From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 41AE6C07545 for ; Tue, 24 Oct 2023 16:17:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Subject:From:Cc:To:MIME-Version:Date:Message-ID: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=9gHM+nKOEMcomyMDhInkoXGOEJqS99ArOmB4edKypks=; b=mV/rANq9AQCm/9ZEBr6VJTA+yJ 09uUAIJ0mv3DnaquQJqe00jvAK5ffMshEwM6AABxTseok8IL8AFR9GNZk1Mu/A9bYAOOzvQyQUZKU oqX0FT4UWnSJWzJL4c+IkpRx20J39rzZbNEOCn8Js1TjKY7D6CZ7v+u6QTtu4LufSg7CINbx4XjH5 Vjrs1x2tFt9EJvDFnK86klLidwK43N49lpekM1r5tCOxLN9lOz37tzYSMkMMTG8GtPkhSaqtawamO WZnhnXMLDVO5c+rLwI8CVMKTQZwnt3N9pGmIfW/urgzxyzNzLKySYp/D2xMi1ayxehbmyzNrOqGi2 C7rw/2RQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qvK5V-00ARUq-0r; Tue, 24 Oct 2023 16:17:01 +0000 Received: from linux.microsoft.com ([13.77.154.182]) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qtY5G-000XSF-2y for kexec@lists.infradead.org; Thu, 19 Oct 2023 18:49:32 +0000 Received: from [192.168.86.69] (unknown [50.46.228.62]) by linux.microsoft.com (Postfix) with ESMTPSA id 454DC20B74C0; Thu, 19 Oct 2023 11:49:22 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 454DC20B74C0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1697741362; bh=d2JVGRdv8gCcfFfmeYalZ8EYM/3NfqEVrcnGI3WvI5g=; h=Date:To:Cc:From:Subject:From; b=sNCbO4IQA6lHhxfw1f2WkM3fFczWPPHZSHYB2/vrqBescY9XnB2uITCRqwSLAQEbE 4s+FguYPXscLPl6h4osoXw2WMxN9lYpC9erG/B4WnWLEIKrlEupFA9cGpzTeShluy1 G9NwHhFd6TXgjfccwN/199BI8n+MHAqKuB+yNqgA= Message-ID: <6c0c32d5-e636-2a0e-5bdf-538c904ceea3@linux.microsoft.com> Date: Thu, 19 Oct 2023 11:49:21 -0700 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.15.1 Content-Language: en-US To: linux-integrity@vger.kernel.org, Mimi Zohar , peterhuewe@gmx.de, Jarkko Sakkinen , jgg@ziepe.ca, Ken Goldman , bhe@redhat.com, vgoyal@redhat.com, Dave Young , "kexec@lists.infradead.org" , jmorris@namei.org, Paul Moore , serge@hallyn.com, James Bottomley , linux-security-module@vger.kernel.org Cc: Tyler Hicks , Lakshmi Ramasubramanian , Sush Shringarputale From: Tushar Sugandhi Subject: [RFC V2] IMA Log Snapshotting Design Proposal X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20231019_114927_061458_39DF0B98 X-CRM114-Status: GOOD ( 21.49 ) X-Mailman-Approved-At: Tue, 24 Oct 2023 09:17:00 -0700 X-BeenThere: kexec@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Sender: "kexec" Errors-To: kexec-bounces+kexec=archiver.kernel.org@lists.infradead.org PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT0KfCBJbnRyb2R1Y3Rpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KVGhpcyBkb2N1bWVu dCBwcm92aWRlcyBhIGRldGFpbGVkIG92ZXJ2aWV3IG9mIHRoZSBwcm9wb3NlZCBLZXJuZWwKZmVh dHVyZSBJTUEgbG9nIHNuYXBzaG90dGluZy4gIEl0IGRlc2NyaWJlcyB0aGUgbW90aXZhdGlvbiBi ZWhpbmQgdGhlCnByb3Bvc2FsLCB0aGUgcHJvYmxlbSB0byBiZSBzb2x2ZWQsIGEgZGV0YWlsZWQg c29sdXRpb24gZGVzaWduIHdpdGgKZXhhbXBsZXMsIGFuZCBkZXNjcmliZXMgdGhlIGNoYW5nZXMg dG8gYmUgbWFkZSBpbiB0aGUgY2xpZW50cy9zZXJ2aWNlcwp3aGljaCBhcmUgcGFydCBvZiByZW1v dGUtYXR0ZXN0YXRpb24gc3lzdGVtLiAgVGhpcyBpcyB0aGUgMm5kIHZlcnNpb24Kb2YgdGhlIHBy b3Bvc2FsLiAgVGhlIGZpcnN0IHZlcnNpb24gaXMgcHJlc2VudCBoZXJlWzFdLgoKVGFibGUgb2Yg Q29udGVudHM6Ci0tLS0tLS0tLS0tLS0tLS0tLQpBLiBNb3RpdmF0aW9uIGFuZCBCYWNrZ3JvdW5k CkIuIEdvYWxzIGFuZCBOb24tR29hbHMKICAgICBCLjEgR29hbHMKICAgICBCLjIgTm9uLUdvYWxz CkMuIFByb3Bvc2VkIFNvbHV0aW9uCiAgICAgQy4xIFNvbHV0aW9uIFN1bW1hcnkKICAgICBDLjIg SGlnaC1sZXZlbCBXb3JrLWZsb3cKRC4gRGV0YWlsZWQgRGVzaWduCiAgICAgRC4xIFNuYXBzaG90 IEFnZ3JlZ2F0ZSBFdmVudAogICAgIEQuMiBTbmFwc2hvdCBUcmlnZ2VyaW5nIE1lY2hhbmlzbQog ICAgIEQuMyBDaG9vc2luZyBBIFBlcnNpc3RlbnQgU3RvcmFnZSBMb2NhdGlvbiBGb3IgU25hcHNo b3RzCiAgICAgRC40IFJlbW90ZS1BdHRlc3RhdGlvbiBDbGllbnQvU2VydmljZS1zaWRlIENoYW5n ZXMKICAgICAgICAgRC40LmEgQ2xpZW50LXNpZGUgQ2hhbmdlcwogICAgICAgICBELjQuYiBTZXJ2 aWNlLXNpZGUgQ2hhbmdlcwpFLiBFeGFtcGxlIFdhbGstdGhyb3VnaApGLiBPdGhlciBEZXNpZ24g Q29uc2lkZXJhdGlvbnMKRy4gUmVmZXJlbmNlcwoKQ2hhbmdlIExvZzoKLS0tLS0tLS0tLS0KVGhp cyBSRkMgcHJvcG9zYWwgZG9jIGhhcyB0aGUgZm9sbG93aW5nIGNoYW5nZXMgY29tcGFyZWQgdG8g aXRzIGZpcnN0CnZlcnNpb25bMV0KICAgICAtIEFkZGVkIHRhYmxlIG9mIGNvbnRlbnRzIGZvciBl YXN5IG5hdmlnYXRpb24gdGhyb3VnaCB0aGUgZG9jLgogICAgIC0gQ2xlYXJseSBkZWZpbmVkIHBy b2JsZW0gYW5kIGFkZGVkIGdvYWxzIGFuZCBub24tZ29hbHMgdGhpcwogICAgICAgcHJvcG9zYWwg cGxhbnMgdG8gYWNoaWV2ZS4KICAgICAtIEFkZGVkIGRpYWdyYW1zIGluIHNlY3Rpb24gIkMuMiBI aWdoLWxldmVsIFdvcmstZmxvdyIgdG8gaGVscAogICAgICAgdGhlIGF1ZGllbmNlIGJldHRlciB1 bmRlcnN0YW5kIHRoZSBzdGVwcyBwcm9wb3NlZC4KICAgICAtIFByb3ZpZGVkIG1vcmUgY2xhcml0 eSBvbiBjaGFuZ2VzIG5lZWRlZCBpbiBhdHRlc3RhdGlvbiBjbGllbnQgYW5kCiAgICAgICByZW1v dGUgYXR0ZXN0YXRpb24gc2VydmljZSB0byBiZW5lZml0IGZyb20gdGhpcyBmZWF0dXJlLgogICAg IC0gTWFkZSB0aGUgbmVjZXNzYXJ5IGNoYW5nZXMgdG8gdGhlIGRvYyBiYXNlZCBvbiB0aGUgbmV3 IGxlYXJuaW5ncwogICAgICAgZnJvbSB0aGUgaW52ZXN0aWdhdGlvbnMgZG9uZSBpbiB0aGUgcGFz dCBmZXcgbW9udGhzLgogICAgIC0gQWRkZWQgc2VjdGlvbiAiRi4gT3RoZXIgRGVzaWduIENvbnNp ZGVyYXRpb25zIiB0byBhZGRyZXNzIHZhcmlvdXMKICAgICAgIGNvbmNlcm5zIGJyb3VnaHQgdXAg aW4gdGhlIGZpcnN0IHZlcnNpb25bMV0gb2YgdGhpcyBkb2Mgb24gdGhlCiAgICAgICBmb2xsb3dp bmcgdG9waWNzOgogICAgICAgICBvIFRQTS1QQ1IgdXBkYXRlIGNvdW50ZXIKICAgICAgICAgbyBF Sy9BSUsgUHVibGljIENlcnQKICAgICAgICAgbyBpbXBsaWNhdGlvbnMgb2YgZXhwb3J0aW5nIGFu ZCByZW1vdmluZyByZWNvcmRzIGZyb20gdGhlIElNQQogICAgICAgICAgIG1lYXN1cmVtZW50IGxp c3QKICAgICAgICAgbyBhdHRlc3RhdGlvbiBjbGllbnQgcmVzdGFydHMgYW5kIHRoZSByZW1vdGUg YXR0ZXN0YXRpb24KICAgICAgICAgICBzZXJ2aWNlIGJlaW5nIHN0YXRlbGVzcwogICAgICAgICBv IHVzaW5nICd0bXBmcycgdG8gc3RvcmUgdGhlIHNuYXBzaG90cwogICAgICAgICBvIFRQTSBzZWFs LXVuc2VhbCBzY2VuYXJpbwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQp8IEEuIE1vdGl2YXRpb24gYW5kIEJhY2tn cm91bmQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQpEZXBlbmRpbmcgb24gdGhlIElNQSBwb2xpY3ksIHRoZSBJTUEgbG9nIGNhbiBjb25zdW1l IGEgbG90IG9mIEtlcm5lbAptZW1vcnkgb24gdGhlIHN5c3RlbS4gIEZvciBpbnN0YW5jZSwgdGhl IGV2ZW50cyBmb3IgdGhlIGZvbGxvd2luZyBJTUEKcG9saWN5IGVudHJpZXMgbWF5IG5lZWQgdG8g YmUgbWVhc3VyZWQgaW4gY2VydGFpbiBzY2VuYXJpb3MsIGJ1dCB0aGV5CmNhbiBhbHNvIGxlYWQg dG8gYSB2ZXJib3NlIElNQSBsb2cgd2hlbiB0aGUgc3lzdGVtIGlzIHJ1bm5pbmcgZm9yIGEKbG9u ZyBwZXJpb2Qgb2YgdGltZS4K4pSM4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSQCuKUgiMgUFJPQ19TVVBFUl9NQUdJQyAgICAgICAg ICAgICAgICAgICAgIOKUggrilIJtZWFzdXJlIGZzbWFnaWM9MHg5ZmEwICAgICAgICAgICAgICAg ICDilIIK4pSCIyBTWVNGU19NQUdJQyAgICAgICAgICAgICAgICAgICAgICAgICAg4pSCCuKUgm1l YXN1cmUgZnNtYWdpYz0weDYyNjU2NTcyICAgICAgICAgICAgIOKUggrilIIjIERFQlVHRlNfTUFH SUMgICAgICAgICAgICAgICAgICAgICAgICDilIIK4pSCbWVhc3VyZSBmc21hZ2ljPTB4NjQ2MjY3 MjAgICAgICAgICAgICAg4pSCCuKUgiMgVE1QRlNfTUFHSUMgICAgICAgICAgICAgICAgICAgICAg ICAgIOKUggrilIJtZWFzdXJlIGZzbWFnaWM9MHgwMTAyMTk5NCAgICAgICAgICAgICDilIIK4pSC IyBSQU1GU19NQUdJQyAgICAgICAgICAgICAgICAgICAgICAgICAg4pSCCuKUgm1lYXN1cmUgZnNt YWdpYz0weDg1ODQ1OGY2ICAgICAgICAgICAgIOKUggrilIIjIFNFQ1VSSVRZRlNfTUFHSUMgICAg ICAgICAgICAgICAgICAgICDilIIK4pSCbWVhc3VyZSBmc21hZ2ljPTB4NzM2MzY2NzMgICAgICAg ICAgICAg4pSCCuKUgiMgT1ZFUkxBWUZTX01BR0lDICAgICAgICAgICAgICAgICAgICAgIOKUggri lIJtZWFzdXJlIGZzbWFnaWM9MHg3OTRjNzYzMCAgICAgICAgICAgICDilIIK4pSCIyBsb2csIGF1 ZGl0IG9yIHRtcCBmaWxlcyAgICAgICAgICAgICAg4pSCCuKUgm1lYXN1cmUgb2JqX3R5cGU9dmFy X2xvZ190ICAgICAgICAgICAgIOKUggrilIJtZWFzdXJlIG9ial90eXBlPWF1ZGl0ZF9sb2dfdCAg ICAgICAgICDilIIK4pSCbWVhc3VyZSBvYmpfdHlwZT10bXBfdCAgICAgICAgICAgICAgICAg4pSC CuKUlOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKU gOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKU gOKUgOKUgOKUmAoKU2Vjb25kbHksIGNlcnRhaW4gc3lzdGVtcyBhcmUgY29uZmlndXJlZCB0byB0 YWtlIEtlcm5lbCB1cGRhdGVzIHVzaW5nCktleGVjIHNvZnQtYm9vdC4gIFRoZSBJTUEgbG9nIGZy b20gdGhlIHByZXZpb3VzIEtlcm5lbCBnZXRzIGNhcnJpZWQKb3ZlciBhbmQgdGhlIEtlcm5lbCBt ZW1vcnkgY29uc3VtcHRpb24gcHJvYmxlbSB3b3JzZW5zIHdoZW4gc3VjaApzeXN0ZW1zIHVuZGVy Z28gbXVsdGlwbGUgS2V4ZWMgc29mdC1ib290cyBvdmVyIGEgbG9uZyBwZXJpb2Qgb2YgdGltZS4K ClRoZSBhYm92ZSB0d28gc2NlbmFyaW9zIGNhbiBjYXVzZSBJTUEgbG9nIHRvIGNvbnN1bWUgc2ln bmlmaWNhbnQgbWVtb3J5Cm9uIHRoZSBzeXN0ZW0uCgpJbiBhZGRpdGlvbiwgcHJvY2Vzc2luZyBh IGxhcmdlciBJTUEgbG9nIG9uIHRoZSBSZW1vdGUtQXR0ZXN0YXRpb24Kc2VydmljZS1zaWRlIGlz IGJvdGggdGltZSBjb25zdW1pbmcgYW5kIGluZWZmaWNpZW50IC0gYmVjYXVzZSBtYWpvcml0eQpv ZiB0aGUgZXZlbnRzIHdvdWxkIGJlIGFscmVhZHkgYXR0ZXN0ZWQgaW4gdGhlIHByZXZpb3VzIGF0 dGVzdGF0aW9uCnJlcXVlc3RzLgoKVG8gc29sdmUgdGhpcyBwcm9ibGVtLCBwdXR0aW5nIGEgY2Fw IG9uIHRoZSBpbi1tZW1vcnkgSU1BIGxvZywgb3IKdHJ1bmNhdGluZyBJTUEgbG9nIHRvIHJlY2xh aW0gbWVtb3J5IGFyZSBub3QgcHJhY3RpY2FsIHNvbHV0aW9ucy4KUHV0dGluZyBhIGNhcCB3b3Vs ZCByZXN1bHQgaW4gZXZlbnRzIG5vdCBnZXR0aW5nIG1lYXN1cmVkIGluIHRoZSBJTUEKbG9nLCB3 aGljaCB3b3VsZCBiZSBhIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdHkuICBUcnVuY2F0aW5nIHRoZSBs b2cgd291bGQKbWFrZSB0aGUgbG9nIGdvIG91dCBvZiBzeW5jIHdpdGggdGhlIFRQTSBQQ1IgcXVv dGUsIHJlc3VsdGluZyBpbiB0aGUKcmVtb3RlIGF0dGVzdGF0aW9uIG9mIHRoZSBzeXN0ZW0gdG8g ZmFpbCB1bnRpbCB0aGUgc3lzdGVtIGdvZXMgdGhyb3VnaAphIGhhcmQgcmVib290LiAgVGhlcmVm b3JlLCBib3RoIHRoZXNlIHNvbHV0aW9ucyBhcmUgdW5hY2NlcHRhYmxlLgoKQSBzb3BoaXN0aWNh dGVkIHNvbHV0aW9uIGlzIHJlcXVpcmVkIGluIHRoaXMgY2FzZSB3aGljaCB3aWxsIGhlbHAKcmVk dWNlIHRoZSBtZW1vcnkgcHJlc3N1cmUgb24gdGhlIHN5c3RlbSBhbmQgY29udGludWUgc3VwcG9y dGluZyByZW1vdGUKYXR0ZXN0YXRpb24gZm9yIGEgbG9uZ2VyIGR1cmF0aW9uIHdpdGhvdXQgZGlz cnVwdGlvbnMuCgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQp8IEIuIEdvYWxzIGFuZCBOb24tR29hbHMgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfAo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLQp8IEIuMSBHb2FscyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfAotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQpUbyBhZGRyZXNzIHRo ZSBpc3N1ZXMgZGVzY3JpYmVkIGluIHRoZSBzZWN0aW9uIGFib3ZlLCB3ZSBwcm9wb3NlCmVuaGFu Y2VtZW50cyB0byB0aGUgSU1BIHN1YnN5c3RlbSB0byBhY2hpZXZlIHRoZSBmb2xsb3dpbmcgZ29h bHM6CgogIGEuIFJlZHVjZSBtZW1vcnkgcHJlc3N1cmUgb24gdGhlIEtlcm5lbCBjYXVzZWQgYnkg bGFyZ2VyIGluLW1lbW9yeQogICAgIElNQSBsb2dzLgoKICBiLiBQcmVzZXJ2ZSB0aGUgc3lzdGVt J3MgYWJpbGl0eSB0byBnZXQgcmVtb3RlbHkgYXR0ZXN0ZWQgdXNpbmcgdGhlCiAgICAgSU1BIGxv ZywgZXZlbiBhZnRlciBpbXBsZW1lbnRpbmcgdGhlIGVuaGFuY2VtZW50cyB0byByZWR1Y2UgbWVt b3J5CiAgICAgcHJlc3N1cmUgY2F1c2VkIGJ5IHRoZSBJTUEgbG9nLiBJTUEncyBJbnRlZ3JpdHkg Z3VhcmFudGVlcyBzaG91bGQKICAgICBiZSBtYWludGFpbmVkLgoKICBjLiBQcm92aWRlIG1lY2hh bmlzbXMgZnJvbSBLZXJuZWwgc2lkZSB0byB0aGUgcmVtb3RlIGF0dGVzdGF0aW9uCiAgICAgc2Vy dmljZSB0byBtYWtlIHNlcnZpY2Utc2lkZSBwcm9jZXNzaW5nIG1vcmUgZWZmaWNpZW50LgoKLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0KfCBCLjIgTm9uLUdvYWxzICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KICBhLiBJbXBsZW1lbnRp bmcgdGhlIGNoYW5nZXMgbmVlZGVkIGluIHRoZSByZW1vdGUgYXR0ZXN0YXRpb24KICAgICBjbGll bnQvc2VydmljZSB0byBiZW5lZml0IGZyb20gdGhlIHByb3Bvc2VkIGVuaGFuY2VtZW50cyBhcmUg b3V0IG9mCiAgICAgc2NvcGUgb2YgdGhpcyBwcm9wb3NhbC4gIEhvd2V2ZXIsIHdlIHdpbGwgYnJp ZWZseSBkaXNjdXNzIHdoYXQgbmVlZHMKICAgICB0byBiZSBkb25lIGluIHRoYXQgc3BhY2UuCgo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQp8IEMuIFByb3Bvc2VkIFNvbHV0aW9uICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQoKVGhpcyBzZWN0aW9u IHByb3ZpZGVzIGhpZ2ggbGV2ZWwgc3VtbWFyeSBvZiB0aGUgcHJvcG9zZWQgc29sdXRpb24gYW5k CnRoZSBuZWNlc3Nhcnkgc3RlcHMgaW4gdGhlIHdvcmstZmxvdy4gIFRoZSBkZXRhaWxzIG9mIGVh Y2ggYXNwZWN0IG9mCnRoZSBzb2x1dGlvbiBhbmQgdGhlIGFsdGVybmF0ZSBhcHByb2FjaGVzIGNv bnNpZGVyZWQgZXRjLiBhcmUgZGlzY3Vzc2VkCmluIHNlY3Rpb24gIkQuIERldGFpbGVkIERlc2ln biIuCgotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLQp8IEMuMSBTb2x1dGlvbiBTdW1tYXJ5ICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfAotLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQpUbyBhY2hp ZXZlIHRoZSBnb2FscyBkZXNjcmliZWQgaW4gdGhlIHNlY3Rpb24gYWJvdmUsIHdlIHByb3Bvc2Ug dGhlCmZvbGxvd2luZyBjaGFuZ2VzIHRvIHRoZSBJTUEgc3Vic3lzdGVtLgoKICAgICBhLiBUaGUg SU1BIGxvZyBmcm9tIEtlcm5lbCBtZW1vcnkgd2lsbCBiZSBvZmZsb2FkZWQgdG8gc29tZQogICAg ICAgIHBlcnNpc3RlbnQgc3RvcmFnZSBkaXNrIHRvIGtlZXAgdGhlIHN5c3RlbSBydW5uaW5nIHJl bGlhYmx5CiAgICAgICAgd2l0aG91dCBmYWNpbmcgbWVtb3J5IHByZXNzdXJlLgogICAgICAgIE1v cmUgZGV0YWlscywgYWx0ZXJuYXRlIGFwcHJvYWNoZXMgY29uc2lkZXJlZCBldGMuIGFyZSBwcmVz ZW50CiAgICAgICAgaW4gc2VjdGlvbiAiRC4zIENob2ljZXMgZm9yIFN0b3JpbmcgU25hcHNob3Rz IiBiZWxvdy4KCiAgICAgYi4gVGhlIElNQSBsb2cgd2lsbCBiZSBkaXZpZGVkIGludG8gbXVsdGlw bGUgY2h1bmtzIChzbmFwc2hvdHMpLgogICAgICAgIEVhY2ggc25hcHNob3Qgd291bGQgYmUgYSBk ZWx0YSBiZXR3ZWVuIHRoZSB0d28gaW5zdGFuY2VzIHdoZW4KICAgICAgICB0aGUgbG9nIHdhcyBv ZmZsb2FkZWQgZnJvbSBtZW1vcnkgdG8gdGhlIHBlcnNpc3RlbnQgc3RvcmFnZQogICAgICAgIGRp c2suCgogICAgIGMuIFNvbWUgVU0gcHJvY2VzcyAobGlrZSBhIHJlbW90ZS1hdHRlc3RhdGlvbi1j