From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Garnier Date: Wed, 4 Oct 2017 14:20:01 -0700 Message-Id: <20171004212003.28296-26-thgarnie@google.com> In-Reply-To: <20171004212003.28296-1-thgarnie@google.com> References: <20171004212003.28296-1-thgarnie@google.com> Subject: [kernel-hardening] [RFC v3 25/27] x86/pie: Add option to build the kernel as PIE To: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Thomas Garnier , Arnd Bergmann , Kees Cook , Matthias Kaehlcke , Tom Lendacky , Andy Lutomirski , "Kirill A . Shutemov" , Borislav Petkov , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Juergen Gross , Chris Wright , Alok Kataria , Rusty Russell , Tejun Heo , Christoph Lameter , Boris Ostrovsky , Alexey Dobriyan , Andrew Morton , Paul Gortmaker , Chris Metcalf , "Paul E . McKenney" , Nicolas Pitre , Borislav Petkov , "Luis R . Rodriguez" , Greg Kroah-Hartman , Christopher Li , Steven Rostedt , Jason Baron , Dou Liyang , "Rafael J . Wysocki" , Mika Westerberg , Lukas Wunner , Masahiro Yamada , Alexei Starovoitov , Daniel Borkmann , Markus Trippelsdorf , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Joerg Roedel , Rik van Riel , David Howells , Ard Biesheuvel , Waiman Long , Kyle Huey , Andrey Ryabinin , Jonathan Corbet , Matthew Wilcox , Michal Hocko , Peter Foley , Paul Bolle , Jiri Kosina , Rob Landley , "H . J . Lu" , Baoquan He , =?UTF-8?q?Jan=20H=20=2E=20Sch=C3=B6nherr?= , Daniel Micay Cc: x86@kernel.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org, virtualization@lists.linux-foundation.org, xen-devel@lists.xenproject.org, linux-arch@vger.kernel.org, linux-sparse@vger.kernel.org, kvm@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com List-ID: Add the CONFIG_X86_PIE option which builds the kernel as a Position Independent Executable (PIE). The kernel is currently build with the mcmodel=kernel option which forces it to stay on the top 2G of the virtual address space. With PIE, the kernel will be able to move below the current limit. The --emit-relocs linker option was kept instead of using -pie to limit the impact on mapped sections. Any incompatible relocation will be catch by the arch/x86/tools/relocs binary at compile time. Performance/Size impact: Size of