From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4F408C433EF for ; Fri, 10 Jun 2022 23:35:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349148AbiFJXfS (ORCPT ); Fri, 10 Jun 2022 19:35:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55250 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348567AbiFJXfS (ORCPT ); Fri, 10 Jun 2022 19:35:18 -0400 Received: from mail-pg1-x549.google.com (mail-pg1-x549.google.com [IPv6:2607:f8b0:4864:20::549]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 765E0289A1D for ; Fri, 10 Jun 2022 16:35:16 -0700 (PDT) Received: by mail-pg1-x549.google.com with SMTP id e18-20020a656492000000b003fa4033f9a7so203687pgv.17 for ; Fri, 10 Jun 2022 16:35:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:message-id:mime-version:subject:from:to:cc :content-transfer-encoding; bh=nsMGvakN23jGJwKQKSNiBedpAQCT/+oZZ53FMvpJmWE=; b=TTSPz9mn3fOB4ve10WTtYfvod1PAt6nWdPvsN17q7/4saeuWmeuexh9VhPgCkS5pDb f5gRy75iYIFhLPMAvisX1Oqd4oD8ZWNaqLTaxxxPtUAHP8Y0ecEOORdAZIU2C/Y/DKOm nyoXugVxssag43IvWS8/pjSe0TCnIP72aYUgpBBAxda48sML5/s4c6m1tYfnik1HhNkH VCNyyM1VHrL4JWanm+XqpeJUg/llXdoZmHhdeF0TE0Y7+EFUsgLS/sGrzW/NxnDX1ad4 vAiGN0d/8G6ZXtGM385+MPY4pp9zuYsCQ2EiF1NaDKONdQ9rOlNd8RH6++XT6lt40Tdk OCeQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc :content-transfer-encoding; bh=nsMGvakN23jGJwKQKSNiBedpAQCT/+oZZ53FMvpJmWE=; b=kK3nJ6x/gT+fDoCxZQsNuQxbLeDcsPwUB5QsNg31177EoRxMN/szEY6RrhKrqmzOY3 ps6ZboZiIW42BMWdfXvZAyolYDzsO5afulidPj6OvGQiiJteB+XJrWwxqH3SvbC1gcsp r+fI1OtSAG267VAkHCA3iCPfLc4mNkLv/3LHicMi6AP0Qz0Huu9xGPGhxZYQHLHyt7bx pTxmbZ0mql8UHVGyJYDFfFONZqnhuhIl2tI2QNswY6wABbu4HS/H0lGRQ1RJsQJDhwxQ DvkSSnmF3Go/DXz0wmQg2Lg82DZV5zhNQ+ZAdgmNsg4B9CKY1ujO0vxpfjtUsefO3izk j+uQ== X-Gm-Message-State: AOAM5317K6HZiwkrywi27dtf4b0ZC3pEiT+/QCof6EhH13viJWN3CXjD vo+ZnG1T75+YY4UUIJ492gqF+X9jTcvQlCnr8AM= X-Google-Smtp-Source: ABdhPJzdLof87FxFUwL7nMS7yP1RwHTMWgXL9tW9h4xwKDJuVFdFP6l21cUGZW05T9FvcBnHeDH2g5GB+ZU+RT5MXgw= X-Received: from samitolvanen1.mtv.corp.google.com ([2620:15c:201:2:f464:6db6:3d47:ed14]) (user=samitolvanen job=sendgmr) by 2002:a17:90b:4b90:b0:1e8:48bd:453 with SMTP id lr16-20020a17090b4b9000b001e848bd0453mr2189527pjb.86.1654904115869; Fri, 10 Jun 2022 16:35:15 -0700 (PDT) Date: Fri, 10 Jun 2022 16:34:53 -0700 Message-Id: <20220610233513.1798771-1-samitolvanen@google.com> Mime-Version: 1.0 X-Developer-Key: i=samitolvanen@google.com; a=openpgp; fpr=35CCFB63B283D6D3AEB783944CB5F6848BBC56EE X-Developer-Signature: v=1; a=openpgp-sha256; l=7489; h=from:subject; bh=nEoLqXNa3ykt1eGfRs/jvdsV+FhVXUy4vtw8erotAL0=; b=owEB7QES/pANAwAKAUy19oSLvFbuAcsmYgBio9UswFKBhBOO2/9SIKqLIDgiaShLWcr9mJQQ6dfI Oi0DjR+JAbMEAAEKAB0WIQQ1zPtjsoPW0663g5RMtfaEi7xW7gUCYqPVLAAKCRBMtfaEi7xW7svkC/ 9n4xT5mUM0FuTK43AIeV3s0iJFI/It59JH+MTCiDiGXGDCEJGkCO0pK9lGCfDDES6dL4PY8iQKF8P1 BOif4X/nNa/ykC/ILkxWs7dG5G4iExpiA3Nw14d8c251mLZKGPU6rok5GF7k7H6mQqgv4EYYeJAUC8 st9LzJ9EhK3bufhrAiwwIXR9RUlZVx7z3nD6z2XAyd/SSilV/Yy4QzkGO4g0qUmR+z9mkSwuvm2jnN 4vDtRdvGzemSFp8Nj+6j3YCIQn3R+y8vX6Mrloje5lon5XoyAdVERBegFZMQo4NThZl1VPvBM+YjmW