From a9eadf7dd84d578377f2d90b58897e01898a73e8 Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Thu, 9 Nov 2023 17:14:08 +0200 Subject: [PATCH 1/8] gpu: labeler: convert private getter functions into public Signed-off-by: Tuomas Katila --- cmd/internal/labeler/labeler.go | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/cmd/internal/labeler/labeler.go b/cmd/internal/labeler/labeler.go index 08c407cd9..26dceee70 100644 --- a/cmd/internal/labeler/labeler.go +++ b/cmd/internal/labeler/labeler.go @@ -162,10 +162,10 @@ func fallback() uint64 { return getEnvVarNumber(memoryOverrideEnv) } -func (l *labeler) getMemoryAmount(gpuName string, numTiles uint64) uint64 { +func GetMemoryAmount(sysfsDrmDir, gpuName string, numTiles uint64) uint64 { reserved := getEnvVarNumber(memoryReservedEnv) - filePath := filepath.Join(l.sysfsDRMDir, gpuName, "lmem_total_bytes") + filePath := filepath.Join(sysfsDrmDir, gpuName, "lmem_total_bytes") dat, err := os.ReadFile(filePath) if err != nil { @@ -182,9 +182,9 @@ func (l *labeler) getMemoryAmount(gpuName string, numTiles uint64) uint64 { return totalPerTile*numTiles - reserved } -// getTileCount reads the tile count. -func (l *labeler) getTileCount(gpuName string) (numTiles uint64) { - filePath := filepath.Join(l.sysfsDRMDir, gpuName, "gt/gt*") +// GetTileCount reads the tile count. +func GetTileCount(sysfsDrmDir, gpuName string) (numTiles uint64) { + filePath := filepath.Join(sysfsDrmDir, gpuName, "gt/gt*") files, _ := filepath.Glob(filePath) @@ -195,9 +195,9 @@ func (l *labeler) getTileCount(gpuName string) (numTiles uint64) { return uint64(len(files)) } -// getNumaNode reads the cards numa node. -func (l *labeler) getNumaNode(gpuName string) int { - filePath := filepath.Join(l.sysfsDRMDir, gpuName, "device/numa_node") +// GetNumaNode reads the cards numa node. +func GetNumaNode(sysfsDrmDir, gpuName string) int { + filePath := filepath.Join(sysfsDrmDir, gpuName, "device/numa_node") data, err := os.ReadFile(filePath) if err != nil { @@ -288,14 +288,14 @@ func (l *labeler) createLabels() error { return errors.Wrap(err, "gpu name parsing error") } - numTiles := l.getTileCount(gpuName) + numTiles := GetTileCount(l.sysfsDRMDir, gpuName) tileCount += int(numTiles) - memoryAmount := l.getMemoryAmount(gpuName, numTiles) + memoryAmount := GetMemoryAmount(l.sysfsDRMDir, gpuName, numTiles) gpuNumList = append(gpuNumList, gpuName[4:]) // get numa node of the GPU - numaNode := l.getNumaNode(gpuName) + numaNode := GetNumaNode(l.sysfsDRMDir, gpuName) if numaNode >= 0 { // and store the gpu under that node id From 393799c34e08a5c3f5091e73d5543b551c374267 Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Fri, 10 Nov 2023 09:58:37 +0200 Subject: [PATCH 2/8] gpu: default to flat/combined mode for l0 affinity mask With tile requests, the level zero affinity mask now defaults to flat/combined mode. If ZE_FLAT_DEVICE_HIERARCHY is set to COMPOSITE in the Pod's specification, plugin will use the previous "x.y" format instead of the new "x" in the affinity mask. Signed-off-by: Tuomas Katila --- cmd/gpu_plugin/gpu_plugin.go | 42 ++-- cmd/gpu_plugin/gpu_plugin_test.go | 3 + .../rm/gpu_plugin_resource_manager.go | 99 ++++++++-- .../rm/gpu_plugin_resource_manager_test.go | 180 ++++++++++++++---- 4 files changed, 263 insertions(+), 61 deletions(-) diff --git a/cmd/gpu_plugin/gpu_plugin.go b/cmd/gpu_plugin/gpu_plugin.go index 50ee1fab9..6f1ad4018 100644 --- a/cmd/gpu_plugin/gpu_plugin.go +++ b/cmd/gpu_plugin/gpu_plugin.go @@ -403,6 +403,29 @@ func (dp *devicePlugin) isCompatibleDevice(name string) bool { return true } +func (dp *devicePlugin) devSpecForDrmFile(drmFile string) (devSpec pluginapi.DeviceSpec, devPath string, err error) { + if dp.controlDeviceReg.MatchString(drmFile) { + //Skipping possible drm control node + err = os.ErrInvalid + + return + } + + devPath = path.Join(dp.devfsDir, drmFile) + if _, err = os.Stat(devPath); err != nil { + return + } + + // even querying metrics requires device to be writable + devSpec = pluginapi.DeviceSpec{ + HostPath: devPath, + ContainerPath: devPath, + Permissions: "rw", + } + + return +} + func (dp *devicePlugin) scan() (dpapi.DeviceTree, error) { files, err := os.ReadDir(dp.sysfsDir) if err != nil { @@ -413,6 +436,7 @@ func (dp *devicePlugin) scan() (dpapi.DeviceTree, error) { devTree := dpapi.NewDeviceTree() rmDevInfos := rm.NewDeviceInfoMap() + tileCounts := []uint64{} for _, f := range files { var nodes []pluginapi.DeviceSpec @@ -429,25 +453,14 @@ func (dp *devicePlugin) scan() (dpapi.DeviceTree, error) { } isPFwithVFs := pluginutils.IsSriovPFwithVFs(path.Join(dp.sysfsDir, f.Name())) + tileCounts = append(tileCounts, labeler.GetTileCount(dp.sysfsDir, f.Name())) for _, drmFile := range drmFiles { - if dp.controlDeviceReg.MatchString(drmFile.Name()) { - //Skipping possible drm control node + devSpec, devPath, devSpecErr := dp.devSpecForDrmFile(drmFile.Name()) + if devSpecErr != nil { continue } - devPath := path.Join(dp.devfsDir, drmFile.Name()) - if _, err := os.Stat(devPath); err != nil { - continue - } - - // even querying metrics requires device to be writable - devSpec := pluginapi.DeviceSpec{ - HostPath: devPath, - ContainerPath: devPath, - Permissions: "rw", - } - if !isPFwithVFs { klog.V(4).Infof("Adding %s to GPU %s", devPath, f.Name()) @@ -487,6 +500,7 @@ func (dp *devicePlugin) scan() (dpapi.DeviceTree, error) { if dp.resMan != nil { dp.resMan.SetDevInfos(rmDevInfos) + dp.resMan.SetTileCountPerCard(tileCounts) } return devTree, nil diff --git a/cmd/gpu_plugin/gpu_plugin_test.go b/cmd/gpu_plugin/gpu_plugin_test.go index 707eee438..0277a089f 100644 --- a/cmd/gpu_plugin/gpu_plugin_test.go +++ b/cmd/gpu_plugin/gpu_plugin_test.go @@ -61,6 +61,9 @@ func (m *mockResourceManager) GetPreferredFractionalAllocation(*v1beta1.Preferre return &v1beta1.PreferredAllocationResponse{}, &dpapi.UseDefaultMethodError{} } +func (m *mockResourceManager) SetTileCountPerCard(counts []uint64) { +} + func createTestFiles(root string, devfsdirs, sysfsdirs []string, sysfsfiles map[string][]byte) (string, string, error) { sysfs := path.Join(root, "sys") devfs := path.Join(root, "dev") diff --git a/cmd/gpu_plugin/rm/gpu_plugin_resource_manager.go b/cmd/gpu_plugin/rm/gpu_plugin_resource_manager.go index 56ed3d3fd..265fabdd6 100644 --- a/cmd/gpu_plugin/rm/gpu_plugin_resource_manager.go +++ b/cmd/gpu_plugin/rm/gpu_plugin_resource_manager.go @@ -25,6 +25,7 @@ import ( "net" "net/http" "os" + "slices" "sort" "strconv" "strings" @@ -43,7 +44,7 @@ import ( pluginapi "k8s.io/kubelet/pkg/apis/deviceplugin/v1beta1" podresourcesv1 "k8s.io/kubelet/pkg/apis/podresources/v1" "k8s.io/kubernetes/pkg/kubelet/apis/podresources" - "k8s.io/utils/strings/slices" + sslices "k8s.io/utils/strings/slices" ) const ( @@ -52,6 +53,11 @@ const ( gasTileAnnotation = "gas-container-tiles" levelZeroAffinityMaskEnvVar = "ZE_AFFINITY_MASK" + levelZeroHierarchyEnvVar = "ZE_FLAT_DEVICE_HIERARCHY" + + hierarchyModeComposite = "COMPOSITE" + hierarchyModeFlat = "FLAT" + hierarchyModeCombined = "COMBINED" grpcAddress = "unix:///var/lib/kubelet/pod-resources/kubelet.sock" grpcBufferSize = 4 * 1024 * 1024 @@ -99,6 +105,7 @@ type ResourceManager interface { CreateFractionalResourceResponse(*pluginapi.AllocateRequest) (*pluginapi.AllocateResponse, error) GetPreferredFractionalAllocation(*pluginapi.PreferredAllocationRequest) (*pluginapi.PreferredAllocationResponse, error) SetDevInfos(DeviceInfoMap) + SetTileCountPerCard(counts []uint64) } type containerAssignments struct { @@ -124,6 +131,7 @@ type resourceManager struct { mutex sync.RWMutex // for devTree updates during scan cleanupMutex sync.RWMutex // for assignment details during cleanup useKubelet bool + tileCountPerCard uint64 } // NewDeviceInfo creates a new DeviceInfo. @@ -365,7 +373,7 @@ func (rm *resourceManager) listPodsOnNodeWithStates(states []string) map[string] for i := range podList.Items { phase := string(podList.Items[i].Status.Phase) - if slices.Contains(states, phase) { + if sslices.Contains(states, phase) { key := getPodKey(&podList.Items[i]) pods[key] = &podList.Items[i] } @@ -470,7 +478,7 @@ func (rm *resourceManager) GetPreferredFractionalAllocation(request *pluginapi.P pod := podCandidate.pod containerIndex := podCandidate.allocatedContainerCount cards := containerCards(pod, containerIndex) - affinityMask := containerTileAffinityMask(pod, containerIndex) + affinityMask := containerTileAffinityMask(pod, containerIndex, int(rm.tileCountPerCard)) podKey := getPodKey(pod) creq := request.ContainerRequests[0] @@ -743,6 +751,25 @@ func (rm *resourceManager) SetDevInfos(deviceInfos DeviceInfoMap) { rm.deviceInfos = deviceInfos } +func (rm *resourceManager) SetTileCountPerCard(counts []uint64) { + if len(counts) == 0 { + return + } + + minCount := slices.Min(counts) + maxCount := slices.Max(counts) + + if minCount != maxCount { + klog.Warning("Node's GPUs are heterogenous (min: %d, max: %d tiles)", minCount, maxCount) + + return + } + + rm.mutex.Lock() + defer rm.mutex.Unlock() + rm.tileCountPerCard = maxCount +} + func (rm *resourceManager) createAllocateResponse(deviceIds []string, tileAffinityMask string) (*pluginapi.AllocateResponse, error) { rm.mutex.Lock() defer rm.mutex.Unlock() @@ -835,7 +862,40 @@ func containerCards(pod *v1.Pod, gpuUsingContainerIndex int) []string { return nil } -func convertTileInfoToEnvMask(tileInfo string) string { +// Guesses level zero hierarchy mode for the container. Defaults to the new "flat" mode +// if no mode is set in the container's env variables. +func guessLevelZeroHierarchyMode(pod *v1.Pod, containerIndex int) string { + klog.V(4).Infof("Checking pod %s envs", pod.Name) + + if containerIndex < len(pod.Spec.Containers) { + c := pod.Spec.Containers[containerIndex] + + if c.Env != nil { + for _, env := range c.Env { + if env.Name == levelZeroHierarchyEnvVar { + switch env.Value { + // Check that the value is valid. + case hierarchyModeComposite: + fallthrough + case hierarchyModeFlat: + fallthrough + case hierarchyModeCombined: + klog.V(4).Infof("Returning %s hierarchy", env.Value) + return env.Value + } + + break + } + } + } + } + + klog.V(4).Infof("Returning default %s hierarchy", hierarchyModeFlat) + + return hierarchyModeFlat +} + +func convertTileInfoToEnvMask(tileInfo string, tilesPerCard int, hierarchyMode string) string { cards := strings.Split(tileInfo, ",") tileIndices := make([]string, len(cards)) @@ -849,7 +909,7 @@ func convertTileInfoToEnvMask(tileInfo string) string { tiles := strings.Split(cardTileSplit[1], "+") - var combos []string + var maskItems []string for _, tile := range tiles { if !strings.HasPrefix(tile, "gt") { @@ -865,13 +925,22 @@ func convertTileInfoToEnvMask(tileInfo string) string { return "" } - levelZeroCardTileCombo := - strconv.FormatInt(int64(i), 10) + "." + - strconv.FormatInt(tileNo, 10) - combos = append(combos, levelZeroCardTileCombo) + maskItem := "" + if hierarchyMode == hierarchyModeComposite { + maskItem = + strconv.FormatInt(int64(i), 10) + "." + + strconv.FormatInt(tileNo, 10) + } else { + // This handles both FLAT and COMBINED hierarchy. + devIndex := i*tilesPerCard + int(tileNo) + + maskItem = strconv.FormatInt(int64(devIndex), 10) + } + + maskItems = append(maskItems, maskItem) } - tileIndices[i] = strings.Join(combos, ",") + tileIndices[i] = strings.Join(maskItems, ",") } return strings.Join(tileIndices, ",") @@ -880,13 +949,15 @@ func convertTileInfoToEnvMask(tileInfo string) string { // containerTiles returns the tile indices to use for a single container. // Indices should be passed to level zero env variable to guide execution // gpuUsingContainerIndex 0 == first gpu-using container in the pod. +// The affinity mask is not needed for 1-tile GPUs. With 1-tile GPUs normal +// GPU exposing is enough to limit container's access to targeted devices. // annotation example: // gas-container-tiles=card0:gt0+gt1,card1:gt0|card2:gt1+gt2||card0:gt3. -func containerTileAffinityMask(pod *v1.Pod, gpuUsingContainerIndex int) string { +func containerTileAffinityMask(pod *v1.Pod, gpuUsingContainerIndex, tilesPerCard int) string { fullAnnotation := pod.Annotations[gasTileAnnotation] onlyDividers := strings.Count(fullAnnotation, "|") == len(fullAnnotation) - if fullAnnotation == "" || onlyDividers { + if fullAnnotation == "" || onlyDividers || tilesPerCard <= 1 { return "" } @@ -895,13 +966,13 @@ func containerTileAffinityMask(pod *v1.Pod, gpuUsingContainerIndex int) string { i := 0 - for _, containerTileInfo := range tileLists { + for containerIndex, containerTileInfo := range tileLists { if len(containerTileInfo) == 0 { continue } if i == gpuUsingContainerIndex { - return convertTileInfoToEnvMask(containerTileInfo) + return convertTileInfoToEnvMask(containerTileInfo, tilesPerCard, guessLevelZeroHierarchyMode(pod, containerIndex)) } i++ diff --git a/cmd/gpu_plugin/rm/gpu_plugin_resource_manager_test.go b/cmd/gpu_plugin/rm/gpu_plugin_resource_manager_test.go index 6f53d4455..ae8038da3 100644 --- a/cmd/gpu_plugin/rm/gpu_plugin_resource_manager_test.go +++ b/cmd/gpu_plugin/rm/gpu_plugin_resource_manager_test.go @@ -419,6 +419,8 @@ func TestCreateFractionalResourceResponse(t *testing.T) { for _, tCase := range testCases { rm := newMockResourceManager(tCase.pods) + rm.SetTileCountPerCard([]uint64{1}) + _, perr := rm.GetPreferredFractionalAllocation(&v1beta1.PreferredAllocationRequest{ ContainerRequests: tCase.prefContainerRequests, }) @@ -468,6 +470,12 @@ func TestCreateFractionalResourceResponseWithOneCardTwoTiles(t *testing.T) { "gpu.intel.com/i915": resource.MustParse("1"), }, }, + Env: []v1.EnvVar{ + { + Name: levelZeroHierarchyEnvVar, + Value: hierarchyModeComposite, + }, + }, }, }, }, @@ -493,6 +501,7 @@ func TestCreateFractionalResourceResponseWithOneCardTwoTiles(t *testing.T) { } rm := newMockResourceManager(tCase.pods) + rm.SetTileCountPerCard([]uint64{2}) _, perr := rm.GetPreferredFractionalAllocation(&v1beta1.PreferredAllocationRequest{ ContainerRequests: tCase.prefContainerRequests, @@ -534,6 +543,12 @@ func TestCreateFractionalResourceResponseWithTwoCardsOneTile(t *testing.T) { "gpu.intel.com/i915": resource.MustParse("2"), }, }, + Env: []v1.EnvVar{ + { + Name: levelZeroHierarchyEnvVar, + Value: hierarchyModeComposite, + }, + }, }, }, }, @@ -559,6 +574,7 @@ func TestCreateFractionalResourceResponseWithTwoCardsOneTile(t *testing.T) { } rm := newMockResourceManager(tCase.pods) + rm.SetTileCountPerCard([]uint64{5}) _, perr := rm.GetPreferredFractionalAllocation(&v1beta1.PreferredAllocationRequest{ ContainerRequests: tCase.prefContainerRequests, @@ -605,6 +621,12 @@ func TestCreateFractionalResourceResponseWithThreeCardsTwoTiles(t *testing.T) { "gpu.intel.com/i915": resource.MustParse("3"), }, }, + Env: []v1.EnvVar{ + { + Name: levelZeroHierarchyEnvVar, + Value: hierarchyModeComposite, + }, + }, }, }, }, @@ -630,6 +652,7 @@ func TestCreateFractionalResourceResponseWithThreeCardsTwoTiles(t *testing.T) { } rm := newMockResourceManager(tCase.pods) + rm.SetTileCountPerCard([]uint64{5}) _, perr := rm.GetPreferredFractionalAllocation(&v1beta1.PreferredAllocationRequest{ ContainerRequests: tCase.prefContainerRequests, @@ -676,6 +699,12 @@ func TestCreateFractionalResourceResponseWithMultipleContainersTileEach(t *testi "gpu.intel.com/i915": resource.MustParse("1"), }, }, + Env: []v1.EnvVar{ + { + Name: levelZeroHierarchyEnvVar, + Value: hierarchyModeComposite, + }, + }, }, { Resources: v1.ResourceRequirements{ @@ -683,6 +712,12 @@ func TestCreateFractionalResourceResponseWithMultipleContainersTileEach(t *testi "gpu.intel.com/i915": resource.MustParse("1"), }, }, + Env: []v1.EnvVar{ + { + Name: levelZeroHierarchyEnvVar, + Value: hierarchyModeComposite, + }, + }, }, }, }, @@ -712,6 +747,7 @@ func TestCreateFractionalResourceResponseWithMultipleContainersTileEach(t *testi } rm := newMockResourceManager(tCase.pods) + rm.SetTileCountPerCard([]uint64{2}) _, perr := rm.GetPreferredFractionalAllocation(&v1beta1.PreferredAllocationRequest{ ContainerRequests: properPrefContainerRequests, @@ -738,26 +774,77 @@ func TestCreateFractionalResourceResponseWithMultipleContainersTileEach(t *testi func TestTileAnnotationParsing(t *testing.T) { type parseTest struct { - line string - result string - index int + line string + result string + hierarchys []string + index int + tilesPerCard int } parseTests := []parseTest{ { - line: "card1:gt1", - index: 0, - result: "0.1", + line: "card1:gt1", + index: 0, + result: "0.1", + hierarchys: []string{"COMPOSITE"}, + tilesPerCard: 2, }, { - line: "card1:gt1+gt2", - index: 0, - result: "0.1,0.2", + line: "card1:gt0", + index: 0, + result: "", + hierarchys: []string{"COMPOSITE"}, + tilesPerCard: 1, }, { - line: "card1:gt1+gt2,card2:gt0", - index: 0, - result: "0.1,0.2,1.0", + line: "card1:gt1+gt2", + index: 0, + result: "0.1,0.2", + hierarchys: []string{"COMPOSITE"}, + tilesPerCard: 3, + }, + // Invalid hierarchy defaults to FLAT + { + line: "card1:gt1+gt2,card2:gt0", + index: 0, + result: "1,2,3", + hierarchys: []string{"FOOBAR"}, + tilesPerCard: 3, + }, + { + line: "card1:gt1+gt2,card2:gt0", + index: 0, + result: "1,2,3", + hierarchys: []string{"FLAT"}, + tilesPerCard: 3, + }, + { + line: "||card1:gt1+gt2,card2:gt0", + index: 0, + result: "1,2,3", + hierarchys: []string{"", "", "FLAT"}, + tilesPerCard: 3, + }, + { + line: "||||card1:gt3,card5:gt1", + index: 0, + result: "3,9", + hierarchys: []string{"", "", "", "", "FLAT"}, + tilesPerCard: 8, + }, + { + line: "card1:gt1+gt2,card2:gt1", + index: 0, + result: "1,2,4", + hierarchys: []string{"COMBINED"}, + tilesPerCard: 3, + }, + { + line: "card1:gt1,card2:gt1", + index: 0, + result: "1,3", + hierarchys: []string{"COMBINED"}, + tilesPerCard: 2, }, { line: "card1:gt1", @@ -765,24 +852,31 @@ func TestTileAnnotationParsing(t *testing.T) { result: "", }, { - line: "card1:gt1|card2:gt4", - index: 1, - result: "0.4", + line: "card1:gt1|card2:gt4", + index: 1, + result: "4", + tilesPerCard: 5, }, { - line: "card1:gt1|card2:gt4,card3:gt2", - index: 1, - result: "0.4,1.2", + line: "card1:gt1|card2:gt4,card3:gt2", + index: 1, + result: "0.4,1.2", + hierarchys: []string{"COMPOSITE", "COMPOSITE"}, + tilesPerCard: 5, }, { - line: "card1:gt1|card2:gt4,card3:gt2|card5:gt0", - index: 2, - result: "0.0", + line: "card1:gt1|card2:gt4,card3:gt2|card5:gt0", + index: 2, + result: "0.0", + hierarchys: []string{"COMPOSITE", "COMPOSITE", "COMPOSITE"}, + tilesPerCard: 5, }, { - line: "||card5:gt0,card6:gt4||", - index: 0, - result: "0.0,1.4", + line: "||card5:gt0,card6:gt4||", + index: 0, + result: "0.0,1.4", + hierarchys: []string{"", "", "COMPOSITE"}, + tilesPerCard: 5, }, { line: "||card5:gt0,card6:gt4||", @@ -815,14 +909,18 @@ func TestTileAnnotationParsing(t *testing.T) { result: "", }, { - line: "card1:gt1||card2:gt4,card3:gt2", - index: 1, - result: "0.4,1.2", + line: "card1:gt1||card2:gt4,card3:gt2", + index: 1, + result: "0.4,1.2", + hierarchys: []string{"", "", "COMPOSITE"}, + tilesPerCard: 6, }, { - line: "|||card2:gt7", - index: 0, - result: "0.7", + line: "|||card2:gt7", + index: 0, + result: "0.7", + hierarchys: []string{"", "", "", "COMPOSITE"}, + tilesPerCard: 8, }, { line: "card5", @@ -831,7 +929,7 @@ func TestTileAnnotationParsing(t *testing.T) { }, } - for _, pt := range parseTests { + for testIndex, pt := range parseTests { pod := v1.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ @@ -839,9 +937,25 @@ func TestTileAnnotationParsing(t *testing.T) { }, } - ret := containerTileAffinityMask(&pod, pt.index) + if pt.hierarchys != nil { + // Create enough containers + pod.Spec.Containers = make([]v1.Container, 10) + + for i := range pod.Spec.Containers { + if i < len(pt.hierarchys) { + pod.Spec.Containers[i].Env = []v1.EnvVar{ + { + Name: levelZeroHierarchyEnvVar, + Value: pt.hierarchys[i], + }, + } + } + } + } + + ret := containerTileAffinityMask(&pod, pt.index, max(1, pt.tilesPerCard)) - expectTruef(ret == pt.result, t, pt.line, "resulting mask is wrong. correct: %v, got: %v", pt.result, ret) + expectTruef(ret == pt.result, t, pt.line, "resulting mask is wrong (test index=%d). correct: %v, got: %v", testIndex, pt.result, ret) } } From b89660907e03cfa229d07e8a13fffdd70d2e6dd6 Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Mon, 20 Nov 2023 14:45:45 +0200 Subject: [PATCH 3/8] gpu: restructure readme Split readme into smaller chunks, show only one "easy installation" and hide the rest. Add some notes about tile resources. Co-authored-by: Eero Tamminen Signed-off-by: Tuomas Katila --- cmd/gpu_plugin/README.md | 234 ++++++----------------------- cmd/gpu_plugin/advanced-install.md | 24 +++ cmd/gpu_plugin/driver-firmware.md | 80 ++++++++++ cmd/gpu_plugin/fractional.md | 64 ++++++++ cmd/gpu_plugin/usage-scenarios.png | Bin 0 -> 90247 bytes 5 files changed, 212 insertions(+), 190 deletions(-) create mode 100644 cmd/gpu_plugin/advanced-install.md create mode 100644 cmd/gpu_plugin/driver-firmware.md create mode 100644 cmd/gpu_plugin/fractional.md create mode 100644 cmd/gpu_plugin/usage-scenarios.png diff --git a/cmd/gpu_plugin/README.md b/cmd/gpu_plugin/README.md index 8eb4cc332..2e5c34ecb 100644 --- a/cmd/gpu_plugin/README.md +++ b/cmd/gpu_plugin/README.md @@ -5,30 +5,20 @@ Table of Contents * [Introduction](#introduction) * [Modes and Configuration Options](#modes-and-configuration-options) * [Operation modes for different workload types](#operation-modes-for-different-workload-types) +* [Installing driver and firmware for Intel GPUs](#installing-driver-and-firmware-for-intel-gpus) +* [Pre-built Images](#pre-built-images) * [Installation](#installation) - * [Prerequisites](#prerequisites) - * [Drivers for discrete GPUs](#drivers-for-discrete-gpus) - * [Kernel driver](#kernel-driver) - * [Intel DKMS packages](#intel-dkms-packages) - * [Upstream kernel](#upstream-kernel) - * [GPU Version](#gpu-version) - * [GPU Firmware](#gpu-firmware) - * [User-space drivers](#user-space-drivers) - * [Drivers for older (integrated) GPUs](#drivers-for-older-integrated-gpus) - * [Pre-built Images](#pre-built-images) - * [Install to all nodes](#install-to-all-nodes) - * [Install to nodes with Intel GPUs with NFD](#install-to-nodes-with-intel-gpus-with-nfd) - * [Install to nodes with NFD, Monitoring and Shared-dev](#install-to-nodes-with-nfd-monitoring-and-shared-dev) - * [Install to nodes with Intel GPUs with Fractional resources](#install-to-nodes-with-intel-gpus-with-fractional-resources) - * [Fractional resources details](#fractional-resources-details) + * [Install with NFD](#install-with-nfd) + * [Install with Operator](#install-with-operator) * [Verify Plugin Registration](#verify-plugin-registration) * [Testing and Demos](#testing-and-demos) -* [Labels created by GPU plugin](#labels-created-by-gpu-plugin) -* [SR-IOV use with the plugin](#sr-iov-use-with-the-plugin) -* [Issues with media workloads on multi-GPU setups](#issues-with-media-workloads-on-multi-gpu-setups) +* [Notes](#notes) + * [Running GPU plugin as non-root](#running-gpu-plugin-as-non-root) + * [Labels created by GPU plugin](#labels-created-by-gpu-plugin) + * [SR-IOV use with the plugin](#sr-iov-use-with-the-plugin) + * [Issues with media workloads on multi-GPU setups](#issues-with-media-workloads-on-multi-gpu-setups) * [Workaround for QSV and VA-API](#workaround-for-qsv-and-va-api) - ## Introduction Intel GPU plugin facilitates Kubernetes workload offloading by providing access to @@ -51,7 +41,7 @@ backend libraries can offload compute operations to GPU. | Flag | Argument | Default | Meaning | |:---- |:-------- |:------- |:------- | | -enable-monitoring | - | disabled | Enable 'i915_monitoring' resource that provides access to all Intel GPU devices on the node | -| -resource-manager | - | disabled | Enable fractional resource management, [see also dependencies](#fractional-resources) | +| -resource-manager | - | disabled | Enable fractional resource management, [see use](./fractional.md) | | -shared-dev-num | int | 1 | Number of containers that can share the same GPU device | | -allocation-policy | string | none | 3 possible values: balanced, packed, none. For shared-dev-num > 1: _balanced_ mode spreads workloads among GPU devices, _packed_ mode fills one GPU fully before moving to next, and _none_ selects first available device from kubelet. Default is _none_. Allocation policy does not have an effect when resource manager is enabled. | @@ -60,104 +50,23 @@ Please use the -h option to see the complete list of logging related options. ## Operation modes for different workload types + + Intel GPU-plugin supports a few different operation modes. Depending on the workloads the cluster is running, some modes make more sense than others. Below is a table that explains the differences between the modes and suggests workload types for each mode. Mode selection applies to the whole GPU plugin deployment, so it is a cluster wide decision. | Mode | Sharing | Intended workloads | Suitable for time critical workloads | |:---- |:-------- |:------- |:------- | | shared-dev-num == 1 | No, 1 container per GPU | Workloads using all GPU capacity, e.g. AI training | Yes | | shared-dev-num > 1 | Yes, >1 containers per GPU | (Batch) workloads using only part of GPU resources, e.g. inference, media transcode/analytics, or CPU bound GPU workloads | No | -| shared-dev-num > 1 && resource-management | Yes and no, 1>= containers per GPU | Any. For best results, all workloads should declare their expected GPU resource usage (memory, millicores). Requires [GAS](https://github.com/intel/platform-aware-scheduling/tree/master/gpu-aware-scheduling). See also [fractional use](#fractional-resources-details) | Yes. 1000 millicores = exclusive GPU usage. See note below. | +| shared-dev-num > 1 && resource-management | Depends on resource requests | Any. For requirements and usage, see [fractional resource management](./fractional.md) | Yes. 1000 millicores = exclusive GPU usage. See note below. | > **Note**: Exclusive GPU usage with >=1000 millicores requires that also *all other GPU containers* specify (non-zero) millicores resource usage. -## Installation - -The following sections detail how to obtain, build, deploy and test the GPU device plugin. - -Examples are provided showing how to deploy the plugin either using a DaemonSet or by hand on a per-node basis. - -### Prerequisites - -Access to a GPU device requires firmware, kernel and user-space -drivers supporting it. Firmware and kernel driver need to be on the -host, user-space drivers in the GPU workload containers. - -Intel GPU devices supported by the current kernel can be listed with: -``` -$ grep i915 /sys/class/drm/card?/device/uevent -/sys/class/drm/card0/device/uevent:DRIVER=i915 -/sys/class/drm/card1/device/uevent:DRIVER=i915 -``` - -#### Drivers for discrete GPUs - -> **Note**: Kernel (on host) and user-space drivers (in containers) -> should be installed from the same repository as there are some -> differences between DKMS and upstream GPU driver uAPI. - -##### Kernel driver - -###### Intel DKMS packages - -`i915` GPU driver DKMS[^dkms] package is recommended for Intel -discrete GPUs, until their support in upstream is complete. DKMS -package(s) can be installed from Intel package repositories for a -subset of older kernel versions used in enterprise / LTS -distributions: -https://dgpu-docs.intel.com/installation-guides/index.html - -[^dkms]: [intel-gpu-i915-backports](https://github.com/intel-gpu/intel-gpu-i915-backports). - -###### Upstream kernel - -Upstream Linux kernel 6.2 or newer is needed for Intel discrete GPU -support. For now, upstream kernel is still missing support for a few -of the features available in DKMS kernels (e.g. Level-Zero Sysman API -GPU error counters). +## Installing driver and firmware for Intel GPUs -##### GPU Version +In case your host's operating system lacks support for Intel GPUs, see this page for help: [Drivers for Intel GPUs](./driver-firmware.md) -PCI IDs for the Intel GPUs on given host can be listed with: -``` -$ lspci | grep -e VGA -e Display | grep Intel -88:00.0 Display controller: Intel Corporation Device 56c1 (rev 05) -8d:00.0 Display controller: Intel Corporation Device 56c1 (rev 05) -``` - -(`lspci` lists GPUs with display support as "VGA compatible controller", -and server GPUs without display support, as "Display controller".) - -Mesa "Iris" 3D driver header provides a mapping between GPU PCI IDs and their Intel brand names: -https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/include/pci_ids/iris_pci_ids.h - -###### GPU Firmware - -If your kernel build does not find the correct firmware version for -a given GPU from the host (see `dmesg | grep i915` output), latest -firmware versions are available in upstream: -https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/i915 - -##### User-space drivers - -Until new enough user-space drivers (supporting also discrete GPUs) -are available directly from distribution package repositories, they -can be installed to containers from Intel package repositories. See: -https://dgpu-docs.intel.com/installation-guides/index.html - -Example container is listed in [Testing and demos](#testing-and-demos). - -Validation status against *upstream* kernel is listed in the user-space drivers release notes: -* Media driver: https://github.com/intel/media-driver/releases -* Compute driver: https://github.com/intel/compute-runtime/releases - -#### Drivers for older (integrated) GPUs - -For the older (integrated) GPUs, new enough firmware and kernel driver -are typically included already with the host OS, and new enough -user-space drivers (for the GPU containers) are in the host OS -repositories. - -### Pre-built Images +## Pre-built Images [Pre-built images](https://hub.docker.com/r/intel/intel-gpu-plugin) of this component are available on the Docker hub. These images are automatically built and uploaded @@ -165,40 +74,21 @@ to the hub from the latest main branch of this repository. Release tagged images of the components are also available on the Docker hub, tagged with their release version numbers in the format `x.y.z`, corresponding to the branches and releases in this -repository. Thus the easiest way to deploy the plugin in your cluster is to run this command - -> **Note**: Replace `` with the desired [release tag](https://github.com/intel/intel-device-plugins-for-kubernetes/tags) or `main` to get `devel` images. - -> **Note**: Add ```--dry-run=client -o yaml``` to the ```kubectl``` commands below to visualize the yaml content being applied. +repository. See [the development guide](../../DEVEL.md) for details if you want to deploy a customized version of the plugin. -#### Install to all nodes - -Simplest option to enable use of Intel GPUs in Kubernetes Pods. - -```bash -$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin?ref=' -``` - -#### Install to nodes with Intel GPUs with NFD - -Deploying GPU plugin to only nodes that have Intel GPU attached. [Node Feature Discovery](https://github.com/kubernetes-sigs/node-feature-discovery) is required to detect the presence of Intel GPUs. +## Installation -```bash -# Start NFD - if your cluster doesn't have NFD installed yet -$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd?ref=' +There are multiple ways to install Intel GPU plugin to a cluster. The most common methods are described below. For alternative methods, see [advanced install](./advanced-install.md) page. -# Create NodeFeatureRules for detecting GPUs on nodes -$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd/overlays/node-feature-rules?ref=' +> **Note**: Replace `` with the desired [release tag](https://github.com/intel/intel-device-plugins-for-kubernetes/tags) or `main` to get `devel` images. -# Create GPU plugin daemonset -$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin/overlays/nfd_labeled_nodes?ref=' -``` +> **Note**: Add ```--dry-run=client -o yaml``` to the ```kubectl``` commands below to visualize the yaml content being applied. -#### Install to nodes with NFD, Monitoring and Shared-dev +### Install with NFD -Same as above, but configures GPU plugin with logging, [monitoring and shared-dev](#modes-and-configuration-options) features enabled. This option is useful when there is a desire to retrieve GPU metrics from nodes. For example with [XPU-Manager](https://github.com/intel/xpumanager/) or [collectd](https://github.com/collectd/collectd/tree/collectd-6.0). +Deploy GPU plugin with the help of NFD ([Node Feature Discovery](https://github.com/kubernetes-sigs/node-feature-discovery)). It detects the presence of Intel GPUs and labels them accordingly. GPU plugin's node selector is used to deploy plugin to nodes which have such a GPU label. ```bash # Start NFD - if your cluster doesn't have NFD installed yet @@ -208,66 +98,20 @@ $ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes $ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd/overlays/node-feature-rules?ref=' # Create GPU plugin daemonset -$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin/overlays/monitoring_shared-dev_nfd/?ref=' +$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin/overlays/nfd_labeled_nodes?ref=' ``` -#### Install