From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Garnier Date: Wed, 4 Oct 2017 14:19:46 -0700 Message-Id: <20171004212003.28296-11-thgarnie@google.com> In-Reply-To: <20171004212003.28296-1-thgarnie@google.com> References: <20171004212003.28296-1-thgarnie@google.com> Subject: [kernel-hardening] [RFC v3 10/27] x86/boot/64: Adapt assembly for PIE support To: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Thomas Garnier , Arnd Bergmann , Kees Cook , Matthias Kaehlcke , Tom Lendacky , Andy Lutomirski , "Kirill A . Shutemov" , Borislav Petkov , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Juergen Gross , Chris Wright , Alok Kataria , Rusty Russell , Tejun Heo , Christoph Lameter , Boris Ostrovsky , Alexey Dobriyan , Andrew Morton , Paul Gortmaker , Chris Metcalf , "Paul E . McKenney" , Nicolas Pitre , Borislav Petkov , "Luis R . Rodriguez" , Greg Kroah-Hartman , Christopher Li , Steven Rostedt , Jason Baron , Dou Liyang , "Rafael J . Wysocki" , Mika Westerberg , Lukas Wunner , Masahiro Yamada , Alexei Starovoitov , Daniel Borkmann , Markus Trippelsdorf , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Joerg Roedel , Rik van Riel , David Howells , Ard Biesheuvel , Waiman Long , Kyle Huey , Andrey Ryabinin , Jonathan Corbet , Matthew Wilcox , Michal Hocko , Peter Foley , Paul Bolle , Jiri Kosina , Rob Landley , "H . J . Lu" , Baoquan He , =?UTF-8?q?Jan=20H=20=2E=20Sch=C3=B6nherr?= , Daniel Micay Cc: x86@kernel.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org, virtualization@lists.linux-foundation.org, xen-devel@lists.xenproject.org, linux-arch@vger.kernel.org, linux-sparse@vger.kernel.org, kvm@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com List-ID: Change the assembly code to use only relative references of symbols for the kernel to be PIE compatible. Early at boot, the kernel is mapped at a temporary address while preparing the page table. To know the changes needed for the page table with KASLR, the boot code calculate the difference between the expected address of the kernel and the one chosen by KASLR. It does not work with PIE because all symbols in code are relatives. Instead of getting the future relocated virtual address, you will get the current temporary mapping. The solution is using global variables that will be relocated as expected. Position Independent Executable (PIE) support will allow to extended the KASLR randomization range below the -2G