e9VbLTEFUMtIeF9BNXaelAZw6gwJEBTiEkz96IIkHIwrSpzCOBJP7dGNpE/clTwzd8x0O9YWDy3Gqg PuLh8K7ozjdJQ/y7qbtQO+Gx7dMEfOA+3GQ8o9OoKouYBVwnqdK3ohasSp2UX8/TkdMbNxl/xNgfNa VG+WTqSZsnFOEv2n68TsYgUcoLR74vqKYZOh9vrWUxlAI= X-Mailer: git-send-email 2.36.1.476.g0c4daa206d-goog Subject: [RFC PATCH v3 00/20] KCFI support From: Sami Tolvanen To: linux-kernel@vger.kernel.org Cc: Kees Cook , Josh Poimboeuf , Peter Zijlstra , x86@kernel.org, Catalin Marinas , Will Deacon , Mark Rutland , Nathan Chancellor , Nick Desaulniers , Joao Moreira , Sedat Dilek , Steven Rostedt , linux-hardening@vger.kernel.org, linux-arm-kernel@lists.infradead.org, llvm@lists.linux.dev, Sami Tolvanen Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org KCFI is a proposed forward-edge control-flow integrity scheme for Clang, which is more suitable for kernel use than the existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require LTO, doesn't alter function references to point to a jump table, and won't break function address equality. The latest LLVM patch is here: https://reviews.llvm.org/D119296 This RFC series replaces the current arm64 CFI implementation with KCFI and adds support for x86_64. KCFI requires assembly functions that are indirectly called from C code to be annotated with type identifiers. As type information is only available in C, the compiler emits expected type identifiers into the symbol table, so they can be referenced from assembly without having to hardcode type hashes. Patch 6 adds helper macros for annotating functions, and patches 8 and 18 add annotations. In case of a type mismatch, KCFI always traps. To support error handling, the compiler generates a .kcfi_traps section for x86_64, which contains the locations of each trap, and for arm64, encodes the necessary register information to the ESR. Patches 9 and 20 add arch-specific error handlers. To test this series, you'll need to compile your own Clang toolchain with the patches linked above. You can also find the complete source tree here: https://github.com/samitolvanen/llvm-project/commits/kcfi-rfc-v3 This series is also available in GitHub: https://github.com/samitolvanen/linux/commits/kcfi-rfc-v3 --- Changes in v3: - Merged the patches that split CC_FLAGS_CFI from CC_FLAGS_LTO. - Dropped the psci_initcall_t patch as Mark volunteered to send a patch for this. Note that this patch is still needed to boot a CFI kernel on certain arm64 systems: https://lore.kernel.org/lkml/YoNhKaTT3EDukxXY@FVFF77S0Q05N/ - Added a patch to remove the now unnecessary workarounds with CFI+ThinLTO in kallsyms. - Added an lkdtm patch to ensure the test actually generates an indirect call. - Changed report_cfi_failure to clearly indicate if we failed to decode target address. - Switched to relative offsets for .kcfi_traps. - On x86_64, moved CFI error handling from traps.c to cfi.c, and as we only call memcpy indirectly w/ CONFIG_MODULES, ensured that the compiler emits __kcfi_typeid_memcpy also without modules. - On x86_64, added a check for the cmpl REX prefix to handle the case where the compiler might not use