7i9`$zw77Fz>sP+xF14%W4;+&GZ2%HKg-*@VGetj-Q8* zz>XP?(3kl8OM=)jSF?^wv(^rT1TFC0&+Qx?jl8)$KHf<6On?A1+7J7Zw&8c0HHm28CA&P#-PZJz3CV#Tx!Ej2O#R@B?AQQz9ZW2TI@-fsa{- zN}Ic$_OMvwUr&_iiNj+9eNzHZxUI`3FE0-|*jiS5B0;}RE*!{x@Ns||!F%vPdG;Ov z@p=vq!_Bfk5B~)2_1V*>uRvxZSF53RDjd9DlEDAI7wkUd+`xvFTg)XK99Y3OOd#sn zOR1;C#IleOL19HHC-z+_F9rri8HIlaUmFW3GxVEcC6Rdd?kTX@nX-vo8ud>9N;@#b z(xFhSKYLl5OQl3tO!hdMA={uYCcd^9NUJ3Qr->-=OaUPwoRBDVBa}^h%Z>6ep8&m#7!?Cvt~<`Esu_lvvuzsu;d4 zANqkp9j!aHdI9y?>Qbqy7!wdn~QbYKL5$bHyTX(r(Yn=3XgR~WuW?c398{d73S$GOL?%RV0yuS+ylzs zL7BS&SQKWsnKY!UGWugV@10y-N6U=lcO3pj2zz~CR~lT;|Jnn0(M}143;N`~IxKpf zsI6^n_ySJFaQWM#2h2VYNIxJB@o;_k2;Znk5K-xZjbhNK{%$;)6;BKXC#*I?)~3O= z3T|ymUqaS~jf|O@8O#{z0ZUPB@@Rm6X+#EmibDU&Cx?5On9h(j>Q50>Cxr3Wx=qzB4yokoVXEduj~g(yNEhdR~E_h-cOF{hvR<>gnl8B@_252#0a9#+Lf> zc!QfiLZZ@s^EVlggTz%{UmalArXsSS&h$9(QE;v+TTP*6-AJ}P>9=p+`~w5o;37*b z6~oX2FbuEjS^humAcmGu`UQ9eV5qldYuG_eEIf9u@qxD+gn*7!OxCZE`BiHNC3pV8 z!TQZ#fYrzBi2+pCK#dT&fd#;m-fIDc1g|3 z%KA^-lp))gOMSD7*r-vl0JJgUzG9J9^44fJ79L)ArTGkvdU+0{CzOe{|2kcEW~#zK z$eakhQp%Zkhs;4VNkhq6jBeFLnerdRNXATw^Wuofl>T>Xt8dGl1^WeuPacXledM!A z#7=2SFF`6w;t>`RQ9lU6Hb*j1fW)?$R3s2fg8gOv=X_x0U>b=84j^wHyaH1-WaNOM zo=S$BG)Ygmd|E5#Mc3GFl-h4AcLw9@Ie?ihJ)IW8H)S)s{}#&y*R4l@4O1)8MFcUi z;nqkd^uof;;9V_FPFAbknEz}pA^a<`AlD4WJZLqz9FEEh!{xX%7gXDWXj0+|?w$z2 zgpmKkkV0b0;ocq0y_JHCT?#Y=KEi16ZZIidN_4Wn+8 zmXP>iK2z!B$*1=Q!r6>uv?;`^~QYU-a`paYWB=!Qs7F(qXI@M8E_8Jxgr`k~&*TD{WD*dYUT zsIM>R_wRQE9G_o>lZ%0*I?zw>$ktqmA*3D`E&p7^H^9S5#3+>NO9G*8MPaUgrK%b? zWzB|2N=mvulqwJUx*ua;z~c+(ld_N+i;e_v-8>CvFa=9~h=gtnIAyO0Cb3hEK2E9K9 zxvc*M@9Nta^hN=L3}r$7fyF)>7XB~({_#(6nPfngLNKg(EcWy@lKLtef;La?$ zWWMLLAG`rh2iQXYF|}OMCs122nWB*X77ftgu^{?j6AJ4178Zu#dbX2hF<1LfR3jjX zFdORX@`Fx00IFFAhNDPD(da-bHZzm>Qaa`-u<1Yya};wUfK8Wi1lA60O{4%d507ex zaQMuu>N&i(FuXhsqDfytIL{X~4PdeamnfP48)8dPWx_GZNDSoTCQf%}Vj+qhysKTq zL>XZ0pnwB#&3T`}#5xR7erUv01|#I2EC2`pZQLYNyUD{)yockzq4xV>aI(#Zey|FV z#x4fcNuafC6NJ{Jo;M{^B@iY>g@0bRLOq@vOuDSHFj#I60BXVkZoH?+feq5LpsxKH zFo=5X{+Q+FGclks>={sP(D>(kxfToH!6U$6bMt2bm5WJ369x~nvb7}%-ba`)j3-Rs z$lsw%_EFw=FTmm;ortd28C3Ghakzml>`Md+ao|f z!s}?1^YNr(7?x@_QYhdNTl_chR_T@VKOL?1Flg3}K}aq_qy`wvPc08-=jQfZ>H!)% z7oY;(j26%$APWKc-|yd_f?zIf&MY$bADABjP|o9OiyCgJ9w`-S@B%q;na~4_kMsry z_^?_c^a><5Crc1V?wsnsJ zWJ$n?#Hhh!esE3?q;4Qv^goDyxJSSrYY)K6)u=gYTEJ!2N&@s_Vw?oD3GX40j1TM% zG-bpK34@DYDr@-vM*sS+1_uX0-NQZLk?w(Y>exVMf#ie!8q9EgD}WpU=>{RkA>lg! zed9X;{gDXCwEl(rAP~c(62gp9Ol#TEhSeAg_hs5y0+EM!6QfogvNk-$G^&kH&Gj4%If%Wh!T`;h4c_1UV8ZoCjw z06O^Z(;D2;laiiC4f_(Q4L~Lw=RrXz*R0GUL44@!igxvzyF0tm|+h zzK7~rNe98hw45I~Pk&;XGL$eIi;j=PsQ*%uJ#|#7i219eBvtXueD_xXxkHI%L7_&u zuC`Qxh*x+24UDGXWsImUTYYL+mjDSj?}lsRK6_;Kz=m5aH}DUB4FH7ADlIQ9I5~@| zgr@N5??Z&x@{1>{jNM)DSrt$6bgNJyw@DevVfrVS?2Yg5T6@!oh=?8HE;0}`LDYmV zIspiw=ExIL>{Go4v+k*17 zfQAd$ovE4uVMaIct@C5cs0)Mhb89AeOO52zH@ov)(TWu*EKMhYo-<><&As z07!MFdcutNq3#NBg`r*-^3aeUJ!VTBkV)hU0Zs(W2Y939eyZduZu1yO3z3jp9LUlG z^K0ekSmj6wj8>_dW^vZ@az|)zR*#_!6E&+$>@M*N=+yv0-+cg&aG14ZfT1}&K8B3i zd^pi-AZcJ~;S1m}!3e{C!?Fet1} zZg6$jiFGbD7KpCt=*qyk6j1?>k$ zd}=Bw#0&z21@)%STN6R{@c!mZRZ(&z{6>Es^j$y~>LRtYv;>10XMo%)H6En`SZ$Y> zc7{E103h;6APEpC0*DE`t68Y96&T>f!VQSZ0OX87hA8|Ap?5wB_@9T+>t$dFh6V;M zFYE40Or-#e2H*)53(I#XF%9^7SMg_;;$Q$Dh{BgOhXMivq4)({Byu{|>24j^|1y5u;c zIf;cX77;)~quk=>zi%agUT4o+0&a``?__U2PnEuezwDK#{f6uy7XY3+9MlId{MVOa zLn|$fhhhhi`;s+~_1oU2l1t(V2b?>w2mkS?X%KnCb+Y6~y1cX`atFJG6dqU_EK<^; zFZU5t8(b>>Q%Lnu;7a<&uq+;g>}3Eh0e;#X=uF$fLh4kR5f(mvu00l%=ob~WI#|~J zi(z?~QTA15wySSP_B@l8yTZ1RCC)r|YxDOJb)v9mNM%Luhu@=UxZLtjqJGJh#R}

BDh)d5aY$YWy0fU(E<(d_`18VovT_{(`}rv7{A*m0c6J53aeWi%-hFG9)%7$aD8+ z`=#=(xC4XS3IHIeREGlL7$!}r3X}02;vO<67yzWy2(S%*3N?fB^70_V16`9H>F;lj zjr%;C@I_7;>Imt@8+XL-Cfj(F{)*3zuyQcj6?8kE-YZLS_3c&*x@^MidmLsgHJBer zMjn<4Z~zcJsQ4j~%N+c27cga?2 zk+lQYj>)sjME|yRaFI1a$gyF z-;LIqe+9P0dmcC++I`LI+2C>D2~YLV=&Bc^zub~>$tnrxUg=NEz7^uAEX&ud_0d<* znywezS!gBwQpUWi?HPI`rz~eV(@JuCO;4@{X*HnHN5Rg5d91s@iGlg1GBT)uAw(q+ zn1svfstyY_IoRy{VE>eYjvR)^Hc#?v8pq1RF8UMN}bcj}_Q z_Vi#62?$*X6H6^{Q?cFc;#}0s*7(%CVrfONWXtdd$CdAvfI!NaAw`zO$6uR^HDGe_1&m(7c z{R9PijPF&>BnJBH$K>SDobAm?J2~-`l$68`s2eV7X=rGuR$Gw)90m%b0zrk$G~58_ z<9i9%YcKEmc387F$Jiu=99lC>d-yA;$T;DYjMrWMXDtAO^sS+}vHCPZq^(ZEsYm#@ za6{j624RuTN^hf*TO;ggjOheN-CCM{$E&|8G+z>zM3)j8oVj<5_=foVWf9KIa2S-a z3~e!An?x_CFL*Rr@{sZn9XTe|V%G8IQKc zp{d+>nJ6$ga3SS$C+P|H?A=;Ko%e-U7Vt$SpYhkhYRUtaIZYM*ATtHDCMdy&i|J1&N+(x}SCGQCW^$R?L^zms53?&$T^&e%^9fWx|oTeWqP% zx=`^eDVOEcB)T&=Bx84GYDGKHh8yvGHJ+;FIotioi|yE4lp^vmUB`trR4)x)@{;fI+-55`7^I^$FzBEwuP-FpoxieRHUbwM3 zn0!r^39J>7+GK?-cPs(o_feLW8JEYY35Eybe+%52&gEgH4<@T4(oQ4Mj-DUD9E-cO zH)^a*hX<_4POJ7WVINq~=7JQOl&z_DXTlI!uyZ8ch1q>~*}#O`pfNf|OAFJpbQkCI zrl9CbX*1P?<`RDF(+>{EQ^h%`vtIrJg(LyXsS20eQ#Yo{duOhB(mN?Iwp~~Emck@5 z)Q@bjE%rzAXNr=dlzD*uVs+fp0F_vI;bvPPqt~+3=7)@eLP17$A2@ke@d$DM#6-eO zspwLGP{X_8LL&2oHqvY5pDJ;38)iRvSV{cq(?`M>>FlX0BW~gStLS}?n^5~1j5)rU z^U(f6XBth;;G97vE7p7YM7LYwXLEn%o1<>9wjHv5|EQ%mFhTra^T*>^!6QV|v8K*A(808T0n;dBu|K6g9M8VUGsejbTWWBiTNEquYiaxTzq)kU50QZ zGC72Qgt45Y;`V6S5HHSlHCrZ=FDh5j?~K^h`tpLSG3kPAr7GpcX%-5e)0k(N_C8NZ ztMA&FdZ&BY$~x!$qOuf&xh!IhTxGPX2>Zvhd_nCL&dBKbUxI+O3PsBoG+N31n1Ihz zSPf%OSY_*p<%m@gWeZ!+&GK8rL%HV27>G;l9@SwZ{3H7ggeyCMq4@?ssO*T}n?*twILT#WMg^XkHFX|moaVVd2QnQ*4|O@hHnqJk(GzE4T$bUx?E zYqfX}Dl!FpEH|Saqj6oMwG>E_$8i`(aLGYlS~QcAc-e2j??UJJ*}d5(e=>#=y|$F+ z5h8<_iQ7`vN0SpRKmV6epD;R|Hp5|hnfz(rvgzP|_ytuyRV+|uBctJyc z{-&epT6bk9V!|1gPF&5I^lG+??j}IuOb71~2-$c+;fr4Pcd~j=1PwvgdT{b_P!I(T zjX&TOpW)yb?n?lBb@W2xcuD0KWhN-?@*WjxR69a3vY-vs6e{sKwB;II+Vuq$8#Xv} zuVEh_O=-?G`3@OcNV%%--xeq9pLWjGFKHvkmU3=c=RV*?C8Vw6F20Il+#T>yI4{1O zpd?3GYXL=2^yRFL$hK3de`>u84V<@bt?jJuLcGVNFLdYG9A+!8LD=2|Y4h5_1nTEY zdaZN3o#h)v?JRWD;4b$Hc7>xU>tNSExRC}J3iFAbWO?zr8?jj9#!Az~Jkgnb;`^A& z5^u`IR+oCgv^x}BrVQl*b%mqXpWy?D?^6N*Rjf;cKm6OEM&^B&VP7a%kk*qt<&Ash!W$(j( z*Sf~B+ZtzO;f9M30TnOPl+kZnZg)-DaN!K5KafA%-`h>fxjCs*y&ri>=}9EtVOVDM z`PdD8E*D`VVa!clUPH892!vc<+(A0%G=PfV!I*5|ecwEO{P+bQUjnp35S4)#Xa`Db ziLy193a7*sFyiCK5k@Llw=M)^jl@*sU++H7jwq;ha#>Mf^`{zlvtqk9BUYJzonp&H zlhC7Ox{7ZFv537**5xiD|;I6)8ub^)oKmVBQ-2qS>Ux zT-n$0u6@>b?J@o53hA4Am%?u=ibOrA5hm&loU%OdQ)(_n^Km_m{`l>)9QmO*s^Y#A zUDZxVrHjzi3|LW<$11cJ(qAAZ#nd9>nnj2-6{I3+oUs+{Q3O-=nwwJPpOWr+I;F}3 z$BECT{}`|s6tuKkX{Xzp{}FM6%!(?5F=H_lpid<;ZW(oA{FSQ1Ol8-*9om7d5aAYO z=vJuJxNHe{5?zs+#&~pmL`cnU^9~^zD!mgev(fK+T}T@3mey0M%TN={!B#%E)-qlWt*WjY*zs z13aHPrrNea^+84VeWOO#yw{y6Q<*8N*YTw69#^_tuu?xgqlgk7*Y8yl#&qMxauX_A zWc5-csQ0$XI{l(D?>edRN_UZbl^ai0XnZ)``+k3FCB0}mMws!vScusg8A*vU!5LU{ zu;pRNzC|cx*8TZu?GZ<#YRt05^pX+`u=~ufOF}9q9DK%0AHLA+9p8U z_b&*iq{!cxs<6P>FHE#gMPo1va}K4}V;h-Do>33&&jQ)ZDpHBL-o>+1e77#s>1wOb zSlV*)?Xma)l;k!j*mv#sCwV-XkQ0|A$K{xZi!TZgln0)p^{1BT;CVSha z+!?iSD^wI5heDafgS*QW*HL7ZOXD>Yx#?NsX9O~Z!TOB>>=o(jWvgF{D8hb%>=Y1T zLO{Q@fnF^`h-Wh6Vz*tF0Xcs>PLt>F-@pHd8Mn$^FaLVN9Bba5lGLq`lUD(ngXl|0 zhV4d40?O!*yT@-4_2h z$r;`daQ^J~tUO!^d?<%bBi2IrXjbj4KzEG(>8ajnzDl*3b;rQeya;8(KX&0KFr;+)nO^@JF9Tr4HT2ktPjtg(CP4MqaDwOZ zz5FC$N0P+wpjoYWHKsBf-3cZ+wPa_y{Fj*)iP*-ib;JBJ$z0J>di*x-ck2Vy&Q+ZLZx zF0vHlWcGIBZ9gMg`dmcxaWW4vUR1sRdw3e`Swkxy-7PMs!YzOjmGw4HCH`n`E76g; zt_XGGf{p>n_aj!;jdR~Ej5D#47j>4vvlDq{VG2joMW=T-My<yj|VyUQL zJc%h93W{vp$VV$C`Se=QQN}{VEvl3JTcvQ;)4w{c1%rM&vKzG=dwY9;TW7ak76qB{ z?}M{p%pfxjPD|JVIY^MDs&Irj{Td8o?ABh+UtN1^d3Vl&zq-Uk_uf(fozO@;Go=$t z(V!}(wEY`4s$tzH-EzZAy6874I{#Cw$5_MQ`Usn7i$t>IBeUUZwqe(X1uR9{K7oU# zxodb^wej*9al&df&M}c`jOCh13zNWTA^KfVLVqpx$C{C>`-KyGEBy)BH&){^HJu@} z_U5e3LEH0`lo{qOK*@58fBJya|LEvB5&~3zDzpATnL>SUyHFRQMeoq=4JMn z^SAAJ7hRZ1nEu%fTj?4~j66rTSH#6NDo)WkT!gu8%tuW4VrRXsX=+ms>pFa$EGNUS z?c*Q2urf|vFTr~xSQ1Hnta~8k&{eeI<)Vd$5l3eJ2!w8UF}E`NhtCG@7qJ+(xN2NF zKPhVBi~c&4Ra!Mo;t;bldiosA@|>`3(TbUF7ZyxKlCe+1c3f7XslV2Ya}#lb zs;N!ta~{2*Ca`8Jv_I9BzR&H^fQ9=7M7DyK6DHoL6mIBm^P(Av%+BGEDbu26h%95bJ z@X5%~H~UkTPdpqPW|+TtZks!aN^KMUWc@Nt&$-A}On}YGVCXmO#M$KjeusUw%OabL z(1I`3>9-u1H@D-wa9c?8Z=1KRN%=J5b^#!&kR<>^LdkgHgSLLZ3 zNt+;;@Z7)Y@WoE7)<4R8ANj=d?r2Kx;B>QRr!q=!apEwz(7xb19=^z&$GCC%a13mz zhBonnZ;xfYb|oPBicM&O`FA?usT=+(%yfrn4&M3(%yiFTl`(xYPCe*H>8;Xne$RBDDha>JpdmLW^j?CDcaa6p3E$$$&f zhKXn_ml&IXMxA|%J?ra9%z{XOh5^gx z2Z}#lUY8|r%sLZR<_VWr1^8TfQ5}r;7sc^#L{KvqF0E|*9kv+R$DdiB7yOder_7RO zB&%`99fa91^Gq@AMNLEM4~K0n)F8=E3))rkhbK9NQs3*M-{dJ5Z>x9F&L|hJ2cvLq zPqeft#w~si#Jg55F$r7S$0~H|3apTPmqV7ORHXEU$?~PniguiI#gE-lUW-jKToFzF zcU*7QoUsfezpnjezHzzoT{8B?4SCCCFkb)Fk+Bxv_kJ}d(J;)nmGpaQfb((Kr(cs% zZxJJTJZ>(8i-ZR%jBz&Qdgc36?OV^9@%MT)yr~LIZZ$6unv)|kgFbQ1I%g?GHi3q3 zo~7-LAb?Z5?#eUnAXQ-%Fh0?p@O^?3QrSs{4snh;w5DM&*JbyZdp| zXui28gZ}(g->Uh%56(OW*RCMo3L&z(+*pB0tKMn<(Sw@?TbuN^A)f(C04KQoXI>+M z2~?;~r7nqiRT;AFugxl&y$hojD8hY3zBPYHn=tO?gS{WDZ@j9QVD#xCmDZEdMP92* zS`YnrWm+kJsyIAkd!o#vN1tmTwZG2tPsT!2O|Zq%@sOenh2`V43JtYlhnIQiXlWm4 z>G@R(*8OwYn2|QRnq}gzPH7I$oRsrnUfjLcpXN#e$Ggl|(JWsNG;Q416D&#f>f!2d z^tec{99&bZCGwE_9yd>DQy{(|VjoA!=@TQLzY)Ja@L7@B`zqvHuKL(5j0>L?H{EQD zh}*r-MHjbD{$tHm7ylUDmE81hQmEBI4q~AGYhQj=>>uyGCZ>MmspIjY#Xv-kl7+NnkHPAP&!