From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-26.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9CB42C433E1 for ; Tue, 23 Mar 2021 20:40:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5E41C619D4 for ; Tue, 23 Mar 2021 20:40:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233427AbhCWUkA (ORCPT ); Tue, 23 Mar 2021 16:40:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44902 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233453AbhCWUjw (ORCPT ); Tue, 23 Mar 2021 16:39:52 -0400 Received: from mail-qk1-x74a.google.com (mail-qk1-x74a.google.com [IPv6:2607:f8b0:4864:20::74a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8C271C0613D8 for ; Tue, 23 Mar 2021 13:39:51 -0700 (PDT) Received: by mail-qk1-x74a.google.com with SMTP id a1so125711qkn.11 for ; Tue, 23 Mar 2021 13:39:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc:content-transfer-encoding; bh=oRH0oPqc1YkPpMAYQYFZl9QAi5/yaxV7NoOeL8QzXY4=; b=GjBgkHJGOeUrIBhop7aWNfhrqfm1aGxDtV3jtuOZIQDlOColM38iVA4ChTKOGs4Vn7 N5IFA5VTu6lclmpBPE9BdZbHEyBaMp8briSjKqsuUmOVK1wpG2wcpsCP9VXyZYyVIoam DHTzjCZ4RDeu+ljC3DvSxDKyaKnBoK+rI5S1K95pDpB6ARMOrZsyjJ5Wd+dT6a8ezDnZ DBoHStC+B5jrj4U2u+dFApkUlFZRW4e48m6eMII6ItNn+1FP3mcuay/8SuuPmC/fnIDZ sKwOsG+GCY4mLxFS+ojNJLKvGu+RTvlb4oH1ee+XCmCiFdJuVke/9wV+bZ+l9fx/HDTd BCfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc:content-transfer-encoding; bh=oRH0oPqc1YkPpMAYQYFZl9QAi5/yaxV7NoOeL8QzXY4=; b=JCixTh4duAdlt4tRMBczYtCEZMsC2CG4ttzJQ3pb8+OenuQhYJ2Dmz8nwJhIZXcoX7 6p2GoeYuYjHkFXnTE1kwiV2cx8DlJWCqS4lh9tyuWIC3jRWQr7zfywU53dRjNO3z0Xl7 mzPcW63ZDw0e1wkVy87yCWpOUHjYgCB+/Zna7yG8ycyBEliL8+g0N2I0iCqtvVab6lqU uAhuQvcGQGt1r2g7VawDuoEEMyfqoyzm8T5uMmPLWkU253nWnTUKndtu62jWyqf+tRjH 1+Dzr8s/cQlJBJg3xL3uCbe51V4Pg4kF2nQMz7iRQm9ilVm4kIg5wydozvqWK/p16O33 m+JQ== X-Gm-Message-State: AOAM5325TkoihcTF5R0gwcdby21XikkNfX9OEcc+LF/TGC44nNPhALlB l9dXQIa2ZN4J8lKhMI+SWpgTyX84+v4QMdndpoo= X-Google-Smtp-Source: ABdhPJxDF0lHo0+rGsyYGKZTGaYYdqb/VVtyXHwYyK1sQr6dy4J7IMGg0tunH3tqmmIpzV7AcPx23lj4ssrrCTE+rJc= X-Received: from samitolvanen1.mtv.corp.google.com ([2620:15c:201:2:e9a3:260d:763b:67dc]) (user=samitolvanen job=sendgmr) by 2002:a05:6214:90b:: with SMTP id dj11mr6674797qvb.52.1616531990609; Tue, 23 Mar 2021 13:39:50 -0700 (PDT) Date: Tue, 23 Mar 2021 13:39:30 -0700 In-Reply-To: <20210323203946.2159693-1-samitolvanen@google.com> Message-Id: <20210323203946.2159693-2-samitolvanen@google.com> Mime-Version: 1.0 References: <20210323203946.2159693-1-samitolvanen@google.com> X-Mailer: git-send-email 2.31.0.291.g576ba9dcdaf-goog Subject: [PATCH v3 01/17] add support for Clang CFI From: Sami Tolvanen To: Kees Cook Cc: Nathan Chancellor , Nick Desaulniers , Masahiro Yamada , Will Deacon , Jessica Yu , Arnd Bergmann , Tejun Heo , "Paul E. McKenney" , Christoph Hellwig , Peter Zijlstra , bpf@vger.kernel.org, linux-hardening@vger.kernel.org, linux-arch@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kbuild@vger.kernel.org, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Sami Tolvanen Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org This change adds support for Clang=E2=80=99s forward-edge Control Flow Integrity (CFI) checking. With CONFIG_CFI_CLANG, the compiler injects a runtime check before each indirect function call to ensure the target is a valid function with the correct static type. This restricts possible call targets and makes it more difficult for an attacker to exploit bugs that allow the modification of stored function pointers. For more details, see: https://clang.llvm.org/docs/ControlFlowIntegrity.html Clang requires CONFIG_LTO_CLANG to be enabled with CFI to gain visibility to possible call targets. Kernel modules are supported with Clang=E2=80=99s cross-DSO CFI mode, which allows checking between independently compiled components. With CFI enabled, the compiler injects a __cfi_check() function into the kernel and each module for validating local call targets. For cross-module calls that cannot be validated locally, the compiler calls the global __cfi_slowpath_diag() function, which determines the target module and calls the correct __cfi_check() function. This patch includes a slowpath implementation that uses __module_address() to resolve call targets, and with CONFIG_CFI_CLANG_SHADOW enabled, a shadow map that speeds up module look-ups by ~3x. Clang implements indirect call checking using jump tables and offers two methods of generating them. With canonical jump tables, the compiler renames each address-taken function to .cfi and points the original symbol to a jump table entry, which passes __cfi_check() validation. This isn=E2=80=99t compatible with stand-alone assembly code, which the compiler doesn=E2=80=99t instrument, and would result in indirect calls to assembly code to fail. Therefore, we default to using non-canonical jump tables instead, where the compiler generates a local jump table entry .cfi_jt for each address-taken function, and replaces all references to the function with the address of the jump table entry. Note that because non-canonical jump table addresses are local to each component, they break cross-module function address equality. Specifically, the address of a global function will be different in each module, as it's replaced with the address of a local jump table entry. If this address is passed to a different module, it won=E2=80=99t match the address of the same function taken there. This may break code that relies on comparing addresses passed from other components. CFI checking can be disabled in a function with the __nocfi attribute. Additionally, CFI can be disabled for an entire compilation unit by filtering out CC_FLAGS_CFI. By default, CFI failures result in a kernel panic to stop a potential exploit. CONFIG_CFI_PERMISSIVE enables a permissive mode, where the kernel prints out a rate-limited warning instead, and allows execution to continue. This option is helpful for locating type mismatches, but should only be enabled during development. Signed-off-by: Sami Tolvanen Reviewed-by: Kees Cook --- Makefile | 17 ++ arch/Kconfig | 45 ++++ include/asm-generic/bug.h | 16 ++ include/asm-generic/vmlinux.lds.h | 20 +- include/linux/cfi.h | 41 ++++ include/linux/compiler-clang.h | 2 + include/linux/compiler_types.h | 4 + include/linux/init.h | 2 +- include/linux/module.h | 13 +- init/Kconfig | 2 +- kernel/Makefile | 4 + kernel/cfi.c | 329 ++++++++++++++++++++++++++++++ kernel/module.c | 43 ++++ scripts/Makefile.modfinal | 2 +- 14 files changed, 534 insertions(+), 6 deletions(-) create mode 100644 include/linux/cfi.h create mode 100644 kernel/cfi.c diff --git a/Makefile b/Makefile index d4784d181123..2b90a5cc08c8 100644 --- a/Makefile +++ b/Makefile @@ -920,6 +920,23 @@ KBUILD_AFLAGS +=3D -fno-lto export CC_FLAGS_LTO endif =20 +ifdef CONFIG_CFI_CLANG +CC_FLAGS_CFI :=3D -fsanitize=3Dcfi \ + -fsanitize-cfi-cross-dso \ + -fno-sanitize-cfi-canonical-jump-tables \ + -fno-sanitize-trap=3Dcfi \ + -fno-sanitize-blacklist + +ifdef CONFIG_CFI_PERMISSIVE +CC_FLAGS_CFI +=3D -fsanitize-recover=3Dcfi +endif + +# If LTO flags are filtered out, we must also filter out CFI. +CC_FLAGS_LTO +=3D $(CC_FLAGS_CFI) +KBUILD_CFLAGS +=3D $(CC_FLAGS_CFI) +export CC_FLAGS_CFI +endif + ifdef CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_32B KBUILD_CFLAGS +=3D -falign-functions=3D32 endif diff --git a/arch/Kconfig b/arch/Kconfig index ecfd3520b676..f6a85ba6cba2 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -692,6 +692,51 @@ config LTO_CLANG_THIN If unsure, say Y. endchoice =20 +config ARCH_SUPPORTS_CFI_CLANG + bool + help + An architecture should select this option if it can support Clang's + Control-Flow Integrity (CFI) checking. + +config CFI_CLANG + bool "Use Clang's Control Flow Integrity (CFI)" + depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG + # Clang >=3D 12: + # - https://bugs.llvm.org/show_bug.cgi?id=3D46258 + # - https://bugs.llvm.org/show_bug.cgi?id=3D47479 + depends on CLANG_VERSION >=3D 120000 + select KALLSYMS + help + This option enables Clang=E2=80=99s forward-edge Control Flow Integrity + (CFI) checking, where the compiler injects a runtime check to each + indirect function call to ensure the target is a valid function with + the correct static type. This restricts possible call targets and + makes it more difficult for an attacker to exploit bugs that allow + the modification of stored function pointers. More information can be + found from Clang's documentation: + + https://clang.llvm.org/docs/ControlFlowIntegrity.html + +config CFI_CLANG_SHADOW + bool "Use CFI shadow to speed up cross-module checks" + default y + depends on CFI_CLANG && MODULES + help + If you select this option, the kernel builds a fast look-up table of + CFI check functions in loaded modules to reduce performance overhead. + + If unsure, say Y. + +config CFI_PERMISSIVE + bool "Use CFI in permissive mode" + depends on CFI_CLANG + help + When selected, Control Flow Integrity (CFI) violations result in a + warning instead of a kernel panic. This option should only be used + for finding indirect call type mismatches during development. + + If unsure, say N. + config HAVE_ARCH_WITHIN_STACK_FRAMES bool help diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h index 76a10e0dca9f..b402494883b6 100644 --- a/include/asm-generic/bug.h +++ b/include/asm-generic/bug.h @@ -241,6 +241,22 @@ void __warn(const char *file, int line, void *caller, = unsigned taint, # define WARN_ON_SMP(x) ({0;}) #endif =20 +/* + * WARN_ON_FUNCTION_MISMATCH() warns if a value doesn't match a + * function address, and can be useful for catching issues with + * callback functions, for example. + * + * With CONFIG_CFI_CLANG, the warning is disabled because the + * compiler replaces function addresses taken in C code with + * local jump table addresses, which breaks cross-module function + * address equality. + */ +#if defined(CONFIG_CFI_CLANG) && defined(CONFIG_MODULES) +# define WARN_ON_FUNCTION_MISMATCH(x, fn) ({ 0; }) +#else +# define WARN_ON_FUNCTION_MISMATCH(x, fn) WARN_ON_ONCE((x) !=3D (fn)) +#endif + #endif /* __ASSEMBLY__ */ =20 #endif diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinu= x.lds.h index 0331d5d49551..40a9c101565e 100644 --- a/include/asm-generic/vmlinux.lds.h +++ b/include/asm-generic/vmlinux.lds.h @@ -544,6 +544,22 @@ . =3D ALIGN((align)); \ __end_rodata =3D .; =20 + +/* + * .text..L.cfi.jumptable.* contain Control-Flow Integrity (CFI) + * jump table entries. + */ +#ifdef CONFIG_CFI_CLANG +#define TEXT_CFI_JT \ + . =3D ALIGN(PMD_SIZE); \ + __cfi_jt_start =3D .; \ + *(.text..L.cfi.jumptable .text..L.cfi.jumptable.*) \ + . =3D ALIGN(PMD_SIZE); \ + __cfi_jt_end =3D .; +#else +#define TEXT_CFI_JT +#endif + /* * Non-instrumentable text section */ @@ -570,6 +586,7 @@ NOINSTR_TEXT \ *(.text..refcount) \ *(.ref.text) \ + TEXT_CFI_JT \ MEM_KEEP(init.text*) \ MEM_KEEP(exit.text*) \ =20 @@ -974,7 +991,8 @@ * keep any .init_array.* sections. * https://bugs.llvm.org/show_bug.cgi?id=3D46478 */ -#if defined(CONFIG_GCOV_KERNEL) || defined(CONFIG_KASAN_GENERIC) || define= d(CONFIG_KCSAN) +#if defined(CONFIG_GCOV_KERNEL) || defined(CONFIG_KASAN_GENERIC) || define= d(CONFIG_KCSAN) || \ + defined(CONFIG_CFI_CLANG) # ifdef CONFIG_CONSTRUCTORS # define SANITIZER_DISCARDS \ *(.eh_frame) diff --git a/include/linux/cfi.h b/include/linux/cfi.h new file mode 100644 index 000000000000..879744aaa6e0 --- /dev/null +++ b/include/linux/cfi.h @@ -0,0 +1,41 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Clang Control Flow Integrity (CFI) support. + * + * Copyright (C) 2021 Google LLC + */ +#ifndef _LINUX_CFI_H +#define _LINUX_CFI_H + +#ifdef CONFIG_CFI_CLANG +typedef void (*cfi_check_fn)(uint64_t id, void *ptr, void *diag); + +/* Compiler-generated function in each module, and the kernel */ +extern void __cfi_check(uint64_t id, void *ptr, void *diag); + +/* + * Force the compiler to generate a CFI jump table entry for a function + * and store the jump table address to __cfi_jt_. + */ +#define __CFI_ADDRESSABLE(fn, __attr) \ + const void *__cfi_jt_ ## fn __visible __attr =3D (void *)&fn + +#ifdef CONFIG_CFI_CLANG_SHADOW + +extern void cfi_module_add(struct module *mod, unsigned long base_addr); +extern void cfi_module_remove(struct module *mod, unsigned long base_addr)= ; + +#else + +static inline void cfi_module_add(struct module *mod, unsigned long base_a= ddr) {} +static inline void cfi_module_remove(struct module *mod, unsigned long bas= e_addr) {} + +#endif /* CONFIG_CFI_CLANG_SHADOW */ + +#else /* !CONFIG_CFI_CLANG */ + +#define __CFI_ADDRESSABLE(fn, __attr) + +#endif /* CONFIG_CFI_CLANG */ + +#endif /* _LINUX_CFI_H */ diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.= h index d217c382b02d..6de9d0c9377e 100644 --- a/include/linux/compiler-clang.h +++ b/include/linux/compiler-clang.h @@ -61,3 +61,5 @@ #if __has_feature(shadow_call_stack) # define __noscs __attribute__((__no_sanitize__("shadow-call-stack"))) #endif + +#define __nocfi __attribute__((__no_sanitize__("cfi"))) diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.= h index e5dd5a4ae946..796935a37e37 100644 --- a/include/linux/compiler_types.h +++ b/include/linux/compiler_types.h @@ -242,6 +242,10 @@ struct ftrace_likely_data { # define __noscs #endif =20 +#ifndef __nocfi +# define __nocfi +#endif + #ifndef asm_volatile_goto #define asm_volatile_goto(x...) asm goto(x) #endif diff --git a/include/linux/init.h b/include/linux/init.h index 31f54de58429..b3ea15348fbd 100644 --- a/include/linux/init.h +++ b/include/linux/init.h @@ -47,7 +47,7 @@ =20 /* These are for everybody (although not all archs will actually discard it in modules) */ -#define __init __section(".init.text") __cold __latent_entropy __noinitr= etpoline +#define __init __section(".init.text") __cold __latent_entropy __noinitr= etpoline __nocfi #define __initdata __section(".init.data") #define __initconst __section(".init.rodata") #define __exitdata __section(".exit.data") diff --git a/include/linux/module.h b/include/linux/module.h index da4b6fbe8ebe..8100bb477d86 100644 --- a/include/linux/module.h +++ b/include/linux/module.h @@ -26,6 +26,7 @@ #include #include #include +#include =20 #include #include @@ -128,13 +129,17 @@ extern void cleanup_module(void); #define module_init(initfn) \ static inline initcall_t __maybe_unused __inittest(void) \ { return initfn; } \ - int init_module(void) __copy(initfn) __attribute__((alias(#initfn))); + int init_module(void) __copy(initfn) \ + __attribute__((alias(#initfn))); \ + __CFI_ADDRESSABLE(init_module, __initdata); =20 /* This is only required if you want to be unloadable. */ #define module_exit(exitfn) \ static inline exitcall_t __maybe_unused __exittest(void) \ { return exitfn; } \ - void cleanup_module(void) __copy(exitfn) __attribute__((alias(#exitfn))); + void cleanup_module(void) __copy(exitfn) \ + __attribute__((alias(#exitfn))); \ + __CFI_ADDRESSABLE(cleanup_module, __exitdata); =20 #endif =20 @@ -376,6 +381,10 @@ struct module { const s32 *crcs; unsigned int num_syms; =20 +#ifdef CONFIG_CFI_CLANG + cfi_check_fn cfi_check; +#endif + /* Kernel parameters. */ #ifdef CONFIG_SYSFS struct mutex param_lock; diff --git a/init/Kconfig b/init/Kconfig index 5f5c776ef192..5babea38e346 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -2296,7 +2296,7 @@ endif # MODULES =20 config MODULES_TREE_LOOKUP def_bool y - depends on PERF_EVENTS || TRACING + depends on PERF_EVENTS || TRACING || CFI_CLANG =20 config INIT_ALL_POSSIBLE bool diff --git a/kernel/Makefile b/kernel/Makefile index 320f1f3941b7..e8a6715f38dc 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -41,6 +41,9 @@ KCSAN_SANITIZE_kcov.o :=3D n UBSAN_SANITIZE_kcov.o :=3D n CFLAGS_kcov.o :=3D $(call cc-option, -fno-conserve-stack) -fno-stack-prote= ctor =20 +# Don't instrument error handlers +CFLAGS_REMOVE_cfi.o :=3D $(CC_FLAGS_CFI) + obj-y +=3D sched/ obj-y +=3D locking/ obj-y +=3D power/ @@ -111,6 +114,7 @@ obj-$(CONFIG_BPF) +=3D bpf/ obj-$(CONFIG_KCSAN) +=3D kcsan/ obj-$(CONFIG_SHADOW_CALL_STACK) +=3D scs.o obj-$(CONFIG_HAVE_STATIC_CALL_INLINE) +=3D static_call.o +obj-$(CONFIG_CFI_CLANG) +=3D cfi.o =20 obj-$(CONFIG_PERF_EVENTS) +=3D events/ =20 diff --git a/kernel/cfi.c b/kernel/cfi.c new file mode 100644 index 000000000000..e17a56639766 --- /dev/null +++ b/kernel/cfi.c @@ -0,0 +1,329 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Clang Control Flow Integrity (CFI) error and slowpath