bGllbnQpIHdpbGwgYmUKICAgICAgICByZXNwb25zaWJsZSBmb3Igd3JpdGluZyB0aGUgSU1BIGxv ZyBzbmFwc2hvdCB0byB0aGUgZGlzay4KCiAgICAgZC4gVGhlIHNhbWUgVU0gcHJvY2VzcyB3b3Vs ZCBiZSByZXNwb25zaWJsZSBmb3IgdHJpZ2dlcmluZyB0aGUgSU1BCiAgICAgICAgbG9nIHNuYXBz aG90LgoKICAgICBlLiBUaGVyZSB3aWxsIGJlIGEgd2VsbC1rbm93biBsb2NhdGlvbiBmb3Igc3Rv cmluZyB0aGUgSU1BIGxvZwogICAgICAgIHNuYXBzaG90cyBvbiB0aGUgZGlzay4gIEl0IHdpbGwg YmUgbm9uLXRyaXZpYWwgZm9yIFVNIHByb2Nlc3NlcwogICAgICAgIHRvIGNoYW5nZSB0aGF0IGxv Y2F0aW9uIGFmdGVyIGJvb3RpbmcgaW50byB0aGUgS2VybmVsLgoKICAgICBmLiBBIG5ldyBldmVu dCwgInNuYXBzaG90X2FnZ3JlZ2F0ZSIsIHdpbGwgYmUgY29tcHV0ZWQgYW5kIG1lYXN1cmVkCiAg ICAgICAgaW4gdGhlIElNQSBsb2cgYXMgcGFydCBvZiB0aGlzIGZlYXR1cmUuICBJdCBzaG91bGQg aGVscCB0aGUKICAgICAgICByZW1vdGUtYXR0ZXN0YXRpb24gY2xpZW50L3NlcnZpY2UgdG8gYmVu ZWZpdCBmcm9tIHRoZSBJTUEgbG9nCiAgICAgICAgc25hcHNob3QgZmVhdHVyZS4KICAgICAgICBU aGUgInNuYXBzaG90X2FnZ3JlZ2F0ZSIgZXZlbnQgaXMgZGVzY3JpYmVkIGluIG1vcmUgZGV0YWls cyBpbgogICAgICAgIHNlY3Rpb24gIkQuMSBTbmFwc2hvdCBBZ2dyZWdhdGUgRXZlbnQiIGJlbG93 LgoKICAgICBnLiBJZiB0aGUgZXhpc3RpbmcgcmVtb3RlLWF0dGVzdGF0aW9uIGNsaWVudC9zZXJ2 aWNlcyBkbyBub3QgY2hhbmdlCiAgICAgICAgdG8gYmVuZWZpdCBmcm9tIHRoaXMgZmVhdHVyZSBv ciBkbyBub3QgdHJpZ2dlciB0aGUgc25hcHNob3QsCiAgICAgICAgdGhlIEtlcm5lbCB3aWxsIGNv bnRpbnVlIHRvIGhhdmUgaXQncyBjdXJyZW50IGZ1bmN0aW9uYWxpdHkgb2YKICAgICAgICBtYWlu dGFpbmluZyBhbiBpbi1tZW1vcnkgZnVsbCBJTUEgbG9nLgoKQWRkaXRpb25hbGx5LCB0aGUgcmVt b3RlLWF0dGVzdGF0aW9uIGNsaWVudC9zZXJ2aWNlcyBuZWVkIHRvIGJlIHVwZGF0ZWQKdG8gYmVu ZWZpdCBmcm9tIHRoZSBJTUEgbG9nIHNuYXBzaG90IGZlYXR1cmUuICBUaGVzZSBwcm9wb3NlZCBj aGFuZ2VzCmFyZSBkZXNjcmliZWQgaW4gc2VjdGlvbiAiRC40IFJlbW90ZS1BdHRlc3RhdGlvbiBD bGllbnQvU2VydmljZSBTaWRlCkNoYW5nZXMiIGJlbG93LCBidXQgdGhlaXIgaW1wbGVtZW50YXRp b24gaXMgb3V0IG9mIHNjb3BlIGZvciB0aGlzCnByb3Bvc2FsLgoKLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KfCBD LjIgSGlnaC1sZXZlbCBXb3JrLWZsb3cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KVGhpcyBzZWN0aW9uIGRlc2NyaWJlcyB0aGUgc3Rl cHMgdG8gdGFrZSBhIHNuYXBzaG90IG9mIHRoZSBJTUEgbG9nLgoKVGhlIHByb3Bvc2VkIGhpZ2gg bGV2ZWwgd29yay1mbG93IG9mIElNQSBsb2cgc25hcHNob3R0aW5nIGlzIGFzCmZvbGxvd3M6CiAg ICAgYS4gQSB1c2VyLW1vZGUgcHJvY2VzcyB3aWxsIHRyaWdnZXIgdGhlIHNuYXBzaG90IGJ5IG9w ZW5pbmcgYSBmaWxlCiAgICAgICAgaW4gU3lzRlMgc2F5IC9zeXMva2VybmVsL3NlY3VyaXR5L2lt YS9zbmFwc2hvdCAocmVmZXJyZWQgdG8gYXMKICAgICAgICAic3lza19pbWFfc25hcHNob3RfZmls ZSIgaGVyZSBvbndhcmRzKS4KICAgICAgICBTZWUgU3RlcCAjYSBpbiBEaWFncmFtICMxIGJlbG93 LgoKICAgICBiLiBUaGUgS2VybmVsIHdpbGwgZ2V0IHRoZSBjdXJyZW50IFRQTSBQQ1IgdmFsdWVz IGFuZCBzdG9yZSB0aGVtIGFzCiAgICAgICAgdGVtcGxhdGUgZGF0YSBpbiBhIG5ldyBJTUEgZXZl bnQgInNuYXBzaG90X2FnZ3JlZ2F0ZSIuCiAgICAgICAgVGhpcyBldmVudCB3aWxsIGJlIG1lYXN1 cmVkIGJ5IElNQSB1c2luZyBjcml0aWNhbCBkYXRhCiAgICAgICAgbWVhc3VyZW1lbnQgZnVuY3Rp b25hbGl0eVsyXS4KICAgICAgICBNZWFzdXJpbmcgdGhlICJzbmFwc2hvdF9hZ2dyZWdhdGUiIHdp bGwgYmUgYW4gYXRvbWljIG9wZXJhdGlvbgogICAgICAgIHNpbWlsYXIgdG8gYW55IG90aGVyIElN QSBsb2cgbWVhc3VyZW1lbnQuCiAgICAgICAgU2VlIFN0ZXAgI2IgYW5kICNjIGluIERpYWdyYW0g IzEgYmVsb3cuCgogICAgIGMuIE9uY2UgdGhlICJzbmFwc2hvdF9hZ2dyZWdhdGUiIGlzIGNvbXB1 dGVkIGFuZCBtZWFzdXJlZCBpbiBJTUEKICAgICAgICBsb2csIHRoZSBwcmlvciBJTUEgZXZlbnRz IHdpbGwgYmUgbWFkZSBhdmFpbGFibGUgaW4gdGhlCiAgICAgICAgInN5c2tfaW1hX3NuYXBzaG90 X2ZpbGUiLgogICAgICAgIFNlZSBTdGVwICNiIGFuZCAjYyBpbiBEaWFncmFtICMxIGJlbG93LgoK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEaWFncmFtICMxCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgLS0tLS0tLS0tLQogICAgICAgICAgICBTdGVwICNhICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBTdGVwICNiIGFuZCAjYwogICAgICAgICAgIC0tLS0t LS0tLSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tLS0tLS0tLS0tLS0tLS0KICAg ICAoSW4tbWVtb3J5IElNQSBsb2cpICAgICAgICAgICAgICAgICAgICAgICAgIChJbi1tZW1vcnkg SU1BIGxvZykKICAgIC4tLS0tLS0tLS0tLS0tLS0tLS0tLS4gICAgICAgICAgICAgICAgICAgICAu LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS4KICAgIHwgRXZlbnQgI0UxICAgICAgICAgIHwgICAgICAg ICAgICAgICAgICAgICB8IEV2ZW50ICNFMSAgICAgICAgICAgIHwKICAgIHwgRXZlbnQgI0UyICAg ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICB8IEV2ZW50ICNFMiAgICAgICAgICAgIHwKICAg IHwgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAgICAg ICAgICAgICAgIHwKICAgIHwgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAg ICB8ICJzbmFwc2hvdF9hZ2dyZWdhdGUiIHwKICAgIHwgICAgICAgICAgICAgICAgICAgIHwgICAg ICAgICAgICAgICAgICAgICB8ICAgKCNFMSsjRTIpICAgICAgICAgIHwKICAgICctLS0tLS0tLS0t LS0tLS0tLS0tLScgICAgICAgICAgICAgICAgICAgICAnLS0tLS0tLS0tLS0tLS0tLS0tLS0tLScK ICAgICAgICAgICAgICBeICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBeCiAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfAogICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwKS00gICAgICAgICAqS2VybmVsKiAgICAgICAgICAgICAgICBzdGVwICNiLktl cm5lbCB3cml0ZXMgIHwKLS0tICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICJzbmFw c2hvdF9hZ2dyZWdhdGUiIHwKVU0gICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHRvIElNQSBsb2cgIHwKICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB8CiAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAg ICAgc3RlcCAjYy5LZXJuZWwgd3JpdGVzICAgfAogICAgICAgICAgICAgIHwgICAgICAgICAgICAg ICAgICAgIHRoZSBldmVudHMgRTIgYW5kIEUzIHRvIHwKICAgICAgICAgICAgICB8ICAgICAgICAg ICAgICAgICAgICAgc3lza19pbWFfc25hcHNob3RfZmlsZSB8CiAgICAgICAgICAgICAgViAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVgogICAgKHN5c2tfaW1hX3Nu YXBzaG90X2ZpbGUpICAgICAgICAgICAgICAgICAgIChzeXNrX2ltYV9zbmFwc2hvdF9maWxlKQog ICAgLi0tLS0tLS0tLS0tLS0tLS0tLS0tLiAgICAgICAgICAgICAgICAgICAgICAuLS0tLS0tLS0t LS0tLS0tLS0tLS0uCiAgICB8ICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAg ICAgIHwgRXZlbnQgI0UxICAgICAgICAgIHwKICAgIHwgICAgICAge0VtcHR5fSAgICAgIHwgICAg ICAgID09PT0+ICAgICAgICAgfCBFdmVudCAjRTIgICAgICAgICAgfAogICAgfCAgICAgICAgICAg ICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICB8CiAg ICAnLS0tLS0tLS0tLS0tLS0tLS0tLS0nICAgICAgICAgICAgICAgICAgICAgICctLS0tLS0tLS0t LS0tLS0tLS0tLScKICAgICAgICAgICAgICBeICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBeCiAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfAogICAgICAgICAgICAgIHxTdGVwICNhIENsaWVudCBvcGVucyAg ICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgICAgICAgICB8c3lza19pbWFfc25hcHNob3Rf ZmlsZSAgICAgICAgICAgICAgICAgICAgICB8CiAgICAgICAgICAgICAgfCAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfAogICAqQXR0ZXN0YXRpb24gQ2xpZW50IChV TSkqICAgICAgICAgICAgICAgICAgICpBdHRlc3RhdGlvbiBDbGllbnQgKFVNKSoKICAgICAgICAg ICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8CiAgICAg ICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfAog ICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwKICAgICAgICAgICAgICBWICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBWCiAgIFVNX3NuYXBzaG90X2ZpbGUgIChvbiBESVNLKSAgICAgICAgICAgICAgIFVNX3Nu YXBzaG90X2ZpbGUgIChvbiBESVNLKQogICAgLi0tLS0tLS0tLS0tLS0tLS0tLS0tLiAgICAgICAg ICAgICAgICAgICAgICAuLS0tLS0tLS0tLS0tLS0tLS0tLS0uCiAgICB8ICAgICAgICAgICAgICAg ICAgICB8ICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgIHwKICAgIHwg ICAgICAge0VtcHR5fSAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgfCAgICAgICB7RW1wdHl9 ICAgICAgfAogICAgfCAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICB8 ICAgICAgICAgICAgICAgICAgICB8CiAgICAnLS0tLS0tLS0tLS0tLS0tLS0tLS0nICAgICAgICAg ICAgICAgICAgICAgICctLS0tLS0tLS0tLS0tLS0tLS0tLScKCiAgICAgZC4gVGhlIFVNIHByb2Nl c3Mgd2lsbCBjb3B5IHRob3NlIElNQSBldmVudHMgZnJvbQogICAgICAgICJzeXNrX2ltYV9zbmFw c2hvdF9maWxlIiB0byBhIHNuYXBzaG90IGZpbGUgb24gZGlzayBjaG9zZW4gYnkgVU0KICAgICAg ICAocmVmZXJyZWQgdG8gYXMgIlVNX3NuYXBzaG90X2ZpbGUiIGhlcmUgb253YXJkcykuCiAgICAg ICAgVGhlIGxvY2F0aW9uLCBmaWxlLXN5c3RlbSB0eXBlLCBhY2Nlc3MgcGVybWlzc2lvbnMgZXRj LiBvZiB0aGUKICAgICAgICAiVU1fc25hcHNob3RfZmlsZSIgd291bGQgYmUgY29udHJvbGxlZCBi eSBVTSBwcm9jZXNzIGl0c2VsZi4KICAgICAgICBBcyBkZXNjcmliZWQgaW4gc2VjdGlvbiBELjMs IHRoZSBsb2NhdGlvbiBvZiAiVU1fc25hcHNob3RfZmlsZSIKICAgICAgICBzaG91bGQgYmUgd2Vs bC1rbm93bi4KICAgICAgICBTZWUgU3RlcCAjZCBpbiBEaWFncmFtICMyIGJlbG93LgoKICAgICBl LiBPbmNlIFVNIGlzIGRvbmUgY29weWluZyB0aGUgSU1BIGV2ZW50cyBmcm9tCiAgICAgICAgInN5 c2tfaW1hX3NuYXBzaG90X2ZpbGUiIHRvICJVTV9zbmFwc2hvdF9maWxlIiwgaXQgd2lsbCBpbmRp Y2F0ZQogICAgICAgIHRvIHRoZSBLZXJuZWwgdGhhdCB0aGUgc25hcHNob3QgY2FuIGJlIGZpbmFs aXplZCBieSB0cmlnZ2VyaW5nIGEKICAgICAgICB3cml0ZSB3aXRoIGFueSBkYXRhIHRvIHRoZSAi c3lza19pbWFfc25hcHNob3RfZmlsZSIuICBVTSBwcm9jZXNzCiAgICAgICAgY2Fubm90IHByZXZl bnQgdGhlIElNQSBsb2cgcHVyZ2Ugb3BlcmF0aW9uIGFmdGVyIHRoaXMgcG9pbnQuCiAgICAgICAg U2VlIFN0ZXAgI2UgaW4gRGlhZ3JhbSAjMiBiZWxvdy4KCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgRGlhZ3JhbSAjMgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tLS0t LS0tLS0KICAgICAgICAgICAgU3RlcCAjZCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgU3RlcCAjZQogICAgICAgICAgIC0tLS0tLS0tLSAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIC0tLS0tLS0tCiAgICAgKEluLW1lbW9yeSBJTUEgbG9nKSAgICAgICAgICAgICAgICAg ICAgICAgICAoSW4tbWVtb3J5IElNQSBsb2cpCiAgICAuLS0tLS0tLS0tLS0tLS0tLS0tLS0uICAg ICAgICAgICAgICAgICAgICAgLi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0uCiAgICB8IEV2ZW50ICMx ICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICAgfCBFdmVudCAjMSAgICAgICAgICAgICB8 CiAgICB8IEV2ZW50ICMyICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICAgfCBFdmVudCAj MiAgICAgICAgICAgICB8CiAgICB8InNuYXBzaG90X2FnZ3JlZ2F0ZSJ8ICAgICAgICAgICAgICAg ICAgICAgfCAic25hcHNob3RfYWdncmVnYXRlIiB8CiAgICB8ICAgKCNFMSsjRTIpICAgICAgICB8 ICAgICAgICAgICAgICAgICAgICAgfCAgICgjRTErI0UyKSAgICAgICAgICB8CiAgICAnLS0tLS0t LS0tLS0tLS0tLS0tLS0nICAgICAgICAgICAgICAgICAgICAgJy0tLS0tLS0tLS0tLS0tLS0tLS0t LS0nCiAgICAgICAgICAgICAgXiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgXgogICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwKICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8CktNICAgICAgICAgKktlcm5lbCogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAqS2VybmVsKgotLS0gICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfApVTSAgICAgICAgICAgfCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfAogICAgICAgICAgICAgIHwgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgICAgICAgICB8ICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8CiAgICAgICAgICAgICAgfCAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfAogICAgICAgICAgICAgIFYg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFYKICAgIChzeXNrX2lt YV9zbmFwc2hvdF9maWxlKSAgICAgICAgICAgICAgICAgICAoc3lza19pbWFfc25hcHNob3RfZmls ZSkKICAgIC4tLS0tLS0tLS0tLS0tLS0tLS0tLS4gICAgICAgICAgICAgICAgICAgICAgLi0tLS0t LS0tLS0tLS0tLS0tLS0tLgogICAgfCBFdmVudCAjRTEgICAgICAgICAgfCAgICAgICAgICAgICAg ICAgICAgICB8ICJkb25lIiAgICAgICAgICAgICB8CiAgICB8IEV2ZW50ICNFMiAgICAgICAgICB8 ICAgICAgICA9PT09PiAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgIHwKICAgIHwgICAgICAg ICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAg fAogICAgJy0tLS0tLS0tLS0tLS0tLS0tLS0tJyAgICAgICAgICAgICAgICAgICAgICAnLS0tLS0t LS0tLS0tLS0tLS0tLS0nCiAgICAgICAgICAgICBeICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgXgogICAgICAgICAgICAgfFN0ZXAgI2QgQ2xpZW50IGNvcGllcyAg ICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgICAgICAgIHxldmVudHMgdG8gVU1fc25hcHNo b3RfZmlsZSAgICAgICAgICAgICAgICAgICB8CiAgICAgICAgICAgICB8ICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfAogICAgICAgICAgICAgfCAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgICAgICAgIHwgICAgICAg ICAgICAgICAgICAgICAgIHN0ZXAgI2UgQ2xpZW50IHdyaXRlcyB8CiAgICAgICAgICAgICB8ICAg ICAgICAgICAgICAgICAgICAgICAgImRvbmUiIHRvIHRoZSBmaWxlICAgfAogICAgICAgICAgICAg fCAgICAgICAgICAgICAgICAgICAgIHN5c2tfaW1hX3NuYXBzaG90X2ZpbGUgIHwKICAgICAgICAg ICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8CiAgKkF0 dGVzdGF0aW9uIENsaWVudCAoVU0pKiAgICAgICAgICAgICAgICAgICAqQXR0ZXN0YXRpb24gQ2xp ZW50IChVTSkqCiAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfAogICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwKICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICB8CiAgICAgICAgICAgICBWICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgVgogICBVTV9zbmFwc2hvdF9maWxlICAob24gRElTSykg ICAgICAgICAgICAgICBVTV9zbmFwc2hvdF9maWxlICAob24gRElTSykKICAgIC4tLS0tLS0tLS0t LS0tLS0tLS0tLS4gICAgICAgICAgICAgICAgICAgICAgLi0tLS0tLS0tLS0tLS0tLS0tLS0tLgog ICAgfCBFdmVudCAjRTEgICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICB8RXZlbnQgI0Ux ICAgICAgICAgICB8CiAgICB8IEV2ZW50ICNFMiAgICAgICAgICB8ICAgICAgICAgICAgICAgICAg ICAgIHxFdmVudCAjRTIgICAgICAgICAgIHwKICAgIHwgICAgICAgICAgICAgICAgICAgIHwgICAg ICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgfAogICAgJy0tLS0tLS0tLS0t