r8-r15 registers for the call target. - On the compiler side, ensured that on x86_64 calls are emitted immediately after the CFI check, fixed the __cfi_ preamble linkage, and changed the compiler to emit relative offsets in .kcfi_traps. Changes in v2: - Changed the compiler patch to encode arm64 target and type details in the ESR, and updated the kernel error handling patch accordingly. - Changed the compiler patch to embed the x86_64 type hash in a valid instruction to avoid special casing objtool instruction decoding, and added a __cfi_ symbol for the preamble. Changed the kernel error handling and manual type annotations to match. - Dropped the .kcfi_types section as that=E2=80=99s no longer needed by objtool, and changed the objtool patch to simply ignore the __cfi_ preambles falling through. - Dropped the .kcfi_traps section on arm64 as it=E2=80=99s no longer needed= , and moved the trap look-up code behind CONFIG_ARCH_USES_CFI_TRAPS, which is selected only for x86_64. - Dropped __nocfi attributes from arm64 code where CFI was disabled due to address space confusion issues, and added type annotations to relevant assembly functions. - Dropped __nocfi from __init. Sami Tolvanen (20): treewide: Filter out CC_FLAGS_CFI scripts/kallsyms: Ignore __kcfi_typeid_ cfi: Remove CONFIG_CFI_CLANG_SHADOW cfi: Drop __CFI_ADDRESSABLE cfi: Switch to -fsanitize=3Dkcfi cfi: Add type helper macros lkdtm: Emit an indirect call for CFI tests arm64: Add types to indirect called assembly functions arm64: Add CFI error handling arm64: Drop unneeded __nocfi attributes init: Drop __nocfi from __init treewide: Drop function_nocfi treewide: Drop WARN_ON_FUNCTION_MISMATCH treewide: Drop __cficanonical objtool: Disable CFI warnings kallsyms: Drop CONFIG_CFI_CLANG workarounds x86/tools/relocs: Ignore __kcfi_typeid_ relocations x86: Add types to indirectly called assembly functions x86/purgatory: Disable CFI x86: Add support for CONFIG_CFI_CLANG Makefile | 13 +- arch/Kconfig | 18 +- arch/arm64/crypto/ghash-ce-core.S | 5 +- arch/arm64/crypto/sm3-ce-core.S | 3 +- arch/arm64/include/asm/brk-imm.h | 6 + arch/arm64/include/asm/ftrace.h | 2 +- arch/arm64/include/asm/mmu_context.h | 4 +- arch/arm64/kernel/acpi_parking_protocol.c | 2 +- arch/arm64/kernel/alternative.c | 2 +- arch/arm64/kernel/cpu-reset.S | 5 +- arch/arm64/kernel/cpufeature.c | 4 +- arch/arm64/kernel/ftrace.c | 2 +- arch/arm64/kernel/machine_kexec.c | 2 +- arch/arm64/kernel/psci.c | 2 +- arch/arm64/kernel/smp_spin_table.c | 2 +- arch/arm64/kernel/traps.c | 47 ++- arch/arm64/kernel/vdso/Makefile | 3 +- arch/arm64/mm/proc.S | 5 +- arch/x86/Kconfig | 2 + arch/x86/crypto/blowfish-x86_64-asm_64.S | 5 +- arch/x86/entry/vdso/Makefile | 3 +- arch/x86/include/asm/cfi.h | 22 ++ arch/x86/include/asm/linkage.h | 12 + arch/x86/kernel/Makefile | 2 + arch/x86/kernel/cfi.c | 83 ++++++ arch/x86/kernel/traps.c | 4 +- arch/x86/lib/memcpy_64.S | 3 +- arch/x86/purgatory/Makefile | 4 + arch/x86/tools/relocs.c | 1 + drivers/firmware/efi/libstub/Makefile | 2 + drivers/firmware/psci/psci.c | 4 +- drivers/misc/lkdtm/cfi.c | 15 +- drivers/misc/lkdtm/usercopy.c | 2 +- include/asm-generic/bug.h | 16 - include/asm-generic/vmlinux.lds.h | 37 +-- include/linux/cfi.h | 59 ++-- include/linux/cfi_types.h | 57 ++++ include/linux/compiler-clang.h | 14 +- include/linux/compiler.h | 16 +- include/linux/compiler_types.h | 4 - include/linux/init.h | 6 +- include/linux/module.h | 10 +- include/linux/pci.h | 4 +- kernel/cfi.c | 342 ++++------------------ kernel/kallsyms.c | 17 -- kernel/kthread.c | 3 +- kernel/module/main.c | 49 +--- kernel/workqueue.c | 2 +- scripts/kallsyms.c | 1 + scripts/module.lds.S | 23 +- tools/objtool/check.c | 7 +- 51 files changed, 420 insertions(+), 538 deletions(-) create mode 100644 arch/x86/include/asm/cfi.h create mode 100644 arch/x86/kernel/cfi.c create mode 100644 include/linux/cfi_types.h --=20 2.36.1.476.g0c4daa206d-goog From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9FDA5C43334 for ; Fri, 10 Jun 2022 23:36:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Mime-Version: Message-Id:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=fdvfnHPqHcXGz7JoVe5naPXrQvoc+/yC4PzjwB/ZZB0=; b=X0f DZ74MQsLrZ1Sv1bBCVuybXdTQEbBF+DcigaE3j38xHm6vKnK1qGc8YBaK2/k94UDxRYSL1NE2hskH i8qznIOtQemrx5FUYPV6sIeDOfL4tO9MBAd+3MjBXN0dzAtkkwjT5I1pQq+UdL9p4hhLn3xJKH3yY uZrdW4km9qMrxBX3GNhWjps8hePEdrLdbCn2F6J7MqWZygCBDiFdhnjNpqiH4LsLKG3SNokp0QhLT PdLlcHQihTPn0egLoBm80NAQT4asXmkw5zzvl/wEhUjfixgAJxjinqH6ENdlliNSCzLKxb98ecn4Z 29eieuxQ4OZUvfiuZ5YcEyQvW9SIyrw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nzo9z-00AQnq-9q; Fri, 10 Jun 2022 23:35:23 +0000 Received: from mail-pf1-x44a.google.com ([2607:f8b0:4864:20::44a]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nzo9v-00AQlX-TH for linux-arm-kernel@lists.infradead.org; Fri, 10 Jun 2022 23:35:21 +0000 Received: by mail-pf1-x44a.google.com with SMTP id 206-20020a6218d7000000b0051893ee2888so279389pfy.16 for ; Fri, 10 Jun 2022 16:35:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:message-id:mime-version:subject:from:to:cc :content-transfer-encoding; bh=nsMGvakN23jGJwKQKSNiBedpAQCT/+oZZ53FMvpJmWE=; b=TTSPz9mn3fOB4ve10WTtYfvod1PAt6nWdPvsN17q7/4saeuWmeuexh9VhPgCkS5pDb f5gRy75iYIFhLPMAvisX1Oqd4oD8ZWNaqLTaxxxPtUAHP8Y0ecEOORdAZIU2C/Y/DKOm nyoXugVxssag43IvWS8/pjSe0TCnIP72aYUgpBBAxda48sML5/s4c6m1tYfnik1HhNkH VCNyyM1VHrL4JWanm+XqpeJUg/llXdoZmHhdeF0TE0Y7+EFUsgLS/sGrzW/NxnDX1ad4 vAiGN0d/8G6ZXtGM385+MPY4pp9zuYsCQ2EiF1NaDKONdQ9rOlNd8RH6++XT6lt40Tdk OCeQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc :content-transfer-encoding; bh=nsMGvakN23jGJwKQKSNiBedpAQCT/+oZZ53FMvpJmWE=; b=bz4frI/tMokQnYaFzW77dIq96WeZkW9LqdDOb9Op5EyxiS5kpPoumJK8b1rSHoaOdy LuKnRiyCeyVFlprGfuFcqqc85vtFhuJTuS22c9NI43X+FNQjsAR4oxdwWwPgrV/7KsR+ 7nQDJQK4htgE6l6i3mXOV8cBtz2lQaXEEkthteTAjweh6JR3F3e8fh5NUjI8lHuZyZKh pn8Im9ZC+8oaA4fj2xMm2KUsRmdnmFnBA5qwz5Rx2Wf9EQtQRlUrhUwjt8upepExtlc9 ykuJCMLB9HCd9iLXnXz1ibXxbcPyy1sMQMqxpJmahLTY/HvkF1TwgjqrVjKHFD3Xcnky 8r+g== X-Gm-Message-State: AOAM5304gdr1BQUVxSH3g8WyKVcT9cgZhNAlWPabcNhEU68aP4OhvQEx f2VHqDhfUieb6Zpz3hmO3sAOPWa84i25oFuad+E= X-Google-Smtp-Source: ABdhPJzdLof87FxFUwL7nMS7yP1RwHTMWgXL9tW9h4xwKDJuVFdFP6l21cUGZW05T9FvcBnHeDH2g5GB+ZU+RT5MXgw= X-Received: from samitolvanen1.mtv.corp.google.com ([2620:15c:201:2:f464:6db6:3d47:ed14]) (user=samitolvanen job=sendgmr) by 2002:a17:90b:4b90:b0:1e8:48bd:453 with SMTP id lr16-20020a17090b4b9000b001e848bd0453mr2189527pjb.86.1654904115869; Fri, 10 Jun 2022 16:35:15 -0700 (PDT) Date: Fri, 10 Jun 2022 16:34:53 -0700 Message-Id: <20220610233513.1798771-1-samitolvanen@google.com> Mime-Version: 1.0 X-Developer-Key: i=samitolvanen@google.com; a=openpgp; fpr=35CCFB63B283D6D3AEB783944CB5F6848BBC56EE X-Developer-Signature: v=1; a=openpgp-sha256; l=7489; h=from:subject; bh=nEoLqXNa3ykt1eGfRs/jvdsV+FhVXUy4vtw8erotAL0=; b=owEB7QES/pANAwAKAUy19oSLvFbuAcsmYgBio9UswFKBhBOO2/9SIKqLIDgiaShLWcr9mJQQ6dfI Oi0DjR+JAbMEAAEKAB0WIQQ1zPtjsoPW0663g5RMtfaEi7xW7gUCYqPVLAAKCRBMtfaEi7xW7svkC/ 9n4xT5mUM0FuTK43AIeV3s0iJFI/It59JH+MTCiDiGXGDCEJGkCO0pK9lGCfDDES6dL4PY8iQKF8P1 BOif4X/nNa/ykC/ILkxWs7dG5G4iExpiA3Nw14d8c251mLZKGPU6rok5GF7k7H6mQqgv4EYYeJAUC8 st9LzJ9EhK3bufhrAiwwIXR9RUlZVx7z3nD6z2XAyd/SSilV/Yy4QzkGO4g0qUmR+z9mkSwuvm2jnN 4vDtRdvGzemSFp8Nj+6j3YCIQn3R+y8vX6Mrloje5lon5XoyAdVERBegFZMQo4NThZl1VPvBM+YjmW e9VbLTEFUMtIeF9BNXaelAZw6gwJEBTiEkz96IIkHIwrSpzCOBJP7dGNpE/clTwzd8x0O9YWDy3Gqg PuLh8K7ozjdJQ/y7qbtQO+Gx7dMEfOA+3GQ8o9OoKouYBVwnqdK3ohasSp2UX8/TkdMbNxl/xNgfNa VG+WTqSZsnFOEv2n68TsYgUcoLR74vqKYZOh9vrWUxlAI= X-Mailer: git-send-email 2.36.1.476.g0c4daa206d-goog Subject: [RFC PATCH v3 00/20] KCFI support From: Sami Tolvanen To: linux-kernel@vger.kernel.org Cc: Kees Cook , Josh Poimboeuf , Peter Zijlstra , x86@kernel.org, Catalin Marinas , Will Deacon , Mark Rutland , Nathan Chancellor , Nick Desaulniers , Joao Moreira , Sedat Dilek , Steven Rostedt , linux-hardening@vger.kernel.org, linux-arm-kernel@lists.infradead.org, llvm@lists.linux.dev, Sami Tolvanen X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220610_163520_035685_49F98A24 X-CRM114-Status: GOOD ( 27.55 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org S0NGSSBpcyBhIHByb3Bvc2VkIGZvcndhcmQtZWRnZSBjb250cm9sLWZsb3cgaW50ZWdyaXR5IHNj aGVtZSBmb3IKQ2xhbmcsIHdoaWNoIGlzIG1vcmUgc3VpdGFibGUgZm9yIGtlcm5lbCB1c2UgdGhh biB0aGUgZXhpc3RpbmcgQ0ZJCnNjaGVtZSB1c2VkIGJ5IENPTkZJR19DRklfQ0xBTkcuIEtDRkkg ZG9lc24ndCByZXF1aXJlIExUTywgZG9lc24ndAphbHRlciBmdW5jdGlvbiByZWZlcmVuY2VzIHRv IHBvaW50IHRvIGEganVtcCB0YWJsZSwgYW5kIHdvbid0IGJyZWFrCmZ1bmN0aW9uIGFkZHJlc3Mg ZXF1YWxpdHkuIFRoZSBsYXRlc3QgTExWTSBwYXRjaCBpcyBoZXJlOgoKICBodHRwczovL3Jldmll d3MubGx2bS5vcmcvRDExOTI5NgoKVGhpcyBSRkMgc2VyaWVzIHJlcGxhY2VzIHRoZSBjdXJyZW50 IGFybTY0IENGSSBpbXBsZW1lbnRhdGlvbiB3aXRoCktDRkkgYW5kIGFkZHMgc3VwcG9ydCBmb3Ig eDg2XzY0LgoKS0NGSSByZXF1aXJlcyBhc3NlbWJseSBmdW5jdGlvbnMgdGhhdCBhcmUgaW5kaXJl Y3RseSBjYWxsZWQgZnJvbSBDCmNvZGUgdG8gYmUgYW5ub3RhdGVkIHdpdGggdHlwZSBpZGVudGlm aWVycy4gQXMgdHlwZSBpbmZvcm1hdGlvbiBpcwpvbmx5IGF2YWlsYWJsZSBpbiBDLCB0aGUgY29t cGlsZXIgZW1pdHMgZXhwZWN0ZWQgdHlwZSBpZGVudGlmaWVycyBpbnRvCnRoZSBzeW1ib2wgdGFi bGUsIHNvIHRoZXkgY2FuIGJlIHJlZmVyZW5jZWQgZnJvbSBhc3NlbWJseSB3aXRob3V0Cmhhdmlu