handling. + * + * Copyright (C) 2021 Google LLC + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* Compiler-defined handler names */ +#ifdef CONFIG_CFI_PERMISSIVE +#define cfi_failure_handler __ubsan_handle_cfi_check_fail +#else +#define cfi_failure_handler __ubsan_handle_cfi_check_fail_abort +#endif + +static inline void handle_cfi_failure(void *ptr) +{ + if (IS_ENABLED(CONFIG_CFI_PERMISSIVE)) + WARN_RATELIMIT(1, "CFI failure (target: %pS):\n", ptr); + else + panic("CFI failure (target: %pS)\n", ptr); +} + +#ifdef CONFIG_MODULES +#ifdef CONFIG_CFI_CLANG_SHADOW +/* + * Index type. A 16-bit index can address at most (2^16)-2 pages (taking + * into account SHADOW_INVALID), i.e. ~256M with 4k pages. + */ +typedef u16 shadow_t; +#define SHADOW_INVALID ((shadow_t)~0UL) + +struct cfi_shadow { + /* Page index for the beginning of the shadow */ + unsigned long base; + /* An array of __cfi_check locations (as indices to the shadow) */ + shadow_t shadow[1]; +} __packed; + +/* + * The shadow covers ~128M from the beginning of the module region. If + * the region is larger, we fall back to __module_address for the rest. + */ +#define __SHADOW_RANGE (_UL(SZ_128M) >> PAGE_SHIFT) + +/* The in-memory size of struct cfi_shadow, always at least one page */ +#define __SHADOW_PAGES ((__SHADOW_RANGE * sizeof(shadow_t)) >> PAGE_SHIFT= ) +#define SHADOW_PAGES max(1UL, __SHADOW_PAGES) +#define SHADOW_SIZE (SHADOW_PAGES << PAGE_SHIFT) + +/* The actual size of the shadow array, minus metadata */ +#define SHADOW_ARR_SIZE (SHADOW_SIZE - offsetof(struct cfi_shadow, shadow= )) +#define SHADOW_ARR_SLOTS (SHADOW_ARR_SIZE / sizeof(shadow_t)) + +static DEFINE_MUTEX(shadow_update_lock); +static struct cfi_shadow __rcu *cfi_shadow __read_mostly; + +/* Returns the index in the shadow for the given address */ +static inline int ptr_to_shadow(const struct cfi_shadow *s, unsigned long = ptr) +{ + unsigned long index; + unsigned long page =3D ptr >> PAGE_SHIFT; + + if (unlikely(page < s->base)) + return -1; /* Outside of module area */ + + index =3D page - s->base; + + if (index >=3D SHADOW_ARR_SLOTS) + return -1; /* Cannot be addressed with shadow */ + + return (int)index; +} + +/* Returns the page address for an index in the shadow */ +static inline unsigned long shadow_to_ptr(const struct cfi_shadow *s, + int index) +{ + if (unlikely(index < 0 || index >=3D SHADOW_ARR_SLOTS)) + return 0; + + return (s->base + index) << PAGE_SHIFT; +} + +/* Returns the __cfi_check function address for the given shadow location = */ +static inline unsigned long shadow_to_check_fn(const struct cfi_shadow *s, + int index) +{ + if (unlikely(index < 0 || index >=3D SHADOW_ARR_SLOTS)) + return 0; + + if (unlikely(s->shadow[index] =3D=3D SHADOW_INVALID)) + return 0; + + /* __cfi_check is always page aligned */ + return (s->base + s->shadow[index]) << PAGE_SHIFT; +} + +static void prepare_next_shadow(const struct cfi_shadow __rcu *prev, + struct cfi_shadow *next) +{ + int i, index, check; + + /* Mark everything invalid */ + memset(next->shadow, 0xFF, SHADOW_ARR_SIZE); + + if (!prev) + return; /* No previous shadow */ + + /* If the base address didn't change, an update is not needed */ + if (prev->base =3D=3D next->base) { + memcpy(next->shadow, prev->shadow, SHADOW_ARR_SIZE); + return; + } + + /* Convert the previous shadow to the new address range */ + for (i =3D 0; i < SHADOW_ARR_SLOTS; ++i) { + if (prev->shadow[i] =3D=3D SHADOW_INVALID) + continue; + + index =3D ptr_to_shadow(next, shadow_to_ptr(prev, i)); + if (index < 0) + continue; + + check =3D ptr_to_shadow(next, + shadow_to_check_fn(prev, prev->shadow[i])); + if (check < 0) + continue; + + next->shadow[index] =3D (shadow_t)check; + } +} + +static void add_module_to_shadow(struct cfi_shadow *s, struct module *mod, + unsigned long min_addr, unsigned long max_addr) +{ + int check_index; + unsigned long check =3D (unsigned long)mod->cfi_check; + unsigned long ptr; + + if (unlikely(!PAGE_ALIGNED(check))) { + pr_warn("cfi: not using shadow for module %s\n", mod->name); + return; + } + + check_index =3D ptr_to_shadow(s, check); + if (check_index < 0) + return; /* Module not addressable with shadow */ + + /* For each page, store the check function index in the shadow */ + for (ptr =3D min_addr; ptr <=3D max_addr; ptr +=3D PAGE_SIZE) { + int index =3D ptr_to_shadow(s, ptr); + + if (index >=3D 0) { + /* Each page must only contain one module */ + WARN_ON_ONCE(s->shadow[index] !=3D SHADOW_INVALID); + s->shadow[index] =3D (shadow_t)check_index; + } + } +} + +static void remove_module_from_shadow(struct cfi_shadow *s, struct module = *mod, + unsigned long min_addr, unsigned long max_addr) +{ + unsigned long ptr; + + for (ptr =3D min_addr; ptr <=3D max_addr; ptr +=3D PAGE_SIZE) { + int index =3D ptr_to_shadow(s, ptr); + + if (index >=3D 0) + s->shadow[index] =3D SHADOW_INVALID; + } +} + +typedef void (*update_shadow_fn)(struct cfi_shadow *, struct module *, + unsigned long min_addr, unsigned long max_addr); + +static void update_shadow(struct module *mod, unsigned long base_addr, + update_shadow_fn fn) +{ + struct cfi_shadow *prev; + struct cfi_shadow *next; + unsigned long min_addr, max_addr; + + next =3D vmalloc(SHADOW_SIZE); + + mutex_lock(&shadow_update_lock); + prev =3D rcu_dereference_protected(cfi_shadow, + mutex_is_locked(&shadow_update_lock)); + + if (next) { + next->base =3D base_addr >> PAGE_SHIFT; + prepare_next_shadow(prev, next); + + min_addr =3D (unsigned long)mod->core_layout.base; + max_addr =3D min_addr + mod->core_layout.text_size; + fn(next, mod, min_addr & PAGE_MASK, max_addr & PAGE_MASK); + + set_memory_ro((unsigned long)next, SHADOW_PAGES); + } + + rcu_assign_pointer(cfi_shadow, next); + mutex_unlock(&shadow_update_lock); + synchronize_rcu(); + + if (prev) { + set_memory_rw((unsigned long)prev, SHADOW_PAGES); + vfree(prev); + } +} + +void cfi_module_add(struct module *mod, unsigned long base_addr) +{ + update_shadow(mod, base_addr, add_module_to_shadow); +} + +void cfi_module_remove(struct module *mod, unsigned long base_addr) +{ + update_shadow(mod, base_addr, remove_module_from_shadow); +} + +static inline cfi_check_fn ptr_to_check_fn(const struct cfi_shadow __rcu *= s, + unsigned long ptr) +{ + int index; + + if (unlikely(!s)) + return NULL; /* No shadow available */ + + index =3D ptr_to_shadow(s, ptr); + if (index < 0) + return NULL; /* Cannot be addressed with shadow */ + + return (cfi_check_fn)shadow_to_check_fn(s, index); +} + +static inline cfi_check_fn find_shadow_check_fn(unsigned long ptr) +{ + cfi_check_fn fn; + + rcu_read_lock_sched(); + fn =3D ptr_to_check_fn(rcu_dereference_sched(cfi_shadow), ptr); + rcu_read_unlock_sched(); + + return fn; +} + +#else /* !CONFIG_CFI_CLANG_SHADOW */ + +static inline cfi_check_fn find_shadow_check_fn(unsigned long ptr) +{ + return NULL; +} + +#endif /* CONFIG_CFI_CLANG_SHADOW */ + +static inline cfi_check_fn find_module_check_fn(unsigned long ptr) +{ + cfi_check_fn fn =3D NULL; + struct module *mod; + + rcu_read_lock_sched(); + mod =3D __module_address(ptr); + if (mod) + fn =3D mod->cfi_check; + rcu_read_unlock_sched(); + + return fn; +} + +static inline cfi_check_fn find_check_fn(unsigned long ptr) +{ + cfi_check_fn fn =3D NULL; + + if (is_kernel_text(ptr)) + return __cfi_check; + + /* + * Indirect call checks can happen when RCU is not watching. Both + * the shadow and __module_address use RCU, so we need to wake it + * up if necessary. + */ + RCU_NONIDLE({ + if (IS_ENABLED(CONFIG_CFI_CLANG_SHADOW)) + fn =3D find_shadow_check_fn(ptr); + + if (!fn) + fn =3D find_module_check_fn(ptr); + }); + + return fn; +} + +void __cfi_slowpath_diag(uint64_t id, void *ptr, void *diag) +{ + cfi_check_fn fn =3D find_check_fn((unsigned long)ptr); + + if (likely(fn)) + fn(id, ptr, diag); + else /* Don't allow unchecked modules */ + handle_cfi_failure(ptr); +} +EXPORT_SYMBOL(__cfi_slowpath_diag); + +#else /* !CONFIG_MODULES */ + +void __cfi_slowpath_diag(uint64_t id, void *ptr, void *diag) +{ + handle_cfi_failure(ptr); /* No modules */ +} +EXPORT_SYMBOL(__cfi_slowpath_diag); + +#endif /* CONFIG_MODULES */ + +void cfi_failure_handler(void *data, void *ptr, void *vtable) +{ + handle_cfi_failure(ptr); +} +EXPORT_SYMBOL(cfi_failure_handler); diff --git a/kernel/module.c b/kernel/module.c index 30479355ab85..20fb004e7d8d 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -2146,6 +2146,8 @@ void __weak module_arch_freeing_init(struct module *m= od) { } =20 +static void cfi_cleanup(struct module *mod); + /* Free a module, remove from lists, etc. */ static void free_module(struct module *mod) { @@ -2187,6 +2189,9 @@ static void free_module(struct module *mod) synchronize_rcu(); mutex_unlock(&module_mutex); =20 + /* Clean up CFI for the module. */ + cfi_cleanup(mod); + /* This may be empty, but that's OK */ module_arch_freeing_init(mod); module_memfree(mod->init_layout.base); @@ -3866,6 +3871,8 @@ static int unknown_module_param_cb(char *param, char = *val, const char *modname, return 0; } =20 +static void cfi_init(struct module *mod); + /* * Allocate and load the module: note that size of section 0 is always * zero, and we rely on this for optional sections. @@ -3997,6 +4004,9 @@ static int load_module(struct load_info *info, const = char __user *uargs, =20 flush_module_icache(mod); =20 + /* Setup CFI for the module. */ + cfi_init(mod); + /* Now copy in args */ mod->args =3D strndup_user(uargs, ~0UL >> 1); if (IS_ERR(mod->args)) { @@ -4070,6 +4080,7 @@ static int load_module(struct load_info *info, const = char __user *uargs, synchronize_rcu(); kfree(mod->args); free_arch_cleanup: + cfi_cleanup(mod); module_arch_cleanup(mod); free_modinfo: free_modinfo(mod); @@ -4415,6 +4426,38 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *,= const char *, #endif /* CONFIG_LIVEPATCH */ #endif /* CONFIG_KALLSYMS */ =20 +static void cfi_init(struct module *mod) +{ +#ifdef CONFIG_CFI_CLANG + initcall_t *init; + exitcall_t *exit; + + rcu_read_lock_sched(); + mod->cfi_check =3D (cfi_check_fn) + find_kallsyms_symbol_value(mod, "__cfi_check"); + init =3D (initcall_t *) + find_kallsyms_symbol_value(mod, "__cfi_jt_init_module"); + exit =3D (exitcall_t *) + find_kallsyms_symbol_value(mod, "__cfi_jt_cleanup_module"); + rcu_read_unlock_sched(); + + /* Fix init/exit functions to point to the CFI jump table */ + if (init) + mod->init =3D *init; + if (exit) + mod->exit =3D *exit; + + cfi_module_add(mod, module_addr_min); +#endif +} + +static void cfi_cleanup(struct module *mod) +{ +#ifdef CONFIG_CFI_CLANG + cfi_module_remove(mod, module_addr_min); +#endif +} + /* Maximum number of characters written by module_flags() */ #define MODULE_FLAGS_BUF_SIZE (TAINT_FLAGS_COUNT + 4) =20 diff --git a/scripts/Makefile.modfinal b/scripts/Makefile.modfinal index 735e11e9041b..dd87cea9fba7 100644 --- a/scripts/Makefile.modfinal +++ b/scripts/Makefile.modfinal @@ -23,7 +23,7 @@ modname =3D $(notdir $(@:.mod.o=3D)) part-of-module =3D y =20 quiet_cmd_cc_o_c =3D CC [M] $@ - cmd_cc_o_c =3D $(CC) $(c_flags) -c -o $@ $< + cmd_cc_o_c =3D $(CC) $(filter-out $(CC_FLAGS_CFI), $(c_flags)) -c -o= $@ $< =20 %.mod.o: %.mod.c FORCE $(call if_changed_dep,cc_o_c) --=20 2.31.0.291.g576ba9dcdaf-goog From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2FEA2C433DB for ; Tue, 23 Mar 2021 20:42:38 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 451BF61574 for ; Tue, 23 Mar 2021 20:42:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 451BF61574 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Cc:To:From:Subject:References:Mime-Version: Message-Id:In-Reply-To:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=wFaVOpmb4E/n9e4oIMH4S0ZDx1oeY1wuY2Hra3jkr6I=; b=ROnmX/S68IJkfQ 2vLe206sypqNGLYAeldVc/jl75r2ceM5B8tzWVMqfhMYXA9wqGVD4yLERO/it0ob4eTOPOJH4bUPz G6164iKGFSkWqP+XESWcAQAa932PHXl629F32yoaXe7C3xR7O3Qk0TyA5XFA5l1ElUPReYKmNDm0F cO9fS5vDdvTfikcmuNzKe8ygHHZONfEyp4FMgWHzP4P/2HKwROoKWGYG7L1ZnV+ylmYM39+tN2P43 Zf9L228HEyzrgtYuWWXF/TNc7SVnVQQ+JLrXdvebckSm4Y+eUpH+d8jfiQI6gFNP5Y6JLNLBuwBzm rb30HTBSSfnaEVD3CJ/A==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lOnoq-00Fg6j-U9; Tue, 23 Mar 2021 20:40:05 +0000 Received: from mail-qk1-x749.google.com ([2607:f8b0:4864:20::749]) by desiato.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lOnoe-00Fg3q-Dx for linux-arm-kernel@lists.infradead.org; Tue, 23 Mar 2021 20:39:55 +0000 Received: by mail-qk1-x749.google.com with SMTP id j14so134791qka.7 for ; Tue, 23 Mar 2021 13:39:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc:content-transfer-encoding; bh=oRH0oPqc1YkPpMAYQYFZl9QAi5/yaxV7NoOeL8QzXY4=; b=GjBgkHJGOeUrIBhop7aWNfhrqfm1aGxDtV3jtuOZIQDlOColM38iVA4ChTKOGs4Vn7 N5IFA5VTu6lclmpBPE9BdZbHEyBaMp8briSjKqsuUmOVK1wpG2wcpsCP9VXyZYyVIoam DHTzjCZ4RDeu+ljC3DvSxDKyaKnBoK+rI5S1K95pDpB6ARMOrZsyjJ5Wd+dT6a8ezDnZ DBoHStC+B5jrj4U2u+dFApkUlFZRW4e48m6eMII6ItNn+1FP3mcuay/8SuuPmC/fnIDZ sKwOsG+GCY4mLxFS+ojNJLKvGu+RTvlb4oH1ee+XCmCiFdJuVke/9wV+bZ+l9fx/HDTd BCfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc:content-transfer-encoding; bh=oRH0oPqc1YkPpMAYQYFZl9QAi5/yaxV7NoOeL8QzXY4=; b=YTsF0mcyFclrfiKBwuz4S7zdsAbQaQmKwxosUHA6xeDwiRGRAsmNr1dyyHZgKSrwMX f5DpGjyWdnpN30fBXoqk2CUB1TSdvS9uBJOkY4UiC5kHHXKclnDMom9PsQ1Sf4ERdaom Ol/+ATujwc67GjEXukCcjSD+cW/1CFjY3LM90xBTBuGNi7NSzWjkpGAoXuRSB9EdiT/B cqwL21NBAGhf8KECQ605ZWoPbPBfeCtoQyuTBfSuOby0XZUvW20DaeWi8xx3BRm7e5kZ zZ3aQIkpW8mbKhCQieWUhBCMbjP4gZZV3wHby5DFaFBgiwknp88zp5ADQ1ZwQa5uY2Xr MVSQ== X-Gm-Message-State: AOAM533O7fOD9INDM+pKTKeP39ybNkFzJovH9E/88cdyUYIUG8sQEhs1 HaLdXlVTe4wYPzkdfX0xpH9iBWfAHft7UiEKT7E= X-Google-Smtp-Source: ABdhPJxDF0lHo0+rGsyYGKZTGaYYdqb/VVtyXHwYyK1sQr6dy4J7IMGg0tunH3tqmmIpzV7AcPx23lj4ssrrCTE+rJc= X-Received: from samitolvanen1.mtv.corp.google.com ([2620:15c:201:2:e9a3:260d:763b:67dc]) (user=samitolvanen job=sendgmr) by 2002:a05:6214:90b:: with SMTP id dj11mr6674797qvb.52.1616531990609; Tue, 23 Mar 2021 13:39:50 -0700 (PDT) Date: Tue, 23 Mar 2021 13:39:30 -0700 In-Reply-To: <20210323203946.2159693-1-samitolvanen@google.com> Message-Id: <20210323203946.2159693-2-samitolvanen@google.com> Mime-Version: 1.0 References: <20210323203946.2159693-1-samitolvanen@google.com> X-Mailer: git-send-email 2.31.0.291.g576ba9dcdaf-goog Subject: [PATCH v3 01/17] add support for Clang CFI From: Sami Tolvanen To: Kees Cook Cc: Nathan Chancellor , Nick Desaulniers , Masahiro Yamada , Will Deacon , Jessica Yu , Arnd Bergmann , Tejun Heo , "Paul E. McKenney" , Christoph Hellwig , Peter Zijlstra , bpf@vger.kernel.org, linux-hardening@vger.kernel.org, linux-arch@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kbuild@vger.kernel.org, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Sami Tolvanen X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210323_203952_845208_C9E0D015 X-CRM114-Status: GOOD ( 36.75 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org VGhpcyBjaGFuZ2UgYWRkcyBzdXBwb3J0IGZvciBDbGFuZ+KAmXMgZm9yd2FyZC1lZGdlIENvbnRy b2wgRmxvdwpJbnRlZ3JpdHkgKENGSSkgY2hlY2tpbmcuIFdpdGggQ09ORklHX0NGSV9DTEFORywg dGhlIGNvbXBpbGVyCmluamVjdHMgYSBydW50aW1lIGNoZWNrIGJlZm9yZSBlYWNoIGluZGlyZWN0 IGZ1bmN0aW9uIGNhbGwgdG8gZW5zdXJlCnRoZSB0YXJnZXQgaXMgYSB2YWxpZCBmdW5jdGlvbiB3 aXRoIHRoZSBjb3JyZWN0IHN0YXRpYyB0eXBlLiBUaGlzCnJlc3RyaWN0cyBwb3NzaWJsZSBjYWxs IHRhcmdldHMgYW5kIG1ha2VzIGl0IG1vcmUgZGlmZmljdWx0IGZvcgphbiBhdHRhY2tlciB0byBl eHBsb2l0IGJ1Z3MgdGhhdCBhbGxvdyB0aGUgbW9kaWZpY2F0aW9uIG9mIHN0b3JlZApmdW5jdGlv biBwb2ludGVycy4gRm9yIG1vcmUgZGV0YWlscywgc2VlOgoKICBodHRwczovL2NsYW5nLmxsdm0u b3JnL2RvY3MvQ29udHJvbEZsb3dJbnRlZ3JpdHkuaHRtbAoKQ2xhbmcgcmVxdWlyZXMgQ09ORklH X0xUT19DTEFORyB0byBiZSBlbmFibGVkIHdpdGggQ0ZJIHRvIGdhaW4KdmlzaWJpbGl0eSB0byBw b3NzaWJsZSBjYWxsIHRhcmdldHMuIEtlcm5lbCBtb2R1bGVzIGFyZSBzdXBwb3J0ZWQKd2l0aCBD bGFuZ+KAmXMgY3Jvc3MtRFNPIENGSSBtb2RlLCB3aGljaCBhbGxvd3MgY2hlY2tpbmcgYmV0d2Vl bgppbmRlcGVuZGVudGx5IGNvbXBpbGVkIGNvbXBvbmVudHMuCgpXaXRoIENGSSBlbmFibGVkLCB0 aGUgY29tcGlsZXIgaW5qZWN0cyBhIF9fY2ZpX2NoZWNrKCkgZnVuY3Rpb24gaW50bwp0aGUga2Vy bmVsIGFuZCBlYWNoIG1vZHVsZSBmb3IgdmFsaWRhdGluZyBsb2NhbCBjYWxsIHRhcmdldHMuIEZv cgpjcm9zcy1tb2R1bGUgY2FsbHMgdGhhdCBjYW5ub3QgYmUgdmFsaWRhdGVkIGxvY2FsbHksIHRo ZSBjb21waWxlcgpjYWxscyB0aGUgZ2xvYmFsIF9fY2ZpX3Nsb3dwYXRoX2RpYWcoKSBmdW5jdGlv biwgd2hpY2ggZGV0ZXJtaW5lcwp0aGUgdGFyZ2V0IG1vZHVsZSBhbmQgY2FsbHMgdGhlIGNvcnJl Y3QgX19jZmlfY2hlY2soKSBmdW5jdGlvbi4gVGhpcwpwYXRjaCBpbmNsdWRlcyBhIHNsb3dwYXRo IGltcGxlbWVudGF0aW9uIHRoYXQgdXNlcyBfX21vZHVsZV9hZGRyZXNzKCkKdG8gcmVzb2x2ZSBj YWxsIHRhcmdldHMsIGFuZCB3aXRoIENPTkZJR19DRklfQ0xBTkdfU0hBRE9XIGVuYWJsZWQsIGEK