LS0tLS0tLS0tJyAgICAgICAgICAgICAgICAgICAgICAnLS0tLS0tLS0tLS0tLS0tLS0tLS0nCgog ICAgIGYuIFRoZSBLZXJuZWwgd2lsbCB0cnVuY2F0ZSB0aGUgY3VycmVudCBJTUEgbG9nIGFuZCBh bmQgY2xlYXIKICAgICAgICBIVGFibGUgdXAgdG8gdGhlICJzbmFwc2hvdF9hZ2dyZWdhdGUiIG1h cmtlci4KICAgICAgICBTZWUgU3RlcCAjZiBpbiBEaWFncmFtICMzIGJlbG93LgoKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBEaWFncmFtICMzCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgLS0tLS0tLS0tLQogICAgICAgICAgICBTdGVwICNmCiAgICAgICAgICAgLS0tLS0t LS0tCiAgICAgIChJbi1tZW1vcnkgSU1BIGxvZykKICAgIC4tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LgogICAgfCAic25hcHNob3RfYWdncmVnYXRlIiB8CiAgICB8IEV2ZW50ICNFNCAgICAgICAgICAg IHwKICAgIHwgRXZlbnQgI0U1ICAgICAgICAgICAgfAogICAgJy0tLS0tLS0tLS0tLS0tLS0tLS0t LS0nCiAgICAgICAgICAgICAgXgogICAgICAgICAgICAgIHwKICAgICAgICAgICAgICB8IFN0ZXAg I2YKS00gICAgICAgICAgIHwgS2VybmVsIHJlbW92ZXMgdGhlIG9sZCBldmVudHMgYmVmb3JlCi0t LSAgICAgICAgICB8ICAic25hcHNob3RfYWdncmVnYXRlIiBpLmUuICNFMSBhbmQgI0UyLgpVTSAg ICAgICAgICAgfCBBbmQgY29udGludWVzIHRvIG1lYXN1cmUgdGhlIG5ldyBldmVudHMKICAgICAg ICAgICAgICB8IGkuZS4gI0U0IGFuZCAjRTUKICAgICAgICAgICAgICB8CiAgICAgICAgICAgICAg fAogICAgICAgICAgICAgIFYKICAgKHN5c2tfaW1hX3NuYXBzaG90X2ZpbGUpCiAgICAuLS0tLS0t LS0tLS0tLS0tLS0tLS0uCiAgICB8ICJkb25lIiAgICAgICAgICAgICB8CiAgICB8ICAgICAgICAg ICAgICAgICAgICB8CiAgICB8ICAgICAgICAgICAgICAgICAgICB8CiAgICAnLS0tLS0tLS0tLS0t LS0tLS0tLS0nCiAgICAgICAgICAgICAgXgogICAgICAgICAgICAgIHwKICAgICAgICAgICAgICB8 CiAgICAgICAgICAgICAgfCBBdHRlc3RhdGlvbiBDbGllbnQgY2FuIG5vdyBjbG9zZQogICAgICAg ICAgICAgIHwgdGhlIHN5c2tfaW1hX3NuYXBzaG90X2ZpbGUuCiAgICAgICAgICAgICAgfCBXaGVu IGl0IGlzIHJlb3BlbmVkIGJ5IHRoZSBjbGllbnQsIGEgbmV3IHNuYXBzaG90IHdpbGwKICAgICAg ICAgICAgICB8IGJlIHRyaWdnZXJlZC4KICAgICAgICAgICAgICBWCiAgIFVNX3NuYXBzaG90X2Zp bGUgIChvbiBESVNLKQogICAgLi0tLS0tLS0tLS0tLS0tLS0tLS0tLgogICAgfCBFdmVudCAjRTEg ICAgICAgICAgfAogICAgfCBFdmVudCAjRTIgICAgICAgICAgfAogICAgfCAgICAgICAgICAgICAg ICAgICAgfAogICAgJy0tLS0tLS0tLS0tLS0tLS0tLS0tJwogICAgIGcuIE9wdGlvbmFsbHksIFVN IGNhbiBwcmV2ZW50IHRoZSBJTUEgbG9nIHB1cmdlIGJ5IGNsb3NpbmcgdGhlCiAgICAgICAgInN5 c2tfaW1hX3NuYXBzaG90X2ZpbGUiIHdpdGhvdXQgcGVyZm9ybWluZyBhIHdyaXRlIG9wZXJhdGlv bgogICAgICAgIG9uIGl0LiAgSW4gdGhpcyBjYXNlLCB0aGUgZXZlbnRzIGluIHRoZSBJTUEgbG9n IGJlZm9yZQogICAgICAgIHRoZSBsYXRlc3QgInNuYXBzaG90X2FnZ3JlZ2F0ZSIgd2lsbCBub3Qg YmUgcHVyZ2VkLgogICAgICAgIFdoaWxlIHRoZSAic25hcHNob3RfYWdncmVnYXRlIiBtYXJrZXIg bWF5IHN0aWxsIHJlbWFpbiBpbiB0aGUKICAgICAgICBsb2cgYXMgYW4gaW50ZXJtZWRpYXRlIGVu dHJ5LCBpdCBjYW4gYmUgaWdub3JlZCBzaW5jZSBpdCB3aWxsCiAgICAgICAgbm90IGludGVyZmVy ZSB3aXRoIHRoZSByZW1vdGUgYXR0ZXN0YXRpb24uCgogICAgIGguIFRoaXMgd29yay1mbG93IHNo b3VsZCB3b3JrIHdoZW4gaW50ZXJsZWF2ZWQgd2l0aCBLZXhlYyAnbG9hZCcKICAgICAgICBhbmQg J2V4ZWN1dGUnIGV2ZW50cyBhbmQgc2hvdWxkIG5vdCBjYXVzZSBJTUEgbG9nICsgc25hcHNob3Qg dG8KICAgICAgICBnbyBvdXQgb2Ygc3luYyB3aXRoIFBDUiBxdW90ZXMuICBUaGUgaW1wbGVtZW50 YXRpb24gZGV0YWlscyBhcmUKICAgICAgICBvbWl0dGVkIGZyb20gdGhpcyBkb2N1bWVudCBmb3Ig YnJldml0eS4KCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09CnwgRC4gRGV0YWlsZWQgRGVzaWduICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8Cj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Cgot LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLQp8IEQuMSBTbmFwc2hvdCBBZ2dyZWdhdGUgRXZlbnQgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfAotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQpXaGVuIHRoZSBJTUEg bG9nIHNuYXBzaG90IGlzIHRyaWdnZXJlZCwgSU1BIHdpbGwgcGF1c2UgdGhlIG1lYXN1cmVtZW50 cwphbmQgc3RhcnQgY29tcHV0aW5nIGFuZCBtZWFzdXJlbWVudCBvZiB0aGUgZXZlbnQgInNuYXBz aG90X2FnZ3JlZ2F0ZSIuCgpUaGUgVGVtcGxhdGUgRGF0YSBvZiB0aGUgInNuYXBzaG90X2FnZ3Jl Z2F0ZSIgZXZlbnQgd2lsbCBoYXZlIHRoZQpmb2xsb3dpbmcgZ3JhbW1hcjoKICAgICBURU1QTEFU RV9EQVRBICAgICAgOj0gPFNuYXBzaG90X0NvdW50ZXI+IjsiPFBDUl9CYW5rcz4iOyIKICAgICBT bmFwc2hvdF9Db3VudGVyICAgOj0gIlNuYXBzaG90X0F0dGVtcHRfQ291bnQ9IgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPG51bS4gc25hcHNob3QgYXR0ZW1wdHM+CiAgICAgUENSX0Jh bmtzICAgICAgICAgIDo9IDxQQ1JfQmFuaz4iOyJ8PFBDUl9CYW5rcz4gIiwiIDxQQ1JfQmFuaz4i OyIKICAgICBQQ1JfQmFuayAgICAgICAgICAgOj0gPFBDUl9IYXNoIFR5cGU+ICI6IiA8UENSbj4K ICAgICBQQ1JfSGFzaF9UeXBlICAgICAgOj0gInNoYTEifCJzaGEyNTYifCJzaGEzODQiCiAgICAg UENSbiAgICAgICAgICAgICAgIDo9ICJQQ1IiPE4+IjoiPFBDUl9IYXNoPgogICAgIFBDUl9IYXNo ICAgICAgICAgICA6PSA8aGFzaCBvZiB0aGUgUENSIE4+CiAgICAgTiAgICAgICAgICAgICAgICAg IDo9IFswLTIzXQoKVGhlIERhdGEgSGFzaCBvZiB0aGUgInNuYXBzaG90X2FnZ3JlZ2F0ZSIgZXZl bnQgbG9nIGxpbmUgaXMgLQogIEFwcGVuZChIKHNuYXBzaG90X2ZpbGUpLFBDUjAsUENSMSwuLi5Q Q1IyMykuICBBbGwgYXZhaWxhYmxlIFBDUiBiYW5rcwogIHdpbGwgYmUgIGluY2x1ZGVkIGluIHRo ZSB0ZW1wbGF0ZSBkYXRhIGluIGEga25vd24gc3RydWN0dXJlLgoKVGhlIGV2ZW50cyBnZW5lcmF0 ZWQgYmV0d2VlbiB0aGUgd2luZG93IG9mICJ0cmlnZ2VyaW5nIG9mCmEgc25hcHNob3QiIGFuZCAi Y29tcHV0YXRpb24gYW5kIG1lYXN1cmVtZW50IG9mIHRoZSAnc25hcHNob3RfYWdncmVnYXRlJwpl dmVudCBkYXRhIiB3aWxsIGJlIHF1ZXVlZCwgYW5kIHRoZXkgd2lsbCBiZSBtZWFzdXJlZCBpbiB0 aGUgSU1BIGxvZwphZnRlciB0aGUgInNuYXBzaG90X2FnZ3JlZ2F0ZSIgZXZlbnQgZGF0YSBpcyBj b21wdXRlZCBhbmQgbWVhc3VyZWQuCgpBZnRlciAic25hcHNob3RfYWdncmVnYXRlIiBldmVudCBk YXRhIGlzIGNvbXB1dGVkIGFuZCBtZWFzdXJlZCwgdGhlIFVNCnByb2Nlc3Mgd2lsbCBkdW1wIHRo ZSBldmVudHMgYmVmb3JlICJzbmFwc2hvdF9hZ2dyZWdhdGUiIHRvIGEgd2VsbAprbm93biBsb2Nh dGlvbiBvbiBwZXJzaXN0ZW50IHN0b3JhZ2UgaW4gIlVNX3NuYXBzaG90X2ZpbGUiLiAgT25jZSB0 aGUKVU0gcHJvY2VzcyBzaWduYWxzIHRoYXQgd29yayBpcyBjb21wbGV0ZSwgSU1BIHdpbGwgcmVt b3ZlIHRob3NlIGV2ZW50cwpmcm9tIHRoZSBJTUEgbG9nLiAgSU1BIGxvZyB3aWxsIG5vdyBoYXZl ICJzbmFwc2hvdF9hZ2dyZWdhdGUiIGFzIHRoZQpmaXJzdCBldmVudCBpbiBpdC4KClRoZSAic25h cHNob3RfYWdncmVnYXRlIiBtYXJrZXIgcHJvdmlkZXMgdGhlIGZvbGxvd2luZyBiZW5lZml0czoK ICAgICBhLiBJdCBmYWNpbGl0YXRlcyB0aGUgSU1BIGxvZyB0byBiZSBkaXZpZGVkIGludG8gbXVs dGlwbGUgY2h1bmtzCiAgICAgICAgYW5kIHByb3ZpZGVzIG1lY2hhbmlzbSB0byB2ZXJpZnkgdGhl IGludGVncml0eSBvZiB0aGUgc3lzdGVtCiAgICAgICAgdXNpbmcgb25seSB0aGUgbGF0ZXN0IGNo dW5rcyBkdXJpbmcgcmVtb3RlIGF0dGVzdGF0aW9uLgoKICAgICBiLiBJdCBwcm92aWRlcyB0YW5n aWJsZSBldmlkZW5jZSBmcm9tIEtlcm5lbCB0byB0aGUgYXR0ZXN0YXRpb24KICAgICAgICBjbGll bnQgdGhhdCBJTUEgbG9nIHNuYXBzaG90dGluZyBoYXMgYmVlbiBlbmFibGVkIGFuZCBhdCBsZWFz dAogICAgICAgIG9uZSBzbmFwc2hvdCBleGlzdHMgb24gdGhlIHN5c3RlbS4KCiAgICAgYy4gSXQg aGVscHMgYm90aCB0aGUgS2VybmVsIGFuZCBVTSBhdHRlc3RhdGlvbiBjbGllbnQgZGVmaW5lIGNs ZWFyCiAgICAgICAgYm91bmRhcmllcyBiZXR3ZWVuIG11bHRpcGxlIHNuYXBzaG90cy4KCiAgICAg ZC4gSW4gdGhlIGV2ZW50IG9mIG11bHRpcGxlIHNuYXBzaG90cywgdGhlIGxhc3QgbWVhc3VyZWQK ICAgICAgICAic25hcHNob3RfYWdncmVnYXRlIiBtYXJrZXIsIHdoaWNoIGlzIHByZXNlbnQgaW4g dGhlIGN1cnJlbnQKICAgICAgICBzZWdtZW50IG9mIHRoZSBJTUEgbG9nLCBoYXMgc3VmZmljaWVu dCBpbmZvcm1hdGlvbiB0byB2ZXJpZnkgdGhlCiAgICAgICAgaW50ZWdyaXR5IG9mIHRoZSBJTUEg bG9nIHNlZ21lbnQgYXMgd2VsbCBhcyB0aGUgcHJldmlvdXMKICAgICAgICBzbmFwc2hvdHMgdXNp bmcgdGhlIFBDUiBxdW90ZXMuCgogICAgIGUuIEluIHRoZSBldmVudCBvZiBtdWx0aXBsZSBzbmFw c2hvdHMsIHNheSBOLCBpZiB0aGUKICAgICAgICByZW1vdGUtYXR0ZXN0YXRpb24gc2VydmljZSBo YXMgYWxyZWFkeSBwcm9jZXNzZWQgdGhlIGxhc3QgTi0xCiAgICAgICAgc25hcHNob3RzLCBpdCBj YW4gZWZmaWNpZW50bHkgcGFyc2UgdGhyb3VnaCB0aGVtIGJ5IGp1c3QKICAgICAgICBwcm9jZXNz aW5nICJzbmFwc2hvdF9hZ2dyZWdhdGUiIGV2ZW50cyB0byBjb21wdXRlIHRoZSBQQ1IgcXVvdGVz CiAgICAgICAgbmVlZGVkIHRvIHZlcmlmeSB0aGUgZXZlbnRzIGluIHRoZSBsYXN0IHNuYXBzaG90 LiAgVGhpcyBzaG91bGQKICAgICAgICBkcmFzdGljYWxseSBpbXByb3ZlIHRoZSBJTUEgbG9nIHBy b2Nlc3NpbmcgZWZmaWNpZW5jeSBvZiB0aGUKICAgICAgICBzZXJ2aWNlLgoKLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0KfCBELjIgU25hcHNob3QgVHJpZ2dlcmluZyBNZWNoYW5pc20gICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KVGhlIHNuYXBzaG90IHRyaWdnZXJpbmcg bWVjaGFuaXNtIGlzIGFzIGRlc2NyaWJlZCBiZWxvdzoKCiAgICAgYS4gVGhlIElNQSBzdWJzeXN0 ZW0gd2lsbCBjcmVhdGUgYSBuZXcgZmlsZToKICAgICAgICAvc3lzL2tlcm5lbC9zZWN1cml0eS9p bWEvc25hcHNob3QKICAgICAgIChhLmsuYS4gc3lza19pbWFfc25hcHNob3RfZmlsZSkuCgogICAg IGIuIEEgVU0gcHJvY2VzcyBvcGVuaW5nIHRoaXMgZmlsZSB3aWxsIHRyaWdnZXIgYSBzbmFwc2hv dC4KICAgICAgICBUaGUgZmlsZSB3aWxsIGJlIG9wZW5lZCBleGNsdXNpdmVseSwgc28gb25seSBv bmUgVU0gcHJvY2VzcyBjYW4KICAgICAgICB0cmlnZ2VyIHRoZSBzbmFwc2hvdCBhdCBhIHRpbWUu CgogICAgIGMuIE9uY2UgdGhlIGtlcm5lbCBoYXMgd3JpdHRlbiB0aGUgInNuYXBzaG90X2FnZ3Jl Z2F0ZSIgbWFya2VyIHRvCiAgICAgICAgdGhlIElNQSBsb2csIHRoZSBJTUEgbG9nIHByaW9yIHRv IHRoYXQgZXZlbnQgY2FuIGJlIHJlYWQgYnkgVU0KICAgICAgICBvbiB0aGUgc2FtZSBGRC4KCiAg ICAgZC4gV2hlbiBVTSB3cml0ZXMgc29tZSBkYXRhIHRvICJzeXNrX2ltYV9zbmFwc2hvdF9maWxl IiwgdGhlIGtlcm5lbAogICAgICAgIHdpbGwgZmluYWxpemUgdGhlIHNuYXBzaG90IGJ5IHB1cmdp bmcgdGhlIGluLW1lbW9yeSBJTUEgbG9nLgoKICAgICBlLiBJZiBVTSBjbG9zZXMgInN5c2tfaW1h X3NuYXBzaG90X2ZpbGUiIHdpdGhvdXQgd3JpdGluZyB0byBpdCwKICAgICAgICB0aGUgS2VybmVs IHdpbGwgbm90IHB1cmdlIHRoZSBJTUEgbG9nLgoKICAgICBmLiBJZiBhIHN5c3RlbSBhZG1pbmlz dHJhdG9yIHJlcXVpcmVzIHRoYXQgb25seSBhIHNwZWNpZmljIGNsaWVudAogICAgICAgIHByb2Nl c3Mgc2hvdWxkIHRyaWdnZXIgdGhlIHNuYXBzaG90LCB0aGlzIGNhcGFiaWxpdHkgY2FuIGJlIHNl dAogICAgICAgIGFzIGFuIFNlTGludXggcG9saWN5LgoKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KfCBELjMgQ2hv b3NpbmcgQSBQZXJzaXN0ZW50IFN0b3JhZ2UgTG9jYXRpb24gRm9yIFNuYXBzaG90cyAgICAgICAg ICAgIHwKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0KQ2hvb3NpbmcgdGhlIHNuYXBzaG90IGxvY2F0aW9uIGlzIGhh bmRsZWQgYnkgdGhlIFVNIHByb2Nlc3MuICBUaGUKbG9jYXRpb24gc2hvdWxkIGJlIGEgd2VsbC1r bm93biBsb2NhdGlvbiwgcG90ZW50aWFsbHkgc2V0IGluIGEKY29uZmlndXJhdGlvbiBmaWxlIG9y IHRoZSBJTUEgcG9saWN5IGZpbGUgdW5kZXIgL2V0Yy4gIFRoZQpjb25maWd1cmF0aW9uIGZpbGUg c2hvdWxkIGJlIG1hcmtlZCBhcyByZWFkLW9ubHkgZm9yIFVNIHByb2Nlc3Nlcy4KClRoZSBLZXJu ZWwgd2lsbCB3YWl0IGZvciB0aGUgVU0gcHJvY2VzcyB0byBpbmRpY2F0ZSB0aGF0IHRoZSBjdXJy ZW50CklNQSBsb2cgaGFzIGJlZW4gd3JpdHRlbiB0byAiVU1fc25hcHNob3RfZmlsZSIgYW5kIG9u bHkgdGhlbiB0aGUgS2VybmVsCndpbGwgdHJ1bmNhdGUgdGhlIGluLW1lbW9yeSBJTUEgbG9nLiAg VU0gaXMgcmVzcG9uc2libGUgdG8gY2xlYXIgYW55CmV4aXN0aW5nIFVNX3NuYXBzaG90X2ZpbGUo cykgb24gc3lzdGVtIHN0YXJ0IG9yIG9uIGEgaGFyZCByZWJvb3QvcG93ZXIKY3ljbGUuCgpEdXJp bmcgdGhlIGZpcnN0IFJGQywgY29uY2VybnMgd2VyZSByYWlzZWQgb3ZlciB0aGUgcHJvdGVjdGlv bnMgb2YgdGhlCiJVTV9zbmFwc2hvdF9maWxlIi4gIEp1c3QgbGlrZSB0aGUgY3VycmVudCBJTUEg bG9nIHNlbnQgb3ZlciB0aGUKbmV0d29yayB0byB0aGUgYXR0ZXN0YXRpb24gc2VydmljZSwgdGhl ICJVTV9zbmFwc2hvdF9maWxlIiBmaWxlIGlzIG5vdApyZXNpc3RhbnQgdG8gbW9kaWZpY2F0aW9u cywgbmVpdGhlciBzaG91bGQgaXQgYmUuICBUaGUgVFBNIFBDUiBxdW90ZQpwcm92aWRlcyB0aGUg Z3VhcmFudGVlIHRoYXQgdGhlIElNQSBsb2cgaGFzIG5vdCBiZWVuIG1vZGlmaWVkIC0gdGhlCnNh bWUgUENSIHF1b3RlIGNvbnRpbnVlcyB0byBwcm92aWRlIHRoYXQgZ3VhcmFudGVlIGZvciB0aGUg c25hcHNob3QKZmlsZXMgYXMgd2VsbC4KVXNpbmcgdGhlIHRlbXBsYXRlIGRhdGEgaW4gdGhlIHNu YXBzaG90X2FnZ3JlZ2F0ZSBtYXJrZXIsIHRoZQphdHRlc3RhdGlvbiBzZXJ2aWNlIGNhbiB2YWxp ZGF0ZSB0aGUgaW50ZWdyaXR5IG9mIHRoZSBkYXRhIHByb3ZpZGVkIGluCnRoZSBwYXN0IHNuYXBz aG90cy4gIFRoZSBsb2cgaXMgdmFsaWRhdGVkIGFsbCB0aGUgd2F5IHRvIHRoZSBmaW5hbApldmVu dCwgd2hpY2ggaXMgdmFsaWRhdGVkIGJ5IHRoZSBQQ1IgcXVvdGUuCgotLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQp8 IEQuNCBSZW1vdGUtQXR0ZXN0YXRpb24gQ2xpZW50L1NlcnZpY2Utc2lkZSBDaGFuZ2VzICAgICAg ICAgICAgICAgICAgfAotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQpBIHJlbW90ZSBhdHRlc3RhdGlvbiBjbGllbnQg YW5kIHNlcnZpY2Ugd2lsbCBuZWVkIHRvIGJlIGF3YXJlIG9mIHRoZQoic25hcHNob3RfYWdncmVn YXRlIiBtYXJrZXIgYW5kIGhvdyBpdCBzaG91bGQgYmUgaGFuZGxlZC4gIEEgdHlwaWNhbAphdHRl c3RhdGlvbiBwYXRoIG9uIHRoZSBzeXN0ZW0gd2lsbCByZW1haW4gdGhlIHNhbWUgLSBzZW5kIHRo ZSBjdXJyZW50CklNQSBsb2cgYWxvbmcgd2l0aCB0aGUgc2lnbmVkIFRQTSBQQ1IgcXVvdGVzIHRv IHRoZSByZW1vdGUKYXR0ZXN0YXRpb24tc2VydmljZS4gIEJ1dCB0aGUgYXR0ZXN0YXRpb24gY2xp ZW50cyBhbmQgcmVtb3RlIHNlcnZpY2VzCm5lZWQgdG8gYmUgYXdhcmUgdGhhdCB0aGV5IG5lZWQg dG8gdXNlICJVTV9zbmFwc2hvdF9maWxlKHMpIiB0b28sCmFsb25nIHdpdGggUENSIHF1b3RlcyBh bmQgdGhlIGRhdGEgaW4gInNuYXBzaG90X2FnZ3JlZ2F0ZSIgZXZlbnQgaW4gSU1BCmxvZyB0byBy ZS1lc3RhYmxpc2ggdGhlIGNoYWluIG9mIHRydXN0IGlmIHRoZSBmZWF0dXJlIGlzIGVuYWJsZWQg YW5kIGEKc25hcHNob3QgaXMgdGFrZW4uCgpBcyBtZW50aW9uZWQgYWJvdmUsIGlmIHRoZSBleGlz dGluZyByZW1vdGUtYXR0ZXN0YXRpb24gY2xpZW50L3NlcnZpY2VzCmRvIG5vdCBjaGFuZ2UgdG8g YmVuZWZpdCBmcm9tIHRoZSBsb2cgc25hcHNob3R0aW5nIGZlYXR1cmUsIG9yIGRvIG5vdAp0cmln Z2VyIHRoZSBzbmFwc2hvdCwgdGhlIEtlcm5lbCB3aWxsIGNvbnRpbnVlIHRvIGhhdmUgaXQncyBj dXJyZW50CmZ1bmN0aW9uYWxpdHkgb2YgbWFpbnRhaW5pbmcgYW4gaW4tbWVtb3J5IGZ1bGwgSU1B IGxvZy4KCiAgIEQuNC5hIENsaWVudC1zaWRlIGNoYW5nZXMKLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KVG8gdXNl IHNuYXBzaG90IGZlYXR1cmUsIHRoZSBhdHRlc3RhdGlvbiBjbGllbnQgaXMgcmVxdWlyZWQgdG8g a25vdwogICAgIC0gaWYgc25hcHNob3R0aW5nIGlzIHN1cHBvcnRlZC9lbmFibGVkIGJ5IHRoZSBL ZXJuZWwKICAgICAtIGlmIHNuYXBzaG90dGluZyBpcyBzdXBwb3J0ZWQvZW5hYmxlZCBieSB0aGUg cmVtb3RlLWF0dGVzdGF0aW9uCiAgICAgICBzZXJ2aWNlIGl0IGludGVyYWN0cyB3aXRoCiAgICAg LSB0aGUgY29ycmVjdCBvcmRlciBvZiBVTV9zbmFwc2hvdF9maWxlKHMpIGZvciBiYWNrdHJhY2tp