}9Rn#Rbvw8ZQWI&wg8&+OS3O)~)ew}N z>z@9tE2>ijWdNY~k@N$^Ok-jKY(=)3A=AJWCAs3?hc)L^Gc}W+(D1c_zi_19u(K+I z)A@P2OIe|!<)7%UUrt+v{24UB(R;`(?Y=4+3y7S`!}KvYQMz(8f!1vDmD>=qjjq zI6+h$&-USyReJBX^kw6Sey3bg%T0BdL>$+n{*)+-i)R$VBya23&hZ?KR-12QUR5^1 z$fq6+%42-GDt^0K`-Wdzn0@hN5r41Sn|FY|=f4aP%q&2Mv-O%{(pVRb0TG(%ZX zPn(o#3!PFAKQBJr_BU*`yE;b(07HA&sag$nW@VyqXVlh~ilxAl@pE z^F#>ub;ov-60ga~4>`HU$>M~4rtyvLU)mA_m@=OmX77UC*k@<0*qa@;p2eDd-}ZHh z*eyENDAqqov3d9FkUrS*=E+J?lKw=DQu|O!x8LyH%la*YBiIQm*%r}DV<)F&oqKX( zInz1F9_Jbyi}%@88B|Ab4^u{LG5*-bUrbFh*=`*b{D0NGWmuHayFIK(NK1D~cS?s6 z!bmA4ATWRe(kTriARsC=N=gdSCEeW}BGTP4Nayh1qrY?h=e%Fu5AUa!%jlK8g+!Uxn}YRR4eqB9F3rmR={ItZB@e(&s9NN*fbL!my&mabSXz>| zv*Q8Kxmuz~7?|}Ia~%w3AgVzzF#ucaS%JPF$dUdfuYk>)0{ED(d@3_{eWkqc5JQuL zG1CMoYgO~ecAJxQ#Su3RX#Ih(pr7Pu=CbmY%drM~LQl*zNt@-W%@Z!MSjYZVnz5YB zgiKzV-<4i>=Ak`GvzQOgsva++{&$jX2zxW{Xu5m)+$neN9i~{pv?bS5S_ZK@eF2ID zGg_NZW-F3ssSLaK$&2Q`z_Lj0u=83uFv!_mHd!DEJ?a;wgvdBFy&Oq$>l&9s5349j z`BG%t=$DDiPZ=-gGphkmWBL8?-a$dLFx{@xu{Dtmo?d zgscf!X4{%={G8g0?T7iCmV19{-(yuWNoAd$BlZVC!{!TkKzKBwp8(&^>R_C~7!Z|F zAt0zO`e-2jku!P#Pw%tckdx$-tCB}}{+qh8vu|FW4|Q(pGM~LZwlLzV$gG*KKjy-?vdl>3Xut~uq(U|!A$WVcTX8So{D7~6r=Z~f3MN4#|{Ljk5Bh20zSWhK#x4vgbyQcTG92ywt5Q8 zTD~Oc#&t4{b7*&yWamR@XB%S3`b1s#wfyBD`?dD1I`B4E6Ax#~da)0fo*3bFj?H?p z-3%lrTyH%qUV)vx-jgoUifswMuHNLz`u47ADq&>%8`VT56IdD3Y#LwrLoZklk$I0~ z5RL{`K}TxHfoBbZZ=^egij?gK3qEFUYIp3fpoPNXHIL$a{@lHKJE$vkkdM&VhjkLy z6aWR+?E8z$i_z~6&i(8#bL7g9zDoh+EPHuoHTEaBSDumuR7&iy!RN(msRpOF5)LN;ZPBUdVGJ%}q-0ma#Kt%b_z%BAp8Y7$;8U5- zq1bQQT;9)IJf!0g^^>OYKW02SJo(by+9d+&ttb>5P&!c}DS%=pze$z>1Uq?3NjDC_ zYqFavhagbazksLv0+gWdfa-z;+t-h33k`x}`jS>Ws(in@4VokKcIVeJTJC`G!78L^ zM<-8s43_hxu7~8zro~WnFj>WDl+2Egeue)8U3cn+q0Rf4>B<@*0yCHilE*%|f){`8 zKMVa?rzcYTBdGT$;mKN4>UBWwD}_Xz`eQEO)))SA^Ju1C)`iVg8SmBO!6hBs?V~oDVo@*7>c>c^u?84RjA9A1C z%0ipqd5CcHt#5*OXIp5$l7cy*!tfv3b6Fn7h$dy_Eao8PjMD@$zL*KQMAdoA)R%`` zkcVF<;)U|jgwe=0{su;hcRJkJnlxWQpIxrvvt!aumc z7-hd`!b9k+R5JZ`2v{uVmWUS2{yO|!H@(017$v4M1$6!L*CT;IdNngE?C2V;Y!FE= z^SjQ2pVzS5ba$$vy4G^3_0!)8aX+CQ5GxYuR0H3?m%g{%7>WG{7ULJK`uo^gK}c^( zgW>A{iib!3F*rfk%AC@`*u_`G2sVEU5E`;hcLl4=+AsmuvF9D(e)-1Ec+O@Zvaa!R z-FAC?Mqe9eN-!Gr$5m#F`y8J%banV9fq3;jOZXD?~}NP+c% z5xWxI^;Q34`X`Ho%>sDl=H}u6p$7y&f0YKw#%;t4bMtR=Vt<2_o>;&MqIV3rEk@u! zum|m9=6*9o{4EaII(Rm8X4heGmC=}`860}4S^n`OE}&|l&ScOj&_^{UbgC)C#o5^m z_yhuun-(Ae0!f(lU$_|b#|>al(?hMve%V!iRi3n{T0ZEmy=Y3n^S38>exS>Ew5ypQ zQ2k4R=GcQ7kg-AHm-D=s9!2jL7ynJbNgD~6AprM6S&EH*S0y1P2Ar3Fz5Es^hnIIW zf**X{oqz5w%@>(TTbSi6$r}6-cBQrx^_cX>az+AssxKVyEyikGtpJF&OVN&Uq!a{> z6#xWo2g};-e^^WCD2}({=sjZMR$!5=1W2cV=nb%eP$D3H0E~NUpyvSsjqLv-c%X=5 z_pP_b^C=2nRAm8HXJ%$5ih2RMBMqnnzyys>O0xS8{p%opED^9=T$DislL@L%^+%(s z;H<~L*MIn64kUW-LPJStXg&gWK*0R!L1SBY-7u&H_nPTl@$H-=ascXL@J;ljoh2ar zp_re5c?f_~z`Za7H@XMpOU(gysHEHrK>Jk4dmL_@`9UYSaLeS80wS4&1_gtzExF>7X-2(a-YfEQgm)7*VRa43T7yvzR{pJ zQSI9Y)m5Op1dK`)AJ?ZhC|Uo%xB#H7SUQ!8UOvF@kBA8CNHGk@eHS|B-w_bMUqq$h z`OtsVe{WAQp*Ka0RuysH+=2ehip5+oK|q6#(GrPmDEoY$V0SFF>0xq_Tj8!>+p%3H zTdL)JB^l4x1I)g)4q=yZAxxRoSWX$V-+T_{o;RH31_#97%Xi|X-vSCN3WTV0-~CU6j3bjN0w=prR&?HcA|$sn z^IKHWMh`9b_w72dip~Dq7HQUruhjt)1$3U1uu86v| zIe|Bx!a%3ZZ#4jnNR*>WqNsf@ID_`j!9l49ODGVlJp@!PRMP?G%9SMh4X~(ydN#4) zr3(3h)9FfstYMorXejN+ty}je3?c=@yam_$bvJ&)?j@tmR@ZOhW+8kj56xVkHYz(N zt_rFk&A6wF=juBAeo*O93&hg14wWtpa5T!~n&BKQnE32I*!r2P@OSZB`#4_=N*3Oy zd+OlXkSD#F4=_-D0?5vQT^nu7QxJ>dK^3jGZ^h5&b<0HJhix%Waj&wMz)~V!n$FWsu;gAbNx4h`InlOT`Sn_sbbwP z#NKfwJYbr)Y_oaLJzQAv+ZMF0u0Db}0r2yJwA~gw&MgJ@d;srJO zT~48P4)7(731afQ%^kXmLu&0y;~)6!ac+#sh9;8MTXF7*@y6!<$*>+3MBH(>GFv@M zgy5Bt)#q+GH25YqyjU_Q*}L`pLlwKFr>cw9RCklDn$pHmi$E6Z(b{MK4D9(Mf^i{7 zO(HKfl#G#vMir1NS)Y7K1LXqL*aQs bCpy?mDOn23zb;y;V$!CfGarB&f-!YllA zI4ni$p4Ys<+ayq*s4Y1p=4xXm@&oqPW1UZA$fMz44bsN9yPqH%-641={tJomL3UW* zfSdi7Z*QHg!*ydo&G6VeLVEdmWc1Jd!9-rK0oFRc>U#l{H?9(*Lw=0SV6!Z56~n3v4TK{eFF&|mic{HIDwm|By@^-zdtzF zp!o~(urM@%rs19IW0R?0yd9}wVOL()Nv)vDe#HqbO6dL6zK6$k$rvob&P52$Ul#)m z2WR~2e9>2}o4!AHM}n#6s`MysG#tuiEz)JblI4$MhB!w?hiQC42uB16+X~xx!ekxm zzRYz9`wHK`0R=)+z$r(ui@{8OmiF*AsxS&>JxC_NMkJpu9}F%jL2-5M9M=bvjjEj< z-B_Ze6o4VR^iYk|{(^1UfhWbH^*lBi=6GaQ#wJ{B#k%(0>z8Qb)qxczUU6(q#;SD6 zqFhGXdDbi*5>b&La$S3fpMi@nE$wPd`#h=&n*8YZ%!ha(pASEzW5Lk=-2{^Z5FF6cEbQ$$0FFZoC>8={EP(1zXMzK+ zaM|Am^Md6cm_ecxK=I2D&Y%X20Al8c7V z!uf}VQrmHx2>me|$K{n$&q|XA(Zz=Ny)(+X zB38RqXE}BJRul~oof!!uBi-xI{eJ)pesO(W85kWPWDRv4KvlgHMbjM5Bl{007pO?Z zoo;~xvV2g!e$E_R$e!ihB`$Nz-Hxr1x6kJ`A(!sEuRXT6YpT2ol}zkH*NMw`aFGIH zWEp)}LD+6mojVhA=9`nSk8FeEso7R+OL%956 z3yqzIR5jM(J9k=flTA<3qV3drRxYEvV$CSQ-s-gTTktQ(Se)Sd^I{W}><_2}qu}45 zPl%$WBs}-iP;B7)n?PA8-D#I(C=l$3eA~KvIh@{2=TG;^_uVm0cD3^d48cQ*XpB3F zNxcpIp~Yt}WyNEjhZL>0%3<}6-F(C@=XZ{ulX@+nm$C?>2( zXZK1}xDwf2PrV~I$#02>&unyXs|<| zIJqj7&Ojyw1Rj7{ob#6mBTfpWU|oMB;ALl`8i%NuQ`%}}xSXNgodf^EO>ga=MNo56L5;2_C^4V0D0 z<;iXaupi+uC`G4;yM%r{a9%?ohIS^)!hnbvl(DHLIPVAk9THUEqhavtS;O~1O-+r? zEOQFd{ub8!zK1JJLw*f7BdnrS(Or}Ki*0}Q_tOCN`XplM>HkgSlBB&xQIyXe4WKk3 ziv9%Zg!eaJN!5iGN@+%ULz^Vn4&w45HCK6MeapNO5($7}HUi`ie`CU~^!oEPa0o?1 zB8nvrPEbdPyHJ4j31va!A=5Q6@tj#gNhk+A6CE9W7>LV#ltCngnq^_AL$gr5dgsnL z0(PScpf{kVFaz1@eP-s{@uK$BA;0JbDgoFJBxu8bx#i~IFG9!}-JS6r1Z#NIBJV@+ zY5whd3L{Ry4#11!KkRbNRM~&*a@vr;6Duk{z8iR%paSrA2Lf90hk(OewlYQG0c(>= zPEGe+G^&=UTLQUiVj-0E;&M!1*mD3^*f6?HKw$5}g>~gK^UYCov?xsVe@3N84;`^? z#nK_3jdwH`TH|FqQ1ZFRWb_EXzu9}DUgx|eiuv5B^ZUhJcY~tR^J5|L*~3Ppe~s*+ zU}(YVr3oda1OC}j{BEUhRkD@P;>sE%V07I2qV@ICsYz|q&^G;UbMKsBKsB|4NRn@o zR73&9K&|S^GU>_D%iZz1W9!zHmB&T$7CDo7awHQsElmiQ&N)>gBKtESHY5xO;0bWt zNY~BR^S!w~1=c+FG zanN|&|MieaCXPL-+U^eXw&$z;Ew*~w5EA;R)bcKSsb^WG>%3h;!)xYfBf`W#;?*eG zDeej1p!243dxoAQw7ENzv|VbZ55VI%EE=a1EOD^je4iixd_&G-pMCD|OHDNO_`CBE z`IkB~IRW;j?ENeDvxYg`=3Jf_hf7a2(wwoFqKXE`*H+9A&P6UO3r#1#i0O;+r$pz+ z3T|*#sl7gBbU=*7dPmE_=37fGmN!WlROS06*A!#huO1@4zn2~a8#|~3ae)E`aHbps z1q>8}B`)qSIrKlucwlt$T{Vu4g{6HCOm_N2Fx{g0p^g2}%b(uwiZKbTv|W@i*$URL zr)rAGOzrANvarSt)h$}Foa^!-{Lt&U)_5-SM()9u6}g7vvX5v#MgC3ZFO(< zPrPVCjP|+{V<`h`nN3Pu&AkVD;i&RIN3z@9IuIuqClaWtqDwwt9D zh32TNM>C8_gx`=>I~Cer%r`YnlQ|5hE?QUCwHIOA=T5^o5lAcYAzt5%Hh7r&@}NDEaeB`u2R295BoV!dBXk9VjVH8^GFtP+%-q zo4wL;-T{?25~|1U9@(mPN|mrTU=n6H78;3tIuYugC?R_zvv?5DKszva^V~wFb!MX@ zN%(pC%bQ1TIBv@aS^V*h!ng|4cwG3Ds*!LjgMCZV`4qQIi3oBfwl%@;_*QLKMJ&MC~rQLp1_NvwBXE& zPjxz-;ZM&rFQm zSe3nllvwIel0Lpo zfW#dv!>{bwIs3fQJvmZSO9B@Ipks~w7klbcF{k}g{tWH^D|3)3Wrn(@;Br5lDc8^H zjLd>`)f-g(3C+EmEKAv0{%+29)KO&d>s-2_*G3o{!~jutS5PaRCCPIZWz@ZeCDxbdEcv8)ubmg{WC<@lx1yCS|a$z{`^YM z1yK%4QuY3KOmQ*);rdWE*qgy|1;jv$0|H}|bPOm?gq#*00{aeI)DSjU0}H$x2%v1G z1mn{Dhy1IPHI~jCU#RHIhR9|Q!Vfz1@Aq1ie|r3ANzIG!Xl+}WQSJkpN5 zJ(pZJEIog0^MxJ1uDs3aLXo_ye_8*Mf+I2b4YO;{-X}j>$p@I>>GNk11zrtkg9+|$ zNag~P!wOdYLea7k?pM^0#SdDpwkK+Oc?=ZJiwRJ8C+@c>Y)s3+K_Vb4-uJo=%QwYJsctf%FGRnEz9Z0dv=EG!t^P zHQt9>qDtEX?qG3%LhLVhbN|2yM8qnBI3wKk#XNJtpQp7I$KQ@3GjbBr!$Z_pibnzn zG}l$@JT3Ut2GFWvi}uRGj|E&a;+zJ%Ri|sep9u>_!}J1qjY6YZQx8@XbNf|x2GdFn zBqV3T4*WU=ohgUYk?#yN}0 zdP*W0yG6T1_H})=zM|ZE`S^Itu|wmEEejN$iwWBq`1p8b!V-t%%RQ3eInWwLzRhY^ zqUiF!(AK0pkZ)iS(xc$2|B*`oM+gvX0(6oC*pFmseC%fKvZ(+^&Mt;luFcQmxnR|I z+VXaedY_STg7$imp{dR|D6;?U z;<%8rhzYe(zL1jw1^@~BzL&2G*erin2mB(Oz|ZxD3;=9=+oCbcsr_*;_P(*7h-Y1<4Gka0O!rvfwSG` zn!z#)6x8$An>91-;5G1^8AFL5uaBRjR<#}-0L3vw8+`$o`+8&6*x*!?wbUEq3i_Uz zvyjA2v^lT?zG*C%Mq1hF+cT7_p|kUc)3phiSnTMhzS}qEK<@ulFa|%aRQB26l;fXg z9?(HP@6S2auGQ6+Ra>c#kR^+FxB~;Zjv1aWk&rz^lgQrqAmjf^plU+ARJ%1BmKAtV1^!rhOX!0P1gs)O?y%bHnA+VniS88gl+ltA~EX^ zG&HBGY?bR?K!+LzYM_5>oecekni*&8l^59JH9C z%|-}bR#fSGpU5(Z%w;6I9EzQ))m9CCPosKhjV{nIc7>`3I&(3! z&(;Vzu6!9JNo(3X378qo8d^E&FR^jW*Id7?x*DWR>^pRH6Ac(#TvhQ@1-e#XHGGSC zsj7T9HF@PR`Qx|R56fcVG_&+e>d7UYJquaiRqm}%@x9y%sow{yP4}$i*6S)=xioM1 z*-8rksQO+Ts$XS=443E`)Eo1=`mST@70nJ%X*(N+r}iw^7`A9C(#xWBhb+^;1H-Zh z&ib>+my1*vD8CW3!S0@9YoU(M)<2&HH4?iv~KMM_OEtInw+e-X&v4Bg? zd!BS`Rb+a?@g91tGPiw6ey8=S)V-npsFdDZ<46nMzv@-v(N;%ZmCsY&)nK6X3u1!DSIkzE$8ph@&&##>${WkSk zi?im!-WyYj^5y}N&!i48%miuxa{%`N5PlNCye0ZP0GE9BO%WTYEng$VBg26w4=@mM zn{WlYB_%jPRpANC!E2OV2oTU8?M#mS6(!Tc>7`NHQ8Iwm1J{k1{;{fBqG zY74>tMEwAyd?0*8opr}>pwX1jFM#x$Jgf%jQYA|MtXNtBGGr7c3aq$>fOOW`dBjlS zv<)nAKwSY`mQ;Wo-+Hq2djqq~0m^M1*j0dK9z~vJYaj5M+JN=)4&o9I9`wg-3%!5grpPUo!Wy$63DZ~Ed`)KX9xH@*aLw@4K^Vm5Tu6^0hk7mbFBePLnG$U-q-hc z@7q)TwRd!RCUEd2-EvpxB;wD_?yN`rm+_X6KR%W;_GZ?6>fS`?xQzF;NT0R`qU(I2 z9AH<>=nP~Xc}J>>_blUw|JmfXFjhU%N38E(1Gjl1^i8FyrP0_%y97j}!K+95?q-u7 zRwqc~2@@eHME&|CRr6xPVG1(@=RL!^3f%lLia{>sKr1%yD+~q}uB3)q4KR0*IP4cj z$?pJEk0TkuLiTYrl?4(ybf5_*)s}SIXa++H2xu4q9{Kk-5RI28)5zyW&KN}(Oq}HU zNC@2RjOT_0B4`CP$)9K?;J5E!M#aRCxh2I%M@2QO@;9Jt6wkJyH`H#l5J`?cIS8B} z6+DHL&DdwR!VNK(49t+CfP5rvx&0H+PY3{80D9P!Gs@p1ZCOPtI+h>maLx`HH7mXP z%+gVyOz-usyFvOd2c?w{>*dNPy+@|{_5;}(}( zrPcbuS{LrQ!!G%K&j;0+zsF9OXf~ZMsEm$7*>j(5=b(DZW_QqPy$kB>f;g<%kAvMO z#lfJ1z~d!W?^H(j%G@N9yODy9hM3F8FDFiXhsI^0pOa5NxH$^4r9XSSc_6GF6hvSq7t{x-%nI8iq?t?!