memory limit. Signed-off-by: Thomas Garnier --- arch/x86/kernel/head_64.S | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S index 42e32c2e51bb..32d1899f48df 100644 --- a/arch/x86/kernel/head_64.S +++ b/arch/x86/kernel/head_64.S @@ -86,8 +86,21 @@ startup_64: popq %rsi /* Form the CR3 value being sure to include the CR3 modifier */ - addq $(early_top_pgt - __START_KERNEL_map), %rax + addq _early_top_pgt_offset(%rip), %rax jmp 1f + + /* + * Position Independent Code takes only relative references in code + * meaning a global variable address is relative to RIP and not its + * future virtual address. Global variables can be used instead as they + * are still relocated on the expected kernel mapping address. + */ + .align 8 +_early_top_pgt_offset: + .quad early_top_pgt - __START_KERNEL_map +_init_top_offset: + .quad init_top_pgt - __START_KERNEL_map + ENTRY(secondary_startup_64) UNWIND_HINT_EMPTY /* @@ -116,7 +129,7 @@ ENTRY(secondary_startup_64) popq %rsi /* Form the CR3 value being sure to include the CR3 modifier */ - addq $(init_top_pgt - __START_KERNEL_map), %rax + addq _init_top_offset(%rip), %rax 1: /* Enable PAE mode, PGE and LA57 */ @@ -131,7 +144,7 @@ ENTRY(secondary_startup_64) movq %rax, %cr3 /* Ensure I am executing from virtual addresses */ - movq $1f, %rax + movabs $1f, %rax jmp *%rax 1: UNWIND_HINT_EMPTY @@ -230,11 +243,12 @@ ENTRY(secondary_startup_64) * REX.W + FF /5 JMP m16:64 Jump far, absolute indirect, * address given in m16:64. */ - pushq $.Lafter_lret # put return address on stack for unwinder + leaq .Lafter_lret(%rip), %rax + pushq %rax # put return address on stack for unwinder xorq %rbp, %rbp # clear frame pointer - movq initial_code(%rip), %rax + leaq initial_code(%rip), %rax pushq $__KERNEL_CS # set correct cs - pushq %rax # target address in negative space + pushq (%rax) # target address in negative space lretq .Lafter_lret: END(secondary_startup_64) -- 2.14.2.920.gcf0c67979c-goog From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Garnier Subject: [RFC v3 10/27] x86/boot/64: Adapt assembly for PIE support Date: Wed, 4 Oct 2017 14:19:46 -0700 Message-ID: <20171004212003.28296-11-thgarnie@google.com> References: <20171004212003.28296-1-thgarnie@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: <20171004212003.28296-1-thgarnie@google.