From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-26.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT,USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 989B4C2BB4C for ; Fri, 12 Mar 2021 00:50:21 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6D2AC64F92 for ; Fri, 12 Mar 2021 00:50:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231605AbhCLAtr (ORCPT ); Thu, 11 Mar 2021 19:49:47 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51956 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230491AbhCLAtX (ORCPT ); Thu, 11 Mar 2021 19:49:23 -0500 Received: from mail-qk1-x74a.google.com (mail-qk1-x74a.google.com [IPv6:2607:f8b0:4864:20::74a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6F979C061762 for ; Thu, 11 Mar 2021 16:49:23 -0800 (PST) Received: by mail-qk1-x74a.google.com with SMTP id c7so17004202qka.6 for ; Thu, 11 Mar 2021 16:49:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc:content-transfer-encoding; bh=kYWK0LnFOZQUSIgVrFyNXnXq3MuC82/VVIJ2++AQu2s=; b=oMXK92xYzFFfoJOoKcwJb28jCIk7pb8pDEzOHr256GwfhlElhlOgE4o82w/iz4ZT7d +V4cu2LqO0CEJK2kLSkD0Es+Ggg8N+9YIml4D+pvlOhEjBZQRc3xre0UHNTamO4be4b7 pbfmN2pwlagJ3zLfqw2sddG8ViZFumtR750SHj19i++7MUmkbuqkw4p9hTJpmh47RLOv YT+YAfVXE6pR/fa7hX1vOBKlCpGVYb2BX8E8G80cQVeqxUCrCCWXfaTT8ClWQI/rxPJR 4sJED1wWb/nEpWdlZsKcK8AUiCrJtxME50dsV4qgl/hFHC/tOWHyNld+EzcsLxKvF2Ia Fnbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc:content-transfer-encoding; bh=kYWK0LnFOZQUSIgVrFyNXnXq3MuC82/VVIJ2++AQu2s=; b=MDiFQvgVfpYK+8V7isArCDCy4zsLBEG1eCc3AhsiXezYsqlfsd1dbovqNea+H3ycyM 7a8X1WLsFBV7+WRUvvsDpUV1JsS/gV3WyuceDIfRENJK84JbYNfJmxqQY/p14YLyt5UI 2hB5Mr+Ef1S7YpoWkLXGgAxX96yiK2Vkev3xh8+mb4KTVedRDOkpw/tM26EOiO6r0//+ hKDodibYK/6Ulz97fRpY0Ju8w55+Z2oGX2WJloLibrxGaSuOs7MynxTu5GgKZY3xkElY Cl42gIEW4LCEYGpBfxbd1W/VYmDn/PRBOEpLekZgGvGxdIy/pApQt9BInt9jDouXH0of ogjA== X-Gm-Message-State: AOAM5303hsL3ctgldwDbOSNZtfRBIwDGHS4i4j2D1OLRoKCbszRtXRKh e+Ai4xVdTYwyfKuW4gC5+g7dDTGi81RTp6gWLH4= X-Google-Smtp-Source: ABdhPJwEGVsKx2ovPS4g444wFkX3TkmdaWS9gvqhU/f0Ua52OAgVry8uJvld3sA8rgr4BKG4wtH0DIiz3MjA/nCRz/k= X-Received: from samitolvanen1.mtv.corp.google.com ([2620:15c:201:2:c86b:8269:af92:55a]) (user=samitolvanen job=sendgmr) by 2002:ad4:51c1:: with SMTP id p1mr10485236qvq.39.1615510162641; Thu, 11 Mar 2021 16:49:22 -0800 (PST) Date: Thu, 11 Mar 2021 16:49:03 -0800 In-Reply-To: <20210312004919.669614-1-samitolvanen@google.com> Message-Id: <20210312004919.669614-2-samitolvanen@google.com> Mime-Version: 1.0 References: <20210312004919.669614-1-samitolvanen@google.com> X-Mailer: git-send-email 2.31.0.rc2.261.g7f71774620-goog Subject: [PATCH 01/17] add support for Clang CFI From: Sami Tolvanen To: Kees Cook Cc: Nathan Chancellor , Nick Desaulniers , Masahiro Yamada , Will Deacon , Jessica Yu , Arnd Bergmann , Tejun Heo , bpf@vger.kernel.org, linux-hardening@vger.kernel.org, linux-arch@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kbuild@vger.kernel.org, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Sami Tolvanen Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org This change adds support for Clang=E2=80=99s forward-edge Control Flow Integrity (CFI) checking. With CONFIG_CFI_CLANG, the compiler injects a runtime check before each indirect function call to ensure the target is a valid function with the correct static type. This restricts possible call targets and makes it more difficult for an attacker to exploit bugs that allow the modification of stored function pointers. For more details, see: https://clang.llvm.org/docs/ControlFlowIntegrity.html Clang requires CONFIG_LTO_CLANG to be enabled with CFI to gain visibility to possible call targets. Kernel modules are supported with Clang=E2=80=99s cross-DSO CFI mode, which allows checking between independently compiled components. With CFI enabled, the compiler injects a __cfi_check() function into the kernel and each module for validating local call targets. For cross-module calls that cannot be validated locally, the compiler calls the global __cfi_slowpath_diag() function, which determines the target module and calls the correct __cfi_check() function. This patch includes a slowpath implementation that uses __module_address() to resolve call targets, and with CONFIG_CFI_CLANG_SHADOW enabled, a shadow map that speeds up module look-ups by ~3x. Clang implements indirect call checking using jump tables and offers two methods of generating them. With canonical jump tables, the compiler renames each address-taken function to .cfi and points the original symbol to a jump table entry, which passes __cfi_check() validation. This isn=E2=80=99t compatible with stand-alone assembly code, which the compiler doesn=E2=80=99t instrument, and would result in indirect calls to assembly code to fail. Therefore, we default to using non-canonical jump tables instead, where the compiler generates a local jump table entry .cfi_jt for each address-taken function, and replaces all references to the function with the address of the jump table entry. Note that because non-canonical jump table addresses are local to each component, they break cross-module function address equality. Specifically, the address of a global function will be different in each module, as it's replaced with the address of a local jump table entry. If this address is passed to a different module, it won=E2=80=99t match the address of the same function taken there. This may break code that relies on comparing addresses passed from other components. CFI checking can be disabled in a function with the __nocfi attribute. Additionally, CFI can be disabled for an entire compilation unit by filtering out CC_FLAGS_CFI. By default, CFI failures result in a kernel panic to stop a potential exploit. CONFIG_CFI_PERMISSIVE enables a permissive mode, where the kernel prints out a rate-limited warning instead, and allows execution to continue. This option is helpful for locating type mismatches, but should only be enabled during development. Signed-off-by: Sami Tolvanen --- Makefile | 17 ++ arch/Kconfig | 45 ++++ include/asm-generic/vmlinux.lds.h | 20 +- include/linux/cfi.h | 41 ++++ include/linux/compiler-clang.h | 2 + include/linux/compiler_types.h | 4 + include/linux/init.h | 2 +- include/linux/module.h | 13 +- init/Kconfig | 2 +- kernel/Makefile | 4 + kernel/cfi.c | 329 ++++++++++++++++++++++++++++++ kernel/module.c | 43 ++++ scripts/Makefile.modfinal | 2 +- 13 files changed, 518 insertions(+), 6 deletions(-) create mode 100644 include/linux/cfi.h create mode 100644 kernel/cfi.c diff --git a/Makefile b/Makefile index 31dcdb3d61fa..41c4bad50d31 100644 --- a/Makefile +++ b/Makefile @@ -918,6 +918,23 @@ KBUILD_AFLAGS +=3D -fno-lto export CC_FLAGS_LTO endif =20 +ifdef CONFIG_CFI_CLANG +CC_FLAGS_CFI :=3D -fsanitize=3Dcfi \ + -fsanitize-cfi-cross-dso \ + -fno-sanitize-cfi-canonical-jump-tables \ + -fno-sanitize-trap=3Dcfi \ + -fno-sanitize-blacklist + +ifdef CONFIG_CFI_PERMISSIVE +CC_FLAGS_CFI +=3D -fsanitize-recover=3Dcfi +endif + +# If LTO flags are filtered out, we must also filter out CFI. +CC_FLAGS_LTO +=3D $(CC_FLAGS_CFI) +KBUILD_CFLAGS +=3D $(CC_FLAGS_CFI) +export CC_FLAGS_CFI +endif + ifdef CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_32B KBUILD_CFLAGS +=3D -falign-functions=3D32 endif diff --git a/arch/Kconfig b/arch/Kconfig index 2bb30673d8e6..57ec663828dc 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -693,6 +693,51 @@ config LTO_CLANG_THIN If unsure, say Y. endchoice =20 +config ARCH_SUPPORTS_CFI_CLANG + bool + help + An architecture should select this option if it can support Clang's + Control-Flow Integrity (CFI) checking. + +config CFI_CLANG + bool "Use Clang's Control Flow Integrity (CFI)" + depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG + # Clang >=3D 12: + # - https://bugs.llvm.org/show_bug.cgi?id=3D46258 + # - https://bugs.llvm.org/show_bug.cgi?id=3D47479 + depends on CLANG_VERSION >=3D 