to nodes with Intel GPUs with Fractional resources - -With the experimental fractional resource feature you can use additional kubernetes extended -resources, such as GPU memory, which can then be consumed by deployments. PODs will then only -deploy to nodes where there are sufficient amounts of the extended resources for the containers. +### Install with Operator -(For this to work properly, all GPUs in a given node should provide equal amount of resources -i.e. heteregenous GPU nodes are not supported.) +GPU plugin can be installed with the Intel Device Plugin Operator. It allows configuring GPU plugin's parameters without kustomizing the deployment files. The general installation is described in the [install documentation](../operator/README.md#installation). For configuring the GPU Custom Resource (CR), see the [configuration options](#modes-and-configuration-options) and [operation modes](#operation-modes-for-different-workload-types). -Enabling the fractional resource feature isn't quite as simple as just enabling the related -command line flag. The DaemonSet needs additional RBAC-permissions -and access to the kubelet podresources gRPC service, plus there are other dependencies to -take care of, which are explained below. For the RBAC-permissions, gRPC service access and -the flag enabling, it is recommended to use kustomization by running: +### Install alongside with GPU Aware Scheduling -```bash -# Start NFD - if your cluster doesn't have NFD installed yet -$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd?ref=' - -# Create NodeFeatureRules for detecting GPUs on nodes -$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd/overlays/node-feature-rules?ref=' - -# Create GPU plugin daemonset -$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin/overlays/fractional_resources?ref=' -``` +GPU plugin can be installed alongside with GPU Aware Scheduling (GAS). It allows scheduling Pods which e.g. request only partial use of a GPU. The installation is described in [fractional resources](./fractional.md) page. -##### Fractional resources details - -Usage of these fractional GPU resources requires that the cluster has node -extended resources with the name prefix `gpu.intel.com/`. Those can be created with NFD -by running the [hook](/cmd/gpu_nfdhook/) installed by the plugin initcontainer. When fractional resources are -enabled, the plugin lets a [scheduler extender](https://github.com/intel/platform-aware-scheduling/tree/master/gpu-aware-scheduling) -do card selection decisions based on resource availability and the amount of extended -resources requested in the [pod spec](https://github.com/intel/platform-aware-scheduling/blob/master/gpu-aware-scheduling/docs/usage.md#pods). - -The scheduler extender then needs to annotate the pod objects with unique -increasing numeric timestamps in the annotation `gas-ts` and container card selections in -`gas-container-cards` annotation. The latter has container separator '`|`' and card separator -'`,`'. Example for a pod with two containers and both containers getting two cards: -`gas-container-cards:card0,card1|card2,card3`. Enabling the fractional-resource support -in the plugin without running such an annotation adding scheduler extender in the cluster -will only slow down GPU-deployments, so do not enable this feature unnecessarily. - -In multi-tile systems, containers can request individual tiles to improve GPU resource usage. -Tiles targeted for containers are specified to pod via `gas-container-tiles` annotation where the the annotation -value describes a set of card and tile combinations. For example in a two container pod, the annotation -could be `gas-container-tiles:card0:gt0+gt1|card1:gt1,card2:gt0`. Similarly to `gas-container-cards`, the container -details are split via `|`. In the example above, the first container gets tiles 0 and 1 from card 0, -and the second container gets tile 1 from card 1 and tile 0 from card 2. - -> **Note**: It is also possible to run the GPU device plugin using a non-root user. To do this, -the nodes' DAC rules must be configured to device plugin socket creation and kubelet registration. -Furthermore, the deployments `securityContext` must be configured with appropriate `runAsUser/runAsGroup`. - -### Verify Plugin Registration +### Verify Plugin Installation -You can verify the plugin has been registered with the expected nodes by searching for the relevant +You can verify that the plugin has been installed on the expected nodes by searching for the relevant resource allocation status on the nodes: ```bash @@ -341,17 +185,27 @@ The GPU plugin functionality can be verified by deploying an [OpenCL image](../. Warning FailedScheduling default-scheduler 0/1 nodes are available: 1 Insufficient gpu.intel.com/i915. ``` -## Labels created by GPU plugin +## Notes + +### Running GPU plugin as non-root + +It is possible to run the GPU device plugin using a non-root user. To do this, +the nodes' DAC rules must be configured to device plugin socket creation and kubelet registration. +Furthermore, the deployments `securityContext` must be configured with appropriate `runAsUser/runAsGroup`. + +More info: https://kubernetes.io/blog/2021/11/09/non-root-containers-and-devices/ + +### Labels created by GPU plugin If installed with NFD and started with resource-management, plugin will export a set of labels for the node. For detailed info, see [labeling documentation](./labels.md). -## SR-IOV use with the plugin +### SR-IOV use with the plugin GPU plugin does __not__ setup SR-IOV. It has to be configured by the cluster admin. GPU plugin does however support provisioning Virtual Functions (VFs) to containers for a SR-IOV enabled GPU. When the plugin detects a GPU with SR-IOV VFs configured, it will only provision the VFs and leaves the PF device on the host. -## Issues with media workloads on multi-GPU setups +### Issues with media workloads on multi-GPU setups OneVPL media API, 3D and compute APIs provide device discovery functionality for applications and work fine in multi-GPU setups. @@ -376,7 +230,7 @@ options are documented here: * QSV: https://github.com/Intel-Media-SDK/MediaSDK/wiki/FFmpeg-QSV-Multi-GPU-Selection-on-Linux -### Workaround for QSV and VA-API +#### Workaround for QSV and VA-API [Render device](render-device.sh) shell script locates and outputs the correct device file name. It can be added to the container and used diff --git a/cmd/gpu_plugin/advanced-install.md b/cmd/gpu_plugin/advanced-install.md new file mode 100644 index 000000000..1b1d98923 --- /dev/null +++ b/cmd/gpu_plugin/advanced-install.md @@ -0,0 +1,24 @@ +# Alternative installation methods for Intel GPU plugin + +## Install to all nodes + +In case the target cluster will not have NFD (or you don't want to install it), Intel GPU plugin can be installed to all nodes. This installation method will consume little unnecessary CPU resources on nodes without Intel GPUs. + +```bash +$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin?ref=' +``` + +## Install to nodes via NFD, with Monitoring and Shared-dev + +Intel GPU plugin is installed via NFD's labels and node selector. Plugin is configured with monitoring and shared devices enabled. This option is useful when there is a desire to retrieve GPU metrics from nodes. For example with [XPU-Manager](https://github.com/intel/xpumanager/) or [collectd](https://github.com/collectd/collectd/tree/collectd-6.0). + +```bash +# Start NFD - if your cluster doesn't have NFD installed yet +$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd?ref=' + +# Create NodeFeatureRules for detecting GPUs on nodes +$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd/overlays/node-feature-rules?ref=' + +# Create GPU plugin daemonset +$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin/overlays/monitoring_shared-dev_nfd/?ref=' +``` diff --git a/cmd/gpu_plugin/driver-firmware.md b/cmd/gpu_plugin/driver-firmware.md new file mode 100644 index 000000000..1718ca97f --- /dev/null +++ b/cmd/gpu_plugin/driver-firmware.md @@ -0,0 +1,80 @@ +# Driver and firmware for Intel GPUs + +Access to a GPU device requires firmware, kernel and user-space +drivers supporting it. Firmware and kernel driver need to be on the +host, user-space drivers in the GPU workload containers. + +Intel GPU devices supported by the current kernel can be listed with: +``` +$ grep i915 /sys/class/drm/card?/device/uevent +/sys/class/drm/card0/device/uevent:DRIVER=i915 +/sys/class/drm/card1/device/uevent:DRIVER=i915 +``` + +## Drivers for discrete GPUs + +> **Note**: Kernel (on host) and user-space drivers (in containers) +> should be installed from the same repository as there are some +> differences between DKMS and upstream GPU driver uAPI. + +##### Kernel driver + +###### Intel DKMS packages + +`i915` GPU driver DKMS[^dkms] package is recommended for Intel +discrete GPUs, until their support in upstream is complete. DKMS +package(s) can be installed from Intel package repositories for a +subset of older kernel versions used in enterprise / LTS +distributions: +https://dgpu-docs.intel.com/installation-guides/index.html + +[^dkms]: [intel-gpu-i915-backports](https://github.com/intel-gpu/intel-gpu-i915-backports). + +###### Upstream kernel + +Support for first Intel discrete GPUs was added to upstream Linux kernel in v6.2, +and expanded in later versions. For now, upstream kernel is still missing support +for few of the features available in DKMS kernels, listed here: +https://dgpu-docs.intel.com/driver/kernel-driver-types.html + +##### GPU Version + +PCI IDs for the Intel GPUs on given host can be listed with: +``` +$ lspci | grep -e VGA -e Display | grep Intel +88:00.0 Display controller: Intel Corporation Device 56c1 (rev 05) +8d:00.0 Display controller: Intel Corporation Device 56c1 (rev 05) +``` + +(`lspci` lists GPUs with display support as "VGA compatible controller", +and server GPUs without display support, as "Display controller".) + +A mapping between GPU PCI IDs and their Intel brand names is available here: +https://dgpu-docs.intel.com/devices/hardware-table.html + +###### GPU Firmware + +If your kernel build does not find the correct firmware version for +a given GPU from the host (see `dmesg | grep i915` output), latest +firmware versions are available in upstream: +https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/i915 + +##### User-space drivers + +Until new enough user-space drivers (supporting also discrete GPUs) +are available directly from distribution package repositories, they +can be installed to containers from Intel package repositories. See: +https://dgpu-docs.intel.com/installation-guides/index.html + +Example container is listed in [Testing and demos](#testing-and-demos). + +Validation status against *upstream* kernel is listed in the user-space drivers release notes: +* Media driver: https://github.com/intel/media-driver/releases +* Compute driver: https://github.com/intel/compute-runtime/releases + +#### Drivers for older (integrated) GPUs + +For the older (integrated) GPUs, new enough firmware and kernel driver +are typically included already with the host OS, and new enough +user-space drivers (for the GPU containers) are in the host OS +repositories. diff --git a/cmd/gpu_plugin/fractional.md b/cmd/gpu_plugin/fractional.md new file mode 100644 index 000000000..731b636ce --- /dev/null +++ b/cmd/gpu_plugin/fractional.md @@ -0,0 +1,64 @@ +# GPU plugin with GPU Aware Scheduling + +This is an experimental feature. + +Installing the GPU plugin with [GPU Aware Scheduling](https://github.com/intel/platform-aware-scheduling/tree/master/gpu-aware-scheduling) (GAS) enables containers to request partial (fractional) GPU resources. For example, a Pod's container can request GPU's millicores or memory and use only a fraction of the GPU. The remaining resources could be leveraged by another container. + +> *NOTE*: For this use case to work properly, all GPUs in a given node should provide equal amount of resources +i.e. heterogenous GPU nodes are not supported. + +> *NOTE*: Resource values are used only for scheduling workloads to nodes, not for limiting their GPU usage on the nodes. Container requesting 50% of the GPU's resources is not restricted by the kernel driver or firmware from using more than 50% of the resources. A container requesting 1% of the GPU could use 100% of it. + +## Install GPU Aware Scheduling + +GAS' installation is described in its [README](https://github.com/intel/platform-aware-scheduling/tree/master/gpu-aware-scheduling#usage-with-nfd-and-the-gpu-plugin). + +## Install GPU plugin with fractional resources + +### With yaml deployments + +The GPU Plugin DaemonSet needs additional RBAC-permissions and access to the kubelet podresources +gRPC service to function. All the required changes are gathered in the `fractional_resources` +overlay. Install GPU plugin by running: + +```bash +# Start NFD - if your cluster doesn't have NFD installed yet +$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd?ref=' + +# Create NodeFeatureRules for detecting GPUs on nodes +$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd/overlays/node-feature-rules?ref=' + +# Create GPU plugin daemonset +$ kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin/overlays/fractional_resources?ref=' +``` + +### With Device Plugin Operator + +Install the Device Plugin Operator according to the [install](../operator/README.md#installation) instructions. When applying the [GPU plugin Custom Resource](../../deployments/operator/samples/deviceplugin_v1_gpudeviceplugin.yaml) (CR), set `resourceManager` option to `true`. The Operator will install all the required RBAC objects and service accounts. + +``` +spec: + resourceManager: true +``` + +## Details about fractional resources + +Use of fractional GPU resources requires that the cluster has node extended resources with the name prefix `gpu.intel.com/`. Those are automatically created by GPU plugin with the help of the NFD. When fractional resources are enabled, the plugin lets GAS do card selection decisions based on resource availability and the amount of extended resources requested in the [pod spec](https://github.com/intel/platform-aware-scheduling/blob/master/gpu-aware-scheduling/docs/usage.md#pods). + +GAS then annotates the pod objects with unique increasing numeric timestamps in the annotation `gas-ts` and container card selections in `gas-container-cards` annotation. The latter has container separator '`|`' and card separator '`,`'. Example for a pod with two containers and both containers getting two cards: `gas-container-cards:card0,card1|card2,card3`. + +Enabling the fractional resource support in the plugin without running GAS in the cluster will only slow down GPU-deployments, so do not enable this feature unnecessarily. + +## Tile level access and Level Zero workloads + +Level Zero library supports targeting different tiles on a GPU. If the host is equipped with multi-tile GPU devices, and the container requests both `gpu.intel.com/i915` and `gpu.intel.com/tiles` resources, GPU plugin (with GAS) adds an [affinity mask](https://spec.oneapi.io/level-zero/latest/core/PROG.html#affinity-mask) to the container. By default the mask is in "FLAT" [device hierarchy](https://spec.oneapi.io/level-zero/latest/core/PROG.html#device-hierarchy) format. With the affinity mask, two Level Zero workloads can share a two tile GPU so that workloads use one tile each. + +If a multi-tile workload is intended to work in "COMPOSITE" hierarchy mode, the container spec environment should include hierarchy mode variable (ZE_FLAT_DEVICE_HIERARCHY) with "COMPOSITE" value. GPU plugin will then adapt the affinity mask from the default "FLAT" to "COMPOSITE" format. + +If the GPU is a single tile device, GPU plugin does not set the affinity mask. Only exposing GPU devices is enough in that case. + +### Details about tile resources + +GAS makes the GPU and tile selection based on the Pod's resource specification. The selection is passed to GPU plugin via the Pod's annotation. + +Tiles targeted for containers are specified to Pod via `gas-container-tiles` annotation where the the annotation value describes a set of card and tile combinations. For example in a two container pod, the annotation could be `gas-container-tiles:card0:gt0+gt1|card1:gt1,card2:gt0`. Similarly to `gas-container-cards`, the container details are split via `|`. In the example above, the first container gets tiles 0 and 1 from card 0, and the second container gets tile 1 from card 1 and tile 0 from card 2. diff --git a/cmd/gpu_plugin/usage-scenarios.png b/cmd/gpu_plugin/usage-scenarios.png new file mode 100644 index 0000000000000000000000000000000000000000..bd4dda730bfeefa6dbe93c114c95158171821fe2 GIT binary patch literal 90247 zcmcG0Rajixw&ubKZb5=WaEIU;2$JCLZo%EHLI?zRw-5pZcXxLP?h@P!cc`wMv-dvt zKJ@K==zgH64`x-ZHRqUfjPXl_Dk(^#qr5@^008~H%sUkTK(GM-*bHP?