ZyB0byBoYXJkY29kZSB0eXBlIGhhc2hlcy4gUGF0Y2ggNiBhZGRzIGhlbHBlciBtYWNyb3MgZm9y CmFubm90YXRpbmcgZnVuY3Rpb25zLCBhbmQgcGF0Y2hlcyA4IGFuZCAxOCBhZGQgYW5ub3RhdGlv bnMuCgpJbiBjYXNlIG9mIGEgdHlwZSBtaXNtYXRjaCwgS0NGSSBhbHdheXMgdHJhcHMuIFRvIHN1 cHBvcnQgZXJyb3IKaGFuZGxpbmcsIHRoZSBjb21waWxlciBnZW5lcmF0ZXMgYSAua2NmaV90cmFw cyBzZWN0aW9uIGZvciB4ODZfNjQsCndoaWNoIGNvbnRhaW5zIHRoZSBsb2NhdGlvbnMgb2YgZWFj aCB0cmFwLCBhbmQgZm9yIGFybTY0LCBlbmNvZGVzCnRoZSBuZWNlc3NhcnkgcmVnaXN0ZXIgaW5m b3JtYXRpb24gdG8gdGhlIEVTUi4gUGF0Y2hlcyA5IGFuZCAyMCBhZGQKYXJjaC1zcGVjaWZpYyBl cnJvciBoYW5kbGVycy4KClRvIHRlc3QgdGhpcyBzZXJpZXMsIHlvdSdsbCBuZWVkIHRvIGNvbXBp bGUgeW91ciBvd24gQ2xhbmcgdG9vbGNoYWluCndpdGggdGhlIHBhdGNoZXMgbGlua2VkIGFib3Zl LiBZb3UgY2FuIGFsc28gZmluZCB0aGUgY29tcGxldGUgc291cmNlCnRyZWUgaGVyZToKCiAgaHR0 cHM6Ly9naXRodWIuY29tL3NhbWl0b2x2YW5lbi9sbHZtLXByb2plY3QvY29tbWl0cy9rY2ZpLXJm Yy12MwoKVGhpcyBzZXJpZXMgaXMgYWxzbyBhdmFpbGFibGUgaW4gR2l0SHViOgoKICBodHRwczov L2dpdGh1Yi5jb20vc2FtaXRvbHZhbmVuL2xpbnV4L2NvbW1pdHMva2NmaS1yZmMtdjMKCi0tLQpD aGFuZ2VzIGluIHYzOgotIE1lcmdlZCB0aGUgcGF0Y2hlcyB0aGF0IHNwbGl0IENDX0ZMQUdTX0NG SSBmcm9tIENDX0ZMQUdTX0xUTy4KCi0gRHJvcHBlZCB0aGUgcHNjaV9pbml0Y2FsbF90IHBhdGNo IGFzIE1hcmsgdm9sdW50ZWVyZWQgdG8gc2VuZCBhCiAgcGF0Y2ggZm9yIHRoaXMuIE5vdGUgdGhh dCB0aGlzIHBhdGNoIGlzIHN0aWxsIG5lZWRlZCB0byBib290IGEKICBDRkkga2VybmVsIG9uIGNl cnRhaW4gYXJtNjQgc3lzdGVtczoKICBodHRwczovL2xvcmUua2VybmVsLm9yZy9sa21sL1lvTmhL YVRUM0VEdWt4WFlARlZGRjc3UzBRMDVOLwoKLSBBZGRlZCBhIHBhdGNoIHRvIHJlbW92ZSB0aGUg bm93IHVubmVjZXNzYXJ5IHdvcmthcm91bmRzIHdpdGgKICBDRkkrVGhpbkxUTyBpbiBrYWxsc3lt cy4KCi0gQWRkZWQgYW4gbGtkdG0gcGF0Y2ggdG8gZW5zdXJlIHRoZSB0ZXN0IGFjdHVhbGx5IGdl bmVyYXRlcyBhbgogIGluZGlyZWN0IGNhbGwuCgotIENoYW5nZWQgcmVwb3J0X2NmaV9mYWlsdXJl IHRvIGNsZWFybHkgaW5kaWNhdGUgaWYgd2UgZmFpbGVkIHRvCiAgZGVjb2RlIHRhcmdldCBhZGRy ZXNzLgoKLSBTd2l0Y2hlZCB0byByZWxhdGl2ZSBvZmZzZXRzIGZvciAua2NmaV90cmFwcy4KCi0g T24geDg2XzY0LCBtb3ZlZCBDRkkgZXJyb3IgaGFuZGxpbmcgZnJvbSB0cmFwcy5jIHRvIGNmaS5j LCBhbmQKICBhcyB3ZSBvbmx5IGNhbGwgbWVtY3B5IGluZGlyZWN0bHkgdy8gQ09ORklHX01PRFVM RVMsIGVuc3VyZWQgdGhhdAogIHRoZSBjb21waWxlciBlbWl0cyBfX2tjZmlfdHlwZWlkX21lbWNw eSBhbHNvIHdpdGhvdXQgbW9kdWxlcy4KCi0gT24geDg2XzY0LCBhZGRlZCBhIGNoZWNrIGZvciB0 aGUgY21wbCBSRVggcHJlZml4IHRvIGhhbmRsZSB0aGUKICBjYXNlIHdoZXJlIHRoZSBjb21waWxl ciBtaWdodCBub3QgdXNlIHI4LXIxNSByZWdpc3RlcnMgZm9yIHRoZQogIGNhbGwgdGFyZ2V0LgoK LSBPbiB0aGUgY29tcGlsZXIgc2lkZSwgZW5zdXJlZCB0aGF0IG9uIHg4Nl82NCBjYWxscyBhcmUg ZW1pdHRlZAogIGltbWVkaWF0ZWx5IGFmdGVyIHRoZSBDRkkgY2hlY2ssIGZpeGVkIHRoZSBfX2Nm aV8gcHJlYW1ibGUKICBsaW5rYWdlLCBhbmQgY2hhbmdlZCB0aGUgY29tcGlsZXIgdG8gZW1pdCBy ZWxhdGl2ZSBvZmZzZXRzIGluCiAgLmtjZmlfdHJhcHMuCgpDaGFuZ2VzIGluIHYyOgotIENoYW5n ZWQgdGhlIGNvbXBpbGVyIHBhdGNoIHRvIGVuY29kZSBhcm02NCB0YXJnZXQgYW5kIHR5cGUgZGV0 YWlscwogIGluIHRoZSBFU1IsIGFuZCB1cGRhdGVkIHRoZSBrZXJuZWwgZXJyb3IgaGFuZGxpbmcg cGF0Y2ggYWNjb3JkaW5nbHkuCgotIENoYW5nZWQgdGhlIGNvbXBpbGVyIHBhdGNoIHRvIGVtYmVk IHRoZSB4ODZfNjQgdHlwZSBoYXNoIGluIGEgdmFsaWQKICBpbnN0cnVjdGlvbiB0byBhdm9pZCBz cGVjaWFsIGNhc2luZyBvYmp0b29sIGluc3RydWN0aW9uIGRlY29kaW5nLCBhbmQKICBhZGRlZCBh IF9fY2ZpXyBzeW1ib2wgZm9yIHRoZSBwcmVhbWJsZS4gQ2hhbmdlZCB0aGUga2VybmVsIGVycm9y