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" To: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Thomas Garnier , Arnd Bergmann , Kees Cook , Matthias Kaehlcke , Tom Lendacky , Andy Lutomirski , "Kirill A . Shutemov" , Borislav Petkov , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Juergen Gross , Chris Wright , Alok Kataria , Rusty Russell , Tejun Heo , Christoph Lameter Bor Cc: linux-arch@vger.kernel.org, kvm@vger.kernel.org, linux-pm@vger.kernel.org, x86@kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org, linux-sparse@vger.kernel.org, linux-crypto@vger.kernel.org, kernel-hardening@lists.openwall.com, xen-devel@lists.xenproject.org List-Id: linux-arch.vger.kernel.org Q2hhbmdlIHRoZSBhc3NlbWJseSBjb2RlIHRvIHVzZSBvbmx5IHJlbGF0aXZlIHJlZmVyZW5jZXMg b2Ygc3ltYm9scyBmb3IgdGhlCmtlcm5lbCB0byBiZSBQSUUgY29tcGF0aWJsZS4KCkVhcmx5IGF0 IGJvb3QsIHRoZSBrZXJuZWwgaXMgbWFwcGVkIGF0IGEgdGVtcG9yYXJ5IGFkZHJlc3Mgd2hpbGUg cHJlcGFyaW5nCnRoZSBwYWdlIHRhYmxlLiBUbyBrbm93IHRoZSBjaGFuZ2VzIG5lZWRlZCBmb3Ig dGhlIHBhZ2UgdGFibGUgd2l0aCBLQVNMUiwKdGhlIGJvb3QgY29kZSBjYWxjdWxhdGUgdGhlIGRp ZmZlcmVuY2UgYmV0d2VlbiB0aGUgZXhwZWN0ZWQgYWRkcmVzcyBvZiB0aGUKa2VybmVsIGFuZCB0 aGUgb25lIGNob3NlbiBieSBLQVNMUi4gSXQgZG9lcyBub3Qgd29yayB3aXRoIFBJRSBiZWNhdXNl IGFsbApzeW1ib2xzIGluIGNvZGUgYXJlIHJlbGF0aXZlcy4gSW5zdGVhZCBvZiBnZXR0aW5nIHRo ZSBmdXR1cmUgcmVsb2NhdGVkCnZpcnR1YWwgYWRkcmVzcywgeW91IHdpbGwgZ2V0IHRoZSBjdXJy ZW50IHRlbXBvcmFyeSBtYXBwaW5nLiBUaGUgc29sdXRpb24KaXMgdXNpbmcgZ2xvYmFsIHZhcmlh YmxlcyB0aGF0IHdpbGwgYmUgcmVsb2NhdGVkIGFzIGV4cGVjdGVkLgoKUG9zaXRpb24gSW5kZXBl bmRlbnQgRXhlY3V0YWJsZSAoUElFKSBzdXBwb3J0IHdpbGwgYWxsb3cgdG8gZXh0ZW5kZWQgdGhl CktBU0xSIHJhbmRvbWl6YXRpb24gcmFuZ2UgYmVsb3cgdGhlIC0yRyBtZW1vcnkgbGltaXQuCgpT aWduZWQtb2ZmLWJ5OiBUaG9tYXMgR2FybmllciA8dGhnYXJuaWVAZ29vZ2xlLmNvbT4KLS0tCiBh cmNoL3g4Ni9rZXJuZWwvaGVhZF82NC5TIHwgMjYgKysrKysrKysrKysrKysrKysrKystLS0tLS0K IDEgZmlsZSBjaGFuZ2VkLCAyMCBpbnNlcnRpb25zKCspLCA2IGRlbGV0aW9ucygtKQoKZGlmZiAt LWdpdCBhL2FyY2gveDg2L2tlcm5lbC9oZWFkXzY0LlMgYi9hcmNoL3g4Ni9rZXJuZWwvaGVhZF82 NC5TCmluZGV4IDQyZTMyYzJlNTFiYi4uMzJkMTg5OWY0OGRmIDEwMDY0NAotLS0gYS9hcmNoL3g4 Ni9rZXJuZWwvaGVhZF82NC5TCisrKyBiL2FyY2gveDg2L2tlcm5lbC9oZWFkXzY0LlMKQEAgLTg2 LDggKzg2LDIxIEBAIHN0YXJ0dXBfNjQ6CiAJcG9wcQklcnNpCiAKIAkvKiBGb3JtIHRoZSBDUjMg dmFsdWUgYmVpbmcgc3VyZSB0byBpbmNsdWRlIHRoZSBDUjMgbW9kaWZpZXIgKi8KLQlhZGRxCSQo ZWFybHlfdG9wX3BndCAtIF9fU1RBUlRfS0VSTkVMX21hcCksICVyYXgKKwlhZGRxICAgIF9lYXJs eV90b3BfcGd0X29mZnNldCglcmlwKSwgJXJheAogCWptcCAxZgorCisJLyoKKwkgKiBQb3NpdGlv biBJbmRlcGVuZGVudCBDb2RlIHRha2VzIG9ubHkgcmVsYXRpdmUgcmVmZXJlbmNlcyBpbiBjb2Rl