120000 + select KALLSYMS + help + This option enables Clang=E2=80=99s forward-edge Control Flow Integrity + (CFI) checking, where the compiler injects a runtime check to each + indirect function call to ensure the target is a valid function with + the correct static type. This restricts possible call targets and + makes it more difficult for an attacker to exploit bugs that allow + the modification of stored function pointers. More information can be + found from Clang's documentation: + + https://clang.llvm.org/docs/ControlFlowIntegrity.html + +config CFI_CLANG_SHADOW + bool "Use CFI shadow to speed up cross-module checks" + default y + depends on CFI_CLANG && MODULES + help + If you select this option, the kernel builds a fast look-up table of + CFI check functions in loaded modules to reduce performance overhead. + + If unsure, say Y. + +config CFI_PERMISSIVE + bool "Use CFI in permissive mode" + depends on CFI_CLANG + help + When selected, Control Flow Integrity (CFI) violations result in a + warning instead of a kernel panic. This option should only be used + for finding indirect call type mismatches during development. + + If unsure, say N. + config HAVE_ARCH_WITHIN_STACK_FRAMES bool help diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinu= x.lds.h index 0331d5d49551..40a9c101565e 100644 --- a/include/asm-generic/vmlinux.lds.h +++ b/include/asm-generic/vmlinux.lds.h @@ -544,6 +544,22 @@ . =3D ALIGN((align)); \ __end_rodata =3D .; =20 + +/* + * .text..L.cfi.jumptable.* contain Control-Flow Integrity (CFI) + * jump table entries. + */ +#ifdef CONFIG_CFI_CLANG +#define TEXT_CFI_JT \ + . =3D ALIGN(PMD_SIZE); \ + __cfi_jt_start =3D .; \ + *(.text..L.cfi.jumptable .text..L.cfi.jumptable.*) \ + . =3D ALIGN(PMD_SIZE); \ + __cfi_jt_end =3D .; +#else +#define TEXT_CFI_JT +#endif + /* * Non-instrumentable text section */ @@ -570,6 +586,7 @@ NOINSTR_TEXT \ *(.text..refcount) \ *(.ref.text) \ + TEXT_CFI_JT \ MEM_KEEP(init.text*) \ MEM_KEEP(exit.text*) \ =20 @@ -974,7 +991,8 @@ * keep any .init_array.* sections. * https://bugs.llvm.org/show_bug.cgi?id=3D46478 */ -#if defined(CONFIG_GCOV_KERNEL) || defined(CONFIG_KASAN_GENERIC) || define= d(CONFIG_KCSAN) +#if defined(CONFIG_GCOV_KERNEL) || defined(CONFIG_KASAN_GENERIC) || define= d(CONFIG_KCSAN) || \ + defined(CONFIG_CFI_CLANG) # ifdef CONFIG_CONSTRUCTORS # define SANITIZER_DISCARDS \ *(.eh_frame) diff --git a/include/linux/cfi.h b/include/linux/cfi.h new file mode 100644 index 000000000000..879744aaa6e0 --- /dev/null +++ b/include/linux/cfi.h @@ -0,0 +1,41 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Clang Control Flow Integrity (CFI) support. + * + * Copyright (C) 2021 Google LLC + */ +#ifndef _LINUX_CFI_H +#define _LINUX_CFI_H + +#ifdef CONFIG_CFI_CLANG +typedef void (*cfi_check_fn)(uint64_t id, void *ptr, void *diag); + +/* Compiler-generated function in each module, and the kernel */ +extern void __cfi_check(uint64_t id, void *ptr, void *diag); + +/* + * Force the compiler to generate a CFI jump table entry for a function + * and store the jump table address to __cfi_jt_. + */ +#define __CFI_ADDRESSABLE(fn, __attr) \ + const void *__cfi_jt_ ## fn __visible __attr =3D (void *)&fn + +#ifdef CONFIG_CFI_CLANG_SHADOW + +extern void cfi_module_add(struct module *mod, unsigned long base_addr); +extern void cfi_module_remove(struct module *mod, unsigned long base_addr)= ; + +#else + +static inline void cfi_module_add(struct module *mod, unsigned long base_a= ddr) {} +static inline void cfi_module_remove(struct module *mod, unsigned long bas= e_addr) {} + +#endif /* CONFIG_CFI_CLANG_SHADOW */ + +#else /* !CONFIG_CFI_CLANG */ + +#define __CFI_ADDRESSABLE(fn, __attr) + +#endif /* CONFIG_CFI_CLANG */ + +#endif /* _LINUX_CFI_H */ diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.= h index 04c0a5a717f7..1ff22bdad992 100644 --- a/include/linux/compiler-clang.h +++ b/include/linux/compiler-clang.h @@ -55,3 +55,5 @@ #if __has_feature(shadow_call_stack) # define __noscs __attribute__((__no_sanitize__("shadow-call-stack"))) #endif + +#define __nocfi __attribute__((__no_sanitize__("cfi"))) diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.= h index e5dd5a4ae946..796935a37e37 100644 --- a/include/linux/compiler_types.h +++ b/include/linux/compiler_types.h @@ -242,6 +242,10 @@ struct ftrace_likely_data { # define __noscs #endif =20 +#ifndef __nocfi +# define __nocfi +#endif + #ifndef asm_volatile_goto #define asm_volatile_goto(x...) asm goto(x) #endif diff --git a/include/linux/init.h b/include/linux/init.h index 31f54de58429..b3ea15348fbd 100644 --- a/include/linux/init.h +++ b/include/linux/init.h @@ -47,7 +47,7 @@ =20 /* These are for everybody (although not all archs will actually discard it in modules) */ -#define __init __section(".init.text") __cold __latent_entropy __noinitr= etpoline +#define __init __section(".init.text") __cold __latent_entropy __noinitr= etpoline __nocfi #define __initdata __section(".init.data") #define __initconst __section(".init.rodata") #define __exitdata __section(".exit.data") diff --git a/include/linux/module.h b/include/linux/module.h index 59f094fa6f74..b0bbd3f336c5 100644 --- a/include/linux/module.h +++ b/include/linux/module.h @@ -26,6 +26,7 @@ #include #include #include +#include =20 #include #include @@ -131,13 +132,17 @@ extern void cleanup_module(void); #define module_init(initfn) \ static inline initcall_t __maybe_unused __inittest(void) \ { return initfn; } \ - int init_module(void) __copy(initfn) __attribute__((alias(#initfn))); + int init_module(void) __copy(initfn) \ + __attribute__((alias(#initfn))); \ + __CFI_ADDRESSABLE(init_module, __initdata); =20 /* This is only required if you want to be unloadable. */ #define module_exit(exitfn) \ static inline exitcall_t __maybe_unused __exittest(void) \ { return exitfn; } \ - void cleanup_module(void) __copy(exitfn) __attribute__((alias(#exitfn))); + void cleanup_module(void) __copy(exitfn) \ + __attribute__((alias(#exitfn))); \ + __CFI_ADDRESSABLE(cleanup_module, __exitdata); =20 #endif =20 @@ -379,6 +384,10 @@ struct module { const s32 *crcs; unsigned int num_syms; =20 +#ifdef CONFIG_CFI_CLANG + cfi_check_fn cfi_check; +#endif + /* Kernel parameters. */ #ifdef CONFIG_SYSFS struct mutex param_lock; diff --git a/init/Kconfig b/init/Kconfig index 22946fe5ded9..2972df4e6060 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -2297,7 +2297,7 @@ endif # MODULES =20 config MODULES_TREE_LOOKUP def_bool y - depends on PERF_EVENTS || TRACING + depends on PERF_EVENTS || TRACING || CFI_CLANG =20 config INIT_ALL_POSSIBLE bool diff --git a/kernel/Makefile b/kernel/Makefile index 320f1f3941b7..e8a6715f38dc 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -41,6 +41,9 @@ KCSAN_SANITIZE_kcov.o :=3D n UBSAN_SANITIZE_kcov.o :=3D n CFLAGS_kcov.o :=3D $(call cc-option, -fno-conserve-stack) -fno-stack-prote= ctor =20 +# Don't instrument error handlers +CFLAGS_REMOVE_cfi.o :=3D $(CC_FLAGS_CFI) + obj-y +=3D sched/ obj-y +=3D locking/ obj-y +=3D power/ @@ -111,6 +114,7 @@ obj-$(CONFIG_BPF) +=3D bpf/ obj-$(CONFIG_KCSAN) +=3D kcsan/ obj-$(CONFIG_SHADOW_CALL_STACK) +=3D scs.o obj-$(CONFIG_HAVE_STATIC_CALL_INLINE) +=3D static_call.o +obj-$(CONFIG_CFI_CLANG) +=3D cfi.o =20 obj-$(CONFIG_PERF_EVENTS) +=3D events/ =20 diff --git a/kernel/cfi.c b/kernel/cfi.c new file mode 100644 index 000000000000..8c9ed3f7058a --- /dev/null +++ b/kernel/cfi.c @@ -0,0 +1,329 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Clang Control Flow Integrity (CFI) error and slowpath handling. + * + * Copyright (C) 2021 Google LLC + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* Compiler-defined handler names */ +#ifdef CONFIG_CFI_PERMISSIVE +#define cfi_failure_handler __ubsan_handle_cfi_check_fail +#else +#define cfi_failure_handler __ubsan_handle_cfi_check_fail_abort +#endif + +static inline void handle_cfi_failure(void *ptr) +{ + if (IS_ENABLED(CONFIG_CFI_PERMISSIVE)) + WARN_RATELIMIT(1, "CFI failure (target: %pS):\n", ptr); + else + panic("CFI failure (target: %pS)\n", ptr); +} + +#ifdef CONFIG_MODULES +#ifdef CONFIG_CFI_CLANG_SHADOW +/* + * Index type. A 16-bit index can address at most (2^16)-2 pages (taking + * into account SHADOW_INVALID), i.e. ~256M with 4k pages. + */ +typedef u16 shadow_t; +#define SHADOW_INVALID ((shadow_t)~0UL) + +struct cfi_shadow { + /* Page index for the beginning of the shadow */ + unsigned long base; + /* An array of __cfi_check locations (as indices to the shadow) */ + shadow_t shadow[1]; +} __packed; + +/* + * The shadow covers ~128M from the beginning of the module region. If + * the region is larger, we fall back to __module_address for the rest. + */ +#define __SHADOW_RANGE (_UL(SZ_128M) >> PAGE_SHIFT) + +/* The in-memory size of struct cfi_shadow, always at least one page */ +#define __SHADOW_PAGES ((__SHADOW_RANGE * sizeof(shadow_t)) >> PAGE_SHIFT= ) +#define SHADOW_PAGES max(1UL, __SHADOW_PAGES) +#define SHADOW_SIZE (SHADOW_PAGES << PAGE_SHIFT) + +/* The actual size of the shadow array, minus metadata */ +#define SHADOW_ARR_SIZE (SHADOW_SIZE - offsetof(struct cfi_shadow, shadow= )) +#define SHADOW_ARR_SLOTS (SHADOW_ARR_SIZE / sizeof(shadow_t)) + +static DEFINE_MUTEX(shadow_update_lock); +static struct cfi_shadow __rcu *cfi_shadow __read_mostly; + +/* Returns the index in the shadow for the given address */ +static inline int ptr_to_shadow(const struct cfi_shadow *s, unsigned long = ptr) +{ + unsigned long index; + unsigned long page =3D ptr >> PAGE_SHIFT; + + if (unlikely(page < s->base)) + return -1; /* Outside of module area */ + + index =3D page - s->base; + + if (index >=3D SHADOW_ARR_SLOTS) + return -1; /* Cannot be addressed with shadow */ + + return (int)index; +} + +/* Returns the page address for an index in the shadow */ +static inline unsigned long shadow_to_ptr(const struct cfi_shadow *s, + int index) +{ + if (unlikely(index < 0 || index >=3D SHADOW_ARR_SLOTS)) + return 0; + + return (s->base + index) << PAGE_SHIFT; +} + +/* Returns the __cfi_check function address for the given shadow location = */ +static inline unsigned long shadow_to_check_fn(const struct cfi_shadow *s, + int index) +{ + if (unlikely(index < 0 || index >=3D SHADOW_ARR_SLOTS)) + return 0; + + if (unlikely(s->shadow[index] =3D=3D SHADOW_INVALID)) + return 0; + + /* __cfi_check is always page aligned */ + return (s->base + s->shadow[index]) << PAGE_SHIFT; +} + +static void prepare_next_shadow(const struct cfi_shadow __rcu *prev, + struct cfi_shadow *next) +{ + int i, index, check; + + /* Mark everything invalid */ + memset(next->shadow, 0xFF, SHADOW_ARR_SIZE); + + if (!prev) + return; /* No previous shadow */ + + /* If the base address didn't change, an update is not needed */ + if (prev->base =3D=3D next->base) { + memcpy(next->shadow, prev->shadow, SHADOW_ARR_SIZE); + return; + } + + /* Convert the previous shadow to the new address range */ + for (i =3D 0; i < SHADOW_ARR_SLOTS; ++i) { + if (prev->shadow[i] =3D=3D SHADOW_INVALID) + continue; + + index =3D ptr_to_shadow(next, shadow_to_ptr(prev, i)); + if (index < 0) + continue; + + check =3D ptr_to_shadow(next, + shadow_to_check_fn(prev, prev->shadow[i])); + if (check < 0) + continue; + + next->shadow[index] =3D (shadow_t)check; + } +} + +static void add_module_to_shadow(struct cfi_shadow *s, struct module *mod, + unsigned long min_addr, unsigned long max_addr) +{ + int check_index; + unsigned long check =3D (unsigned long)mod->cfi_check; + unsigned long ptr; + + if (unlikely(!PAGE_ALIGNED(check))) { + pr_warn("cfi: not using shadow for module %s\n", mod->name); + return; + } + + check_index =3D ptr_to_shadow(s, check); + if (check_index < 0) + return; /* Module not addressable with shadow */ + + /* For each page, store the check function index in the shadow */ + for (ptr =3D min_addr; ptr <=3D max_addr; ptr +=3D PAGE_SIZE) { + int index =3D ptr_to_shadow(s, ptr); + + if (index >=3D 0) { + /* Each page must only contain one module */ + WARN_ON_ONCE(s->shadow[index] !=3D SHADOW_INVALID); + s->shadow[index] =3D (shadow_t)check_index; + } + } +} + +static void remove_module_from_shadow(struct cfi_shadow *s, struct module = *mod, + unsigned long min_addr, unsigned long max_addr) +{ + unsigned long ptr; + + for (ptr =3D min_addr; ptr <=3D max_addr; ptr +=3D PAGE_SIZE) { + int index =3D ptr_to_shadow(s, ptr); + + if (index >=3D 0) + s->shadow[index] =3D SHADOW_INVALID; + } +} + +typedef void (*update_shadow_fn)(struct cfi_shadow *, struct module *, + unsigned long min_addr, unsigned long max_addr); + +static void update_shadow(struct module *mod, unsigned long base_addr, + update_shadow_fn fn) +{ + struct cfi_shadow *prev; + struct cfi_shadow *next; + unsigned long min_addr, max_addr; + + next =3D vmalloc(SHADOW_SIZE); + + mutex_lock(&shadow_update_lock); + prev =3D rcu_dereference_protected(cfi_shadow, + mutex_is_locked(&shadow_update_lock)); + + if (next) { + next->base =3D base_addr >> PAGE_SHIFT; + prepare_next_shadow(prev, next); + + min_addr =3D (unsigned long)mod->core_layout.base; + max_addr =3D min_addr + mod->core_layout.text_size; + fn(next, mod, min_addr & PAGE_MASK, max_addr & PAGE_MASK); + + set_memory_ro((unsigned long)next, SHADOW_PAGES); + } + + rcu_assign_pointer(cfi_shadow, next); + mutex_unlock(&shadow_update_lock); + synchronize_rcu_expedited(); + + if (prev) { + set_memory_rw((unsigned long)prev, SHADOW_PAGES); + vfree(prev); + } +} + +void cfi_module_add(struct module *mod, unsigned long base_addr) +{ + update_shadow(mod, base_addr, add_module_to_shadow); +} + +void cfi_module_remove(struct module *mod, unsigned long base_addr) +{ + update_shadow(mod, base_addr, remove_module_from_shadow); +} + +static inline cfi_check_fn ptr_to_check_fn(const struct cfi_shadow __rcu *= s, + unsigned long ptr) +{ + int index; + + if (unlikely(!s)) + return NULL; /* No shadow available */ + + index =3D ptr_to_shadow(s, ptr); + if (index < 0) + return NULL; /* Cannot be addressed with shadow */ + + return (cfi_check_fn)shadow_to_check_fn(s, index); +} + +static inline cfi_check_fn find_shadow_check_fn(unsigned long ptr) +{ + cfi_check_fn fn; + + rcu_read_lock_sched(); + fn =3D ptr_to_check_fn(rcu_dereference_sched(cfi_shadow), ptr); + rcu_read_unlock_sched(); + + return fn; +} + +#else /* !CONFIG_CFI_CLANG_SHADOW */ + +static inline cfi_check_fn find_shadow_check_fn(unsigned long ptr) +{ + return NULL; +} + +#endif /* CONFIG_CFI_CLANG_SHADOW */ + +static inline cfi_check_fn find_module_check_fn(unsigned long ptr) +{ + cfi_check_fn fn =3D NULL; + struct module *mod; + + rcu_read_lock_sched(); + mod =3D __module_address(ptr); + if (mod) + fn =3D mod->cfi_check; + rcu_read_unlock_sched(); + + return fn; +} + +static inline cfi_check_fn find_check_fn(unsigned long ptr) +{ + cfi_check_fn fn =3D NULL; + + if (is_kernel_text(ptr)) + return __cfi_check; + + /* + * Indirect call checks can happen when RCU is not watching. Both + * the shadow and __module_address use RCU, so we need to wake it + * up if necessary. + */ + RCU_NONIDLE({ + if (IS_ENABLED(CONFIG_CFI_CLANG_SHADOW)) + fn =3D find_shadow_check_fn(ptr); + + if (!fn) + fn =3D find_module_check_fn(ptr); + }); + + return fn; +} + +void __cfi_slowpath_diag(uint64_t id, void *ptr, void *diag) +{ + cfi_check_fn fn =3D find_check_fn((unsigned long)ptr); + + if (likely(fn)) + fn(id, ptr, diag); + else /* Don't allow unchecked modules */ + handle_cfi_failure(ptr); +} +EXPORT_SYMBOL(__cfi_slowpath_diag); + +#else /* !CONFIG_MODULES */ + +void __cfi_slowpath_diag(uint64_t id, void *ptr, void *diag) +{ + handle_cfi_failure(ptr); /* No modules */ +} +EXPORT_SYMBOL(__cfi_slowpath_diag); + +#endif /* CONFIG_MODULES */ + +void cfi_failure_handler(void *data, void *ptr, void *vtable) +{ + handle_cfi_failure(ptr); +} +EXPORT_SYMBOL(cfi_failure_handler); diff --git a/kernel/module.c b/kernel/module.c index 