c2hhZG93IG1hcCB0aGF0IHNwZWVkcyB1cCBtb2R1bGUgbG9vay11cHMgYnkgfjN4LgoKQ2xhbmcg aW1wbGVtZW50cyBpbmRpcmVjdCBjYWxsIGNoZWNraW5nIHVzaW5nIGp1bXAgdGFibGVzIGFuZApv ZmZlcnMgdHdvIG1ldGhvZHMgb2YgZ2VuZXJhdGluZyB0aGVtLiBXaXRoIGNhbm9uaWNhbCBqdW1w IHRhYmxlcywKdGhlIGNvbXBpbGVyIHJlbmFtZXMgZWFjaCBhZGRyZXNzLXRha2VuIGZ1bmN0aW9u IHRvIDxmdW5jdGlvbj4uY2ZpCmFuZCBwb2ludHMgdGhlIG9yaWdpbmFsIHN5bWJvbCB0byBhIGp1 bXAgdGFibGUgZW50cnksIHdoaWNoIHBhc3NlcwpfX2NmaV9jaGVjaygpIHZhbGlkYXRpb24uIFRo aXMgaXNu4oCZdCBjb21wYXRpYmxlIHdpdGggc3RhbmQtYWxvbmUKYXNzZW1ibHkgY29kZSwgd2hp Y2ggdGhlIGNvbXBpbGVyIGRvZXNu4oCZdCBpbnN0cnVtZW50LCBhbmQgd291bGQKcmVzdWx0IGlu IGluZGlyZWN0IGNhbGxzIHRvIGFzc2VtYmx5IGNvZGUgdG8gZmFpbC4gVGhlcmVmb3JlLCB3ZQpk ZWZhdWx0IHRvIHVzaW5nIG5vbi1jYW5vbmljYWwganVtcCB0YWJsZXMgaW5zdGVhZCwgd2hlcmUg dGhlIGNvbXBpbGVyCmdlbmVyYXRlcyBhIGxvY2FsIGp1bXAgdGFibGUgZW50cnkgPGZ1bmN0aW9u Pi5jZmlfanQgZm9yIGVhY2gKYWRkcmVzcy10YWtlbiBmdW5jdGlvbiwgYW5kIHJlcGxhY2VzIGFs bCByZWZlcmVuY2VzIHRvIHRoZSBmdW5jdGlvbgp3aXRoIHRoZSBhZGRyZXNzIG9mIHRoZSBqdW1w IHRhYmxlIGVudHJ5LgoKTm90ZSB0aGF0IGJlY2F1c2Ugbm9uLWNhbm9uaWNhbCBqdW1wIHRhYmxl IGFkZHJlc3NlcyBhcmUgbG9jYWwKdG8gZWFjaCBjb21wb25lbnQsIHRoZXkgYnJlYWsgY3Jvc3Mt bW9kdWxlIGZ1bmN0aW9uIGFkZHJlc3MKZXF1YWxpdHkuIFNwZWNpZmljYWxseSwgdGhlIGFkZHJl c3Mgb2YgYSBnbG9iYWwgZnVuY3Rpb24gd2lsbCBiZQpkaWZmZXJlbnQgaW4gZWFjaCBtb2R1bGUs IGFzIGl0J3MgcmVwbGFjZWQgd2l0aCB0aGUgYWRkcmVzcyBvZiBhIGxvY2FsCmp1bXAgdGFibGUg ZW50cnkuIElmIHRoaXMgYWRkcmVzcyBpcyBwYXNzZWQgdG8gYSBkaWZmZXJlbnQgbW9kdWxlLApp dCB3b27igJl0IG1hdGNoIHRoZSBhZGRyZXNzIG9mIHRoZSBzYW1lIGZ1bmN0aW9uIHRha2VuIHRo ZXJlLiBUaGlzCm1heSBicmVhayBjb2RlIHRoYXQgcmVsaWVzIG9uIGNvbXBhcmluZyBhZGRyZXNz ZXMgcGFzc2VkIGZyb20gb3RoZXIKY29tcG9uZW50cy4KCkNGSSBjaGVja2luZyBjYW4gYmUgZGlz YWJsZWQgaW4gYSBmdW5jdGlvbiB3aXRoIHRoZSBfX25vY2ZpIGF0dHJpYnV0ZS4KQWRkaXRpb25h bGx5LCBDRkkgY2FuIGJlIGRpc2FibGVkIGZvciBhbiBlbnRpcmUgY29tcGlsYXRpb24gdW5pdCBi eQpmaWx0ZXJpbmcgb3V0IENDX0ZMQUdTX0NGSS4KCkJ5IGRlZmF1bHQsIENGSSBmYWlsdXJlcyBy ZXN1bHQgaW4gYSBrZXJuZWwgcGFuaWMgdG8gc3RvcCBhIHBvdGVudGlhbApleHBsb2l0LiBDT05G SUdfQ0ZJX1BFUk1JU1NJVkUgZW5hYmxlcyBhIHBlcm1pc3NpdmUgbW9kZSwgd2hlcmUgdGhlCmtl cm5lbCBwcmludHMgb3V0IGEgcmF0ZS1saW1pdGVkIHdhcm5pbmcgaW5zdGVhZCwgYW5kIGFsbG93 cyBleGVjdXRpb24KdG8gY29udGludWUuIFRoaXMgb3B0aW9uIGlzIGhlbHBmdWwgZm9yIGxvY2F0 aW5nIHR5cGUgbWlzbWF0Y2hlcywgYnV0CnNob3VsZCBvbmx5IGJlIGVuYWJsZWQgZHVyaW5nIGRl dmVsb3BtZW50LgoKU2lnbmVkLW9mZi1ieTogU2FtaSBUb2x2YW5lbiA8c2FtaXRvbHZhbmVuQGdv b2dsZS5jb20+ClJldmlld2VkLWJ5OiBLZWVzIENvb2sgPGtlZXNjb29rQGNocm9taXVtLm9yZz4K LS0tCiBNYWtlZmlsZSAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgMTcgKysKIGFyY2gvS2Nv bmZpZyAgICAgICAgICAgICAgICAgICAgICB8ICA0NSArKysrCiBpbmNsdWRlL2FzbS1nZW5lcmlj L2J1Zy5oICAgICAgICAgfCAgMTYgKysKIGluY2x1ZGUvYXNtLWdlbmVyaWMvdm1saW51eC5sZHMu aCB8ICAyMCArLQogaW5jbHVkZS9saW51eC9jZmkuaCAgICAgICAgICAgICAgIHwgIDQxICsrKysK IGluY2x1ZGUvbGludXgvY29tcGlsZXItY2xhbmcuaCAgICB8ICAgMiArCiBpbmNsdWRlL2xpbnV4 L2NvbXBpbGVyX3R5cGVzLmggICAgfCAgIDQgKwogaW5jbHVkZS9saW51eC9pbml0LmggICAgICAg ICAgICAgIHwgICAyICstCiBpbmNsdWRlL2xpbnV4L21vZHVsZS5oICAgICAgICAgICAgfCAgMTMg Ky0KIGluaXQvS2NvbmZpZyAgICAgICAgICAgICAgICAgICAgICB8ICAgMiArLQoga2VybmVsL01h a2VmaWxlICAgICAgICAgICAgICAgICAgIHwgICA0ICsKIGtlcm5lbC9jZmkuYyAgICAgICAgICAg ICAgICAgICAgICB8IDMyOSArKysrKysrKysrKysrKysrKysrKysrKysrKysrKysKIGtlcm5lbC9t b2R1bGUuYyAgICAgICAgICAgICAgICAgICB8ICA0MyArKysrCiBzY3JpcHRzL01ha2VmaWxlLm1v ZGZpbmFsICAgICAgICAgfCAgIDIgKy0KIDE0IGZpbGVzIGNoYW5nZWQsIDUzNCBpbnNlcnRpb25z KCspLCA2IGRlbGV0aW9ucygtKQogY3JlYXRlIG1vZGUgMTAwNjQ0IGluY2x1ZGUvbGludXgvY2Zp LmgKIGNyZWF0ZSBtb2RlIDEwMDY0NCBrZXJuZWwvY2ZpLmMKCmRpZmYgLS1naXQgYS9NYWtlZmls ZSBiL01ha2VmaWxlCmluZGV4IGQ0Nzg0ZDE4MTEyMy4uMmI5MGE1Y2MwOGM4IDEwMDY0NAotLS0g YS9NYWtlZmlsZQorKysgYi9NYWtlZmlsZQpAQCAtOTIwLDYgKzkyMCwyMyBAQCBLQlVJTERfQUZM QUdTCSs9IC1mbm8tbHRvCiBleHBvcnQgQ0NfRkxBR1NfTFRPCiBlbmRpZgogCitpZmRlZiBDT05G SUdfQ0ZJX0NMQU5HCitDQ19GTEFHU19DRkkJOj0gLWZzYW5pdGl6ZT1jZmkgXAorCQkgICAtZnNh bml0aXplLWNmaS1jcm9zcy1kc28gXAorCQkgICAtZm5vLXNhbml0aXplLWNmaS1jYW5vbmljYWwt anVtcC10YWJsZXMgXAorCQkgICAtZm5vLXNhbml0aXplLXRyYXA9Y2ZpIFwKKwkJICAgLWZuby1z YW5pdGl6ZS1ibGFja2xpc3QKKworaWZkZWYgQ09ORklHX0NGSV9QRVJNSVNTSVZFCitDQ19GTEFH U19DRkkJKz0gLWZzYW5pdGl6ZS1yZWNvdmVyPWNmaQorZW5kaWYKKworIyBJZiBMVE8gZmxhZ3Mg YXJlIGZpbHRlcmVkIG91dCwgd2UgbXVzdCBhbHNvIGZpbHRlciBvdXQgQ0ZJLgorQ0NfRkxBR1Nf TFRPCSs9ICQoQ0NfRkxBR1NfQ0ZJKQorS0JVSUxEX0NGTEFHUwkrPSAkKENDX0ZMQUdTX0NGSSkK K2V4cG9ydCBDQ19GTEFHU19DRkkKK2VuZGlmCisKIGlmZGVmIENPTkZJR19ERUJVR19GT1JDRV9G VU5DVElPTl9BTElHTl8zMkIKIEtCVUlMRF9DRkxBR1MgKz0gLWZhbGlnbi1mdW5jdGlvbnM9MzIK IGVuZGlmCmRpZmYgLS1naXQgYS9hcmNoL0tjb25maWcgYi9hcmNoL0tjb25maWcKaW5kZXggZWNm ZDM1MjBiNjc2Li5mNmE4NWJhNmNiYTIgMTAwNjQ0Ci0tLSBhL2FyY2gvS2NvbmZpZworKysgYi9h cmNoL0tjb25maWcKQEAgLTY5Miw2ICs2OTIsNTEgQEAgY29uZmlnIExUT19DTEFOR19USElOCiAJ ICBJZiB1bnN1cmUsIHNheSBZLgogZW5kY2hvaWNlCiAKK2NvbmZpZyBBUkNIX1NVUFBPUlRTX0NG SV9DTEFORworCWJvb2wKKwloZWxwCisJICBBbiBhcmNoaXRlY3R1cmUgc2hvdWxkIHNlbGVjdCB0 aGlzIG9wdGlvbiBpZiBpdCBjYW4gc3VwcG9ydCBDbGFuZydzCisJICBDb250cm9sLUZsb3cgSW50 ZWdyaXR5IChDRkkpIGNoZWNraW5nLgorCitjb25maWcgQ0ZJX0NMQU5HCisJYm9vbCAiVXNlIENs YW5nJ3MgQ29udHJvbCBGbG93IEludGVncml0eSAoQ0ZJKSIKKwlkZXBlbmRzIG9uIExUT19DTEFO RyAmJiBBUkNIX1NVUFBPUlRTX0NGSV9DTEFORworCSMgQ2xhbmcgPj0gMTI6CisJIyAtIGh0dHBz Oi8vYnVncy5sbHZtLm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NDYyNTgKKwkjIC0gaHR0cHM6Ly9idWdz Lmxsdm0ub3JnL3Nob3dfYnVnLmNnaT9pZD00NzQ3OQorCWRlcGVuZHMgb24gQ0xBTkdfVkVSU0lP TiA+PSAxMjAwMDAKKwlzZWxlY3QgS0FMTFNZTVMKKwloZWxwCisJICBUaGlzIG9wdGlvbiBlbmFi bGVzIENsYW5n4oCZcyBmb3J3YXJkLWVkZ2UgQ29udHJvbCBGbG93IEludGVncml0eQorCSAgKENG SSkgY2hlY2tpbmcsIHdoZXJlIHRoZSBjb21waWxlciBpbmplY3RzIGEgcnVudGltZSBjaGVjayB0 byBlYWNoCisJICBpbmRpcmVjdCBmdW5jdGlvbiBjYWxsIHRvIGVuc3VyZSB0aGUgdGFyZ2V0IGlz IGEgdmFsaWQgZnVuY3Rpb24gd2l0aAorCSAgdGhlIGNvcnJlY3Qgc3RhdGljIHR5cGUuIFRoaXMg cmVzdHJpY3RzIHBvc3NpYmxlIGNhbGwgdGFyZ2V0cyBhbmQKKwkgIG1ha2VzIGl0IG1vcmUgZGlm ZmljdWx0IGZvciBhbiBhdHRhY2tlciB0byBleHBsb2l0IGJ1Z3MgdGhhdCBhbGxvdworCSAgdGhl IG1vZGlmaWNhdGlvbiBvZiBzdG9yZWQgZnVuY3Rpb24gcG9pbnRlcnMuIE1vcmUgaW5mb3JtYXRp b24gY2FuIGJlCisJICBmb3VuZCBmcm9tIENsYW5nJ3MgZG9jdW1lbnRhdGlvbjoKKworCSAgICBo dHRwczovL2NsYW5nLmxsdm0ub3JnL2RvY3MvQ29udHJvbEZsb3dJbnRlZ3JpdHkuaHRtbAorCitj b25maWcgQ0ZJX0NMQU5HX1NIQURPVworCWJvb2wgIlVzZSBDRkkgc2hhZG93IHRvIHNwZWVkIHVw IGNyb3NzLW1vZHVsZSBjaGVja3MiCisJZGVmYXVsdCB5CisJZGVwZW5kcyBvbiBDRklfQ0xBTkcg JiYgTU9EVUxFUworCWhlbHAKKwkgIElmIHlvdSBzZWxlY3QgdGhpcyBvcHRpb24sIHRoZSBrZXJu ZWwgYnVpbGRzIGEgZmFzdCBsb29rLXVwIHRhYmxlIG9mCisJICBDRkkgY2hlY2sgZnVuY3Rpb25z IGluIGxvYWRlZCBtb2R1bGVzIHRvIHJlZHVjZSBwZXJmb3JtYW5jZSBvdmVyaGVhZC4KKworCSAg SWYgdW5zdXJlLCBzYXkgWS4KKworY29uZmlnIENGSV9QRVJNSVNTSVZFCisJYm9vbCAiVXNlIENG SSBpbiBwZXJtaXNzaXZlIG1vZGUiCisJZGVwZW5kcyBvbiBDRklfQ0xBTkcKKwloZWxwCisJICBX aGVuIHNlbGVjdGVkLCBDb250cm9sIEZsb3cgSW50ZWdyaXR5IChDRkkpIHZpb2xhdGlvbnMgcmVz dWx0IGluIGEKKwkgIHdhcm5pbmcgaW5zdGVhZCBvZiBhIGtlcm5lbCBwYW5pYy4gVGhpcyBvcHRp b24gc2hvdWxkIG9ubHkgYmUgdXNlZAorCSAgZm9yIGZpbmRpbmcgaW5kaXJlY3QgY2FsbCB0eXBl IG1pc21hdGNoZXMgZHVyaW5nIGRldmVsb3BtZW50LgorCisJICBJZiB1bnN1cmUsIHNheSBOLgor CiBjb25maWcgSEFWRV9BUkNIX1dJVEhJTl9TVEFDS19GUkFNRVMKIAlib29sCiAJaGVscApkaWZm IC0tZ2l0IGEvaW5jbHVkZS9hc20tZ2VuZXJpYy9idWcuaCBiL2luY2x1ZGUvYXNtLWdlbmVyaWMv YnVnLmgKaW5kZXggNzZhMTBlMGRjYTlmLi5iNDAyNDk0ODgzYjYgMTAwNjQ0Ci0tLSBhL2luY2x1 ZGUvYXNtLWdlbmVyaWMvYnVnLmgKKysrIGIvaW5jbHVkZS9hc20tZ2VuZXJpYy9idWcuaApAQCAt MjQxLDYgKzI0MSwyMiBAQCB2b2lkIF9fd2Fybihjb25zdCBjaGFyICpmaWxlLCBpbnQgbGluZSwg dm9pZCAqY2FsbGVyLCB1bnNpZ25lZCB0YWludCwKICMgZGVmaW5lIFdBUk5fT05fU01QKHgpCQkJ KHswO30pCiAjZW5kaWYKIAorLyoKKyAqIFdBUk5fT05fRlVOQ1RJT05fTUlTTUFUQ0goKSB3YXJu cyBpZiBhIHZhbHVlIGRvZXNuJ3QgbWF0Y2ggYQorICogZnVuY3Rpb24gYWRkcmVzcywgYW5kIGNh biBiZSB1c2VmdWwgZm9yIGNhdGNoaW5nIGlzc3VlcyB3aXRoCisgKiBjYWxsYmFjayBmdW5jdGlv bnMsIGZvciBleGFtcGxlLgorICoKKyAqIFdpdGggQ09ORklHX0NGSV9DTEFORywgdGhlIHdhcm5p bmcgaXMgZGlzYWJsZWQgYmVjYXVzZSB0aGUKKyAqIGNvbXBpbGVyIHJlcGxhY2VzIGZ1bmN0aW9u IGFkZHJlc3NlcyB0YWtlbiBpbiBDIGNvZGUgd2l0aAorICogbG9jYWwganVtcCB0YWJsZSBhZGRy ZXNzZXMsIHdoaWNoIGJyZWFrcyBjcm9zcy1tb2R1bGUgZnVuY3Rpb24KKyAqIGFkZHJlc3MgZXF1 YWxpdHkuCisgKi8KKyNpZiBkZWZpbmVkKENPTkZJR19DRklfQ0xBTkcpICYmIGRlZmluZWQoQ09O RklHX01PRFVMRVMpCisjIGRlZmluZSBXQVJOX09OX0ZVTkNUSU9OX01JU01BVENIKHgsIGZuKSAo eyAwOyB9KQorI2Vsc2UKKyMgZGVmaW5lIFdBUk5fT05fRlVOQ1RJT05fTUlTTUFUQ0goeCwgZm4p