CiAgaGFuZGxpbmcgYW5kIG1hbnVhbCB0eXBlIGFubm90YXRpb25zIHRvIG1hdGNoLgoKLSBEcm9w cGVkIHRoZSAua2NmaV90eXBlcyBzZWN0aW9uIGFzIHRoYXTigJlzIG5vIGxvbmdlciBuZWVkZWQg YnkKICBvYmp0b29sLCBhbmQgY2hhbmdlZCB0aGUgb2JqdG9vbCBwYXRjaCB0byBzaW1wbHkgaWdu b3JlIHRoZSBfX2NmaV8KICBwcmVhbWJsZXMgZmFsbGluZyB0aHJvdWdoLgoKLSBEcm9wcGVkIHRo ZSAua2NmaV90cmFwcyBzZWN0aW9uIG9uIGFybTY0IGFzIGl04oCZcyBubyBsb25nZXIgbmVlZGVk LAogIGFuZCBtb3ZlZCB0aGUgdHJhcCBsb29rLXVwIGNvZGUgYmVoaW5kIENPTkZJR19BUkNIX1VT RVNfQ0ZJX1RSQVBTLAogIHdoaWNoIGlzIHNlbGVjdGVkIG9ubHkgZm9yIHg4Nl82NC4KCi0gRHJv cHBlZCBfX25vY2ZpIGF0dHJpYnV0ZXMgZnJvbSBhcm02NCBjb2RlIHdoZXJlIENGSSB3YXMgZGlz YWJsZWQKICBkdWUgdG8gYWRkcmVzcyBzcGFjZSBjb25mdXNpb24gaXNzdWVzLCBhbmQgYWRkZWQg dHlwZSBhbm5vdGF0aW9ucyB0bwogIHJlbGV2YW50IGFzc2VtYmx5IGZ1bmN0aW9ucy4KCi0gRHJv cHBlZCBfX25vY2ZpIGZyb20gX19pbml0LgoKU2FtaSBUb2x2YW5lbiAoMjApOgogIHRyZWV3aWRl OiBGaWx0ZXIgb3V0IENDX0ZMQUdTX0NGSQogIHNjcmlwdHMva2FsbHN5bXM6IElnbm9yZSBfX2tj ZmlfdHlwZWlkXwogIGNmaTogUmVtb3ZlIENPTkZJR19DRklfQ0xBTkdfU0hBRE9XCiAgY2ZpOiBE cm9wIF9fQ0ZJX0FERFJFU1NBQkxFCiAgY2ZpOiBTd2l0Y2ggdG8gLWZzYW5pdGl6ZT1rY2ZpCiAg Y2ZpOiBBZGQgdHlwZSBoZWxwZXIgbWFjcm9zCiAgbGtkdG06IEVtaXQgYW4gaW5kaXJlY3QgY2Fs bCBmb3IgQ0ZJIHRlc3RzCiAgYXJtNjQ6IEFkZCB0eXBlcyB0byBpbmRpcmVjdCBjYWxsZWQgYXNz ZW1ibHkgZnVuY3Rpb25zCiAgYXJtNjQ6IEFkZCBDRkkgZXJyb3IgaGFuZGxpbmcKICBhcm02NDog RHJvcCB1bm5lZWRlZCBfX25vY2ZpIGF0dHJpYnV0ZXMKICBpbml0OiBEcm9wIF9fbm9jZmkgZnJv bSBfX2luaXQKICB0cmVld2lkZTogRHJvcCBmdW5jdGlvbl9ub2NmaQogIHRyZWV3aWRlOiBEcm9w IFdBUk5fT05fRlVOQ1RJT05fTUlTTUFUQ0gKICB0cmVld2lkZTogRHJvcCBfX2NmaWNhbm9uaWNh bAogIG9ianRvb2w6IERpc2FibGUgQ0ZJIHdhcm5pbmdzCiAga2FsbHN5bXM6IERyb3AgQ09ORklH X0NGSV9DTEFORyB3b3JrYXJvdW5kcwogIHg4Ni90b29scy9yZWxvY3M6IElnbm9yZSBfX2tjZmlf dHlwZWlkXyByZWxvY2F0aW9ucwogIHg4NjogQWRkIHR5cGVzIHRvIGluZGlyZWN0bHkgY2FsbGVk IGFzc2VtYmx5IGZ1bmN0aW9ucwogIHg4Ni9wdXJnYXRvcnk6IERpc2FibGUgQ0ZJCiAgeDg2OiBB ZGQgc3VwcG9ydCBmb3IgQ09ORklHX0NGSV9DTEFORwoKIE1ha2VmaWxlICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgIDEzICstCiBhcmNoL0tjb25maWcgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAxOCArLQogYXJjaC9hcm02NC9jcnlwdG8vZ2hhc2gtY2UtY29yZS5T ICAgICAgICAgfCAgIDUgKy0KIGFyY2gvYXJtNjQvY3J5cHRvL3NtMy1jZS1jb3JlLlMgICAgICAg ICAgIHwgICAzICstCiBhcmNoL2FybTY0L2luY2x1ZGUvYXNtL2Jyay1pbW0uaCAgICAgICAgICB8 ICAgNiArCiBhcmNoL2FybTY0L2luY2x1ZGUvYXNtL2Z0cmFjZS5oICAgICAgICAgICB8ICAgMiAr LQogYXJjaC9hcm02NC9pbmNsdWRlL2FzbS9tbXVfY29udGV4dC5oICAgICAgfCAgIDQgKy0KIGFy Y2gvYXJtNjQva2VybmVsL2FjcGlfcGFya2luZ19wcm90b2NvbC5jIHwgICAyICstCiBhcmNoL2Fy bTY0L2tlcm5lbC9hbHRlcm5hdGl2ZS5jICAgICAgICAgICB8ICAgMiArLQogYXJjaC9hcm02NC9r ZXJuZWwvY3B1LXJlc2V0LlMgICAgICAgICAgICAgfCAgIDUgKy0KIGFyY2gvYXJtNjQva2VybmVs L2NwdWZlYXR1cmUuYyAgICAgICAgICAgIHwgICA0ICstCiBhcmNoL2FybTY0L2tlcm5lbC9mdHJh Y2UuYyAgICAgICAgICAgICAgICB8ICAgMiArLQogYXJjaC9hcm02NC9rZXJuZWwvbWFjaGluZV9r ZXhlYy5jICAgICAgICAgfCAgIDIgKy0KIGFyY2gvYXJtNjQva2VybmVsL3BzY2kuYyAgICAgICAg ICAgICAgICAgIHwgICAyICstCiBhcmNoL2FybTY0L2tlcm5lbC9zbXBfc3Bpbl90YWJsZS5jICAg ICAgICB8ICAgMiArLQogYXJjaC9hcm02NC9rZXJuZWwvdHJhcHMuYyAgICAgICAgICAgICAgICAg fCAgNDcgKystCiBhcmNoL2FybTY0L2tlcm5lbC92ZHNvL01ha2VmaWxlICAgICAgICAgICB8ICAg