=wGk{17e}S zUO38Vy8r-2&z~QdL?#Sk0H6Tgzk93ZX>hdS;EFewN%!cm*I1SB&CRfB^;`W*Lr2YN z4rV-0dXmdWE*TQttjYnc^U&U?UZJlg)LCe@B<7?o93y)bsGcm<%0h3?zMYx=#@!OC zafxV=h|f7j;to&m|B3rkC}V?=J9v^luTrh9Axc3LZ)NJ%YvO*Y$o@4qa(@Td<*{qI z$*;Jn$*uVW{QS^WknN8mj!YSZ_2(hRYSe}HU(f#aV3van``3T4#4V(-;r|&p5eF{rwJDoLpfP|Ga~l1>ReVzsC)X&T+9&>VvL9 zBw=@|)x_zzL|bh-Z~4Vw>R`R_e{P{s{w$tFo~_>tgeO<)@iQFmYJrv8~oS^Lbg zkVAhIo!YA~_D}zr4SQMlmQAsY0uVxHU;7eCO11)elBf#N($chd7;(r_SLezMjjEv= zac(Q&Uvn{M*;B{A+g;~KmSR#xtvNpnveMT3!HKb(P}OLj`jp>Wz~&RTp2VGS@gYdq zEcI!&Bn*d#oP89=e%$j5S5xqJTl=f@9bo*9$DTf2*P^{Q#9<(G>LxpyZ)&Q3k1=~O z(i~D$oDLTgsAx}uNe%#dS?j!qu#zD5rd0(ql7^KD!oL=FfSX9+-I@SN=wYyVbY8>j zaVo=8HtV^vk=l3PP%Ab_k8{eZceGs623Hej4k7uIha)T_@gd?6oGDgqTxCR!AGaFn zGa?3M78VLbnS$xma7wfGOV_o}Pom2NjUT)7)WE)#*IAX!-$niRA|)maiE-^TX^Y#C zimi)3tA>3bo)ipNbh@qKn9VS+diAqJ*HAwL8%Qnn4gYY~Bbb>}zc%y0b+Q{*HPmli z^q5tdfL&_mlWx)dB-VX`{!D_fa5igqd=I89w_k1@I}{T5LbTe*w2WzfTxS=(n#wo1 z>ff+Lh*>T}^BhLUGb_yQZvY~9uo6hY8qsaetz53;5&K~CV31DxO{C8BklK{(eao}n zaB~Jrsn7F%)o}mP5=I}+ewTjSd1CFAqWXiG5g)dH?b9!|$V#w8>?>c}%|7YsHVod8 zydX*d?|vxBGPC+;N!J>gsIjh2edTKLWEm0g&lYIJm#9o?cZkG<0c|OVwbOHSmiiAj zVS$&6d)FM6&*UM~JVZ>le3Oq|{&rgD2|rPAHQEQIJvVNjGs(kNLuu}fz=0tAw%(uIzpRbE$?01!P zK|(AobS#WWoD;kLegABpDGN*aN0YYitQPNwYl7`ATz}rt)IIndED5Gj!;M_f)ZTt@ zu2`!IiJbpL5O*T1tEt%RYdnMo8K2$j=fc!B@(^8~*WxEa7&O78gIN#n%_8X}%wNr2 ze+NrWB;2i3(E5D|>7R4q4rei)^o;V`fac9pUlGk_q@1yp!^z5nMwf5FlhSEkQyx*d z%vo8sJ94eNv_viM3L&n=C0+BPf|HZT<8@=vz4<2pIJvc;HA+Xd^ToA%=UILxd-U(+%! z&TO*4)hDeb#g@D!I-L}8!FjT3AeqF|dMRnG7x?T}jXQjXU$IYI_DuT)@oJWMPW1FRi=6ttQ{AHuoDyF)Bb~ zzAc+iHaLg?yf4j-tPW#gn=K`2R(SCJxQm+E_x0sNZ*%SQkd3Wif#9*|fwkb*2j15C zn6?)TWDYjg{Kladzv~E$@ilDy3RgwRfp-Bv%y<1Gmll_lUEJKH-Z7+)LPpt+yXlgJBy|$$35;6T2b&0(ZD?F`}LIQAg^M4SJ$}`EXh& zHRV}WJ$~R_TK8cjLXrmCmJso3Z^suFtN&?PPr7bfCV5t=wGwIM?#2aISExtY2b zu~Ge!Be3bUyP0Skr;ETR^ur5#9u3{9M{;RhT!x6uj#D+iS)9pQg?eCs_s_chu}cL1 z1oj;LUF`N(Tp;UQerc%SN5olKVFnuckEg<-WteWMIK?p$B^&n^6*%PBT0M}oKK-Up ze}7V9;KoPF>dB#yf|Dk?%abV*5XsLBPIVZ7BA~SD2!u~sH`arDHQWOH$~~k8QrOm0 z0$`R^mHibh`z56hX128xu8L2B0KL_7>6S6x(djVt)v-BTD(pE=^F}mwL&*+YVe18* zdLA5Pvt^a%VXbKB(Dfm!=2OzJlX9KyJ!8uvorriu|M5HIDv__g4b$sIg$_fx^k`Bj zr-+|XIWff;7!aBDelH{Dhf;tBZz9mm8Wn~(vwiu7Bo*gg6hBTBPLaN&dc`#f;T51N z1G6p*d}KrXcO4^>r5EOqiUj(#=uzw1$2wx+1LqZ+CQP|<%nA=sRw1TWk95L|M<5$7 zIdT9Efg}aZOS`tJ{vQc>0Q#GxosW+k>gq5ZoUD0*X{G*Ci0h0R_!gEoKkr69k5|(h zzeWRYH@;7n$RGjZ8wx#uuSBA%d<&?*V4mXvm##d15JQrFfPx<$Sck^Jk$7AIaZFVP zcN!_^QIa=iqARGB{6+6Q>8I$8DhIWPZD^V{P-yS}?QtVgOkhSrNX<$ILopa)D+UXa z>@<4cP(3c<@&WhLStyzYv-?|Mr2f3KGRbS`YYRR{*$)Uu+1_)S+ousN3?@0nn{2Aq zrXCV{vq|+ZXUj~UxtkqCmqPBfqFHy3SJYAscl#$aZ7Py|6$>t`#xM9!lRKXc-;Lri z4MbS3tp1Z?2eY?I?G`r=56~c@E8c7b-5OM6?|Z0o=3bjiny=h1hMJ>ZSoG?6)b}F7 z19(G2CecUkT!;-Rx0>>b1(wFl#j(616>rf}^EZ|9*P<5Lx|dt9-WHa zYb>;4t-YPFZqIN~HeqhBC=K-^altY%b7c-(SNY5|Gxj;Sv{jHJwo_mxQwAokor;~q zrE4-;dNYc6hvDa~R7X6Qql>PItaZIZ@)Cpr@36KMHO&nMntubX;)!jRe-~iFvDRnw z0|~k$|JlVoG!JA&H^ORc!Dvq<`I$3r^1OCS5gt5rBcp=E)tclf2uxMwEIbq)3G2b5 z#G1t_Qo3`VPy4$Vy77=KGE)Q)`p(+rWYSCi^m70pkj)OPgasO?q*PV803gWaO~9uO zHZ~8b_hD1%^jq4~o~Ne9Gg0Kzd~+TH9Vm1J>Pl_+m(R;G^Y_i|b#Rz6AR-?&7%>br zGv?Oyvr!eBU+~MALdijy4%a=&yPzK8NzECoG&gCi63x< z{XV~M2$xlJ%NYS4ZjEp{T1?FQsO*XV$pv}@Jcd{08c)T=u^abni#nLr8U2C+SL?if zV+Rfig!POL2exEtwI%|2?D8Y>HT6)e^8t}zWpJLW;QCaE|FY7 zE7MksuIc0Bg}>dVY5@{ciNJrKiXFetjEtBZjI(R|)XH@Y_qLF2bp=(7Rd+j`6mzy;_DJ=sT@O4)Y4 z-ub!`u~%uh1PB>623+f!uAcvA$3!<^S%D*n-mmrTT36STGt--aI)rvVX*1B%1GZnc zz+X(wg)cIdG@F+Axx<(=wF5bDFA`ajP3Y_%G-Kyu+Lt-PIo+qX!?S9L9|(b+ ztE8$FR@jBJqn zNzyod-=PR>VU%Ma05jvm^n|E&G0RC02Pt#j3dc;bO$*GgUgu^_=UU+x->MGh7 zAhZsFruyTCR4?hYZ&PjrE&h$;~8%#JIwWc{IYXEEQPIB>o;XbvKxb zagtCoz3-WPE%o}Q&SQ~0A`tvr-wT-e#ZR-RU(PBi83dhN9fs3`0U?`%q7R&gj?K9o zfA!@tLM%U*wN_RxrMiS>&o6z*z^&GmdZ1}~UR>c;J)q=A)yZMeg?cq*vU;h&5AteT zI|yc0K=y7^df5cR9A}0o<;mZU59eL@sV!PI+@Ju@I<&pK=?cJFE zTDTXONqvWl!r`dpm}<0LQCIaD5uThQQFw%J%J5S%ffI~J|`>ty@ zQ$^eG<lS~~Y3 zqZS8OIt&j|RJ7PXT<&(pKiF<;1E+&Y!h7T|EWDmQxOy&+POQmtAzs*lCCK`AwmOXtJr3-v~6L+OONZ}(sRwT>Bp@mw5N`J@UPnL0J^S*{N9AYudMeDXqua}I78)z4V8s3_q=Z=d zL*_s5&_8Go^zyiJ|3BhT|Cb+h6rJ(nZzM~^r#s(WgO^3O;dSGW>2|%uR4!SCYf#x? z@LgyJX_d;s1>4!kiCfTCBo%VCC2_&(@o&)X^UzDO-Olu0M=JMo6&!>Q-!c~VpuhWE<+Hg${u*YXd8mB3#8AU|xPgXooWJC3r-Gi-M0qE_lo2DacR_vAjRZewL6$Pz3$PiLt=a_D26!7gZyv@)Z}hs z8VL(1P3JL+_~&o7%wCbP1za+YyHM*~1|fJdwzt;W^TUCB)XL}l8Y{V1iNl}ro36=r znUEV5pasU(Eakl^si;-7UQH$v^z*h7IJ?=7j`$qlVv^xMn;S@qpPNef@aF5fZ^#Uf zP1gw%`@X^Zgyn3S$9y3HGmsaMghBqpYx;|Q#xBophdLEp_HWh57s8s zv$o+!PH1>@&OwvwK@vih9&Rb4&K7&A1Q@~c*@P&4ac@$O?bFZ(DWm9Cu(7u_Ej(q(-+Ned26J_iH+Bv9~B`zfFMjmsC?*};J$I_3u>T;8{^0>T!W&&X8tq=66_|rr zm~Q;AmN`d@{j7OO<{%!+f&K0FODD&*&&?%m;BQ>Qe&L8aI|Yo28aJUqfRf6>Y2=@_AJ5x{ zj4d8Omhchn=f)Ku&~tvtZ=KZ|`by;2NVAN@{PU;x`T-Nem}UaidYJK}g-~x8 zcx@^NbpW%ZR4XPmF{bgYDHaHCF4{d<(e<$X_huy=ZDK-FX;G2abharrjV6o{T~r;p zXR#p1vnO5REz_)B2`Zl;!%_HzgoBicW#r(l7;W+Md72ydr#J@5L!`DfZ_dG_Sz$>1 zL8_+zw0~C(3^+LZ$kWVsL?w)Fbsw$usccpBnSL`)NOp*kytwdOa2(aRckLr4>C{MN z%SiPbE%o{~XX~;B?7p+8DBkAFvqa-OgtoB$LmN$nQSSFzI((NJbE&Aaw-Q3}A3l&j zhA$qVlne2sCrBGwqhu1?PMw#^*IGw0?-osMxt=CQWhsMVa*K zk?(_AH2=h@JIDC(Os7@WwL~ZG_RNQ1NHLmp$JqAXB=Co!`kWSP7pQjQG+IM284M z8fD3GPT>#QHFwi@Vkfto0}Ank&E49Qe`ZF{x0485Mp;CP>1Zt7jsi1!TT%_j)W{56 zlgl-b5_Hf@FT7~x&YjtBGv(5l2bG5E4gqDehqt-r@1Mj}hp}<1zO%-%+or+QL6J^~ zvE_NY(As+Tqw02nPP#u%HT-&<&<%a>NuaX*tEc6!9(8-($1Y371eWmFQt=rsz9T+S zb+!C+F0fJ&jmmQ#{1l38|%fbdEoJKe`pa{aRP_R(x3Z1uZX zi2ZQLG|#eKd2k*vsjAY7Rari&KQg9%mU4mYMXel8pFMD;JqEd8yylV)jl^!>%y7Y@ zrGpc}%5drA6J5LO%2G1PlGfK_4n~q6uJbV^Ws4dbcj!4Bug#MCfU0(7-}xXf(uLc< z=$^MFoX**X-uN1Wr#3T7a&A`0;mQTQlgjd3Eo(?VJ<}>^S&ZsTYHCa(80at?7p@vH z3gG;xlYgxc;{Ks{t*zAg_q66n)A_rA8ZXQAJ{WeZPeseyeFNVXEVT(tax7YR3rTh7 z%xWHYE6zun`_iRWCC@yU%376G0XdbVB=2Pzo!|+}k0H8O4YQ{n>7Os0aMiOMJIOYL zxUJExNg?w%bt${D)|Kl!0D%y;UmlU6Z`(m`Qog1eCDVZkZLnNC>Y;7Jw&am#8|#JY zAnnFOx__CV=pji;z|%?7_SiI96*$K_o6BigW)czDVRaV7#D*Sy@#OS3kTvhejhtPc zFHj(@%0vFRk8Zf1dO)-L(Pn5%Rr&BZQ<3x~6@rYlqo4i?H4&we_|Eh(+1m=mV1cnk zM=x07dV6iI%HvFSMfaLE91d33I&$bobX*4FCP{6zXQ>8uc<9cS{sjp5^wKTqk4S~rVh(tAI%;mlLTg1gESbz&#-?QDv))FJ7_UmSr#6zj6J%!XRy#wWCiX6%IduvLo+f!)Dzdt|&r zroA)T#I9UFY0iG-`Sx}oma^2&!==VB#esa1%mz&kw=HwxCH14Cu&vvs?BP_nGwMYq zbP2hA_{i>K6G@byP)(TuEnLUfi92!Cy_R)4>J`QN;R3sBx)3>+mVO5TR{qqv0;vJZ zjxZ8FTV!_g(WFvhSlsSfXj-`@hXPHPQE(Gg-jv1G5_MjR!#37;#zyg_A zAzb(I^yBY8t(UHKveAI+-Z29AU>s_VBTF_ya@{;)cL$;eJzMCRbb+mU=^;5b>#ZqA zAdYqYZNgGO)y0UW`lm^GpHOKk11Ry{k4vZ>ns?oBlJNaoRUyIvW!XTRbWt&R>8W|d z7kui#mpeZR?;0KVzV*Q%Q-)2Sm(QsQ;|&lZGW8&v&Z$S@Zn!o}W3gr`DuU2v6@oDV zc5`z-xb|hIvJTacsB&epuwrPhXA0cklw|m_Cne2HBT|jh*`B?nqGW{IUnbuZ&P4-3 zDi=ecwSd)ox0UY7-Br$BgyRt<_3fUV%XqzZe=F^$3q?i!YAXsH0ecuFGOOkDfp;EQ zN@mCE?8QSe+}eC45T|@RM2p*`7x$cK9&3snVkQ1<9fkiPa=$0ZjB}* zrmXFF2g72odv?-e=+mnD{fEVoFdWd#Mws!WrD0F2$$g@gJQ2;mX87=v?K+IrHg}g7 z+00{hG#C|4LFd=<-&z1H1`#c_dLL$A0L1W;8}qpuztTvb@X}$C3;)lxY6$DN-};W= zOGSS=-@k8Dy1%_9#T@@mfF8$b_c}0UJWJ-15Y{nK) z;=q-RYfE-%6_G)qFAubwStrAqNFk+tscCTWvKjBIXUG@Gc>qrhb#*hvL1<6YXqstj z<4^{FwHYk+-K(Qj4^j2AxQ0~)P8)Qe3WSJXLmES2THcv%@lt6O*V{D02rd+Ak z_OY)pC5}_1X3{WdCD#xS*eZw5SW9|)tkHE;{d!d30M0uPE4OErDN`J+nxran7N zet%^@vKJ9xU+dm4L`h8vkpJZ(WV_&9&k75JC}Yk9c8Kn`Ef#do8Ebw+?O@1!O$?0O ztbdLo7A8%myRC3(N`5p~ci-0tyBJo*+=@(m_Og(JcVswN0U_YsGm@n^r^+dZ>9ec6 z7diSW!v7vs4SbY+{^CyPRShEi7Q>oLU5Wc))ku(2b%{`3$4+ax9by$ht$9&VLx*ah zE{WrG!koU>j_#&B-T3#QRlhX27`Vi@yV0;)_|C~--cIldjc&fiFL7+aNH(P$+}K6(Hw z0vUOB@!l(_tg@tK(l4{huZT5ylly5TXUUH(SaP@(2OwLzSzGEli@3rlQ2uUlX%=bx zWj_xrElo;e7L2I^WoI}{=u{EV#2EW8IP}6>#*p;?VP5EDfvnzeGob5e9}e*SsHF*r z-Brb|5T7tj?kH66rfW^{@` zXG&NGC>&eqXtplGS9Y0L;8iqk^D-aSCPs`cgGtVdgkX4-yMI8nG1S*R-jP&^+%F;b zOyfc}E&E%#(;>mea3E&~t65Uml%gWQh$z`p;I~DQkn-bp;UOZNeJBh_mca=Fi;&pb z=ZUVB>^s|HRW8jU8@uSQQ^P|mL^#SV#8(sI#~e%u<7s`Q=|k$Fg@)zDdVto%b+$Eb zrN!pEWx2QKqI``%HoizaM5njf-^AtW%}xy?_Nl6<%$nh|O#U342SFbBO+I6jYF5aI`pesX5bV0Y3igZb;E!QWh@D!TNdwQl}gqojObY(q-sSk zSn!)x7P7^oh8t+hVE3(62T)QkBnI2i#O;MIn231}1Pw!Vg|NM9`Oja)x2qlKp4>bP zpBU~8YWwV{dUdrChLeP6dabcr*6wcVsb$?kI~h%{!2j@OoRj@DApo#kHHj->q3fmK z6N_vAar;Gus~q=|(2o0bv9`puh|lBY^G^0VG~$vUzQfh%3+YfqV1NXt{Upo@bZ67X zVcabLA>#@m5M6GkHk9#WAVBxG3_}p%4fug0SEy&RT&N>J_ILYTl zJ1!_S2G)Y@n0J z%Bf;!u&F5Y?)VPJVk=MoLD2@@IXeI=oQ$g=zq7uf4!U4i8z?|UAj$Y@N-2}Vwz^jqLQ_@SZo1DZYhLpa_4TfdS3KqN1)N&*48R)uc5)o z5i(=j&g|f>^v16;ILj(TQ%e^Xorl(YP<23JjHpl@yVBFKnA>N&thuXd%bMym|Jd-H zcbAE@-HUCenJxyMwqL7rS{+{7LVM-bZC&nX1S0eK${mM#>uRDnKu>l%RWXt`B+;_z zx~B6n-C(hbO7j=xXz!0u502s?m&Ndw)X*tXK|zx(v{EYj#u zjI1Wlsk^7CF$l|fGZH0sh~%-i<*-dR-Lq`dm#StLNuN5&(Tg#AK#$S$D7lM&cQ{Y& z=~&9oCw-Q{>h6Jyu!0iFhFra1i*l<;8J_a<))^vW>!%@W7V1MIx9pcn;&vmNBE!>bJnVftwSifHab$JsNqgZ6mWC@V^bB{Mv-jKAH^Q`OrN{Tsj_L0U4z8Zu3&4oCWwW_nN zhyCj066N7U59{$8x9wOB1lO16YwdQK`G&7W-+ha=SY6-skUR8DX zyMpGjo_go=%osxG14#Y9pL#TwQo{^=$i&_ZAP4*P&d4VD61jS^KF}m%zgHQ?>D$bGeEd z`_O1lBbkd9Xs``wy0gJTAGux#H&Y;p3ZEeJnrT@d2L&9`F}aM&pI1%Ps{o$`IR(>oEUx;i-qc8Qiuf&UV%(FpA+IVBC92>T7SCc@A7@t;+hQ2s|aNgJzGR*o9bvLNef1{^;0+C?MzQENaE4 z8H{op2CSclJXPQG>}q=LXm83hjepl#KeSOtgp%9jA)Ji%Vk!UO*Bx6T7{?F$bCEFV z;MZTwCiujqzNA&p3W^yI+A3dbb#a+Nk!N1xO zG`!3aIm}+Q=JWH|M0nZMiLPmpYB5(EtBMjul0?2!+~4`C>-Ww3B4DZ7Zg_SVQr702 z8qx@*iz7w2_?xq2#VuTYqTf0eauYMw3S(c0H#AntYU}AZCpUL+r#&{T$)xB3Uslr~ z)GiBg3#vopFG&3P?J;|GvbZ0ITR9udFZZ76YFhmJ>%#=ct!68J1w4z}7#8v>sW#f) z(|^I6uV@^y#kkR_^ji~k>Dg5kKJj|Ln*58+8KxrcoQ0S+SzDb<$I#2fvO$qh+Fh7b zQ&v6tO;_Z*E}X0(^zCGWL%ESQL~WJov(A&9%_Kk8%Vm$Imb@aN@js+E@`0&a9{4yK z4bY?|FBQVHTfKZcwYr&fr!dUbt|psYL{=}OW3l1)8TFe|>GRU!V5V*VpdtFbf02z} z8lu=alEZ0OBp>s;??se z?xKq;)h%f3{Ap^}zMmAXw&Yl9HusHtoZK6X_!t&)W``ONdm8eFz{s?@p>yBJSt#ZX zU3jD0{E@yGN$S4Jjrts)H2d_U@PIZl7E4?NGT&vi!qq9zIVuuPCyn~7l_Z-m7#X|! zP}J6%TlDrcr*rG2$65A}t!)O|1-vyeTrFW;#HY?Ju+k}A?@+Q3?%}hHEaPFl=4|x* zEM0Qv$>m6UWjprPwG;Hr2CTfEqG-8Y*&k2%r-aH=agkC=M3f9J-i>lAlEi7+E!q>* zv|)3F$RGcB0em4_%T0gvEU@mBb3JG@Zo?5yXCjSWrZ$TA76|iolW(5k6%>fJvB)L^ z6DubFOQ}FNR4{@{e>wYPRNU+b$!TCWo%PC&gF1tyE&!OQ8DZ2* z&~4$rM&bd_=a8XED(q`ym&vPrFglMj+TL`VYg@8@uWp+A(dR0Lrz3KT0}dpsqA@)y zs(u_#IXmMHv5_IJy4;M-!Ztic!wwQ+8gH>_vD(s4_-`VMY8=x+IRh2pg^@?mger|DF8ADp@w2aIQT zJbL;V^E@+7kcYlX-HZ(etu*R#?~wR-LTqu@PIoSXr1Pxf?EZ^Y%d`wQ`x|{Ss21X6 zraNgubU+$)3o4CxJ$}K5Y=505#MH!(?lbU4bZZcAIY6Z(LCz1HjT(59KHEPy0qb!l z?#B5`7I{$i!zs+v#^3}V%5v4Ny<}E;J8kC!`o*U5)-CGGYb9s3xa|@c`Kh6T^O5$x z<{}$n^!|l)XLlMp`7({+dsN3D5{pqPf$z!w?F}T@c*${=l@b9 z@n2j)_MBauI0SO68T(to-~W+s#H5F>Jn5)TMa|B~TmX$Z|G9&${J5qB_K&xnr_ZP1Vnj0EJ66 zmpz^fnH%%TQipbYr?u-mzykFG(qE-Z7!U1Hz*?KaBA zyPumfa$r(Xmz<+N8@c#ekWJ-psyQk1Ljil?kIT;XpQUA|LsNAZQ}0@iQ{Cm4e>==i zDJ>FPK?*Erj#)(V7s$d}zP6W_I`?N7 z!mIiZhV`0ksmO{Ew4%Q=;07lK=b~}{&1iB-Ek!$zArNovijyL3%xVn>z|I*g%s7wy z%boLSL<(^fCW{Z-diJtuw@zb)%gNyXK)Z5r7ZAbk>amZFd$d*1C8X>s6A*;|emhll zysFh7o_l^le0J|rN*6x~tKO=6>K`9{+EZDl&)_vq3)up}kU1<(;E)0UEz<$)U>(}A zqm5#hH5!KV*caJvMncu7*I2uS$~H=exBW>Ky+Vd6;Rw7)4eOzMOry6O7wY7-Z(55` zwUr6DILy-Yv@E+>*i8B_+*U8qWg?>#mZzro=#?C4`k&}{VgHdOXGe)ev! zpLCVrz;9vm!1B{5698grd2k%xW=otC)%Jp{oG2#?`bj=|F0Gp8gSJYoY<-uL$)t@8 zBaWVa``gKYZ=HT#ei0}~1#SoZN*!oy+0EU$J$T{!rQzrMCR#_4-uO4=UX4z!DE{1^ zCeq{Rf=qX7@V3>6tUJMA?Fh2Sms?*u3SCk&@qe4PCvR`1mfA&?&$$T9j&K#-XJh-& zzB=naOGXM%Jj^+)od0Bm0kJFAKz=?c5qqF+>G_VIcvb7;soO1yxQ85vXR;lk(MXld zj~lRy)P3MRT0NI(qW{a@^`swLUAy`c&Dm>n)!FI$U12i!ZxtJlSz zSu`Ji=jjex`phquMk>O$(2$J>R&FC7#plSB16%8=k+{F%fDzoE5c|?(nC`PNR<2BX z9N}OvEhM56(OjE*~LkRLg}6z(u)(uL-j+=+Y}2O$NAcrfSFEPnKSd zZ~?It-kqraxr(@Z8PjfSBCNg%iL;Wo#0sqJz#ks0+Usu~%p2%vV%NIgGIK@zVm*^< zjsqB95}H~Oir|L204m??h5qnm#jol_w9`lko0a1|{2u+Z^$JIkf60Uw&z8jiU)$g@ z-$aC90y1s=MZRbtyVrdpO6N%L{+1gK>=H7S`f6o16@BvCNwA00!Ya}Et>=%4%E$;E zy+E41xIt2bm{ELFZC=lGr>}LD;#q1jF;0s zNeN+=kP?$~HQz0!g71SJ92hkx`AsWfpp1{>wHm^XA?{@ZpbMVO zbhu{J+RsKRNZ3@FZiWHAw1pw%>!GS9m=J&}xsiddL9<-2V&|pIF1|QfGc)GeH;#cd zEhYz~Ml>Hd0H{bkkwX#|^n;!gcpVa-I=F=y_>cH}yt3KPKssK)Jm2Ho)Y?h|_Z4XC ziV^q~Fh~dkxM!EwV999zPIf;Dkmd?0uo!>iICv`z&>KjPzycj=weUcY6`DXY`v9sc zSe5ks<9FjcK(n%norzZECn8xPv*F8A79%45#7UoOXIL$*qI{ntwy~;y11JS@!e;sf z4fw->$j#FK;Xo+*sE}I%enH(a1~u%5!IhH_;9<8f0BD0vaIVRpwS8xwv<6Ek4l}GuKrpZ-&P*Vi-$TkRSo=2S2xA(}Q=ST)NF!FOEri&xM5tJL z@kE9q&+p9wWB{epeofNPV)iP3+!V`!*T+jYN7dsheaz z`k)$yd@HBwh-csb8R1PfF4?l8f;UCddRumV?q+QI^km|Smr}PPoHX?>m{~F^3*y8q z%(UK@)^L>Z8zs%d@$ip_d`shEzaSg-wu_)`UFeSoT#xk0aanF>&;uVvLMEz1KfzLP z;eP{g>Tdh4E8Hm%93`x0z%7)z`17|08Y$1FJTXNDz=10IL&Qb`nTJ6y9G~BpaaqQI zKkU}T$NWgm7h3*!B5Djc(xj4%VfZ2+cE6RzXkI*CJyZqNOFzX$=a(Oy>78d` z0j;w+U3a^HvMW!GVG^<5^SpM*NFIN%IO#9)SoR z`K$eS`GaVwwQ*}TMN_8^UUJYLKeh`V4XY&P6BUVwt4uWtV5F?Q;0uTc2%1QlKM6e&6tjQ*mq$KkiBuBHUf_J_APfQU zEb(*j{Gi!lN3ycytu>_(wE1M}wcse;{;|iv0o^cVu?Sz|sFal&0WazPM4s-wxna4I z9*7h?PrxC~d44T<(~7?d;Hymwv2%=y{RKb8@Mt$wY&;kWj8yLk$c5Y$J$DTQP9oFi zO=EPg`ZQWLv#B&tVul%Eae#)FM8li+pa#!9X{fbhg!VFK_Dsd+NKeR_Irh;u&HG|F zP~-&=P~Upo)58aEoVC2>E7tCkL&pWyV|0ZRvp$`)#ATq|{74EfK2RFm_vd>I8WAtM zo#GiTXP$N!Wt$~ll)1g}qpRxC^sY~TVekKq4(c4^uc-W;<9d;JH)n^IWfQ9H-MJ@P*1(aeDn_LUjH@*jDq9@aECrt;v5M)#=K+hL|Li9tM94hG0m1Q z?Z4_TD?CgS^%mFV)jSBjEqYnQq+{~aW}Pwc>sUe*VZM@pDSBr_ha4YnH^>h{sKoau zg_z2feIwf1RNfuoIOcb9sJAO}bM`G*z^}Ldm40UAS8^c-f7jta*pd03-itTsBCOn5 zOV#HyE$c7dQYms056QCaGt0kw{MM6q@mZ(Up8aw{>%DQ^n8iTAVd5mx7N=pKMG1X# zQFY`8y_cFvRkC(A2m98@addHp4K@7ocGDz_j|U8)aUF-mI0ac};#3tn=$7;Jo8Y9T>LY*&AZBiQu79TqsG#{VeDsZ7Pb}CnDJVlev1@ zgx=dD&$(T0r&|l{m42i=UL~KG+{sQfDJSNqScJip@6PFxSF2%(((fYV37bu{Te=Tk zIubJ?L%(kW0De;Nk<&WPF7ld%h>i^j7jWn)6P4A}ga_tk%gJSsxmv=4lqx;D5f@fV zmaFrE!5?PURxsGRDkshq$FpB9dRGC|>6HhOAUL82XLTL@eXEsYJ9FGk-0bw1Lrrq% za(cBrN!M@fts;9*BNtE6V~Gtpot`(6ab6SD<6hk7-+SW%}Y~? zrbLHr@f%ly9p- z9I$>jhACAD0Ex@~WS)FFPpNh_E!1g73I_mt11BrZ;o;#^lauo>jwsOA2!5Ve7PBW4 z4+!lEdHMhnOtbA{%=}+;y=7QjOVch)f(Ca863Addg1ZJX!6mpuaF^gd2?VzQ!7aGE zdvJFh+}+*z7TNoG-{(8$I`a!=x~r?Jt7=tO-QBCz)Y=q;!Iajc3)=V41eL#btVhl$ z``##uM3q6Q-F(q%TsZPNe-Q1B&Z<1Cd@R`C3KuzQb-n`aa<#+8W% zW!5=F7+zsI-h?}pQYU5&NvDW-^`9dyG)L28Z1*UZ?Kc@Ai`};~AZTYnH+QJ;7shqx zqrad(-<$$d%R8@RZyoX(``xcnO}^DGBv`{X7$q2oD*hcBb17htd;wtUO5aOqkw<#!hcy$?L5axY=#+0+nU zz`)$Xz#@J~B}BK;IG=C(#AL(!$E(7)GjKkb6ND{;6m_xw7Tp#hm;9L-nBU$oBV6gn zJ&4!fb8RO{NtID91gWM$6_a;D$yKgW#&v*kB^|q9-ueGATcJgOStc3)!^3=AY@2y8 zVv=qa9IKSQ&!5hsGa%a(w?N&6A*oi*y;vec%*~;M3G*${mi`qm$d?aDAET=G5BG#Q6c2+BEq_dl2%rY@yXJY64|4x-qA3B4LQe>! zA?keru559zfw8vnP)T557DV7*z|!aoKmwWuF=Z3HTclK`Zu!t}pYMyzu z76AcP+~oZo7Us9+^8!qNA)*6j{J(twVf~rZBZY(cmh$0wl&+MQt18$)6J%$EFlr}Q z%^KqKQ2FF03pwMop+`u4RJ^+rDPz$dc_vS@$uQ#kw83_|hA(Gl^knG-!>t-r@N z3HMGSb{H&|^6ajRjExQPJiF1+V4R%*v!Su2!2*VQu>uF{U&ik4ycxJxT?((6@}*w=_>lNuRCfq)r=dAWJ%|5zW2m@s5`a5kQT48^Ld z_k=RJkz4N0-&9Z|@!i2Sr}E#QbY$)b->YcOXK{9`&9#>dMnErrJEAN5a}^CUl$iYR z(zhQ8*_MB}Hrd1at2_Jln9Q&7U|`&=M@oFYuq6%7*U{I^i%fJ(OjWd>FRc7Ri_fBz zmrf;PpkCWZpC2Bdf|x9p@(Sy>OcgN=&(_l3xr=hr>UsVCiMo5g2A$*D#<$VHKWM)# zY(^HJId-!2G1)`u4D)S1zvM&VZ@k@eNBp1|uVIzBGTL9wq=I^WG5gzqyV=vTzFzMa z$V;a*H%}xPvU)t17+PYjPNKJTfq!v$LEDYi=C6-K7JKp@FaI7#o!02q$cFN%{Km$F zVZQEBI~vO5u$wdj)0Hc~u>~oWFwkny)A( zB)-w;Q{h8BznA&QrBK!;#Dn~C<%X3j-OX`ICt4o2VfSMF^Bv`{ozX}xoqqnv2;zpf ztw)z!3(>%tZvjD5M2rfkbcgt13)cqhUn@lh%o}Dqx|QEn&9d!UwT4PGAVf^I)BvoM z!&q;s*F{A=(~k%ShgiCa97j}+jhnCiQhWP4Xz176bPe`@LIO_RK!36zg` zMPyE<#_#%i=q`d}6W-Dd4h=QsvMrrPN(ZD~REn^6o*FeMMSx4N$BR@g zqi?pLG9>ZBqrhh8=jK^uJJHv3`-%i6@<4{Ab+SIinB5T0Q*3zJRg*5nntFH38|tSK z$ghp1*Ml-4v1-^PSY$#HQ+AU%^nE>yq;C@0p-$UAu)F3GZDdgyo&i0^+_CPppFNAl zEDajL<;!Ak z&nO#~-#E<#zSsG9#lZ$F2$VXbeAKDXU-H>YBhLc6O9-kZNDjgl9gh2zb*mNsG*nUH`aEXa#0&)EeF~Tx(y7 zHAy_tjgeYwJ9wNC%I_Qbdt|0N2jPzWNN+Byy+Mv>oekS)<8^#D$9Vz4)BrkY*C}TX zb$5P#RbdcAl#NB?1hzG(HV-QjeV0fkVSd4Xa%nfv(kL}2+pD$bjpy5D+L|>cE7q74 z?j%UDw5kOKQ<|lg!~NQ5IVU9a@K&6rG!g_nr&JUGrz%J|04p}KZ*)d6s}oS2O*=j# zPC{wJhNnr0yDrBm6Q3QJ+q^&P49-}$B4dw*gMZblp`tQcU-l_V{>(_eS;2Mt;8%!^ zIIAdir8Yfpt-wY``n~h?kxD`*YhB0qXE)2?#G_5F5(d+$JXwNdIPTUZx-m4AtI>U8~FnXN$pjYV59P@)noWh?xFgBMsf z#&G_5QwV61FQBb}#@20jz>-r^R#>`fA}q~YGZMo_dWM6xtOQc?33i?E3{Wet*r(f=L>lQHM*Lq z@@`wDW`k2-8jPN7K7RBWoSNv3on`l5QY&*+wSFz({qf^Q^XAycypo~?9furer)e=> zf1c;CCLXu$a{#Q4t$fwm+-FyYzS)Fw<0SJ`g6&8otEQD5FsbTyK zt!>+g7@vM0vh7-7uc&f#!*KB7dJ0U7_1ez)KxI+_TW5|LlJww?vxZTq+rnf&Tvp04 z{%LTDD~@BwL1?B&jDa(+LWo<-;Y6cou$_;b+s$~jP&X(bAOY2n2$WV+d+@?Y=n^&B z4HVJ(n}#cJre+X4FRa5f zV3>WJJ!A@=kVC8>Sg?)ie9}`tZk<*+oJ1VfsJ@N`gYiG!F;Oj~RTfHB|8^yw5~Qj) z3hJPBpK6I{xHC|mDM0qZxD_X02KEWHX3R@KtPHa)W-JAZ)$USW?$t~X{+3mf0eoT1 z77Vu9>4u}WmVlVZG@J^n&UyfvKr`Wp ziyJ$0I{nrTr*jyIfOAL5gdGf4?n{^AG!|*w-=vo)7qZ0OHKTv8;3Q;k@R>RBJ-E6& zZkJklpH5Lji(DFzpPmqRyNfIK z5|e!AO29+5gLMEKpzR@2uv;8wxM#Iz|aAJIDzhUwyTZ4ZewEg-=6(}%<~4~ z!!X*dGmAsG=iromvTntwZN&OeR)fDk;zw)!QBUVpos>5dmkNzF4n)bJ*OBr?IbujY zIaF{sSn@lLz&EUBb13eC(yO9byvg515}7XIU~Y2f^qMy7eZ{4t%^lA&(7|9%;?%dv zo9?i_L6kTdK6b2=JM>c!JmQD`$h3 zHQi~`gr5FEEjL+D6BCYj0Y4mNQwJG`Ee-4Aa;PQPk;u)uKj!sdXOwz4yp>LcSku)v zUJ%c(o&7JzAW7}}FSXi%1cBH`=J%(21WFmoJaa9LiQh6z;Fl+W?