30479355ab85..20fb004e7d8d 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -2146,6 +2146,8 @@ void __weak module_arch_freeing_init(struct module *m= od) { } =20 +static void cfi_cleanup(struct module *mod); + /* Free a module, remove from lists, etc. */ static void free_module(struct module *mod) { @@ -2187,6 +2189,9 @@ static void free_module(struct module *mod) synchronize_rcu(); mutex_unlock(&module_mutex); =20 + /* Clean up CFI for the module. */ + cfi_cleanup(mod); + /* This may be empty, but that's OK */ module_arch_freeing_init(mod); module_memfree(mod->init_layout.base); @@ -3866,6 +3871,8 @@ static int unknown_module_param_cb(char *param, char = *val, const char *modname, return 0; } =20 +static void cfi_init(struct module *mod); + /* * Allocate and load the module: note that size of section 0 is always * zero, and we rely on this for optional sections. @@ -3997,6 +4004,9 @@ static int load_module(struct load_info *info, const = char __user *uargs, =20 flush_module_icache(mod); =20 + /* Setup CFI for the module. */ + cfi_init(mod); + /* Now copy in args */ mod->args =3D strndup_user(uargs, ~0UL >> 1); if (IS_ERR(mod->args)) { @@ -4070,6 +4080,7 @@ static int load_module(struct load_info *info, const = char __user *uargs, synchronize_rcu(); kfree(mod->args); free_arch_cleanup: + cfi_cleanup(mod); module_arch_cleanup(mod); free_modinfo: free_modinfo(mod); @@ -4415,6 +4426,38 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *,= const char *, #endif /* CONFIG_LIVEPATCH */ #endif /* CONFIG_KALLSYMS */ =20 +static void cfi_init(struct module *mod) +{ +#ifdef CONFIG_CFI_CLANG + initcall_t *init; + exitcall_t *exit; + + rcu_read_lock_sched(); + mod->cfi_check =3D (cfi_check_fn) + find_kallsyms_symbol_value(mod, "__cfi_check"); + init =3D (initcall_t *) + find_kallsyms_symbol_value(mod, "__cfi_jt_init_module"); + exit =3D (exitcall_t *) + find_kallsyms_symbol_value(mod, "__cfi_jt_cleanup_module"); + rcu_read_unlock_sched(); + + /* Fix init/exit functions to point to the CFI jump table */ + if (init) + mod->init =3D *init; + if (exit) + mod->exit =3D *exit; + + cfi_module_add(mod, module_addr_min); +#endif +} + +static void cfi_cleanup(struct module *mod) +{ +#ifdef CONFIG_CFI_CLANG + cfi_module_remove(mod, module_addr_min); +#endif +} + /* Maximum number of characters written by module_flags() */ #define MODULE_FLAGS_BUF_SIZE (TAINT_FLAGS_COUNT + 4) =20 diff --git a/scripts/Makefile.modfinal b/scripts/Makefile.modfinal index 735e11e9041b..dd87cea9fba7 100644 --- a/scripts/Makefile.modfinal +++ b/scripts/Makefile.modfinal @@ -23,7 +23,7 @@ modname =3D $(notdir $(@:.mod.o=3D)) part-of-module =3D y =20 quiet_cmd_cc_o_c =3D CC [M] $@ - cmd_cc_o_c =3D $(CC) $(c_flags) -c -o $@ $< + cmd_cc_o_c =3D $(CC) $(filter-out $(CC_FLAGS_CFI), $(c_flags)) -c -o= $@ $< =20 %.mod.o: %.mod.c FORCE $(call if_changed_dep,cc_o_c) --=20 2.31.0.rc2.261.g7f71774620-goog From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78BBFC433DB for ; Fri, 12 Mar 2021 00:51:58 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id DB17564F82 for ; Fri, 12 Mar 2021 00:51:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org DB17564F82 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Cc:To:From:Subject:References:Mime-Version: Message-Id:In-Reply-To:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=DV0mdbAehXv4j4p5zlNDhVCHiFcUGZIzYRL2o8zMeIk=; b=N5ADyDdjZtfaxt Pu0B3ItGDb8NUmWZVF0ZmtFK6sPPk9SOFVHb+bM6EmOXDO8x+V/9ylZD/W6KLhNzKs4fCKg/tUKsn 08iRWF018AGDP+v2DFr6S4twZfC2DmKLXGHldca6otxu4hYrCPkabaBBVLWNFOC7yJb085KoJ7tbw ZF3pFOGyIHfEAOkuz+uYiiIZuxnIkJX96IuIqRJR5HLcdOSB/F0sXsGTquV4Db/H57KPjfsXpvOvm 8YwIgeHeKC7OirvGvcpvhCG3T186fqkMU6Q6rPBjBeO9ScVQqDllREgo8TYEbI6kr5WQL1AX3WxGw FqlMr9vInyrBCBt40kDg==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lKVzy-00AKqh-Tk; Fri, 12 Mar 2021 00:49:51 +0000 Received: from mail-qk1-x749.google.com ([2607:f8b0:4864:20::749]) by desiato.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lKVzb-00AKku-EH for linux-arm-kernel@lists.infradead.org; Fri, 12 Mar 2021 00:49:30 +0000 Received: by mail-qk1-x749.google.com with SMTP id a137so13338996qkb.20 for ; Thu, 11 Mar 2021 16:49:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc:content-transfer-encoding; bh=kYWK0LnFOZQUSIgVrFyNXnXq3MuC82/VVIJ2++AQu2s=; b=oMXK92xYzFFfoJOoKcwJb28jCIk7pb8pDEzOHr256GwfhlElhlOgE4o82w/iz4ZT7d +V4cu2LqO0CEJK2kLSkD0Es+Ggg8N+9YIml4D+pvlOhEjBZQRc3xre0UHNTamO4be4b7 pbfmN2pwlagJ3zLfqw2sddG8ViZFumtR750SHj19i++7MUmkbuqkw4p9hTJpmh47RLOv YT+YAfVXE6pR/fa7hX1vOBKlCpGVYb2BX8E8G80cQVeqxUCrCCWXfaTT8ClWQI/rxPJR 4sJED1wWb/nEpWdlZsKcK8AUiCrJtxME50dsV4qgl/hFHC/tOWHyNld+EzcsLxKvF2Ia Fnbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc:content-transfer-encoding; bh=kYWK0LnFOZQUSIgVrFyNXnXq3MuC82/VVIJ2++AQu2s=; b=HsFrOgHPjQivxLzIpRGlt8icO5LULQMkyBKwF+m+FCeOo+Fschm7Q4YEuPJj8z7I2C 3n5EA2wAU/zaNTT5AnTIbpw1gr62kDAd2nVTcHc+y/KrvA/If5aLj0UcYbVH4e+x3LFz IpBPnUKEL5zufZjkhvfL6XUwJVJ5trR/mKGkHlI3l5tf6fQihXx+ZrYukdTe4avGqd68 jPUIey/aqZIsEd+eEJNkIoMTbL3qlnNUYa9pZdTql6JhM+Oy9lkPAgjbNu9VP/4b2ULz pVadNKNaNjWV2K5hbFA4D8rEHHSVighIISUBlMQcZaGueQycuThVgW8nWqFUoI9dfLZ9 rRgA== X-Gm-Message-State: AOAM531+DwjzRol2uflepSco9bZGwod2moLv3jsuk1WmuJY0/15iEl1K YWAa3tA0fcwQMxEJNvPhHqKzuax103SRdC/BpUo= X-Google-Smtp-Source: ABdhPJwEGVsKx2ovPS4g444wFkX3TkmdaWS9gvqhU/f0Ua52OAgVry8uJvld3sA8rgr4BKG4wtH0DIiz3MjA/nCRz/k= X-Received: from samitolvanen1.mtv.corp.google.com ([2620:15c:201:2:c86b:8269:af92:55a]) (user=samitolvanen job=sendgmr) by 2002:ad4:51c1:: with SMTP id p1mr10485236qvq.39.1615510162641; Thu, 11 Mar 2021 16:49:22 -0800 (PST) Date: Thu, 11 Mar 2021 16:49:03 -0800 In-Reply-To: <20210312004919.669614-1-samitolvanen@google.com> Message-Id: <20210312004919.669614-2-samitolvanen@google.com> Mime-Version: 1.0 References: <20210312004919.669614-1-samitolvanen@google.com> X-Mailer: git-send-email 2.31.0.rc2.261.g7f71774620-goog Subject: [PATCH 01/17] add support for Clang CFI From: Sami Tolvanen To: Kees Cook Cc: Nathan Chancellor , Nick Desaulniers , Masahiro Yamada , Will Deacon , Jessica Yu , Arnd Bergmann , Tejun Heo , bpf@vger.kernel.org, linux-hardening@vger.kernel.org, linux-arch@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kbuild@vger.kernel.org, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Sami Tolvanen X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210312_004927_813156_4ECA7D65 X-CRM114-Status: GOOD ( 33.71 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org VGhpcyBjaGFuZ2UgYWRkcyBzdXBwb3J0IGZvciBDbGFuZ+KAmXMgZm9yd2FyZC1lZGdlIENvbnRy b2wgRmxvdwpJbnRlZ3JpdHkgKENGSSkgY2hlY2tpbmcuIFdpdGggQ09ORklHX0NGSV9DTEFORywg dGhlIGNvbXBpbGVyCmluamVjdHMgYSBydW50aW1lIGNoZWNrIGJlZm9yZSBlYWNoIGluZGlyZWN0 IGZ1bmN0aW9uIGNhbGwgdG8gZW5zdXJlCnRoZSB0YXJnZXQgaXMgYSB2YWxpZCBmdW5jdGlvbiB3 aXRoIHRoZSBjb3JyZWN0IHN0YXRpYyB0eXBlLiBUaGlzCnJlc3RyaWN0cyBwb3NzaWJsZSBjYWxs IHRhcmdldHMgYW5kIG1ha2VzIGl0IG1vcmUgZGlmZmljdWx0IGZvcgphbiBhdHRhY2tlciB0byBl eHBsb2l0IGJ1Z3MgdGhhdCBhbGxvdyB0aGUgbW9kaWZpY2F0aW9uIG9mIHN0b3JlZApmdW5jdGlv biBwb2ludGVycy4gRm9yIG1vcmUgZGV0YWlscywgc2VlOgoKICBodHRwczovL2NsYW5nLmxsdm0u b3JnL2RvY3MvQ29udHJvbEZsb3dJbnRlZ3JpdHkuaHRtbAoKQ2xhbmcgcmVxdWlyZXMgQ09ORklH X0xUT19DTEFORyB0byBiZSBlbmFibGVkIHdpdGggQ0ZJIHRvIGdhaW4KdmlzaWJpbGl0eSB0byBw b3NzaWJsZSBjYWxsIHRhcmdldHMuIEtlcm5lbCBtb2R1bGVzIGFyZSBzdXBwb3J0ZWQKd2l0aCBD bGFuZ+KAmXMgY3Jvc3MtRFNPIENGSSBtb2RlLCB3aGljaCBhbGxvd3MgY2hlY2tpbmcgYmV0d2Vl bgppbmRlcGVuZGVudGx5IGNvbXBpbGVkIGNvbXBvbmVudHMuCgpXaXRoIENGSSBlbmFibGVkLCB0 aGUgY29tcGlsZXIgaW5qZWN0cyBhIF9fY2ZpX2NoZWNrKCkgZnVuY3Rpb24gaW50bwp0aGUga2Vy bmVsIGFuZCBlYWNoIG1vZHVsZSBmb3IgdmFsaWRhdGluZyBsb2NhbCBjYWxsIHRhcmdldHMuIEZv cgpjcm9zcy1tb2R1bGUgY2FsbHMgdGhhdCBjYW5ub3QgYmUgdmFsaWRhdGVkIGxvY2FsbHksIHRo ZSBjb21waWxlcgpjYWxscyB0aGUgZ2xvYmFsIF9fY2ZpX3Nsb3dwYXRoX2RpYWcoKSBmdW5jdGlv biwgd2hpY2ggZGV0ZXJtaW5lcwp0aGUgdGFyZ2V0IG1vZHVsZSBhbmQgY2FsbHMgdGhlIGNvcnJl Y3QgX19jZmlfY2hlY2soKSBmdW5jdGlvbi4gVGhpcwpwYXRjaCBpbmNsdWRlcyBhIHNsb3dwYXRo