vmlinux (Default configuration): File size: - PIE disabled: +0.000031% - PIE enabled: -3.210% (less relocations) .text section: - PIE disabled: +0.000644% - PIE enabled: +0.837% Size of vmlinux (Ubuntu configuration): File size: - PIE disabled: -0.201% - PIE enabled: -0.082% .text section: - PIE disabled: same - PIE enabled: +1.319% Size of vmlinux (Default configuration + ORC): File size: - PIE enabled: -3.167% .text section: - PIE enabled: +0.814% Size of vmlinux (Ubuntu configuration + ORC): File size: - PIE enabled: -3.167% .text section: - PIE enabled: +1.26% The size increase is mainly due to not having access to the 32-bit signed relocation that can be used with mcmodel=kernel. A small part is due to reduced optimization for PIE code. This bug [1] was opened with gcc to provide a better code generation for kernel PIE. Hackbench (50% and 1600% on thread/process for pipe/sockets): - PIE disabled: no significant change (avg +0.1% on latest test). - PIE enabled: between -0.50% to +0.86% in average (default and Ubuntu config). slab_test (average of 10 runs): - PIE disabled: no significant change (-2% on latest run, likely noise). - PIE enabled: between -1% and +0.8% on latest runs. Kernbench (average of 10 Half and Optimal runs): Elapsed Time: - PIE disabled: no significant change (avg -0.239%) - PIE enabled: average +0.07% System Time: - PIE disabled: no significant change (avg -0.277%) - PIE enabled: average +0.7% [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82303 Signed-off-by: Thomas Garnier --- arch/x86/Kconfig | 8 ++++++++ arch/x86/Makefile | 1 + 2 files changed, 9 insertions(+) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 1e4b399c64e5..b92f96923712 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2141,6 +2141,14 @@ config X86_GLOBAL_STACKPROTECTOR bool depends on CC_STACKPROTECTOR +config X86_PIE + bool + depends on X86_64 + select DEFAULT_HIDDEN + select DYNAMIC_MODULE_BASE + select MODULE_REL_CRCS if MODVERSIONS + select X86_GLOBAL_STACKPROTECTOR if CC_STACKPROTECTOR + config HOTPLUG_CPU bool "Support for hot-pluggable CPUs" depends on SMP diff --git a/arch/x86/Makefile b/arch/x86/Makefile index 42774185a58a..c49855b4b1be 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -144,6 +144,7 @@ else KBUILD_CFLAGS += -mno-red-zone ifdef CONFIG_X86_PIE + KBUILD_CFLAGS += -fPIC KBUILD_LDFLAGS_MODULE += -T $(srctree)/arch/x86/kernel/module.lds else KBUILD_CFLAGS += -mcmodel=kernel -- 2.14.2.920.gcf0c67979c-goog From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Garnier Subject: [RFC v3 25/27] x86/pie: Add option to build the kernel as PIE Date: Wed, 4 Oct 2017 14:20:01 -0700 Message-ID: <20171004212003.28296-26-thgarnie@google.com> References: <20171004212003.28296-1-thgarnie@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: <20171004212003.28296-1-thgarnie@google.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" To: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Thomas Garnier , Arnd Bergmann , Kees Cook , Matthias Kaehlcke , Tom Lendacky , Andy Lutomirski , "Kirill A . Shutemov" , Borislav Petkov , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Juergen Gross , Chris Wright , Alok Kataria , Rusty Russell , Tejun Heo , Christoph Lameter Bor Cc: linux-arch@vger.kernel.org, kvm@vger.kernel.org, linux-pm@vger.kernel.org, x86@kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org, linux-sparse@vger.kernel.org, linux-crypto@vger.kernel.org, kernel-hardening@lists.openwall.com, xen-devel@lists.xenproject.org List-Id: linux-arch.vger.kernel.org QWRkIHRoZSBDT05GSUdfWDg2X1BJRSBvcHRpb24gd2hpY2ggYnVpbGRzIHRoZSBrZXJuZWwgYXMg YSBQb3NpdGlvbgpJbmRlcGVuZGVudCBFeGVjdXRhYmxlIChQSUUpLiBUaGUga2VybmVsIGlzIGN1 cnJlbnRseSBidWlsZCB3aXRoIHRoZQptY21vZGVsPWtlcm5lbCBvcHRpb24gd2hpY2ggZm9yY2Vz IGl0IHRvIHN0YXkgb24gdGhlIHRvcCAyRyBvZiB0aGUKdmlydHVhbCBhZGRyZXNzIHNwYWNlLiBX aXRoIFBJRSwgdGhlIGtlcm5lbCB3aWxsIGJlIGFibGUgdG8gbW92ZSBiZWxvdwp0aGUgY3VycmVu dCBsaW1pdC4KClRoZSAtLWVtaXQtcmVsb2NzIGxpbmtlciBvcHRpb24gd2FzIGtlcHQgaW5zdGVh ZCBvZiB1c2luZyAtcGllIHRvIGxpbWl0CnRoZSBpbXBhY3Qgb24gbWFwcGVkIHNlY3Rpb25zLiBB bnkgaW5jb21wYXRpYmxlIHJlbG9jYXRpb24gd2lsbCBiZQpjYXRjaCBieSB0aGUgYXJjaC94ODYv dG9vbHMvcmVsb2NzIGJpbmFyeSBhdCBjb21waWxlIHRpbWUuCgpQZXJmb3JtYW5jZS9TaXplIGlt cGFjdDoKU2l6ZSBvZiB2bWxpbnV4IChEZWZhdWx0IGNvbmZpZ3VyYXRpb24pOgogRmlsZSBzaXpl OgogLSBQSUUgZGlzYWJsZWQ6ICswLjAwMDAzMSUKIC0gUElFIGVuYWJsZWQ6IC0zLjIxMCUgKGxl c3MgcmVsb2NhdGlvbnMpCiAudGV4dCBzZWN0aW9uOgogLSBQSUUgZGlzYWJsZWQ6ICswLjAwMDY0 