bmcgdGhyb3VnaAogICAgICAgdGhlIElNQSBsb2cKClRoZSBwcm90b2NvbCBiZXR3ZWVuIHRoZSBy ZW1vdGUtYXR0ZXN0YXRpb24gY2xpZW50IGFuZCBzZXJ2aWNlIG5lZWRzIHRvCmJlIHVwZGF0ZWQg dG8gc2VuZCBwcmV2aW91cyBzbmFwc2hvdHMgdG8gdGhlIHNlcnZpY2UgYXMgcmVxdWVzdGVkLgoK SWYgdGhlIHNlcnZpY2UgaXMgbm90IHlldCByZWFkeSB0byBwcm9jZXNzIHRoZSAic25hcHNob3Rf YWdncmVnYXRlIgpldmVudHMgYW5kIHRoZSBzbmFwc2hvdHMsIHRoZW4gdGhlIGNsaWVudHMgc2hv dWxkIG5vdCB3cml0ZSBhbnkgZGF0YSB0bwp0aGUgc3lza19pbWFfc25hcHNob3RfZmlsZSBiZWZv cmUgY2xvc2luZyBpdC4gIFRoaXMgd2lsbCBhZGQgdGhlCiJzbmFwc2hvdF9hZ2dyZWdhdGUiIG1h cmtlciB0byB0aGUgSU1BIGxvZyB3aXRob3V0IHB1cmdpbmcgdGhlIGxvZy4KT25jZSB0aGUgc2Vy dmljZSBpbXBsZW1lbnRzICJzbmFwc2hvdF9hZ2dyZWdhdGUiIGV2ZW50IHBhcnNpbmcsIHRoZQpj bGllbnQgY2FuIGltcGxlbWVudCB0aGUgZnVuY3Rpb25hbGl0eSB0byAgd3JpdGUgdG8gdGhlCiJz eXNrX2ltYV9zbmFwc2hvdF9maWxlIiBlYWNoIHRpbWUgaXQgdHJpZ2dlcnMgdGhlIHNuYXBzaG90 LiAgVGhpcwp3b3VsZCBpbmRpY2F0ZSB0byB0aGUgS2VybmVsIHRoYXQgdGhlIGxvZyBzaG91bGQg YmUgcHVyZ2VkLgoKICAgRC40LmIgU2VydmljZS1zaWRlIGNoYW5nZXMKLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0K Rm9yIHRoZSByZW1vdGUgYXR0ZXN0YXRpb24gdG8gd29yaywgdGhlIHNlcnZpY2Ugd2lsbCBuZWVk IHRvIGtub3cgaG93CnRvIHZhbGlkYXRlIHRoZSAic25hcHNob3RfYWdncmVnYXRlIiBlbnRyeSBp biB0aGUgSU1BIGxvZy4gIEl0IHdpbGwKaGF2ZSB0byByZWFkIHRoZSBQQ1IgdmFsdWVzIHByZXNl bnQgaW4gdGhlIHRlbXBsYXRlIGRhdGEgb2YgdGhlCiJzbmFwc2hvdF9hZ2dyZWdhdGUiIGV2ZW50 IGluIHRoZSBsYXRlc3QgSU1BIGxvZyBzZWdtZW50LCBhbmQgZW5zdXJlCnRoYXQgdGhlIFBDUiBx dW90ZXMgYWxpZ24gd2l0aCB0aGUgY29udGVudHMgb2YgdGhlIHBhc3QKVU1fc25hcHNob3RfZmls ZShzKS4gIFRoaXMgd2lsbCByZS1lc3RhYmxpc2ggdGhlIGNoYWluIG9mIHRydXN0IG5lZWRlZApm b3IgdGhlIHN5c3RlbSB0byBwYXNzIHJlbW90ZSBhdHRlc3RhdGlvbi4gIFRoaXMgd2lsbCBhbHNv IG1haW50YWluIHRoZQphYmlsaXR5IG9mIHRoZSByZW1vdGUtYXR0ZXN0YXRpb24gc2VydmljZSB0 byBzZWFsIHRoZSBzZWNyZXRzLCBpZiB0aGUKY2xpZW50LXNlcnZlciB1c2UgVFBNIHNlYWwvdW5z ZWFsIG1lY2hhbmlzbSB0byBhdHRlc3QgdGhlIHN0YXRlIG9mIHRoZQpzeXN0ZW0uCgpUaGUgY2xp ZW50LXNlcnZpY2UgcHJvdG9jb2wgd2lsbCBuZWVkIGFuIGltcGxlbWVudGF0aW9uIGZvciByZXF1 ZXN0aW5nCnByZXZpb3VzIHNuYXBzaG90cyBvZiB0aGUgSU1BIGxvZ3MuICBUaGVyZSBtYXkgYmUg dmFyaW91cyBzY2VuYXJpb3MKd2hlbiBzdWNoIGEgcmVxdWVzdCBpcyBtYWRlIHN1Y2ggYXM6CiAg ICAgLSB0aGUgc2VydmljZSBpcyBzdGF0ZWxlc3MgYW5kIHJlcXVpcmVzIGFsbCB0aGUgZGF0YSBz aW5jZSBib290CiAgICAgICBmb3IgZXZhbHVhdGluZyBpZiB0aGUgYXR0ZXN0YXRpb24gc2hvdWxk IHN1Y2NlZWQgb3Igbm90LgogICAgIC0gdGhlcmUgYXJlIGxpbmtlZCBJTUEgZXZlbnRzIHRoYXQg YXJlIHNwbGl0IGFjcm9zcyBhIHNuYXBzaG90CiAgICAgICBib3VuZGFyeQogICAgIC0gdGhlIGV4 cGVjdGVkIGV2ZW50IHRoYXQgdGhlIHNlcnZpY2UgaXMgbG9va2luZyBmb3IgaXMgbm90IHByZXNl bnQKICAgICAgIGluIHRoZSBjdXJyZW50IGxpc3Qgb2YgSU1BIGxvZyArIFVNX3NuYXBzaG90X2Zp bGUocykuCgpUaGUgc2VydmljZSB3aWxsIG5lZWQgdG8gcmVxdWVzdCB0aGUgY2xpZW50IHRvIHNl bmQgdGhlIG9sZApVTV9zbmFwc2hvdF9maWxlKHMpIGFuZCBlbnN1cmUgdGhhdCB0aGUgbG9nIHJl cGxheSBzdGlsbCBnZW5lcmF0ZXMgdGhlCmV4cGVjdGVkIFBDUiB2YWx1ZXMgcHJvdmlkZWQgaW4g dGhlIHF1b3RlLgoKVG8gYXZvaWQgYXNraW5nIGZvciBwcmV2aW91cyBzbmFwc2hvdCBjaHVua3Mg ZnJvbSB0aGUgc3lzdGVtLCB0aGUKc2VydmljZSBtYXkgbWFpbnRhaW4gdGhlIHBhc3QgYXR0ZXN0 YXRpb24gc3RhdHVzIG9mIHRoZSBzeXN0ZW0gYXQgYQpnaXZlbiBzbmFwc2hvdCBjaGVja3BvaW50 LiAgVGhpcyB3b3VsZCBtYWtlIHRoZSBzZXJ2aWNlIG1vcmUgZWZmaWNpZW50CmluIHByb2Nlc3Np bmcgSU1BIGxvZ3MgZm9yIGF0dGVzdGF0aW9uLiAgSXQgd2lsbCByZWR1Y2UgdGhlIHBlcnNpc3Rl bnQKc3RvcmFnZSBzcGFjZSByZXF1aXJlbWVudHMgb24gdGhlIGNsaWVudC4gIEJ1dCBpdCB3b3Vs ZCByZXF1aXJlIHRoZQpzZXJ2aWNlIHRvIGJlIHN0YXRlZnVsLiAgSXQncyBhIHRyYWRlLW9mZiB3 aGljaCBuZWVkcyB0byBiZSBldmFsdWF0ZWQKYnkgdGhlIG93bmVycyBvZiB0aGUgcmVtb3RlIGF0 dGVzdGF0aW9uIHNlcnZpY2UuCgpJZiB0aGUgY2xpZW50cyBhcmUgbm90IHlldCB1cGRhdGVkIHRv IHRyaWdnZXIgc25hcHNob3RzLCB0aGV5IHdpbGwKc3RpbGwgYmUgc2VuZGluZyB0aGUgSU1BIGxv ZyBpbiBpdHMgZW50aXJldHkgd2l0aG91dCBhbnkKInNuYXBzaG90X2FnZ3JlZ2F0ZSIgZXZlbnQg cmVjb3JkZWQgaW4gdGhlIGxvZy4gIFByb2Nlc3Npbmcgc3VjaCBJTUEKbG9ncyBpcyBhbiBleGlz dGluZyBzZXJ2aWNlIGJlaGF2aW9yLCBhbmQgdGhlIHNlcnZpY2Ugc2hvdWxkIGNvbnRpbnVlCnN1 cHBvcnRpbmcgaXQgdW50aWwgYWxsIHRoZSBjbGllbnRzIGFyZSB1cGRhdGVkIHRvIHRha2UgSU1B IGxvZwpzbmFwc2hvdHMuICBUaGUgc2VydmljZSBjYW4gdXNlIHRoZSBwcmVzZW5jZSBvZiB0aGUK InNuYXBzaG90X2FnZ3JlZ2F0ZSIgZXZlbnQgaW4gdGhlIElNQSBsb2cgdG8gZGV0ZXJtaW5lIGFu ZCB0cmFjayB3aGljaApjbGllbnRzIGluIHRoZSBmbGVldCBoYXZlIHRoZSBjYXBhYmlsaXR5IHRv IGdlbmVyYXRlIElNQSBsb2cgc25hcHNob3QuCgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQp8IEUuIEV4YW1wbGUg V2Fsay10aHJvdWdoICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg fAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PQpUaGlzIHNlY3Rpb24gcHJvdmlkZXMgYW4gZXhhbXBsZSB3YWxrLXRo cm91Z2ggb2YgdGhlIElNQSBsb2cgc25hcHNob3QKY2FwdHVyaW5nIHNjZW5hcmlvLiAgQXNzdW1l IGEgc3lzdGVtIGhhcyBiZWxvdyBJTUEgbG9nIGJlZm9yZSBhCnNuYXBzaG90IGlzIHRha2VuLgri lIzilIDilIDilIDilKzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilKzi lIDilIDilIDilIDilIDilIDilIDilIDilKzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilKzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lKzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilJAK4pSCUENS4pSCVGVtcGxh dGUgSGFzaOKUglRlbXBsYXRl4pSCIERhdGEgSGFzaCAg4pSCICAgRGF0YSBGaWxlICAgIOKUglRl bXBsYXRlRGF0YeKUggrilJzilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDilIDilIDi lIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilKQK 4pSCMTAg4pSCMzIyYTg0NzM4NS4uLuKUgmltYS1zaWcg4pSCc2hhMjU2OjMwOS4u4pSCYm9vdF9h Z2dyZWdhdGUgIOKUgiAgICAgICAgICAgIOKUggrilJzilIDilIDilIDilLzilIDilIDilIDilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilLzi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilIDilIDilKQK4pSCMTAg4pSCOTJkYmY1NTA2MS4uLuKUgmltYS1idWYg4pSCc2hhMjU2 OmI5My4u4pSCa2VybmVsX3ZlcnNpb24uLuKUgjM1MjM0MjM0Ny4uLuKUggrilJzilIDilIDilIDi lLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDilIDi lIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilKQK4pSCMTEg4pSCZThlMTJkOTUzMi4uLuKUgmlt YS1idWYg4pSCc2hhMjU2OmNkMC4u4pSCZG1fdGFibGVfbG9hZC4uIOKUgjU2ODk1Njg5OS4uLuKU ggrilJzilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lLzilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilKQK4pSCMTIg4pSCZThl MTJkOTUzMi4uLuKUgmltYS1zaWcg4pSCc2hhMjU2OjU2MC4u4pSCL3Vzci9saWIvbW9kdWwuLuKU giAgICAgICAgICAgIOKUggrilJTilIDilIDilIDilLTilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilIDilIDilIDilLTilIDilIDilIDilIDilIDilIDilIDilIDilLTilIDilIDilIDilIDi lIDilIDilIDilIDilIDilIDilIDilIDilLTilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilIDilIDilIDilIDilLTilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lJgKCkZvciB0aGlzIGV4YW1wbGUsIHRoZSBQQ1IgdmFsdWVzIGluIHNoYTI1NiBiYW5rIGFyZSBh cyBmb2xsb3dzOgoKICAgICBzaGEyNTY6CiAgICAgICAgIDAgOiAweERBMDA5Q0I5RERCRjJERjIu Li44RDNDQUU1MTZBOTk4NDcyNjI3OTA0NzkzNjhGODJCNgogICAgICAgICAuLi4KICAgICAgICAg Li4uCiAgICAgICAgIDEwOiAweEI5M0VCRjY4RkM2NkM2QjYuLi4zMDNCQzBENURBMEI0MTlGMDU5 REUyN0VBRTNCQUEyOQogICAgICAgICAxMTogMHhDRDAwQUJCM0Q4NERCMEYwLi4uMDFBMUFEQ0RD QURCMTVERUVENDdCQTZGQ0U0MEQ0MjAKICAgICAgICAgMTI6IDB4NTYwMTUzRkI2QTBDQzYwMy4u Ljg5MkJCNDg3NzI2ODJGNjkyRTQ0QTAzOTMyODFEQjQ1CiAgICAgICAgIC4uLgogICAgICAgICAu Li4KICAgICAgICAgMjM6IDB4MDAwMDAwMDAwMDAwMDAwMC4uLjAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwCgpJZiBhIHNuYXBzaG90IGlzIHRha2VuIGF0IHRoaXMgcG9pbnQsIHRoZSBj dXJyZW50IElNQSBsb2cgd2lsbCBiZQp3cml0dGVuIHRvIHRoZSBkaXNrLiAgVGhlIGV2ZW50cyBn ZW5lcmF0ZWQgYmV0d2VlbiB0aGUgd2luZG93IG9mCiJ0cmlnZ2VyaW5nIG9mIGEgc25hcHNob3Qi IGFuZCAiY29tcHV0YXRpb24gYW5kIG1lYXN1cmVtZW50IG9mIHRoZQpzbmFwc2hvdF9hZ2dyZWdh dGUgZXZlbnQgZGF0YSIgd2lsbCBiZSBxdWV1ZWQsIGFuZCB0aGV5IHdpbGwgYmUKbWVhc3VyZWQg aW4gdGhlIElNQSBsb2cgYWZ0ZXIgdGhlICJzbmFwc2hvdF9hZ2dyZWdhdGUiIGV2ZW50IGRhdGEg aXMKY29tcHV0ZWQgYW5kIG1lYXN1cmVkLgoKVGhlIHN0YXRlIG9mIHRoZSBJTUEgbG9nIGFmdGVy IHRoZSBzbmFwc2hvdDoK4pSM4pSA4pSA4pSA4pSs4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSs4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSs4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSs4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSs4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSQ CuKUglBDUuKUglRlbXBsYXRlIOKUglRlbXBsYXRl4pSCIERhdGEgSGFzaCDilIIgICAgIERhdGEg RmlsZSAgICDilIIgVGVtcGxhdGUgICAgICDilIIK4pSCICAg4pSCIEhhc2ggICAg4pSCICAgICAg ICDilIIgICAgICAgICAgIOKUgiAgICAgICAgICAgICAgICAgIOKUgiAgIERhdGEgICAgICAgIOKU ggrilJzilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDi lIDilIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilKQK4pSCMTAg4pSCZTU1 Y2JhLi4u4pSCaW1hLWJ1ZiDilIJTaGEyNTY6MzBhLuKUgnNuYXBzaG90X2FnZ3JlZ2F0ZeKUgjxU RU1QTEFURV9EQVRBPuKUggrilIIgICDilIIgICAgICAgICDilIIgICAgICAgIOKUgiAgICAgICAg ICAg4pSCICAgICAgICAgICAgICAgICAg4pSCc2VlIHRoZSBncmFtbWFy4pSCCuKUgiAgIOKUgiAg ICAgICAgIOKUgiAgICAgICAg4pSCICAgICAgICAgICDilIIgICAgICAgICAgICAgICAgICDilIIg ICBiZWxvdyAgICAgICDilIIK4pSU4pSA4pSA4pSA4pS04pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pS04pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pS04pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pS04pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pS04pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSYCgogIHdoZXJlIHRoZSBEYXRhIEhhc2ggb2YgdGhlIGxvZyBsaW5lIGlzIC0KICBBcHBlbmQo SChzbmFwc2hvdF9maWxlKSxQQ1IwLFBDUjEsLi4uUENSMjMpLiAgQWxsIGF2YWlsYWJsZSBQQ1Ig YmFua3MKICB3aWxsIGJlICBpbmNsdWRlZCBpbiB0aGUgdGVtcGxhdGUgZGF0YSBpbiBhIGtub3du IHN0cnVjdHVyZS4KClRoZSBUZW1wbGF0ZSBEYXRhIHdpbGwgZm9sbG93IHRoZSBncmFtbWFyIGJl bG93OgogICAgIFRFTVBMQVRFX0RBVEEgICAgICA6PSA8U25hcHNob3RfQ291bnRlcj4iOyI8UENS X0JhbmtzPiI7IgogICAgIFNuYXBzaG90X0NvdW50ZXIgICA6PSAiU25hcHNob3RfQXR0ZW1wdF9D b3VudD0iCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8bnVtLiBzbmFwc2hvdCBhdHRl bXB0cz4KICAgICBQQ1JfQmFua3MgICAgICAgICAgOj0gPFBDUl9CYW5rPiI7Inw8UENSX0Jhbmtz PiAiLCIgPFBDUl9CYW5rPiI7IgogICAgIFBDUl9CYW5rICAgICAgICAgICA6PSA8UENSX0hhc2gg VHlwZT4gIjoiIDxQQ1JuPgogICAgIFBDUl9IYXNoX1R5cGUgICAgICA6PSAic2hhMSJ8InNoYTI1 NiJ8InNoYTM4NCIKICAgICBQQ1JuICAgICAgICAgICAgICAgOj0gIlBDUiI8Tj4iOiI8UENSX0hh c2g+CiAgICAgUENSX0hhc2ggICAgICAgICAgIDo9IDxoYXNoIG9mIHRoZSBQQ1IgTj4KICAgICBO ICAgICAgICAgICAgICAgICAgOj0gWzAtMjNdCgpUaGUgc3RhdGUgb2YgdGhlIFBDUnMgYWZ0ZXIg dGhlIHNuYXBzaG90OgogICAgIChPbmx5IFBDUiAxMCB3aWxsIGNoYW5nZSwgc2luY2UgInNuYXBz aG90X2FnZ3JlZ2F0ZSIgaXMgZXh0ZW5kZWQKICAgICAgaW4gdGhhdCBQQ1IuKQogICAgIHNoYTI1 NjoKICAgICAgICAgMCA6IDB4REEwMDlDQjlEREJGMkRGMi4uLjhEM0NBRTUxNkE5OTg0NzI2Mjc5 MDQ3OTM2OEY4MkI2CiAgICAgICAgIC4uLgogICAgICAgICAuLi4KICAgICAgICAgMTAgOiAweDMw QTFCNjlGMDlBOTU5OS4uLjI1MTgzOTRBOEUxQTNCOEQzNDNENDQ1OEU2RkIwQjA0CiAgICAgICAg IDExIDogMHhDRDAwQUJCM0Q4NERCMEYuLi4wMUExQURDRENBREIxNURFRUQ0N0JBNkZDRTQwRDQy MAogICAgICAgICAxMiA6IDB4NTYwMTUzRkI2QTBDQzYwLi4uODkyQkI0ODc3MjY4MkY2OTJFNDRB MDM5MzI4MURCNDUKICAgICAgICAgLi4uCiAgICAgICAgIC4uLgogICAgICAgICAyMzogMHgwMDAw MDAwMDAwMDAwMDAwLi4uMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAKCkFuIGV4YW1w bGUgb2YgInNuYXBzaG90X2FnZ3JlZ2F0ZSIgdGVtcGxhdGUgZGF0YSBpcyBnaXZlbiBiZWxvdy4K MTAgZTU1Y2JhLi4uIGltYS1idWYgIFNoYTI1NjozMGEuLi4gc25hcHNob3RfYWdncmVnYXRlCiAg ICAgU25hcHNob3RfQXR0ZW1wdF9Db3VudD03OwogICAgIHNoYTI1NjpQQ1IwOjB4REEwMDlDQjlE REJGMkRGMi4uLjhEM0NBRTUxNkE5OTg0NzI2Mjc5MDQ3OTM2OEY4MkI2LAogICAgIHNoYTI1NjpQ Q1IxOjB4MzBBMUI2OUYwOUE5NTk5RS4uLjI1MTgzOTRBOEUxQTNCOEQzNDNENDQ1OEU2RkIwQjA0 LAogICAgIC4uLgogICAgIHNoYTI1NjpQQ1IyMzoweDMwQTFCNjlGMDlBOTU5OS4uLjI1MTgzOTRB OEUxQTNCOEQzNDNENDQ1OEU2RkIwQjA0OwoKRnV0dXJlIElNQSBldmVudHMgY2FuIHRoZW4gY29u dGludWUgdG8gYmUgZXh0ZW5kZWQgaW4gdGhlIGFzc2lnbmVkIFBDUnMKYW5kIGFkZGVkIGluIHRo ZSBJTUEgbG9nIGFmdGVyIHNuYXBzaG90X2FnZ3JlZ2F0ZS4gIFNpbmNlIElNQQptZWFzdXJlbWVu dHMgZXh0ZW5kIHRoZSBUUE0tUENScyBhbmQgY29tcHV0aW5nIHNuYXBzaG90X2FnZ3JlZ2F0ZQpp bnZvbHZlcyByZWFkaW5nIFRQTSBQQ1IgYmFua3MsIElNQSBtZWFzdXJlbWVudHMgbXVzdCBiZSBz dXNwZW5kZWQKdW50aWwgdGhlIHNuYXBzaG90X2FnZ3JlZ2F0ZSBpcyBjb21wdXRlZCBhbmQgbWVh c3VyZWQuICBPdGhlcndpc2UsCnRoZXNlIHR3byBvcGVyYXRpb25zIG1heSBpbnRlcmZlcmUgd2l0 aCBlYWNoIG90aGVyIGNvbXByb21pc2luZyB0aGUKaW50ZWdyaXR5IG9mIHRoZSBzeXN0ZW0uCgpU aGUgcmVtb3RlLWF0dGVzdGF0aW9uLXNlcnZpY2UgY2FuIHZlcmlmeSB0aGUgY29udGVudHMgb2Yg dGhlIHBhc3QKKE4tMSkgVU1fc25hcHNob3RfZmlsZShzKSBieSByZXBsYXlpbmcgdGhlIGV2ZW50 cyBpbiB0aGVtIGFuZCBjb21wYXJpbmcKdGhlbSB3aXRoIHRoZSBQQ1IgdmFsdWVzIHN0b3JlZCBp biB0ZW1wbGF0ZSBkYXRhIG9mIHRoZSBmaXJzdAoic25hcHNob3RfYWdncmVnYXRlIiBldmVudCBv ZiBzdWJzZXF1ZW50IElNQSBsb2cuCgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQp8IEYuIE90aGVyIERlc2lnbiBD b25zaWRlcmF0aW9ucyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfAo9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PQogICAgIGEuIEluIHYxIG9mIHRoaXMgUkZDIHByb3Bvc2FsICwgaXQgd2FzIGRp