{i}sT2WppmkzBfg z#Y&B{p7rCAS81)^+hiZPwaw15E_FM?L(Hq{C(Th}(mcv{*zs@$s_z8ta;ixGZW)r? zsDa(uJpGWS@E3l8Tvs~bJt>S}s3cg&LoS_~i3y}FaQDhY(-SbJtKEBVqX5JP-<}Mg z>Si|00kDqFN9chQesH|_Hb$FWV_4i&dA?ugE|HVK1ZLzcOK zkoOQzL(%CB75YA9HKd z6!`Y5Rji1?Hl4IT#>F(JR$Q)Wc;QYEvTT`tZL(PWiueFOH^+Nn{9u9I$!ciuFlPMV z6kk*L$`Z6=>_K+RpV~%kBh_(PsBgY$cfJYSPL&pgjlI=XP4~*7U;@m7U%xK-lahyzvuqo z*7SY;hyD^{@hnN09)Eykwd^4Y8|t|5gmJ|JNS~M9h&coi3n$_JGV<6-lUe%A=(P~@ z<;`T-uqNsT!EmZ-LC_GskrjPYwPAm`L}4e$EeN2(udiw;MKp{)iYb`d)5VM$;nL-Y zRxv9?-+BzKxJ9JmN}KV|?d$iMu8+pLb-|e=8U$O5L|{ZztJq}xR*Ai;Hg75mGWGush1YYFafVJ3A3Wz+C2 z$l&t2f8E|U%&1oKl=plLQMho`*fDzWo5nff|1m;;3E8c^(NvYauqIoR$G8(W`J4KP zI$QkfsY&DSU-+FbRcd!P7dKW$#<2*qa)IRH`M-%P>MU+{l@#CSN4T)wJQNWlCd}xH z8%`-#Ki15JsP^}l5HWy3kgpBzB7}2j^udu~B^L`F*jOKHLPSwo1TKBw=;GpHrC#50 z*w~1p>WAd>8x`;@G*MgCGOm z@`U(94XIDD-LN9W1x3M}GIiC12nlwfp+7L-0-qh{T9mv!a3ch)rt3`=btGJsr)Ccf zF(dw204ko}6o&r9PG51&89=B~hncOL_9+hjD}j_`U*bcK8j5ag8EbFT@**O@q1&$C zQu;X4_AOQf7>m|`p>JN%8GpY*yN@r8YNaF_VQIW!Dg9L%HkT$8s_4wP@P2o}rdanW zT+0(jLgZkSli-pldUm7(PR>+)H6oOZgw7;^{nMv}sUp8N0W-3#*lDZ?`6ea~BUSlC z{qHT(s}d82268P&ETiputX!IAdIdr(SZ4O)V--Qo6M( zdR2IOMS=kG$ON2bvLt2~V?x1nx&Blq^A0UP=ky6!k+*Dbmx003 zwk~l$*>7BncGdlGx_{w|;=dVv6n%ivUr%fGU`=AGx7&I*LMo-*qUX5@Pt4K^e48&% z*J9=vGLg(wZ<%o?(ylR_V_MXZY~7HMSncWVRA587+AkUyKvb{sJJZ7YwABCF@H4)) z`9m50#o~m3m}DqeV4Fg_RS^{kMr8$XfaJ+xw6K=&NFF-Awgow;+{1vp+-%6$XonDV zdW<0#$6z2%$YvfPn$N~Ru9D&|gWYxo$_hNlW zrpA~C+}p@NWHj_Worrq7P952u*4$D=0X%v+&NtmKn1c8AjMX9to%CHk&Zm~2BllXc zx)Ik7$2Zz_Hr8p-aDPcc186U-KU3s-@6D@ZZGQ|*uj_F(^nwbzB?-Mv>K}Jek7I#_ zmS{JfG~naFcegvQ{U_D^m!OByzjA-NLQ%7Bp87s({s{7Y-=g8ZaNy9@-S46v{bUt% zv-9Ja1th4BnsDYH{wqq(vNq{KPoPV6Aeq$RE!))s?j}@y)Q-hqDtgn%D0#v~COBCR zyl@p!{A_6d<~pZ=BNB@nQ4kTM{DAg_NXg=6PZx%#-a-CKgEJ&0-i|jaAb?Qs z%lTQ0``hM?aE7EtLo}m9C`4aQvbo6@3%>hl<>m$}S>+=Fncg|s)KBvFXNJc44<%e$ z_{ryOC~}LB;|q&v>X&GQsms?w{6bGdnv4?cR?yk(1+&ymNVJ0ZzO*tYkAG= zqPiLQblaBYG9883QzmwP&f{u$)#)YTb!QPr9h{awHNXBAH}Ho5WIuh;l$mgFeey(( z0~*40-sMKTMvH$}mMVGFuo+IpL{?_%(w%CaH##{5HLX=!9q;uby59{&@F{Ek`0jFV zUA$Z!HM$B7I9(%81DT^vJn>tcUtc+(+5Hl}q!>e_ZAI$pP>yIN>a#fUp}ony>aKoq zhcj5-hI!VHxowEgh74f!mWa(2x%2APTyuT;r)kejiZ~x2Fk=s($pDZYzt`sX$Sd2f zB91+0LW@}1KSi$WcL{%A2^Q_;^$hqE%7nb^Omq;E^O;?8W=F1$MWjVG#-Nc{;CjZ| zISS_(H%Qd+Mw8WJG?$Ud*ZtVPUbTKvIHa_~h`(WM(B#w?+w4fFl5fB^!q6p0;9G8k z;22h6CK6y0dCEY^0CD~~xZ%eAuQ&&7*AXZ$AfWwUC4ob8(jS^N){|3HQxg+2w~w1j zw!c=|{qL@?U0hwuV28RaIj4aYoOHZ0Rv@%RZNCP7aCgUe%}QtyAr9x>X2=S3)nIU5 zgrfR%kRRy^OplCwR($@nqyHiQ6R(t}Yimpjho8CU^E!3->hcmF32y&eg>b!K+zmhr zpyuLI3hOz!hwLqy0o;99>v3aeWmVK`sPC`$^W^xrl#G2mTLuLK!#PO$e5y#(_wVO2 zvm!0+dlNh=>&x$d=H~b)DJeNQrRBTXi@Ng230cT>CLS9Kp$>(>t$i4s@?S5zmHfUD~ z57mATgat)K54U?IHVgH5um67Dyct?_gGuIhJ#D&LoNM-MNL^}z^j<7~Jz4Dp>{2mD zcA?%;iY|K5dCBwAzP6;~Xe8|;RI|Ma&;&zvq66O)Ky>}FOgQpNN=jgGN7I3>Hgml6 zrGa$DC^ITWZ2v)?cX)VsNePp?1tHvip7+Dc4+YPP6a-GERm}e3@4p0jde|?jW2B<$ zG-bDjmiv<0(&fk|)6vn@+pfIC3MCWLA;+9Kd#9_b>wKlN#0@7_P*PGuBVScj<<_KA zFj-$$*V)+c^v)&fTwOgiH>XJ#J&VDntGl$)j<_WysFf_BT4RE% zTC7zD1+Iq=4Gs%K$G{+C(T8*2d$TPMzjC_Kzq7N0hlh8y;G8OwhJ=AZ5Zt*R`o)$H z^4O@5$3RQ_Hog0e`+g^ZuA$A>5>G$}{Lx84=|6w|JO-I&{4>R;gkf*z)ui5oz5B*Tjvq3J&EQKru4tDnYRe~0mlTHFe&F`pr z-W7KMHfO(krpjVEU>jQB!F-IU(o6B!7SZCXB@m zD^WrhA0cfauX`6aH(o4(<3F&M?WkODlY(_hYEpM?=4;>L2d8>oLIVPjE=3o1n!Rl| z2jWTjoS0G12H1vyRXB6uzrfx|}87IYUE3J8C=&Q^*Sm z2yj`C5PJy=3)TE~mYbJH%g88bw;s^YaOVw=vbwrDqsg7p6e#2k3=I{Rl%#T4sOam1+=ChG9xh5CMm1HD5zn8MwY3Vv-pHRnF{L4P zPJor@>FKEyTmbCxJ8XYeQ;Vyq;d0OTo;AHkz@&5kaJ583O)Ypap?Gz_1nX?JJ(6~r z*H6Hx^|@e@%X*&hI>(%YXfRgS>*jhb+`yIjoGI+&^tAk{gsJ7eJU7>Lrc}>o84{lgLDY2+iuTV-3P$H&K&l@&nUF54|{&v*9UbMH>%DRL$rjEa#NAtE#Z5`C{( zeSbbK2N1GzaA5BeG~q%TcLd$;={{+wsa3&NH@Y|*B%aw0Dj$6Nd`v#Ccy*^nxIXSsH zHXaQn=F;)Jm`sH{x=!XRV+h?d^P$RGoNtc;LfaZjZm`>sbacEZ@w%YD#1C^gn60wk z8WK3^z+p`J1g!Ps!K35lzB=I8Ffsou>cc=4eRFejpB|5%y1Y4(RyH>|zpi%p`T0dg zMm{t0>eZ|L_q9Na9`h<*ZTJ;{ji)Qf6Agaw(`jr=?eZ=j38%}LBS@ptRNlzQNI^lt z!-IdSWepXu=$V-rAUfD=^F?WroaWPxe**5a=5xO+1Uyvg<2j9=-i)5D9k8l-d3oT< zuWO=CmM~BhHQ+ymykDfSG+TRnK&dfCK0|b4Yb#X{q^{5~Jkr9w@APy# zxAf?=)`jNe@_R~x^vgvxCQ07jnu;bN0J^!tl4gYGck+4LzGzYO-zTfoU)9UsrsI~K_17<7|#H8%#2 zQ+Yq2JoMwu+{FsCkhokb=>ZFMwmE3f{f)jWoGcY!Ix0$0OKTwPYs5Gj37^ychx#Gc z0+ph%9fvDA?ct#zm4ZomdHL4X)_p?T&O-GH5fKr$lw#-4!nq|S!vh19=}Y&UTyNgI z*=M%x0ahnRCei75x%K|u!)c&3?2UjM;6(s`h-%ShPu$Kd6~pj0eWAg5&XUt6kZ1JYh$ zq0uuk8*-H9p+W#2I%7>Bev(;^1dP`fHhSZ{NXX^3US?x zH(}JScUbSiavEUK@<12y^n8e*5Tlk&3V7T=-hbEw3y4)6*3OVGh8U5Xh5Bs%H!- z%+Sh-3$QwOzymn^jX+;m)wnQxT5T;iIr(x*qYoNFN>0vJrbJYJL4jNfe{UF1h(g}P z-bECRoH63J41EIw*q1M5lX*MQx&4Amd_HSwc>s^FxHv*581BBs76g|_*RNl{s;SK| zd7Yp*!PGu`9c15CKwUM8Vo298w-TQF?C=RyO1(^BwfH608b(y6!1gU^Z!;rEt5cr9~>MMH1oor$MrN*i;;}Y z7?lr(gu}4sXKwDhWZ4{rycrfm+Y=t79Jy4{Cp+59M`bN7Eg;qlw+utpc#$-2&s%oBWoDD1q?5C=M0PW5 zKA8E70^JA6j8TWg;);H_X9EO+BM=3J`oSMP)ON6_XiRLZZj)Oysr|R3mZ#>*N_Kw! zBvKgJ;E<5>lM|k=t8jeFFvX4NZ5#cuqb*vW4GlAMa!lk7iO+-COol>8c(4mBYjFYZ zqWiF`3b1c&YWk(Swk>dz9G8F~anM-lL`%ld(9q0m2Ot1_foN)K3UKKF2E*y}ZYi|2 zwTXt2K&{GZW#C(lE0P7=IaygFhqr315r+VY**QBORWDC4?MIOw&!iNroZSFE70BY! zpj4itm`K3g#cC8$pEFGx9O=T^qqn%8Wj|mc01L?oNa_o-R-;P<=`yAXtpE_Q02 zM3LaUzsJAOR8*wEMTQnFzudoD@Je|NQ>-qWTUZEwvXc=>JN75@`clLDO{at=9k7RT z*guY!$vS|aK)3b98T{Lh%t3}iG=wltP)%K(7842hvlSg?I^C4EmRzVCT&k>GSzHNPdeO+CmPQP0`pB}EnX|xnSeE9S8?Z+K{ zZW9>B10*~+0^<@{bm_F9q;(Yq;BM-CP*S^gbQ8o;VEqauS$6B_D4c+^E*p>@`iJP< zH+Df|6%Y88si|aqFpPh^^2xqg=Z^0%BertX)z#hH+&FrMRQ19z;Gya(^NQusb<9iAKyB zvVdHycYVC#=;*kwQfwQ;gLJ9*aJjORB1s`d{gt+IM&$URTsgUvH)@Lx0=g8ehj4ujeDKVUtgzw9*m0`;u_(A|9QME3g}^*
    Zqi|Dg6;o{B{RaE~f+)6-Yq){{~y?(eudmM!jh7uSQ7*D=gRznQ} zDM}2bVdFGJ2lR|<|2aD&yZRi^*iP1@Q`&OuCg2*D$Sa2R2faF7)icsPE5-DDJ+oKA z2{Y+uReI(!IPEmDI=@S8Nqn959OY+NBBr2gxd`1C8_S&c1MeD#tbt6I+_2uuufOkC z5VO3|-O}>bKg$LN_HcO|uAPR3wHZ&HHhT8afrNWP;@>9U6Ki2k3EPUOJaksTcjlw0 zRw++jfY)h{&!WV;WkLdjBb_J20&eG93XNRvqLsnk{>DS7d--$hkmjx0YZF}kXTH=6 zc;#~&T|Q~b8x_*nUEv00DY%MXuM>7|%gR=I%HW;ruCME`V1=geGl|YVk~bD@oISK{ zb-_Cx^DzGeY;5KBXYrD3&Yb-fE>efWP5ayLq{+Pz#SQs_nS1Yd91!^h;9vIE`qT7u z>g@ld&)L&PwUAAh*FApB9?ZK_!c%by2nc|~*ysm!~M z<-!N6mZ;%EIUN~#)#@EuqTwXewNoOAn2t1`B;DXoQX~`k>K1Bz6wADtAalfXW8pFJ zy!>ApGg;1JTbgcBhM>?F`Afxv7Sbe1M~SYfmd0rH-y9VbVDRC~o61iX zoP}}FN22DEytWNki0g*-`;*l%;|_z689pIb%KXX>B>(@rxLTgoSxzxx%=Mv7pKRHPISt#|4LlUiDmY&9ju$y34D7 z)=KBHKpE4C*U6Q>+X{=f8e(|wqR?qrSL$d}P(xHuX|$mc)l6x!*XE7WFEmp_oxSiH z?GS+uN%psVYK@oh=^dRS1s1Tu0qNu7WMZe$OcDcq^1Z#!+$?kY~C|4sx|Ui7+7{A zA}heF0yXlmF|r+A_#Yj<*HvbDTq@d34R(`;bi-2G8b6%{4=SwKSab)JFU0C)U%DFB zD$V4ljhb_)=sea-+e{T)TBkUt+paY?1=Bcq{HVt@DJEBwQh?Oh+NT8u&?J|EjK(9m zFB!lV&{mm($6p%1rwJM(8rhG}DsyI2)m$)`Jlt*U?&O!0oJ_a!@oez6t9T$@92|7+ zU&-B3Y~gP+=(ir^MB}4-RLizYG^Ynp^yGr33dW|Hv}oRy@ZV4P#+(b_+3hd|t<~v!WYO?PmI97st@(0~b zCi8#s7fD3lDwLm}H3jn$9!AjBBBPQ#lt9KDS7~EBYTae;#%p)(fwxeqWT$dPd)C@z zfmVH7N$(kKb)GW!4#(nc4z#XJiKPN$QW&$1wo*c`@B$h49k!cD)WiMrBe)L)p12NxYO4bg4gbm6UjYV$MVLn z_|S`g^O_tW-`%`3Udu_%8u;6_On`nT6W(*%IW*{gv5&^vjq;h{w%gx=!WEn; z5Er31xCnEL00;?wFJ4CKSw<&q_>g0Djl0tqSg+b570?aer}j{k#~jQiJ#x7FF#d+T zh~Qis-rL{siJuc1)|oE$_yFcNn=fyILQ-iRY4V5WsyTAnl`(j~D}7f4JRufIQgIZy zrEH%VvB@nq$F9B5VvbRFD?B&1HVqTd4`ck1oCdTvO_oJ)xe2q83tR|7qc=2nlhP*% z7DiEctSR7;YD6SxX-Y!fco><(*=lQ zR@@#iZZW)C<-9j2Soi*7r*+?<^M?BH^mPS@GnuwDL5fi;ohJ(Vb(@XS+b7X$DJ-O1 z6r|G=)MB%5YA%ez)EQLsw4yE^WcHP%si`&iabtBT^N8OV1UgaFbauE2`0lV6RwMIv z8g^}!rUoKXO)QRA3zxO!#Yqm>(?HTqPhXOcibbz4HoYDTtSTGk4(|zWg>m1KXF=hp zlAXNN`1*cr@YgA1?~9pc5&^6e{S;l2@y8eu&9T?P1Ql~`;_r^B^2zJXZUaeQ4$=4X zWR_#g{~72!tCtiA3~0oa=&x6cETVt(dI?Gw&B$w~YW^+vS&(p_PH;}w6a*5UkNk9C zf?D0_ZaZ{}2n`kZ@wm~4T#gaVfnC>6(8yoWQ2&jb+LfoFDCZ}gE!-ygdBbjX!J67D(xxJ59^w zJn)b;mk2wM%t|edq%Yy#d z?}u6?=#jGNr|AL%{6eFI{)AmnSUjfj3t)}bmfDgqFmCNems5jQdq27fq!x2k`lF{- zVMlzxTAXeu{Ns(>ww%+HT|@(NHtXT`PtgMQVR6dt8}-ovE*Js~&g(ymfL3LYATtrKiBUyie-&#=p>I4(@J@(icQ>5*=eP=H2sH&3R^Y>I^K_Qb z4vHeA0i-=AzD`_YDj0@0ZNUDTI56Pelf+52SF0M**=FUd0*a(*#tomZNWGtiJP;gG zpxI>;Q`2MB-JrPNz0)5~gVfa~DrYBxfj3fqUvm;vfM*1X$q!cKV~%?lje|@@gL%|; z1j7#tTHR>0%;IPt>K9GvZfwm?`KZ7hC^8zjonZ~+Vlf+}JsL~m;N-_MsYMyDf?6L( zR`~Jh{Vy2DQ~h^Oksi%fqxp-O?;Ad!RxL_``CWlav?$>#1AQ!VZ5~V9#S~ZR?52vK zkfy)|Y3sL4hgw4^qDFMrb7Siv)mBsa<&kGp8aP-HUrrMsjZ?iSKhv&$!t;Lb+EipO z$r!KYcq&@gCVg)qWIi-Ccrdjp^5k7y=UjW%&-!R$uY(2zhXjw3v#WuHqM68yFAT&W zd)*Gng-^=G$Ws8Eae>DE8{_3}u@5^j@p<6FI+sGAJWrYDMkSKZ2 zqp6@r1wxLiV{xqeNK?gwLi0e31m7MI&@-VmZ(cSk{Z0gZlgYKi=z;AD3tOqlO@J=LO{w#mzT;d%xXfP}RqqxzZuR{(i6c z7Xk|nIpPZ^tgWg<$DfjUCd9@NvvU83%;a+i&30u=D_iWN8Fy;&7XE97)9@4ghK{@UkPn>wKin{H>*(ZC%KUhFzs$HGz{ z6jd}(U6?TE#Kx*S`9UhPV5hEzsCSI><43stFufUj9jopo)mkn z>)?TXHnJ&3Q+Q#V&Uh+o(BwI>?D|%*_Uah-<6nDu$80QrN^&XY@M5PvcpEUF z`;VIphnHyMMYY!Thne)Wk=&e&-eMD`eRnRpCOJf65!Vt6fj#-}$ICw!X}_ljLRJY_ z_XztxsdQ~=4iyBmX{g8=t;Zytz1f;GoFMkJ867-$hrsYCBIAm!_;KC+w zwt-EN0Cy=3m8(lYT)=kUXi|BYjS6N&mElu!q$tRFXI+f$$G^b^NqZL`t2T{ zR6Q@pIbRBh-&+j4>78VdtgF3af4P+y5RelP_=O2!ZHyUh@>Q)r<@=BoEcwo6M_Tw~ zvJLd*N84*Ac(9@J#)e9%PmTK7)s`|Qmd(5&|K)Ze9GgxOu{c;|GR$#@l)-iRgMzQf zuIxnaAfLv_&34*?bLov$MiitstQFYyiwJ$JM@RQ}cz9zwi~RD{W}zn5n$$!taQ+u% zigfS3a3YuKx_k3sV}G-Gt&_n;R2DoH%%|G4biz)kxRM=hX7tyKV|Iplk0WWG-iq*G zsSjIfUN61Aq;vEy)IHL@k|i+HFOf)%$2kJ%4nxa%N)kw^K;`CakCk;d7oS?JYIvJ0 zKEk)siW4+9Q-+8czIPXLU2#(0GAL1YcUV|LhsvEkus+FQUd>DA@kQ|1j3+#h4r`S3 zsMi^%R!8)38ISU3M$7io8+Y#V=sTzHHaeo{^wurjNX#llHnTifZk_0$BsP2jg$GoU zSuakVSg~023h6AUSW?~1iPlA`@baOOJ)rIIa=#h7c(K)p2bccmli6IiG9?X$-z{fT77_%vKmes{AOJ~Bk#+@xo(L# z)4P_aTaA)}%a$_RTl+jZwuld9tAkW7TmEb~9hTyAg!I(q<`~Va8>7C7Y$$yispQfc zlcPXnANP2i(Yv!Hv(6ZHvlbM8FonE}@^vg>^6N|I@|c{b%U<6^A^9DfR7_$SqwX=) z!IZ~7;rCb)snB}-5+-vLARtE6=}EY%86uGZR&M5cZzg9ti;UjF9=qgSZ@E_2@zXHw?qjG49`?)i!7KnhsT|pcm=yOI z*XJX-HlqK>dcl#ThK2x>{cFoOhn*+O{)S>z&sysh|Gge5@(Ub=rcpI3)&)VKlMWV? z>E>oe+RPU7d+)ekknBk&7pk>%i7Jc9LhS;VW_?KONUC)7?QV<>UN-~e$!9~a2RVs^ z$?!x-2UB zQ570)f0Y`dOdWMIB%#G?)w}o9pl|#Ik}TiJ=6tvy+@gIW5iclo5q&?Q+6bqwyD}nb zkhM6WC9^DH^0?tsxwO)&W%@_j zc6(ihpCDN-jino8O*UG`{=lmkdmk^(E=z1)^X1dqq;|mL5FCgv5svHXzH&x1@b~#w z&ZS8W0K#r{X2U&rbKNN0cz?KG*`mle>hkgc-Z|yEHSW6GWGG&UE4x4T{YB??JfGdi zO^=@m2{-DkpPH&PO04o6U%kZpI^0-E=_)JUf?Knkvep~*m_n9X`SkD<8)3h1sa`di zIh~+Ey?Wx2^)`Iq`hv|q>J0|gxjh8?UCe<1pViZl^WqXjDT_n>Vp>xLb~W&0_M@Bi z>FTF4mtjvtug4pc0RUZ|VPefsSh4)&c4#1Jeigf^Zt|-vB_S!cpw;I55#YIhsbnD=-&T43}AM*gjSkXs6wS=1Er{0_o`H@+}7lTMn}>_%Gf{C9fFACN~v{Q z{1#^D`OT#5B&F?wsx%6kvP&9oaL{mW5ksO7ZTHDv09&>W9t-Lr^^Yp!jz!h!V`_3h zf)V4Vq?q%`E!kqyg3y2-*Jaq3wj_?DA@y<7N!^C@BKAk{NB>2d7(~g2Yn4BqlqM8E zg{nNd75no>Gh4DJRfr+wqa%8ctD_2eHUx;b3s+1j9$lxTY%xd7&wOgE$#tOO1!b+h zJUX0QWqx<^Qa_TjgVKuJqDsYGTi5lBM&A$FGiwa7L)$3IIh8H|Pl8xbeD*{3p3!WO zWJahT`dKVOUuT>%^SiX${STf}(+dU)&G`~~HJ1ouj;doh4#}ClP$9|+V)xF;u?t2& z8Jcyf7+Fk=`(KJFB}#|%2eCQ!dLwJEMEgIAVq7meZ3X&>bO`SoZ$IZmRSvz~?UR-= z%3u!z-8l@G63bxSU?;a;*oDj1UF9FOH+^$hC`)ps`ULYWj2z|ppx&RE|K#E={>?S# z13Bz})7<4Bo|D8%sW1LL2mVjqdr{=#^?&ln!uUY)+Vfl4|DNgoCma3T=bxlIx#4#p zk*=95_@5LzIRFKN`K|h2$>{$F5!mO3{~SO^TigW3Y4Y7=`}d5xmQN1gJ%N~yv%<3wKzb63~tmGbpn?BL6zh9g0c2vAVFeB9XE z>qkH50t$-&gbZlqx4UZ&0KlB+Rk{0T-eLy^AT5k=K>e@3^GpI&#^(maT-E@Du0m7O zOi>sU*%z#&sX14Vr3D~=D#>8NHV+Q0*oppD?{P*jo6Algz?bO{lCCvR!1jE$gUPD&2flzoQOs$wEUZ|sdg)Vo$C#4u6j~(UT z${N#MmhVSs1+rFCEwxW8Gfel4z&h@vNtv4Twoh@NDZ7)W*|aWDkoTHba*_c6FB7a& z&e=dgtw&Hhs@IU{n-m}D^zyQcwwD7M421hJt5+bMYBBm2JmzWiLQMEnDfss`UWJbVP8=nQMTQF8P1(+{)Rod8lgE-it3r1LLMq`T3X19AE>qi;1Qsq0$sFA zYm}6H!K7#g3s4j%H4WAlzV2l5!XhNhRid-vB&LVc0&t7c)KQ-1fBwX=8U?8oyr-u( z0FV!soQaZIk>ZrF_Tj&@YJo>OKo2l009ODg5(jg^3N|3-pS^~)ZeM9Hz2$4nvJ~yp za|r)I2C(4uWN9_IRb^%xj%7;he|rWABuG=wt2zPqoKdmH7tT2(YYUU7_w$(Egwm1OU|vdW&% z`Re{X&(rI5|8aM_Kd#Spo$H+Ud7t+=pW5_v*8h|kHkbkWnwqb5^G;WC3WhMI(m}PC zBJRe^$|}bdS8O^qBX6nz|Gn3;v!}-bUJyhbPbax*S@{=k{yJ_D6{w5)3wV~RefKQS&&(6})O{yu=gIy;acAS9$U{r1bT@$oZ|&w%W) zu&JIU{<@)*>+d0ZpT9|HB}-=mNZztklMhqjImZWo;Uz-5%ttGoIU`$3QXdW(hd82l z{70Q$&{yB9lrI)jJR=yK`8+=x2_;QFTV!x0s+gZ^kG*~SHfWKe+s%H{l#A%^9DrPt z9#kqnpLX|ImFno|?6K*`cg**|`wbfUCPzm%L|~MIPNvmT;M8|_U6S|nQ8&|BQip?M z1=0KWc;xC0@88$IH^EM4p-z5cLfa=~ome23R2FGdrBXd=eq>oS%28eS!B!}&Y&;yF zLPg+HZ*#(x#2|T#`<0!3nD-D*DJz%!^cJ$}JEt}x17)NLNca{V%-to=+GeAlMFw{g zExvn}ytjCAuodb1yL0}~mK>Wk5%egaXtORKHS}0!FT-IpTOG&)jTzcSp^(jyzQ?nb z&Wp7tyQ4N35^XsJwIhRrdyRzGl~bjX^R}M6;KU1>Eci4Hijb!w^gR-PiBL#vw@(hB zF9U&AiQpzBNCcRC_KiUm_%l;!II-2S^`Zk>b$@hp^E8B(7*iJ_^DL3k6f zu#&Axr3>MA0!JS(KAEib24yy=w3fa1##;v@UXQZl`TP5$6{-pftxTtzxSgGQ5`pon zXNLu6-v_W?$H$kuZ_U)5ooqb1F&jPMJ{yh}Pb$Z+N}U~~p0!K4J}@yck&|m|2*mB^ z=veGYWdcE}6xLWDT7M0~%dTW`ZKCmPu=AmBFRAy|$LT03=e8JP9<+k$rrc)u=jbTh zi=GM3jjuLuEntuCWNbCyGMN!RK)(a|-Vp@*qsg2*7`A0^Q9uYa*0*$UOXy2~uS8dNSorwqw$MZzm ze8Kh)1@H9cx}kx-{>gm2Ar1~sa7YNDs6DA(ep(v(gX5AQAA;X?wl;Yh&Z8C+cTM{q zTMU?po2%>L!9iC7f1o!`MPyl7S%yNS56GQCCW_wL=fkB5>RMXnH{LS3Phphtu@j&A zJauuI+UpqCuXMVdr{z59Z18OUVl>;)Sf-qg&M;iGwZ+8{r3-Fu;5qcGT|phS3)^%G zK4Z9e@eq`(RJ?i>mc6WH%pP#QpzB-v{d=s$f|Tq6Hg@RT6k_&rcgN0iLh6=p-@cxm z9$ECHfb10n_OLPD30(`t#l`ScMYb5j(?9VYZ+J{o`MIuJjCk`RKqz$`HMO3T3T)n)l-Zf-6J zg?AO1O+d;72M%F}JZuhr*!NF6=dcCde7Nw0rJddB-_)~Csw}?nJKz{oKw5t6Q+YK{ zE2nQ+HC2iy`Yw8>$b1T#G6SluZEfeJ%#)LoVLKzi-Nvvh4RJop2he9TRtwL@$j~^T!J^z z&eIjN=%z=nc4ud2thLj;1a7F!$d{|!+^@WUCX2)|J9LBKb*4ECRJiNwc46|YvF#vT z1I?W>hqJl)WxP(4A{WpS!=I;59jk3Yg3NvM=1oaS{VyBwUFM)79SWo1tT5&Q*b$h@ z@6z%jYTSJQ3R10Wt@jf9TBzzef z3W&sdAQzvM)FPEl%huMGHax4kI!W|%z(+nq(wNxT+fGd@rGo}w3bzCJ$iEsC^jnGB zLuRqEylk9`9c#YbN&4#7y>;M%~O`5tr_7D`d$@>V*$Q*faLEl5_)9O-oCY27zbT z(o{pB&87N_UvzoM0K2ZZh(QpE5Eq;sV{w8u5inZ7osY%{j`?ZB<%1kQWXJ^YHBUP* zOCb!Nq5q_9g}Avt&!)Be`~ZH?%jaV>4x6+oS;XNGSrQQu0e%XaFa($p1wR5E z6yUM%aWSy{uw@Z?1-M67+|xnkO-)J3#?Fpb)sI~U1v|lWxjZdH2!NwK7ZQ+m__yxd zxnpJZS(EE_z?5;}3)y1|_tEGg z)+RB200J^ef9hvk`>oQa>L^rFYN|9C_jF{3*^TFN>L5jicA@D=tXC*-8Y(JXQ>TPZ zmFS%wGk}&1K3v&37qR39qqg>T=wW&E4N-H0HXMu#{Jaf@9r_oUm!#oh><25pz?30v z)O_D>C4I8phs)^BeC^uHJhH2l1knBSg~cz&L5b!K531$F+QZ}U%agtz!BdLpr^6|L zV)@3+n>81Q%VwHyy>LMT9uhGlpxY{>sX>Z>7vy`41vxoNnHt|(TkS`_gyoTu zso%XD3R+{I;|hZU3u}aFcE6RWsp&@5YJP)4VN^qt(Z#?7a39vCBk$h5OG#nOH9^#Z zqvSRQelCdRE>Z@uB#T6NASF`nWx`v5b=VlwJeQk>UDSfK5j~c5FuaRwR?gF+fEfDbn+Xdm8(#gjjNVXeV;8Upn7@cu-`a|ck2wkHYl$~R z83;M(b~W>naJDN~?xx*`=9qWlZV`DHuPzK)^NC>lL#GwU!}$mrOpQna5KtG;N ziTT?ubJj*Kod0{EcI6r9eP+Zqp5prPAQ|v}6RC9P_wQ8@QHMu(C<$)M$RI|LMgiYD zI^MDq(Q}(^vLysE>q7Sh06g#(^3CjcOR|X5u?j~l{6>cVZ7~~OqfEe5biQF-zQ(8Y zj0^?CIzG#hFHZ=br$h9FHoQCxk?fL^zmRw+V_|Y$zT9LZlq&Z01&<#cEU%Y~mp4Vq zTTHn1HR_umBlZ+&dE8}=s}UsljYu{;X87PYC1Qcu9aL8V*R=EJ=I0NNj!H_&u28;s z(wCJ+jL{N4{M=Z?jsv7aB}xm+6f^p%w%T0e>}y0&_HWA8+rhcKh#7J&;k%uh6Si)__OHr1LpkTr%!X7T<%!kQY_ z1XWG(T#k&AQuEQHHY&vWhm4Gjva&bmg;(m?2_@xx{yck9{oc=U}~4w7C7A%RLXp=~BbM*d=(1o#0rqnL>rxNwku@RGj1 z(nnV+C~we`W@vl@>Ga<}e_FinXkVdZVPUbn9GJN4xG|AxWJUDdJQ)W_IJDwsy${hihPgLS0>501ukzka+l*n>}VX z(t742(Cem$r!T;6X#1z6ftDJYCPhULJSUGBQFND|%dy0^{|H8O(>0B!U29Adz!$~rjuUr}J^JpSKYxZA zhn{(QUZZ>gEXlM1zldT^Kb)^H2S+fER}yqLQr&PznNZAdwwc{b`K}*m;3-oZpk7p2Lyz8BqFwoW({tkx*kc}q% zPHwcL^Ed-i{hoHYvq9bLEnnlu`Em?l)sDg)BbO% z3lKZtnM8UQs!AbV!JRvR`AE?FW@BqIkgrciM&`IVC0mBrw4I-y@8&k1y30n+ZRX$x zhr|ew6xub6IhcQRVY9%<+h_Fk4?E4B!Kk#pkCB1DgsnZlA5qK|r2zq$z!IdU_E71` ze$s^de+a3&4aQU!WE+Qv9-MS&BdE#ASp}zIgE5A!#UC1SCxZnX3ipEJ%Wrb9X0a3H%~^xH||oymh#xD;beeReKYj zgSk3Q19}RdG@+SQOH;G(0)mzGr&TF5_#{E&2a4uxU7a-54TSPL-8|^-8p%_lSu!WZ zgy=*{j?D>vbIL&^6m828UHKfC+8K26wBqhvq@!DnS))^M1bz-$A;GuVbr|sp2ndK& z5;i%&c9fKqfY;#h6PMZMCZ`SO5E2p+6@AMCA!CyiKOhzic#0ewyihGz>+Fr&h`Y!! zb?^|Lo}LBDz|YSgowqerd$gV; zXiYVOoYDg8fW3egTXRA;awIY;I@f9 zr{foah=SmiMNYL)D?9$%aJ%fZG-K#H1XKh*$R-?mW{UwCLVq+*J*DgX_c%zkA~G=i zV^dNldVAHiwOgrVwjE{?T!fNT^0X{0EFvi>9&x{kzK7s77N9K(Li ziyjMYnsz^0D~Dd6?!A4i7D$C5MF|(erioZ(rfEfDlkDLZMKv%?|B_f1pjENA-?&SR zCvPT{)N4S3zJzRSc)(U;1Wm84g+o+fmUXxc6f5{D=;>%Qq~(hH4*ijFuU{8lNcap; z6S`zuih}$pXlSm)cc7nZOw#zF&r$$>Nafx=6GCAYa6K%t4&>xP7;sgLAxa@O396%^ zneY&L(a@X(I#r}Sb8>QmhOpjX#5>p-AOP*gi1FTSZ*TAJ?!wh6L(IS>k6i_13va`a ziQ!-P0%PAofR-Qk-v-36;$cCH1CF4O5EUgQH;@MB36q>USDeS!Q|KqM!N^K++-T&Z zr@B#bRlX-yDNhSbC^CjwggydNb6Do-qdcwZ@d!q23uajwh^R;$v=@dQ4FIzCUM6Ow zw2|54$IzJ#HXQn~rpBuw-~w=3W`w3JargTA`rz%?rhZ9;fkOlI=IrEz?kXNpF^54; z=*5}}(1zjt3r+Rl;&C8=OkH#(+<-21cqxcVS#V+lL7AFd*9~gg)>v^KXjxmYf~Vpf z@~c-=Q?s|Wwua^{LS_>Hz+u2#cbRvzw;K~SJ>sU43qW|m*-60JfiG>WXSCg_Vzt90CnmbYasH?j@8*9E<^hN=l;pNrC;dAY{G=CUO;SH;{tBIS)7TKp&Qn z2|Af_V1$bZ`ATEG0TBRPX5jBXmz3OuX3#Gis<2#WEgwN<(NaTvrKeUjVhOCS=far= zSY1_AKokkh7>y-SLHmE0~qZI-l+!~~6n*=Yr zAld#4q-3sMLF0v#RQ;RY5Wetv++g#SWz86W00B)zZhTsFR@kPY$AsC*P34dq5hlV0Ya(MR*G zOpVenUjW|2%>3}YFbylK6(|^hecT387wDjI$fPU?^OtL#=dtvIr3{fW59~Lf z770OShdHNbN=h9-4i006l9OW_Yd(Ak%MlU9@DEkypddphsBle`|97#^JrY$IAvNzu z&Cg%Hd{JQXew`OK3jP_$o!;Q7E%yu-)WnXL@L>rZ zKF(bbJvt$~PeedK0LKkOLWTpxVQ2yngm`2UNvhdO_wLOA>Q>;0Wswh z>+gT4p)up-B_m9M4SVZbAw~V)IYEP&@q1iZn!8Aj@qgqXFdB~@(V(1h+uPfrHX`c2 zX#}VYg%$Z@XsB(E94A7L*WSv?%ErcwkeLIZ9F1MDiK;3Iisq6QKVlLH4F?ClT6{6I z5rj1PlM>@0Vks~9y)yrKk(wG^MTELUA;Pd{KSPrXh$eXbPwwOJ`s>pELfGYKdIPWu zq>tcEcwQ0Z(D>Qk$si-f>%R4$*-GNUNl8@l8rJ4&d;(t5XETtgP_Vq%vKKuXC=i#_ zNyTc)7?M(I9$iY9Swf}9!_95en|_<-`4m+Y^JZRg@gKO)rdBe{00O1i@Js`+js2RY z>uGMIlMmQj2l7vvT&(Z}Q$jmPpc9lizOcBbyrjM^Bq)gg!>>NNV;kKr{wI+ZUkCZ2-!AiewU_@JR<4yb=q5o`IojVC+6v zCqy-1ZVU~XP*`pp^#JG{&sez4kT)T{tA`{93J)d4#Y2tBunaU61okCla_($gs~Nz% zqbUm_^Vv}d7!DUjuEKPg(-TM=&Q2Zmm|wh+OXExGvb?p)CzfmnybC5^aCv!opp1-J z0{5rK8m^Vjh zSg+emH$I1%FfcnuQc}`}cr3Oaq7p#PqN1Y8%D35up=AtIFM3MWBv2T36P23gPW6(S)))W$j?y@ z0mJaY3mgE&K}BdEh7N7^_V%oDbeQf5(7i98-De9t!bHt8o30afHa2d<+M2?