IGltcGxlbWVudGF0aW9uIHRoYXQgdXNlcyBfX21vZHVsZV9hZGRyZXNzKCkKdG8gcmVzb2x2ZSBj YWxsIHRhcmdldHMsIGFuZCB3aXRoIENPTkZJR19DRklfQ0xBTkdfU0hBRE9XIGVuYWJsZWQsIGEK c2hhZG93IG1hcCB0aGF0IHNwZWVkcyB1cCBtb2R1bGUgbG9vay11cHMgYnkgfjN4LgoKQ2xhbmcg aW1wbGVtZW50cyBpbmRpcmVjdCBjYWxsIGNoZWNraW5nIHVzaW5nIGp1bXAgdGFibGVzIGFuZApv ZmZlcnMgdHdvIG1ldGhvZHMgb2YgZ2VuZXJhdGluZyB0aGVtLiBXaXRoIGNhbm9uaWNhbCBqdW1w IHRhYmxlcywKdGhlIGNvbXBpbGVyIHJlbmFtZXMgZWFjaCBhZGRyZXNzLXRha2VuIGZ1bmN0aW9u IHRvIDxmdW5jdGlvbj4uY2ZpCmFuZCBwb2ludHMgdGhlIG9yaWdpbmFsIHN5bWJvbCB0byBhIGp1 bXAgdGFibGUgZW50cnksIHdoaWNoIHBhc3NlcwpfX2NmaV9jaGVjaygpIHZhbGlkYXRpb24uIFRo aXMgaXNu4oCZdCBjb21wYXRpYmxlIHdpdGggc3RhbmQtYWxvbmUKYXNzZW1ibHkgY29kZSwgd2hp Y2ggdGhlIGNvbXBpbGVyIGRvZXNu4oCZdCBpbnN0cnVtZW50LCBhbmQgd291bGQKcmVzdWx0IGlu IGluZGlyZWN0IGNhbGxzIHRvIGFzc2VtYmx5IGNvZGUgdG8gZmFpbC4gVGhlcmVmb3JlLCB3ZQpk ZWZhdWx0IHRvIHVzaW5nIG5vbi1jYW5vbmljYWwganVtcCB0YWJsZXMgaW5zdGVhZCwgd2hlcmUg dGhlIGNvbXBpbGVyCmdlbmVyYXRlcyBhIGxvY2FsIGp1bXAgdGFibGUgZW50cnkgPGZ1bmN0aW9u Pi5jZmlfanQgZm9yIGVhY2gKYWRkcmVzcy10YWtlbiBmdW5jdGlvbiwgYW5kIHJlcGxhY2VzIGFs bCByZWZlcmVuY2VzIHRvIHRoZSBmdW5jdGlvbgp3aXRoIHRoZSBhZGRyZXNzIG9mIHRoZSBqdW1w IHRhYmxlIGVudHJ5LgoKTm90ZSB0aGF0IGJlY2F1c2Ugbm9uLWNhbm9uaWNhbCBqdW1wIHRhYmxl IGFkZHJlc3NlcyBhcmUgbG9jYWwKdG8gZWFjaCBjb21wb25lbnQsIHRoZXkgYnJlYWsgY3Jvc3Mt bW9kdWxlIGZ1bmN0aW9uIGFkZHJlc3MKZXF1YWxpdHkuIFNwZWNpZmljYWxseSwgdGhlIGFkZHJl c3Mgb2YgYSBnbG9iYWwgZnVuY3Rpb24gd2lsbCBiZQpkaWZmZXJlbnQgaW4gZWFjaCBtb2R1bGUs IGFzIGl0J3MgcmVwbGFjZWQgd2l0aCB0aGUgYWRkcmVzcyBvZiBhIGxvY2FsCmp1bXAgdGFibGUg ZW50cnkuIElmIHRoaXMgYWRkcmVzcyBpcyBwYXNzZWQgdG8gYSBkaWZmZXJlbnQgbW9kdWxlLApp dCB3b27igJl0IG1hdGNoIHRoZSBhZGRyZXNzIG9mIHRoZSBzYW1lIGZ1bmN0aW9uIHRha2VuIHRo ZXJlLiBUaGlzCm1heSBicmVhayBjb2RlIHRoYXQgcmVsaWVzIG9uIGNvbXBhcmluZyBhZGRyZXNz ZXMgcGFzc2VkIGZyb20gb3RoZXIKY29tcG9uZW50cy4KCkNGSSBjaGVja2luZyBjYW4gYmUgZGlz YWJsZWQgaW4gYSBmdW5jdGlvbiB3aXRoIHRoZSBfX25vY2ZpIGF0dHJpYnV0ZS4KQWRkaXRpb25h bGx5LCBDRkkgY2FuIGJlIGRpc2FibGVkIGZvciBhbiBlbnRpcmUgY29tcGlsYXRpb24gdW5pdCBi eQpmaWx0ZXJpbmcgb3V0IENDX0ZMQUdTX0NGSS4KCkJ5IGRlZmF1bHQsIENGSSBmYWlsdXJlcyBy ZXN1bHQgaW4gYSBrZXJuZWwgcGFuaWMgdG8gc3RvcCBhIHBvdGVudGlhbApleHBsb2l0LiBDT05G SUdfQ0ZJX1BFUk1JU1NJVkUgZW5hYmxlcyBhIHBlcm1pc3NpdmUgbW9kZSwgd2hlcmUgdGhlCmtl cm5lbCBwcmludHMgb3V0IGEgcmF0ZS1saW1pdGVkIHdhcm5pbmcgaW5zdGVhZCwgYW5kIGFsbG93 cyBleGVjdXRpb24KdG8gY29udGludWUuIFRoaXMgb3B0aW9uIGlzIGhlbHBmdWwgZm9yIGxvY2F0 aW5nIHR5cGUgbWlzbWF0Y2hlcywgYnV0CnNob3VsZCBvbmx5IGJlIGVuYWJsZWQgZHVyaW5nIGRl dmVsb3BtZW50LgoKU2lnbmVkLW9mZi1ieTogU2FtaSBUb2x2YW5lbiA8c2FtaXRvbHZhbmVuQGdv b2dsZS5jb20+Ci0tLQogTWFrZWZpbGUgICAgICAgICAgICAgICAgICAgICAgICAgIHwgIDE3ICsr CiBhcmNoL0tjb25maWcgICAgICAgICAgICAgICAgICAgICAgfCAgNDUgKysrKwogaW5jbHVkZS9h c20tZ2VuZXJpYy92bWxpbnV4Lmxkcy5oIHwgIDIwICstCiBpbmNsdWRlL2xpbnV4L2NmaS5oICAg ICAgICAgICAgICAgfCAgNDEgKysrKwogaW5jbHVkZS9saW51eC9jb21waWxlci1jbGFuZy5oICAg IHwgICAyICsKIGluY2x1ZGUvbGludXgvY29tcGlsZXJfdHlwZXMuaCAgICB8ICAgNCArCiBpbmNs dWRlL2xpbnV4L2luaXQuaCAgICAgICAgICAgICAgfCAgIDIgKy0KIGluY2x1ZGUvbGludXgvbW9k dWxlLmggICAgICAgICAgICB8ICAxMyArLQogaW5pdC9LY29uZmlnICAgICAgICAgICAgICAgICAg ICAgIHwgICAyICstCiBrZXJuZWwvTWFrZWZpbGUgICAgICAgICAgICAgICAgICAgfCAgIDQgKwog a2VybmVsL2NmaS5jICAgICAgICAgICAgICAgICAgICAgIHwgMzI5ICsrKysrKysrKysrKysrKysr KysrKysrKysrKysrKwoga2VybmVsL21vZHVsZS5jICAgICAgICAgICAgICAgICAgIHwgIDQzICsr KysKIHNjcmlwdHMvTWFrZWZpbGUubW9kZmluYWwgICAgICAgICB8ICAgMiArLQogMTMgZmlsZXMg Y2hhbmdlZCwgNTE4IGluc2VydGlvbnMoKyksIDYgZGVsZXRpb25zKC0pCiBjcmVhdGUgbW9kZSAx MDA2NDQgaW5jbHVkZS9saW51eC9jZmkuaAogY3JlYXRlIG1vZGUgMTAwNjQ0IGtlcm5lbC9jZmku YwoKZGlmZiAtLWdpdCBhL01ha2VmaWxlIGIvTWFrZWZpbGUKaW5kZXggMzFkY2RiM2Q2MWZhLi40 MWM0YmFkNTBkMzEgMTAwNjQ0Ci0tLSBhL01ha2VmaWxlCisrKyBiL01ha2VmaWxlCkBAIC05MTgs NiArOTE4LDIzIEBAIEtCVUlMRF9BRkxBR1MJKz0gLWZuby1sdG8KIGV4cG9ydCBDQ19GTEFHU19M VE8KIGVuZGlmCiAKK2lmZGVmIENPTkZJR19DRklfQ0xBTkcKK0NDX0ZMQUdTX0NGSQk6PSAtZnNh bml0aXplPWNmaSBcCisJCSAgIC1mc2FuaXRpemUtY2ZpLWNyb3NzLWRzbyBcCisJCSAgIC1mbm8t c2FuaXRpemUtY2ZpLWNhbm9uaWNhbC1qdW1wLXRhYmxlcyBcCisJCSAgIC1mbm8tc2FuaXRpemUt dHJhcD1jZmkgXAorCQkgICAtZm5vLXNhbml0aXplLWJsYWNrbGlzdAorCitpZmRlZiBDT05GSUdf Q0ZJX1BFUk1JU1NJVkUKK0NDX0ZMQUdTX0NGSQkrPSAtZnNhbml0aXplLXJlY292ZXI9Y2ZpCitl bmRpZgorCisjIElmIExUTyBmbGFncyBhcmUgZmlsdGVyZWQgb3V0LCB3ZSBtdXN0IGFsc28gZmls dGVyIG91dCBDRkkuCitDQ19GTEFHU19MVE8JKz0gJChDQ19GTEFHU19DRkkpCitLQlVJTERfQ0ZM QUdTCSs9ICQoQ0NfRkxBR1NfQ0ZJKQorZXhwb3J0IENDX0ZMQUdTX0NGSQorZW5kaWYKKwogaWZk ZWYgQ09ORklHX0RFQlVHX0ZPUkNFX0ZVTkNUSU9OX0FMSUdOXzMyQgogS0JVSUxEX0NGTEFHUyAr PSAtZmFsaWduLWZ1bmN0aW9ucz0zMgogZW5kaWYKZGlmZiAtLWdpdCBhL2FyY2gvS2NvbmZpZyBi L2FyY2gvS2NvbmZpZwppbmRleCAyYmIzMDY3M2Q4ZTYuLjU3ZWM2NjM4MjhkYyAxMDA2NDQKLS0t IGEvYXJjaC9LY29uZmlnCisrKyBiL2FyY2gvS2NvbmZpZwpAQCAtNjkzLDYgKzY5Myw1MSBAQCBj b25maWcgTFRPX0NMQU5HX1RISU4KIAkgIElmIHVuc3VyZSwgc2F5IFkuCiBlbmRjaG9pY2UKIAor Y29uZmlnIEFSQ0hfU1VQUE9SVFNfQ0ZJX0NMQU5HCisJYm9vbAorCWhlbHAKKwkgIEFuIGFyY2hp dGVjdHVyZSBzaG91bGQgc2VsZWN0IHRoaXMgb3B0aW9uIGlmIGl0IGNhbiBzdXBwb3J0IENsYW5n J3MKKwkgIENvbnRyb2wtRmxvdyBJbnRlZ3JpdHkgKENGSSkgY2hlY2tpbmcuCisKK2NvbmZpZyBD RklfQ0xBTkcKKwlib29sICJVc2UgQ2xhbmcncyBDb250cm9sIEZsb3cgSW50ZWdyaXR5IChDRkkp IgorCWRlcGVuZHMgb24gTFRPX0NMQU5HICYmIEFSQ0hfU1VQUE9SVFNfQ0ZJX0NMQU5HCisJIyBD bGFuZyA+PSAxMjoKKwkjIC0gaHR0cHM6Ly9idWdzLmxsdm0ub3JnL3Nob3dfYnVnLmNnaT9pZD00 NjI1OAorCSMgLSBodHRwczovL2J1Z3MubGx2bS5vcmcvc2hvd19idWcuY2dpP2lkPTQ3NDc5CisJ ZGVwZW5kcyBvbiBDTEFOR19WRVJTSU9OID49IDEyMDAwMAorCXNlbGVjdCBLQUxMU1lNUworCWhl bHAKKwkgIFRoaXMgb3B0aW9uIGVuYWJsZXMgQ2xhbmfigJlzIGZvcndhcmQtZWRnZSBDb250cm9s IEZsb3cgSW50ZWdyaXR5CisJICAoQ0ZJKSBjaGVja2luZywgd2hlcmUgdGhlIGNvbXBpbGVyIGlu amVjdHMgYSBydW50aW1lIGNoZWNrIHRvIGVhY2gKKwkgIGluZGlyZWN0IGZ1bmN0aW9uIGNhbGwg dG8gZW5zdXJlIHRoZSB0YXJnZXQgaXMgYSB2YWxpZCBmdW5jdGlvbiB3aXRoCisJICB0aGUgY29y cmVjdCBzdGF0aWMgdHlwZS4gVGhpcyByZXN0cmljdHMgcG9zc2libGUgY2FsbCB0YXJnZXRzIGFu ZAorCSAgbWFrZXMgaXQgbW9yZSBkaWZmaWN1bHQgZm9yIGFuIGF0dGFja2VyIHRvIGV4cGxvaXQg YnVncyB0aGF0IGFsbG93CisJICB0aGUgbW9kaWZpY2F0aW9uIG9mIHN0b3JlZCBmdW5jdGlvbiBw b2ludGVycy4gTW9yZSBpbmZvcm1hdGlvbiBjYW4gYmUKKwkgIGZvdW5kIGZyb20gQ2xhbmcncyBk b2N1bWVudGF0aW9uOgorCisJICAgIGh0dHBzOi8vY2xhbmcubGx2bS5vcmcvZG9jcy9Db250cm9s Rmxvd0ludGVncml0eS5odG1sCisKK2NvbmZpZyBDRklfQ0xBTkdfU0hBRE9XCisJYm9vbCAiVXNl IENGSSBzaGFkb3cgdG8gc3BlZWQgdXAgY3Jvc3MtbW9kdWxlIGNoZWNrcyIKKwlkZWZhdWx0IHkK KwlkZXBlbmRzIG9uIENGSV9DTEFORyAmJiBNT0RVTEVTCisJaGVscAorCSAgSWYgeW91IHNlbGVj dCB0aGlzIG9wdGlvbiwgdGhlIGtlcm5lbCBidWlsZHMgYSBmYXN0IGxvb2stdXAgdGFibGUgb2YK KwkgIENGSSBjaGVjayBmdW5jdGlvbnMgaW4gbG9hZGVkIG1vZHVsZXMgdG8gcmVkdWNlIHBlcmZv cm1hbmNlIG92ZXJoZWFkLgorCisJICBJZiB1bnN1cmUsIHNheSBZLgorCitjb25maWcgQ0ZJX1BF Uk1JU1NJVkUKKwlib29sICJVc2UgQ0ZJIGluIHBlcm1pc3NpdmUgbW9kZSIKKwlkZXBlbmRzIG9u IENGSV9DTEFORworCWhlbHAKKwkgIFdoZW4gc2VsZWN0ZWQsIENvbnRyb2wgRmxvdyBJbnRlZ3Jp dHkgKENGSSkgdmlvbGF0aW9ucyByZXN1bHQgaW4gYQorCSAgd2FybmluZyBpbnN0ZWFkIG9mIGEg a2VybmVsIHBhbmljLiBUaGlzIG9wdGlvbiBzaG91bGQgb25seSBiZSB1c2VkCisJICBmb3IgZmlu ZGluZyBpbmRpcmVjdCBjYWxsIHR5cGUgbWlzbWF0Y2hlcyBkdXJpbmcgZGV2ZWxvcG1lbnQuCisK KwkgIElmIHVuc3VyZSwgc2F5IE4uCisKIGNvbmZpZyBIQVZFX0FSQ0hfV0lUSElOX1NUQUNLX0ZS QU1FUwogCWJvb2wKIAloZWxwCmRpZmYgLS1naXQgYS9pbmNsdWRlL2FzbS1nZW5lcmljL3ZtbGlu dXgubGRzLmggYi9pbmNsdWRlL2FzbS1nZW5lcmljL3ZtbGludXgubGRzLmgKaW5kZXggMDMzMWQ1 ZDQ5NTUxLi40MGE5YzEwMTU2NWUgMTAwNjQ0Ci0tLSBhL2luY2x1ZGUvYXNtLWdlbmVyaWMvdm1s aW51eC5sZHMuaAorKysgYi9pbmNsdWRlL2FzbS1nZW5lcmljL3ZtbGludXgubGRzLmgKQEAgLTU0 NCw2ICs1NDQsMjIgQEAKIAkuID0gQUxJR04oKGFsaWduKSk7CQkJCQkJXAogCV9fZW5kX3JvZGF0 YSA9IC47CiAKKworLyoKKyAqIC50ZXh0Li5MLmNmaS5qdW1wdGFibGUuKiBjb250YWluIENvbnRy b2wtRmxvdyBJbnRlZ3JpdHkgKENGSSkKKyAqIGp1bXAgdGFibGUgZW50cmllcy4KKyAqLworI2lm ZGVmIENPTkZJR19DRklfQ0xBTkcKKyNkZWZpbmUgVEVYVF9DRklfSlQJCQkJCQkJXAorCQkuID0g QUxJR04oUE1EX1NJWkUpOwkJCQkJXAorCQlfX2NmaV9qdF9zdGFydCA9IC47CQkJCQlcCisJCSoo LnRleHQuLkwuY2ZpLmp1bXB0YWJsZSAudGV4dC4uTC5jZmkuanVtcHRhYmxlLiopCVwKKwkJLiA9 IEFMSUdOKFBNRF9TSVpFKTsJCQkJCVwKKwkJX19jZmlfanRfZW5kID0gLjsKKyNlbHNlCisjZGVm