c2N1c3NlZCBbNV0gaWYgd2Ugc2hvdWxkCiAgICAgICAgdXNlIFRQTS1QQ1IgdXBkYXRlIGNvdW50 ZXIgaW4gdGhlICJzbmFwc2hvdF9hZ2dyZWdhdGUiIGV2ZW50LgogICAgICAgICAgICA9PiBBZnRl ciB0aGUgaW5pdGlhbCBpbnZlc3RpZ2F0aW9uIGFuZCBwcm90b3R5cGluZ1szXSwgd2UKICAgICAg ICAgICAgICAgZGlzY292ZXJlZCB0aGUgVFBNIFBDUiBjb3VudGVyIGdldHMgaW5jcmVtZW50ZWQg d2hlbiBhbnkKICAgICAgICAgICAgICAgb2YgdGhlIFBDUnMgaW4gdGhlIFBDUiBiYW5rIGdldHMg dXBkYXRlZC4gIFRoZSBjb3VudGVyIGlzCiAgICAgICAgICAgICAgIG5vdCBzcGVjaWZpYyB0byBh bnkgc2luZ2xlIFBDUiAoZS5nLiBQQ1IgMTAgd2hlcmUgSU1BCiAgICAgICAgICAgICAgIGV4dGVu ZHMgdGhlIG1lYXN1cmVtZW50cyBieSBkZWZhdWx0KS4KICAgICAgICAgICAgICAgQWRkaW5nIFRQ TSBQQ1IgY291bnRlciB0byAic25hcHNob3RfYWdncmVnYXRlIiBldmVudAogICAgICAgICAgICAg ICB3b24ndCBwcm92aWRlIGFueSBhZGRpdGlvbmFsIGJlbmVmaXRzLCB0aGVyZWZvcmUgd2UgZG8K ICAgICAgICAgICAgICAgbm90IHBsYW4gdG8gaW5jbHVkZSBpdCBpbiBhbnkgb2YgdGhlIElNQSBs b2cKICAgICAgICAgICAgICAgbWVhc3VyZW1lbnRzLgoKICAgICBiLiBJbiB2MSBvZiB0aGlzIFJG QyBwcm9wb3NhbCAsIGl0IHdhcyBkaXNjdXNzZWQgWzZdIGlmIHdlIHNob3VsZAogICAgICAgIGFk ZCB0aGUgRUsvQUlLIFB1YmxpYyBDZXJ0IGFzIHBhcnQgb2YgInNuYXBzaG90X2FnZ3JlZ2F0ZSIg ZXZlbnQKICAgICAgICBkYXRhLgogICAgICAgICAgICA9PiBJbiBhIHR5cGljYWwgcmVtb3RlIGF0 dGVzdGF0aW9uIHNjZW5hcmlvIHRoYXQgZG9lcyBub3QKICAgICAgICAgICAgICAgdXNlIElNQSBs b2cgc25hcHNob3R0aW5nLCB0aGUgRUsvQUlLIHB1YmxpYyBjZXJ0CiAgICAgICAgICAgICAgIHR5 cGljYWxseSBuZWVkcyB0byBiZSBzZW50IHRvIHRoZSByZW1vdGUgYXR0ZXN0YXRpb24KICAgICAg ICAgICAgICAgc2VydmljZSBhbG9uZyB3aXRoIElNQSBsb2cgYW5kIFRQTSBQQ1IgcXVvdGVzLiAg VGhlCiAgICAgICAgICAgICAgIEVLL0FJSyBwdWJsaWMgY2VydCB2ZXJpZmllcyB0aGF0IHRoZSBU UE0gUENSIHF1b3RlcyBhcmUKICAgICAgICAgICAgICAgc2lnbmVkIGJ5IGEgZ2VudWluZSBUUE0s IHdoaWNoIGluIHR1cm4gdmVyaWZpZXMgdGhhdCB0aGUKICAgICAgICAgICAgICAgSU1BIGxvZyBp cyBub3QgdGFtcGVyZWQgd2l0aC4gIFNpbmNlIHRoZSBFSy9BSUsgcHVibGljCiAgICAgICAgICAg ICAgIGNlcnQgaXMgYW55d2F5cyBzZW50IG91dHNpZGUgb2YgdGhlIElNQSBsb2cgaW4gdGhpcwog ICAgICAgICAgICAgICBzY2VuYXJpbywgaXQgaXMgbm90IG5lZWRlZCB0byBiZSBzZW50IGFzIHBh cnQgb2YgSU1BIGxvZwogICAgICAgICAgICAgICBhZ2Fpbi4gIEluIG90aGVyIHNjZW5hcmlvcyAo ZS5nLiBzZWFsL3Vuc2VhbCwgYW5kIHNvbWUKICAgICAgICAgICAgICAgY2FzZXMgZlRQTS92VFBN KSwgdGhlIEVLL0FJSyBwdWJsaWMgY2VydCBpcyBlaXRoZXIKICAgICAgICAgICAgICAgdW5hdmFp bGFibGUgb3IgaXMgbm90IHVzZWQgZm9yIHJlbW90ZSBhdHRlc3RhdGlvbi4KICAgICAgICAgICAg ICAgVGhlcmVmb3JlIHdlIHdpbGwgbm90IGJlIGFkZGluZyB0aGUgRUsvQUlLIHB1YmxpYyBjZXJ0 IGFzCiAgICAgICAgICAgICAgIHBhcnQgb2YgInNuYXBzaG90X2FnZ3JlZ2F0ZSIgZXZlbnQgZGF0 YS4KCiAgICAgYy4gSW4gb25lIG9mIHRoZSBwcmV2aW91cyBhdHRlbXB0cyBzbyB0byBleHBvcnQg dGhlIElNQSBsb2cgWzRdLAogICAgICAgIHNldmVyYWwgYXNwZWN0cyBvZiB0aGUgcHJvYmxlbSB3 ZXJlIGRpc2N1c3NlZC4KICAgICAgICAgICAgbyAiVGhlIGltcGxpY2F0aW9ucyBvZiBleHBvcnRp bmcgYW5kIHJlbW92aW5nIHJlY29yZHMgZnJvbQogICAgICAgICAgICAgIHRoZSBJTUEgbWVhc3Vy ZW1lbnQgbGlzdCBuZWVkcyB0byBiZSBjb25zaWRlcmVkIGNhcmVmdWxseSIKICAgICAgICAgICAg ICAgICAgPT4gV2UgYXJlIGFkZHJlc3NpbmcgdGhhdCBpbiB0aGlzIGRlc2lnbiBieQogICAgICAg ICAgICAgICAgICAgICBpbnRyb2R1Y2luZyB0aGUgSU1BIGV2ZW50ICJzbmFwc2hvdF9hZ2dyZWdh dGUiLCBhCiAgICAgICAgICAgICAgICAgICAgIHdlbGwga25vd24gbG9jYXRpb24gdG8gc3RvcmUg dGhlbSwgY29vcmRpbmF0aW9uCiAgICAgICAgICAgICAgICAgICAgIGJldHdlZW4gdGhlIEtlcm5l bCBhbmQgdGhlIFVNIHByb2Nlc3MgdG8gdHJpZ2dlcgogICAgICAgICAgICAgICAgICAgICBhbmQg Y2FwdHVyZSB0aGUgc25hcHNob3QsIGFuZCBwcm92aWRpbmcgZ3VpZGFuY2UgdG8KICAgICAgICAg ICAgICAgICAgICAgdGhlIGNsaWVudC9zZXJ2aWNlIHRvIHByb2Nlc3MgdGhlIGV2ZW50cy4KICAg ICAgICAgICAgbyBDb25mbGF0aW5nIHRoZSB0d28gZGlmZmVyZW50IHVzZSBjYXNlcyAtIGkuZS4g Ym90aCBVTSBhbmQKICAgICAgICAgICAgICB0aGUgS2VybmVsIHJlcXVlc3RpbmcgZXhwb3J0aW5n IGFuZCByZW1vdmluZyBvZiB0aGUKICAgICAgICAgICAgICBtZWFzdXJlbWVudCBsaXN0IHJlY29y ZHMuCiAgICAgICAgICAgICAgICAgID0+IFdlIGFyZSBhZGRyZXNzaW5nIHRoYXQgaW4gdGhpcyBk ZXNpZ24gYnkgYWxsb3dpbmcKICAgICAgICAgICAgICAgICAgICAgb25seSBVTSB0byByZXF1ZXN0 IHRoZSBzbmFwc2hvdCwgYW5kIHN0b3JlIGl0IG9uCiAgICAgICAgICAgICAgICAgICAgIHRoZSB3 ZWxsIGtub3duIHBlcnNpc3RlbnQgc3RvcmFnZS4gIFdoZXJlYXMgb25seQogICAgICAgICAgICAg ICAgICAgICBLZXJuZWwgYmVpbmcgcmVzcG9uc2libGUgZm9yIHJlbW92aW5nIHRoZSBleHBvcnRl ZAogICAgICAgICAgICAgICAgICAgICBldmVudHMgZnJvbSB0aGUgS2VybmVsIG1lbW9yeS4KICAg ICAgICAgICAgICAgICAgICAgVGhlIHJlc3BvbnNpYmlsaXRpZXMgb2YgdGhlIEtlcm5lbCBhbmQg VU0gY2xpZW50IGFyZQogICAgICAgICAgICAgICAgICAgICBjbGVhcmx5IGRlZmluZWQsIGFuZCB0 aGV5IGFyZSBkaXN0aW5jdCBmcm9tIGVhY2gKICAgICAgICAgICAgICAgICAgICAgb3RoZXIuCiAg ICAgICAgICAgIG8gVGhlIGZlZWRiYWNrIGZyb20gdGhlIElNQSBtYWludGFpbmVyIG9uIGV4cG9y dGluZyB0aGUgSU1BCiAgICAgICAgICAgICAgbG9nIFs0XSB3YXMgdGhhdCB0aGUgdXNlci1zcGFj ZSB3b3VsZCBiZSByZXNwb25zaWJsZSBmb3IKICAgICAgICAgICAgICBzYWZlbHkgc3RvcmluZyB0 aGUgbWVhc3VyZW1lbnRzLiAgVGhlIGtlcm5lbCB3b3VsZCBvbmx5IGJlCiAgICAgICAgICAgICAg cmVzcG9uc2libGUgZm9yIGxpbWl0aW5nIHBlcm1pc3Npb24sIHBlcmhhcHMgYmFzZWQgb24gYQog ICAgICAgICAgICAgIGNhcGFiaWxpdHksIGJlZm9yZSByZW1vdmluZyByZWNvcmRzIGZyb20gdGhl IG1lYXN1cmVtZW50CiAgICAgICAgICAgICAgbGlzdC4KICAgICAgICAgICAgICAgICAgPT4gV2Ug aGF2ZSBpbmNvcnBvcmF0ZWQgdGhpcyBmZWVkYmFjayBpbiBvdXIgZGVzaWduLgogICAgICAgICAg ICAgICAgICAgICAgLSBUaGUgVU0gcHJvY2VzcyB0cmlnZ2VycyB0aGUgc25hcHNob3QuCiAgICAg ICAgICAgICAgICAgICAgICAtIFRoZSBVTSBwcm9jZXNzIGlzIHJlc3BvbnNpYmxlIGZvciBzdG9y aW5nIHRoZQogICAgICAgICAgICAgICAgICAgICAgICBzbmFwc2hvdCBvbiB0aGUgcGVyc2lzdGVu dCBzdG9yYWdlLgogICAgICAgICAgICAgICAgICAgICAgLSBUaGUgS2VybmVsIGNvLW9yZGluYXRl cyB3aXRoIHRoZSBVTSBwcm9jZXNzCiAgICAgICAgICAgICAgICAgICAgICAgIGJlZm9yZSByZW1v dmluZyB0aGUgcmVjb3JkcyBmcm9tIHRoZSBtZWFzdXJlbWVudAogICAgICAgICAgICAgICAgICAg ICAgICBsaXN0LgoKICAgICBkLiBJbiB2MSBvZiB0aGlzIFJGQyBwcm9wb3NhbCwgc29tZSBjbGFy aWZpY2F0aW9uIHdhcyBuZWVkZWQgdG8KICAgICAgICBhZGRyZXNzIHRoZSBhdHRlc3RhdGlvbiBj bGllbnQgcmVzdGFydHMgYW5kIHRoZSByZW1vdGUKICAgICAgICBhdHRlc3RhdGlvbiBzZXJ2aWNl IGJlaW5nIHN0YXRlbGVzc1s3XS4KICAgICAgICAgICAgPT4gQXMgbWVudGlvbmVkIGluIHRoZSAi Tm9uLUdvYWxzIiBzZWN0aW9uIGFib3ZlLAogICAgICAgICAgICAgICBpbXBsZW1lbnRpbmcgdGhl IGNoYW5nZXMgbmVlZGVkIGluIHRoZSByZW1vdGUgYXR0ZXN0YXRpb24KICAgICAgICAgICAgICAg Y2xpZW50L3NlcnZpY2UgYXJlIG91dCBvZiBzY29wZSBmb3IgdGhpcyBkb2N1bWVudC4KICAgICAg ICAgICAgICAgSG93ZXZlciwgdGFraW5nIHRoZSBJTUEgbG9nIHNuYXBzaG90cyBzaG91bGQgbm90 CiAgICAgICAgICAgICAgIGludGVyZmVyZSB3aXRoIHRoZSBhYmlsaXR5IG9mIHRoZSBjbGllbnQg dG8gcmVzdGFydCBhdAogICAgICAgICAgICAgICBhbnkgcG9pbnQuICBFdmVuIGlmIHRoZSBjbGll bnQgcmVzdGFydHMgYW5kIGRvZXMgbm90IHdyaXRlCiAgICAgICAgICAgICAgIGFueSBkYXRhIHRv ICJzeXNrX2ltYV9zbmFwc2hvdF9maWxlIiBhZnRlciByZWNvcmRpbmcgdGhlCiAgICAgICAgICAg ICAgICJzbmFwc2hvdF9hZ2dyZWdhdGUiIGV2ZW50LCBJTUEgd2lsbCBub3QgcHVyZ2UgdGhlIHJl Y29yZHMKICAgICAgICAgICAgICAgZnJvbSB0aGUgSU1BIGxvZy4gIFRoZXJlIGlzIG5vIGRhdGEg bG9zcywgYW5kIHRoZSBzeXN0ZW0KICAgICAgICAgICAgICAgb3ZlcmFsbCBrZWVwcyB0aGUgYWJp bGl0eSB0byBhdHRlc3QgaXRzZWxmIHJlbW90ZWx5LgogICAgICAgICAgICAgICBTaW1pbGFybHks IHRoZSByZW1vdGUtYXR0ZXN0YXRpb24tc2VydmljZSBiZWluZyBzdGF0ZS1sZXNzCiAgICAgICAg ICAgICAgIG9yIG5vdCBpcyBvcnRob2dvbmFsIHRvIHRoZSBJTUEgbG9nIHNuYXBzaG90IGZlYXR1 cmUuCiAgICAgICAgICAgICAgIEFzIGRpc2N1c3NlZCBpbiBkZXRhaWwgaW4gc2VjdGlvbiBELjQu YiBhYm92ZSwgdGhhdAogICAgICAgICAgICAgICBkZWNpc2lvbiBzaG91bGQgYmUgbWFkZSBieSB0 aGUgc2VydmljZSBvd25lciBhZnRlcgogICAgICAgICAgICAgICB3ZWlnaGluZyB0aGUgcHJvcyBh bmQgY29ucy4KCiAgICAgZS4gSW4gdjEgb2YgdGhpcyBSRkMgcHJvcG9zYWwsIHRoZXJlIHdhcyBk aXNjdXNzaW9uIG9uIHVzaW5nICd0bXBmcycKICAgICAgICBhcyBhIGxvY2F0aW9uIHRvIHN0b3Jl IHRoZSBzbmFwc2hvdC4gIEV2ZW4gdGhvdWdoICd0bXBmcycgbWF5CiAgICAgICAgc2ltcGxpZnkg c29tZSBhc3BlY3RzIG9mIGltcGxlbWVudGluZyB0aGUgc25hcHNob3R0aW5nIGZlYXR1cmUsCiAg ICAgICAgaXQgZG9lc24ndCByZWFsbHkgaGVscCBhY2hpZXZpbmcgdGhlIG1haW4gZ29hbCBvZiB0 aGUgZmVhdHVyZSAtCiAgICAgICAgaS5lLiByZWR1Y2luZyB0aGUgbWVtb3J5IHByZXNzdXJlIG9u IHRoZSBLZXJuZWwuCiAgICAgICAgVGhpcyBpcyBiZWNhdXNlOgogICAgICAgICAgIC0gVGhlICd0 bXBmcycgaXMgcGFydCBvZiB0aGUgc3lzdGVtJ3MgbWVtb3J5IGFuZCBub3QKICAgICAgICAgICAg IHBlcnNpc3RlbnQgc3RvcmFnZVs4XS4gIE1vdmluZyBwYXJ0IG9mIElNQSBsb2cgdG8gJ3RtcGZz JwogICAgICAgICAgICAgZG9lc24ndCByZWFsbHkgYWRkcmVzcyB0aGUgbWVtb3J5IHByZXNzdXJl IHByb2JsZW0gd2UgYXJlCiAgICAgICAgICAgICB0cnlpbmcgdG8gc29sdmUuCiAgICAgICAgICAg LSBUaGUgJ3RtcGZzJyBpcyBhbiBlcGhlbWVyYWwgc3RvcmFnZS4gIEl0J3MgY29udGVudHMgYXJl IGxvc3QKICAgICAgICAgICAgIG9uIHJlYm9vdHMuICBUaGVyZWZvcmUsIGR1cmluZyBrZXhlYyBz b2Z0LWJvb3RzLCB0aGUKICAgICAgICAgICAgIGNvbnRlbnRzIHdvdWxkIGhhdmUgdG8gYmUgYnJv dWdodCBiYWNrIHRvIHRoZSBtYWluIG1lbW9yeQogICAgICAgICAgICAgc28gdGhhdCB0aGV5IGNh biBiZSBtYXBwZWQgdG8gdGhlIG1lbW9yeSBvZiB0aGUgbmV4dCBrZXJuZWwuCiAgICAgICAgICAg ICBPdGhlcndpc2UsIHJlbW90ZSBhdHRlc3RhdGlvbiB3b3VsZCBmYWlsIHBvc3Qga2V4ZWMgc29m dAogICAgICAgICAgICAgcmVib290LgogICAgICAgIEJlY2F1c2Ugb2YgdGhlIGFib3ZlIHJlYXNv bnMsIHdlIHdpbGwgbm90IHN0b3JlIHNuYXBzaG90cyBvbgogICAgICAgICd0bXBmcycuCgogICAg IGYuIEluIHYxIG9mIHRoaXMgUkZDIHByb3Bvc2FsLCB0aGVyZSB3YXMgZGlzY3Vzc2lvbiBhYm91 dCBzdXBwb3J0aW5nCiAgICAgICAgVFBNIHNlYWwtdW5zZWFsIHNjZW5hcmlvIGluIHRoZSBjb250 ZXh0IG9mIElNQSBsb2cgc25hcHNob3RzWzldLgogICAgICAgIEluIGEgdHlwaWNhbCBzZWFsLXVu c2VhbCBzY2VuYXJpbywgc29tZSBzZWNyZXQgaXMgc2VhbGVkIHVzaW5nCiAgICAgICAgdGhlIFRQ TS1QQ1IgcXVvdGVzIG9uIHRoZSBzZXJ2aWNlLXNpZGUuICBUaGUgc2VydmljZSBtYXkgY2hlY2sK ICAgICAgICB0aGUgSU1BIGxvZyBoYXZlIGV4cGVjdGVkIGNvbnRlbnRzIGJlZm9yZSBzZWFsaW5n IHRoZSBzZWNyZXQuCiAgICAgICAgVGhlIFRQTSBvbiB0aGUgY2xpZW50LXNpZGUgY2FuIG9ubHkg dW5zZWFsIHRoZSBzZWNyZXQgaWYgdGhlIFBDUgogICAgICAgIHF1b3RlcyBhcmUgbm90IGNoYW5n ZWQgc2luY2UgdGhlIHRpbWUgc2VjcmV0IHdhcyBzZWFsZWQuICBJTUEgbG9nCiAgICAgICAgc25h cHNob3RzIGFzIGEgZmVhdHVyZSBkb2VzIG5vdCBhbHRlciB0aGlzIHByb2Nlc3Mgb2YKICAgICAg ICBzZWFsLXVuc2VhbC4gIFRoZXJlZm9yZSBpdCBzaG91bGQgbm90IGltcGFjdCB0aGUgY29yZSBw cm9jZXNzIG9mCiAgICAgICAgc2VhbC11bnNlYWwuICBBbHRob3VnaCwgYXMgbWVudGlvbmVkIGlu IHNlY3Rpb24gRC40LCBjaGFuZ2VzIGFyZQogICAgICAgIG5lZWRlZCBpbiBjbGllbnQvc2Vydmlj ZSBzaWRlIGZ1bmN0aW9uYWxpdHkgdG8gcmVxdWVzdCBzbmFwc2hvdHMKICAgICAgICB0byB2ZXJp ZnkgdGhlIGNvbnRlbnRzIG9mIElNQSBsb2cgd2hpY2ggYXJlIG5vdCBwcmVzZW50IGluIHRoZQog ICAgICAgIGxhdGVzdCBsb2cgc2VnbWVudC4KCldlIGFwcHJlY2lhdGUgeW91ciBjb21tZW50cyBv biB0aGlzIHByb3Bvc2FsLgoKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KfCBHLiBSZWZlcmVuY2VzICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KWzFdIFtSRkNdIElNQSBMb2cgU25hcHNob3R0aW5nIERlc2lnbiBQcm9wb3NhbCAoVjEp Cmh0dHBzOi8vbG9yZS5rZXJuZWwub3JnL2xpbnV4LWludGVncml0eS9jNTczNzE0MS03ODI3LTFj ODMtYWIzOC0wMTE5ZGNmZWE0ODVAbGludXgubWljcm9zb2Z0LmNvbS9ULyNtMzVlN2Q4ODVkYjM2 NWIwYWFjNDM4MjgzMGIzOWQ0NDZlYjVlZmRiNQoKWzJdIElNQTogc3VwcG9ydCBmb3IgbWVhc3Vy aW5nIGtlcm5lbCBpbnRlZ3JpdHkgY3JpdGljYWwgZGF0YQpodHRwczovL3BhdGNod29yay5rZXJu ZWwub3JnL3Byb2plY3QvbGludXgtaW50ZWdyaXR5L2NvdmVyLzIwMjEwMTA4MDQwNzA4LjgzODkt MS10dXNoYXJzdUBsaW51eC5taWNyb3NvZnQuY29tLwoKWzNdIE1lYXN1cmluZyBUUE0gdXBkYXRl IGNvdW50ZXIgaW4gSU1BCmh0dHBzOi8vcGF0Y2h3b3JrLmtlcm5lbC5vcmcvcHJvamVjdC9saW51 eC1pbnRlZ3JpdHkvY292ZXIvMjAyMzA4MDExODE5MTcuODUzNS0xLXR1c2hhcnN1QGxpbnV4Lm1p Y3Jvc29mdC5jb20vCgpbNF0gUmU6IFtQQVRDSCB2Ml0gaW1hOiBleHBvcnQgdGhlIG1lYXN1cmVt ZW50IGxpc3Qgd2hlbiBuZWVkZWQKaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcvbGludXgtaW50ZWdy aXR5LzE1ODA5OTg0MzIuNTU4NS40MTEuY2FtZWxAbGludXguaWJtLmNvbS8KCls1XSBUUE0tUENS IFVwZGF0ZSBjb3VudGVycyBpbiBJTUEgbG9nIHNuYXBzaG90cwpodHRwczovL2xvcmUua2VybmVs Lm9yZy9saW51eC1pbnRlZ3JpdHkvYzU3MzcxNDEtNzgyNy0xYzgzLWFiMzgtMDExOWRjZmVhNDg1 QGxpbnV4Lm1pY3Jvc29mdC5jb20vVC8jbTc3NWI4YjA5MmUwNmJlZDQ2OTRiNDE4ZTlkNjQyYzRk MjY0MmVlOGYKCls2XSBBZGRpbmcgRUsvQUlLIFB1YmxpYyBDZXJ0IHRvIHRoZSBJTUEgbG9nIHNu YXBzaG90cwpodHRwczovL2xvcmUua2VybmVsLm9yZy9saW51eC1pbnRlZ3JpdHkvYzU3MzcxNDEt NzgyNy0xYzgzLWFiMzgtMDExOWRjZmVhNDg1QGxpbnV4Lm1pY3Jvc29mdC5jb20vVC8jbTQ4ZWM2 ZDljZWFjYTQwMDMwNjA0YjIzMzZmMGVmMGFkYThkMzllNmEKaHR0cHM6Ly9sb3JlLmtlcm5lbC5v cmcvbGludXgtaW50ZWdyaXR5L2M1NzM3MTQxLTc4MjctMWM4My1hYjM4LTAxMTlkY2ZlYTQ4NUBs aW51eC5taWNyb3NvZnQuY29tL1QvI200MTA4MTcxM2RhMWNhMTU4NjdiNjIzYmY3ZDJmZmI4MjJj MWZlM2ZkCmh0dHBzOi8vbG9yZS5rZXJuZWwub3JnL2xpbnV4LWludGVncml0eS9jNTczNzE0MS03 ODI3LTFjODMtYWIzOC0wMTE5ZGNmZWE0ODVAbGludXgubWljcm9zb2Z0LmNvbS9ULyNtYjhiYzIz OThjZTRkMmQ3MWJjZTUzOTc3NjE2OWU1M2I5ZjMzYzhkOAoKWzddIEFib3V0IENsaWVudCByZXN0 YXJ0cyBhbmQgcmVtb3RlIGF0dGVzdGF0aW9uIHNlcnZpY2UgYmVpbmcKICAgICAgIHN0YXRlbGVz cwpodHRwczovL2xvcmUua2VybmVsLm9yZy9saW51eC1pbnRlZ3JpdHkvYzU3MzcxNDEtNzgyNy0x YzgzLWFiMzgtMDExOWRjZmVhNDg1QGxpbnV4Lm1pY3Jvc29mdC5jb20vVC8jbTMzZmM0MDA1Yjk0 ZTZmYWI3OTE1MzgwMGEwNmFmNDA0NzdjM2JlNjUgCgoKWzhdIFRtcGZzCmh0dHBzOi8vd3d3Lmtl cm5lbC5vcmcvZG9jL2h0bWwvbGF0ZXN0L2ZpbGVzeXN0ZW1zL3RtcGZzLmh0bWwKCls5XSBUUE0g U2VhbC1VbnNlYWwKaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcvbGludXgtaW50ZWdyaXR5L2M1NzM3 MTQxLTc4MjctMWM4My1hYjM4LTAxMTlkY2ZlYTQ4NUBsaW51eC5taWNyb3NvZnQuY29tL1QvI20x MmMxYjM1YzZkMTMwYTZlZTE4MWE4Y2NlNGMxZWJkZWE0MTJhMTliCgpUaGFua3MhClN1c2ggJiBU dXNoYXIKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCmtl eGVjIG1haWxpbmcgbGlzdAprZXhlY0BsaXN0cy5pbmZyYWRlYWQub3JnCmh0dHA6Ly9saXN0cy5p bmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8va2V4ZWMK From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5BF7DCDB483 for ; Thu, 19 Oct 2023 18:49:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233268AbjJSSt2 (ORCPT ); Thu, 19 Oct 2023 14:49:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38744 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233020AbjJSSt1 (ORCPT ); Thu, 19 Oct 2023 14:49:27 -0400 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 19A92CA; Thu, 19 Oct 2023 11:49:23 -0700 (PDT) Received: from [192.168.86.69] (unknown [50.46.228.62]) by linux.microsoft.com (Postfix) with ESMTPSA id 454DC20B74C0; Thu, 19 Oct 2023 11:49:22 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 454DC20B74C0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1697741362; bh=d2JVGRdv8gCcfFfmeYalZ8EYM/3NfqEVrcnGI3WvI5g=; h=Date:To:Cc:From:Subject:From; b=sNCbO4IQA6lHhxfw1f2WkM3fFczWPPHZSHYB2/vrqBescY9XnB2uITCRqwSLAQEbE 4s+FguYPXscLPl6h4osoXw2WMxN9lYpC9erG/B4WnWLEIKrlEupFA9cGpzTeShluy1 G9NwHhFd6TXgjfccwN/199BI8n+MHAqKuB+yNqgA= Message-ID: <6c0c32d5-e636-2a0e-5bdf-538c904ceea3@linux.microsoft.com> Date: Thu, 19 Oct 2023 11:49:21 -0700 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.15.1 Content-Language: en-US To: linux-integrity@vger.kernel.org, Mimi Zohar , peterhuewe@gmx.de, Jarkko Sakkinen , jgg@ziepe.ca, Ken Goldman , bhe@redhat.com, vgoyal@redhat.com, Dave Young , "kexec@lists.infradead.org" , jmorris@namei.org, Paul Moore , serge@hallyn.com, James Bottomley , linux-security-module@vger.kernel.org Cc: Tyler Hicks , Lakshmi Ramasubramanian , Sush Shringarputale From: Tushar Sugandhi Subject: [RFC V2] IMA Log Snapshotting Design Proposal Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org ======================================================================= | Introduction | ======================================================================= This document provides a detailed overview of the proposed Kernel feature IMA log snapshotting. It describes the motivation behind the proposal, the problem to be solved, a detailed solution design with examples, and describes the changes to be made in the clients/services which are part of remote-attestation system. This is the 2nd version of the proposal. The first version is present here[1]. Table of Contents: ------------------ A. Motivation and Background B. Goals and Non-Goals B.1 Goals B.2 Non-Goals C. Proposed Solution C.1 Solution Summary C.2 High-level Work-flow D. Detailed Design D.1 Snapshot Aggregate Event D.2 Snapshot Triggering Mechanism D.3 Choosing A Persistent Storage Location For Snapshots D.4 Remote-Attestation Client/Service-side Changes D.4.a Client-side Changes D.4.b Service-side Changes E. Example Walk-through F. Other Design Considerations G. References Change Log: ----------- This RFC proposal doc has the following changes compared to its first version[1] - Added table of contents for easy navigation through the doc. - Clearly defined problem and added goals and non-goals this proposal plans to achieve. - Added diagrams in section "C.2 High-level Work-flow" to help the audience better understand the steps proposed. - Provided more clarity on changes needed in attestation client and remote attestation service to benefit from this feature. - Made the necessary changes to the doc based on the new learnings from the investigations done in the past few months. - Added section "F. Other Design Considerations" to address various concerns brought up in the first version[1] of this doc on the following topics: o TPM-PCR update counter o EK/AIK Public Cert o implications of exporting and removing records from the IMA measurement list o attestation client restarts and the remote attestation service being stateless o using 'tmpfs' to store the snapshots o TPM seal-unseal scenario ======================================================================= | A. Motivation and Background | ======================================================================= Depending on the IMA policy, the IMA log can consume a lot of Kernel memory on the system. For instance, the events for the following IMA policy entries may need to be measured in certain scenarios, but they can also lead to a verbose IMA log when the system is running for a long period of time. ┌───────────────────────────────────────┐ │# PROC_SUPER_MAGIC │ │measure fsmagic=0x9fa0 │ │# SYSFS_MAGIC │ │measure fsmagic=0x62656572 │ │# DEBUGFS_MAGIC │ │measure fsmagic=0x64626720 │ │# TMPFS_MAGIC │ │measure fsmagic=0x01021994 │ │# RAMFS_MAGIC │ │measure fsmagic=0x858458f6 │ │# SECURITYFS_MAGIC │ │measure fsmagic=0x73636673 │ │# OVERLAYFS_MAGIC │ │measure fsmagic=0x794c7630 │ │# log, audit or tmp files │ │measure obj_type=var_log_t │ │measure obj_type=auditd_log_t │ │measure obj_type=tmp_t │ └───────────────────────────────────────┘ Secondly, certain systems are configured to take Kernel updates using Kexec soft-boot. The IMA log from the previous Kernel gets carried over and the Kernel memory consumption problem worsens when such systems undergo multiple Kexec soft-boots over a long period of time. The above two scenarios can cause IMA log to consume significant memory on the system. In addition, processing a larger IMA log on the Remote-Attestation service-side is both time consuming and inefficient - because majority of the events would be already attested in the previous attestation requests. To solve this problem, putting a cap on the in-memory IMA log, or truncating IMA log to reclaim memory are not practical solutions. Putting a cap would result in events not getting measured in the IMA log, which would be a security vulnerability. Truncating the log would make the log go out of sync with the TPM PCR quote, resulting in the remote attestation of the system to fail until the system goes through a hard reboot. Therefore, both these solutions are unacceptable. A sophisticated solution is required in this case which will help reduce the memory pressure on the system and continue supporting remote attestation for a longer duration without disruptions. ======================================================================= | B. Goals and Non-Goals | ======================================================================= ----------------------------------------------------------------------- | B.1 Goals | ----------------------------------------------------------------------- To address the issues described in the section above, we propose enhancements to the IMA subsystem to achieve the following goals: a. Reduce memory pressure on the Kernel caused by larger in-memory IMA logs. b. Preserve the system's ability to get remotely attested using the IMA log, even after implementing the enhancements to reduce memory pressure caused by the IMA log. IMA's Integrity guarantees should be maintained. c. Provide mechanisms from Kernel side to the remote attestation service to make service-side processing more efficient. ----------------------------------------------------------------------- | B.2 Non-Goals | ----------------------------------------------------------------------- a. Implementing the changes needed in the remote attestation client/service to benefit from the proposed enhancements are out of scope of this proposal. However, we will briefly discuss what needs to be done in that space. ======================================================================= | C. Proposed Solution | ======================================================================= This section provides high level summary of the proposed solution and the necessary steps in the work-flow. The details of each aspect of the solution and the alternate approaches considered etc. are discussed in section "D. Detailed Design". ----------------------------------------------------------------------- | C.1 Solution Summary | ----------------------------------------------------------------------- To achieve the goals described in the section above, we propose the following changes to the IMA subsystem. a. The IMA log from Kernel memory will be offloaded to some persistent storage disk to keep the system running reliably without facing memory pressure. More details, alternate approaches considered etc. are present in section "D.3 Choices for Storing Snapshots" below. b. The IMA log will be divided into multiple chunks (snapshots). Each snapshot would be a delta between the two instances when the log was offloaded from memory to the persistent storage disk. c. Some UM process (like a remote-attestation-client) will be responsible for writing the IMA log snapshot to the disk. d. The same UM process would be responsible for triggering the IMA log snapshot. e. There will be a well-known location for storing the IMA log snapshots on the disk. It will be non-trivial for UM processes to change that location after booting into the Kernel. f. A new event, "snapshot_aggregate", will be computed and measured in the IMA log as part of this feature. It should help the remote-attestation client/service to benefit from the IMA log snapshot feature. The "snapshot_aggregate" event is described in more details in section "D.1 Snapshot Aggregate Event" below. g. If the existing remote-attestation client/services do not change to benefit from this feature or do not trigger the snapshot, the Kernel will continue to have it's current functionality of maintaining an in-memory full IMA log. Additionally, the remote-attestation client/services need to be updated to benefit from the IMA log snapshot feature. These proposed changes are described in section "D.4 Remote-Attestation Client/Service Side Changes" below, but their implementation is out of scope for this proposal. ----------------------------------------------------------------------- | C.2 High-level Work-flow | ----------------------------------------------------------------------- This section describes the steps to take a snapshot of the IMA log. The proposed high level work-flow of IMA log snapshotting is as follows: a. A user-mode process will trigger the snapshot by opening a file in SysFS say /sys/kernel/security/ima/snapshot (referred to as "sysk_ima_snapshot_file" here onwards). See Step #a in Diagram #1 below. b. The Kernel will get the current TPM PCR values and store them as template data in a new IMA event "snapshot_aggregate". This event will be measured by IMA using critical data measurement functionality[2]. Measuring the "snapshot_aggregate" will be an atomic operation similar to any other IMA log measurement. See Step #b and #c in Diagram #1 below. c. Once the "snapshot_aggregate" is computed and measured in IMA log, the prior IMA events will be made available in the "sysk_ima_snapshot_file". See Step #b and #c in Diagram #1 below. Diagram #1 ---------- Step #a Step #b and #c --------- ---------------- (In-memory IMA log) (In-memory IMA log) .--------------------. .----------------------. | Event #E1 | | Event #E1 | | Event #E2 | | Event #E2 | | | | | | | | "snapshot_aggregate" | | | | (#E1+#E2) | '--------------------' '----------------------' ^ ^ | | | | KM *Kernel* step #b.Kernel writes | --- | "snapshot_aggregate" | UM | to IMA log | | | | step #c.Kernel writes | | the events E2 and E3 to | | sysk_ima_snapshot_file | V V (sysk_ima_snapshot_file) (sysk_ima_snapshot_file) .--------------------. .--------------------. | | | Event #E1 | | {Empty} | ====> | Event #E2 | | | | | '--------------------' '--------------------' ^ ^ | | |Step #a Client opens | |sysk_ima_snapshot_file | | | *Attestation Client (UM)* *Attestation Client (UM)* | | | | | | V V UM_snapshot_file (on DISK) UM_snapshot_file (on DISK) .--------------------. .