`O`w)w zh4+DNadIkF<}fAnLf0-~7{oO$t|81&tOe#xm5g4FB60LkezK5^u`*9~lBvb{yn50}^czTeNc@ zsYCj2t3u-92^KOk~I%^>HiF*CIc|bxH z$kOldoe)Newo>r`@x*4}gDUm9Pl#+VIOt%5v%%?=lsJ14T_bxhK!(+s-_4A=<^ZB#Y*iFjwh+`?BI`gan&0U@2Ry1(fi{8)D_{3{a zlMo*-+;8HUsj=)J0_96QBVy}xY5A=29X+YilOrSFsf;v?FJh@dEDpOOE}q0A z(q$t=0n1GVjfrM;!dvh`SifDx(U~-#qB_F;*#V5EfJF@y7^bGAbPq_31F2M8QUY5$ z1O<-)nK2GWASeo>WIG`-hJ?`oN(|e}eZv8LP`&}b0@p39%Nzzd+(ouvg9`@N!-vlM zJ7uRHLd=2!*Hy~{4K)j|F@VXy)qM7a!5mW*fu9uC8^#j`W}iG~e?m*nxBk$US8mqCL>@z$@NKdI|cBamzWH|^D& zA)4Yaqf?`cfr!mNe?I&_+5>ELc!UxP(O+Q&AQ>tzFE0^9vgc_*<%BC{g9YlbiNf}b zKv@C!mxC+EA#^J`5F5k&@r}25l6a;;|9QtKW<2n}OiZJ(H0Mv zlo7(C6x3Q_oXOkmOD}+2`x6|D6WCA>CIKLi1*p5XZ!b|%wNSMHzczKsw~3oW(}Dp< zh7QS~eMj@I^O{^BVj8Y_b`zEG*}VJR+oYr;kSI(kz26VB!p8z)tr;57^&sa$algUu zzCQZObDFP1s@JadiCm68{=2tq3p^>Z|`&vGPa!G-T&X`6eeX@1OK)$ zUM&n|YDnx&tskJw%;vyN-q+N0Ir#Iq3@5#ThYHz#PBQ+1IR#~9LTEEsB#EzZ-!iea zU2En%rxMQjZ6-FnSwAR9F9Do~*MKXHITgUghF8c-o z91^MU8Ob)xkMG|r=qZjhk z$~n}fcxE*4?HeBtXGF&&8F{mFq>2}CWIj4M3CTxuHdHUaeA!MtT~39fb=$xcV2My2 z;8meA@)5ElRo?i){(gNJM8e}Y1r+|nUsgL%sXPz)73c)<`?Le(p@34JWBUUKga?@} z0)CDiX7ReNk5vMFy-s)I6`O>F7ffGMh-9?2vNEye8qTgGj{Z2uTo({*snv z`kK)VRZgf+W%LRN2^9+_NPwzjZEcNp?3~p$0L@}=Zv&OgBiLdft6Bi|JjaKCPeMS@ zD9Yg8$d1SRc9=htS(X`!07#?EgEXLHlS6pA-?lolgr!7>qjs%7pq}o zJ)o6vd7&k zg=t^#&{ug4ZGf;T3BJK_CD0qx4;aP3G`&}^UitYU%9uHzBnr+_7OXV6rusjhIpmA3`|TLBVRqE&U2!Sy1KfyKyz?R=Sz=*8XW|f z9@uO^?w2VP60I2ErN1ftIfU z*2uS&Va_!{q(E8T6u$|aFf;HTnD9?JWDOdR9#z1c?*e^r*$p9 zV|=Fjr@q@bP?0aOWr?DsB9nk+y~}nNS^pI{=~wFXxNLax=<5rIh59668*tt~CZf;1Um1W?X|Ix&c52V|~{@e)DaWFwoq071@k*M<6S^^8)bMN4sk%2s}VrbqpBky}k#86|hNW zqA)ec!Xg{>`<#O<$j@IWqY7+?oP{2y^#G%_^amd=2trc}gMBpfD=4$TDE_WHU}{Ln z&A{J@Km`OiB^VxMGr1%Oi-b#<-G?43XhXc8-M5UM8EJWL5**a9nSh0{v9UL!nV~|1 zE(a3FGaJRsoZAE-HHfz|nqa~T3JPGtgA7>t5RwA}1ABw{u2$&NpdVxb035V7;325H zyG9&iNM8B`@|RK*;oWS%`cAobn96@T5} z0vs~zua3^Mb0wLV80-R6Lg@Z6(FLDB&+uBw8o|LZK?Wo5CBTdXd*~^AVLTSajD)Ni zJ4o?GWBtP^2B-v~H9$}dgi&`qC@gKjJU|PB2`9i5znz_@)#tU#1Q!vvS8;bTbSfN- zVR9VG;lj&rc3ArV0@AtvMJKbOcy4AT!;pf*Kq+DSiOzxg+mI+-B=`n% zJ0Ue5qTLK0ecqr_=LB@0??A2&YzA33gQi@tHh#f3tXdtAXZ+0U+c7n_QV>uKRjjgAwp!5o4{^!px zco3veeLvzgo-$%-GHaj@DuUl61qxrtzkIJJg6|{+>~40$_;N5hc0m1u85{=^p~e4d z1~Mujc?1P_&=U!*>jR&z4&0WPe@`q+WA`=4zr?5^0A_x{wYacIviL-RcE&cC70T9| z1d@2O!4TRYIG;a?JV+f#643oX`cj6dQNKb7guB$UKWr#O{OA09A=+@es(SpK$VjS}Gh?g%-3G+>FyhYQ(K)|4F!5A2PJWu|5wh?gS;0J*ZZft5ArrlhC zfS(96B}b6^S^ZWg$H!wHc$fgFI4&$OziNkr)J37tVK`uQ$fgXc`Doe%A{=NQSix6f zz;l(~fL;hqWKAA)yGcxOI@!vN-wBBS>% z_+b&LyU5Vc->%iTW2K04$Y=m!MnM*Scyt8YGK7iu7%&9%wC(fy< z1a1*Gkz0QMK`VG9U2MC&{G)Gt=tqKv#IGWU!fu*q6B~or6oioIB1uQbd36gbZ4AZ~ zf@1?Yv>D+P!5BGCetQQNw_b%q%PXj{1OYRSK0m;j0JLlxGAquP91A86S-t_IQ+_hD z-9@aUD+p3JR%|VG^&;Q1Q;;;(ZcsNcO zLztUTy?Cdou5Qdn1C@}WfE+lu%@?2@z&7?O^o8O1!2D=MFcX0p`$ah;b#-+sVxvTK z@&-V6X$>|rCJXC2)$twMxLBs*RKzv0&;Ppo8gMvW{btNVE2#{{yK*8@131qFh+J*;ad=@kvVw7ht~y|Tm^Y~%Tir7Jh{Yewcc9q zqut-bO;TJ^0SwIsJ_nC?)5OEV!oAn2>k^Uc10xy!f$_sp;(YcAS67elo}WFeWQ&fz~@3!%#jX6Zc&Ll}F9s z`Qb0amLOAxn=5^?tTtSXx8za<@F4P^V8dsB(>Phxtw(aNP;e>)vHbTgS}YH`S={ay zZ&PYx@){l~s~JA~G}HVh50wfpfi73Q!3agehbGT}`fs?WEXA8&F4oH4^=MhP`W6Nz zFGf$|ax=mXE*gxvBvnMO1Y(e=P)X5WvtgJgx?anIIVp(;q%f+?rV?f&&tSzTq|`dm zvozlKiV8J!^|}2akJ;Wn{Lbv!8px;AO6J>Jc#MshcJLGx6+!O@*OI?7mXeT=P}$+)VR5sX8fykid%E@`dRnb^PQMMY-QiRq>F&lP zQ!!$zA?PlA{Ob+xssPHs_hbi6i%HA_%!H}ZJCHwwlIn$e@}rvwIJIM0q>zuAe?I;> zR0(N}H&j}OM?QSc&HbXA$5?jm@%3{0cXxK6I>QVzXAb~pkug;u_e@ei*9zxfp>l+v zSpvY!NP*pqoBvJU7_AS1VZz4NGG8EngDMKQ*@T=|MuJEkQl~BEF~gl$@nF1~d=tU9 z%CJo^2wTBx%Bed9FO-zy_I}K(_o7>dux9a%8jwgtYULyg+3JF@2enBFOlMu4VRm29 z1qVTc9)=81^<4+4tN(ued`0}W&8;Rl$!`+R2soa9GXazdOiXwIHpUhPQ^mF4;8s>a z*kWS+U=+MM3Yd2KRHTO+0V>dOi;$R5zc}}6&M3nz?3rweeydUd-lh5ZBwHA2@9@cx zOv>qnl+W&u)u0FQj=N1hwvGkT^VteHPB+MT0UZDz5gh5ob?pgjZxj-l7q1ys`KGW$ue)#<59LNmpo{KmNB zMpiSW`0}T&RobETeYyiFDJfujDWc9eTNnj*NYTrwDxBMXUr7kJ^cY0$MS=~>E@ChUtiN3^_)w2D47 zui5;oc!)3Ok+J@d2DTUR_M8fm@U+#zWMDgg` zS=O!avIKMt7LTm$qIX2>DZ!S%ksUGYNazdhCyJXj%^=1<264TSHRc~Qd8?$V`lj9N zQCq!me5&{zN9fH#OI+c9s)(gJt#ef^sC0lD^Nk9}B!Jn3eeyrFC__(Cz_xWOy$j33>Rx<%+B0gF5SuK(ap$ zqIeWVkZN|d&q)<7x=3Fh)iCW)2zINTEPh8_L*vh0-5JA{e|-gY4HR8L3=ez@m8sf=C#Y`*dKl{e+Pg#hfdk`juo z2DTZwAP5^D`>o0r!q7b(P<(pQTQsc{Um`fAWAy7cIB6c9Jl~Vi$)QBcP45$2L~K6P zZ4Y-=8SC#FG}gDbwJoi#!q8G9 z!YK_AH-z#9NITjt;KQe*hk!~fd0&7X4B`dT7m!JgLG2O9jlw8@X%LSjfSOGi=rhFT z6{uiO4MWWZUFJ<}-@<@iM=)L(^hKno)@^2GZ1iJgSnCMBynI5NcruoDdBd(?pd?a_M`+i-{g-~m zc;(l9`I|=~NRUdyxnC8$<@f^_-N1kVDAwJZTZ|wJTYe{JW;s-T(w2QuYu6E>&PN*# z46KRQFfL3JO~os~Tnl~?n@Zh3_^b3%)f!3qlj6{4SMlGj{?uZ>=RL$p_^JHU%-mxC z)?eYQW~HG-i)yI6eW}w$_5CzkDkW3=kXA%E`?L4~Q)fhCi1KIX&S)Ugt}dRyRgMASL)TyYOxEc`H)cKf&=#A4E)_1e7* zJEdNhEs>NiI?Z@8jVg8SF=@8aF!`9jh&Dfs+Oe&@thz!Zn*hJ$RUQrjKaY{?dY`$j ze(KeXxAEFuq)XS|iz}V&TXcK(z4PqkvT6!lW=_gcJ9(1*<_7~ug6;|TrFyyz0UDdr z-uAyvT0!3f+QxqAK2ZN!p01_uwBcN*{L*=xP^0doOIpyv_C!A>cH>X3g3qQ${x~V> z;bgFCc2XkvQmFVrWKJ&Dr>U9gW|)x(9BU~(jN!RXJ?QelLD@^!?&m89LzG2GZE>1q z_30z^d#4+Wx|hD4Mmv_oF}m*-)Jl&YM8(#*N`+nXJ?p-~1nvRJ$%aS4S%r;JzAPis zwjqn$9a&4Yxwe9Lx6^&0GWW~Jv?e<>=cf%yw>e$cM#)N+Ew1UkrqUr^+>tjOUe{!e z3oeNadzG_6kf`)>VranOA=TN5Vg5rl(j%UdGDdgX$&gHiv#M(|-&7ninoirWX?8qv znj*bjD5c1K-*%>YQ?{X_!w6bo#`pL`Ru&AMe({2U4Nt-`mJ$2b&RMOVo++{Z>GmO0 z9>c`V$9W^A8@_v5)HPIMNAsN(X|0?emTRVIyUdvwh$D=c&EdkS>fs0Yl`mK2oNa#* z+WmISNk04?FKfY8OfC3$;#QbFt=8Z6ug`;hbbc-@YG->NYIL-FFH0-KC(qu@pY_Y7f724cMne#URI|wjl7mgjOh^w*RE>2?&RTQ zw=lAOA79<`$(B!P?S%Q>Rng)+QD!mE(i_96q4eY7iGh>vKG%)dvNJuoZ*%YGNhDh{ z(ed8z(xaCVmskgFRFkf=+z|LZkrQuTU_j?N|B_TqYdL&Sk+za=x}o)f-6@g0e8jp| zSHsGK9qsC)D||NQCgx6du9}-Ny#{r4A1kc8tHRYSCPmW+`hIrNF}m*F700BWyl5j? zm@^_nMtb^3oRrh|=!Q0Jo|m2N;!DoX7=xR=P*EHamm9yx?y0n~C~u9DkGQw2Z45PS(L|NSQ8@t$E zhq#$J0Vqi75_$}>8BqIb<(#yu`7}})nKZkt(?oxDvUhw~zHuDB>RTqXG8&)xlbw#q zJKfe0Kl)RW<xIB4G=fA@0mSa;w3?iflUqdK*!_q3hz{mY)ZU-N`4vNP#=PnvD?rw}9x*6<$Xq%Fj zzRCY2&9^S?;nB4J<=eyuzK>EVZp;5N(Dwe&LQbZcp>@QT*<(QS1g0Nu@Y>oOjb|}s z9z94MH(y(3i5Y1du-M>aWerI?+*u^m9%iMoXyI&M(*2uRte;BX_xSYarOsb=`Crx_ zKRwjme3+29-XMMQBC!;16S|ldED!Eud<|^ z9(m*s!>7hqOOCchm%2Cbba(~muNCi`IpYWHcq#4_2|ba&z1CYhtTb!Uvt-pv6{oo@ zc4&yIdvSDMht92TzrDd@vf_6$JK>3EBJI;^DRt``K3lE*?Hc4~;xhukj-N}9h8i`Y z7Tj<36eu@z?huGi(OYRMFXXKg7WYAMb!gx3a@Vu<_IGK%f}af!TE#Q9besYtL|N+x z)N^=;H8iUag{Ak^t6skoS=d8)=6;0&)6TFhxu-PQFi~plX5`l$$`V$7QJ#@r+mBbp z{#Zr(%yvxr@&$*s_1gZRdZ=XfDKZ~#r*ihm%g{F6$~7imaWf)S)hN!MH;;(3`)~X5 zejeX!BxO|HoQ36O zWYiZfJNIqWN^|mhE%|g@d1hhXHF24C{8>qtLCIpFsB&T%|I6xP;Z^IGFKAbGsB*$T zME5OPWJ!tq&L7zvb;+1?p%vJtHsD0xRUWr}U840ejTMR~E#9MQ13H(5YYN2nasng8s6OekF!gtwo zr|;*)=fshZzx#WLI%Nw7*RSWVyfHsrXiv?XlKQfnyC!~GQCD1OHr!KUzjrb5clh(t zqPk~)NU=;sey$&SH*{C&>N~eI@yq{mv_v`P@vM7Zm(HTEz^%PuaU^|OccS2G(S0;b z;LFOygdbg6^eA;ZM_8M)l4Iv-rmDA+@Igza*Q$eLfOy^IIR*I^)7x*leD{6zvSd~l zYj%5ZRjCG3M`@C2Qi~5#Kb54Ha&W9E^f)>re+!y=DtLK?+Vsa=jFdS2+2Vhv=3%t> zsdK?;PXPRer@WrJ+ip&CSmyAKH`Ct@DGJ&c^~FV4ktb;q#QS8`AcP6Un4o& z&0N8H9&Vjd+l6@BtA@gmAG{Y?@_>ZN@aVF`_s!@nWY6Im*rf;WRh*=i@u z>>moV*>?I$y6wl2)r3pcE4-4MOg&5@_lN0dnaV|;nL7*~U=^$#&I+BB`qvc?-hYt8TlMRXJeF{>mD)w> zljYLbHJ@n0m<-G+TItEtUPISX61$J4SH%83rBB>@x+b%o?Br?Og&up~ll!e*oR4~} zKKEZF#yxfY__6!vWa|kfbEyBZl=16h$a!zX;!3@^vvY0qY+qL~?jdce#C1`r_Zc6| zIUI+oSj7m3?}~smd-%c^e<)jDAjH zOC#)?p_cE>Out-kx{}e8R9WZ5TsN4qF)hWD;hPeMb_TYsgawq^t{0lwdz4;m**>H` zInX}a|1!}X=b6;Qbj|AHRjEINZYu>t^pf7`BPu^ic3j*5E0dLr7Z=$aQm|{iP}Ft% z+rdS4Av@drTWn=knz?12?Afo);6|?kC!L9{Yo=xd{7ZLlduMy&64tJy$CarWA zMx@Us)lN^g()`u?sJg>qqbe&+gZhx+9wRGxn!+ykW}JkHPNJmLuUg-{b+kjA*|dA9 zmWuHVZwAW&1C4#(Fb46DXIY=vpxQ-Wc>bB+C}0>`=31T5uQnJ#9m}dW{!S?nvliQo%0S@SO=+J=%++$L}eTa~mpD`PSQs z6Gk9Tq_O7OZaN*LKh;>VU9WKZYr&@2tiM%0q3R~AT6=j;TwKUxD2EI=r6BLBz|@;p z*E8#(;MK^Q9>P>`>~$PwBZNy9otDvlZ$f={m*AwZ!_5;urPJ$@IV{sYrucnrk_;MP zot$o<5PQ#!vGM}b4AaLGzkZI`WX}0FeZSIr zJQ}s%k$zloNjHZpzYOJR>pfR^X(a4p5C6|6mcRP6TE7vxGD)XSn0xnk9bJ((%R<F)+%>4E`CJM)2+AMgwIJ&5M+w&X;M4dsL@b66=dj=t8lW*(-v1c_In@o zPgL^yrPre4ZcVDQtCQxcUGd7CmJf5>8M&X&-)|hpGwHW4<6zpe5ohCLm@BSXkki3X z_2#Q!T|v>8OQCk<$wyy0OMO-K#+d{tGu2QcoT?i7{bR;i(PB9Y2NI-ndul}o-irNc z!5ZER!S1|&S9TP;-G4OA2FlJ<5)k2$TrSoTuTqeRA#!@;>0!f$Pq4pRt~&X|=Tz!f z-_0L8a`JP3*X#o_LMSBX5!&yK^!D3># z&CUqV^>GjFDz_mN>x5e~K6LNo^yll81oJ2>I#o*W@!ikvgETv)@k5$?Fz?G}4xi>j z=?A&xjivl2eFS7yHg5egU1OoGu)8#$;7d2qqGl*wQ`fi@bJ2xG0wh0$u1G&N30K0>C5kM_MSpPWMX0hCOwoPOj#1`DKZQ(NG`b8V49KjPHT?-8kQ5-ykPUC=C2Uuho1;(Yg3h5u?;4rVm4+Q`5Tui!dyHv z#$Bv_8WyShMV4lMHd(q9!Arp5nN!;&i}f{2YC76&d|By&GMC!-4eyLui-={`2FWm6 zo}4rNzpP&Oh)V@=6lT^ub3JT!5n6ecXsrQ_sIL#XiqDTl+pCo&Bwn+bjOEkSxj(H zY^+X0zfZ^w@he-!<$P)}ZQ5yZNQ$V&qGC1{!^g~0Z0jBFv(9M9?~VT3jT%M?-af0&)3x7;yZt=4=FQisaE5FZ|`%G0?mrJ^RkhEAU5dMa%@chobHX}Y)pH&%48)1>V>SMB(FlvxRYt#OFWvyV`FFzD%j= zawTFgtf?r8dUNuZ@NL-oX2gEb^X{no58`(cfBEW3N27jNl|oGh3f$&|590KAufwMl zpRW8u596U#_6zN1xE#~WqZa?>2`vHXrJq7$V%_aN>rMK;SKmk-t`d{BbePK@h;1{h z4K(CjWKDMsEK2n$JDM77$J!Ii9!uT#Iit6o`1o@n_h zZZOn;vbHGNt}vq@uO3-@9Qd?cpvd#+fV57zX6=l7)9U-e-h;sXf#Q}AwrzPnJNMVb z&nU=_lRBp}e$$U1k{X^C=Z?BP^U~xaQ=Fx`zMYqwGbm(n1(%c|_%G+`@0k4xep{cl zLSmxc5B{It*4_%CwVw4qiTA)ENiEW1>}$6h0Ol#QVYd2$kJLLlwDxCPw$ zTkVfOr+hUGhMUHHwS`z3q&kGZ)}(p8iT`@p-ghQN}v z;^HP2mAkqkSshr_vkN?83fH60HaoPfhf`Jvh5lqkD^$MX5D;b8(CBlQGu10~T|()b zs`n0#JFok)89SVC_+5jp!Z3aY$^E%wTQMCoON3yVFdc(H#ZA`e(&}-Un4uqAYxf6r zG6qMzVj0_MUy+9XUQ?NUNgCSbcE{`^sg4+rRA1KEp0JzWF(dYTo!Q^RaM+s9S9}gQ ziT{iReMtE6#79zlC;r|`TH3sybK#MvmPWsPExTtw8P>tfouYjChLfK5bCS;nX7!*UHvRlRIOQMo?mbfVDL42q>5G0u};fy z(7gdkHv4iUB@O~lFPOAMCF5=|t#EIpb z5gToJwqzNx`5qFpt1B@l1>Q3yj&Hs4Usn-7eE!W-u%#mWQ)IE4tAbcEi4qMBsJzDH zf|*X16l{nkQq+`NZuVR<^v?S;WG&uJ#m=J^nZmHJy0r4K;3H2CzlQR?(}I!(rO?os z0gHUD)48EtZ}F3Xv7{?;kHoq5m_$G9CD*Yy&*xE(mQy1EmfBvu`V%&d^?^AD@Ah@B zyzx5W^&_3MU*;dVxvvu6`yO$%7o5scY=CK|sR~cVV1B2%uhU$zTA8|*om0^3+(o61 zJ)a>59(IjNfA1Uh&Hsn0uZ+s7Yu8Mv zTP_-YyP2_^=6pTgS`sgQ8!ua9*{a}MY5hTwGHp+vDMQ<2DSIVlLQ=a~wW_<^kd)8E zGS26nI37W_%fTOLr%-#>D z`mOg>b6eG>2x`pq8WDnTfQ5@uH zxsg);jh8aBQ@=O06*JR&nO}4%n%z?Cnc?&~OJ)4s?1Qe;MsUmggLkXx97f~y_y+r( zlmg2`cl64`5$?hL-Lx6qJO$FM)}b(HlyAGhYoQg{ z!>BS}-XXiXmpHF#fRi-=P^7vQGE2ndbv5T$6qf3BH_Wu2QR^8fg zW(8XS>;PSU;3p@a;;?Yr9uod{k)1=w>+r}ZTC`TnySCtZGTr*H1JXH7K+{>dGn^Rn zG)k|&!q_Wrah1HASF*c4_|?&|BMVktf=nH_I=F$yk1?T z40Tpc^R*EV!x;fl+46YXO*!xA-R71k+S`W+!MI-0v$gAAys@|~U$utoOk^c+oXM}Z z6ra_TX~40;{6qW1q5ZTcTx>rno0zosT=_uYYV!eJ_}D|@^VG7TQOi-*ldmtV)~_uY zs#1cwZd(Sl)zl593239Eb213Y6r<~IVoTm~;>&sKSzBZ5AIbR8wmMeb`$R9Z*`K>u zB+kPmbeqMR&)(;3j=h`6mUdn@m-C)~XDzx^SaGH-=a=crfdtBr#W=ND)1$vD zzv)yQ7zp2Okl^AmH80`mdw6X+@1)H(MQ7nR(=xg=*=RQlURB->vudH=J!iPz$!a6# zQD&yTa3B4=fB*2a`J|!f(8d2(EdBd#c-qh6_&TOIku|hTx&&UO71Q{2CHWqDS?BWt z^GXE%ZZEy-T*|)5xeiWoxE8cbC^2hTX}lP2$om8zClMV$EQXJUL`&NdlDK^o8-f{A z@`4I^;Kc7rIom$yGyj&)$jP0bSr&XoR}ox*+C~({xuRW#mJ75rJ*#uEaCVtdrJz&% zBuE?*8`L{CU@bxzo^uPIm;05~K+QSc(2gYMaUC22-zZ5>lV_h(!0i;hQ5CUKMLj)? z{R$Bp>iL;pU-{+zy=42_!-*e_Qn4@);n&y8>C<;{_qEU0D)5g z$;d;W6DE({`t=Lo?n97+kabqStOp|5jXA#y&ekiBmot5ejU+AYj=p|B`6h^@iJHzO z?e#M&HJFamUp3LOLcX4(?h(-sdNUj5bW0!dGv1RlSxaxfmX&{w{Gu|W{IF|S@mff{ z;>nXp2wLYYFLJ^Rx3VfB{GK4(h!J;{*2>+dKLqj4B_%^yjN>lO%o^(cgs%R0?& z){8k>a`*8XDaUq15S#ByoLL}DJ(bI1g}GtcrY7?CB<8~u#xc^q)!sck3&U6N#@!2{ zw+=K{Rh8KtT_VnV0aq>2HRp|=;WG|~{Z5;q$n_t)CnWQC+N5``Rs>3thumB&o5~|f z5!n!O08U!P4eKCbzpMm8Z%OItyI8y#JDaj(B-PT(MQ}jtcz@8z(V48DBu0u!Rj{E( zCoEQ(i4Gf2md`2raJeLjIB01-MoqL-kM1cyvJ%`a?M=yHe;{!FrK9_KkG2Ikkn;-_ zm5COw5udDLUA4rV!(90q#mnX2l0&({2`g}xvM>Ea#pV$=F6imXZ}acUwgC<$A6**} zP#7QiIM21xH;R4(hNSd+Nxt{1PygVnxo-pnmkYYj<4nPrlBJ_4Avi9ny?$K+N1u?A zqG@0Nuwiz)5Nw0PYA4_~KC*8=;M{m;z^MZEm6^HuAzi(ss8WNYRQmPJW>dL}rxULWk1jY8zAblz+LBa{?=z5DNaV|!m2qeH>mzU&7 zy+%Qz;<`oaQ&JDXe5I<2rDW`ZB#>2^(Jw|O1{d0g9%7TBKu#~It0Hzcy5O8gESs5IFxtl*SG6DeizXXti-#@;s=nVst z#J5#|N&=TP7x2eHh#X+djY)z^e__E>krXWqVm)3PJPehos?0gj|6l>s{@h|vEl}b< zg$d|eS4E7&3ZitN4wij`0V~0SfdjAB@%V<|KQA!zR+SiW0itmYH%xl%*aL8}ff88} zdhY$>?ed`h-=vu=7iA7*U`xZ{Z=#R&D;4NxG(n)Fj|9z_3zB_)f=8MHF7VASV z#u5JSM^O`($dI+;;c@KB@{M1U%)B#%hFrrVcxEa)ixK!@bS3`TAzKs^odqXAY427N z;M@5duU7Idi+net+##=XZ`w1~htFdrM17)U%7%9%9CRvWkmPx(QYiHxqkDGnEohKj z8G21UvV1-)Sas(R&JhsDZEbIl2rWh$|Jj}bqj*~jaap6GMcrjT)TKmL!RF-q)8gRC z)DEC_m1ydEpGK}D4kfwE4$FMotu%(vh-{b8^58$sUB9pE(O{M=xtEsUG50@R&y)L; zBf$P_JT1@W&Ojw4!%(kW|Jd#mNh=A2i;oXRF)TDx6;Z|BL&(tBI8TN)B0M}7EaY}_ zcpB4}I|!kp`get}o(3<}y+#hmXQoh;e3Nxvm%}qx|IS*1L(+K;)bvcgkdl&?z=0xi z72@i6{Z4<%N!rh&wsS>YJNZ}viM#VZw}u93&*$#luH{kc+o~P5%Bv1nvNWb;+%WRR ztGm96MQi&kutv#mlgFc(e9)6o(UN(ASJ-y-GN#+2r}yXhwM8x!L%EGQ{MF?y#j~nN z4ZqcE7cr;(?sz#{m5DXQqi#`N-p$g25H!7<>`qlJa{T*1dsx7M0SxeJn7ktoq2+Ka znrbv-HV1sTWKHT)1Xlmbd*ipEAw(O$=efO@_cAahpQkw!eC`>;K_lTvLoH@Y4Y{L3 zs`$ND-oEdcF;aNLll8rZ_O8PId?S2sk8W5FZA9@^umn$%p$Z#+@0D==-gY_5z}$nZ zlq~bAsD)W)S+Y-d@n_nbKYfBjsK@xk@Pa}pHrSD5cfqF@%^+OKDpwYpU9wjx(RNg} zU*;F3%KT95wfU(OYvmk$jl(sz|A}LkcR$}ONAI$7yzvQqcnWN}^VT75DsjN?2;E%j3>YdS(%Q7I8`TWVYI@io|Z6Z;9 zXK+q`TS}aRm7TTf2?Tv_6FyBJC0%(QXBC(fkxa(YC(7~!3Q)3& zeyvu2@;>rci^EV8AAO=Q)u@-L?RC`I+cvK3CLp^aGwIgGJvj^ zzAYKuKR}v5sc4`TJ}Dy=o1PL2;;>cYhoF-5=Tl?nlYM=J?9T~)pasbeoG_>weu%3B z!s&qcF~zhi+ANQm-fbfN&`l073gj@QA#oc1UXGQ#`TB4Chl%=61(=A_;b>q_W0Tgb zUx@{Yv}w6>yfl|`z^30_2Zz&^?3ZlOBwpEF?l+bq(s$`7FQa7oSfQV~b6Pk(6AEwe|Ju91--!th3L2n-zIEjnSZAy}FhT z*GVhVe~n@azN4!@Ju`Syy?=MzLA$^GVvL)yA5Tm_{s@-{n_y2F4vJGZ6_EZB5#FKK zkkY>4rMwpOP5+kJegCvnycL4dS6EAKO&I=~cpqg?$w?X&Bk%ppE7uAYP(?gI0~9W{ ze5vS&=x89I2*BfDUlD27K{c4O!}?;Ei<_nC@D@9W-VuTXMv`2kP}1?rQA)9hV}R_8 zL>_n@xM*b9<)W9Hob9)U&qU%^U>8%Za1MTtIx+rS(8;a&rn}2KDKGj`gQ--*!D3aP zFfu`XIVhLNz<;ksmmU7c{#|Wh{_9J#`GFNGM$h%zzGnQLFK+>!5#+FddN2iZ$|yu$ z1?Ye^HP{RRs1QApu;m_|tN!6_rF#MKmu?!LC*^%=n8b#FlmNX6dV}reTpCor6L*D5 z*~UQER`fgD$~Ds8LJFQGS(NddCsKSeZ_0WgtbCT=FH*cx9WLP8niSdWaK0Mz5j=fH zV4I40(d#l<6%EZ=k5>X^N!EA}qjiCE#4jrxYVy4OHD`8A>n1vtN|TCdCgIox5s*3-za))qA7+XJMQv!E;6yZaeiNn+Sx6}8;Y)qwW{$g+ymd+B!vd4SYe79UT zV8v+ZjCt%X(dc%Cc4^Zh{d%!$fup;2?h<2p!`(LDc*}txtOKa80WJdw1b~Fb6#EqK zTyUhiT5HB52VrLm@U4c|FKfd)7e#Gw*si< zkLsUKy8@0qz5_rbz`+Aao?SvO#>}4Ft{7#{=j6m~{s;B(_N^rgL~?qbf0tOd-`$JA z**E2_Dtx5;B?s0S#XnQld@A;~HNS@PAm8VUe78I}m43gY@Q*e(F|r8c#=}13d-;Bd z*|BAz0Z`vw$Z9ahU&frxB0kwokHBx6t277!Tb~~5tw4T6l%fa5daxZJ>;bqPz|E7o zLT5y=eM9~Ij9>=@43nT!&8*IY50#2Xx;=_y;^V+xFL>+^(8NQZ3w}d=?l}B7V~NhV z+ZcK}m-J5FHQdhf_U_Hdi52BG$C_$66PebX5sP+FKb%E#|LQq8IF6e6oA5Q+ni(q5 zBbI4cpuOkT8-|D8NRMO@MzydO&3G8B5%wSHo))~)A4S%+xi!!vxYO1yHHB|x9JL@I zoQ8qE7xyaeT&;g4X+Y`v#V;TrB`pm!`Z%TCta%yQG`BNmod z7s;Q;Bqp5jn;=7w%yT>_ea`}z#7@8jAVsA<1Sncy)-Zx7<56i@UuXq>pGJJF<8dyN zr>!JLBTk;YiVCkIq(DXX-W8{$<91z)bG&vxLH{DTMuI!GPBf!=+3L zAr$b(e54(|Vjgj}Ktm;A3uAkR@V!bwV!hk>irCZb8 zEx8NrG8hDbaGPCxn?N5iFT;K!B5NtOLH^-joZM)BNP@RKxF+M=6qxl!-@Jf(ZxM)uCf$G% zT*}AK50*b*f&me$6H(;OeEUiM(Ut2N(8kGw@ig_L`1Tj? zJA)9{z5^M2h>e)4YCKSiR5E5mCXc-Uddfy^eq?PqzVD^cLTvPayc(bl)I~forL7CV zl<1;3r=;YHk|~_1so}5@W5Zi=e_hW(w@V=8MroROxZJX^yd3kDPyqo4J|qsU^Q%}$ z7}jEFN3B#Wxv=A!qypwOf<-%(X&2b>e`&@P1^+jj=~4p0aaEQ5n>UoM5E^c5ACO7I zjO>|$3Bjxp1p|ankAy^(5d>b}B@g)9KodU@4XG#;hX_-mAHsp31WOgY`8z-c-O9vI{C!0YKo7bu3E<}u}fQc!=gER_@Ma<&T%=QcSN#gpk2dJ(C zRR@rLk?b42><V)kw|#A( zo3aaWAdtsufge3Rc`~t!j#DBkk}%{TtMO8V5KQ8Gg;YwHZ_9Qpe6K2~IVYBP+9?7R zftVWB2gy;<2O*H+BIS&Z{`m0%>{wBo@gOg@=!EO*S|uTtFsDx(0M-_z8eA%=l$0Sh z5mrYu!dDxKfJ{Hd#F3wI!BrbiBP@K}Zr}14?iIE^%E_fiM#=-_9+1BFa`_r(!&6aH z2kA;ckONqfs`*k^mzOGt3ekt_ub8RyW|x;m>=yZ~@z9b6fI9Q+^F#frTum%uV%t!Q z61otmeG0j=Orsq9GwuV3tUx&;uXp|U(I5h-TSk!yrU-=nV0rfJgRX=DAc*}2RLEAq zZ~>3~37Q3aY6>!T2#}@zp~gJA#LdDIqg(q5G^bPob&^BbeOpTDp1;l3lLhhgq@r;< zN?Bg-)=3+HWEg0_Bzq~PkRg(P4_KQ(AQ(^-A3qV4LjV;DWV$#UKwT9AB)}7CL`p zb2BIrgT4MSc~{6`M!|vSa;ZlA&qsqV0dLKT>Vc$>*iqy1mGBP> zJMmM%GEgdhD`F<`?_@X>!CqFB=(pzP<<(MGSI8Dh69@>4s$9x%Xh;hQSfPB2)bz}W>*8yGk!%L`Q)!9oDp_~Q_D{r7GS+ycOo z)s$z%1s*^DOq?;5wUevaDkFPK%UpCysC|T6UX2lVE+8OG#@ky^DUO}_pB0MW{dhCj z9|}P1NP_tTgMmYcv@-aOj#DFPy_4iicyCOFf3K&*_3?#ZbP63B7eSXiv;PmKW)3A6 zihutPA=)HZ2=ZiRJuyo2oRzs7i%m-teVXC=GTAfjVekhIi6I{tj<6}x# z@^z8JhkVxgr*cz`E0Xg7m`^~B5|Dt@`r^(ec??EIhiJlojvn)KQQ9M&z<1I4dR3$jLHytc5B0c@0Dq zOK3}tit&Ki2ppC`2nU`&cq0FdfG!v+AOfrGe+?#S8Ui>&fyOfkxU#(u`FB&7NSQ{_&}KGmAcLai;NSqPg6NT2YVP3>BfEAc@0{r)yY?q> zD!M^=&#SUPMnOhju;Y>l5}P5FdDgPeYcYU|4h3AQ%A84_5oMFXBHo^itN4FM z4QQ6}@p=46We3$p79WuZpk~(Qx(6UCSKPi10K29DOf2>R|dBt`X z%pDY!KMS|{op33sh4rY0!^KL@2^R*Utm1bSs!~y>(STW9!y)FhF!Tvm^@sndpALq$ zakEGr8NQFx0rp|w@|no>n|uwAU+*PKFZS_1;Alf&`9S2Y=n}*6QTfrCmq~O@_krbG zC?vI+{G;2CN%zR<)g(HSKeLc4v!@wh+$ZPIieFzHvPDEdDmt23OizIgbd~aq4XKq1 zY6w8o93YHT6!!cXb%;$|nlg|uigf|%y5(9`Ys3*Lg*W%>UJ)07MwOkGZ?QAo>1-j7 zf?=mDIMIHNf=0+(F(?{$z5}ybWkvCD!{h)5CzRK;ZF&7IY62Y;IOM9Hj%ML#K0C9$ z#hCi(aixCWIKh0zT2Ez;nV)hp-XK@t}n zJlv-UkdO_p^uV}p+f+4$Q5~(q#}6{)mAr6R*w|C+Ixwp+@LXC(_D=%B%DKtfk&%z$ zaWR1^E7uZc4FO-IG2>(Twf~7RIDqOpo}tdX0h4jPH~Kk{o)`5OasAP%^MxyV`C;*Vhbv zA*-nKOBw|Ip*u&#SvU7$&-`t1zpieJV(1_INxN8GNjO78890gYxx9Cm=JZdy-tP-Ag}nW=ka(5R#ZD^dq1eq$`rIoIVtk7!;N`^@U}I+qN2oL@G)CEPS_4YU zYcHNmc7i?nKii(tzsDUh$lC`8rzLU?Aq3IzoOVf~r<&PeZhrEkm$Egqodpt+`i$DtiNhc2oBN{fl*#c!P zux+{V#dk!E3Hg3+stO{L!h%BHyI(LN!Y6{FUq$PMKcyWPmu1If)jJq)6#n^;#>o&! z(GFYlrAZux^dW$pcY{bogd7^?Mq7GdW^l+HpGV=fwyte2ddB)ODTVmnKvRGZhHHk) z5+)op`q8Jzlzi>I%|}XKe>q(>YJX|L?t>R&}@>*>KvQGap>=;BIJW4ZoF2NB^p%t!V+ z6(gf6&2r#OXi)-G#sPbqfsb!arP1@GNS_4*4UJo!7F!lbHF|h7Bq|z0wt+lye0d7pdA1L6bRt%fa(m8y4!36E?