aW5lIFRFWFRfQ0ZJX0pUCisjZW5kaWYKKwogLyoKICAqIE5vbi1pbnN0cnVtZW50YWJsZSB0ZXh0 IHNlY3Rpb24KICAqLwpAQCAtNTcwLDYgKzU4Niw3IEBACiAJCU5PSU5TVFJfVEVYVAkJCQkJCVwK IAkJKigudGV4dC4ucmVmY291bnQpCQkJCQlcCiAJCSooLnJlZi50ZXh0KQkJCQkJCVwKKwkJVEVY VF9DRklfSlQJCQkJCQlcCiAJTUVNX0tFRVAoaW5pdC50ZXh0KikJCQkJCQlcCiAJTUVNX0tFRVAo ZXhpdC50ZXh0KikJCQkJCQlcCiAKQEAgLTk3NCw3ICs5OTEsOCBAQAogICoga2VlcCBhbnkgLmlu aXRfYXJyYXkuKiBzZWN0aW9ucy4KICAqIGh0dHBzOi8vYnVncy5sbHZtLm9yZy9zaG93X2J1Zy5j Z2k/aWQ9NDY0NzgKICAqLwotI2lmIGRlZmluZWQoQ09ORklHX0dDT1ZfS0VSTkVMKSB8fCBkZWZp bmVkKENPTkZJR19LQVNBTl9HRU5FUklDKSB8fCBkZWZpbmVkKENPTkZJR19LQ1NBTikKKyNpZiBk ZWZpbmVkKENPTkZJR19HQ09WX0tFUk5FTCkgfHwgZGVmaW5lZChDT05GSUdfS0FTQU5fR0VORVJJ QykgfHwgZGVmaW5lZChDT05GSUdfS0NTQU4pIHx8IFwKKwlkZWZpbmVkKENPTkZJR19DRklfQ0xB TkcpCiAjIGlmZGVmIENPTkZJR19DT05TVFJVQ1RPUlMKICMgIGRlZmluZSBTQU5JVElaRVJfRElT Q0FSRFMJCQkJCQlcCiAJKiguZWhfZnJhbWUpCmRpZmYgLS1naXQgYS9pbmNsdWRlL2xpbnV4L2Nm aS5oIGIvaW5jbHVkZS9saW51eC9jZmkuaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAw MDAwMDAwMDAuLjg3OTc0NGFhYTZlMAotLS0gL2Rldi9udWxsCisrKyBiL2luY2x1ZGUvbGludXgv Y2ZpLmgKQEAgLTAsMCArMSw0MSBAQAorLyogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEdQTC0y LjAgKi8KKy8qCisgKiBDbGFuZyBDb250cm9sIEZsb3cgSW50ZWdyaXR5IChDRkkpIHN1cHBvcnQu CisgKgorICogQ29weXJpZ2h0IChDKSAyMDIxIEdvb2dsZSBMTEMKKyAqLworI2lmbmRlZiBfTElO VVhfQ0ZJX0gKKyNkZWZpbmUgX0xJTlVYX0NGSV9ICisKKyNpZmRlZiBDT05GSUdfQ0ZJX0NMQU5H Cit0eXBlZGVmIHZvaWQgKCpjZmlfY2hlY2tfZm4pKHVpbnQ2NF90IGlkLCB2b2lkICpwdHIsIHZv aWQgKmRpYWcpOworCisvKiBDb21waWxlci1nZW5lcmF0ZWQgZnVuY3Rpb24gaW4gZWFjaCBtb2R1 bGUsIGFuZCB0aGUga2VybmVsICovCitleHRlcm4gdm9pZCBfX2NmaV9jaGVjayh1aW50NjRfdCBp ZCwgdm9pZCAqcHRyLCB2b2lkICpkaWFnKTsKKworLyoKKyAqIEZvcmNlIHRoZSBjb21waWxlciB0 byBnZW5lcmF0ZSBhIENGSSBqdW1wIHRhYmxlIGVudHJ5IGZvciBhIGZ1bmN0aW9uCisgKiBhbmQg c3RvcmUgdGhlIGp1bXAgdGFibGUgYWRkcmVzcyB0byBfX2NmaV9qdF88ZnVuY3Rpb24+LgorICov CisjZGVmaW5lIF9fQ0ZJX0FERFJFU1NBQkxFKGZuLCBfX2F0dHIpIFwKKwljb25zdCB2b2lkICpf X2NmaV9qdF8gIyMgZm4gX192aXNpYmxlIF9fYXR0ciA9ICh2b2lkICopJmZuCisKKyNpZmRlZiBD T05GSUdfQ0ZJX0NMQU5HX1NIQURPVworCitleHRlcm4gdm9pZCBjZmlfbW9kdWxlX2FkZChzdHJ1 Y3QgbW9kdWxlICptb2QsIHVuc2lnbmVkIGxvbmcgYmFzZV9hZGRyKTsKK2V4dGVybiB2b2lkIGNm aV9tb2R1bGVfcmVtb3ZlKHN0cnVjdCBtb2R1bGUgKm1vZCwgdW5zaWduZWQgbG9uZyBiYXNlX2Fk ZHIpOworCisjZWxzZQorCitzdGF0aWMgaW5saW5lIHZvaWQgY2ZpX21vZHVsZV9hZGQoc3RydWN0 IG1vZHVsZSAqbW9kLCB1bnNpZ25lZCBsb25nIGJhc2VfYWRkcikge30KK3N0YXRpYyBpbmxpbmUg dm9pZCBjZmlfbW9kdWxlX3JlbW92ZShzdHJ1Y3QgbW9kdWxlICptb2QsIHVuc2lnbmVkIGxvbmcg YmFzZV9hZGRyKSB7fQorCisjZW5kaWYgLyogQ09ORklHX0NGSV9DTEFOR19TSEFET1cgKi8KKwor I2Vsc2UgLyogIUNPTkZJR19DRklfQ0xBTkcgKi8KKworI2RlZmluZSBfX0NGSV9BRERSRVNTQUJM RShmbiwgX19hdHRyKQorCisjZW5kaWYgLyogQ09ORklHX0NGSV9DTEFORyAqLworCisjZW5kaWYg LyogX0xJTlVYX0NGSV9IICovCmRpZmYgLS1naXQgYS9pbmNsdWRlL2xpbnV4L2NvbXBpbGVyLWNs YW5nLmggYi9pbmNsdWRlL2xpbnV4L2NvbXBpbGVyLWNsYW5nLmgKaW5kZXggMDRjMGE1YTcxN2Y3 Li4xZmYyMmJkYWQ5OTIgMTAwNjQ0Ci0tLSBhL2luY2x1ZGUvbGludXgvY29tcGlsZXItY2xhbmcu aAorKysgYi9pbmNsdWRlL2xpbnV4L2NvbXBpbGVyLWNsYW5nLmgKQEAgLTU1LDMgKzU1LDUgQEAK ICNpZiBfX2hhc19mZWF0dXJlKHNoYWRvd19jYWxsX3N0YWNrKQogIyBkZWZpbmUgX19ub3Njcwlf X2F0dHJpYnV0ZV9fKChfX25vX3Nhbml0aXplX18oInNoYWRvdy1jYWxsLXN0YWNrIikpKQogI2Vu ZGlmCisKKyNkZWZpbmUgX19ub2NmaQkJX19hdHRyaWJ1dGVfXygoX19ub19zYW5pdGl6ZV9fKCJj ZmkiKSkpCmRpZmYgLS1naXQgYS9pbmNsdWRlL2xpbnV4L2NvbXBpbGVyX3R5cGVzLmggYi9pbmNs dWRlL2xpbnV4L2NvbXBpbGVyX3R5cGVzLmgKaW5kZXggZTVkZDVhNGFlOTQ2Li43OTY5MzVhMzdl MzcgMTAwNjQ0Ci0tLSBhL2luY2x1ZGUvbGludXgvY29tcGlsZXJfdHlwZXMuaAorKysgYi9pbmNs dWRlL2xpbnV4L2NvbXBpbGVyX3R5cGVzLmgKQEAgLTI0Miw2ICsyNDIsMTAgQEAgc3RydWN0IGZ0 cmFjZV9saWtlbHlfZGF0YSB7CiAjIGRlZmluZSBfX25vc2NzCiAjZW5kaWYKIAorI2lmbmRlZiBf X25vY2ZpCisjIGRlZmluZSBfX25vY2ZpCisjZW5kaWYKKwogI2lmbmRlZiBhc21fdm9sYXRpbGVf Z290bwogI2RlZmluZSBhc21fdm9sYXRpbGVfZ290byh4Li4uKSBhc20gZ290byh4KQogI2VuZGlm CmRpZmYgLS1naXQgYS9pbmNsdWRlL2xpbnV4L2luaXQuaCBiL2luY2x1ZGUvbGludXgvaW5pdC5o CmluZGV4IDMxZjU0ZGU1ODQyOS4uYjNlYTE1MzQ4ZmJkIDEwMDY0NAotLS0gYS9pbmNsdWRlL2xp bnV4L2luaXQuaAorKysgYi9pbmNsdWRlL2xpbnV4L2luaXQuaApAQCAtNDcsNyArNDcsNyBAQAog CiAvKiBUaGVzZSBhcmUgZm9yIGV2ZXJ5Ym9keSAoYWx0aG91Z2ggbm90IGFsbCBhcmNocyB3aWxs IGFjdHVhbGx5CiAgICBkaXNjYXJkIGl0IGluIG1vZHVsZXMpICovCi0jZGVmaW5lIF9faW5pdAkJ X19zZWN0aW9uKCIuaW5pdC50ZXh0IikgX19jb2xkICBfX2xhdGVudF9lbnRyb3B5IF9fbm9pbml0 cmV0cG9saW5lCisjZGVmaW5lIF9faW5pdAkJX19zZWN0aW9uKCIuaW5pdC50ZXh0IikgX19jb2xk ICBfX2xhdGVudF9lbnRyb3B5IF9fbm9pbml0cmV0cG9saW5lIF9fbm9jZmkKICNkZWZpbmUgX19p bml0ZGF0YQlfX3NlY3Rpb24oIi5pbml0LmRhdGEiKQogI2RlZmluZSBfX2luaXRjb25zdAlfX3Nl Y3Rpb24oIi5pbml0LnJvZGF0YSIpCiAjZGVmaW5lIF9fZXhpdGRhdGEJX19zZWN0aW9uKCIuZXhp dC5kYXRhIikKZGlmZiAtLWdpdCBhL2luY2x1ZGUvbGludXgvbW9kdWxlLmggYi9pbmNsdWRlL2xp bnV4L21vZHVsZS5oCmluZGV4IDU5ZjA5NGZhNmY3NC4uYjBiYmQzZjMzNmM1IDEwMDY0NAotLS0g YS9pbmNsdWRlL2xpbnV4L21vZHVsZS5oCisrKyBiL2luY2x1ZGUvbGludXgvbW9kdWxlLmgKQEAg LTI2LDYgKzI2LDcgQEAKICNpbmNsdWRlIDxsaW51eC90cmFjZXBvaW50LWRlZnMuaD4KICNpbmNs dWRlIDxsaW51eC9zcmN1Lmg+CiAjaW5jbHVkZSA8bGludXgvc3RhdGljX2NhbGxfdHlwZXMuaD4K KyNpbmNsdWRlIDxsaW51eC9jZmkuaD4KIAogI2luY2x1ZGUgPGxpbnV4L3BlcmNwdS5oPgogI2lu Y2x1ZGUgPGFzbS9tb2R1bGUuaD4KQEAgLTEzMSwxMyArMTMyLDE3IEBAIGV4dGVybiB2b2lkIGNs ZWFudXBfbW9kdWxlKHZvaWQpOwogI2RlZmluZSBtb2R1bGVfaW5pdChpbml0Zm4pCQkJCQlcCiAJ c3RhdGljIGlubGluZSBpbml0Y2FsbF90IF9fbWF5YmVfdW51c2VkIF9faW5pdHRlc3Qodm9pZCkJ CVwKIAl7IHJldHVybiBpbml0Zm47IH0JCQkJCVwKLQlpbnQgaW5pdF9tb2R1bGUodm9pZCkgX19j b3B5KGluaXRmbikgX19hdHRyaWJ1dGVfXygoYWxpYXMoI2luaXRmbikpKTsKKwlpbnQgaW5pdF9t b2R1bGUodm9pZCkgX19jb3B5KGluaXRmbikJCQlcCisJCV9fYXR0cmlidXRlX18oKGFsaWFzKCNp bml0Zm4pKSk7CQlcCisJX19DRklfQUREUkVTU0FCTEUoaW5pdF9tb2R1bGUsIF9faW5pdGRhdGEp OwogCiAvKiBUaGlzIGlzIG9ubHkgcmVxdWlyZWQgaWYgeW91IHdhbnQgdG8gYmUgdW5sb2FkYWJs ZS4gKi8KICNkZWZpbmUgbW9kdWxlX2V4aXQoZXhpdGZuKQkJCQkJXAogCXN0YXRpYyBpbmxpbmUg ZXhpdGNhbGxfdCBfX21heWJlX3VudXNlZCBfX2V4aXR0ZXN0KHZvaWQpCQlcCiAJeyByZXR1cm4g ZXhpdGZuOyB9CQkJCQlcCi0Jdm9pZCBjbGVhbnVwX21vZHVsZSh2b2lkKSBfX2NvcHkoZXhpdGZu KSBfX2F0dHJpYnV0ZV9fKChhbGlhcygjZXhpdGZuKSkpOworCXZvaWQgY2xlYW51cF9tb2R1bGUo dm9pZCkgX19jb3B5KGV4aXRmbikJCVwKKwkJX19hdHRyaWJ1dGVfXygoYWxpYXMoI2V4aXRmbikp KTsJCVwKKwlfX0NGSV9BRERSRVNTQUJMRShjbGVhbnVwX21vZHVsZSwgX19leGl0ZGF0YSk7CiAK ICNlbmRpZgogCkBAIC0zNzksNiArMzg0LDEwIEBAIHN0cnVjdCBtb2R1bGUgewogCWNvbnN0IHMz MiAqY3JjczsKIAl1bnNpZ25lZCBpbnQgbnVtX3N5bXM7CiAKKyNpZmRlZiBDT05GSUdfQ0ZJX0NM QU5HCisJY2ZpX2NoZWNrX2ZuIGNmaV9jaGVjazsKKyNlbmRpZgorCiAJLyogS2VybmVsIHBhcmFt ZXRlcnMuICovCiAjaWZkZWYgQ09ORklHX1NZU0ZTCiAJc3RydWN0IG11dGV4IHBhcmFtX2xvY2s7 CmRpZmYgLS1naXQgYS9pbml0L0tjb25maWcgYi9pbml0L0tjb25maWcKaW5kZXggMjI5NDZmZTVk ZWQ5Li4yOTcyZGY0ZTYwNjAgMTAwNjQ0Ci0tLSBhL2luaXQvS2NvbmZpZworKysgYi9pbml0L0tj b25maWcKQEAgLTIyOTcsNyArMjI5Nyw3IEBAIGVuZGlmICMgTU9EVUxFUwogCiBjb25maWcgTU9E VUxFU19UUkVFX0xPT0tVUAogCWRlZl9ib29sIHkKLQlkZXBlbmRzIG9uIFBFUkZfRVZFTlRTIHx8 IFRSQUNJTkcKKwlkZXBlbmRzIG9uIFBFUkZfRVZFTlRTIHx8IFRSQUNJTkcgfHwgQ0ZJX0NMQU5H CiAKIGNvbmZpZyBJTklUX0FMTF9QT1NTSUJMRQogCWJvb2wKZGlmZiAtLWdpdCBhL2tlcm5lbC9N YWtlZmlsZSBiL2tlcm5lbC9NYWtlZmlsZQppbmRleCAzMjBmMWYzOTQxYjcuLmU4YTY3MTVmMzhk YyAxMDA2NDQKLS0tIGEva2VybmVsL01ha2VmaWxlCisrKyBiL2tlcm5lbC9NYWtlZmlsZQpAQCAt NDEsNiArNDEsOSBAQCBLQ1NBTl9TQU5JVElaRV9rY292Lm8gOj0gbgogVUJTQU5fU0FOSVRJWkVf a2Nvdi5vIDo9IG4KIENGTEFHU19rY292Lm8gOj0gJChjYWxsIGNjLW9wdGlvbiwgLWZuby1jb25z ZXJ2ZS1zdGFjaykgLWZuby1zdGFjay1wcm90ZWN0b3IKIAorIyBEb24ndCBpbnN0cnVtZW50IGVy cm9yIGhhbmRsZXJzCitDRkxBR1NfUkVNT1ZFX2NmaS5vIDo9ICQoQ0NfRkxBR1NfQ0ZJKQorCiBv YmoteSArPSBzY2hlZC8KIG9iai15ICs9IGxvY2tpbmcvCiBvYmoteSArPSBwb3dlci8KQEAgLTEx MSw2ICsxMTQsNyBAQCBvYmotJChDT05GSUdfQlBGKSArPSBicGYvCiBvYmotJChDT05GSUdfS0NT QU4pICs9IGtjc2FuLwogb2JqLSQoQ09ORklHX1NIQURPV19DQUxMX1NUQUNLKSArPSBzY3Mubwog b2JqLSQoQ09ORklHX0hBVkVfU1RBVElDX0NBTExfSU5MSU5FKSArPSBzdGF0aWNfY2FsbC5vCitv YmotJChDT05GSUdfQ0ZJX0NMQU5HKSArPSBjZmkubwogCiBvYmotJChDT05GSUdfUEVSRl9FVkVO VFMpICs9IGV2ZW50cy8KIApkaWZmIC0tZ2l0IGEva2VybmVsL2NmaS5jIGIva2VybmVsL2NmaS5j Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMC4uOGM5ZWQzZjcwNThhCi0t LSAvZGV2L251bGwKKysrIGIva2VybmVsL2NmaS5jCkBAIC0wLDAgKzEsMzI5IEBACisvLyBTUERY