NCUKIC0gUElFIGVuYWJsZWQ6ICswLjgzNyUKClNpemUgb2Ygdm1saW51eCAoVWJ1bnR1IGNvbmZp Z3VyYXRpb24pOgogRmlsZSBzaXplOgogLSBQSUUgZGlzYWJsZWQ6IC0wLjIwMSUKIC0gUElFIGVu YWJsZWQ6IC0wLjA4MiUKIC50ZXh0IHNlY3Rpb246CiAtIFBJRSBkaXNhYmxlZDogc2FtZQogLSBQ SUUgZW5hYmxlZDogKzEuMzE5JQoKU2l6ZSBvZiB2bWxpbnV4IChEZWZhdWx0IGNvbmZpZ3VyYXRp b24gKyBPUkMpOgogRmlsZSBzaXplOgogLSBQSUUgZW5hYmxlZDogLTMuMTY3JQogLnRleHQgc2Vj dGlvbjoKIC0gUElFIGVuYWJsZWQ6ICswLjgxNCUKClNpemUgb2Ygdm1saW51eCAoVWJ1bnR1IGNv bmZpZ3VyYXRpb24gKyBPUkMpOgogRmlsZSBzaXplOgogLSBQSUUgZW5hYmxlZDogLTMuMTY3JQog LnRleHQgc2VjdGlvbjoKIC0gUElFIGVuYWJsZWQ6ICsxLjI2JQoKVGhlIHNpemUgaW5jcmVhc2Ug aXMgbWFpbmx5IGR1ZSB0byBub3QgaGF2aW5nIGFjY2VzcyB0byB0aGUgMzItYml0IHNpZ25lZApy ZWxvY2F0aW9uIHRoYXQgY2FuIGJlIHVzZWQgd2l0aCBtY21vZGVsPWtlcm5lbC4gQSBzbWFsbCBw YXJ0IGlzIGR1ZSB0byByZWR1Y2VkCm9wdGltaXphdGlvbiBmb3IgUElFIGNvZGUuIFRoaXMgYnVn IFsxXSB3YXMgb3BlbmVkIHdpdGggZ2NjIHRvIHByb3ZpZGUgYSBiZXR0ZXIKY29kZSBnZW5lcmF0 aW9uIGZvciBrZXJuZWwgUElFLgoKSGFja2JlbmNoICg1MCUgYW5kIDE2MDAlIG9uIHRocmVhZC9w cm9jZXNzIGZvciBwaXBlL3NvY2tldHMpOgogLSBQSUUgZGlzYWJsZWQ6IG5vIHNpZ25pZmljYW50 IGNoYW5nZSAoYXZnICswLjElIG9uIGxhdGVzdCB0ZXN0KS4KIC0gUElFIGVuYWJsZWQ6IGJldHdl ZW4gLTAuNTAlIHRvICswLjg2JSBpbiBhdmVyYWdlIChkZWZhdWx0IGFuZCBVYnVudHUgY29uZmln KS4KCnNsYWJfdGVzdCAoYXZlcmFnZSBvZiAxMCBydW5zKToKIC0gUElFIGRpc2FibGVkOiBubyBz aWduaWZpY2FudCBjaGFuZ2UgKC0yJSBvbiBsYXRlc3QgcnVuLCBsaWtlbHkgbm9pc2UpLgogLSBQ SUUgZW5hYmxlZDogYmV0d2VlbiAtMSUgYW5kICswLjglIG9uIGxhdGVzdCBydW5zLgoKS2VybmJl bmNoIChhdmVyYWdlIG9mIDEwIEhhbGYgYW5kIE9wdGltYWwgcnVucyk6CiBFbGFwc2VkIFRpbWU6 CiAtIFBJRSBkaXNhYmxlZDogbm8gc2lnbmlmaWNhbnQgY2hhbmdlIChhdmcgLTAuMjM5JSkKIC0g UElFIGVuYWJsZWQ6IGF2ZXJhZ2UgKzAuMDclCiBTeXN0ZW0gVGltZToKIC0gUElFIGRpc2FibGVk OiBubyBzaWduaWZpY2FudCBjaGFuZ2UgKGF2ZyAtMC4yNzclKQogLSBQSUUgZW5hYmxlZDogYXZl cmFnZSArMC43JQoKWzFdIGh0dHBzOi8vZ2NjLmdudS5vcmcvYnVnemlsbGEvc2hvd19idWcuY2dp P2lkPTgyMzAzCgpTaWduZWQtb2ZmLWJ5OiBUaG9tYXMgR2FybmllciA8dGhnYXJuaWVAZ29vZ2xl LmNvbT4KLS0tCiBhcmNoL3g4Ni9LY29uZmlnICB8IDggKysrKysrKysKIGFyY2gveDg2L01ha2Vm aWxlIHwgMSArCiAyIGZpbGVzIGNoYW5nZWQsIDkgaW5zZXJ0aW9ucygrKQoKZGlmZiAtLWdpdCBh L2FyY2gveDg2L0tjb25maWcgYi9hcmNoL3g4Ni9LY29uZmlnCmluZGV4IDFlNGIzOTljNjRlNS4u YjkyZjk2OTIzNzEyIDEwMDY0NAotLS0gYS9hcmNoL3g4Ni9LY29uZmlnCisrKyBiL2FyY2gveDg2 