}t&cg(s# zeq2uvh$^(3>{QVmEjFqd7}(yT0R;^Zr~uUg?#viqJOze)7#Iv(;^)ZF5_6hI0s9}v z(4pT=jjp^&k&@KP%F4iH7CKoV?zRYZuBv8m zpUX?XPk^UPZQ6lVFQ^HIfAiJb&~kFl=1IH3>r&XUyP&bT7x@`iO|j4L%nOm5BfUai z%fgOntCsWH{}FK577g_jP1?MJer@1z+b$>ceDyZR^TLqFEC}`NM5nesUta<;sO{#Q zF#YJ(*twc+u+?cVAp8s%$nH`u%DT1WZ`lmDVK{exFMR4UOqagJ#s^eCb$x zJUk%I+@~@yG$aT#pn&iLYBI=|fH(|LFC$_CN{ctE?OER!^vIl`Wpr&)U z1Q-Ev(;VQd2htX_*)7n<1ANsSzw6S~y}xH?fCFpe>)S##RZ>}bzp!%u&1#bVWe5;d z|CpZMWZV@7WL^w@&s6Avfcw#BtXLuKQ#sJJE-WenFimry`Oy@i&ZMZQcn3_dGUMWM z%YncN=vo4+N|LJYz*M;j=o13-E@CD?%J&3n79W}Q%u60+Er7=oFi~Yw4@*Lr5obdQ z0-{|tYW1d68ncXri?Rujn9E&?>W<-We*cqAgo}ql%96aviHI>3<~_59HRfZw^u(QG7>Kgo=KeSMvV zh9>$s5HH3+MrQ9ugxEa)ZUEgHVr9zMm>4BlS@zZz3L+xe((ivdQGi$PnRfRC+-g)m!D{=m^9d*zXM;`7)D|aM!0)l4kdwZz3UKN}Rb+CNiUTmm^ zhk8d*aDU^`hR!OUHEvci)^ z$r`KUkR*s5b0l}D*tBL=z}Tyt(XXHa`u1xukO&pb3qCCxyMX?~73IIX)7H$FAt9#; z8k8iVdz7dM|0W+e@TLr?$AR*v>P<9Cf4R`SPN%-f6FecJCNz4xxA>3;Ce}+Gb$~^E z&GJ=P2>e9R=fE{IHa%NK{s!30S zJ95=Qy2OYF5o-5%T!+OR<6>|*+^gc~$7VB$>M?DdoQWr%ZnVATd<8R*W1CHY%N>~L zE~lF$qV@G zjYiByEoPX<>|2qb&yXlaz!SF5M!9q_NVzZ&@Tpn;s5+%-R6*4-&G4rcr9EyZQ5aqt z#UF^A9BrpntsL{sWc^lM7NP6ubGYBM7K67t`Vh7C>L=tEJB_}A z7@5s8V=t^4yzbl2tCVHas8Dbyz6a8>8;fJ-&=4Fhq{M6KPEuNxJQGc>V?Jo#>D+CG zhcGK`tU~{^uhd&)F}CO~jH!6not_3pz18Y){cCE#qV9hAP~qcv#o+lGR4Ey8TP`SF zxOn>^ePN-)QI4Rkiqy{d?8lS`Bj@=u=3&vy?CT!>#=g_vC#NUG+P8F(^wqSU3->9W zr#@Dtf2IOQUw<9!*c#aIG`F=CPXWcB$7Cq+F}nn1F?g7tY*83tNi34v_6(i<@gDN# zNM;rmIed=P0s>y!GwSuzu9#3e&FV1jL2Fd7XIjp0V6n{yqx{*hIjCw+{a9u$4)%rv zom_Fn1$bB^DgD_`wy#J%85^=0iE^b7(=iYk#F+PpeU@(#x-8!pl$PSmkt$;p`{|pw*Yea3$U6Kzbv&RWp%g4o9DeOY z+u?Y!ddg9G0i13BdVK$A# z`ZN^NpK40Hyt9sOY?J<|iib&85;b=Jv1 zW(Y=%I-W6EZa1}#W1y(>CECBWl)AimYfh#b3-EnEyIzI>m)~aC`|4CdUI{_Os?=RI3(eeG2=YJS}O3p_k5f4@xzxVK%s`e&a_9U<@>VNI@-Fg z!)MHYN|B!gQM$oYBLppwH7Y9L#0}KdF5f=7b-axwYJo*-1ghDOp1k0o1K!M^V$g!n zs)FDA-f-fFv>z0;;0=yDhI^$h=B#L|2ku5_$E~p0bcdfv=bg4zL*o;$>cn&S>( zdz9KwM@*`nnl5v9+#=s8EHaL=PZ@(aJYTz#T}{xcI|d+kK)gFQ@mPWXHqy}=ccubO923L?Af_lrr{o+Q9tM5ssa?u9 zhc?f^Qz>TCX7KeHo8JsN4h$VjRhUg}@V4nA6Le2WPF8)-+*fl!0;>7lk7GhE`S)bT z$mx0AJ@UzHMa&<1RM+T@&Qb$G`M(oREpD`Q4$+3}NE>Ipx{#>#71j0&^rfa|3{+}r z>JmCrLr`%jN_m2a11}Hiu8;SRU;2Zaex#!(S|I9&Spi%ZotL%VP7hE#1pcqWzy|#q zRlfbPf$&(T%3GF2K_lw(KIs~(Yvq?t9P1OVv&Zs@w^>j@ z55i9ZE>&61&H^+3zRK`DjdnNm@aXKE?V~b(5hy_a1vXL{Q%{7Tn8WS&x7a4+7<ckZf`e!lqbk@0Sx6+>-oU{o;HsyERC&i;R#AxNBa`4h3J{SG*PIcaw4J9)5 z%|Q2IW%yR8zHkqDu-sx$i9m}?b`(#Y@zBkB+JIGZTciO!s1Ve;ZBLH_^;b!`5!T_J zvnMFIfB5j$%L6QtMk@vfG*r;{3bA<#eos9gINKwBb0ZmY@wF?S;^ zEXkbR_5u}xXg~Uk(2s`=d)U9r^kc0?FcX|1YfDw*@ZUuBH|R-)gZf9F;+FHY@yUPm zd_kD;?XbV_cJST6vN1%-d_%8Bd$MjnhfUE7us(G0qV_)qM+7|SS)OIXL2L;D&9kql zmlu`mL()&Vv}v(Dy}ZC~p@ukC9oqP{5QKrC&uWdQ1NW)xr{uAElt*Btb8N|SwvkeI{P3na5=_L;14Faa!^ zV@&*N2?`_>+vg^H?uVd*oQ73dV95#Ua_5xVvEb0);^E?xdOS5krJ_i8uyKH@Qwwkr z+D-L5`>hEtfdnj#g9B8mwtd^oD68ICA$ZBekxVuWI-a;8s2aS33pfnQ++5qVZSX>b z5Q*UeXuUBop=~8niMyM9Uc0(j*X1^qO+oETN&(BxXic#>db6LNK<%aiP=M3| zvY1%bB|fr3dd=#^+M$KzLOU{7^cp@h-=3k2^BL;4>wItf&bi5-)9&N}=4ZUTyh1{Y zAE;CD}H*aL%#HV8RcYo0#cuuwB7Jj^>k==#=*PA|Haz+aJW1Kx;8BYqVcP znGCi_;uY+6J|a)zU$a!$!=5*e^ed4tv*OiAk3A`nXmWl3_oV-4m>OXGTo~;!H7q^i zTgY#?nG!~5K?I5j3)SYrjIn-30xb<}h;+LrvB-xUe5cJoi=ZOC;VV90L+_E0=wHn(3G4?IAEJHeQzdWe#;v)Brt5#UCtwED*+kmJ_kz zzg@b0aj_Ej%CAMkXrG26Pulu1-K)aDt&t@o>=-32J?YD(w16l(`=n~bU+e4G*7oLo zZzxNEkCk~~U#gRyAml)@Wl(8?p>5n6m21D`zgz1=Squ7m!D-T{s;cp9@#C`>JKQwl z+gN|vjr~B=FK@MER!ItUdMp1q`vU$LHmvS!POV!we_eToksPnOPey734v4lczQeVf-(kM9-C;oeTb8I4PramE!xF!qZ zP0M8b0Rb+@_3#ld_?2p-=1HbI)p%OEJ=5R2%p zv-c7SSxr6DpU2kz_hO--rkZGHesyuh4NgPm4}8*<^zw4HhWJ}8t$pBT#(Vl>J9xU|*!i`NS@5CjpI zN*??gGyxuJMu zgadly8OE`zc~Dv7b?=cG_OpQ)1;b0P1m4K&gusLpTO;Pvo9#j~-w{usCana#-J@19 zDW}NztATA2aJ1bGAVS-Wi^i1DLf)4iO zZLteU{)PscG&m7ePEm6-oQ}HgeC(}Sx>q<$Ior9K*k+a%^-e&B$|8by9xivfDW+}R zr5ZydMNd}V8F_J3OQ*ZsOt>2z-aTvEC?b`L{t)hcUg-Kjwq@3A5##ZTO*B*@Fp_c( zE}HSgAuKnPsMqLb6LsB>SHt(`vUDYK(LXmF^tok4`NT;y^}f(j!Q+<)0@Pk%G$Z^)sAc}{!z+}W)ZV0&+myP) zv=$w`m@E%gB?@Z&g$yD0CHH#R9PRTTLZX|Bs~xA)-WTN8Yuz1n>&F{dY2hGDgYQ6} zG8z=2ZyfrdeP-vQFshKgBj|XR!Ex1!U#x_OY-5nEAlJ>{^vXZH@F0tAut%89?Kbi2 zt-+bj*CLKBb-#>@$>%Ru6*^cgtnKRpgNwaQB^DR8Enug9|6~}&HTamA{+A+l$Y73r zfYXB%f*Q4HG1WC9@Z_-PvJX2P$CZaS+=jEq!=2zQ=(3eRMKwOkv}=tx2~54 z1s!(WzwDz|3wOQD(G_B!V_akNY5z|U8ntC2qhzjMb{uJlPa~M*St_xUR?9BpRISsf z(Gd(i_A=~ZK=K8bg`A#nq%^YN{aZBB<(-)vM(f?j)90b{U+6?CTe>yl~} z1)+<+s#}fz>ZZ2eH5W7W48x+DreD$idz3oGXU~mdLYs3{nYeW!X3N?v;tFDb2wm+@ z$)Zjx7iH}g9TWF${`6NSecPlbXt+FB8+1Wr8@FB3cE4z_cR;#@1(K8|HCcNcgLVkf zC>ZW35#=nKq^x+Lw7=>N2L(tvnCgYe^q$2=l5I&b_7KROKOKzFeAtO@wBv%H-_x9C zTU|eu5a@ygr0pv+bRT+tqW+u7TCh`wge7qw^gM0}JHrvrwE$Ik$b}SVdk6-iCljMV z)BhU?y0~%o39i-ISKWsgkKx!DoRQbbRjl)*zktI|aNnmq`n~4F*CSu|)E@trEgxu5 zS#F&mwmpYje&sHLm2m4H%(1zxBH8rG50M2xON#xB?1ADb9rIlf)0Z4d&&KI>ppKQ97N2G z$;zJmjA-$ndO5XrWw1vn11}mui!RP;uNX1gmiLOn^CII2q4Tyox45C{X=u@TYX4Cd zUdCHj14MS1jPt`POuXrnoD+n&6yL;W30KFwHXkr1qgg-PdcM_kn;GDAynZmDg>kQn zl>FY9V~1SV6AoxBkE!>K3{oDI*(-1M?GmNWThgD4H3P3U2&O&Xoh`whvX751Y29hD z7`z@&Q|L*4+o*;5ssW8uK>unz0{0XDZ#p_AhrIf%QQ?_8_+do{#OY*tEiO#UofGNA zqaJ|b(Srq;6%6$W9w=z(Be!d9ax%eQU}Agh(V!sAcE<^Imoq#b!mQp_uZux6=cg^H zy)`)KjS?w|WKweNzy{R9jQS(1&Flabp~1}`)($Ivq;_y2S`lhtK!R3ra2}&i0`Wc({9@T4U&bwRqXl%zVQ1e70K0bDx&>q>hl=Uh1j5i3Q=C(ISA|3 z4qzFg%}31)827d?|-A{`=CsRixcjq zaJtkGI5CE}r9$#l8=gsV9X&%0235vnU2LuiIXnf$E^i=|n45I=jU2(j;j?)iW6k^a^(xSY$QkK`>G`Qtg%vyPJz-cTR`z|8HQ>4Nz>R8rZQ}>943Ds`;kN>f zP~0H?PO$x@`wnR52FR*ltI|h8w&ik)ur6n0V}!!l$7694lO9rk%%sw^Ww#u%4ERxD z1Cq+>FnqC&+e0y?$+C2zpI1@)CsR~!nA8ha6OB2KFx+ebJ>;>#xCh36tP3Fwo`ZYK ze)$P{@kOhNIlw)V+0E3m^OG(JBOZe2`|)ggM1*y0vcvW^jHY|K9Z*@kwHt$ zg@abbpa6U>s24df1s+1Y4zAjzD7&ASHAMXWOTzY?m*i`KaL%kWS0@bA zfKq?IlXh5&??ppK*n5=P;`fEe_+L~f(cxzJ*q_`&{J5X+z}${Y&2{bOv-P_5&a$ij z)#Wb=CMck9Qy2%e-sx-15|3BVr#F2@Ge?(&eUUc3fcOId@SGt02|b!p@rT`weH!W2 zV*W9LL({*GUF`+pFAo7u@kxEwJ;wkQxePinhpeTjNZ%P<7W~B1@NS~8OGs=|e|E2U zg1`ks*@Bo+7mo`+L;R|bRJ)h`_P?1&T&OI3-=wo%)5wDG||*C9coI z@k!)t;e$u(a6B^99;Mf2)i`@_WT@L|Gga)?%~Y_@}c6A?;6&d462-{r{(! z|C1dQ1pa^7!6LzHci!bh zlhrS4p8%FGm11%Kn-ut;j0(-k!Z? z-sHN%SH$;nOK^&|=gK*z)7HK(Etprmzf2FCX%ssnEDY(bET>~yX;011>ns_f!gY9> zUwp_}oUMFty8G_S1VL|}h-BZMUF5Xj=K6=t*0eCZ`Ejl2ZIqo@>96<)$KLC z{j!2_Yr{&^k56w&g+(A?5<7)ZJ%hQ`kR>JR#PMj$n;477b5&tHo3qi%X1WvJpY>Z= zqyDLLib{8QxW0mKP4qv=-+usRLrrv*ZloVS=X93g@lHGWrtD6@lrr8pR4|1;AqH1m}JPWU=l{z4>Ivo!m%Z`k`G7eDau>_qw;Se3(%`nk!AK}Fm@)hK?@0kdNjcjr?I#$D-9o( zzp!6lg0P+(fA1(=ZGtx5D(?mrI}I&s2Ty1@QuiQmout3fzJ+Zec#kqQM=Um&Heg=f;j9@&v0Fz8NctmpuHj| z3k1PeEVmigtzt2l3}=s-Vb=ve&v*s?%0PeMBlRr4M5Z%-$P5#L#98+*_pl4Y-b`9S z_s{Hm+*{J|x!x}15gEjue#g-=r6(4qUo5Hsl8>*Km{j{^9X|Ob+?Su*YMbd-b6-kF z{@W{vd&NaAH%#CP%V-~ocN$D_=Kv2uNv?`cQui~81VZK_Edo>~JM&0`LsN3e*xP&l081e2aZ0o~4qJv9LCzoH>vO1IfS}F~VXOD;~pd`WD+kV^l0R^yPBH z$cm}I706!pe+Jv8D2U#Oi~d`4=%=2$j~BnEY)*!wLdJP(vI9X0DKx)uaxl3{Epo~< zU)%~AOcf-_>84SAU0aq}>qA{rO8gm5dj(7ZfJ-bF`*=esUYdrTT_v!yveJ6p4fj6n z8Sc}^FNtyBmHr>p6zOZ~N@t9xQ!8028uG+^&*{hB;^#Vn+q&2U z_PaDgpwRzACgHpD7WyMWf%M;i02Hj^5Ih(v<}wPdgzw5}TAz!^xIBROk zfMwduWVuIdO)4DR^cb}T?N1P?9F;bCzI0{rz47i8G~y)5xZ z{PfRfblli>VsZEJ`Y)``eqR$sbH2SAeZ{ds5aa)y*~md$-;hNlgJ$ktRh*emSw8cZ z@u|X|RKf<}$^%pS61e^-0KJ)+o0F+Phus`82SW(TS8=Z_OA)4wKt%~~A;6^SU#vBe zCHvT%TH#$#T4A#q=By)}y>>p;E6RS6HOQ}4eH7HXu|aaW_*|JK!tB)JlSWqy;pYy} zWbEqddieXXO$G7EQyh5CNjfAjlnS!X@r$-?$_M*5_99*S2ORFn`cK z_kIJ}K+o4ASPS0twQ0XA?T* z+!fe5h{z%NoF6$!l_ecmpG11!oz3ce&W4%(1$I?)(6FGKe8)^+gdigQAVbd-XPJ0* z>~fOUMNzCF+jt+#poHoWn(}l!jq^&7$;^J=LqIBrEw_~<2GK4A6q6pG+McvK0BOCB zL^?A7ZqapIe4yJ(1g=Rzi3We=JaS{V{*H>I8@pas+y#POXMU|JOU7yP+6(G)h3Q(f zY_*t4u^Gn_*N?J0Gn&G9Y=i*Xej}v>QeG=)=X1WZx3^#;L`O$|WEhmmzHmFmm~h9n z>`4&N%7K<>=o~!$Uv+OC6xXx03lAPFFc3UJ2KNDiBv^pKEkT1j1PB(~36{YFgy0a| zA-KEigy5dwPH=~BlixY#ec$`ly;b+myDO=pX7Am-yL)x_>b0J=9T{d}zKiO6QRkBQvEUBu-I&q1^mB@jNfI0!ho z0XiRmsLt8&8xSlo1X#wEj25IX%Kwc8c*W5ED4{={3bPRF_f+YW*j^oY>VpXvZHD!_|!2oTHweo#F$ zkjT|$7Gs*5F+iRaEC+D513ZO5$_cal_j5Ju3=Hf2jOowS09H#fO3J$-9t0^1z)TX9 zo}TW&-<2lpIX^#7%&GrA|7OSF-k3XaFrJfN4WOCv1z2!M^xfKDUjkGXC9jztIE^IM z^3r_(A~x+x^N5V2LC#iyx~~<0GXxI+ki`3ol_-E>lY-^`65)%5jlJY~AS^*IDtbR& zp!(pNPy=|~P?6h%aVbb~ZdtYf7F6I&?FsPZ;o9t(nVA995oOJ1W&%tj|1>%e6^8xW(Q*L?Xv#xVQPa`h;UEvFgF4t%9`*oK_I!q+T_RBbhel~#B|Eelr@7?fFaWG zFznf`*!L!Y>1@9*nihZvqRgcK*5L*^*RZA1>|mVXm>P{a(<3aTYzS& ze}C?K|LO1}kl9d)g16@!poN~9nHlFYrE<#i12zJnsRvMRzK8H1U``Ph7JRnvb!arF zpC_1VjKJoO#2lwjY<)^3IO2}6f)WdCMecj!0FW7c*#5c=zdh~ugJCZ4%DM{kT2uo4iY_EoYsO}1R-{>{SFC}v~8om#i>2(FXZMx0kJdL z0yz|Jfv7e!FJOgdR7wHxVVj090kX+OTqa?xxz)4;5-(XMv#AJdgidCpKbKYVLek0jZIJ9*z z=U9kr9;>dkPA@K1wJGxc=3Szcx2w>tWvRK1KODj$GZKo}1NL=f2c9+4&t^y(`wdwv>Ng4GWIiU^Xj z>Npj%=g|LrS4)OXyugopd|6KS7!y0CtOXcV;PuUEKEMnAn{Z?QGT!$x9>CCdVYpI> z2Qs7mt7=wPmmZ9m#E-z+jBPQi<&2M0c}*5OeJ=+M0E#<-$YUWKXf=&ko&3PyU{PTq zKGi&{H;uTXW90@{g6_Y*0h#_$}^NSK+I^KB50oy7K9q`Jp=EHRAo2{k0;d388=oy&m&Z(-RC z08F{GyfjzT^O(&ph-lCJ^SLZD-+`hD&q$QEI)8RkMuFaqmNt`CZp2H2@j?2(RShX9e9LM@ACaZ?LlnHHO2Y7v@?= zT^7K5iS` z!7Z1A>C*0$Wa1Y*^%OoM7v*UyAXnTgY7nT6Ng)VZx{RZYskTawG-vUVCHtDXba6Knn zDAwPh&4Qv41X`0krsP^M&YEhC!592v8wEAhKkFGOZQi>R=1c1u!OYFMeZLjNjE5|YAy2SXeufAKmZ%FYfNH8QZ$X6Z29Kc!?`<$QSoQ*WbcR( zTpMjV254^y4o_fY6=y3LdWJ%||yS$Wad3q=ZuM#%yz2~&YuRhGq5Ec9BS94GTDtvfOJDu!CsS$7MW4ax)O)(eui11z$B?g6 zLS46!a_^@i2 zn9Hq>OeyW02nEpQ>WfR`3eVbNw3_>utY^vqnJTVea`#YNo{XQ@MCf>%lMvABLanI%} z2;}JPeR1GC^QS*N5L#En&zSxg!)+ebfTHx5MKt(#^x& z_vNf*^^A00qaEL=a~s#1ID9?#3Qnrxd7dd^vBeizDc6JqjBE{ft`^$YuLi%-(RMz3 ze_fJNC9TyU*-R{7mfEM(e3qu~$q#m(TD!ge)V-IP-#1;)4R-eNyy{pajKHOsvU$5M z6ClVLH<^~ms;G!}%(z^pC#*FPUEEkVPD*-g2vcw!tPd_bI*GTv+Z`SW zudjWzjbSAXZr={-)t}M#JcAuK1VzV~Va_b?hdIBTsR+a!5qZ?yupAne;&wQ=ljhmw zP*&t>x!AHqoGz+Dbe?QB(rAEk%11RC)Y4>|>={xgY~UuBb_x=74MpK_`6OyG)~i77KB=jq;1 z{mPE(7+!ZwpE(kn!#`!`*#p*8oeg+_plW$N`p3rH{t4Kj`ufNzHDg<`RT2KdtJtE; z>r(2j{icF2Y>e;2h!XbwaR_GGy0Yh*rw`h%V*aP(ao5PRfELx@dVK zRr%zq_*~U9s8mG@lCH(|;eL5`hdm`VxQ};zM1Jq!4-q~Q5p{m!j5!30rcqyW<_E>+ zi#|CEAZ@kJ8%r+7s4r=vJ~LM`Rekj~-enL6%;kW_u43WWDhEXhIwj^I7k0dtjM@S5 zW(>nd@S#~wxoz3RCJlC)Ws2vQaV71n6)_#c2FN|4oGqapZbtPpmNXyPsDFgn{Vd6& zIB8NIDinCA>Pgj2|IDXtr;Q?oqE0=ku@jnR4EX%^$&Z!Jq-r?m}ab$XBJZ$CeN(*61J!oV5GeKSr!a^VLj z)l$)3jZTfoD||_)@j~!i8>LefOyyVm8Q32|IL4m~7G5jtl?ZnQ_KBm1qoaMg_}o%i z9n^PN9pz44bw4KvrZx2n@qiytk-ut#(^u$MwrJ%Ytg?S$sL=Qx$i zc~%;)Zq!S1tMqvVX)Pa1xRl;yOYua67-W5Y)b}%U;tO9PggcgDa3mE7I}#Bxr=GZS zO@DJ5HCum`b%}O=ARgN=^t2~XvwwDOldbsywAx|X1VSrNE;*BBOG0BYt|)T z$NCA?2y&RX{(}3<;^bGCG~^C+ALFYa)L}ZS=E;#pfBp9GZ-(cuCpCXbcO6T3M_yl4 zB0=OE_fz`k%`4BQ_e`xTP6$RzC^OsdZ?F3#0_H^~gTxIW+tugzT;rLoBeAayx%7pm ze1n0VS=FwnWkG2KwVe~T&*l#LGnw5AV7x&l?^v=C;`d~*rkqq-awpzmipFm9m5@Y^ zrvmlI;L9t_KJ!Z8FpKWPfB*Y)N3Q67Z%Qc7R0A2G4Dn_!bal}6F%iE2G(ed%1YS%` z0p_I=KD&E^kU*}eYnGOJ-h7WV{|4Et=WHn_I^p*B5-Q|uG@>gP0X`2O@%V>wREc2%+MOi=lEJupY4P{staAv5uMaFEev#0hjx-x zt*u?xP}B|2rG=6r?k$0Y?bOB@tqHsQF9qGmIZ7*a*j$Wn0#W2^P{Y$d(+DnE?-X$y zpB_H5AHb_jK?pXT%Q#|O%9_6SdrSQ%r<5X%(H$S>62nQya~GDH_W>{MNC?)E%(qA+ z_oy4WEQ=6?@sD~vS8Jzyh5aer*yZ!DDp^g73TfOH)3%;-EHWxcFSm*X2JD>2eY-l= zezRZ!&zgORS=cP5WH#k&T-?H@pt+)py&(=}J=yNUY_ny%nnITNrfbaoVSnYS<7UPD&HFPQ&JugIXLR(i)uyJro63&t z%S0@s=#t!DeqUpYr%&eI$C;o+#~mKk8Vrh77*rbT9NCL42?I(ZB$`>=JAWjt+fk zCsb@+FW?L4?e}mWAE_r-bljRDsRS$Jjzl7zVx^kLrY86$W?h+^v`!W`O5F_-=QS>) zK(@IZCfk!4a5$;yUMURk@i*Ld?XQ(WgK=`|>EqXATV;%uNS;uZ@#~Nt24Kge%c-Ir z_3#8qE{#*%_k>xnXl9#r3C8nKu$~i5Kpn`Gi|8rKct5LaR^7WL-yELym!eHg+706Q z>gn07x)I1j#$|ouvz-jue!eMtp`kx!y86Cro->gs_K#bp-2Tllm&QJ4;kiM%Ewiti zfstaP&}H}T1)!5yhiM#7^j{U3V?070O;Zy1wuAjY}D|kexAs>Y-&2%$LD~_tTUZ^jgHyxs%yD${eg|jk_1t zO|H7b;rTndTh=@G7l$EA5UK*US8Yp8w%g94?QdG!2D-AeaVO{0T&u&Pg}=^_P~pGX zIIThQ?UK2W$woqMm~l|0Cb)LLL1evu+-5BUc)>vEgapZHq_0wJ4=~hU*0T6QDjcs6 zOP5zT(lPdlqTrBD%A}pn9g3={c_nVW7W;yDOgxIwo>`Yg-Z#5j)r8>76W_Vo=Tsam zRH`9(8n58TUIWP5rua3Tv@fp3!th@f9MaFD+;|GF3dy(0lPIV)=(m_pPpp zq}WI!+HBbemm5#Qeskt*r?vO}X{q(R8W7+s6lVwIY_iPqiAFhuOHS8_;!f|kyxx`e zxm)Vk$~Fh#sx#3E2iqOFG&M+!Eej3s$G`V>mR{71XnL-aqcV^<8JoW6VWZ>Ie2iDk zXURHPJ=^I!t@j~hWskVm10aXI-d<1fKTdg9BS%DQp{=}r;9tg%3^5cScGxa@b8FDoHwaQ2!f1kZT(Wl^^| zos7#8g2#ME;DI7fIRx{Y-Ncuwp%t8-mAvmn%Q7#E#>=zh>X6{?Smxz`8C%XH`O~8H za%YTtF7ybY-gNwar86XYlm-c6Fz0$zlqXM-%)Xp3G|~FOwgvyY*Pg%K;yCffQ$ln0 z1WqFDIS$`c&5W#XT|@2XPpG<_M18lLU24wM)aqIsIUL0<{$?5*O@+-F*HVDRB#dP`N-iMW|?nM%~zoq^`s zowqiJfcsp{&?6dfw0ivc_FU2pVsM48#IXPEQ5l+|hWpWEEw>)U5Ixo6)vN`*yKkiL zIWro#Q-QX@M`h5wsajBWU!c2i;ri1D9*S0nIdlu$cGV)@M*ZPy?po;nLO3*Yy&~pi z5#8bGxle|Zy4d)t?TnsdMX+j_VMy0#zgFw(u+E&wfPfWTv{ugNBMOT(eE#LNxB{m9 z$%61{vY#LC)f1?hsI zm&Z!uwdj(xn7X^wsWEMqSB>+g6kDx%nHBNn7UR%BjE%<&uqn>IQZ5XOw3yek`LSJ% z<%x*SGKb14Xl?E-HQeL0T8?XJYI~MjGzdHwGEUQVYp55xzeyRId5<^cB<@+q!Q_y* zHAuME;JC+yje;y)r}~(XsMaHK|C}*$9d1)Z*l8YWv;J}+{!%;Dz-dSu5sTCW0A>Ko zo+-LcHQ*hvTm1VzgwENMQsY4 z=b4W1LT|Z8)RmjlpM7mHa@fI`%@RC+Mo$1Y3*%8u z)1wz!nw<8^G~T(dZxG=(qpPih!~HdLY>Wp)MDuTNS=DXrxQ$MK6?q$}k*=-CmNrJc z?|RBSLAE9z6E|X4t6&);V9csDv+@^+{yLK3O4e>4jfkA$!qQCcM>A$DjH$T}~I#M4YuU z1$W02(@O1KSd$J?m`vR5BGnZoS9@W$k#_xYutYt5$%f5h~+$wE|)}M1bI#_aGgCh~6#kw9&v4S<^>SIQrtG~#FEGBPnnwkuDto3@QcIB9`) zE_pw}ne2ZrM_`la)Q?0aHxHfoVZ5zHd$d})x<(RzBI@)AvDn&g!%h07&b^bMwDJ?U z(wGWz6s2`_wOAKv&0n%gNJ{YQ0_zH}!I20rDTY%?z>*CV?1i=PTbwL1ESSaYw;P(& z&XHRGbTR5HE9`PRyBw`9BnL)=W!8AEeTBVzJMg(;e%*0kgny>VOdDmF1oFjYwfDu! zP;OJc`aaNQN)Id+C7R(b#+^@4Z2PYJ*9d;<^OL%(2rND$d`dR!JO2)P)OB$epRwLl zZuj{BQtmgKgsY(f?^sz07?g|LXc`AomFa({mIAWk&9M94&2;}&hI_mAk8KAFv0D8;vu-aWs9d`mQ5!i`td+vrV;%l)7i(MRm?p!(==HzgtGW7pyn#0+@ zy$@a3UGDdl`s_*5`Hch*n7V#kyhLLbQf!Zj@qBxwy3pZL?skcNhbKrVJ|Ag(_IK<< z;6_a))};PXt!(*r!ffHZ28b5-@PmX!irTmAFyljIq26b1VR4KEVHiH6#PDt(Sgl*w z@F|fl6LEdBa@d4;*A&V6_<26V(s@l121(@JKdcIm8!)QP zq=QuO65UwK>TGV?Sf^n2oWr}tA&c9Is7^W_@Gfz1w9KwFtZ8E10o|?~jOJbDW+Vi# z%|&C*_~G-lIgX>OFk)VEr4Nd{_tirIgJ~Z>BAX@%?AwsOkGV!05aMJ6W$`-y72<@1 zP)y{ui#BKrOlWE4#eN$UN8+S8OIS!57Jh(FF~k+l8GR5Mzo^4Mb&Rh__(Fo64{|wU z)8AS_PQd|$x~ioYaxArG-CgC@`eu;VkhkkL7>tRlROcMM^2srQ^OM_w?U)Adi{A(d zGTVSzG3l&YMtf8Pb?Dk_YaLuvhQ1I)!yxp6QeVjxo2Y#uF0)?q_j=5zGm!v-0z}to>O$#0%1}PzjEYp&kNwi>Zr$HsfvsG$jKRE5`R$XJ7UrBuektEc zgqDEd8)=hMvaE#VpTv@|k*_~$gLBP8qqcoBGy2;I1zE+#VMmXG;4HWvwB09my>0xw zdgZY~5aYUYZ%!I90FH|G*A7y^Jb{5^s2kmtzltoek{CO0B0GY{1Dxap9jh`|YZnLA z0*k&B=jv+enWz`(EfroiY$tILu&Ya9wJddfhRbmKeq4T~>fJ4Se3VTw_L3R|qH33g ziK*SC;SMLwm%UgUm^jP`FNc)c?^9o0@y3RIABi?3>=juYnazJ z$RrKQ6_tcTY)AdrDSIg%j(C8hD<{JT_g5OG{J>kaG)ETS-d?YsBbn&6&@-8jHS*cI z$=Ue$m}*5+Ohuw4^Vc72#p zu|ctN%nQ8MJJx~QOg2vG6)*HomanEF_d}snqXOd+O9=JvdH!%XrW%8AeB4ZHCy3z}FB>0$82!I1*{P=={K(Vi#o}C*~Ujq_M z0XZ|zgwSLAHqw240I$60?Ur&H07U@>1KD6WVUm)!S5vKLLQq?w+mo?#X&44fc-0-W z|MhDpn)PI{tg`aC5XdB`HmR&u3$<9SClp;vuuVtN#zvUVJSXNO#n3IjAi{g9XGZ3! zz(r;8vmOdPAp|^!pg+nMR}^*8s>LTuT0r9Ec)H<6{lP4o%MuxPzoF#(+{I_!t z%NyucVJSLH^^;omKV5Ls4?!Eh>``%8WA9&SePnvg(J*%1&IOU(#N(5Cx~~|?pLXpD z_}xGt1?K#IG|(Rc0@MpI`i?i2J>s_r5K9*Rh#=4tG$!L0f>}gr2+jRzg5iEDT8u@2 z4|e{#SMWVAmo8Y~@tMBh8|O`UDZoUzCfkQD$*%u7223IRQO?egyYufdg0yv` z85!!^LNog&s+5!CrO3+R>0no6mWKCU1}8^~um$%q9X>{2Hw?gaRtU`__Rv6vLK3*h zIGK%G^J|ocP8N)K@{YqZ`oD2{0~XffparMMqo)n~y)ur#RS$m(yGcETAwjz{d42Vqy^M<|G z!o<@XfgN>fS)=x1V|3o*q;_1(7|3Lg_Now5Oe2B z4mSNE-CRW}Tik8JL0Z%gefD#MYrJU6mxP?wkuP;4!bA1PjeW0XwU1~41?Ah&@6>pIr zFZghjzYmIbB&$fA6}$=t8R`NJJh5h<*U#9Ysqo5c-E!OXdT zvey_QyBpS>w;^y3XM?BfCd7GcPq1<^ynUnn7k(CA!is>y;5ZYojuN5*RWd#f!^F!P z+39`~Ex_rLfd|xh3+*Q)=-fEx)S-q{>{L_jk5+35sD6SPUoQJ9X!aU&qLXq$u~C7T z#Cq>*KIBa*R;ZBBXBppu4p9cc^mk*4@OTzK`HesErL(IRJb%i*pAIV|(R^zk@=<1YY-;NjJ~yZ5u@D5( zay+z{Ip1^-JxbL1Y4$D%bWUyy0TgQ{YO#xGj}qd>RDM1^bBQUH_?%?;ZhUD?pFf@O zf}Swllk570&sa+CFNA~O`Hl4_J5gs(=O(1=Y||LGfGDvZcDhHuern%zQ(Tq^MW=3d zo^C8eKD`)z17Yxx@EOQFAfbgKg-voczjgj&TChLolxPu6-nQ`9S1yHw*%4)Imp^?I zd?uK-3-i|$xvH>B*-W2O$0z)J(NpP5wQ`4p(fYlsS5=vReR49bo{y8h>lg|O7nQ+p zqZjaApc?b!+`nA4?`xP+MS;WJylrdvPEzwU>Rnt`N7SDQjfx!iGpc0H`#6(k^hM=2 zHs<+0`bF9CcZovv#`j?pQ|rJ$!<;0PU6TKV+AZ_G|u`08G_p5 zn~SG@QwEcX@3ixsa_4|$0@Q~3QRIcYvEe_H*19)pYR0RC-zme|^T4_UJ?ZlMbq6ZnOXmr+ zh4y1AyYdoUA~KHS-----quVU8%5SaaI|JU61Cth?0M*`PDp}jKqIyL6&*FNp%glTW z^$g9sH40I}eRfWfH`V7=j(wtZH+cx)+)q>U8vs9m5(?d7GbD+*<}UX-3i%VoJBUz5 z{v^g;Rw{lp!w7Z8INy9Kfy1ivrG9y1tGxrs0=ca&2o-7mkuiaYTkAnI;szHn;wre^ z)%Vpxv|6aKwsYKaEhLeW+T_q0bp^u;&`%Asf1nz%L8B3S5xbsr+F#GE&1|JpZ!$H6 z%grVTHA@MQX7Vr(5RFc=5GiZ`f13aFde zk3g|l<{ts|1gp*k1adb~9y?0G@t@~pn z(7fJX%{h_juR1CUWE*Zd^xeDAiH%H3@uUVoMXbPm;4+k>xGy5*vs>JKfeNzc1lBe{ zh5ZLyv?3}72egc*$e=osAF|+wr*mIsBS4_VSHQ{;i}knBPwe-Ayp`wxs0X+be)in6 z04XjUkiGHu3jtjtO#%d+w5I}qep0BwSNp|(rkm?j_SnpEoMX1FO|mnBb*v{blcQ^`qmS>|bIL#-z&p zdVvlSB>=!x7&ORjdVV6nb^yhSy`D8HWgSaVmq}C5xFYmbFJdmy93GKL>inEqBw8@4 zV6r@wPmf$t^^P|uq7Xim4Ipdi8SspLSz;h~d(%TTV-`}%B^!$|e^Aj;>w)vNns+6v{gH2)n( zP4AR1q!+_QqJL!X61RztL1fRNK7oHKor!g+wWz>kOlRjyBvp9Pbn~f6iDa&vj3ydS zikOami(TW#xu(4WAi*9eVF1upfvfEc-`36)DR|Js5k-&5IA}42-^YOw8;iU+W-WQq zM`P_mHb%4X1OFb&eM2_4dVNQFpN6Xat3g?f_g6MG1L<(MM$h1q5Bq(e&v2+sKR2fm zC}H+N5zgk`vH(QQo>AeO^{0&IwW}3ETO_hWTmBs@r{>tSKK5cqs+NVX7Tt2cZzg-J zEV&&jtc6yEUqCn59XmDa>Cr83#wIRg@Z$8oG_q;=+t#EL;`e5Rz;_Mp^K+a>Jqo5xNQ2%eN@*Ao{ z@hq&$`p{YQrjhg0s>ygwwaNRu9S8aTNKMyO?=cw_$w2?=&FA%V`hx{f!N*6#^g0F$ z(dX*4oDpgTUq0lXu39we&wVuz{e?H7L2@v1+YsH@t<&HRfvCEV6qT(}mTu(8#mO<( z@>_{4T>a#T7~S{!n&EaW-*_~L)5Y>-U`EC2MdJOawa)p}abzcP)|r}_dun;FdjsR; zQ8AFUi!P`k>X4Wf9HPYqjxO&vq~|l<_oMa;fhW-0KPA6I^<#d_`)EaTj6}yZo%~Pg zf+jUFnyk5GZwbJd#`SLhWpG{30C&XN*O!hVDZ4hOMC7=g#TNy$>@?