= zjr%b6)m6dEJ2dls{uqi@*9KRR4_L<<;*n3R@%4o^pY0zOn&SqOSdSwtMfuK?`n~pU z@o;)hzW5cLWGJ>l31^|J3=@vUl5AW}z12N*%Fqp8QXWfb>*<^9>7^=0r(?}x(aY1= zMmAXv#5tB&9M6DZkhkD&Z>;RE<5|dBvEY92ew+gs%GvI-MDR zEKD*jSluQ%CXv_;4#MM05pp@G$g+jEh^2YA*HPEHh(KJGd+!B9})({?v zGo;XB*OdloFz0^jF~ri%e{ltY>)@bf&!58MFoAt8&n1tNH`>G2=Bo3mX%0cJy%JLy z+^8XBJs}lO^G$|1Ss)*9V`1>jGmp^(CwWcJi^!-r8gO@^qlpq*tojF%8!T`xI6f7) zh9!m=Of{_zr#*oj6B?6xvD(-#AK00QimLCd!LU>7=}`CWxWLPap?AZ9z?T9+*XEkv z4PMA@3g{mfScE>x4&#l0~Ax?>}Cs0q&;H3c&=PaLkjK;hAr zy=>ZvCD#ZW7%d$l<=zr`x9HLO@w9D=^-*>-DMGXs%pb^iRxq?dqjG0ISeUv5ZElHUc#OF8$Dn=V zR&w53b~4NOQbO8U%IN0l5!@8wY=8Cxzq;5*m96OaQ?_NLgF^|c>(fs=^D&t#D?(J- zKZ*^Gdqp6HilZ3}m~=|;-sE`x8<(atx-O4~(3+0PdO@R5?#{xc%`!O5b0$!)O8Ct$ z88^N)a3)~l05{=W*JnqywZ0B2yMbcGfe`zR8IQY77snMxjwa_N{`3$nDr*m+BvDGF zJN{1Z+~IXc8P5$t7J{|pkB=wP;jAN-3FsNMq*d`kDIdI)sDjm2+hNXp!H&syKB=y; z5KdW=51ktKTr6;Z)D@NK!nxMhG~1e6xasWuVpLvu&Ig9l2Ya_IY<*+X@~l`NBgRysn4t|9+g&HiwE9s?W@}? zKeKQ6`M({P!7LYB&kOp4sIdcBV_3*6UXa&cuOL6ly*F{F^vC~M1g)$wf3})8GN4Ug zPcTZO5UL%dq4OtGBv4O1Er**S2Q62L{%QGu_TrB^(_OxtN%E=GyXp4(vubBY*zpqh z{ts}dNwYhqF-Yj&j`s+xJb!v9;1W}VzTqQxG`l|Sg-hRQ^z+s&;!hC8M>?i6hr?L| zL>xD7on)#PaH>xc`v{7KEVCcF@$?^#sh)DnY>>iPI`I3NmT<((o9TuG7H)YsLM!0- z=S*7Ebn3OL3=pkz-3rXB3v7LH5~LKSrDnjDUzR3slJ)s>BkMOA7z-I<3de>cbOE~V zqu#A0#Qh80KkPhj%=Euv86)1}Y6j0TIIR_jK7ZV71#NqmyMLI1B{zHFvAAsU6vp8e z_Swbi+NhgrkhEW+gqsGgou((Zfn-yoy)!l#u;(nx?Vx}ua*QB`z@L0vonL&v^5bQj zkfnxah}_%-+I)6OKLboEUh>BgQzeV8PNBwofBP$XSufnIh*0~l8K=C77{-@aU-@H2 zUSldahV7;Jw#}z&w55^cmMe-XR75zL<8RE{YyQEySA;*S8D!1>aP7keYqwHtRE@x@ z`tKOD*&%MXB56;Aji)0%o(~2wG}w9B>=;ue55s;iphYg&CPBbVMC}qy6cM;JkUs6S zG3|_SJ`^(R?Gw0m)&GiJW2Rz@W`EgAwXR^e0D)lgxJ6-#; zOc$bJ4XW$u&e%Ug*5I>cFF^L%nb$~+Lz1S9#h??4O(JA=hFgNX9luYtavWIa7}U-p z{^k}ql-~D>AW6s!y+P9K*}lTb341>(%?(A#vS>v-^$3HL*_H;ZCSN)x~`q~cl$ zllzXQr^oDn`nm)>9nVTamR(Z9wquTLO;$^W_#j*g4KaJAUjmYzMY@U@}r)*Oe?v=upoSL@66qMePw#X4O` zFx`vAUG_Bhpp7Y5ms>;;Hy0|xocRI^vv;)GDqyaeb~M8-uk{siG^THeNj=8r|3ulU ztBIFAfAPfk&jG85)2tligE6lpdNQMXGK|b_lG5$N2j*>(v##E6k=D+FM>g6xLA#AR zZJxi(xK1l=#gn|m?tVYiJG5*U$IN?Cz<8Z}D0#n$Z6{fge#gk3)RF z#2H`lR%7TU^tQEAr{>8dX$J8TH68;JV@)G4xgl-;Rik?lE*b0=(`y&Jca4E>^1rR~ z_gK|MEA(gyJZuwAv#4N5CYB%0A$zyp{6XoSwLz)cs&3iK42=1ZijnE*D#aVA%drhu zer79nLtqaZL@Vk2*8_f)Me5!2$(NBr_M=qNqHAU*`o2U}l^@oF^;sa2Z=EP@eiBG3 zb^JJ#I=iU5PjL6qDAjin{kx-)q3*|~K5PXh1Y=N)yw>w;#_u_7TnxVo!((9;gyjZG zXqjSDR^3mc)Q%38Yhz9t`D?VwuX;K4UHLt*3kHMV#SVMQS-kolJ96LoSnEudFmY$_ z>n;35L|DjQ=u@B z+_QMOZTQfi($_b=>+wR_d~08-GITxD!D+%csuUs4beCOWJaITp#*O+`a%4E-n2{9{ z+I~=6?OwF_X_k!#H#3sB4%!=cs<8t5}U7K{3W&(jxZi$&qBc2{dO&87vB zox~eeL7F9laY){*-V|Ey2a{WAo5>Z}Ka=@x{0i6iP@SmQ`7YOZpbckK6NzYX@Hth9 zDY37+AYL7sQHTm$=lv?wc{i~&2bXX0cxFyo5{5QG+b~qOlf=qnl!CP=Nvqps>(2_t zSpEziUp+nf98TH%yEoa7X74m$eNdbj!3$>kqtbLO{q&{Q#-+utkF@f!PDBW168Jaa zRTtN#{43jGo{I|a%@hQfwM=3dahxzF-y;jRN}CC(g{2~lVqHF8clLT|jMz^B7V8RQ z@{!wDFRF81wuH}YSPE%2k~b*cEPDy0?WVj`&`mewvpd7nL!u>;mcyi)0+poF4Ap=8 zzqKHhoUODD zcZ0rSPMtmVNqLc?X`WxUG2dwbG8K@~y=txJ6!1YJ`?A_YMjl+;Pl$?vwuiYREWZ+Z zc`4C)P-=}bN}$&mfH2UE`Ky^Ny8MH0WqT2s%rUI|SofnhT&Wy8G_qxV<_V5mpx=r| zDt#Hzb06T!%!duHl2>1|R-c{+?bIgSEyPk7LuVw^_2$d^Ts52|TUzZ@Tk5Ht1r2xO6~8vQ9b@qp z_RLW?ubYdj3It9{c(B$i?4f`R6F8V-fR@HrVT!I%e9>3(%cA9~p7Bs^S#65>AbxU> zwfya4NQn~>&ph@nH^T3x(km(fi<6g8<~B!O0Z+C;rG*kzVE%q#iL+BznA)fVPQgFBZh! z8w_!5yp^Z$(NX|rBiIG`Bx{8j3Y{S<5htOhd+nzV0co$;D)iO%eOaoejkK=sD|n1F z{v0$7K4##td zqxL{_ut2mhVn(qgGh03-?042VZBCBhi!;{pO=1nThTP5cSnR^RPeC3cxp~hJdt2yj z?f29NI#?Q8c(~cE?PBT2!}11It?d&`?C8lCEiIz#d||V}gOvlyvVENo?qQSJT|G0D zdnoaYTc-BVvGc%`|8$mDhXT_W_vVzN;057W%18fT_(G1m(@etfHl7Oa)`wK1_#0}T zp`fQ|B90V(vp7S@{7LN5)X-14QRmt@*Sx-U*j%UY)-GRsEWJBUEl+0ZDr+}&3zd0( zGjF_7-8r&aTe+%PA(U?K3Le!k-Jly1K8k=7a)J~;Pt*@xlTX5v=;v$3Be~r8NL+<% z+jQ-QjZV^aW5PZ}KrzExR>y~jYf;rCdi{a@yiqg6m{7MUy2lE`IS<}twe<$y+jK(j z&A;c?NZn{~w=5-~X&_*E>QSqn{+S?;3GU{4i$t=j$8X7SCfWeU)Zn=FM=siwo`Xc) z!~tZujBQkZH{j35K>RXzNlpcl-+iTNUYRicrFM40+^zbSIy|k< zbVG)6OIN}(#53xIsUNo^zOF$oE{>$-Fuu&*71kgTu` zLgL6^5}M}BVzU#;jmo;Dy9)DNX$XIMlDs<;jj*?Bev8O!X^wP)qgr}zI-aLQ%V?QU zG(sb-vv#LBxrKT^VZG3@$1Mhz63W&Vx4RS3K9;6y@V}d^bx(C5!O%6YGL&3xfidi=FKH*X@2_R$7;MSAdC7*1j5J{sxEN5 zvz>;G{-$?&!(4^0s6cWsFbj4UxDF=q;?LBF2O4LuXsfBLu~%BN9Up11Zb&RJ#_8wl zy!sRhL(NcnF`j3Jw>E?!=SKey^I$eOky;_t5ceVQUaLI4L+1AN7>IpL>Kda{+{%&FfZeoXQx<9HMqfw{DDaj`;(M9G0H4 zO&Q_PSvAK|?eE<^+u+Daz>%Oan+>wvu}$ zF9hJYFMhQZN#6}l?-(+DT6Jbbq6K&BMnw?-$k0lgzZ>s^TYq?$)|LHd`F9Sj6(7%C z>uzfT1%DjKBdk0|`8SKB%IV|z0?V%Y4b;D0$(!q{$Pr8(2ajDUO%(OZooy22d5PtS z5>!@&xMRI2E*_o=OuxsX8_Kr3nE7aU7u_o43EaOOHR2%_?C1K`S6rTFf@kYZi(4Og z%LzDWWY2{A!<*Bh0cbEBz!mGHF235k@jSY#B4A#Fqs8mg)%T#s>9oC}>G_S8=fbG` zJjbFqoP`VpEkLv;^Th7$QGw`~G78O)fy$u~!omuH$R~7AbI7CM>Q&0==A=(@Rze znYK6zk3+o=kHABL@~GFG8viZ@-#GXF{cPaX2W^KlCh)_}x1tv72XPL()p-hSX&EY5 zI>M~c19dJz07+hj|7}m^9cmdLGJbx2RgMkD(MNWD1B8-+EHSDmJQ4!`P|i6`r3-Kd zt_jqqM7_22<=^K3Gb;OE>ml$=@xN0HbwLN`|4Yll9$`H_*Y&d%jed$kM^U#lSKj)y zlg7N$aiEFyrO}^ebGr(IP6723048ZfFo+GUVSS{i=mY zY8(p#I=rYc2>xY?uUa&rUVyGoLe(z*J>&o5C;r!!|9`yY&zn0~gJ&<8vcp1dfiH-X LhGLPtY2g0>#y|#4 From 6c33e8712ec5a02befcb99109430b73620083df0 Mon Sep 17 00:00:00 2001 From: Olivier Deprez Date: Tue, 5 Sep 2023 09:41:15 +0200 Subject: [PATCH 2/3] docs: remove SEL2 SPMC threat model The SEL2/Hafnium SPMC implementation threat model is now hosted at [1]. [1] https://hafnium.readthedocs.io/en/latest/threat_model_spm.html Signed-off-by: Olivier Deprez Change-Id: I83d3f21ef0ee9364529c7b80de9872034ff92b09 --- docs/threat_model/index.rst | 1 - docs/threat_model/threat_model_spm.rst | 1340 ------------------------ 2 files changed, 1341 deletions(-) delete mode 100644 docs/threat_model/threat_model_spm.rst diff --git a/docs/threat_model/index.rst b/docs/threat_model/index.rst index b22fb1813..3e0393e38 100644 --- a/docs/threat_model/index.rst +++ b/docs/threat_model/index.rst @@ -31,7 +31,6 @@ data flow diagram, as well as a list of threats we have identified using the :caption: Contents threat_model - threat_model_spm threat_model_el3_spm threat_model_fvp_r threat_model_rss_interface diff --git a/docs/threat_model/threat_model_spm.rst b/docs/threat_model/threat_model_spm.rst deleted file mode 100644 index 24a115bfa..000000000 --- a/docs/threat_model/threat_model_spm.rst +++ /dev/null @@ -1,1340 +0,0 @@ -SPMC Threat Model -***************** - -************************ -Introduction -************************ -This document provides a threat model for the TF-A :ref:`Secure Partition Manager` -(SPM) implementation or more generally the S-EL2 reference firmware running on -systems implementing the FEAT_SEL2 (formerly Armv8.4 Secure EL2) architecture -extension. The SPM implementation is based on the `Arm Firmware Framework for -Arm A-profile`_ specification. - -In brief, the broad FF-A specification and S-EL2 firmware implementation -provide: - -- Isolation of mutually mistrusting SW components, or endpoints in the FF-A - terminology. -- Distinct sandboxes in the secure world called secure partitions. This permits - isolation of services from multiple vendors. -- A standard protocol for communication and memory sharing between FF-A - endpoints. -- Mutual isolation of the normal world and the secure world (e.g. a Trusted OS - is prevented to map an arbitrary NS physical memory region such as the kernel - or the Hypervisor). - -************************ -Target of Evaluation -************************ -In this threat model, the target of evaluation is the S-EL2 firmware or the -``Secure Partition Manager Core`` component (SPMC). -The monitor and SPMD at EL3 are covered by the :ref:`Generic TF-A threat model -`. - -The scope for this threat model is: - -- The TF-A implementation for the S-EL2 SPMC based on the Hafnium hypervisor - running in the secure world of TrustZone (at S-EL2 exception level). - The threat model is not related to the normal world Hypervisor or VMs. - The S-EL1 and EL3 SPMC solutions are not covered. -- The implementation complies with the FF-A v1.0 specification, and a few - features of FF-A v1.1 specification. -- Secure partitions are statically provisioned at boot time. -- Focus on the run-time part of the life-cycle (no specific emphasis on boot - time, factory firmware provisioning, firmware udpate etc.) -- Not covering advanced or invasive physical attacks such as decapsulation, - FIB etc. -- Assumes secure boot or in particular TF-A trusted boot (TBBR or dual CoT) is - enabled. An attacker cannot boot arbitrary images that are not approved by the - SiP or platform providers. - -Data Flow Diagram -====================== -Figure 1 shows a high-level data flow diagram for the SPM split into an SPMD -component at EL3 and an SPMC component at S-EL2. The SPMD mostly acts as a -relayer/pass-through