L0tjb25maWcKQEAgLTIxNDEsNiArMjE0MSwxNCBAQCBjb25maWcgWDg2X0dMT0JBTF9TVEFDS1BS T1RFQ1RPUgogCWJvb2wKIAlkZXBlbmRzIG9uIENDX1NUQUNLUFJPVEVDVE9SCiAKK2NvbmZpZyBY ODZfUElFCisJYm9vbAorCWRlcGVuZHMgb24gWDg2XzY0CisJc2VsZWN0IERFRkFVTFRfSElEREVO CisJc2VsZWN0IERZTkFNSUNfTU9EVUxFX0JBU0UKKwlzZWxlY3QgTU9EVUxFX1JFTF9DUkNTIGlm IE1PRFZFUlNJT05TCisJc2VsZWN0IFg4Nl9HTE9CQUxfU1RBQ0tQUk9URUNUT1IgaWYgQ0NfU1RB Q0tQUk9URUNUT1IKKwogY29uZmlnIEhPVFBMVUdfQ1BVCiAJYm9vbCAiU3VwcG9ydCBmb3IgaG90 LXBsdWdnYWJsZSBDUFVzIgogCWRlcGVuZHMgb24gU01QCmRpZmYgLS1naXQgYS9hcmNoL3g4Ni9N YWtlZmlsZSBiL2FyY2gveDg2L01ha2VmaWxlCmluZGV4IDQyNzc0MTg1YTU4YS4uYzQ5ODU1YjRi MWJlIDEwMDY0NAotLS0gYS9hcmNoL3g4Ni9NYWtlZmlsZQorKysgYi9hcmNoL3g4Ni9NYWtlZmls ZQpAQCAtMTQ0LDYgKzE0NCw3IEBAIGVsc2UKIAogICAgICAgICBLQlVJTERfQ0ZMQUdTICs9IC1t bm8tcmVkLXpvbmUKIGlmZGVmIENPTkZJR19YODZfUElFCisgICAgICAgIEtCVUlMRF9DRkxBR1Mg Kz0gLWZQSUMKICAgICAgICAgS0JVSUxEX0xERkxBR1NfTU9EVUxFICs9IC1UICQoc3JjdHJlZSkv YXJjaC94ODYva2VybmVsL21vZHVsZS5sZHMKIGVsc2UKICAgICAgICAgS0JVSUxEX0NGTEFHUyAr PSAtbWNtb2RlbD1rZXJuZWwKLS0gCjIuMTQuMi45MjAuZ2NmMGM2Nzk3OWMtZ29vZwoKCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fClhlbi1kZXZlbCBtYWls aW5nIGxpc3QKWGVuLWRldmVsQGxpc3RzLnhlbi5vcmcKaHR0cHM6Ly9saXN0cy54ZW4ub3JnL3hl bi1kZXZlbAo= From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Garnier Subject: [RFC v3 25/27] x86/pie: Add option to build the kernel as PIE Date: Wed, 4 Oct 2017 14:20:01 -0700 Message-ID: <20171004212003.28296-26-thgarnie@google.com> References: <20171004212003.28296-1-thgarnie@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Cc: linux-arch@vger.kernel.org, kvm@vger.kernel.org, linux-pm@vger.kernel.org, x86@kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org, linux-sparse@vger.kernel.org, linux-crypto@vger.kernel.org, kernel-hardening@lists.openwall.com, xen-devel@lists.xenproject.org To: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Thomas Garnier , Arnd Bergmann , Kees Cook , Matthias Kaehlcke , Tom Lendacky , Andy Lutomirski , "Kirill A . Shutemov" , Borislav Petkov , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Juergen Gross , Chris Wright , Alok Kataria , Rusty Russell , Tejun Heo , Christoph Lameter , Bor Return-path: In-Reply-To: <20171004212003.28296-1-thgarnie@google.