--------------------. | | | | | {Empty} | | {Empty} | | | | | '--------------------' '--------------------' d. The UM process will copy those IMA events from "sysk_ima_snapshot_file" to a snapshot file on disk chosen by UM (referred to as "UM_snapshot_file" here onwards). The location, file-system type, access permissions etc. of the "UM_snapshot_file" would be controlled by UM process itself. As described in section D.3, the location of "UM_snapshot_file" should be well-known. See Step #d in Diagram #2 below. e. Once UM is done copying the IMA events from "sysk_ima_snapshot_file" to "UM_snapshot_file", it will indicate to the Kernel that the snapshot can be finalized by triggering a write with any data to the "sysk_ima_snapshot_file". UM process cannot prevent the IMA log purge operation after this point. See Step #e in Diagram #2 below. Diagram #2 ---------- Step #d Step #e --------- -------- (In-memory IMA log) (In-memory IMA log) .--------------------. .----------------------. | Event #1 | | Event #1 | | Event #2 | | Event #2 | |"snapshot_aggregate"| | "snapshot_aggregate" | | (#E1+#E2) | | (#E1+#E2) | '--------------------' '----------------------' ^ ^ | | | | KM *Kernel* *Kernel* --- | | UM | | | | | | | | V V (sysk_ima_snapshot_file) (sysk_ima_snapshot_file) .--------------------. .--------------------. | Event #E1 | | "done" | | Event #E2 | ====> | | | | | | '--------------------' '--------------------' ^ ^ |Step #d Client copies | |events to UM_snapshot_file | | | | | | step #e Client writes | | "done" to the file | | sysk_ima_snapshot_file | | | *Attestation Client (UM)* *Attestation Client (UM)* | | | | | | V V UM_snapshot_file (on DISK) UM_snapshot_file (on DISK) .--------------------. .--------------------. | Event #E1 | |Event #E1 | | Event #E2 | |Event #E2 | | | | | '--------------------' '--------------------' f. The Kernel will truncate the current IMA log and and clear HTable up to the "snapshot_aggregate" marker. See Step #f in Diagram #3 below. Diagram #3 ---------- Step #f --------- (In-memory IMA log) .----------------------. | "snapshot_aggregate" | | Event #E4 | | Event #E5 | '----------------------' ^ | | Step #f KM | Kernel removes the old events before --- | "snapshot_aggregate" i.e. #E1 and #E2. UM | And continues to measure the new events | i.e. #E4 and #E5 | | V (sysk_ima_snapshot_file) .--------------------. | "done" | | | | | '--------------------' ^ | | | Attestation Client can now close | the sysk_ima_snapshot_file. | When it is reopened by the client, a new snapshot will | be triggered. V UM_snapshot_file (on DISK) .--------------------. | Event #E1 | | Event #E2 | | | '--------------------' g. Optionally, UM can prevent the IMA log purge by closing the "sysk_ima_snapshot_file" without performing a write operation on it. In this case, the events in the IMA log before the latest "snapshot_aggregate" will not be purged. While the "snapshot_aggregate" marker may still remain in the log as an intermediate entry, it can be ignored since it will not interfere with the remote attestation. h. This work-flow should work when interleaved with Kexec 'load' and 'execute' events and should not cause IMA log + snapshot to go out of sync with PCR quotes. The implementation details are omitted from this document for brevity. ======================================================================= | D. Detailed Design | ======================================================================= ----------------------------------------------------------------------- | D.1 Snapshot Aggregate Event | ----------------------------------------------------------------------- When the IMA log snapshot is triggered, IMA will pause the measurements and start computing and measurement of the event "snapshot_aggregate". The Template Data of the "snapshot_aggregate" event will have the following grammar: TEMPLATE_DATA := ";"";" Snapshot_Counter := "Snapshot_Attempt_Count=" PCR_Banks := ";"| "," ";" PCR_Bank := ":" PCR_Hash_Type := "sha1"|"sha256"|"sha384" PCRn := "PCR"":" PCR_Hash := N := [0-23] The Data Hash of the "snapshot_aggregate" event log line is - Append(H(snapshot_file),PCR0,PCR1,...PCR23). All available PCR banks will be included in the template data in a known structure. The events generated between the window of "triggering of a snapshot" and "computation and measurement of the 'snapshot_aggregate' event data" will be queued, and they will be measured in the IMA log after the "snapshot_aggregate" event data is computed and measured. After "snapshot_aggregate" event data is computed and measured, the UM process will dump the events before "snapshot_aggregate" to a well known location on persistent storage in "UM_snapshot_file". Once the UM process signals that work is complete, IMA will remove those events from the IMA log. IMA log will now have "snapshot_aggregate" as the first event in it. The "snapshot_aggregate" marker provides the following benefits: a. It facilitates the IMA log to be divided into multiple chunks and provides mechanism to verify the integrity of the system using only the latest chunks during remote attestation. b. It provides tangible evidence from Kernel to the attestation client that IMA log snapshotting has been enabled and at least one snapshot exists on the system. c. It helps both the Kernel and UM attestation client define clear boundaries between multiple snapshots. d. In the event of multiple snapshots, the last measured "snapshot_aggregate" marker, which is present in the current segment of the IMA log, has sufficient information to verify the integrity of the IMA log segment as well as the previous snapshots using the PCR quotes. e. In the event of multiple snapshots, say N, if the remote-attestation service has already processed the last N-1 snapshots, it can efficiently parse through them by just processing "snapshot_aggregate" events to compute the PCR quotes needed to verify the events in the last snapshot. This should drastically improve the IMA log processing efficiency of the service. ----------------------------------------------------------------------- | D.2 Snapshot Triggering Mechanism | ----------------------------------------------------------------------- The snapshot triggering mechanism is as described below: a. The IMA subsystem will create a new file: /sys/kernel/security/ima/snapshot (a.k.a. sysk_ima_snapshot_file). b. A UM process opening this file will trigger a snapshot. The file will be opened exclusively, so only one UM process can trigger the snapshot at a time. c. Once the kernel has written the "snapshot_aggregate" marker to the IMA log, the IMA log prior to that event can be read by UM on the same FD. d. When UM writes some data to "sysk_ima_snapshot_file", the kernel will finalize the snapshot by purging the in-memory IMA log. e. If UM closes "sysk_ima_snapshot_file" without writing to it, the Kernel will not purge the IMA log. f. If a system administrator requires that only a specific client process should trigger the snapshot, this capability can be set as an SeLinux policy. ----------------------------------------------------------------------- | D.3 Choosing A Persistent Storage Location For Snapshots | ----------------------------------------------------------------------- Choosing the snapshot location is handled by the UM process. The location should be a well-known location, potentially set in a configuration file or the IMA policy file under /etc. The configuration file should be marked as read-only for UM processes. The Kernel will wait for the UM process to indicate that the current IMA log has been written to "UM_snapshot_file" and only then the Kernel will truncate the in-memory IMA log. UM is responsible to clear any existing UM_snapshot_file(s) on system start or on a hard reboot/power cycle. During the first RFC, concerns were raised over the protections of the "UM_snapshot_file". Just like the current IMA log sent over the network to the attestation service, the "UM_snapshot_file" file is not resistant to modifications, neither should it be. The TPM PCR quote provides the guarantee that the IMA log has not been modified - the same PCR quote continues to provide that guarantee for the snapshot files as well. Using the template data in the snapshot_aggregate marker, the attestation service can validate the integrity of the data provided in the past snapshots. The log is validated all the way to the final event, which is validated by the PCR quote. ----------------------------------------------------------------------- | D.4 Remote-Attestation Client/Service-side Changes | ----------------------------------------------------------------------- A remote attestation client and service will need to be aware of the "snapshot_aggregate" marker and how it should be handled. A typical attestation path on the system will remain the same - send the current IMA log along with the signed TPM PCR quotes to the remote attestation-service. But the attestation clients and remote services need to be aware that they need to use "UM_snapshot_file(s)" too, along with PCR quotes and the data in "snapshot_aggregate" event in IMA log to re-establish the chain of trust if the feature is enabled and a snapshot is taken. As mentioned above, if the existing remote-attestation client/services do not change to benefit from the log snapshotting feature, or do not trigger the snapshot, the Kernel will continue to have it's current functionality of maintaining an in-memory full IMA log. D.4.a Client-side changes ----------------------------------------------------------------------- To use snapshot feature, the attestation client is required to know - if snapshotting is supported/enabled by the Kernel - if snapshotting is supported/enabled by the remote-attestation service it interacts with - the correct order of UM_snapshot_file(s) for backtracking through the IMA log The protocol between the remote-attestation client and service needs to be updated to send previous snapshots to the service as requested. If the service is not yet ready to process the "snapshot_aggregate" events and the snapshots, then the clients should not write any data to the sysk_ima_snapshot_file before closing it. This will add the "snapshot_aggregate" marker to the IMA log without purging the log. Once the service implements "snapshot_aggregate" event parsing, the client can implement the functionality to write to the "sysk_ima_snapshot_file" each time it triggers the snapshot. This would indicate to the Kernel that the log should be purged. D.4.b Service-side changes ----------------------------------------------------------------------- For the remote attestation to work, the service will need to know how to validate the "snapshot_aggregate" entry in the IMA log. It will have to read the PCR values present in the template data of the "snapshot_aggregate" event in the latest IMA log segment, and ensure that the PCR quotes align with the contents of the past UM_snapshot_file(s). This will re-establish the chain of trust needed for the system to pass remote attestation. This will also maintain the ability of the remote-attestation service to seal the secrets, if the client-server use TPM seal/unseal mechanism to attest the state of the system. The client-service protocol will need an implementation for requesting previous snapshots of the IMA logs. There may be various scenarios when such a request is made such as: - the service is stateless and requires all the data since boot for evaluating if the attestation should succeed or not. - there are linked IMA events that are split across a snapshot boundary - the expected event that the service is looking for is not present in the current list of IMA log + UM_snapshot_file(s). The service will need to request the client to send the old UM_snapshot_file(s) and ensure that the log replay still generates the expected PCR values provided in the quote. To avoid asking for previous snapshot chunks from the system, the service may maintain the past attestation status of the system at a given snapshot checkpoint. This would make the service more efficient in processing IMA logs for attestation. It will reduce the persistent storage space requirements on the client. But it would require the service to be stateful. It's a trade-off which needs to be evaluated by the owners of the remote attestation service. If the clients are not yet updated to trigger snapshots, they will still be sending the IMA log in its entirety without any "snapshot_aggregate" event recorded in the log. Processing such IMA logs is an existing service behavior, and the service should continue supporting it until all the clients are updated to take IMA log snapshots. The service can use the presence of the "snapshot_aggregate" event in the IMA log to determine and track which clients in the fleet have the capability to generate IMA log snapshot. ======================================================================= | E. Example Walk-through | ======================================================================= This section provides an example walk-through of the IMA log snapshot capturing scenario. Assume a system has below IMA log before a snapshot is taken. ┌───┬─────────────┬────────┬────────────┬────────────────┬────────────┐ │PCR│Template Hash│Template│ Data Hash │ Data File │TemplateData│ ├───┼─────────────┼────────┼────────────┼────────────────┼────────────┤ │10 │322a847385...