From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A81C3C4363D for ; Thu, 24 Sep 2020 12:12:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6B8552388A for ; Thu, 24 Sep 2020 12:12:59 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="legzRaCy" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727522AbgIXMGy (ORCPT ); Thu, 24 Sep 2020 08:06:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35800 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727517AbgIXMGv (ORCPT ); Thu, 24 Sep 2020 08:06:51 -0400 Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0FF0AC0613CE; Thu, 24 Sep 2020 05:06:51 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id z25so2958533iol.10; Thu, 24 Sep 2020 05:06:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=czjx6uCVHJbE30rsl5ybjWpjkXo3ycs6ILmTpqDQhks=; b=legzRaCyxrXo9JYiAUGZBSyAUE1HC4S2PLFUGZxKLkddVqDzJB+dMyo+zTphVOx0rf jrAf64kSObVsUl3zfZiDNf0TdaTGhLV/Lm7rOnNk3EUWebxVV1zK8gIGA1ToCHkCyHpT 9hIbY27tazc8peXV5PsXo2AmbqOucZ1Cn5a1AQ2uWDpifoQ5KwaEDbfFAwSNMxuS+P+A xoB6jjac+jsnD0Xied9pxgn3znzaqDo3MIl6SQWemCdoL/Fm+VD0vMTmCEGmSCYRWkHA QUb12sA1/NuJwQi+Z+w+ZnPUZL+n6WjmkCSSk77LgDXMOBosDRNvgFREweFrkOsaD3aR vtcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=czjx6uCVHJbE30rsl5ybjWpjkXo3ycs6ILmTpqDQhks=; b=TjWB11crm5exqRfEMECfu/UO0kOB0+cbLR70gZZrisHfX2Bf4BYyDrgLkkBP4LWeUn KcABzPFH35bfWyhCElwJMej587CNuAFaUzrqUXFFTsUbspTg+LU4coPNoUpHlKvxAdfn WqQDXQ4vV281533E2SP14tzE5/PrJL6ibJb8a8i1FLYVGN5UfnsyfXKnl34KB7hn0bpx rjfM0itpxrmaNUtAWmZy95Vb52qdq5UMVGr9YVJ5mi2k73hQMiIqrejAZ7uiBi+Xc7YR vVxo47Gg/DB08uBEpUA23IoDbQQ+J8IfKempYUhDRj96w0YEd9PNYzScBp2zaWaLQz4P kRPQ== X-Gm-Message-State: AOAM531rR5ye0DYXWeyIuw6ZDhmwD0E82xPRnndyU/6s7YsRsSuZhB1K 74gW9pMLqLArJh63D3SjXAM= X-Google-Smtp-Source: ABdhPJzGbZE46AmsMLsslmC7CgBzYpWTSbOnbBVZM2z6uTF28dj4+C/7zyymAueopV6rMS5KD/+WsQ== X-Received: by 2002:a05:6602:27d2:: with SMTP id l18mr3088110ios.34.1600949210300; Thu, 24 Sep 2020 05:06:50 -0700 (PDT) Received: from localhost.localdomain (host-173-230-99-154.tnkngak.clients.pavlovmedia.com. [173.230.99.154]) by smtp.gmail.com with ESMTPSA id a23sm1259435ioc.54.2020.09.24.05.06.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Sep 2020 05:06:49 -0700 (PDT) From: YiFei Zhu To: containers@lists.linux-foundation.org Cc: YiFei Zhu , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, Aleksa Sarai , Andrea Arcangeli , Andy Lutomirski , Dimitrios Skarlatos , Giuseppe Scrivano , Hubertus Franke , Jack Chen , Jann Horn , Josep Torrellas , Kees Cook , Tianyin Xu , Tobin Feldman-Fitzthum , Tycho Andersen , Valentin Rothberg , Will Drewry Subject: [PATCH seccomp 0/6] seccomp: Add bitmap cache of arg-independent filter results that allow syscalls Date: Thu, 24 Sep 2020 07:06:40 -0500 Message-Id: X-Mailer: git-send-email 2.28.0 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org From: YiFei Zhu Alternative: https://lore.kernel.org/lkml/20200923232923.3142503-1-keescook@chromium.org/T/ Major differences from the linked alternative by Kees: * No x32 special-case handling -- not worth the complexity * No caching of denylist -- not worth the complexity * No seccomp arch pinning -- I think this is an independent feature * The bitmaps are part of the filters rather than