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" List-Id: linux-crypto.vger.kernel.org QWRkIHRoZSBDT05GSUdfWDg2X1BJRSBvcHRpb24gd2hpY2ggYnVpbGRzIHRoZSBrZXJuZWwgYXMg YSBQb3NpdGlvbgpJbmRlcGVuZGVudCBFeGVjdXRhYmxlIChQSUUpLiBUaGUga2VybmVsIGlzIGN1 cnJlbnRseSBidWlsZCB3aXRoIHRoZQptY21vZGVsPWtlcm5lbCBvcHRpb24gd2hpY2ggZm9yY2Vz IGl0IHRvIHN0YXkgb24gdGhlIHRvcCAyRyBvZiB0aGUKdmlydHVhbCBhZGRyZXNzIHNwYWNlLiBX aXRoIFBJRSwgdGhlIGtlcm5lbCB3aWxsIGJlIGFibGUgdG8gbW92ZSBiZWxvdwp0aGUgY3VycmVu dCBsaW1pdC4KClRoZSAtLWVtaXQtcmVsb2NzIGxpbmtlciBvcHRpb24gd2FzIGtlcHQgaW5zdGVh ZCBvZiB1c2luZyAtcGllIHRvIGxpbWl0CnRoZSBpbXBhY3Qgb24gbWFwcGVkIHNlY3Rpb25zLiBB bnkgaW5jb21wYXRpYmxlIHJlbG9jYXRpb24gd2lsbCBiZQpjYXRjaCBieSB0aGUgYXJjaC94ODYv dG9vbHMvcmVsb2NzIGJpbmFyeSBhdCBjb21waWxlIHRpbWUuCgpQZXJmb3JtYW5jZS9TaXplIGlt cGFjdDoKU2l6ZSBvZiB2bWxpbnV4IChEZWZhdWx0IGNvbmZpZ3VyYXRpb24pOgogRmlsZSBzaXpl OgogLSBQSUUgZGlzYWJsZWQ6ICswLjAwMDAzMSUKIC0gUElFIGVuYWJsZWQ6IC0zLjIxMCUgKGxl c3MgcmVsb2NhdGlvbnMpCiAudGV4dCBzZWN0aW9uOgogLSBQSUUgZGlzYWJsZWQ6ICswLjAwMDY0 NCUKIC0gUElFIGVuYWJsZWQ6ICswLjgzNyUKClNpemUgb2Ygdm1saW51eCAoVWJ1bnR1IGNvbmZp Z3VyYXRpb24pOgogRmlsZSBzaXplOgogLSBQSUUgZGlzYWJsZWQ6IC0wLjIwMSUKIC0gUElFIGVu YWJsZWQ6IC0wLjA4MiUKIC50ZXh0IHNlY3Rpb246CiAtIFBJRSBkaXNhYmxlZDogc2FtZQogLSBQ SUUgZW5hYmxlZDogKzEuMzE5JQoKU2l6ZSBvZiB2bWxpbnV4IChEZWZhdWx0IGNvbmZpZ3VyYXRp b24gKyBPUkMpOgogRmlsZSBzaXplOgogLSBQSUUgZW5hYmxlZDogLTMuMTY3JQogLnRleHQgc2Vj dGlvbjoKIC0gUElFIGVuYWJsZWQ6ICswLjgxNCUKClNpemUgb2Ygdm1saW51eCAoVWJ1bnR1IGNv bmZpZ3VyYXRpb24gKyBPUkMpOgogRmlsZSBzaXplOgogLSBQSUUgZW5hYmxlZDogLTMuMTY3JQog LnRleHQgc2VjdGlvbjoKIC0gUElFIGVuYWJsZWQ6ICsxLjI2JQoKVGhlIHNpemUgaW5jcmVhc2Ug aXMgbWFpbmx5IGR1ZSB0byBub3QgaGF2aW5nIGFjY2VzcyB0byB0aGUgMzItYml0IHNpZ25lZApy ZWxvY2F0aW9uIHRoYXQgY2FuIGJlIHVzZWQgd2l0aCBtY21vZGVsPWtlcm5lbC4gQSBzbWFsbCBw YXJ0IGlzIGR1ZSB0byByZWR1Y2VkCm9wdGltaXphdGlvbiBmb3IgUElFIGNvZGUuIFRoaXMgYnVn IFsxXSB3YXMgb3BlbmVkIHdpdGggZ2NjIHRvIHByb3ZpZGUgYSBiZXR0ZXIKY29kZSBnZW5lcmF0 aW9uIGZvciBrZXJuZWwgUElFLgoKSGFja2JlbmNoICg1MCUgYW5kIDE2MDAlIG9uIHRocmVhZC9w cm9jZXNzIGZvciBwaXBlL3NvY2tldHMpOgogLSBQSUUgZGlzYWJsZWQ6IG5vIHNpZ25pZmljYW50 IGNoYW5nZSAoYXZnICswLjElIG9uIGxhdGVzdCB0ZXN0KS4KIC0gUElFIGVuYWJsZWQ6IGJldHdl ZW4gLTAuNTAlIHRvICswLjg2JSBpbiBhdmVyYWdlIChkZWZhdWx0IGFuZCBVYnVudHUgY29uZmln