`4QGgEl0FrCJ zqW-_JR(q_q)US^Dd+5M=&W0^BaKPZag=1}{wGA}hZCsX&@>O7WDh7;)c4jZJiMeC( z?7a6XW12*JTd%+P!%2}O&RFA|vC|MUxh^$^P-~HeqP-Z#)*5!60j~IA8J78m)3BSS zpJ-)eUp_bMAFC5mCDrVe-~>62^sBEo)tu{^4U^|+!=7XhxJfzDzG8NHdLk8;TbyRG zUJQ=~gA<2s=swE_pr@^Hn%%v7HMiZ&eU7XiKnvlyc*%qo670ZUZEw^i4xzBC z#`8pWfd>{m#_SMa3{_aD6I&B8wqY5WasS5Po6fL5kv*zUC^a;ACkQ&9M@>OP2DLTw zx0gOcF7PtH*K}P zE0#PBp$n~BK)2;lHem5q%DL2Gqp$ z3q!6=40*$d(KEc4T*TPQbod1owKhpwuP^Qkc`>Y>W593L3hDdFtTn@(kT_jM?51oZ z+6_`qdyZvGBV%BYaw_nl2I4DzQ@7L;I^$qbB*Q`pe<%{>+pqN7tL%Kea%|SO7IUu8 z_@Eiv(i_rHK9k!S|CE(DS&CY-7qdTHD0Y<9lVm%nSjzBJm^WBvzG6=-txoAK*X#|2 zUbr}k=vene&zpy zBx6ou{4O;l4W?Q4M7Pu0e7Vgv-+2t{y14QP7krUMuQ*e~zIQE14jm~LqkdDe_)R-? zn0IPwd_q@1ujH1c_D*H4X33nX>F&z5v~MP@sCr1w=eAp6tu00`1SaQFT9Vr5{lZ?8 zVoFirvl z?emH+;f|fS`)clUS2hPC>r8a=s{0-^wYe1)G(3=`zC|^s*MpdGT66lYY~ZYu+?!z? z`Q3oB6q8&q*x=Y%b)DjXUXWW)M|VH0aRBjULNrSSJ4E|ATJNyJ+gbA|i`(tcl#+UF zNN{^E5a9_5=aETojf$4j%B0BENL%$@ns--?%?OJQWSVY|j9HkU6njD)cX5h~+cxy2 z0=Z$-(g@bMIAk#mod^Z~eZkr5hQXTzkPJhQi+%kMBdvdWRTx;)_s7uDOTfHt4`a<^=!zWx zSXftKZ2VxqS4G9*UI<>71>1qnrydq66@0DPAq`08`u5dhV`B}vlV>DSbfUz+J)i>7 zFY8rfkbRWX@b zytPfSJRq{r;ykxFppg^P5rr;*KFdpOxCoB z^NOxa#+m`5U)Dd|&unFH$4{*iC;_s$R z_YDQUss8oFRkH(3%f$W7FMv*v!0iyQD7m|sI`yX6E1|@;SPO~HujCVX25{V0la*?R zWIHwI_SkGlr;%`(KG)@m9Z1B2eh4Zu;si&(-IVV-c7Z_dJam#%v)gUK++Ye8i-LZe zwpiVLACVQ->=u&ujkXK~g8>Vyq;zsQDJ?dR6iC3BlX8Bhb~FA`H1=g8-AdG*|3E6q zgV@AINd4{G-b#6uWiwc|cC(b$t>xMx9-XjgSkwvQ{s*&mi?tLegvWUkmyXO#yP@IA zWN$IG{_6?dny<-4P40liwLH1kMB#IYF>?1jz0KvC-dEm!he~=#MG`KFT;%gNze4L| zAP_6&tGp?!@Hbkmb3*SV99mlHzV!_B1zc>4lBnScG3b4+Fph-7w!?V`u+yzvS|p3o zU-y%h9=aLHKI=~(QgC6@A^q2M66pPomBanx^aa}=A`F=)$IC03x;B=35Brxb(@b+w z_JJ(N*H$gKt}~iMP&=$?_@zwV)A9uHjbW#jd0$b$ggMPewda3M-}-*>ZeQ^G8?3;5 zB1Za!&SAy;dU0MNsp0`ZtMI=ksqYrqezVmE)DIG06oMHNEnd0W}5i-!ua9x*loocA+=-`ED6?FNwY3?4hDgzeoRryMN zgCw&(=;G#bzX1#0Q>X#auAbLxf9+8COzv|=`X zorgSOoedU7GTavThqhy8f54O|d1^rvf?l+C6wKsj2Cs98 z%=dMOpO`nNA@@Q_|NR|_r*Cm`a%3!}1v_No8-GJOiv6c==zx$*bvaD5Rhzs6?8@ti|r4T~am{IZbmxxtq z-{5U=Q-8DkFy3p}h%vmV%yOIa<*!2JiKqtiSCkp};3c({Gc0y;#o>H|2mjzNrS>Z{ z0DBC8cK=LE^TbGyt;D}*#Hvlp)K#SYb<$z<9j}!-Y zHb&Wn=uUA2tIsjs-~d{fjY{Ug=;*q~IW;-)uC;&ZP(QJZV8QygEnqzio4o6 z!=iS9hIIf+vo31$OO%~SFh<8W5Y}E8n8#1=P|rE;miFM&vA0vKdpIgD;|ebkpkR zlX$Y5m8m=yGK*({^|_M(&_JB)7Yr!H&l9_L3d@IZpK0bDKR zqGo_5_o2bA53xOd=bx$DQo;EHZnAMkl}UoOCs1Qc>K*M7kiA95f5{XIsEtAf|CbU$ zC|x^~;KP?44!#NSs|H%Nn6M6T>_VfBuz*r&{na0Sl6WwR;69jaehEK#%>Ks@faenQ zhw^Xe)A!H^sRc}Y|FjV(7nI9UZ2VvMlYzW(fV1Oa^dCHm{pgji9&SDa$2>F=h&_7S zhxJhH!_fV$1t>z5M1$);_x}lC@w3JN`SCyW4RCS=lwH843bY4sr;7a}U;il(xUZo1 z@Xp^42jZXp_5soqaOAZE3_`%=2Wb01zdaPzmhJy{0R{i3Nx=PthKGQzHqZZ7Jh1fw zU-w`s`seEW+duypjbJ~J{`E9)4_E^pj97o$`Y+Sd|Hyl8 z>!Eks;QyAMhhAW&ei)|z>UF+^hog?n?^%Fj02dGd=*(YJCvDKbhXHu!K~SKO|JK!p z{|L~3RrFVYpep~d`6>MWiY+iCLV2k9e>;5hE#4HBuYld3Sr?GnzikG(D);4Iq5N;A zJJ^5547mN@N8uld`){u^5Piu2+6GwU|7Gj@w~z0Ck>dY|M8f;O&Wh-c>VGEDgV2!y z$!)@sIRH+c#X3Bycn~ykdhZOt4PReexKRRMKsvNHSG(sT2!7~6DBHu={=J|=50m5X i<@Xzy5dW|KdF#vSpzkXgPFwxZ0$E8VSgE+7|NjU3-D`^g literal 0 HcmV?d00001 From c50598bc86726978eafba650c767968e05613a22 Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Tue, 21 Nov 2023 16:06:55 +0200 Subject: [PATCH 4/8] gpu: enable monitoring for the default installations Signed-off-by: Tuomas Katila --- .../overlays/fractional_resources/add-args.yaml | 1 + .../overlays/nfd_labeled_nodes/add-args.yaml | 12 ++++++++++++ .../overlays/nfd_labeled_nodes/kustomization.yaml | 1 + .../samples/deviceplugin_v1_gpudeviceplugin.yaml | 1 + 4 files changed, 15 insertions(+) create mode 100644 deployments/gpu_plugin/overlays/nfd_labeled_nodes/add-args.yaml diff --git a/deployments/gpu_plugin/overlays/fractional_resources/add-args.yaml b/deployments/gpu_plugin/overlays/fractional_resources/add-args.yaml index a438bab4c..033f5ff00 100644 --- a/deployments/gpu_plugin/overlays/fractional_resources/add-args.yaml +++ b/deployments/gpu_plugin/overlays/fractional_resources/add-args.yaml @@ -10,3 +10,4 @@ spec: args: - "-shared-dev-num=300" - "-resource-manager" + - "-enable-monitoring" diff --git a/deployments/gpu_plugin/overlays/nfd_labeled_nodes/add-args.yaml b/deployments/gpu_plugin/overlays/nfd_labeled_nodes/add-args.yaml new file mode 100644 index 000000000..999a6622e --- /dev/null +++ b/deployments/gpu_plugin/overlays/nfd_labeled_nodes/add-args.yaml @@ -0,0 +1,12 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: intel-gpu-plugin +spec: + template: + spec: + containers: + - name: intel-gpu-plugin + args: + - "-enable-monitoring" + - "-v=2" diff --git a/deployments/gpu_plugin/overlays/nfd_labeled_nodes/kustomization.yaml b/deployments/gpu_plugin/overlays/nfd_labeled_nodes/kustomization.yaml index 38178d290..b0ea98bea 100644 --- a/deployments/gpu_plugin/overlays/nfd_labeled_nodes/kustomization.yaml +++ b/deployments/gpu_plugin/overlays/nfd_labeled_nodes/kustomization.yaml @@ -2,3 +2,4 @@ resources: - ../../base patches: - path: add-nodeselector-intel-gpu.yaml + - path: add-args.yaml diff --git a/deployments/operator/samples/deviceplugin_v1_gpudeviceplugin.yaml b/deployments/operator/samples/deviceplugin_v1_gpudeviceplugin.yaml index f40706026..d120d7187 100644 --- a/deployments/operator/samples/deviceplugin_v1_gpudeviceplugin.yaml +++ b/deployments/operator/samples/deviceplugin_v1_gpudeviceplugin.yaml @@ -6,5 +6,6 @@ spec: image: intel/intel-gpu-plugin:0.28.0 sharedDevNum: 10 logLevel: 4 + enableMonitoring: true nodeSelector: intel.feature.node.kubernetes.io/gpu: "true" From f1f1c11534abb20f45891c36edf352b5f258767c Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Mon, 4 Dec 2023 15:20:58 +0200 Subject: [PATCH 5/8] codeql: fix issues in labeler code Signed-off-by: Tuomas Katila --- cmd/gpu_plugin/gpu_plugin.go | 2 +- cmd/gpu_plugin/gpu_plugin_test.go | 2 +- .../rm/gpu_plugin_resource_manager.go | 10 ++++++--- .../rm/gpu_plugin_resource_manager_test.go | 10 ++++----- cmd/internal/labeler/labeler.go | 11 +++++----- cmd/internal/labeler/labeler_test.go | 21 +++++++++++++++++++ 6 files changed, 41 insertions(+), 15 deletions(-) diff --git a/cmd/gpu_plugin/gpu_plugin.go b/cmd/gpu_plugin/gpu_plugin.go index 6f1ad4018..e689a40fc 100644 --- a/cmd/gpu_plugin/gpu_plugin.go +++ b/cmd/gpu_plugin/gpu_plugin.go @@ -436,7 +436,7 @@ func (dp *devicePlugin) scan() (dpapi.DeviceTree, error) { devTree := dpapi.NewDeviceTree() rmDevInfos := rm.NewDeviceInfoMap() - tileCounts := []uint64{} + tileCounts := []int{} for _, f := range files { var nodes []pluginapi.DeviceSpec diff --git a/cmd/gpu_plugin/gpu_plugin_test.go b/cmd/gpu_plugin/gpu_plugin_test.go index 0277a089f..baa5f79e1 100644 --- a/cmd/gpu_plugin/gpu_plugin_test.go +++ b/cmd/gpu_plugin/gpu_plugin_test.go @@ -61,7 +61,7 @@ func (m *mockResourceManager) GetPreferredFractionalAllocation(*v1beta1.Preferre return &v1beta1.PreferredAllocationResponse{}, &dpapi.UseDefaultMethodError{} } -func (m *mockResourceManager) SetTileCountPerCard(counts []uint64) { +func (m *mockResourceManager) SetTileCountPerCard(counts []int) { } func createTestFiles(root string, devfsdirs, sysfsdirs []string, sysfsfiles map[string][]byte) (string, string, error) { diff --git a/cmd/gpu_plugin/rm/gpu_plugin_resource_manager.go b/cmd/gpu_plugin/rm/gpu_plugin_resource_manager.go index 265fabdd6..04def4642 100644 --- a/cmd/gpu_plugin/rm/gpu_plugin_resource_manager.go +++ b/cmd/gpu_plugin/rm/gpu_plugin_resource_manager.go @@ -105,7 +105,7 @@ type ResourceManager interface { CreateFractionalResourceResponse(*pluginapi.AllocateRequest) (*pluginapi.AllocateResponse, error) GetPreferredFractionalAllocation(*pluginapi.PreferredAllocationRequest) (*pluginapi.PreferredAllocationResponse, error) SetDevInfos(DeviceInfoMap) - SetTileCountPerCard(counts []uint64) + SetTileCountPerCard(counts []int) } type containerAssignments struct { @@ -751,7 +751,7 @@ func (rm *resourceManager) SetDevInfos(deviceInfos DeviceInfoMap) { rm.deviceInfos = deviceInfos } -func (rm *resourceManager) SetTileCountPerCard(counts []uint64) { +func (rm *resourceManager) SetTileCountPerCard(counts []int) { if len(counts) == 0 { return } @@ -765,9 +765,13 @@ func (rm *resourceManager) SetTileCountPerCard(counts []uint64) { return } + if minCount < 1 { + return + } + rm.mutex.Lock() defer rm.mutex.Unlock() - rm.tileCountPerCard = maxCount + rm.tileCountPerCard = uint64(maxCount) } func (rm *resourceManager) createAllocateResponse(deviceIds []string, tileAffinityMask string) (*pluginapi.AllocateResponse, error) { diff --git a/cmd/gpu_plugin/rm/gpu_plugin_resource_manager_test.go b/cmd/gpu_plugin/rm/gpu_plugin_resource_manager_test.go index ae8038da3..b38486f93 100644 --- a/cmd/gpu_plugin/rm/gpu_plugin_resource_manager_test.go +++ b/cmd/gpu_plugin/rm/gpu_plugin_resource_manager_test.go @@ -419,7 +419,7 @@ func TestCreateFractionalResourceResponse(t *testing.T) { for _, tCase := range testCases { rm := newMockResourceManager(tCase.pods) - rm.SetTileCountPerCard([]uint64{1}) + rm.SetTileCountPerCard([]int{1}) _, perr := rm.GetPreferredFractionalAllocation(&v1beta1.PreferredAllocationRequest{ ContainerRequests: tCase.prefContainerRequests, @@ -501,7 +501,7 @@ func TestCreateFractionalResourceResponseWithOneCardTwoTiles(t *testing.T) { } rm := newMockResourceManager(tCase.pods) - rm.SetTileCountPerCard([]uint64{2}) + rm.SetTileCountPerCard([]int{2}) _, perr := rm.GetPreferredFractionalAllocation(&v1beta1.PreferredAllocationRequest{ ContainerRequests: tCase.prefContainerRequests, @@ -574,7 +574,7 @@ func TestCreateFractionalResourceResponseWithTwoCardsOneTile(t *testing.T) { } rm := newMockResourceManager(tCase.pods) - rm.SetTileCountPerCard([]uint64{5}) + rm.SetTileCountPerCard([]int{5}) _, perr := rm.GetPreferredFractionalAllocation(&v1beta1.PreferredAllocationRequest{ ContainerRequests: tCase.prefContainerRequests, @@ -652,7 +652,7 @@ func TestCreateFractionalResourceResponseWithThreeCardsTwoTiles(t *testing.T) { } rm := newMockResourceManager(tCase.pods) - rm.SetTileCountPerCard([]uint64{5}) + rm.SetTileCountPerCard([]int{5}) _, perr := rm.GetPreferredFractionalAllocation(&v1beta1.PreferredAllocationRequest{ ContainerRequests: tCase.prefContainerRequests, @@ -747,7 +747,7 @@ func TestCreateFractionalResourceResponseWithMultipleContainersTileEach(t *testi } rm := newMockResourceManager(tCase.pods) - rm.SetTileCountPerCard([]uint64{2}) + rm.SetTileCountPerCard([]int{2}) _, perr := rm.GetPreferredFractionalAllocation(&v1beta1.PreferredAllocationRequest{ ContainerRequests: properPrefContainerRequests, diff --git a/cmd/internal/labeler/labeler.go b/cmd/internal/labeler/labeler.go index 26dceee70..4a026fcba 100644 --- a/cmd/internal/labeler/labeler.go +++ b/cmd/internal/labeler/labeler.go @@ -16,6 +16,7 @@ package labeler import ( "fmt" + "math" "os" "os/signal" "path" @@ -183,7 +184,7 @@ func GetMemoryAmount(sysfsDrmDir, gpuName string, numTiles uint64) uint64 { } // GetTileCount reads the tile count. -func GetTileCount(sysfsDrmDir, gpuName string) (numTiles uint64) { +func GetTileCount(sysfsDrmDir, gpuName string) int { filePath := filepath.Join(sysfsDrmDir, gpuName, "gt/gt*") files, _ := filepath.Glob(filePath) @@ -192,7 +193,7 @@ func GetTileCount(sysfsDrmDir, gpuName string) (numTiles uint64) { return 1 } - return uint64(len(files)) + return len(files) } // GetNumaNode reads the cards numa node. @@ -206,7 +207,7 @@ func GetNumaNode(sysfsDrmDir, gpuName string) int { } numa, err := strconv.ParseInt(strings.TrimSpace(string(data)), 10, 64) - if err != nil { + if err != nil || numa > math.MaxInt { klog.Warning("Can't convert numa_node: ", err) return -1 } @@ -289,9 +290,9 @@ func (l *labeler) createLabels() error { } numTiles := GetTileCount(l.sysfsDRMDir, gpuName) - tileCount += int(numTiles) + tileCount += numTiles - memoryAmount := GetMemoryAmount(l.sysfsDRMDir, gpuName, numTiles) + memoryAmount := GetMemoryAmount(l.sysfsDRMDir, gpuName, uint64(numTiles)) gpuNumList = append(gpuNumList, gpuName[4:]) // get numa node of the GPU diff --git a/cmd/internal/labeler/labeler_test.go b/cmd/internal/labeler/labeler_test.go index 9833eabe7..9a69c49d7 100644 --- a/cmd/internal/labeler/labeler_test.go +++ b/cmd/internal/labeler/labeler_test.go @@ -520,6 +520,27 @@ func getTestCases() []testcase { "gpu.intel.com/tiles": "27", }, }, + { + sysfsdirs: []string{ + "card1/device/drm/card1", + "card1/gt/gt0", + }, + sysfsfiles: map[string][]byte{ + "card1/device/vendor": []byte("0x8086"), + "card1/lmem_total_bytes": []byte("8000"), + "card1/device/numa_node": []byte("18446744073709551615"), // max int 64 + }, + name: "invalid numa node is not processed", + memoryOverride: 16000000000, + expectedRetval: nil, + expectedLabels: labelMap{ + "gpu.intel.com/millicores": "1000", + "gpu.intel.com/memory.max": "8000", + "gpu.intel.com/gpu-numbers": "1", + "gpu.intel.com/cards": "card1", + "gpu.intel.com/tiles": "1", + }, + }, } } From 65f996a74233a552a8a92ca60f5312266cfe7d4a Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Mon, 4 Dec 2023 15:44:49 +0200 Subject: [PATCH 6/8] workflow: run codeql for PRs and ignore actions for doc changes Signed-off-by: Tuomas Katila --- .github/workflows/ci.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 43bcbcffc..3603a124e 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -7,6 +7,9 @@ on: branches: - main - 'release-*' + # ignore PRs with only documentation changes + paths-ignore: + - '**/*.md' permissions: contents: read @@ -23,6 +26,13 @@ jobs: validate: uses: "./.github/workflows/lib-validate.yaml" + codeql: + permissions: + actions: read + contents: read + security-events: write + uses: "./.github/workflows/lib-codeql.yaml" + build: needs: - trivy From bf2bf8bc3a575bcd8d781c44cdc80329dc4fbb73 Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Mon, 4 Dec 2023 15:51:38 +0200 Subject: [PATCH 7/8] ignore most flows Signed-off-by: Tuomas Katila --- .github/workflows/ci.yaml | 22 +++++++++++----------- .github/workflows/devel.yaml | 34 +++++++++++++++++----------------- 2 files changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3603a124e..190fd82de 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -23,8 +23,8 @@ jobs: security-events: write uses: "./.github/workflows/lib-trivy.yaml" - validate: - uses: "./.github/workflows/lib-validate.yaml" +# validate: +# uses: "./.github/workflows/lib-validate.yaml" codeql: permissions: @@ -33,13 +33,13 @@ jobs: security-events: write uses: "./.github/workflows/lib-codeql.yaml" - build: - needs: - - trivy - - validate - uses: "./.github/workflows/lib-build.yaml" +# build: +# needs: +# - trivy +# - validate +# uses: "./.github/workflows/lib-build.yaml" - e2e: - needs: - - build - uses: "./.github/workflows/lib-e2e.yaml" +# e2e: +# needs: +# - build +# uses: "./.github/workflows/lib-e2e.yaml" diff --git a/.github/workflows/devel.yaml b/.github/workflows/devel.yaml index cf5bb5a40..98771224c 100644 --- a/.github/workflows/devel.yaml +++ b/.github/workflows/devel.yaml @@ -18,8 +18,8 @@ jobs: with: upload-to-github-security-tab: true - validate: - uses: "./.github/workflows/lib-validate.yaml" +# validate: +# uses: "./.github/workflows/lib-validate.yaml" codeql: permissions: @@ -35,21 +35,21 @@ jobs: security-events: write uses: "./.github/workflows/lib-scorecard.yaml" - build: - needs: - - validate - - trivy - uses: "./.github/workflows/lib-build.yaml" +# build: +# needs: +# - validate +# - trivy +# uses: "./.github/workflows/lib-build.yaml" - e2e: - needs: - - build - uses: "./.github/workflows/lib-e2e.yaml" +# e2e: +# needs: +# - build +# uses: "./.github/workflows/lib-e2e.yaml" # devel image push - publish: - needs: - - e2e - - build - uses: "./.github/workflows/lib-publish.yaml" - secrets: inherit +# publish: +# needs: +# - e2e +# - build +# uses: "./.github/workflows/lib-publish.yaml" +# secrets: inherit From 8f5f8893666771c1d5ce846082803a7ae5e9c2b8 Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Mon, 4 Dec 2023 16:06:39 +0200 Subject: [PATCH 8/8] one more Signed-off-by: Tuomas Katila --- cmd/internal/labeler/labeler.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cmd/internal/labeler/labeler.go b/cmd/internal/labeler/labeler.go index 4a026fcba..b23d2865d 100644 --- a/cmd/internal/labeler/labeler.go +++ b/cmd/internal/labeler/labeler.go @@ -306,7 +306,9 @@ func (l *labeler) createLabels() error { numaMapping[numaNode] = numaList } - l.labels.addNumericLabel(labelNamespace+"memory.max", int64(memoryAmount)) + if memoryAmount < math.MaxInt64 { + l.labels.addNumericLabel(labelNamespace+"memory.max", int64(memoryAmount)) + } } gpuCount := len(gpuNumList)