IFdBUk5fT05fT05DRSgoeCkgIT0gKGZuKSkKKyNlbmRpZgorCiAjZW5kaWYgLyogX19BU1NFTUJM WV9fICovCiAKICNlbmRpZgpkaWZmIC0tZ2l0IGEvaW5jbHVkZS9hc20tZ2VuZXJpYy92bWxpbnV4 Lmxkcy5oIGIvaW5jbHVkZS9hc20tZ2VuZXJpYy92bWxpbnV4Lmxkcy5oCmluZGV4IDAzMzFkNWQ0 OTU1MS4uNDBhOWMxMDE1NjVlIDEwMDY0NAotLS0gYS9pbmNsdWRlL2FzbS1nZW5lcmljL3ZtbGlu dXgubGRzLmgKKysrIGIvaW5jbHVkZS9hc20tZ2VuZXJpYy92bWxpbnV4Lmxkcy5oCkBAIC01NDQs NiArNTQ0LDIyIEBACiAJLiA9IEFMSUdOKChhbGlnbikpOwkJCQkJCVwKIAlfX2VuZF9yb2RhdGEg PSAuOwogCisKKy8qCisgKiAudGV4dC4uTC5jZmkuanVtcHRhYmxlLiogY29udGFpbiBDb250cm9s LUZsb3cgSW50ZWdyaXR5IChDRkkpCisgKiBqdW1wIHRhYmxlIGVudHJpZXMuCisgKi8KKyNpZmRl ZiBDT05GSUdfQ0ZJX0NMQU5HCisjZGVmaW5lIFRFWFRfQ0ZJX0pUCQkJCQkJCVwKKwkJLiA9IEFM SUdOKFBNRF9TSVpFKTsJCQkJCVwKKwkJX19jZmlfanRfc3RhcnQgPSAuOwkJCQkJXAorCQkqKC50 ZXh0Li5MLmNmaS5qdW1wdGFibGUgLnRleHQuLkwuY2ZpLmp1bXB0YWJsZS4qKQlcCisJCS4gPSBB TElHTihQTURfU0laRSk7CQkJCQlcCisJCV9fY2ZpX2p0X2VuZCA9IC47CisjZWxzZQorI2RlZmlu ZSBURVhUX0NGSV9KVAorI2VuZGlmCisKIC8qCiAgKiBOb24taW5zdHJ1bWVudGFibGUgdGV4dCBz ZWN0aW9uCiAgKi8KQEAgLTU3MCw2ICs1ODYsNyBAQAogCQlOT0lOU1RSX1RFWFQJCQkJCQlcCiAJ CSooLnRleHQuLnJlZmNvdW50KQkJCQkJXAogCQkqKC5yZWYudGV4dCkJCQkJCQlcCisJCVRFWFRf Q0ZJX0pUCQkJCQkJXAogCU1FTV9LRUVQKGluaXQudGV4dCopCQkJCQkJXAogCU1FTV9LRUVQKGV4 aXQudGV4dCopCQkJCQkJXAogCkBAIC05NzQsNyArOTkxLDggQEAKICAqIGtlZXAgYW55IC5pbml0 X2FycmF5Liogc2VjdGlvbnMuCiAgKiBodHRwczovL2J1Z3MubGx2bS5vcmcvc2hvd19idWcuY2dp P2lkPTQ2NDc4CiAgKi8KLSNpZiBkZWZpbmVkKENPTkZJR19HQ09WX0tFUk5FTCkgfHwgZGVmaW5l ZChDT05GSUdfS0FTQU5fR0VORVJJQykgfHwgZGVmaW5lZChDT05GSUdfS0NTQU4pCisjaWYgZGVm aW5lZChDT05GSUdfR0NPVl9LRVJORUwpIHx8IGRlZmluZWQoQ09ORklHX0tBU0FOX0dFTkVSSUMp IHx8IGRlZmluZWQoQ09ORklHX0tDU0FOKSB8fCBcCisJZGVmaW5lZChDT05GSUdfQ0ZJX0NMQU5H KQogIyBpZmRlZiBDT05GSUdfQ09OU1RSVUNUT1JTCiAjICBkZWZpbmUgU0FOSVRJWkVSX0RJU0NB UkRTCQkJCQkJXAogCSooLmVoX2ZyYW1lKQpkaWZmIC0tZ2l0IGEvaW5jbHVkZS9saW51eC9jZmku aCBiL2luY2x1ZGUvbGludXgvY2ZpLmgKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAw MDAwMDAwLi44Nzk3NDRhYWE2ZTAKLS0tIC9kZXYvbnVsbAorKysgYi9pbmNsdWRlL2xpbnV4L2Nm aS5oCkBAIC0wLDAgKzEsNDEgQEAKKy8qIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBHUEwtMi4w ICovCisvKgorICogQ2xhbmcgQ29udHJvbCBGbG93IEludGVncml0eSAoQ0ZJKSBzdXBwb3J0Lgor ICoKKyAqIENvcHlyaWdodCAoQykgMjAyMSBHb29nbGUgTExDCisgKi8KKyNpZm5kZWYgX0xJTlVY X0NGSV9ICisjZGVmaW5lIF9MSU5VWF9DRklfSAorCisjaWZkZWYgQ09ORklHX0NGSV9DTEFORwor dHlwZWRlZiB2b2lkICgqY2ZpX2NoZWNrX2ZuKSh1aW50NjRfdCBpZCwgdm9pZCAqcHRyLCB2b2lk ICpkaWFnKTsKKworLyogQ29tcGlsZXItZ2VuZXJhdGVkIGZ1bmN0aW9uIGluIGVhY2ggbW9kdWxl LCBhbmQgdGhlIGtlcm5lbCAqLworZXh0ZXJuIHZvaWQgX19jZmlfY2hlY2sodWludDY0X3QgaWQs IHZvaWQgKnB0ciwgdm9pZCAqZGlhZyk7CisKKy8qCisgKiBGb3JjZSB0aGUgY29tcGlsZXIgdG8g Z2VuZXJhdGUgYSBDRkkganVtcCB0YWJsZSBlbnRyeSBmb3IgYSBmdW5jdGlvbgorICogYW5kIHN0 b3JlIHRoZSBqdW1wIHRhYmxlIGFkZHJlc3MgdG8gX19jZmlfanRfPGZ1bmN0aW9uPi4KKyAqLwor I2RlZmluZSBfX0NGSV9BRERSRVNTQUJMRShmbiwgX19hdHRyKSBcCisJY29uc3Qgdm9pZCAqX19j ZmlfanRfICMjIGZuIF9fdmlzaWJsZSBfX2F0dHIgPSAodm9pZCAqKSZmbgorCisjaWZkZWYgQ09O RklHX0NGSV9DTEFOR19TSEFET1cKKworZXh0ZXJuIHZvaWQgY2ZpX21vZHVsZV9hZGQoc3RydWN0 IG1vZHVsZSAqbW9kLCB1bnNpZ25lZCBsb25nIGJhc2VfYWRkcik7CitleHRlcm4gdm9pZCBjZmlf bW9kdWxlX3JlbW92ZShzdHJ1Y3QgbW9kdWxlICptb2QsIHVuc2lnbmVkIGxvbmcgYmFzZV9hZGRy KTsKKworI2Vsc2UKKworc3RhdGljIGlubGluZSB2b2lkIGNmaV9tb2R1bGVfYWRkKHN0cnVjdCBt b2R1bGUgKm1vZCwgdW5zaWduZWQgbG9uZyBiYXNlX2FkZHIpIHt9CitzdGF0aWMgaW5saW5lIHZv aWQgY2ZpX21vZHVsZV9yZW1vdmUoc3RydWN0IG1vZHVsZSAqbW9kLCB1bnNpZ25lZCBsb25nIGJh c2VfYWRkcikge30KKworI2VuZGlmIC8qIENPTkZJR19DRklfQ0xBTkdfU0hBRE9XICovCisKKyNl bHNlIC8qICFDT05GSUdfQ0ZJX0NMQU5HICovCisKKyNkZWZpbmUgX19DRklfQUREUkVTU0FCTEUo Zm4sIF9fYXR0cikKKworI2VuZGlmIC8qIENPTkZJR19DRklfQ0xBTkcgKi8KKworI2VuZGlmIC8q IF9MSU5VWF9DRklfSCAqLwpkaWZmIC0tZ2l0IGEvaW5jbHVkZS9saW51eC9jb21waWxlci1jbGFu Zy5oIGIvaW5jbHVkZS9saW51eC9jb21waWxlci1jbGFuZy5oCmluZGV4IGQyMTdjMzgyYjAyZC4u NmRlOWQwYzkzNzdlIDEwMDY0NAotLS0gYS9pbmNsdWRlL2xpbnV4L2NvbXBpbGVyLWNsYW5nLmgK KysrIGIvaW5jbHVkZS9saW51eC9jb21waWxlci1jbGFuZy5oCkBAIC02MSwzICs2MSw1IEBACiAj aWYgX19oYXNfZmVhdHVyZShzaGFkb3dfY2FsbF9zdGFjaykKICMgZGVmaW5lIF9fbm9zY3MJX19h dHRyaWJ1dGVfXygoX19ub19zYW5pdGl6ZV9fKCJzaGFkb3ctY2FsbC1zdGFjayIpKSkKICNlbmRp ZgorCisjZGVmaW5lIF9fbm9jZmkJCV9fYXR0cmlidXRlX18oKF9fbm9fc2FuaXRpemVfXygiY2Zp IikpKQpkaWZmIC0tZ2l0IGEvaW5jbHVkZS9saW51eC9jb21waWxlcl90eXBlcy5oIGIvaW5jbHVk ZS9saW51eC9jb21waWxlcl90eXBlcy5oCmluZGV4IGU1ZGQ1YTRhZTk0Ni4uNzk2OTM1YTM3ZTM3 IDEwMDY0NAotLS0gYS9pbmNsdWRlL2xpbnV4L2NvbXBpbGVyX3R5cGVzLmgKKysrIGIvaW5jbHVk ZS9saW51eC9jb21waWxlcl90eXBlcy5oCkBAIC0yNDIsNiArMjQyLDEwIEBAIHN0cnVjdCBmdHJh Y2VfbGlrZWx5X2RhdGEgewogIyBkZWZpbmUgX19ub3NjcwogI2VuZGlmCiAKKyNpZm5kZWYgX19u b2NmaQorIyBkZWZpbmUgX19ub2NmaQorI2VuZGlmCisKICNpZm5kZWYgYXNtX3ZvbGF0aWxlX2dv dG8KICNkZWZpbmUgYXNtX3ZvbGF0aWxlX2dvdG8oeC4uLikgYXNtIGdvdG8oeCkKICNlbmRpZgpk aWZmIC0tZ2l0IGEvaW5jbHVkZS9saW51eC9pbml0LmggYi9pbmNsdWRlL2xpbnV4L2luaXQuaApp bmRleCAzMWY1NGRlNTg0MjkuLmIzZWExNTM0OGZiZCAxMDA2NDQKLS0tIGEvaW5jbHVkZS9saW51 eC9pbml0LmgKKysrIGIvaW5jbHVkZS9saW51eC9pbml0LmgKQEAgLTQ3LDcgKzQ3LDcgQEAKIAog LyogVGhlc2UgYXJlIGZvciBldmVyeWJvZHkgKGFsdGhvdWdoIG5vdCBhbGwgYXJjaHMgd2lsbCBh Y3R1YWxseQogICAgZGlzY2FyZCBpdCBpbiBtb2R1bGVzKSAqLwotI2RlZmluZSBfX2luaXQJCV9f c2VjdGlvbigiLmluaXQudGV4dCIpIF9fY29sZCAgX19sYXRlbnRfZW50cm9weSBfX25vaW5pdHJl dHBvbGluZQorI2RlZmluZSBfX2luaXQJCV9fc2VjdGlvbigiLmluaXQudGV4dCIpIF9fY29sZCAg X19sYXRlbnRfZW50cm9weSBfX25vaW5pdHJldHBvbGluZSBfX25vY2ZpCiAjZGVmaW5lIF9faW5p dGRhdGEJX19zZWN0aW9uKCIuaW5pdC5kYXRhIikKICNkZWZpbmUgX19pbml0Y29uc3QJX19zZWN0 aW9uKCIuaW5pdC5yb2RhdGEiKQogI2RlZmluZSBfX2V4aXRkYXRhCV9fc2VjdGlvbigiLmV4aXQu ZGF0YSIpCmRpZmYgLS1naXQgYS9pbmNsdWRlL2xpbnV4L21vZHVsZS5oIGIvaW5jbHVkZS9saW51 eC9tb2R1bGUuaAppbmRleCBkYTRiNmZiZThlYmUuLjgxMDBiYjQ3N2Q4NiAxMDA2NDQKLS0tIGEv aW5jbHVkZS9saW51eC9tb2R1bGUuaAorKysgYi9pbmNsdWRlL2xpbnV4L21vZHVsZS5oCkBAIC0y Niw2ICsyNiw3IEBACiAjaW5jbHVkZSA8bGludXgvdHJhY2Vwb2ludC1kZWZzLmg+CiAjaW5jbHVk ZSA8bGludXgvc3JjdS5oPgogI2luY2x1ZGUgPGxpbnV4L3N0YXRpY19jYWxsX3R5cGVzLmg+Cisj aW5jbHVkZSA8bGludXgvY2ZpLmg+CiAKICNpbmNsdWRlIDxsaW51eC9wZXJjcHUuaD4KICNpbmNs dWRlIDxhc20vbW9kdWxlLmg+CkBAIC0xMjgsMTMgKzEyOSwxNyBAQCBleHRlcm4gdm9pZCBjbGVh bnVwX21vZHVsZSh2b2lkKTsKICNkZWZpbmUgbW9kdWxlX2luaXQoaW5pdGZuKQkJCQkJXAogCXN0 YXRpYyBpbmxpbmUgaW5pdGNhbGxfdCBfX21heWJlX3VudXNlZCBfX2luaXR0ZXN0KHZvaWQpCQlc CiAJeyByZXR1cm4gaW5pdGZuOyB9CQkJCQlcCi0JaW50IGluaXRfbW9kdWxlKHZvaWQpIF9fY29w eShpbml0Zm4pIF9fYXR0cmlidXRlX18oKGFsaWFzKCNpbml0Zm4pKSk7CisJaW50IGluaXRfbW9k dWxlKHZvaWQpIF9fY29weShpbml0Zm4pCQkJXAorCQlfX2F0dHJpYnV0ZV9fKChhbGlhcygjaW5p dGZuKSkpOwkJXAorCV9fQ0ZJX0FERFJFU1NBQkxFKGluaXRfbW9kdWxlLCBfX2luaXRkYXRhKTsK IAogLyogVGhpcyBpcyBvbmx5IHJlcXVpcmVkIGlmIHlvdSB3YW50IHRvIGJlIHVubG9hZGFibGUu ICovCiAjZGVmaW5lIG1vZHVsZV9leGl0KGV4aXRmbikJCQkJCVwKIAlzdGF0aWMgaW5saW5lIGV4 aXRjYWxsX3QgX19tYXliZV91bnVzZWQgX19leGl0dGVzdCh2b2lkKQkJXAogCXsgcmV0dXJuIGV4 aXRmbjsgfQkJCQkJXAotCXZvaWQgY2xlYW51cF9tb2R1bGUodm9pZCkgX19jb3B5KGV4aXRmbikg X19hdHRyaWJ1dGVfXygoYWxpYXMoI2V4aXRmbikpKTsKKwl2b2lkIGNsZWFudXBfbW9kdWxlKHZv aWQpIF9fY29weShleGl0Zm4pCQlcCisJCV9fYXR0cmlidXRlX18oKGFsaWFzKCNleGl0Zm4pKSk7 CQlcCisJX19DRklfQUREUkVTU0FCTEUoY2xlYW51cF9tb2R1bGUsIF9fZXhpdGRhdGEpOwogCiAj ZW5kaWYKIApAQCAtMzc2LDYgKzM4MSwxMCBAQCBzdHJ1Y3QgbW9kdWxlIHsKIAljb25zdCBzMzIg KmNyY3M7CiAJdW5zaWduZWQgaW50IG51bV9zeW1zOwogCisjaWZkZWYgQ09ORklHX0NGSV9DTEFO RworCWNmaV9jaGVja19mbiBjZmlfY2hlY2s7CisjZW5kaWYKKwogCS8qIEtlcm5lbCBwYXJhbWV0 ZXJzLiAqLwogI2lmZGVmIENPTkZJR19TWVNGUwogCXN0cnVjdCBtdXRleCBwYXJhbV9sb2NrOwpk aWZmIC0tZ2l0IGEvaW5pdC9LY29uZmlnIGIvaW5pdC9LY29uZmlnCmluZGV4IDVmNWM3NzZlZjE5 Mi4uNWJhYmVhMzhlMzQ2IDEwMDY0NAotLS0gYS9pbml0L0tjb25maWcKKysrIGIvaW5pdC9LY29u ZmlnCkBAIC0yMjk2LDcgKzIyOTYsNyBAQCBlbmRpZiAjIE1PRFVMRVMKIAogY29uZmlnIE1PRFVM RVNfVFJFRV9MT09LVVAKIAlkZWZfYm9vbCB5Ci0JZGVwZW5kcyBvbiBQRVJGX0VWRU5UUyB8fCBU UkFDSU5HCisJZGVwZW5kcyBvbiBQRVJGX0VWRU5UUyB8fCBUUkFDSU5HIHx8IENGSV9DTEFORwog CiBjb25maWcgSU5JVF9BTExfUE9TU0lCTEUKIAlib29sCmRpZmYgLS1naXQgYS9rZXJuZWwvTWFr ZWZpbGUgYi9rZXJuZWwvTWFrZWZpbGUKaW5kZXggMzIwZjFmMzk0MWI3Li5lOGE2NzE1ZjM4ZGMg MTAwNjQ0Ci0tLSBhL2tlcm5lbC9NYWtlZmlsZQorKysgYi9rZXJuZWwvTWFrZWZpbGUKQEAgLTQx LDYgKzQxLDkgQEAgS0NTQU5fU0FOSVRJWkVfa2Nvdi5vIDo9IG4KIFVCU0FOX1NBTklUSVpFX2tj b3YubyA6PSBuCiBDRkxBR1Nfa2Nvdi5vIDo9ICQoY2FsbCBjYy1vcHRpb24sIC1mbm8tY29uc2Vy dmUtc3RhY2spIC1mbm8tc3RhY2stcHJvdGVjdG9yCiAKKyMgRG9uJ3QgaW5zdHJ1bWVudCBlcnJv ciBoYW5kbGVycworQ0ZMQUdTX1JFTU9WRV9jZmkubyA6PSAkKENDX0ZMQUdTX0NGSSkKKwogb2Jq