LUxpY2Vuc2UtSWRlbnRpZmllcjogR1BMLTIuMAorLyoKKyAqIENsYW5nIENvbnRyb2wgRmxvdyBJ bnRlZ3JpdHkgKENGSSkgZXJyb3IgYW5kIHNsb3dwYXRoIGhhbmRsaW5nLgorICoKKyAqIENvcHly aWdodCAoQykgMjAyMSBHb29nbGUgTExDCisgKi8KKworI2luY2x1ZGUgPGxpbnV4L2hhcmRpcnEu aD4KKyNpbmNsdWRlIDxsaW51eC9rYWxsc3ltcy5oPgorI2luY2x1ZGUgPGxpbnV4L21vZHVsZS5o PgorI2luY2x1ZGUgPGxpbnV4L211dGV4Lmg+CisjaW5jbHVkZSA8bGludXgvcHJpbnRrLmg+Cisj aW5jbHVkZSA8bGludXgvcmF0ZWxpbWl0Lmg+CisjaW5jbHVkZSA8bGludXgvcmN1cGRhdGUuaD4K KyNpbmNsdWRlIDxsaW51eC92bWFsbG9jLmg+CisjaW5jbHVkZSA8YXNtL2NhY2hlZmx1c2guaD4K KyNpbmNsdWRlIDxhc20vc2V0X21lbW9yeS5oPgorCisvKiBDb21waWxlci1kZWZpbmVkIGhhbmRs ZXIgbmFtZXMgKi8KKyNpZmRlZiBDT05GSUdfQ0ZJX1BFUk1JU1NJVkUKKyNkZWZpbmUgY2ZpX2Zh aWx1cmVfaGFuZGxlcglfX3Vic2FuX2hhbmRsZV9jZmlfY2hlY2tfZmFpbAorI2Vsc2UKKyNkZWZp bmUgY2ZpX2ZhaWx1cmVfaGFuZGxlcglfX3Vic2FuX2hhbmRsZV9jZmlfY2hlY2tfZmFpbF9hYm9y dAorI2VuZGlmCisKK3N0YXRpYyBpbmxpbmUgdm9pZCBoYW5kbGVfY2ZpX2ZhaWx1cmUodm9pZCAq cHRyKQoreworCWlmIChJU19FTkFCTEVEKENPTkZJR19DRklfUEVSTUlTU0lWRSkpCisJCVdBUk5f UkFURUxJTUlUKDEsICJDRkkgZmFpbHVyZSAodGFyZ2V0OiAlcFMpOlxuIiwgcHRyKTsKKwllbHNl CisJCXBhbmljKCJDRkkgZmFpbHVyZSAodGFyZ2V0OiAlcFMpXG4iLCBwdHIpOworfQorCisjaWZk ZWYgQ09ORklHX01PRFVMRVMKKyNpZmRlZiBDT05GSUdfQ0ZJX0NMQU5HX1NIQURPVworLyoKKyAq IEluZGV4IHR5cGUuIEEgMTYtYml0IGluZGV4IGNhbiBhZGRyZXNzIGF0IG1vc3QgKDJeMTYpLTIg cGFnZXMgKHRha2luZworICogaW50byBhY2NvdW50IFNIQURPV19JTlZBTElEKSwgaS5lLiB+MjU2 TSB3aXRoIDRrIHBhZ2VzLgorICovCit0eXBlZGVmIHUxNiBzaGFkb3dfdDsKKyNkZWZpbmUgU0hB RE9XX0lOVkFMSUQJCSgoc2hhZG93X3QpfjBVTCkKKworc3RydWN0IGNmaV9zaGFkb3cgeworCS8q IFBhZ2UgaW5kZXggZm9yIHRoZSBiZWdpbm5pbmcgb2YgdGhlIHNoYWRvdyAqLworCXVuc2lnbmVk IGxvbmcgYmFzZTsKKwkvKiBBbiBhcnJheSBvZiBfX2NmaV9jaGVjayBsb2NhdGlvbnMgKGFzIGlu ZGljZXMgdG8gdGhlIHNoYWRvdykgKi8KKwlzaGFkb3dfdCBzaGFkb3dbMV07Cit9IF9fcGFja2Vk OworCisvKgorICogVGhlIHNoYWRvdyBjb3ZlcnMgfjEyOE0gZnJvbSB0aGUgYmVnaW5uaW5nIG9m IHRoZSBtb2R1bGUgcmVnaW9uLiBJZgorICogdGhlIHJlZ2lvbiBpcyBsYXJnZXIsIHdlIGZhbGwg YmFjayB0byBfX21vZHVsZV9hZGRyZXNzIGZvciB0aGUgcmVzdC4KKyAqLworI2RlZmluZSBfX1NI QURPV19SQU5HRQkJKF9VTChTWl8xMjhNKSA+PiBQQUdFX1NISUZUKQorCisvKiBUaGUgaW4tbWVt b3J5IHNpemUgb2Ygc3RydWN0IGNmaV9zaGFkb3csIGFsd2F5cyBhdCBsZWFzdCBvbmUgcGFnZSAq LworI2RlZmluZSBfX1NIQURPV19QQUdFUwkJKChfX1NIQURPV19SQU5HRSAqIHNpemVvZihzaGFk b3dfdCkpID4+IFBBR0VfU0hJRlQpCisjZGVmaW5lIFNIQURPV19QQUdFUwkJbWF4KDFVTCwgX19T SEFET1dfUEFHRVMpCisjZGVmaW5lIFNIQURPV19TSVpFCQkoU0hBRE9XX1BBR0VTIDw8IFBBR0Vf U0hJRlQpCisKKy8qIFRoZSBhY3R1YWwgc2l6ZSBvZiB0aGUgc2hhZG93IGFycmF5LCBtaW51cyBt ZXRhZGF0YSAqLworI2RlZmluZSBTSEFET1dfQVJSX1NJWkUJCShTSEFET1dfU0laRSAtIG9mZnNl dG9mKHN0cnVjdCBjZmlfc2hhZG93LCBzaGFkb3cpKQorI2RlZmluZSBTSEFET1dfQVJSX1NMT1RT CShTSEFET1dfQVJSX1NJWkUgLyBzaXplb2Yoc2hhZG93X3QpKQorCitzdGF0aWMgREVGSU5FX01V VEVYKHNoYWRvd191cGRhdGVfbG9jayk7CitzdGF0aWMgc3RydWN0IGNmaV9zaGFkb3cgX19yY3Ug KmNmaV9zaGFkb3cgX19yZWFkX21vc3RseTsKKworLyogUmV0dXJucyB0aGUgaW5kZXggaW4gdGhl IHNoYWRvdyBmb3IgdGhlIGdpdmVuIGFkZHJlc3MgKi8KK3N0YXRpYyBpbmxpbmUgaW50IHB0cl90 b19zaGFkb3coY29uc3Qgc3RydWN0IGNmaV9zaGFkb3cgKnMsIHVuc2lnbmVkIGxvbmcgcHRyKQor eworCXVuc2lnbmVkIGxvbmcgaW5kZXg7CisJdW5zaWduZWQgbG9uZyBwYWdlID0gcHRyID4+IFBB R0VfU0hJRlQ7CisKKwlpZiAodW5saWtlbHkocGFnZSA8IHMtPmJhc2UpKQorCQlyZXR1cm4gLTE7 IC8qIE91dHNpZGUgb2YgbW9kdWxlIGFyZWEgKi8KKworCWluZGV4ID0gcGFnZSAtIHMtPmJhc2U7 CisKKwlpZiAoaW5kZXggPj0gU0hBRE9XX0FSUl9TTE9UUykKKwkJcmV0dXJuIC0xOyAvKiBDYW5u b3QgYmUgYWRkcmVzc2VkIHdpdGggc2hhZG93ICovCisKKwlyZXR1cm4gKGludClpbmRleDsKK30K KworLyogUmV0dXJucyB0aGUgcGFnZSBhZGRyZXNzIGZvciBhbiBpbmRleCBpbiB0aGUgc2hhZG93 ICovCitzdGF0aWMgaW5saW5lIHVuc2lnbmVkIGxvbmcgc2hhZG93X3RvX3B0cihjb25zdCBzdHJ1 Y3QgY2ZpX3NoYWRvdyAqcywKKwlpbnQgaW5kZXgpCit7CisJaWYgKHVubGlrZWx5KGluZGV4IDwg MCB8fCBpbmRleCA+PSBTSEFET1dfQVJSX1NMT1RTKSkKKwkJcmV0dXJuIDA7CisKKwlyZXR1cm4g KHMtPmJhc2UgKyBpbmRleCkgPDwgUEFHRV9TSElGVDsKK30KKworLyogUmV0dXJucyB0aGUgX19j ZmlfY2hlY2sgZnVuY3Rpb24gYWRkcmVzcyBmb3IgdGhlIGdpdmVuIHNoYWRvdyBsb2NhdGlvbiAq Lworc3RhdGljIGlubGluZSB1bnNpZ25lZCBsb25nIHNoYWRvd190b19jaGVja19mbihjb25zdCBz dHJ1Y3QgY2ZpX3NoYWRvdyAqcywKKwlpbnQgaW5kZXgpCit7CisJaWYgKHVubGlrZWx5KGluZGV4 IDwgMCB8fCBpbmRleCA+PSBTSEFET1dfQVJSX1NMT1RTKSkKKwkJcmV0dXJuIDA7CisKKwlpZiAo dW5saWtlbHkocy0+c2hhZG93W2luZGV4XSA9PSBTSEFET1dfSU5WQUxJRCkpCisJCXJldHVybiAw OworCisJLyogX19jZmlfY2hlY2sgaXMgYWx3YXlzIHBhZ2UgYWxpZ25lZCAqLworCXJldHVybiAo cy0+YmFzZSArIHMtPnNoYWRvd1tpbmRleF0pIDw8IFBBR0VfU0hJRlQ7Cit9CisKK3N0YXRpYyB2 b2lkIHByZXBhcmVfbmV4dF9zaGFkb3coY29uc3Qgc3RydWN0IGNmaV9zaGFkb3cgX19yY3UgKnBy ZXYsCisJCXN0cnVjdCBjZmlfc2hhZG93ICpuZXh0KQoreworCWludCBpLCBpbmRleCwgY2hlY2s7 CisKKwkvKiBNYXJrIGV2ZXJ5dGhpbmcgaW52YWxpZCAqLworCW1lbXNldChuZXh0LT5zaGFkb3cs IDB4RkYsIFNIQURPV19BUlJfU0laRSk7CisKKwlpZiAoIXByZXYpCisJCXJldHVybjsgLyogTm8g cHJldmlvdXMgc2hhZG93ICovCisKKwkvKiBJZiB0aGUgYmFzZSBhZGRyZXNzIGRpZG4ndCBjaGFu Z2UsIGFuIHVwZGF0ZSBpcyBub3QgbmVlZGVkICovCisJaWYgKHByZXYtPmJhc2UgPT0gbmV4dC0+ YmFzZSkgeworCQltZW1jcHkobmV4dC0+c2hhZG93LCBwcmV2LT5zaGFkb3csIFNIQURPV19BUlJf U0laRSk7CisJCXJldHVybjsKKwl9CisKKwkvKiBDb252ZXJ0IHRoZSBwcmV2aW91cyBzaGFkb3cg dG8gdGhlIG5ldyBhZGRyZXNzIHJhbmdlICovCisJZm9yIChpID0gMDsgaSA8IFNIQURPV19BUlJf U0xPVFM7ICsraSkgeworCQlpZiAocHJldi0+c2hhZG93W2ldID09IFNIQURPV19JTlZBTElEKQor CQkJY29udGludWU7CisKKwkJaW5kZXggPSBwdHJfdG9fc2hhZG93KG5leHQsIHNoYWRvd190b19w dHIocHJldiwgaSkpOworCQlpZiAoaW5kZXggPCAwKQorCQkJY29udGludWU7CisKKwkJY2hlY2sg PSBwdHJfdG9fc2hhZG93KG5leHQsCisJCQkJc2hhZG93X3RvX2NoZWNrX2ZuKHByZXYsIHByZXYt PnNoYWRvd1tpXSkpOworCQlpZiAoY2hlY2sgPCAwKQorCQkJY29udGludWU7CisKKwkJbmV4dC0+ c2hhZG93W2luZGV4XSA9IChzaGFkb3dfdCljaGVjazsKKwl9Cit9CisKK3N0YXRpYyB2b2lkIGFk ZF9tb2R1bGVfdG9fc2hhZG93KHN0cnVjdCBjZmlfc2hhZG93ICpzLCBzdHJ1Y3QgbW9kdWxlICpt b2QsCisJCQl1bnNpZ25lZCBsb25nIG1pbl9hZGRyLCB1bnNpZ25lZCBsb25nIG1heF9hZGRyKQor eworCWludCBjaGVja19pbmRleDsKKwl1bnNpZ25lZCBsb25nIGNoZWNrID0gKHVuc2lnbmVkIGxv bmcpbW9kLT5jZmlfY2hlY2s7CisJdW5zaWduZWQgbG9uZyBwdHI7CisKKwlpZiAodW5saWtlbHko IVBBR0VfQUxJR05FRChjaGVjaykpKSB7CisJCXByX3dhcm4oImNmaTogbm90IHVzaW5nIHNoYWRv dyBmb3IgbW9kdWxlICVzXG4iLCBtb2QtPm5hbWUpOworCQlyZXR1cm47CisJfQorCisJY2hlY2tf aW5kZXggPSBwdHJfdG9fc2hhZG93KHMsIGNoZWNrKTsKKwlpZiAoY2hlY2tfaW5kZXggPCAwKQor CQlyZXR1cm47IC8qIE1vZHVsZSBub3QgYWRkcmVzc2FibGUgd2l0aCBzaGFkb3cgKi8KKworCS8q IEZvciBlYWNoIHBhZ2UsIHN0b3JlIHRoZSBjaGVjayBmdW5jdGlvbiBpbmRleCBpbiB0aGUgc2hh ZG93ICovCisJZm9yIChwdHIgPSBtaW5fYWRkcjsgcHRyIDw9IG1heF9hZGRyOyBwdHIgKz0gUEFH RV9TSVpFKSB7CisJCWludCBpbmRleCA9IHB0cl90b19zaGFkb3cocywgcHRyKTsKKworCQlpZiAo aW5kZXggPj0gMCkgeworCQkJLyogRWFjaCBwYWdlIG11c3Qgb25seSBjb250YWluIG9uZSBtb2R1 bGUgKi8KKwkJCVdBUk5fT05fT05DRShzLT5zaGFkb3dbaW5kZXhdICE9IFNIQURPV19JTlZBTElE KTsKKwkJCXMtPnNoYWRvd1tpbmRleF0gPSAoc2hhZG93X3QpY2hlY2tfaW5kZXg7CisJCX0KKwl9 Cit9CisKK3N0YXRpYyB2b2lkIHJlbW92ZV9tb2R1bGVfZnJvbV9zaGFkb3coc3RydWN0IGNmaV9z aGFkb3cgKnMsIHN0cnVjdCBtb2R1bGUgKm1vZCwKKwkJdW5zaWduZWQgbG9uZyBtaW5fYWRkciwg dW5zaWduZWQgbG9uZyBtYXhfYWRkcikKK3sKKwl1bnNpZ25lZCBsb25nIHB0cjsKKworCWZvciAo cHRyID0gbWluX2FkZHI7IHB0ciA8PSBtYXhfYWRkcjsgcHRyICs9IFBBR0VfU0laRSkgeworCQlp bnQgaW5kZXggPSBwdHJfdG9fc2hhZG93KHMsIHB0cik7CisKKwkJaWYgKGluZGV4ID49IDApCisJ CQlzLT5zaGFkb3dbaW5kZXhdID0gU0hBRE9XX0lOVkFMSUQ7CisJfQorfQorCit0eXBlZGVmIHZv aWQgKCp1cGRhdGVfc2hhZG93X2ZuKShzdHJ1Y3QgY2ZpX3NoYWRvdyAqLCBzdHJ1Y3QgbW9kdWxl ICosCisJCQl1bnNpZ25lZCBsb25nIG1pbl9hZGRyLCB1bnNpZ25lZCBsb25nIG1heF9hZGRyKTsK Kworc3RhdGljIHZvaWQgdXBkYXRlX3NoYWRvdyhzdHJ1Y3QgbW9kdWxlICptb2QsIHVuc2lnbmVk IGxvbmcgYmFzZV9hZGRyLAorCQl1cGRhdGVfc2hhZG93X2ZuIGZuKQoreworCXN0cnVjdCBjZmlf c2hhZG93ICpwcmV2OworCXN0cnVjdCBjZmlfc2hhZG93ICpuZXh0OworCXVuc2lnbmVkIGxvbmcg bWluX2FkZHIsIG1heF9hZGRyOworCisJbmV4dCA9IHZtYWxsb2MoU0hBRE9XX1NJWkUpOworCisJ bXV0ZXhfbG9jaygmc2hhZG93X3VwZGF0ZV9sb2NrKTsKKwlwcmV2ID0gcmN1X2RlcmVmZXJlbmNl X3Byb3RlY3RlZChjZmlfc2hhZG93LAorCQkJCQkgbXV0ZXhfaXNfbG9ja2VkKCZzaGFkb3dfdXBk YXRlX2xvY2spKTsKKworCWlmIChuZXh0KSB7CisJCW5leHQtPmJhc2UgPSBiYXNlX2FkZHIgPj4g UEFHRV9TSElGVDsKKwkJcHJlcGFyZV9uZXh0X3NoYWRvdyhwcmV2LCBuZXh0KTsKKworCQltaW5f YWRkciA9ICh1bnNpZ25lZCBsb25nKW1vZC0+Y29yZV9sYXlvdXQuYmFzZTsKKwkJbWF4X2FkZHIg PSBtaW5fYWRkciArIG1vZC0+Y29yZV9sYXlvdXQudGV4dF9zaXplOworCQlmbihuZXh0LCBtb2Qs