CisJICogbWVhbmluZyBhIGdsb2JhbCB2YXJpYWJsZSBhZGRyZXNzIGlzIHJlbGF0aXZlIHRvIFJJ UCBhbmQgbm90IGl0cworCSAqIGZ1dHVyZSB2aXJ0dWFsIGFkZHJlc3MuIEdsb2JhbCB2YXJpYWJs ZXMgY2FuIGJlIHVzZWQgaW5zdGVhZCBhcyB0aGV5CisJICogYXJlIHN0aWxsIHJlbG9jYXRlZCBv biB0aGUgZXhwZWN0ZWQga2VybmVsIG1hcHBpbmcgYWRkcmVzcy4KKwkgKi8KKwkuYWxpZ24gOAor X2Vhcmx5X3RvcF9wZ3Rfb2Zmc2V0OgorCS5xdWFkIGVhcmx5X3RvcF9wZ3QgLSBfX1NUQVJUX0tF Uk5FTF9tYXAKK19pbml0X3RvcF9vZmZzZXQ6CisJLnF1YWQgaW5pdF90b3BfcGd0IC0gX19TVEFS VF9LRVJORUxfbWFwCisKIEVOVFJZKHNlY29uZGFyeV9zdGFydHVwXzY0KQogCVVOV0lORF9ISU5U X0VNUFRZCiAJLyoKQEAgLTExNiw3ICsxMjksNyBAQCBFTlRSWShzZWNvbmRhcnlfc3RhcnR1cF82 NCkKIAlwb3BxCSVyc2kKIAogCS8qIEZvcm0gdGhlIENSMyB2YWx1ZSBiZWluZyBzdXJlIHRvIGlu Y2x1ZGUgdGhlIENSMyBtb2RpZmllciAqLwotCWFkZHEJJChpbml0X3RvcF9wZ3QgLSBfX1NUQVJU X0tFUk5FTF9tYXApLCAlcmF4CisJYWRkcSAgICBfaW5pdF90b3Bfb2Zmc2V0KCVyaXApLCAlcmF4 CiAxOgogCiAJLyogRW5hYmxlIFBBRSBtb2RlLCBQR0UgYW5kIExBNTcgKi8KQEAgLTEzMSw3ICsx NDQsNyBAQCBFTlRSWShzZWNvbmRhcnlfc3RhcnR1cF82NCkKIAltb3ZxCSVyYXgsICVjcjMKIAog CS8qIEVuc3VyZSBJIGFtIGV4ZWN1dGluZyBmcm9tIHZpcnR1YWwgYWRkcmVzc2VzICovCi0JbW92 cQkkMWYsICVyYXgKKwltb3ZhYnMgICQxZiwgJXJheAogCWptcAkqJXJheAogMToKIAlVTldJTkRf SElOVF9FTVBUWQpAQCAtMjMwLDExICsyNDMsMTIgQEAgRU5UUlkoc2Vjb25kYXJ5X3N0YXJ0dXBf NjQpCiAJICoJUkVYLlcgKyBGRiAvNSBKTVAgbTE2OjY0IEp1bXAgZmFyLCBhYnNvbHV0ZSBpbmRp cmVjdCwKIAkgKgkJYWRkcmVzcyBnaXZlbiBpbiBtMTY6NjQuCiAJICovCi0JcHVzaHEJJC5MYWZ0 ZXJfbHJldAkjIHB1dCByZXR1cm4gYWRkcmVzcyBvbiBzdGFjayBmb3IgdW53aW5kZXIKKwlsZWFx CS5MYWZ0ZXJfbHJldCglcmlwKSwgJXJheAorCXB1c2hxCSVyYXgJCSMgcHV0IHJldHVybiBhZGRy ZXNzIG9uIHN0YWNrIGZvciB1bndpbmRlcgogCXhvcnEJJXJicCwgJXJicAkjIGNsZWFyIGZyYW1l IHBvaW50ZXIKLQltb3ZxCWluaXRpYWxfY29kZSglcmlwKSwgJXJheAorCWxlYXEJaW5pdGlhbF9j b2RlKCVyaXApLCAlcmF4CiAJcHVzaHEJJF9fS0VSTkVMX0NTCSMgc2V0IGNvcnJlY3QgY3MKLQlw dXNocQklcmF4CQkjIHRhcmdldCBhZGRyZXNzIGluIG5lZ2F0aXZlIHNwYWNlCisJcHVzaHEJKCVy YXgpCQkjIHRhcmdldCBhZGRyZXNzIGluIG5lZ2F0aXZlIHNwYWNlCiAJbHJldHEKIC5MYWZ0ZXJf bHJldDoKIEVORChzZWNvbmRhcnlfc3RhcnR1cF82NCkKLS0gCjIuMTQuMi45MjAuZ2NmMGM2Nzk3 OWMtZ29vZwoKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Clhlbi1kZXZlbCBtYWlsaW5nIGxpc3QKWGVuLWRldmVsQGxpc3RzLnhlbi5vcmcKaHR0cHM6Ly9s aXN0cy54ZW4ub3JnL3hlbi1kZXZlbAo= From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Garnier Subject: [RFC v3 10/27] x86/boot/64: Adapt assembly for PIE support Date: Wed, 4 Oct 2017 14:19:46 -0700 Message-ID: <20171004212003.28296-11-thgarnie@google.com> References: <20171004212003.28296-1-thgarnie@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Cc: linux-arch@vger.kernel.org, kvm@vger.kernel.org, linux-pm@vger.kernel.org, x86@kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org, linux-sparse@vger.kernel.org, linux-crypto@vger.kernel.org, kernel-hardening@lists.openwall.com, xen-devel@lists.xenproject.org To: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Thomas Garnier , Arnd Bergmann , Kees Cook , Matthias Kaehlcke , Tom Lendacky , Andy Lutomirski , "Kirill A . Shutemov" , Borislav Petkov , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Juergen Gross , Chris Wright , Alok Kataria , Rusty Russell , Tejun Heo , Christoph Lameter , Bor Return-path: In-Reply-To: <20171004212003.28296-1-thgarnie@google.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" List-Id: linux-crypto.vger.kernel.org Q2hhbmdlIHRoZSBhc3NlbWJseSBjb2RlIHRvIHVzZSBvbmx5IHJlbGF0aXZlIHJlZmVyZW5jZXMg b2Ygc3ltYm9scyBmb3IgdGhlCmtlcm5lbCB0byBiZSBQSUUgY29tcGF0aWJsZS4KCkVhcmx5IGF0 IGJvb3QsIHRoZSBrZXJuZWwgaXMgbWFwcGVkIGF0IGEgdGVtcG9yYXJ5IGFkZHJlc3Mgd2hpbGUg cHJlcGFyaW5nCnRoZSBwYWdlIHRhYmxlLiBUbyBrbm93IHRoZSBjaGFuZ2VzIG5lZWRlZCBmb3Ig dGhlIHBhZ2UgdGFibGUgd2l0aCBLQVNMUiwKdGhlIGJvb3QgY29kZSBjYWxjdWxhdGUgdGhlIGRp ZmZlcmVuY2UgYmV0d2VlbiB0aGUgZXhwZWN0ZWQgYWRkcmVzcyBvZiB0aGUKa2VybmVsIGFuZCB0 aGUgb25lIGNob3NlbiBieSBLQVNMUi4gSXQgZG9lcyBub3Qgd29yayB3aXRoIFBJRSBiZWNhdXNl IGFsbApzeW1ib2xzIGluIGNvZGUgYXJlIHJlbGF0aXZlcy4gSW5zdGVhZCBvZiBnZXR0aW5nIHRo ZSBmdXR1cmUgcmVsb2NhdGVkCnZpcnR1YWwgYWRkcmVzcywgeW91IHdpbGwgZ2V0IHRoZSBjdXJy ZW50IHRlbXBvcmFyeSBtYXBwaW5nLiBUaGUgc29sdXRpb24KaXMgdXNpbmcgZ2xvYmFsIHZhcmlh YmxlcyB0aGF0IHdpbGwgYmUgcmVsb2NhdGVkIGFzIGV4cGVjdGVkLgoKUG9zaXRpb24gSW5kZXBl bmRlbnQgRXhlY3V0YWJsZSAoUElFKSBzdXBwb3J0IHdpbGwgYWxsb3cgdG8gZXh0ZW5kZWQgdGhl CktBU0xSIHJhbmRvbWl6YXRpb24gcmFuZ2UgYmVsb3cgdGhlIC0yRyBtZW1vcnkgbGltaXQuCgpT aWduZWQtb2ZmLWJ5OiBUaG9tYXMgR2FybmllciA8dGhnYXJuaWVAZ29vZ2xlLmNvbT4KLS0tCiBh cmNoL3g4Ni9rZXJuZWwvaGVhZF82NC5TIHwgMjYgKysrKysrKysrKysrKysrKysrKystLS0tLS0K IDEgZmlsZSBjaGFuZ2VkLCAyMCBpbnNlcnRpb25zKCspLCA2IGRlbGV0aW9ucygtKQoKZGlmZiAt LWdpdCBhL2FyY2gveDg2L2tlcm5lbC9oZWFkXzY0LlMgYi9hcmNoL3g4Ni9rZXJuZWwvaGVhZF82 NC5TCmluZGV4IDQyZTMyYzJlNTFiYi4uMzJkMTg5OWY0OGRmIDEwMDY0NAotLS0gYS9hcmNoL3g4 Ni9rZXJuZWwvaGVhZF82NC5TCisrKyBiL2FyY2gveDg2L2tlcm5lbC9oZWFkXzY0LlMKQEAgLTg2 LDggKzg2LDIxIEBAIHN0YXJ0dXBfNjQ6CiAJcG9wcQklcnNpCiAKIAkvKiBGb3JtIHRoZSBDUjMg dmFsdWUgYmVpbmcgc3VyZSB0byBpbmNsdWRlIHRoZSBDUjMgbW9kaWZpZXIgKi8KLQlhZGRxCSQo