LXkgKz0gc2NoZWQvCiBvYmoteSArPSBsb2NraW5nLwogb2JqLXkgKz0gcG93ZXIvCkBAIC0xMTEs NiArMTE0LDcgQEAgb2JqLSQoQ09ORklHX0JQRikgKz0gYnBmLwogb2JqLSQoQ09ORklHX0tDU0FO KSArPSBrY3Nhbi8KIG9iai0kKENPTkZJR19TSEFET1dfQ0FMTF9TVEFDSykgKz0gc2NzLm8KIG9i ai0kKENPTkZJR19IQVZFX1NUQVRJQ19DQUxMX0lOTElORSkgKz0gc3RhdGljX2NhbGwubworb2Jq LSQoQ09ORklHX0NGSV9DTEFORykgKz0gY2ZpLm8KIAogb2JqLSQoQ09ORklHX1BFUkZfRVZFTlRT KSArPSBldmVudHMvCiAKZGlmZiAtLWdpdCBhL2tlcm5lbC9jZmkuYyBiL2tlcm5lbC9jZmkuYwpu ZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAuLmUxN2E1NjYzOTc2NgotLS0g L2Rldi9udWxsCisrKyBiL2tlcm5lbC9jZmkuYwpAQCAtMCwwICsxLDMyOSBAQAorLy8gU1BEWC1M aWNlbnNlLUlkZW50aWZpZXI6IEdQTC0yLjAKKy8qCisgKiBDbGFuZyBDb250cm9sIEZsb3cgSW50 ZWdyaXR5IChDRkkpIGVycm9yIGFuZCBzbG93cGF0aCBoYW5kbGluZy4KKyAqCisgKiBDb3B5cmln aHQgKEMpIDIwMjEgR29vZ2xlIExMQworICovCisKKyNpbmNsdWRlIDxsaW51eC9oYXJkaXJxLmg+ CisjaW5jbHVkZSA8bGludXgva2FsbHN5bXMuaD4KKyNpbmNsdWRlIDxsaW51eC9tb2R1bGUuaD4K KyNpbmNsdWRlIDxsaW51eC9tdXRleC5oPgorI2luY2x1ZGUgPGxpbnV4L3ByaW50ay5oPgorI2lu Y2x1ZGUgPGxpbnV4L3JhdGVsaW1pdC5oPgorI2luY2x1ZGUgPGxpbnV4L3JjdXBkYXRlLmg+Cisj aW5jbHVkZSA8bGludXgvdm1hbGxvYy5oPgorI2luY2x1ZGUgPGFzbS9jYWNoZWZsdXNoLmg+Cisj aW5jbHVkZSA8YXNtL3NldF9tZW1vcnkuaD4KKworLyogQ29tcGlsZXItZGVmaW5lZCBoYW5kbGVy IG5hbWVzICovCisjaWZkZWYgQ09ORklHX0NGSV9QRVJNSVNTSVZFCisjZGVmaW5lIGNmaV9mYWls dXJlX2hhbmRsZXIJX191YnNhbl9oYW5kbGVfY2ZpX2NoZWNrX2ZhaWwKKyNlbHNlCisjZGVmaW5l IGNmaV9mYWlsdXJlX2hhbmRsZXIJX191YnNhbl9oYW5kbGVfY2ZpX2NoZWNrX2ZhaWxfYWJvcnQK KyNlbmRpZgorCitzdGF0aWMgaW5saW5lIHZvaWQgaGFuZGxlX2NmaV9mYWlsdXJlKHZvaWQgKnB0 cikKK3sKKwlpZiAoSVNfRU5BQkxFRChDT05GSUdfQ0ZJX1BFUk1JU1NJVkUpKQorCQlXQVJOX1JB VEVMSU1JVCgxLCAiQ0ZJIGZhaWx1cmUgKHRhcmdldDogJXBTKTpcbiIsIHB0cik7CisJZWxzZQor CQlwYW5pYygiQ0ZJIGZhaWx1cmUgKHRhcmdldDogJXBTKVxuIiwgcHRyKTsKK30KKworI2lmZGVm IENPTkZJR19NT0RVTEVTCisjaWZkZWYgQ09ORklHX0NGSV9DTEFOR19TSEFET1cKKy8qCisgKiBJ bmRleCB0eXBlLiBBIDE2LWJpdCBpbmRleCBjYW4gYWRkcmVzcyBhdCBtb3N0ICgyXjE2KS0yIHBh Z2VzICh0YWtpbmcKKyAqIGludG8gYWNjb3VudCBTSEFET1dfSU5WQUxJRCksIGkuZS4gfjI1Nk0g d2l0aCA0ayBwYWdlcy4KKyAqLwordHlwZWRlZiB1MTYgc2hhZG93X3Q7CisjZGVmaW5lIFNIQURP V19JTlZBTElECQkoKHNoYWRvd190KX4wVUwpCisKK3N0cnVjdCBjZmlfc2hhZG93IHsKKwkvKiBQ YWdlIGluZGV4IGZvciB0aGUgYmVnaW5uaW5nIG9mIHRoZSBzaGFkb3cgKi8KKwl1bnNpZ25lZCBs b25nIGJhc2U7CisJLyogQW4gYXJyYXkgb2YgX19jZmlfY2hlY2sgbG9jYXRpb25zIChhcyBpbmRp Y2VzIHRvIHRoZSBzaGFkb3cpICovCisJc2hhZG93X3Qgc2hhZG93WzFdOworfSBfX3BhY2tlZDsK KworLyoKKyAqIFRoZSBzaGFkb3cgY292ZXJzIH4xMjhNIGZyb20gdGhlIGJlZ2lubmluZyBvZiB0 aGUgbW9kdWxlIHJlZ2lvbi4gSWYKKyAqIHRoZSByZWdpb24gaXMgbGFyZ2VyLCB3ZSBmYWxsIGJh Y2sgdG8gX19tb2R1bGVfYWRkcmVzcyBmb3IgdGhlIHJlc3QuCisgKi8KKyNkZWZpbmUgX19TSEFE T1dfUkFOR0UJCShfVUwoU1pfMTI4TSkgPj4gUEFHRV9TSElGVCkKKworLyogVGhlIGluLW1lbW9y eSBzaXplIG9mIHN0cnVjdCBjZmlfc2hhZG93LCBhbHdheXMgYXQgbGVhc3Qgb25lIHBhZ2UgKi8K KyNkZWZpbmUgX19TSEFET1dfUEFHRVMJCSgoX19TSEFET1dfUkFOR0UgKiBzaXplb2Yoc2hhZG93 X3QpKSA+PiBQQUdFX1NISUZUKQorI2RlZmluZSBTSEFET1dfUEFHRVMJCW1heCgxVUwsIF9fU0hB RE9XX1BBR0VTKQorI2RlZmluZSBTSEFET1dfU0laRQkJKFNIQURPV19QQUdFUyA8PCBQQUdFX1NI SUZUKQorCisvKiBUaGUgYWN0dWFsIHNpemUgb2YgdGhlIHNoYWRvdyBhcnJheSwgbWludXMgbWV0 YWRhdGEgKi8KKyNkZWZpbmUgU0hBRE9XX0FSUl9TSVpFCQkoU0hBRE9XX1NJWkUgLSBvZmZzZXRv ZihzdHJ1Y3QgY2ZpX3NoYWRvdywgc2hhZG93KSkKKyNkZWZpbmUgU0hBRE9XX0FSUl9TTE9UUwko U0hBRE9XX0FSUl9TSVpFIC8gc2l6ZW9mKHNoYWRvd190KSkKKworc3RhdGljIERFRklORV9NVVRF WChzaGFkb3dfdXBkYXRlX2xvY2spOworc3RhdGljIHN0cnVjdCBjZmlfc2hhZG93IF9fcmN1ICpj Zmlfc2hhZG93IF9fcmVhZF9tb3N0bHk7CisKKy8qIFJldHVybnMgdGhlIGluZGV4IGluIHRoZSBz aGFkb3cgZm9yIHRoZSBnaXZlbiBhZGRyZXNzICovCitzdGF0aWMgaW5saW5lIGludCBwdHJfdG9f c2hhZG93KGNvbnN0IHN0cnVjdCBjZmlfc2hhZG93ICpzLCB1bnNpZ25lZCBsb25nIHB0cikKK3sK Kwl1bnNpZ25lZCBsb25nIGluZGV4OworCXVuc2lnbmVkIGxvbmcgcGFnZSA9IHB0ciA+PiBQQUdF X1NISUZUOworCisJaWYgKHVubGlrZWx5KHBhZ2UgPCBzLT5iYXNlKSkKKwkJcmV0dXJuIC0xOyAv KiBPdXRzaWRlIG9mIG1vZHVsZSBhcmVhICovCisKKwlpbmRleCA9IHBhZ2UgLSBzLT5iYXNlOwor CisJaWYgKGluZGV4ID49IFNIQURPV19BUlJfU0xPVFMpCisJCXJldHVybiAtMTsgLyogQ2Fubm90 IGJlIGFkZHJlc3NlZCB3aXRoIHNoYWRvdyAqLworCisJcmV0dXJuIChpbnQpaW5kZXg7Cit9CisK Ky8qIFJldHVybnMgdGhlIHBhZ2UgYWRkcmVzcyBmb3IgYW4gaW5kZXggaW4gdGhlIHNoYWRvdyAq Lworc3RhdGljIGlubGluZSB1bnNpZ25lZCBsb25nIHNoYWRvd190b19wdHIoY29uc3Qgc3RydWN0 IGNmaV9zaGFkb3cgKnMsCisJaW50IGluZGV4KQoreworCWlmICh1bmxpa2VseShpbmRleCA8IDAg fHwgaW5kZXggPj0gU0hBRE9XX0FSUl9TTE9UUykpCisJCXJldHVybiAwOworCisJcmV0dXJuIChz LT5iYXNlICsgaW5kZXgpIDw8IFBBR0VfU0hJRlQ7Cit9CisKKy8qIFJldHVybnMgdGhlIF9fY2Zp X2NoZWNrIGZ1bmN0aW9uIGFkZHJlc3MgZm9yIHRoZSBnaXZlbiBzaGFkb3cgbG9jYXRpb24gKi8K K3N0YXRpYyBpbmxpbmUgdW5zaWduZWQgbG9uZyBzaGFkb3dfdG9fY2hlY2tfZm4oY29uc3Qgc3Ry dWN0IGNmaV9zaGFkb3cgKnMsCisJaW50IGluZGV4KQoreworCWlmICh1bmxpa2VseShpbmRleCA8 IDAgfHwgaW5kZXggPj0gU0hBRE9XX0FSUl9TTE9UUykpCisJCXJldHVybiAwOworCisJaWYgKHVu bGlrZWx5KHMtPnNoYWRvd1tpbmRleF0gPT0gU0hBRE9XX0lOVkFMSUQpKQorCQlyZXR1cm4gMDsK KworCS8qIF9fY2ZpX2NoZWNrIGlzIGFsd2F5cyBwYWdlIGFsaWduZWQgKi8KKwlyZXR1cm4gKHMt PmJhc2UgKyBzLT5zaGFkb3dbaW5kZXhdKSA8PCBQQUdFX1NISUZUOworfQorCitzdGF0aWMgdm9p ZCBwcmVwYXJlX25leHRfc2hhZG93KGNvbnN0IHN0cnVjdCBjZmlfc2hhZG93IF9fcmN1ICpwcmV2 LAorCQlzdHJ1Y3QgY2ZpX3NoYWRvdyAqbmV4dCkKK3sKKwlpbnQgaSwgaW5kZXgsIGNoZWNrOwor CisJLyogTWFyayBldmVyeXRoaW5nIGludmFsaWQgKi8KKwltZW1zZXQobmV4dC0+c2hhZG93LCAw eEZGLCBTSEFET1dfQVJSX1NJWkUpOworCisJaWYgKCFwcmV2KQorCQlyZXR1cm47IC8qIE5vIHBy ZXZpb3VzIHNoYWRvdyAqLworCisJLyogSWYgdGhlIGJhc2UgYWRkcmVzcyBkaWRuJ3QgY2hhbmdl LCBhbiB1cGRhdGUgaXMgbm90IG5lZWRlZCAqLworCWlmIChwcmV2LT5iYXNlID09IG5leHQtPmJh c2UpIHsKKwkJbWVtY3B5KG5leHQtPnNoYWRvdywgcHJldi0+c2hhZG93LCBTSEFET1dfQVJSX1NJ WkUpOworCQlyZXR1cm47CisJfQorCisJLyogQ29udmVydCB0aGUgcHJldmlvdXMgc2hhZG93IHRv IHRoZSBuZXcgYWRkcmVzcyByYW5nZSAqLworCWZvciAoaSA9IDA7IGkgPCBTSEFET1dfQVJSX1NM T1RTOyArK2kpIHsKKwkJaWYgKHByZXYtPnNoYWRvd1tpXSA9PSBTSEFET1dfSU5WQUxJRCkKKwkJ CWNvbnRpbnVlOworCisJCWluZGV4ID0gcHRyX3RvX3NoYWRvdyhuZXh0LCBzaGFkb3dfdG9fcHRy KHByZXYsIGkpKTsKKwkJaWYgKGluZGV4IDwgMCkKKwkJCWNvbnRpbnVlOworCisJCWNoZWNrID0g cHRyX3RvX3NoYWRvdyhuZXh0LAorCQkJCXNoYWRvd190b19jaGVja19mbihwcmV2LCBwcmV2LT5z aGFkb3dbaV0pKTsKKwkJaWYgKGNoZWNrIDwgMCkKKwkJCWNvbnRpbnVlOworCisJCW5leHQtPnNo YWRvd1tpbmRleF0gPSAoc2hhZG93X3QpY2hlY2s7CisJfQorfQorCitzdGF0aWMgdm9pZCBhZGRf bW9kdWxlX3RvX3NoYWRvdyhzdHJ1Y3QgY2ZpX3NoYWRvdyAqcywgc3RydWN0IG1vZHVsZSAqbW9k LAorCQkJdW5zaWduZWQgbG9uZyBtaW5fYWRkciwgdW5zaWduZWQgbG9uZyBtYXhfYWRkcikKK3sK KwlpbnQgY2hlY2tfaW5kZXg7CisJdW5zaWduZWQgbG9uZyBjaGVjayA9ICh1bnNpZ25lZCBsb25n KW1vZC0+Y2ZpX2NoZWNrOworCXVuc2lnbmVkIGxvbmcgcHRyOworCisJaWYgKHVubGlrZWx5KCFQ QUdFX0FMSUdORUQoY2hlY2spKSkgeworCQlwcl93YXJuKCJjZmk6IG5vdCB1c2luZyBzaGFkb3cg Zm9yIG1vZHVsZSAlc1xuIiwgbW9kLT5uYW1lKTsKKwkJcmV0dXJuOworCX0KKworCWNoZWNrX2lu ZGV4ID0gcHRyX3RvX3NoYWRvdyhzLCBjaGVjayk7CisJaWYgKGNoZWNrX2luZGV4IDwgMCkKKwkJ cmV0dXJuOyAvKiBNb2R1bGUgbm90IGFkZHJlc3NhYmxlIHdpdGggc2hhZG93ICovCisKKwkvKiBG b3IgZWFjaCBwYWdlLCBzdG9yZSB0aGUgY2hlY2sgZnVuY3Rpb24gaW5kZXggaW4gdGhlIHNoYWRv dyAqLworCWZvciAocHRyID0gbWluX2FkZHI7IHB0ciA8PSBtYXhfYWRkcjsgcHRyICs9IFBBR0Vf U0laRSkgeworCQlpbnQgaW5kZXggPSBwdHJfdG9fc2hhZG93KHMsIHB0cik7CisKKwkJaWYgKGlu ZGV4ID49IDApIHsKKwkJCS8qIEVhY2ggcGFnZSBtdXN0IG9ubHkgY29udGFpbiBvbmUgbW9kdWxl ICovCisJCQlXQVJOX09OX09OQ0Uocy0+c2hhZG93W2luZGV4XSAhPSBTSEFET1dfSU5WQUxJRCk7 CisJCQlzLT5zaGFkb3dbaW5kZXhdID0gKHNoYWRvd190KWNoZWNrX2luZGV4OworCQl9CisJfQor fQorCitzdGF0aWMgdm9pZCByZW1vdmVfbW9kdWxlX2Zyb21fc2hhZG93KHN0cnVjdCBjZmlfc2hh ZG93ICpzLCBzdHJ1Y3QgbW9kdWxlICptb2QsCisJCXVuc2lnbmVkIGxvbmcgbWluX2FkZHIsIHVu c2lnbmVkIGxvbmcgbWF4X2FkZHIpCit7CisJdW5zaWduZWQgbG9uZyBwdHI7CisKKwlmb3IgKHB0 ciA9IG1pbl9hZGRyOyBwdHIgPD0gbWF4X2FkZHI7IHB0ciArPSBQQUdFX1NJWkUpIHsKKwkJaW50 IGluZGV4ID0gcHRyX3RvX3NoYWRvdyhzLCBwdHIpOworCisJCWlmIChpbmRleCA+PSAwKQorCQkJ cy0+c2hhZG93W2luZGV4XSA9IFNIQURPV19JTlZBTElEOworCX0KK30KKwordHlwZWRlZiB2b2lk ICgqdXBkYXRlX3NoYWRvd19mbikoc3RydWN0IGNmaV9zaGFkb3cgKiwgc3RydWN0IG1vZHVsZSAq LAorCQkJdW5zaWduZWQgbG9uZyBtaW5fYWRkciwgdW5zaWduZWQgbG9uZyBtYXhfYWRkcik7CisK K3N0YXRpYyB2b2lkIHVwZGF0ZV9zaGFkb3coc3RydWN0IG1vZHVsZSAqbW9kLCB1bnNpZ25lZCBs b25nIGJhc2VfYWRkciwKKwkJdXBkYXRlX3NoYWRvd19mbiBmbikKK3sKKwlzdHJ1Y3QgY2ZpX3No YWRvdyAqcHJldjsKKwlzdHJ1Y3QgY2ZpX3NoYWRvdyAqbmV4dDsKKwl1bnNpZ25lZCBsb25nIG1p bl9hZGRyLCBtYXhfYWRkcjsKKworCW5leHQgPSB2bWFsbG9jKFNIQURPV19TSVpFKTsKKworCW11 dGV4X2xvY2soJnNoYWRvd191cGRhdGVfbG9jayk7CisJcHJldiA9IHJjdV9kZXJlZmVyZW5jZV9w