the task. * Architectures supported by default through arch number array, except for MIPS with its sparse syscall numbers. * Configurable per-build for future different cache modes. This series adds a bitmap to cache seccomp filter results if the result permits a syscall and is indepenent of syscall arguments. This visibly decreases seccomp overhead for most common seccomp filters with very little memory footprint. The overhead of running Seccomp filters has been part of some past discussions [1][2][3]. Oftentimes, the filters have a large number of instructions that check syscall numbers one by one and jump based on that. Some users chain BPF filters which further enlarge the overhead. A recent work [6] comprehensively measures the Seccomp overhead and shows that the overhead is non-negligible and has a non-trivial impact on application performance. We observed some common filters, such as docker's [4] or systemd's [5], will make most decisions based only on the syscall numbers, and as past discussions considered, a bitmap where each bit represents a syscall makes most sense for these filters. In order to build this bitmap at filter attach time, each filter is emulated for every syscall (under each possible architecture), and checked for any accesses of struct seccomp_data that are not the "arch" nor "nr" (syscall) members. If only "arch" and "nr" are examined, and the program returns allow, then we can be sure that the filter must return allow independent from syscall arguments. When it is concluded that an allow must occur for the given architecture and syscall pair, seccomp will immediately allow the syscall, bypassing further BPF execution. Ongoing work is to further support arguments with fast hash table lookups. We are investigating the performance of doing so [6], and how to best integrate with the existing seccomp infrastructure. Some benchmarks are performed with results in patch 5, copied below: Current BPF sysctl settings: net.core.bpf_jit_enable = 1 net.core.bpf_jit_harden = 0 Benchmarking 100000000 syscalls... 63.896255358 - 0.008504529 = 63887750829 (63.9s) getpid native: 638 ns 130.383312423 - 63.897315189 = 66485997234 (66.5s) getpid RET_ALLOW 1 filter (bitmap): 664 ns 196.789080421 - 130.384414983 = 66404665438 (66.4s) getpid RET_ALLOW 2 filters (bitmap): 664 ns 268.844643304 - 196.790234168 = 72054409136 (72.1s) getpid RET_ALLOW 3 filters (full): 720 ns 342.627472515 - 268.845799103 = 73781673412 (73.8s) getpid RET_ALLOW 4 filters (full): 737 ns Estimated total seccomp overhead for 1 bitmapped filter: 26 ns Estimated total seccomp overhead for 2 bitmapped filters: 26 ns Estimated total seccomp overhead for 3 full filters: 82 ns Estimated total seccomp overhead for 4 full filters: 99 ns Estimated seccomp entry overhead: 26 ns Estimated seccomp per-filter overhead (last 2 diff): 17 ns Estimated seccomp per-filter overhead (filters / 4): 18 ns Expectations: native ≤ 1 bitmap (638 ≤ 664): ✔️ native ≤ 1 filter (638 ≤ 720): ✔️ per-filter (last 2 diff) ≈ per-filter (filters / 4) (17 ≈ 18): ✔️ 1 bitmapped ≈ 2 bitmapped (26 ≈ 26): ✔️ entry ≈ 1 bitmapped (26 ≈ 26): ✔️ entry ≈ 2 bitmapped (26 ≈ 26): ✔️ native + entry + (per filter * 4) ≈ 4 filters total (732 ≈ 