ZWFybHlfdG9wX3BndCAtIF9fU1RBUlRfS0VSTkVMX21hcCksICVyYXgKKwlhZGRxICAgIF9lYXJs eV90b3BfcGd0X29mZnNldCglcmlwKSwgJXJheAogCWptcCAxZgorCisJLyoKKwkgKiBQb3NpdGlv biBJbmRlcGVuZGVudCBDb2RlIHRha2VzIG9ubHkgcmVsYXRpdmUgcmVmZXJlbmNlcyBpbiBjb2Rl CisJICogbWVhbmluZyBhIGdsb2JhbCB2YXJpYWJsZSBhZGRyZXNzIGlzIHJlbGF0aXZlIHRvIFJJ UCBhbmQgbm90IGl0cworCSAqIGZ1dHVyZSB2aXJ0dWFsIGFkZHJlc3MuIEdsb2JhbCB2YXJpYWJs ZXMgY2FuIGJlIHVzZWQgaW5zdGVhZCBhcyB0aGV5CisJICogYXJlIHN0aWxsIHJlbG9jYXRlZCBv biB0aGUgZXhwZWN0ZWQga2VybmVsIG1hcHBpbmcgYWRkcmVzcy4KKwkgKi8KKwkuYWxpZ24gOAor X2Vhcmx5X3RvcF9wZ3Rfb2Zmc2V0OgorCS5xdWFkIGVhcmx5X3RvcF9wZ3QgLSBfX1NUQVJUX0tF Uk5FTF9tYXAKK19pbml0X3RvcF9vZmZzZXQ6CisJLnF1YWQgaW5pdF90b3BfcGd0IC0gX19TVEFS VF9LRVJORUxfbWFwCisKIEVOVFJZKHNlY29uZGFyeV9zdGFydHVwXzY0KQogCVVOV0lORF9ISU5U X0VNUFRZCiAJLyoKQEAgLTExNiw3ICsxMjksNyBAQCBFTlRSWShzZWNvbmRhcnlfc3RhcnR1cF82 NCkKIAlwb3BxCSVyc2kKIAogCS8qIEZvcm0gdGhlIENSMyB2YWx1ZSBiZWluZyBzdXJlIHRvIGlu Y2x1ZGUgdGhlIENSMyBtb2RpZmllciAqLwotCWFkZHEJJChpbml0X3RvcF9wZ3QgLSBfX1NUQVJU X0tFUk5FTF9tYXApLCAlcmF4CisJYWRkcSAgICBfaW5pdF90b3Bfb2Zmc2V0KCVyaXApLCAlcmF4 CiAxOgogCiAJLyogRW5hYmxlIFBBRSBtb2RlLCBQR0UgYW5kIExBNTcgKi8KQEAgLTEzMSw3ICsx NDQsNyBAQCBFTlRSWShzZWNvbmRhcnlfc3RhcnR1cF82NCkKIAltb3ZxCSVyYXgsICVjcjMKIAog CS8qIEVuc3VyZSBJIGFtIGV4ZWN1dGluZyBmcm9tIHZpcnR1YWwgYWRkcmVzc2VzICovCi0JbW92 cQkkMWYsICVyYXgKKwltb3ZhYnMgICQxZiwgJXJheAogCWptcAkqJXJheAogMToKIAlVTldJTkRf SElOVF9FTVBUWQpAQCAtMjMwLDExICsyNDMsMTIgQEAgRU5UUlkoc2Vjb25kYXJ5X3N0YXJ0dXBf NjQpCiAJICoJUkVYLlcgKyBGRiAvNSBKTVAgbTE2OjY0IEp1bXAgZmFyLCBhYnNvbHV0ZSBpbmRp cmVjdCwKIAkgKgkJYWRkcmVzcyBnaXZlbiBpbiBtMTY6NjQuCiAJICovCi0JcHVzaHEJJC5MYWZ0 ZXJfbHJldAkjIHB1dCByZXR1cm4gYWRkcmVzcyBvbiBzdGFjayBmb3IgdW53aW5kZXIKKwlsZWFx CS5MYWZ0ZXJfbHJldCglcmlwKSwgJXJheAorCXB1c2hxCSVyYXgJCSMgcHV0IHJldHVybiBhZGRy ZXNzIG9uIHN0YWNrIGZvciB1bndpbmRlcgogCXhvcnEJJXJicCwgJXJicAkjIGNsZWFyIGZyYW1l IHBvaW50ZXIKLQltb3ZxCWluaXRpYWxfY29kZSglcmlwKSwgJXJheAorCWxlYXEJaW5pdGlhbF9j b2RlKCVyaXApLCAlcmF4CiAJcHVzaHEJJF9fS0VSTkVMX0NTCSMgc2V0IGNvcnJlY3QgY3MKLQlw dXNocQklcmF4CQkjIHRhcmdldCBhZGRyZXNzIGluIG5lZ2F0aXZlIHNwYWNlCisJcHVzaHEJKCVy YXgpCQkjIHRhcmdldCBhZGRyZXNzIGluIG5lZ2F0aXZlIHNwYWNlCiAJbHJldHEKIC5MYWZ0ZXJf bHJldDoKIEVORChzZWNvbmRhcnlfc3RhcnR1cF82NCkKLS0gCjIuMTQuMi45MjAuZ2NmMGM2Nzk3 OWMtZ29vZwoKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Clhlbi1kZXZlbCBtYWlsaW5nIGxpc3QKWGVuLWRldmVsQGxpc3RzLnhlbi5vcmcKaHR0cHM6Ly9s aXN0cy54ZW4ub3JnL3hlbi1kZXZlbAo=