IG1pbl9hZGRyICYgUEFHRV9NQVNLLCBtYXhfYWRkciAmIFBBR0VfTUFTSyk7CisKKwkJc2V0X21l bW9yeV9ybygodW5zaWduZWQgbG9uZyluZXh0LCBTSEFET1dfUEFHRVMpOworCX0KKworCXJjdV9h c3NpZ25fcG9pbnRlcihjZmlfc2hhZG93LCBuZXh0KTsKKwltdXRleF91bmxvY2soJnNoYWRvd191 cGRhdGVfbG9jayk7CisJc3luY2hyb25pemVfcmN1X2V4cGVkaXRlZCgpOworCisJaWYgKHByZXYp IHsKKwkJc2V0X21lbW9yeV9ydygodW5zaWduZWQgbG9uZylwcmV2LCBTSEFET1dfUEFHRVMpOwor CQl2ZnJlZShwcmV2KTsKKwl9Cit9CisKK3ZvaWQgY2ZpX21vZHVsZV9hZGQoc3RydWN0IG1vZHVs ZSAqbW9kLCB1bnNpZ25lZCBsb25nIGJhc2VfYWRkcikKK3sKKwl1cGRhdGVfc2hhZG93KG1vZCwg YmFzZV9hZGRyLCBhZGRfbW9kdWxlX3RvX3NoYWRvdyk7Cit9CisKK3ZvaWQgY2ZpX21vZHVsZV9y ZW1vdmUoc3RydWN0IG1vZHVsZSAqbW9kLCB1bnNpZ25lZCBsb25nIGJhc2VfYWRkcikKK3sKKwl1 cGRhdGVfc2hhZG93KG1vZCwgYmFzZV9hZGRyLCByZW1vdmVfbW9kdWxlX2Zyb21fc2hhZG93KTsK K30KKworc3RhdGljIGlubGluZSBjZmlfY2hlY2tfZm4gcHRyX3RvX2NoZWNrX2ZuKGNvbnN0IHN0 cnVjdCBjZmlfc2hhZG93IF9fcmN1ICpzLAorCXVuc2lnbmVkIGxvbmcgcHRyKQoreworCWludCBp bmRleDsKKworCWlmICh1bmxpa2VseSghcykpCisJCXJldHVybiBOVUxMOyAvKiBObyBzaGFkb3cg YXZhaWxhYmxlICovCisKKwlpbmRleCA9IHB0cl90b19zaGFkb3cocywgcHRyKTsKKwlpZiAoaW5k ZXggPCAwKQorCQlyZXR1cm4gTlVMTDsgLyogQ2Fubm90IGJlIGFkZHJlc3NlZCB3aXRoIHNoYWRv dyAqLworCisJcmV0dXJuIChjZmlfY2hlY2tfZm4pc2hhZG93X3RvX2NoZWNrX2ZuKHMsIGluZGV4 KTsKK30KKworc3RhdGljIGlubGluZSBjZmlfY2hlY2tfZm4gZmluZF9zaGFkb3dfY2hlY2tfZm4o dW5zaWduZWQgbG9uZyBwdHIpCit7CisJY2ZpX2NoZWNrX2ZuIGZuOworCisJcmN1X3JlYWRfbG9j a19zY2hlZCgpOworCWZuID0gcHRyX3RvX2NoZWNrX2ZuKHJjdV9kZXJlZmVyZW5jZV9zY2hlZChj Zmlfc2hhZG93KSwgcHRyKTsKKwlyY3VfcmVhZF91bmxvY2tfc2NoZWQoKTsKKworCXJldHVybiBm bjsKK30KKworI2Vsc2UgLyogIUNPTkZJR19DRklfQ0xBTkdfU0hBRE9XICovCisKK3N0YXRpYyBp bmxpbmUgY2ZpX2NoZWNrX2ZuIGZpbmRfc2hhZG93X2NoZWNrX2ZuKHVuc2lnbmVkIGxvbmcgcHRy KQoreworCXJldHVybiBOVUxMOworfQorCisjZW5kaWYgLyogQ09ORklHX0NGSV9DTEFOR19TSEFE T1cgKi8KKworc3RhdGljIGlubGluZSBjZmlfY2hlY2tfZm4gZmluZF9tb2R1bGVfY2hlY2tfZm4o dW5zaWduZWQgbG9uZyBwdHIpCit7CisJY2ZpX2NoZWNrX2ZuIGZuID0gTlVMTDsKKwlzdHJ1Y3Qg bW9kdWxlICptb2Q7CisKKwlyY3VfcmVhZF9sb2NrX3NjaGVkKCk7CisJbW9kID0gX19tb2R1bGVf YWRkcmVzcyhwdHIpOworCWlmIChtb2QpCisJCWZuID0gbW9kLT5jZmlfY2hlY2s7CisJcmN1X3Jl YWRfdW5sb2NrX3NjaGVkKCk7CisKKwlyZXR1cm4gZm47Cit9CisKK3N0YXRpYyBpbmxpbmUgY2Zp X2NoZWNrX2ZuIGZpbmRfY2hlY2tfZm4odW5zaWduZWQgbG9uZyBwdHIpCit7CisJY2ZpX2NoZWNr X2ZuIGZuID0gTlVMTDsKKworCWlmIChpc19rZXJuZWxfdGV4dChwdHIpKQorCQlyZXR1cm4gX19j ZmlfY2hlY2s7CisKKwkvKgorCSAqIEluZGlyZWN0IGNhbGwgY2hlY2tzIGNhbiBoYXBwZW4gd2hl biBSQ1UgaXMgbm90IHdhdGNoaW5nLiBCb3RoCisJICogdGhlIHNoYWRvdyBhbmQgX19tb2R1bGVf YWRkcmVzcyB1c2UgUkNVLCBzbyB3ZSBuZWVkIHRvIHdha2UgaXQKKwkgKiB1cCBpZiBuZWNlc3Nh cnkuCisJICovCisJUkNVX05PTklETEUoeworCQlpZiAoSVNfRU5BQkxFRChDT05GSUdfQ0ZJX0NM QU5HX1NIQURPVykpCisJCQlmbiA9IGZpbmRfc2hhZG93X2NoZWNrX2ZuKHB0cik7CisKKwkJaWYg KCFmbikKKwkJCWZuID0gZmluZF9tb2R1bGVfY2hlY2tfZm4ocHRyKTsKKwl9KTsKKworCXJldHVy biBmbjsKK30KKwordm9pZCBfX2NmaV9zbG93cGF0aF9kaWFnKHVpbnQ2NF90IGlkLCB2b2lkICpw dHIsIHZvaWQgKmRpYWcpCit7CisJY2ZpX2NoZWNrX2ZuIGZuID0gZmluZF9jaGVja19mbigodW5z aWduZWQgbG9uZylwdHIpOworCisJaWYgKGxpa2VseShmbikpCisJCWZuKGlkLCBwdHIsIGRpYWcp OworCWVsc2UgLyogRG9uJ3QgYWxsb3cgdW5jaGVja2VkIG1vZHVsZXMgKi8KKwkJaGFuZGxlX2Nm aV9mYWlsdXJlKHB0cik7Cit9CitFWFBPUlRfU1lNQk9MKF9fY2ZpX3Nsb3dwYXRoX2RpYWcpOwor CisjZWxzZSAvKiAhQ09ORklHX01PRFVMRVMgKi8KKwordm9pZCBfX2NmaV9zbG93cGF0aF9kaWFn KHVpbnQ2NF90IGlkLCB2b2lkICpwdHIsIHZvaWQgKmRpYWcpCit7CisJaGFuZGxlX2NmaV9mYWls dXJlKHB0cik7IC8qIE5vIG1vZHVsZXMgKi8KK30KK0VYUE9SVF9TWU1CT0woX19jZmlfc2xvd3Bh dGhfZGlhZyk7CisKKyNlbmRpZiAvKiBDT05GSUdfTU9EVUxFUyAqLworCit2b2lkIGNmaV9mYWls dXJlX2hhbmRsZXIodm9pZCAqZGF0YSwgdm9pZCAqcHRyLCB2b2lkICp2dGFibGUpCit7CisJaGFu ZGxlX2NmaV9mYWlsdXJlKHB0cik7Cit9CitFWFBPUlRfU1lNQk9MKGNmaV9mYWlsdXJlX2hhbmRs ZXIpOwpkaWZmIC0tZ2l0IGEva2VybmVsL21vZHVsZS5jIGIva2VybmVsL21vZHVsZS5jCmluZGV4 IDMwNDc5MzU1YWI4NS4uMjBmYjAwNGU3ZDhkIDEwMDY0NAotLS0gYS9rZXJuZWwvbW9kdWxlLmMK KysrIGIva2VybmVsL21vZHVsZS5jCkBAIC0yMTQ2LDYgKzIxNDYsOCBAQCB2b2lkIF9fd2VhayBt b2R1bGVfYXJjaF9mcmVlaW5nX2luaXQoc3RydWN0IG1vZHVsZSAqbW9kKQogewogfQogCitzdGF0 aWMgdm9pZCBjZmlfY2xlYW51cChzdHJ1Y3QgbW9kdWxlICptb2QpOworCiAvKiBGcmVlIGEgbW9k dWxlLCByZW1vdmUgZnJvbSBsaXN0cywgZXRjLiAqLwogc3RhdGljIHZvaWQgZnJlZV9tb2R1bGUo c3RydWN0IG1vZHVsZSAqbW9kKQogewpAQCAtMjE4Nyw2ICsyMTg5LDkgQEAgc3RhdGljIHZvaWQg ZnJlZV9tb2R1bGUoc3RydWN0IG1vZHVsZSAqbW9kKQogCXN5bmNocm9uaXplX3JjdSgpOwogCW11 dGV4X3VubG9jaygmbW9kdWxlX211dGV4KTsKIAorCS8qIENsZWFuIHVwIENGSSBmb3IgdGhlIG1v ZHVsZS4gKi8KKwljZmlfY2xlYW51cChtb2QpOworCiAJLyogVGhpcyBtYXkgYmUgZW1wdHksIGJ1 dCB0aGF0J3MgT0sgKi8KIAltb2R1bGVfYXJjaF9mcmVlaW5nX2luaXQobW9kKTsKIAltb2R1bGVf bWVtZnJlZShtb2QtPmluaXRfbGF5b3V0LmJhc2UpOwpAQCAtMzg2Niw2ICszODcxLDggQEAgc3Rh dGljIGludCB1bmtub3duX21vZHVsZV9wYXJhbV9jYihjaGFyICpwYXJhbSwgY2hhciAqdmFsLCBj b25zdCBjaGFyICptb2RuYW1lLAogCXJldHVybiAwOwogfQogCitzdGF0aWMgdm9pZCBjZmlfaW5p dChzdHJ1Y3QgbW9kdWxlICptb2QpOworCiAvKgogICogQWxsb2NhdGUgYW5kIGxvYWQgdGhlIG1v ZHVsZTogbm90ZSB0aGF0IHNpemUgb2Ygc2VjdGlvbiAwIGlzIGFsd2F5cwogICogemVybywgYW5k IHdlIHJlbHkgb24gdGhpcyBmb3Igb3B0aW9uYWwgc2VjdGlvbnMuCkBAIC0zOTk3LDYgKzQwMDQs OSBAQCBzdGF0aWMgaW50IGxvYWRfbW9kdWxlKHN0cnVjdCBsb2FkX2luZm8gKmluZm8sIGNvbnN0 IGNoYXIgX191c2VyICp1YXJncywKIAogCWZsdXNoX21vZHVsZV9pY2FjaGUobW9kKTsKIAorCS8q IFNldHVwIENGSSBmb3IgdGhlIG1vZHVsZS4gKi8KKwljZmlfaW5pdChtb2QpOworCiAJLyogTm93 IGNvcHkgaW4gYXJncyAqLwogCW1vZC0+YXJncyA9IHN0cm5kdXBfdXNlcih1YXJncywgfjBVTCA+ PiAxKTsKIAlpZiAoSVNfRVJSKG1vZC0+YXJncykpIHsKQEAgLTQwNzAsNiArNDA4MCw3IEBAIHN0 YXRpYyBpbnQgbG9hZF9tb2R1bGUoc3RydWN0IGxvYWRfaW5mbyAqaW5mbywgY29uc3QgY2hhciBf X3VzZXIgKnVhcmdzLAogCXN5bmNocm9uaXplX3JjdSgpOwogCWtmcmVlKG1vZC0+YXJncyk7CiAg ZnJlZV9hcmNoX2NsZWFudXA6CisJY2ZpX2NsZWFudXAobW9kKTsKIAltb2R1bGVfYXJjaF9jbGVh bnVwKG1vZCk7CiAgZnJlZV9tb2RpbmZvOgogCWZyZWVfbW9kaW5mbyhtb2QpOwpAQCAtNDQxNSw2 ICs0NDI2LDM4IEBAIGludCBtb2R1bGVfa2FsbHN5bXNfb25fZWFjaF9zeW1ib2woaW50ICgqZm4p KHZvaWQgKiwgY29uc3QgY2hhciAqLAogI2VuZGlmIC8qIENPTkZJR19MSVZFUEFUQ0ggKi8KICNl bmRpZiAvKiBDT05GSUdfS0FMTFNZTVMgKi8KIAorc3RhdGljIHZvaWQgY2ZpX2luaXQoc3RydWN0 IG1vZHVsZSAqbW9kKQoreworI2lmZGVmIENPTkZJR19DRklfQ0xBTkcKKwlpbml0Y2FsbF90ICpp bml0OworCWV4aXRjYWxsX3QgKmV4aXQ7CisKKwlyY3VfcmVhZF9sb2NrX3NjaGVkKCk7CisJbW9k LT5jZmlfY2hlY2sgPSAoY2ZpX2NoZWNrX2ZuKQorCQlmaW5kX2thbGxzeW1zX3N5bWJvbF92YWx1 ZShtb2QsICJfX2NmaV9jaGVjayIpOworCWluaXQgPSAoaW5pdGNhbGxfdCAqKQorCQlmaW5kX2th bGxzeW1zX3N5bWJvbF92YWx1ZShtb2QsICJfX2NmaV9qdF9pbml0X21vZHVsZSIpOworCWV4aXQg PSAoZXhpdGNhbGxfdCAqKQorCQlmaW5kX2thbGxzeW1zX3N5bWJvbF92YWx1ZShtb2QsICJfX2Nm aV9qdF9jbGVhbnVwX21vZHVsZSIpOworCXJjdV9yZWFkX3VubG9ja19zY2hlZCgpOworCisJLyog Rml4IGluaXQvZXhpdCBmdW5jdGlvbnMgdG8gcG9pbnQgdG8gdGhlIENGSSBqdW1wIHRhYmxlICov CisJaWYgKGluaXQpCisJCW1vZC0+aW5pdCA9ICppbml0OworCWlmIChleGl0KQorCQltb2QtPmV4 aXQgPSAqZXhpdDsKKworCWNmaV9tb2R1bGVfYWRkKG1vZCwgbW9kdWxlX2FkZHJfbWluKTsKKyNl bmRpZgorfQorCitzdGF0aWMgdm9pZCBjZmlfY2xlYW51cChzdHJ1Y3QgbW9kdWxlICptb2QpCit7 CisjaWZkZWYgQ09ORklHX0NGSV9DTEFORworCWNmaV9tb2R1bGVfcmVtb3ZlKG1vZCwgbW9kdWxl X2FkZHJfbWluKTsKKyNlbmRpZgorfQorCiAvKiBNYXhpbXVtIG51bWJlciBvZiBjaGFyYWN0ZXJz IHdyaXR0ZW4gYnkgbW9kdWxlX2ZsYWdzKCkgKi8KICNkZWZpbmUgTU9EVUxFX0ZMQUdTX0JVRl9T SVpFIChUQUlOVF9GTEFHU19DT1VOVCArIDQpCiAKZGlmZiAtLWdpdCBhL3NjcmlwdHMvTWFrZWZp bGUubW9kZmluYWwgYi9zY3JpcHRzL01ha2VmaWxlLm1vZGZpbmFsCmluZGV4IDczNWUxMWU5MDQx Yi4uZGQ4N2NlYTlmYmE3IDEwMDY0NAotLS0gYS9zY3JpcHRzL01ha2VmaWxlLm1vZGZpbmFsCisr KyBiL3NjcmlwdHMvTWFrZWZpbGUubW9kZmluYWwKQEAgLTIzLDcgKzIzLDcgQEAgbW9kbmFtZSA9 ICQobm90ZGlyICQoQDoubW9kLm89KSkKIHBhcnQtb2YtbW9kdWxlID0geQogCiBxdWlldF9jbWRf Y2Nfb19jID0gQ0MgW01dICAkQAotICAgICAgY21kX2NjX29fYyA9ICQoQ0MpICQoY19mbGFncykg LWMgLW8gJEAgJDwKKyAgICAgIGNtZF9jY19vX2MgPSAkKENDKSAkKGZpbHRlci1vdXQgJChDQ19G TEFHU19DRkkpLCAkKGNfZmxhZ3MpKSAtYyAtbyAkQCAkPAogCiAlLm1vZC5vOiAlLm1vZC5jIEZP UkNFCiAJJChjYWxsIGlmX2NoYW5nZWRfZGVwLGNjX29fYykKLS0gCjIuMzEuMC5yYzIuMjYxLmc3 ZjcxNzc0NjIwLWdvb2cKCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwpsaW51eC1hcm0ta2VybmVsIG1haWxpbmcgbGlzdApsaW51eC1hcm0ta2VybmVsQGxp c3RzLmluZnJhZGVhZC5vcmcKaHR0cDovL2xpc3RzLmluZnJhZGVhZC5vcmcvbWFpbG1hbi9saXN0 aW5mby9saW51eC1hcm0ta2VybmVsCg==