between the normal world and the secure world. It is -assumed to expose small attack surface. - -A description of each diagram element is given in Table 1. In the diagram, the -red broken lines indicate trust boundaries. - -Components outside of the broken lines are considered untrusted. - -.. uml:: ../resources/diagrams/plantuml/spm_dfd.puml - :caption: Figure 1: SPMC Data Flow Diagram - -.. table:: Table 1: SPMC Data Flow Diagram Description - - +---------------------+--------------------------------------------------------+ - | Diagram Element | Description | - +=====================+========================================================+ - | ``DF1`` | SP to SPMC communication. FF-A function invocation or | - | | implementation-defined Hypervisor call. | - +---------------------+--------------------------------------------------------+ - | ``DF2`` | SPMC to SPMD FF-A call. | - +---------------------+--------------------------------------------------------+ - | ``DF3`` | SPMD to NS forwarding. | - +---------------------+--------------------------------------------------------+ - | ``DF4`` | SP to SP FF-A direct message request/response. | - | | Note as a matter of simplifying the diagram | - | | the SP to SP communication happens through the SPMC | - | | (SP1 performs a direct message request to the | - | | SPMC targeting SP2 as destination. And similarly for | - | | the direct message response from SP2 to SP1). | - +---------------------+--------------------------------------------------------+ - | ``DF5`` | HW control. | - +---------------------+--------------------------------------------------------+ - | ``DF6`` | Bootloader image loading. | - +---------------------+--------------------------------------------------------+ - | ``DF7`` | External memory access. | - +---------------------+--------------------------------------------------------+ - -********************* -Threat Analysis -********************* - -This threat model follows a similar methodology to the :ref:`Generic TF-A threat model -`. -The following sections define: - -- Trust boundaries -- Assets -- Theat agents -- Threat types - -Trust boundaries -============================ - -- Normal world is untrusted. -- Secure world and normal world are separate trust boundaries. -- EL3 monitor, SPMD and SPMC are trusted. -- Bootloaders (in particular BL1/BL2 if using TF-A) and run-time BL31 are - implicitely trusted by the usage of secure boot. -- EL3 monitor, SPMD, SPMC do not trust SPs. - -.. figure:: ../resources/diagrams/spm-threat-model-trust-boundaries.png - - Figure 2: Trust boundaries - -Assets -============================ - -The following assets are identified: - -- SPMC state. -- SP state. -- Information exchange between endpoints (partition messages). -- SPMC secrets (e.g. pointer authentication key when enabled) -- SP secrets (e.g. application keys). -- Scheduling cycles. -- Shared memory. - -Threat Agents -============================ - -The following threat agents are identified: - -- NS-Endpoint identifies a non-secure endpoint: normal world client at NS-EL2 - (Hypervisor) or NS-EL1 (VM or OS kernel). -- S-Endpoint identifies a secure endpoint typically a secure partition. -- Hardware attacks (non-invasive) requiring a physical access to the device, - such as bus probing or DRAM stress. - -Threat types -============================ - -The following threat categories as exposed in the :ref:`Generic TF-A threat model -` -are re-used: - -- Spoofing -- Tampering -- Repudiation -- Information disclosure -- Denial of service -- Elevation of privileges - -Similarly this threat model re-uses the same threat risk ratings. The risk -analysis is evaluated based on the environment being ``Server`` or ``Mobile``. - -Threat Assessment -============================ - -The following threats are identified by applying STRIDE analysis on each diagram -element of the data flow diagram. - -+------------------------+----------------------------------------------------+ -| ID | 01 | -+========================+====================================================+ -| ``Threat`` | **An endpoint impersonates the sender or receiver | -| | FF-A ID in a direct request/response invocation.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMD, SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Spoofing | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------++----------------+---------------+ -| ``Impact`` | Critical(5) | Critical(5) | | -+------------------------+------------------++----------------+---------------+ -| ``Likelihood`` | Critical(5) | Critical(5) | | -+------------------------+------------------++----------------+---------------+ -| ``Total Risk Rating`` | Critical(25) | Critical(25) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. | -| | The guidance below is left for a system integrator | -| | to implemented as necessary. | -| | The SPMC must enforce checks in the direct message | -| | request/response interfaces such an endpoint cannot| -| | spoof the origin and destination worlds (e.g. a NWd| -| | originated message directed to the SWd cannot use a| -| | SWd ID as the sender ID). | -| | Additionally a software component residing in the | -| | SPMC can be added for the purpose of direct | -| | request/response filtering. | -| | It can be configured with the list of known IDs | -| | and about which interaction can occur between one | -| | and another endpoint (e.g. which NWd endpoint ID | -| | sends a direct request to which SWd endpoint ID). | -| | This component checks the sender/receiver fields | -| | for a legitimate communication between endpoints. | -| | A similar component can exist in the OS kernel | -| | driver, or Hypervisor although it remains untrusted| -| | by the SPMD/SPMC. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 02 | -+========================+====================================================+ -| ``Threat`` | **Tampering with memory shared between an endpoint | -| | and the SPMC.** | -| | A malicious endpoint may attempt tampering with its| -| | RX/TX buffer contents while the SPMC is processing | -| | it (TOCTOU). | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF3, DF4, DF7 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | Shared memory, Information exchange | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | High (4) | High (4) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | High (4) | High (4) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | High (16) | High (16) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | In context of FF-A v1.0 and v1.1 this is the case | -| | of sharing the RX/TX buffer pair and usage in the | -| | PARTITION_INFO_GET or mem sharing primitives. | -| | The SPMC must copy the contents of the TX buffer | -| | to an internal temporary buffer before processing | -| | its contents. The SPMC must implement hardened | -| | input validation on data transmitted through the TX| -| | buffer by an untrusted endpoint. | -| | The TF-A SPMC mitigates this threat by enforcing | -| | checks on data transmitted through RX/TX buffers. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 03 | -+========================+====================================================+ -| ``Threat`` | **An endpoint may tamper with its own state or the | -| | state of another endpoint.** | -| | A malicious endpoint may attempt violating: | -| | - its own or another SP state by using an unusual | -| | combination (or out-of-order) FF-A function | -| | invocations. | -| | This can also be an endpoint emitting | -| | FF-A function invocations to another endpoint while| -| | the latter is not in a state to receive it (e.g. a | -| | SP sends a direct request to the normal world early| -| | while the normal world is not booted yet). | -| | - the SPMC state itself by employing unexpected | -| | transitions in FF-A memory sharing, direct requests| -| | and responses, or handling of interrupts. | -| | This can be led by random stimuli injection or | -| | fuzzing. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMD, SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP state, SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | High (4) | High (4) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | High (12) | High (12) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC provides mitigation against such | -| | threat by following the guidance for partition | -| | runtime models as described in FF-A v1.1 EAC0 spec.