KS4KCnNsYWJfdGVzdCAoYXZlcmFnZSBvZiAxMCBydW5zKToKIC0gUElFIGRpc2FibGVkOiBubyBz aWduaWZpY2FudCBjaGFuZ2UgKC0yJSBvbiBsYXRlc3QgcnVuLCBsaWtlbHkgbm9pc2UpLgogLSBQ SUUgZW5hYmxlZDogYmV0d2VlbiAtMSUgYW5kICswLjglIG9uIGxhdGVzdCBydW5zLgoKS2VybmJl bmNoIChhdmVyYWdlIG9mIDEwIEhhbGYgYW5kIE9wdGltYWwgcnVucyk6CiBFbGFwc2VkIFRpbWU6 CiAtIFBJRSBkaXNhYmxlZDogbm8gc2lnbmlmaWNhbnQgY2hhbmdlIChhdmcgLTAuMjM5JSkKIC0g UElFIGVuYWJsZWQ6IGF2ZXJhZ2UgKzAuMDclCiBTeXN0ZW0gVGltZToKIC0gUElFIGRpc2FibGVk OiBubyBzaWduaWZpY2FudCBjaGFuZ2UgKGF2ZyAtMC4yNzclKQogLSBQSUUgZW5hYmxlZDogYXZl cmFnZSArMC43JQoKWzFdIGh0dHBzOi8vZ2NjLmdudS5vcmcvYnVnemlsbGEvc2hvd19idWcuY2dp P2lkPTgyMzAzCgpTaWduZWQtb2ZmLWJ5OiBUaG9tYXMgR2FybmllciA8dGhnYXJuaWVAZ29vZ2xl LmNvbT4KLS0tCiBhcmNoL3g4Ni9LY29uZmlnICB8IDggKysrKysrKysKIGFyY2gveDg2L01ha2Vm aWxlIHwgMSArCiAyIGZpbGVzIGNoYW5nZWQsIDkgaW5zZXJ0aW9ucygrKQoKZGlmZiAtLWdpdCBh L2FyY2gveDg2L0tjb25maWcgYi9hcmNoL3g4Ni9LY29uZmlnCmluZGV4IDFlNGIzOTljNjRlNS4u YjkyZjk2OTIzNzEyIDEwMDY0NAotLS0gYS9hcmNoL3g4Ni9LY29uZmlnCisrKyBiL2FyY2gveDg2 L0tjb25maWcKQEAgLTIxNDEsNiArMjE0MSwxNCBAQCBjb25maWcgWDg2X0dMT0JBTF9TVEFDS1BS T1RFQ1RPUgogCWJvb2wKIAlkZXBlbmRzIG9uIENDX1NUQUNLUFJPVEVDVE9SCiAKK2NvbmZpZyBY ODZfUElFCisJYm9vbAorCWRlcGVuZHMgb24gWDg2XzY0CisJc2VsZWN0IERFRkFVTFRfSElEREVO CisJc2VsZWN0IERZTkFNSUNfTU9EVUxFX0JBU0UKKwlzZWxlY3QgTU9EVUxFX1JFTF9DUkNTIGlm IE1PRFZFUlNJT05TCisJc2VsZWN0IFg4Nl9HTE9CQUxfU1RBQ0tQUk9URUNUT1IgaWYgQ0NfU1RB Q0tQUk9URUNUT1IKKwogY29uZmlnIEhPVFBMVUdfQ1BVCiAJYm9vbCAiU3VwcG9ydCBmb3IgaG90 LXBsdWdnYWJsZSBDUFVzIgogCWRlcGVuZHMgb24gU01QCmRpZmYgLS1naXQgYS9hcmNoL3g4Ni9N YWtlZmlsZSBiL2FyY2gveDg2L01ha2VmaWxlCmluZGV4IDQyNzc0MTg1YTU4YS4uYzQ5ODU1YjRi MWJlIDEwMDY0NAotLS0gYS9hcmNoL3g4Ni9NYWtlZmlsZQorKysgYi9hcmNoL3g4Ni9NYWtlZmls ZQpAQCAtMTQ0LDYgKzE0NCw3IEBAIGVsc2UKIAogICAgICAgICBLQlVJTERfQ0ZMQUdTICs9IC1t bm8tcmVkLXpvbmUKIGlmZGVmIENPTkZJR19YODZfUElFCisgICAgICAgIEtCVUlMRF9DRkxBR1Mg Kz0gLWZQSUMKICAgICAgICAgS0JVSUxEX0xERkxBR1NfTU9EVUxFICs9IC1UICQoc3JjdHJlZSkv YXJjaC94ODYva2VybmVsL21vZHVsZS5sZHMKIGVsc2UKICAgICAgICAgS0JVSUxEX0NGTEFHUyAr PSAtbWNtb2RlbD1rZXJuZWwKLS0gCjIuMTQuMi45MjAuZ2NmMGM2Nzk3OWMtZ29vZwoKCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fClhlbi1kZXZlbCBtYWls aW5nIGxpc3QKWGVuLWRldmVsQGxpc3RzLnhlbi5vcmcKaHR0cHM6Ly9saXN0cy54ZW4ub3JnL3hl bi1kZXZlbAo=