MyArLQogYXJjaC9hcm02NC9tbS9wcm9jLlMgICAgICAgICAgICAgICAgICAgICAgfCAgIDUgKy0K IGFyY2gveDg2L0tjb25maWcgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAyICsKIGFyY2gv eDg2L2NyeXB0by9ibG93ZmlzaC14ODZfNjQtYXNtXzY0LlMgIHwgICA1ICstCiBhcmNoL3g4Ni9l bnRyeS92ZHNvL01ha2VmaWxlICAgICAgICAgICAgICB8ICAgMyArLQogYXJjaC94ODYvaW5jbHVk ZS9hc20vY2ZpLmggICAgICAgICAgICAgICAgfCAgMjIgKysKIGFyY2gveDg2L2luY2x1ZGUvYXNt L2xpbmthZ2UuaCAgICAgICAgICAgIHwgIDEyICsKIGFyY2gveDg2L2tlcm5lbC9NYWtlZmlsZSAg ICAgICAgICAgICAgICAgIHwgICAyICsKIGFyY2gveDg2L2tlcm5lbC9jZmkuYyAgICAgICAgICAg ICAgICAgICAgIHwgIDgzICsrKysrKwogYXJjaC94ODYva2VybmVsL3RyYXBzLmMgICAgICAgICAg ICAgICAgICAgfCAgIDQgKy0KIGFyY2gveDg2L2xpYi9tZW1jcHlfNjQuUyAgICAgICAgICAgICAg ICAgIHwgICAzICstCiBhcmNoL3g4Ni9wdXJnYXRvcnkvTWFrZWZpbGUgICAgICAgICAgICAgICB8 ICAgNCArCiBhcmNoL3g4Ni90b29scy9yZWxvY3MuYyAgICAgICAgICAgICAgICAgICB8ICAgMSAr CiBkcml2ZXJzL2Zpcm13YXJlL2VmaS9saWJzdHViL01ha2VmaWxlICAgICB8ICAgMiArCiBkcml2 ZXJzL2Zpcm13YXJlL3BzY2kvcHNjaS5jICAgICAgICAgICAgICB8ICAgNCArLQogZHJpdmVycy9t aXNjL2xrZHRtL2NmaS5jICAgICAgICAgICAgICAgICAgfCAgMTUgKy0KIGRyaXZlcnMvbWlzYy9s a2R0bS91c2VyY29weS5jICAgICAgICAgICAgIHwgICAyICstCiBpbmNsdWRlL2FzbS1nZW5lcmlj L2J1Zy5oICAgICAgICAgICAgICAgICB8ICAxNiAtCiBpbmNsdWRlL2FzbS1nZW5lcmljL3ZtbGlu dXgubGRzLmggICAgICAgICB8ICAzNyArLS0KIGluY2x1ZGUvbGludXgvY2ZpLmggICAgICAgICAg ICAgICAgICAgICAgIHwgIDU5ICsrLS0KIGluY2x1ZGUvbGludXgvY2ZpX3R5cGVzLmggICAgICAg ICAgICAgICAgIHwgIDU3ICsrKysKIGluY2x1ZGUvbGludXgvY29tcGlsZXItY2xhbmcuaCAgICAg ICAgICAgIHwgIDE0ICstCiBpbmNsdWRlL2xpbnV4L2NvbXBpbGVyLmggICAgICAgICAgICAgICAg ICB8ICAxNiArLQogaW5jbHVkZS9saW51eC9jb21waWxlcl90eXBlcy5oICAgICAgICAgICAgfCAg IDQgLQogaW5jbHVkZS9saW51eC9pbml0LmggICAgICAgICAgICAgICAgICAgICAgfCAgIDYgKy0K IGluY2x1ZGUvbGludXgvbW9kdWxlLmggICAgICAgICAgICAgICAgICAgIHwgIDEwICstCiBpbmNs dWRlL2xpbnV4L3BjaS5oICAgICAgICAgICAgICAgICAgICAgICB8ICAgNCArLQoga2VybmVsL2Nm aS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAzNDIgKysrKy0tLS0tLS0tLS0tLS0t LS0tLQoga2VybmVsL2thbGxzeW1zLmMgICAgICAgICAgICAgICAgICAgICAgICAgfCAgMTcgLS0K IGtlcm5lbC9rdGhyZWFkLmMgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAzICstCiBrZXJu ZWwvbW9kdWxlL21haW4uYyAgICAgICAgICAgICAgICAgICAgICB8ICA0OSArLS0tCiBrZXJuZWwv d29ya3F1ZXVlLmMgICAgICAgICAgICAgICAgICAgICAgICB8ICAgMiArLQogc2NyaXB0cy9rYWxs c3ltcy5jICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDEgKwogc2NyaXB0cy9tb2R1bGUubGRz LlMgICAgICAgICAgICAgICAgICAgICAgfCAgMjMgKy0KIHRvb2xzL29ianRvb2wvY2hlY2suYyAg ICAgICAgICAgICAgICAgICAgIHwgICA3ICstCiA1MSBmaWxlcyBjaGFuZ2VkLCA0MjAgaW5zZXJ0 aW9ucygrKSwgNTM4IGRlbGV0aW9ucygtKQogY3JlYXRlIG1vZGUgMTAwNjQ0IGFyY2gveDg2L2lu Y2x1ZGUvYXNtL2NmaS5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgYXJjaC94ODYva2VybmVsL2NmaS5j CiBjcmVhdGUgbW9kZSAxMDA2NDQgaW5jbHVkZS9saW51eC9jZmlfdHlwZXMuaAoKLS0gCjIuMzYu MS40NzYuZzBjNGRhYTIwNmQtZ29vZwoKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fCmxpbnV4LWFybS1rZXJuZWwgbWFpbGluZyBsaXN0CmxpbnV4LWFybS1r ZXJuZWxAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9tYWls bWFuL2xpc3RpbmZvL2xpbnV4LWFybS1rZXJuZWwK