| -| | The SPMC performs numerous checks in runtime to | -| | prevent illegal state transitions by adhering to | -| | the partition runtime model. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 04 | -+========================+====================================================+ -| ``Threat`` | *An attacker may attempt injecting errors by the | -| | use of external DRAM stress techniques.** | -| | A malicious agent may attempt toggling an SP | -| | Stage-2 MMU descriptor bit within the page tables | -| | that the SPMC manages. This can happen in Rowhammer| -| | types of attack. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF7 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP or SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | Hardware attack | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering | -+------------------------+------------------+---------------+-----------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+---------------+-----------------+ -| ``Impact`` | High (4) | High (4) | | -+------------------------+------------------+---------------+-----------------+ -| ``Likelihood`` | Low (2) | Medium (3) | | -+------------------------+------------------+---------------+-----------------+ -| ``Total Risk Rating`` | Medium (8) | High (12) | | -+------------------------+------------------+---------------+-----------------+ -| ``Mitigations`` | The TF-A SPMC does not provide mitigations to this | -| | type of attack. It can be addressed by the use of | -| | dedicated HW circuity or hardening at the chipset | -| | or platform level left to the integrator. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 05 | -+========================+====================================================+ -| ``Threat`` | **Protection of the SPMC from a DMA capable device | -| | upstream to an SMMU.** | -| | A device may attempt to tamper with the internal | -| | SPMC code/data sections. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF5 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC or SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering, Elevation of privileges | -+------------------------+------------------+---------------+-----------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+---------------+-----------------+ -| ``Impact`` | High (4) | High (4) | | -+------------------------+------------------+---------------+-----------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+---------------+-----------------+ -| ``Total Risk Rating`` | High (12) | High (12) | | -+------------------------+------------------+---------------+-----------------+ -| ``Mitigations`` | A platform may prefer assigning boot time, | -| | statically alocated memory regions through the SMMU| -| | configuration and page tables. The FF-A v1.1 | -| | specification provisions this capability through | -| | static DMA isolation. | -| | The TF-A SPMC does not mitigate this threat. | -| | It will adopt the static DMA isolation approach in | -| | a future release. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 06 | -+========================+====================================================+ -| ``Threat`` | **Replay fragments of past communication between | -| | endpoints.** | -| | A malicious endpoint may replay a message exchange | -| | that occured between two legitimate endpoint as | -| | a matter of triggering a malfunction or extracting | -| | secrets from the receiving endpoint. In particular | -| | the memory sharing operation with fragmented | -| | messages between an endpoint and the SPMC may be | -| | replayed by a malicious agent as a matter of | -| | getting access or gaining permissions to a memory | -| | region which does not belong to this agent. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | Information exchange | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Repdudiation | -+------------------------+------------------+---------------+-----------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+---------------+-----------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+---------------+-----------------+ -| ``Likelihood`` | High (4) | High (4) | | -+------------------------+------------------+---------------+-----------------+ -| ``Total Risk Rating`` | High (12) | High (12) | | -+------------------------+------------------+---------------+-----------------+ -| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 07 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint may attempt to extract data | -| | or state information by the use of invalid or | -| | incorrect input arguments.** | -| | Lack of input parameter validation or side effects | -| | of maliciously forged input parameters might affect| -| | the SPMC. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMD, SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP secrets, SPMC secrets, SP state, SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Information discolure | -+------------------------+------------------+---------------+-----------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+---------------+-----------------+ -| ``Impact`` | High (4) | High (4) | | -+------------------------+------------------+---------------+-----------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+---------------+-----------------+ -| ``Total Risk Rating`` | High (12) | High (12) | | -+------------------------+------------------+---------------+-----------------+ -| ``Mitigations`` | Secure Partitions must follow security standards | -| | and best practises as a way to mitigate the risk | -| | of common vulnerabilities to be exploited. | -| | The use of software (canaries) or hardware | -| | hardening techniques (XN, WXN, BTI, pointer | -| | authentication, MTE) helps detecting and stopping | -| | an exploitation early. | -| | The TF-A SPMC mitigates this threat by implementing| -| | stack protector, pointer authentication, BTI, XN, | -| | WXN, security hardening techniques. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 08 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint may forge a direct message | -| | request such that it reveals the internal state of | -| | another endpoint through the direct message | -| | response.** | -| | The secure partition or SPMC replies to a partition| -| | message by a direct message response with | -| | information which may reveal its internal state | -| | (.e.g. partition message response outside of | -| | allowed bounds). | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC or SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Information discolure | -+------------------------+------------------+---------------+-----------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+---------------+-----------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+---------------+-----------------+ -| ``Likelihood`` | Low (2) | Low (2) | | -+------------------------+------------------+---------------+-----------------+ -| ``Total Risk Rating`` | Medium (6) | Medium (6) | | -+------------------------+------------------+---------------+-----------------+ -| ``Mitigations`` | For the specific case of direct requests targeting | -| | the SPMC, the latter is hardened to prevent | -| | its internal state or the state of an SP to be | -| | revealed through a direct message response. | -| | Further, SPMC performs numerous checks in runtime | -| | on the basis of the rules established by partition | -| | runtime models to stop any malicious attempts by | -| | an endpoint to extract internal state of another | -| | endpoint. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 09 | -+========================+====================================================+ -| ``Threat`` | **Probing the FF-A communication between | -| | endpoints.** | -| | SPMC and SPs are typically loaded to external | -| | memory (protected by a TrustZone memory | -| | controller). A malicious agent may use non invasive| -| | methods to probe the external memory bus and | -| | extract the traffic between an SP and the SPMC or | -| | among SPs when shared buffers are held in external | -| | memory. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF7 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP/SPMC state, SP/SPMC secrets | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | Hardware attack | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Information disclosure | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Low (2) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (6) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | It is expected the platform or chipset provides | -| | guarantees in protecting the DRAM contents. | -| | The TF-A SPMC does not mitigate this class of | -| | attack and this is left to the integrator. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 10 | -+========================+====================================================+ -| ``Threat`` | **A malicious agent may attempt revealing the SPMC | -| | state or secrets by the use of software-based cache| -| | side-channel attack techniques.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF7 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP or SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Information disclosure | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Low (2) | Low (2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (6) | Medium (6) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | From an integration perspective it is assumed | -| | platforms consuming the SPMC component at S-EL2 | -| | (hence implementing the Armv8.4 FEAT_SEL2 | -| | architecture extension) implement mitigations to | -| | Spectre, Meltdown or other cache timing | -| | side-channel type of attacks. | -| | The TF-A SPMC implements one mitigation (barrier | -| | preventing speculation past exeception returns). | -| | The SPMC may be hardened further with SW | -| | mitigations (e.g. speculation barriers) for the | -| | cases not covered in HW. Usage of hardened | -| | compilers and appropriate options, code inspection | -| | are recommended ways to mitigate Spectre types of | -| | attacks. For non-hardened cores, the usage of | -| | techniques such a kernel page table isolation can | -| | help mitigating Meltdown type of attacks. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 11 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint may attempt flooding the | -| | SPMC with requests targeting a service within an | -| | endpoint such that it denies another endpoint to | -| | access this service.** | -| | Similarly, the malicious endpoint may target a | -| | a service within an endpoint such that the latter | -| | is unable to request services from another | -| | endpoint. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. | -| | Bounding the time for operations to complete can | -| | be achieved by the usage of a trusted watchdog. | -| | Other quality of service monitoring can be achieved| -| | in the SPMC such as counting a number of operations| -| | in a limited timeframe. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 12 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint may attempt to allocate | -| | notifications bitmaps in the SPMC, through the | -| | FFA_NOTIFICATION_BITMAP_CREATE.** | -| | This might be an attempt to exhaust SPMC's memory, | -| | or to allocate a bitmap for a VM that was not | -| | intended to receive notifications from SPs. Thus | -| | creating the possibility for a channel that was not| -| | meant to exist. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of service, Spoofing | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium(3) | Medium(3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium(3) | Medium(3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium(9) | Medium(9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this threat by defining a | -| | a fixed size pool for bitmap allocation. | -| | It also limits the designated FF-A calls to be used| -| | from NWd endpoints. | -| | In the NWd the hypervisor is supposed to limit the | -| | access to the designated FF-A call. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 13 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint may attempt to destroy the | -| | notifications bitmaps in the SPMC, through the | -| | FFA_NOTIFICATION_BITMAP_DESTROY.** | -| | This might be an attempt to tamper with the SPMC | -| | state such that a partition isn't able to receive | -| | notifications. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Low(4) | Low(4) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this issue by limiting the | -| | designated FF-A call to be issued by the NWd. | -| | Also, the notifications bitmap can't be destroyed | -| | if there are pending notifications. | -| | In the NWd, the hypervisor must restrict the | -| | NS-endpoints that can issue the designated call. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 14 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint might attempt to give | -| | permissions to an unintended sender to set | -| | notifications targeting another receiver using the | -| | FF-A call FFA_NOTIFICATION_BIND.** | -| | This might be an attempt to tamper with the SPMC | -| | state such that an unintended, and possibly | -| | malicious, communication channel is established. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering, Spoofing | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium(3) | Medium(3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium(6) | Medium(6) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this by restricting | -| | designated FFA_NOTIFICATION_BIND call to be issued | -| | by the receiver only. The receiver is responsible | -| | for allocating the notifications IDs to one | -| | specific partition. | -| | Also, receivers that are not meant to receive | -| | notifications, must have notifications receipt | -| | disabled in the respective partition's manifest. | -| | As for calls coming from NWd, if the NWd VM has had| -| | its bitmap allocated at initialization, the TF-A | -| | SPMC can't guarantee this threat won't happen. | -| | The Hypervisor must mitigate in the NWd, similarly | -| | to SPMC for calls in SWd. Though, if the Hypervisor| -| | has been compromised, the SPMC won't be able to | -| | mitigate it for calls forwarded from NWd. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 15 | -+========================+====================================================+ -| ``Threat`` | **A malicious partition endpoint might attempt to | -| | set notifications that are not bound to it.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Spoofing | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Low(4) | Low(4) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this by checking the | -| | sender's ID provided in the input to the call | -| | FFA_NOTIFICATION_SET. The SPMC keeps track of which| -| | notifications are bound to which sender, for a | -| | given receiver. If the sender is an SP, the | -| | provided sender ID must match the ID of the | -| | currently running partition. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 16 | -+========================+====================================================+ -| ``Threat`` | **A malicious partition endpoint might attempt to | -| | get notifications that are not targeted to it.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Spoofing | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Informational(1) | Informational(1)| | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this by checking the | -| | receiver's ID provided in the input to the call | -| | FFA_NOTIFICATION_GET. The SPMC keeps track of which| -| | notifications are pending for each receiver. | -| | The provided receiver ID must match the ID of the | -| | currently running partition, if it is an SP. | -| | For calls forwarded from NWd, the SPMC will return | -| | the pending notifications if the receiver had its | -| | bitmap created, and has pending notifications. | -| | If Hypervisor or OS kernel are compromised, the | -| | SPMC won't be able to mitigate calls from rogue NWd| -| | endpoints. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 17 | -+========================+====================================================+ -| ``Threat`` | **A malicious partition endpoint might attempt to | -| | get the information about pending notifications, | -| | through the FFA_NOTIFICATION_INFO_GET call.** | -| | This call is meant to be used by the NWd FF-A | -| | driver. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Information disclosure | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium(3) | Medium(3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium(6) | Medium(6) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this by returning error to | -| | calls made by SPs to FFA_NOTIFICATION_INFO_GET. | -| | If Hypervisor or OS kernel are compromised, the | -| | SPMC won't be able mitigate calls from rogue NWd | -| | endpoints. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 18 | -+========================+====================================================+ -| ``Threat`` | **A malicious partition endpoint might attempt to | -| | flood another partition endpoint with notifications| -| | hindering its operation.** | -| | The intent of the malicious endpoint could be to | -| | interfere with both the receiver's and/or primary | -| | endpoint execution, as they can both be preempted | -| | by the NPI and SRI, respectively. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state, CPU cycles | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | DoS | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium(3) | Medium(3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium(6) | Medium(6) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. | -| | However, the impact is limited due to the | -| | architecture: | -| | - Notifications are not queued, one that has been | -| | signaled needs to be retrieved by the receiver, | -| | until it can be sent again. | -| | - Both SRI and NPI can't be pended until handled | -| | which limits the amount of spurious interrupts. | -| | - A given receiver could only bind a maximum number| -| | of notifications to a given sender, within a given | -| | execution context. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 19 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint may abuse FFA_RUN call to | -| | resume or turn on other endpoint execution | -| | contexts, attempting to alter the internal state of| -| | SPMC and SPs, potentially leading to illegal state | -| | transitions and deadlocks.** | -| | An endpoint can call into another endpoint | -| | execution context using FFA_MSG_SEND_DIRECT_REQ | -| | ABI to create a call chain. A malicious endpoint | -| | could abuse this to form loops in a call chain that| -| | could lead to potential deadlocks. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, SPMD | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state, Scheduling cycles | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering, Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC provides mitigation against such | -| | threats by following the guidance for partition | -| | runtime models as described in FF-A v1.1 EAC0 spec.| -| | The SPMC performs numerous checks in runtime to | -| | prevent illegal state transitions by adhering to | -| | the partition runtime model. Further, if the | -| | receiver endpoint is a predecessor of current | -| | endpoint in the present call chain, the SPMC denies| -| | any attempts to form loops by returning FFA_DENIED | -| | error code. Only the primary scheduler is allowed | -| | to turn on execution contexts of other partitions | -| | though SPMC does not have the ability to | -| | scrutinize its identity. Secure partitions have | -| | limited ability to resume execution contexts of | -| | other partitions based on the runtime model. Such | -| | attempts cannot compromise the integrity of the | -| | SPMC. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 20 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint can perform a | -| | denial-of-service attack by using FFA_INTERRUPT | -| | call that could attempt to cause the system to | -| | crash or enter into an unknown state as no physical| -| | interrupt could be pending for it to be handled in | -| | the SPMC.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF5 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, SPMD | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state, Scheduling cycles | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering, Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC provides mitigation against such | -| | attack by detecting invocations from partitions | -| | and simply returning FFA_ERROR status interface. | -| | SPMC only allows SPMD to use FFA_INTERRUPT ABI to | -| | communicate a pending secure interrupt triggered | -| | while execution was in normal world. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 21 | -+========================+====================================================+ -| ``Threat`` | **A malicious secure endpoint might deactivate a | -| | (virtual) secure interrupt that was not originally | -| | signaled by SPMC, thereby attempting to alter the | -| | state of the SPMC and potentially lead to system | -| | crash.** | -| | SPMC maps the virtual interrupt ids to the physical| -| | interrupt ids to keep the implementation of virtual| -| | interrupt driver simple. | -| | Similarly, a malicious secure endpoint might invoke| -| | the deactivation ABI more than once for a secure | -| | interrupt. Moreover, a malicious secure endpoint | -| | might attempt to deactivate a (virtual) secure | -| | interrupt that was signaled to another endpoint | -| | execution context by the SPMC even before secure | -| | interrupt was handled. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF5 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | At initialization, the TF-A SPMC parses the | -| | partition manifests to find the target execution | -| | context responsible for handling the various | -| | secure physical interrupts. The TF-A SPMC provides | -| | mitigation against above mentioned threats by: | -| | | -| | - Keeping track of each pending virtual interrupt | -| | signaled to an execution context of a secure | -| | secure partition. | -| | - Denying any deactivation call from SP if there is| -| | no pending physical interrupt mapped to the | -| | given virtual interrupt. | -| | - Denying any deactivation call from SP if the | -| | virtual interrupt has not been signaled to the | -| | current execution context. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 22 | -+========================+====================================================+ -| ``Threat`` | **A malicious secure endpoint might not deactivate | -| | a virtual interrupt signaled to it by the SPMC but | -| | perform secure interrupt signal completion. This | -| | attempt to corrupt the internal state of the SPMC | -| | could lead to an unknown state and further lead to | -| | system crash.** | -| | Similarly, a malicious secure endpoint could | -| | deliberately not perform either interrupt | -| | deactivation or interrupt completion signal. Since,| -| | the SPMC can only process one secure interrupt at a| -| | time, this could choke the system where all | -| | interrupts are indefinitely masked which could | -| | potentially lead to system crash or reboot. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF5 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state, Scheduling cycles | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering, Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC does not provide mitigation against | -| | such threat. This is a limitation of the current | -| | SPMC implementation and needs to be handled in the | -| | future releases. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 23 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint could leverage non-secure | -| | interrupts to preempt a secure endpoint, thereby | -| | attempting to render it unable to handle a secure | -| | virtual interrupt targetted for it. This could lead| -| | to priority inversion as secure virtual interrupts | -| | are kept pending while non-secure interrupts are | -| | handled by normal world VMs.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF5 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, SPMD | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state, Scheduling cycles | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC alone does not provide mitigation | -| | against such threats. System integrators must take | -| | necessary high level design decisions that takes | -| | care of interrupt prioritization. The SPMC performs| -| | its role of enabling SPs to specify appropriate | -| | action towards non-secure interrupt with the help | -| | of partition manifest based on the guidance in the | -| | FF-A v1.1 EAC0 specification. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 24 | -+========================+====================================================+ -| ``Threat`` | **A secure endpoint depends on primary scheduler | -| | for CPU cycles. A malicious endpoint could delay | -| | the secure endpoint from being scheduled. Secure | -| | interrupts, if not handled timely, could compromise| -| | the state of SP and SPMC, thereby rendering the | -| | system unresponsive.