737): ✔️ RFC -> v1: * Config made on by default across all arches that could support it. * Added arch numbers array and emulate filter for each arch number, and have a per-arch bitmap. * Massively simplified the emulator so it would only support the common instructions in Kees's list. * Fixed inheriting bitmap across filters (filter->prev is always NULL during prepare). * Stole the selftest from Kees. * Added a /proc/pid/seccomp_cache by Jann's suggestion. Patch 1 moves the SECCOMP Kcomfig option to arch/Kconfig. Patch 2 adds a syscall_arches array so the emulator can enumerate it. Patch 3 implements the emulator that finds if a filter must return allow, Patch 4 implements the test_bit against the bitmaps. Patch 5 updates the selftest to better show the new semantics. Patch 6 implements /proc/pid/seccomp_cache. [1] https://lore.kernel.org/linux-security-module/c22a6c3cefc2412cad00ae14c1371711@huawei.com/T/ [2] https://lore.kernel.org/lkml/202005181120.971232B7B@keescook/T/ [3] https://github.com/seccomp/libseccomp/issues/116 [4] https://github.com/moby/moby/blob/ae0ef82b90356ac613f329a8ef5ee42ca923417d/profiles/seccomp/default.json [5] https://github.com/systemd/systemd/blob/6743a1caf4037f03dc51a1277855018e4ab61957/src/shared/seccomp-util.c#L270 [6] Draco: Architectural and Operating System Support for System Call Security https://tianyin.github.io/pub/draco.pdf, MICRO-53, Oct. 2020 Kees Cook (1): selftests/seccomp: Compare bitmap vs filter overhead YiFei Zhu (5): seccomp: Move config option SECCOMP to arch/Kconfig asm/syscall.h: Add syscall_arches[] array seccomp/cache: Add "emulator" to check if filter is arg-dependent seccomp/cache: Lookup syscall allowlist for fast path seccomp/cache: Report cache data through /proc/pid/seccomp_cache arch/Kconfig | 56 ++++ arch/alpha/include/asm/syscall.h | 4 + arch/arc/include/asm/syscall.h | 24 +- arch/arm/Kconfig | 15 +- arch/arm/include/asm/syscall.h | 4 + arch/arm64/Kconfig | 13 - arch/arm64/include/asm/syscall.h | 4 + arch/c6x/include/asm/syscall.h | 13 +- arch/csky/Kconfig | 13 - arch/csky/include/asm/syscall.h | 4 + arch/h8300/include/asm/syscall.h | 4 + arch/hexagon/include/asm/syscall.h | 4 + arch/ia64/include/asm/syscall.h | 4 + arch/m68k/include/asm/syscall.h | 4 + arch/microblaze/Kconfig | 18 +- arch/microblaze/include/asm/syscall.h | 4 + arch/mips/Kconfig | 17 -- arch/mips/include/asm/syscall.h | 16 ++ arch/nds32/include/asm/syscall.h | 13 +- arch/nios2/include/asm/syscall.h | 4 + arch/openrisc/include/asm/syscall.h | 4 + arch/parisc/Kconfig | 16 -- arch/parisc/include/asm/syscall.h | 7 + arch/powerpc/Kconfig | 17 -- arch/powerpc/include/asm/syscall.h | 14 + arch/riscv/Kconfig | 13 - arch/riscv/include/asm/syscall.h | 14 +- arch/s390/Kconfig | 17 -- arch/s390/include/asm/syscall.h | 7 + arch/sh/Kconfig | 16 -- arch/sh/include/asm/syscall_32.h | 17 +- arch/sparc/Kconfig | 18 +- arch/sparc/include/asm/syscall.h | 9 + arch/um/Kconfig | 16 -- arch/x86/Kconfig | 16 -- arch/x86/include/asm/syscall.h | 11 + arch/x86/um/asm/syscall.h | 14 +- arch/xtensa/Kconfig | 14 - arch/xtensa/include/asm/syscall.h | 4 + fs/proc/base.c | 7 +- include/linux/seccomp.h | 5 + kernel/seccomp.c | 259 +++++++++++++++++- .../selftests/seccomp/seccomp_benchmark.c | 151 ++++++++-- tools/testing/selftests/seccomp/settings | 2 +- 44 files changed, 641 insertions(+), 265 deletions(-) -- 2.28.0 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.5 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42924C4363D for ; Thu, 24 Sep 2020 12:06:55 +0000 (UTC) Received: from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B471A20758 for ; Thu, 24 Sep 2020 12:06:54 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="legzRaCy" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B471A20758 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=containers-bounces@lists.linux-foundation.org Received: from localhost (localhost [127.0.0.1]) by hemlock.osuosl.org (Postfix) with ESMTP id 493AB8701E; Thu, 24 Sep 2020 12:06:54 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from hemlock.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7IQHSSV99ebs; Thu, 24 Sep 2020 12:06:53 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by hemlock.osuosl.org (Postfix) with ESMTP id 82716824DC; Thu, 24 Sep 2020 12:06:53 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 6D4CFC0859; Thu, 24 Sep 2020 12:06:53 +0000 (UTC) Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists.linuxfoundation.org (Postfix) with ESMTP id 3B28EC0051 for ; Thu, 24 Sep 2020 12:06:52 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 371DB86A8C for ; Thu, 24 Sep 2020 12:06:52 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iSiz-Ks77SSt for ; Thu, 24 Sep 2020 12:06:51 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-io1-f67.google.com (mail-io1-f67.google.com [209.85.166.67]) by fraxinus.osuosl.org (Postfix) with ESMTPS id 62BC3868C5 for ; Thu, 24 Sep 2020 12:06:51 +0000 (UTC) Received: by mail-io1-f67.google.com with SMTP id r9so3039328ioa.2 for ; Thu, 24 Sep 2020 05:06:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=czjx6uCVHJbE30rsl5ybjWpjkXo3ycs6ILmTpqDQhks=; b=legzRaCyxrXo9JYiAUGZBSyAUE1HC4S2PLFUGZxKLkddVqDzJB+dMyo+zTphVOx0rf jrAf64kSObVsUl3zfZiDNf0TdaTGhLV/Lm7rOnNk3EUWebxVV1zK8gIGA1ToCHkCyHpT 9hIbY27tazc8peXV5PsXo2AmbqOucZ1Cn5a1AQ2uWDpifoQ5KwaEDbfFAwSNMxuS+P+A xoB6jjac+jsnD0Xied9pxgn3znzaqDo3MIl6SQWemCdoL/Fm+VD0vMTmCEGmSCYRWkHA QUb12sA1/NuJwQi+Z+w+ZnPUZL+n6WjmkCSSk77LgDXMOBosDRNvgFREweFrkOsaD3aR vtcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=czjx6uCVHJbE30rsl5ybjWpjkXo3ycs6ILmTpqDQhks=; b=AKHXBwuE/S0Oi64GJowJN9HsWN1VyLilxxjROr9+vEsaeOFErlwH6C0cR+j3AieCYW RwcvGt0mgx/aXz3EOD5EyYc85LvWDitDVyAYCSWfIK26UDR9DsQeiKELIiIBWzH2yOMc 4bNSEd7trqnQwO5W1tDN9GsPTCCZSu1DRx4AzQKhsrQrRVRnFIHA47NwGlTTWm2xSxb0 ClpxEHXno/4thNdtd9ehUPemuS1Ib151z6p4GEwYF2zo0u9hqlwj1WB9nDJUkKrv3g0O VTJl/EBm6PM+JrKt7yctPn/jpMAzqKXEQKhxm5yJR2sLAgO8xCI75hgwes/7ql5XqBvy pQcQ== X-Gm-Message-State: AOAM531ZifBBWmV66zBj9ul1hT8kw341oZ0kFn7XsJzKM3PrO2lwvdRX Vh2l+rR7XtAUEz/TxqoGwG8C53opc661IQ== X-Google-Smtp-Source: ABdhPJzGbZE46AmsMLsslmC7CgBzYpWTSbOnbBVZM2z6uTF28dj4+C/7zyymAueopV6rMS5KD/+WsQ== X-Received: by 2002:a05:6602:27d2:: with SMTP id l18mr3088110ios.34.1600949210300; Thu, 24 Sep 2020 05:06:50 -0700 (PDT) Received: from localhost.localdomain (host-173-230-99-154.tnkngak.clients.pavlovmedia.com. [173.230.99.154]) by smtp.gmail.com with ESMTPSA id a23sm1259435ioc.54.2020.09.24.05.06.