cm90ZWN0ZWQoY2ZpX3NoYWRvdywKKwkJCQkJIG11dGV4X2lzX2xvY2tlZCgmc2hhZG93X3VwZGF0 ZV9sb2NrKSk7CisKKwlpZiAobmV4dCkgeworCQluZXh0LT5iYXNlID0gYmFzZV9hZGRyID4+IFBB R0VfU0hJRlQ7CisJCXByZXBhcmVfbmV4dF9zaGFkb3cocHJldiwgbmV4dCk7CisKKwkJbWluX2Fk ZHIgPSAodW5zaWduZWQgbG9uZyltb2QtPmNvcmVfbGF5b3V0LmJhc2U7CisJCW1heF9hZGRyID0g bWluX2FkZHIgKyBtb2QtPmNvcmVfbGF5b3V0LnRleHRfc2l6ZTsKKwkJZm4obmV4dCwgbW9kLCBt aW5fYWRkciAmIFBBR0VfTUFTSywgbWF4X2FkZHIgJiBQQUdFX01BU0spOworCisJCXNldF9tZW1v cnlfcm8oKHVuc2lnbmVkIGxvbmcpbmV4dCwgU0hBRE9XX1BBR0VTKTsKKwl9CisKKwlyY3VfYXNz aWduX3BvaW50ZXIoY2ZpX3NoYWRvdywgbmV4dCk7CisJbXV0ZXhfdW5sb2NrKCZzaGFkb3dfdXBk YXRlX2xvY2spOworCXN5bmNocm9uaXplX3JjdSgpOworCisJaWYgKHByZXYpIHsKKwkJc2V0X21l bW9yeV9ydygodW5zaWduZWQgbG9uZylwcmV2LCBTSEFET1dfUEFHRVMpOworCQl2ZnJlZShwcmV2 KTsKKwl9Cit9CisKK3ZvaWQgY2ZpX21vZHVsZV9hZGQoc3RydWN0IG1vZHVsZSAqbW9kLCB1bnNp Z25lZCBsb25nIGJhc2VfYWRkcikKK3sKKwl1cGRhdGVfc2hhZG93KG1vZCwgYmFzZV9hZGRyLCBh ZGRfbW9kdWxlX3RvX3NoYWRvdyk7Cit9CisKK3ZvaWQgY2ZpX21vZHVsZV9yZW1vdmUoc3RydWN0 IG1vZHVsZSAqbW9kLCB1bnNpZ25lZCBsb25nIGJhc2VfYWRkcikKK3sKKwl1cGRhdGVfc2hhZG93 KG1vZCwgYmFzZV9hZGRyLCByZW1vdmVfbW9kdWxlX2Zyb21fc2hhZG93KTsKK30KKworc3RhdGlj IGlubGluZSBjZmlfY2hlY2tfZm4gcHRyX3RvX2NoZWNrX2ZuKGNvbnN0IHN0cnVjdCBjZmlfc2hh ZG93IF9fcmN1ICpzLAorCXVuc2lnbmVkIGxvbmcgcHRyKQoreworCWludCBpbmRleDsKKworCWlm ICh1bmxpa2VseSghcykpCisJCXJldHVybiBOVUxMOyAvKiBObyBzaGFkb3cgYXZhaWxhYmxlICov CisKKwlpbmRleCA9IHB0cl90b19zaGFkb3cocywgcHRyKTsKKwlpZiAoaW5kZXggPCAwKQorCQly ZXR1cm4gTlVMTDsgLyogQ2Fubm90IGJlIGFkZHJlc3NlZCB3aXRoIHNoYWRvdyAqLworCisJcmV0 dXJuIChjZmlfY2hlY2tfZm4pc2hhZG93X3RvX2NoZWNrX2ZuKHMsIGluZGV4KTsKK30KKworc3Rh dGljIGlubGluZSBjZmlfY2hlY2tfZm4gZmluZF9zaGFkb3dfY2hlY2tfZm4odW5zaWduZWQgbG9u ZyBwdHIpCit7CisJY2ZpX2NoZWNrX2ZuIGZuOworCisJcmN1X3JlYWRfbG9ja19zY2hlZCgpOwor CWZuID0gcHRyX3RvX2NoZWNrX2ZuKHJjdV9kZXJlZmVyZW5jZV9zY2hlZChjZmlfc2hhZG93KSwg cHRyKTsKKwlyY3VfcmVhZF91bmxvY2tfc2NoZWQoKTsKKworCXJldHVybiBmbjsKK30KKworI2Vs c2UgLyogIUNPTkZJR19DRklfQ0xBTkdfU0hBRE9XICovCisKK3N0YXRpYyBpbmxpbmUgY2ZpX2No ZWNrX2ZuIGZpbmRfc2hhZG93X2NoZWNrX2ZuKHVuc2lnbmVkIGxvbmcgcHRyKQoreworCXJldHVy biBOVUxMOworfQorCisjZW5kaWYgLyogQ09ORklHX0NGSV9DTEFOR19TSEFET1cgKi8KKworc3Rh dGljIGlubGluZSBjZmlfY2hlY2tfZm4gZmluZF9tb2R1bGVfY2hlY2tfZm4odW5zaWduZWQgbG9u ZyBwdHIpCit7CisJY2ZpX2NoZWNrX2ZuIGZuID0gTlVMTDsKKwlzdHJ1Y3QgbW9kdWxlICptb2Q7 CisKKwlyY3VfcmVhZF9sb2NrX3NjaGVkKCk7CisJbW9kID0gX19tb2R1bGVfYWRkcmVzcyhwdHIp OworCWlmIChtb2QpCisJCWZuID0gbW9kLT5jZmlfY2hlY2s7CisJcmN1X3JlYWRfdW5sb2NrX3Nj aGVkKCk7CisKKwlyZXR1cm4gZm47Cit9CisKK3N0YXRpYyBpbmxpbmUgY2ZpX2NoZWNrX2ZuIGZp bmRfY2hlY2tfZm4odW5zaWduZWQgbG9uZyBwdHIpCit7CisJY2ZpX2NoZWNrX2ZuIGZuID0gTlVM TDsKKworCWlmIChpc19rZXJuZWxfdGV4dChwdHIpKQorCQlyZXR1cm4gX19jZmlfY2hlY2s7CisK KwkvKgorCSAqIEluZGlyZWN0IGNhbGwgY2hlY2tzIGNhbiBoYXBwZW4gd2hlbiBSQ1UgaXMgbm90 IHdhdGNoaW5nLiBCb3RoCisJICogdGhlIHNoYWRvdyBhbmQgX19tb2R1bGVfYWRkcmVzcyB1c2Ug UkNVLCBzbyB3ZSBuZWVkIHRvIHdha2UgaXQKKwkgKiB1cCBpZiBuZWNlc3NhcnkuCisJICovCisJ UkNVX05PTklETEUoeworCQlpZiAoSVNfRU5BQkxFRChDT05GSUdfQ0ZJX0NMQU5HX1NIQURPVykp CisJCQlmbiA9IGZpbmRfc2hhZG93X2NoZWNrX2ZuKHB0cik7CisKKwkJaWYgKCFmbikKKwkJCWZu ID0gZmluZF9tb2R1bGVfY2hlY2tfZm4ocHRyKTsKKwl9KTsKKworCXJldHVybiBmbjsKK30KKwor dm9pZCBfX2NmaV9zbG93cGF0aF9kaWFnKHVpbnQ2NF90IGlkLCB2b2lkICpwdHIsIHZvaWQgKmRp YWcpCit7CisJY2ZpX2NoZWNrX2ZuIGZuID0gZmluZF9jaGVja19mbigodW5zaWduZWQgbG9uZylw dHIpOworCisJaWYgKGxpa2VseShmbikpCisJCWZuKGlkLCBwdHIsIGRpYWcpOworCWVsc2UgLyog RG9uJ3QgYWxsb3cgdW5jaGVja2VkIG1vZHVsZXMgKi8KKwkJaGFuZGxlX2NmaV9mYWlsdXJlKHB0 cik7Cit9CitFWFBPUlRfU1lNQk9MKF9fY2ZpX3Nsb3dwYXRoX2RpYWcpOworCisjZWxzZSAvKiAh Q09ORklHX01PRFVMRVMgKi8KKwordm9pZCBfX2NmaV9zbG93cGF0aF9kaWFnKHVpbnQ2NF90IGlk LCB2b2lkICpwdHIsIHZvaWQgKmRpYWcpCit7CisJaGFuZGxlX2NmaV9mYWlsdXJlKHB0cik7IC8q IE5vIG1vZHVsZXMgKi8KK30KK0VYUE9SVF9TWU1CT0woX19jZmlfc2xvd3BhdGhfZGlhZyk7CisK KyNlbmRpZiAvKiBDT05GSUdfTU9EVUxFUyAqLworCit2b2lkIGNmaV9mYWlsdXJlX2hhbmRsZXIo dm9pZCAqZGF0YSwgdm9pZCAqcHRyLCB2b2lkICp2dGFibGUpCit7CisJaGFuZGxlX2NmaV9mYWls dXJlKHB0cik7Cit9CitFWFBPUlRfU1lNQk9MKGNmaV9mYWlsdXJlX2hhbmRsZXIpOwpkaWZmIC0t Z2l0IGEva2VybmVsL21vZHVsZS5jIGIva2VybmVsL21vZHVsZS5jCmluZGV4IDMwNDc5MzU1YWI4 NS4uMjBmYjAwNGU3ZDhkIDEwMDY0NAotLS0gYS9rZXJuZWwvbW9kdWxlLmMKKysrIGIva2VybmVs L21vZHVsZS5jCkBAIC0yMTQ2LDYgKzIxNDYsOCBAQCB2b2lkIF9fd2VhayBtb2R1bGVfYXJjaF9m cmVlaW5nX2luaXQoc3RydWN0IG1vZHVsZSAqbW9kKQogewogfQogCitzdGF0aWMgdm9pZCBjZmlf Y2xlYW51cChzdHJ1Y3QgbW9kdWxlICptb2QpOworCiAvKiBGcmVlIGEgbW9kdWxlLCByZW1vdmUg ZnJvbSBsaXN0cywgZXRjLiAqLwogc3RhdGljIHZvaWQgZnJlZV9tb2R1bGUoc3RydWN0IG1vZHVs ZSAqbW9kKQogewpAQCAtMjE4Nyw2ICsyMTg5LDkgQEAgc3RhdGljIHZvaWQgZnJlZV9tb2R1bGUo c3RydWN0IG1vZHVsZSAqbW9kKQogCXN5bmNocm9uaXplX3JjdSgpOwogCW11dGV4X3VubG9jaygm bW9kdWxlX211dGV4KTsKIAorCS8qIENsZWFuIHVwIENGSSBmb3IgdGhlIG1vZHVsZS4gKi8KKwlj ZmlfY2xlYW51cChtb2QpOworCiAJLyogVGhpcyBtYXkgYmUgZW1wdHksIGJ1dCB0aGF0J3MgT0sg Ki8KIAltb2R1bGVfYXJjaF9mcmVlaW5nX2luaXQobW9kKTsKIAltb2R1bGVfbWVtZnJlZShtb2Qt PmluaXRfbGF5b3V0LmJhc2UpOwpAQCAtMzg2Niw2ICszODcxLDggQEAgc3RhdGljIGludCB1bmtu b3duX21vZHVsZV9wYXJhbV9jYihjaGFyICpwYXJhbSwgY2hhciAqdmFsLCBjb25zdCBjaGFyICpt b2RuYW1lLAogCXJldHVybiAwOwogfQogCitzdGF0aWMgdm9pZCBjZmlfaW5pdChzdHJ1Y3QgbW9k dWxlICptb2QpOworCiAvKgogICogQWxsb2NhdGUgYW5kIGxvYWQgdGhlIG1vZHVsZTogbm90ZSB0 aGF0IHNpemUgb2Ygc2VjdGlvbiAwIGlzIGFsd2F5cwogICogemVybywgYW5kIHdlIHJlbHkgb24g dGhpcyBmb3Igb3B0aW9uYWwgc2VjdGlvbnMuCkBAIC0zOTk3LDYgKzQwMDQsOSBAQCBzdGF0aWMg aW50IGxvYWRfbW9kdWxlKHN0cnVjdCBsb2FkX2luZm8gKmluZm8sIGNvbnN0IGNoYXIgX191c2Vy ICp1YXJncywKIAogCWZsdXNoX21vZHVsZV9pY2FjaGUobW9kKTsKIAorCS8qIFNldHVwIENGSSBm b3IgdGhlIG1vZHVsZS4gKi8KKwljZmlfaW5pdChtb2QpOworCiAJLyogTm93IGNvcHkgaW4gYXJn cyAqLwogCW1vZC0+YXJncyA9IHN0cm5kdXBfdXNlcih1YXJncywgfjBVTCA+PiAxKTsKIAlpZiAo SVNfRVJSKG1vZC0+YXJncykpIHsKQEAgLTQwNzAsNiArNDA4MCw3IEBAIHN0YXRpYyBpbnQgbG9h ZF9tb2R1bGUoc3RydWN0IGxvYWRfaW5mbyAqaW5mbywgY29uc3QgY2hhciBfX3VzZXIgKnVhcmdz LAogCXN5bmNocm9uaXplX3JjdSgpOwogCWtmcmVlKG1vZC0+YXJncyk7CiAgZnJlZV9hcmNoX2Ns ZWFudXA6CisJY2ZpX2NsZWFudXAobW9kKTsKIAltb2R1bGVfYXJjaF9jbGVhbnVwKG1vZCk7CiAg ZnJlZV9tb2RpbmZvOgogCWZyZWVfbW9kaW5mbyhtb2QpOwpAQCAtNDQxNSw2ICs0NDI2LDM4IEBA IGludCBtb2R1bGVfa2FsbHN5bXNfb25fZWFjaF9zeW1ib2woaW50ICgqZm4pKHZvaWQgKiwgY29u c3QgY2hhciAqLAogI2VuZGlmIC8qIENPTkZJR19MSVZFUEFUQ0ggKi8KICNlbmRpZiAvKiBDT05G SUdfS0FMTFNZTVMgKi8KIAorc3RhdGljIHZvaWQgY2ZpX2luaXQoc3RydWN0IG1vZHVsZSAqbW9k KQoreworI2lmZGVmIENPTkZJR19DRklfQ0xBTkcKKwlpbml0Y2FsbF90ICppbml0OworCWV4aXRj YWxsX3QgKmV4aXQ7CisKKwlyY3VfcmVhZF9sb2NrX3NjaGVkKCk7CisJbW9kLT5jZmlfY2hlY2sg PSAoY2ZpX2NoZWNrX2ZuKQorCQlmaW5kX2thbGxzeW1zX3N5bWJvbF92YWx1ZShtb2QsICJfX2Nm aV9jaGVjayIpOworCWluaXQgPSAoaW5pdGNhbGxfdCAqKQorCQlmaW5kX2thbGxzeW1zX3N5bWJv bF92YWx1ZShtb2QsICJfX2NmaV9qdF9pbml0X21vZHVsZSIpOworCWV4aXQgPSAoZXhpdGNhbGxf dCAqKQorCQlmaW5kX2thbGxzeW1zX3N5bWJvbF92YWx1ZShtb2QsICJfX2NmaV9qdF9jbGVhbnVw X21vZHVsZSIpOworCXJjdV9yZWFkX3VubG9ja19zY2hlZCgpOworCisJLyogRml4IGluaXQvZXhp dCBmdW5jdGlvbnMgdG8gcG9pbnQgdG8gdGhlIENGSSBqdW1wIHRhYmxlICovCisJaWYgKGluaXQp CisJCW1vZC0+aW5pdCA9ICppbml0OworCWlmIChleGl0KQorCQltb2QtPmV4aXQgPSAqZXhpdDsK KworCWNmaV9tb2R1bGVfYWRkKG1vZCwgbW9kdWxlX2FkZHJfbWluKTsKKyNlbmRpZgorfQorCitz dGF0aWMgdm9pZCBjZmlfY2xlYW51cChzdHJ1Y3QgbW9kdWxlICptb2QpCit7CisjaWZkZWYgQ09O RklHX0NGSV9DTEFORworCWNmaV9tb2R1bGVfcmVtb3ZlKG1vZCwgbW9kdWxlX2FkZHJfbWluKTsK KyNlbmRpZgorfQorCiAvKiBNYXhpbXVtIG51bWJlciBvZiBjaGFyYWN0ZXJzIHdyaXR0ZW4gYnkg bW9kdWxlX2ZsYWdzKCkgKi8KICNkZWZpbmUgTU9EVUxFX0ZMQUdTX0JVRl9TSVpFIChUQUlOVF9G TEFHU19DT1VOVCArIDQpCiAKZGlmZiAtLWdpdCBhL3NjcmlwdHMvTWFrZWZpbGUubW9kZmluYWwg Yi9zY3JpcHRzL01ha2VmaWxlLm1vZGZpbmFsCmluZGV4IDczNWUxMWU5MDQxYi4uZGQ4N2NlYTlm YmE3IDEwMDY0NAotLS0gYS9zY3JpcHRzL01ha2VmaWxlLm1vZGZpbmFsCisrKyBiL3NjcmlwdHMv TWFrZWZpbGUubW9kZmluYWwKQEAgLTIzLDcgKzIzLDcgQEAgbW9kbmFtZSA9ICQobm90ZGlyICQo QDoubW9kLm89KSkKIHBhcnQtb2YtbW9kdWxlID0geQogCiBxdWlldF9jbWRfY2Nfb19jID0gQ0Mg W01dICAkQAotICAgICAgY21kX2NjX29fYyA9ICQoQ0MpICQoY19mbGFncykgLWMgLW8gJEAgJDwK KyAgICAgIGNtZF9jY19vX2MgPSAkKENDKSAkKGZpbHRlci1vdXQgJChDQ19GTEFHU19DRkkpLCAk KGNfZmxhZ3MpKSAtYyAtbyAkQCAkPAogCiAlLm1vZC5vOiAlLm1vZC5jIEZPUkNFCiAJJChjYWxs IGlmX2NoYW5nZWRfZGVwLGNjX29fYykKLS0gCjIuMzEuMC4yOTEuZzU3NmJhOWRjZGFmLWdvb2cK CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpsaW51eC1h cm0ta2VybmVsIG1haWxpbmcgbGlzdApsaW51eC1hcm0ta2VybmVsQGxpc3RzLmluZnJhZGVhZC5v cmcKaHR0cDovL2xpc3RzLmluZnJhZGVhZC5vcmcvbWFpbG1hbi9saXN0aW5mby9saW51eC1hcm0t a2VybmVsCg==