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF5 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, SPMD | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state, Scheduling cycles | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC does not provide full mitigation | -| | against such threats. However, based on the | -| | guidance provided in the FF-A v1.1 EAC0 spec, SPMC | -| | provisions CPU cycles to run a secure endpoint | -| | execution context in SPMC schedule mode which | -| | cannot be preempted by a non-secure interrupt. | -| | This reduces the dependency on primary scheduler | -| | for cycle allocation. Moreover, all further | -| | interrupts are masked until pending secure virtual | -| | interrupt on current CPU is handled. This allows SP| -| | execution context to make progress even upon being | -| | interrupted. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 25 | -+========================+====================================================+ -| ``Threat`` | **A rogue FF-A endpoint can use memory sharing | -| | calls to exhaust SPMC resources.** | -| | For each on-going operation that involves an SP, | -| | the SPMC allocates resources to track its state. | -| | If the operation is never concluded, the resources | -| | are never freed. | -| | In the worst scenario, multiple operations that | -| | never conclude may exhaust the SPMC resources to a | -| | point in which renders memory sharing operations | -| | impossible. This could affect other, non-harmful | -| | FF-A endpoints, from legitimately using memory | -| | share functionality. The intent might even be | -| | to cause the SPMC to consume excessive CPU cycles, | -| | attempting to make it deny its service to the NWd. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, SPMD | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | High (4) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | High (4) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | High (16) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC uses a statically allocated pool of | -| | memory to keep track of on-going memory sharing | -| | operations. After a possible attack, this could | -| | fail due to insufficient memory, and return an | -| | error to the caller. At this point, any other | -| | endpoint that requires use of memory sharing for | -| | its operation could get itself in an unusable | -| | state. | -| | Regarding CPU cycles starving threat, the SPMC | -| | doesn't provide any mitigation for this, as any | -| | FF-A endpoint, at the virtual FF-A instance is | -| | allowed to invoke memory share/lend/donate. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 26 | -+========================+====================================================+ -| ``Threat`` | **A borrower may interfere with lender's | -| | operation, if it terminates due to a fatal error | -| | condition without releasing the memory | -| | shared/lent.** | -| | Such scenario may render the lender inoperable. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | High (4) | Low (2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | High (12) | Medium(6) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC does not provide mitigation for such | -| | scenario. The FF-A endpoints must attempt to | -| | relinquish memory shared/lent themselves in | -| | case of failure. The memory used to track the | -| | operation in the SPMC will also remain usuable. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 27 | -+========================+====================================================+ -| ``Threat`` | **A rogue FF-A endpoint may attempt to tamper with | -| | the content of the memory shared/lent, whilst | -| | being accessed by other FF-A endpoints.** | -| | It might attempt to do so: using one of the clear | -| | flags, when either retrieving or relinquishing | -| | access to the memory via the respective FF-A | -| | calls; or directly accessing memory without | -| | respecting the synchronization protocol between | -| | all involved endpoints. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, FF-A endpoint | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of Service, Tampering | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Low (2) | Low (2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (6) | Medium(6) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The first case defined in the threat, the TF-A | -| | SPMC mitigates it, by ensuring a memory is cleared | -| | only when all borrowers have relinquished access | -| | to the memory, in a scenario involving multiple | -| | borrowers. Also, if the receiver is granted RO, | -| | permissions, the SPMC will reject any request | -| | to clear memory on behalf of the borrower, by | -| | returning an error to the respective FF-A call. | -| | The second case defined in the threat can't be | -| | mitigated by the SPMC. It is up to the NS/S FF-A | -| | endpoints to establish a robust protocol for using | -| | the shared memory. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 28 | -+========================+====================================================+ -| ``Threat`` | **A rogue FF-A endpoint may attempt to share | -| | memory that is not in its translation regime, or | -| | attempt to specify attributes more permissive than | -| | those it possesses at a given time.** | -| | Both ways could be an attempt for escalating its | -| | privileges. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, FF-A endpoint | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of Service, Tampering | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | High (4) | Low (2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Low (2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | High (12) | Low (2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this threat by performing | -| | sanity checks to the provided memory region | -| | descriptor. | -| | For operations at the virtual FF-A instance, and | -| | once the full memory descriptor is provided, | -| | the SPMC validates that the memory is part of the | -| | caller's translation regime. The SPMC also checks | -| | that the memory attributes provided are within | -| | those the owner possesses, in terms of | -| | permissiveness. If more permissive attributes are | -| | specified, the SPMC returns an error | -| | FFA_INVALID_PARAMETERS. The permissiveness rules | -| | are enforced in any call to share/lend or donate | -| | the memory, and in retrieve requests. | -+------------------------+----------------------------------------------------+ - --------------- - -*Copyright (c) 2021-2023, Arm Limited. All rights reserved.* - -.. _Arm Firmware Framework for Arm A-profile: https://developer.arm.com/docs/den0077/latest -.. _FF-A ACS: https://github.com/ARM-software/ff-a-acs/releases - From d5be80275278f6f788c3a724253dca6479c42013 Mon Sep 17 00:00:00 2001 From: Olivier Deprez Date: Tue, 5 Sep 2023 09:48:43 +0200 Subject: [PATCH 3/3] docs(spm-mm): remove reference to SEL2 SPMC As the SEL2 SPMC design doc is migrated to Hafnium tree, remove the reference to this implementation from TF-A's SPM-MM doc. Signed-off-by: Olivier Deprez Change-Id: I1609c7d1d098420412dffc7b1309cc9c11502f8a --- docs/components/secure-partition-manager-mm.rst | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/docs/components/secure-partition-manager-mm.rst b/docs/components/secure-partition-manager-mm.rst index 4cdb96c10..d9b2b1b7c 100644 --- a/docs/components/secure-partition-manager-mm.rst +++ b/docs/components/secure-partition-manager-mm.rst @@ -4,17 +4,10 @@ Secure Partition Manager (MM) Foreword ======== -Two implementations of a Secure Partition Manager co-exist in the TF-A codebase: - -- SPM based on the FF-A specification (:ref:`Secure Partition Manager`). -- SPM based on the MM interface. - -Both implementations differ in their architectures and only one can be selected -at build time. - -This document describes the latter implementation where the Secure Partition Manager -resides at EL3 and management services run from isolated Secure Partitions at S-EL0. -The communication protocol is established through the Management Mode (MM) interface. +This document describes the implementation where the Secure Partition Manager +resides at EL3 and management services run from isolated Secure Partitions at +S-EL0. The communication protocol is established through the Management Mode +(MM) interface. Background ==========