│ima-sig │sha256:309..│boot_aggregate │ │ ├───┼─────────────┼────────┼────────────┼────────────────┼────────────┤ │10 │92dbf55061...│ima-buf │sha256:b93..│kernel_version..│352342347...│ ├───┼─────────────┼────────┼────────────┼────────────────┼────────────┤ │11 │e8e12d9532...│ima-buf │sha256:cd0..│dm_table_load.. │568956899...│ ├───┼─────────────┼────────┼────────────┼────────────────┼────────────┤ │12 │e8e12d9532...│ima-sig │sha256:560..│/usr/lib/modul..│ │ └───┴─────────────┴────────┴────────────┴────────────────┴────────────┘ For this example, the PCR values in sha256 bank are as follows: sha256: 0 : 0xDA009CB9DDBF2DF2...8D3CAE516A99847262790479368F82B6 ... ... 10: 0xB93EBF68FC66C6B6...303BC0D5DA0B419F059DE27EAE3BAA29 11: 0xCD00ABB3D84DB0F0...01A1ADCDCADB15DEED47BA6FCE40D420 12: 0x560153FB6A0CC603...892BB48772682F692E44A0393281DB45 ... ... 23: 0x0000000000000000...00000000000000000000000000000000 If a snapshot is taken at this point, the current IMA log will be written to the disk. The events generated between the window of "triggering of a snapshot" and "computation and measurement of the snapshot_aggregate event data" will be queued, and they will be measured in the IMA log after the "snapshot_aggregate" event data is computed and measured. The state of the IMA log after the snapshot: ┌───┬─────────┬────────┬───────────┬──────────────────┬───────────────┐ │PCR│Template │Template│ Data Hash │ Data File │ Template │ │ │ Hash │ │ │ │ Data │ ├───┼─────────┼────────┼───────────┼──────────────────┼───────────────┤ │10 │e55cba...│ima-buf │Sha256:30a.│snapshot_aggregate││ │ │ │ │ │ │see the grammar│ │ │ │ │ │ │ below │ └───┴─────────┴────────┴───────────┴──────────────────┴───────────────┘ where the Data Hash of the log line is - Append(H(snapshot_file),PCR0,PCR1,...PCR23). All available PCR banks will be included in the template data in a known structure. The Template Data will follow the grammar below: TEMPLATE_DATA := ";"";" Snapshot_Counter := "Snapshot_Attempt_Count=" PCR_Banks := ";"| "," ";" PCR_Bank := ":" PCR_Hash_Type := "sha1"|"sha256"|"sha384" PCRn := "PCR"":" PCR_Hash := N := [0-23] The state of the PCRs after the snapshot: (Only PCR 10 will change, since "snapshot_aggregate" is extended in that PCR.) sha256: 0 : 0xDA009CB9DDBF2DF2...8D3CAE516A99847262790479368F82B6 ... ... 10 : 0x30A1B69F09A9599...2518394A8E1A3B8D343D4458E6FB0B04 11 : 0xCD00ABB3D84DB0F...01A1ADCDCADB15DEED47BA6FCE40D420 12 : 0x560153FB6A0CC60...892BB48772682F692E44A0393281DB45 ... ... 23: 0x0000000000000000...00000000000000000000000000000000 An example of "snapshot_aggregate" template data is given below. 10 e55cba... ima-buf Sha256:30a... snapshot_aggregate Snapshot_Attempt_Count=7; sha256:PCR0:0xDA009CB9DDBF2DF2...8D3CAE516A99847262790479368F82B6, sha256:PCR1:0x30A1B69F09A9599E...2518394A8E1A3B8D343D4458E6FB0B04, ... sha256:PCR23:0x30A1B69F09A9599...2518394A8E1A3B8D343D4458E6FB0B04; Future IMA events can then continue to be extended in the assigned PCRs and added in the IMA log after snapshot_aggregate. Since IMA measurements extend the TPM-PCRs and computing snapshot_aggregate involves reading TPM PCR banks, IMA measurements must be suspended until the snapshot_aggregate is computed and measured. Otherwise, these two operations may interfere with each other compromising the integrity of the system. The remote-attestation-service can verify the contents of the past (N-1) UM_snapshot_file(s) by replaying the events in them and comparing them with the PCR values stored in template data of the first "snapshot_aggregate" event of subsequent IMA log. ======================================================================= | F. Other Design Considerations | ======================================================================= a. In v1 of this RFC proposal , it was discussed [5] if we should use TPM-PCR update counter in the "snapshot_aggregate" event. => After the initial investigation and prototyping[3], we discovered the TPM PCR counter gets incremented when any of the PCRs in the PCR bank gets updated. The counter is not specific to any single PCR (e.g. PCR 10 where IMA extends the measurements by default). Adding TPM PCR counter to "snapshot_aggregate" event won't provide any additional benefits, therefore we do not plan to include it in any of the IMA log measurements. b. In v1 of this RFC proposal , it was discussed [6] if we should add the EK/AIK Public Cert as part of "snapshot_aggregate" event data. => In a typical remote attestation scenario that does not use IMA log snapshotting, the EK/AIK public cert typically needs to be sent to the remote attestation service along with IMA log and TPM PCR quotes. The EK/AIK public cert verifies that the TPM PCR quotes are signed by a genuine TPM, which in turn verifies that the IMA log is not tampered with. Since the EK/AIK public cert is anyways sent outside of the IMA log in this scenario, it is not needed to be sent as part of IMA log again. In other scenarios (e.g. seal/unseal, and some cases fTPM/vTPM), the EK/AIK public cert is either unavailable or is not used for remote attestation. Therefore we will not be adding the EK/AIK public cert as part of "snapshot_aggregate" event data. c. In one of the previous attempts so to export the IMA log [4], several aspects of the problem were discussed. o "The implications of exporting and removing records from the IMA measurement list needs to be considered carefully" => We are addressing that in this design by introducing the IMA event "snapshot_aggregate", a well known location to store them, coordination between the Kernel and the UM process to trigger and capture the snapshot, and providing guidance to the client/service to process the events. o Conflating the two different use cases - i.e. both UM and the Kernel requesting exporting and removing of the measurement list records. => We are addressing that in this design by allowing only UM to request the snapshot, and store it on the well known persistent storage. Whereas only Kernel being responsible for removing the exported events from the Kernel memory. The responsibilities of the Kernel and UM client are clearly defined, and they are distinct from each other. o The feedback from the IMA maintainer on exporting the IMA log [4] was that the user-space would be responsible for safely storing the measurements. The kernel would only be responsible for limiting permission, perhaps based on a capability, before removing records from the measurement list. => We have incorporated this feedback in our design. - The UM process triggers the snapshot. - The UM process is responsible for storing the snapshot on the persistent storage. - The Kernel co-ordinates with the UM process before removing the records from the measurement list. d. In v1 of this RFC proposal, some clarification was needed to address the attestation client restarts and the remote attestation service being stateless[7]. => As mentioned in the "Non-Goals" section above, implementing the changes needed in the remote attestation client/service are out of scope for this document. However, taking the IMA log snapshots should not interfere with the ability of the client to restart at any point. Even if the client restarts and does not write any data to "sysk_ima_snapshot_file" after recording the "snapshot_aggregate" event, IMA will not purge the records from the IMA log. There is no data loss, and the system overall keeps the ability to attest itself remotely. Similarly, the remote-attestation-service being state-less or not is orthogonal to the IMA log snapshot feature. As discussed in detail in section D.4.b above, that decision should be made by the service owner after weighing the pros and cons. e. In v1 of this RFC proposal, there was discussion on using 'tmpfs' as a location to store the snapshot. Even though 'tmpfs' may simplify some aspects of implementing the snapshotting feature, it doesn't really help achieving the main goal of the feature - i.e. reducing the memory pressure on the Kernel. This is because: - The 'tmpfs' is part of the system's memory and not persistent storage[8]. Moving part of IMA log to 'tmpfs' doesn't really address the memory pressure problem we are trying to solve. - The 'tmpfs' is an ephemeral storage. It's contents are lost on reboots. Therefore, during kexec soft-boots, the contents would have to be brought back to the main memory so that they can be mapped to the memory of the next kernel. Otherwise, remote attestation would fail post kexec soft reboot. Because of the above reasons, we will not store snapshots on 'tmpfs'. f. In v1 of this RFC proposal, there was discussion about supporting TPM seal-unseal scenario in the context of IMA log snapshots[9]. In a typical seal-unseal scenario, some secret is sealed using the TPM-PCR quotes on the service-side. The service may check the IMA log have expected contents before sealing the secret. The TPM on the client-side can only unseal the secret if the PCR quotes are not changed since the time secret was sealed. IMA log snapshots as a feature does not alter this process of seal-unseal. Therefore it should not impact the core process of seal-unseal. Although, as mentioned in section D.4, changes are needed in client/service side functionality to request snapshots to verify the contents of IMA log which are not present in the latest log segment. We appreciate your comments on this proposal. ======================================================================= | G. References | ======================================================================= [1] [RFC] IMA Log Snapshotting Design Proposal (V1) https://lore.kernel.org/linux-integrity/c5737141-7827-1c83-ab38-0119dcfea485@linux.microsoft.com/T/#m35e7d885db365b0aac4382830b39d446eb5efdb5 [2] IMA: support for measuring kernel integrity critical data https://patchwork.kernel.org/project/linux-integrity/cover/20210108040708.8389-1-tusharsu@linux.microsoft.com/ [3] Measuring TPM update counter in IMA https://patchwork.kernel.org/project/linux-integrity/cover/20230801181917.8535-1-tusharsu@linux.microsoft.com/ [4] Re: [PATCH v2] ima: export the measurement list when needed https://lore.kernel.org/linux-integrity/1580998432.5585.411.camel@linux.ibm.com/ [5] TPM-PCR Update counters in IMA log snapshots https://lore.kernel.org/linux-integrity/c5737141-7827-1c83-ab38-0119dcfea485@linux.microsoft.com/T/#m775b8b092e06bed4694b418e9d642c4d2642ee8f [6] Adding EK/AIK Public Cert to the IMA log snapshots https://lore.kernel.org/linux-integrity/c5737141-7827-1c83-ab38-0119dcfea485@linux.microsoft.com/T/#m48ec6d9ceaca40030604b2336f0ef0ada8d39e6a https://lore.kernel.org/linux-integrity/c5737141-7827-1c83-ab38-0119dcfea485@linux.microsoft.com/T/#m41081713da1ca15867b623bf7d2ffb822c1fe3fd https://lore.kernel.org/linux-integrity/c5737141-7827-1c83-ab38-0119dcfea485@linux.microsoft.com/T/#mb8bc2398ce4d2d71bce539776169e53b9f33c8d8 [7] About Client restarts and remote attestation service being stateless https://lore.kernel.org/linux-integrity/c5737141-7827-1c83-ab38-0119dcfea485@linux.microsoft.com/T/#m33fc4005b94e6fab79153800a06af40477c3be65 [8] Tmpfs https://www.kernel.org/doc/html/latest/filesystems/tmpfs.html [9] TPM Seal-Unseal https://lore.kernel.org/linux-integrity/c5737141-7827-1c83-ab38-0119dcfea485@linux.microsoft.com/T/#m12c1b35c6d130a6ee181a8cce4c1ebdea412a19b Thanks! Sush & Tushar