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Sep 2020 05:06:49 -0700 (PDT) From: YiFei Zhu To: containers@lists.linux-foundation.org Subject: [PATCH seccomp 0/6] seccomp: Add bitmap cache of arg-independent filter results that allow syscalls Date: Thu, 24 Sep 2020 07:06:40 -0500 Message-Id: X-Mailer: git-send-email 2.28.0 In-Reply-To: References: MIME-Version: 1.0 Cc: Andrea Arcangeli , Giuseppe Scrivano , Valentin Rothberg , Kees Cook , Jann Horn , YiFei Zhu , Tobin Feldman-Fitzthum , linux-kernel@vger.kernel.org, Andy Lutomirski , Hubertus Franke , Jack Chen , Dimitrios Skarlatos , Josep Torrellas , Will Drewry , bpf@vger.kernel.org, Tianyin Xu X-BeenThere: containers@lists.linux-foundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Linux Containers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: containers-bounces@lists.linux-foundation.org Sender: "Containers" RnJvbTogWWlGZWkgWmh1IDx5aWZlaWZ6MkBpbGxpbm9pcy5lZHU+CgpBbHRlcm5hdGl2ZTogaHR0 cHM6Ly9sb3JlLmtlcm5lbC5vcmcvbGttbC8yMDIwMDkyMzIzMjkyMy4zMTQyNTAzLTEta2Vlc2Nv b2tAY2hyb21pdW0ub3JnL1QvCgpNYWpvciBkaWZmZXJlbmNlcyBmcm9tIHRoZSBsaW5rZWQgYWx0 ZXJuYXRpdmUgYnkgS2VlczoKKiBObyB4MzIgc3BlY2lhbC1jYXNlIGhhbmRsaW5nIC0tIG5vdCB3 b3J0aCB0aGUgY29tcGxleGl0eQoqIE5vIGNhY2hpbmcgb2YgZGVueWxpc3QgLS0gbm90IHdvcnRo IHRoZSBjb21wbGV4aXR5CiogTm8gc2VjY29tcCBhcmNoIHBpbm5pbmcgLS0gSSB0aGluayB0aGlz IGlzIGFuIGluZGVwZW5kZW50IGZlYXR1cmUKKiBUaGUgYml0bWFwcyBhcmUgcGFydCBvZiB0aGUg ZmlsdGVycyByYXRoZXIgdGhhbiB0aGUgdGFzay4KKiBBcmNoaXRlY3R1cmVzIHN1cHBvcnRlZCBi eSBkZWZhdWx0IHRocm91Z2ggYXJjaCBudW1iZXIgYXJyYXksCiAgZXhjZXB0IGZvciBNSVBTIHdp dGggaXRzIHNwYXJzZSBzeXNjYWxsIG51bWJlcnMuCiogQ29uZmlndXJhYmxlIHBlci1idWlsZCBm b3IgZnV0dXJlIGRpZmZlcmVudCBjYWNoZSBtb2Rlcy4KClRoaXMgc2VyaWVzIGFkZHMgYSBiaXRt YXAgdG8gY2FjaGUgc2VjY29tcCBmaWx0ZXIgcmVzdWx0cyBpZiB0aGUKcmVzdWx0IHBlcm1pdHMg YSBzeXNjYWxsIGFuZCBpcyBpbmRlcGVuZW50IG9mIHN5c2NhbGwgYXJndW1lbnRzLgpUaGlzIHZp c2libHkgZGVjcmVhc2VzIHNlY2NvbXAgb3ZlcmhlYWQgZm9yIG1vc3QgY29tbW9uIHNlY2NvbXAK ZmlsdGVycyB3aXRoIHZlcnkgbGl0dGxlIG1lbW9yeSBmb290cHJpbnQuCgpUaGUgb3ZlcmhlYWQg b2YgcnVubmluZyBTZWNjb21wIGZpbHRlcnMgaGFzIGJlZW4gcGFydCBvZiBzb21lIHBhc3QKZGlz Y3Vzc2lvbnMgWzFdWzJdWzNdLiBPZnRlbnRpbWVzLCB0aGUgZmlsdGVycyBoYXZlIGEgbGFyZ2Ug bnVtYmVyCm9mIGluc3RydWN0aW9ucyB0aGF0IGNoZWNrIHN5c2NhbGwgbnVtYmVycyBvbmUgYnkg b25lIGFuZCBqdW1wIGJhc2VkCm9uIHRoYXQuIFNvbWUgdXNlcnMgY2hhaW4gQlBGIGZpbHRlcnMg d2hpY2ggZnVydGhlciBlbmxhcmdlIHRoZQpvdmVyaGVhZC4gQSByZWNlbnQgd29yayBbNl0gY29t cHJlaGVuc2l2ZWx5IG1lYXN1cmVzIHRoZSBTZWNjb21wCm92ZXJoZWFkIGFuZCBzaG93cyB0aGF0 IHRoZSBvdmVyaGVhZCBpcyBub24tbmVnbGlnaWJsZSBhbmQgaGFzIGEKbm9uLXRyaXZpYWwgaW1w YWN0IG9uIGFwcGxpY2F0aW9uIHBlcmZvcm1hbmNlLgoKV2Ugb2JzZXJ2ZWQgc29tZSBjb21tb24g ZmlsdGVycywgc3VjaCBhcyBkb2NrZXIncyBbNF0gb3IKc3lzdGVtZCdzIFs1XSwgd2lsbCBtYWtl IG1vc3QgZGVjaXNpb25zIGJhc2VkIG9ubHkgb24gdGhlIHN5c2NhbGwKbnVtYmVycywgYW5kIGFz IHBhc3QgZGlzY3Vzc2lvbnMgY29uc2lkZXJlZCwgYSBiaXRtYXAgd2hlcmUgZWFjaCBiaXQKcmVw cmVzZW50cyBhIHN5c2NhbGwgbWFrZXMgbW9zdCBzZW5zZSBmb3IgdGhlc2UgZmlsdGVycy4KCklu IG9yZGVyIHRvIGJ1aWxkIHRoaXMgYml0bWFwIGF0IGZpbHRlciBhdHRhY2ggdGltZSwgZWFjaCBm aWx0ZXIgaXMKZW11bGF0ZWQgZm9yIGV2ZXJ5IHN5c2NhbGwgKHVuZGVyIGVhY2ggcG9zc2libGUg YXJjaGl0ZWN0dXJlKSwgYW5kCmNoZWNrZWQgZm9yIGFueSBhY2Nlc3NlcyBvZiBzdHJ1Y3Qgc2Vj Y29tcF9kYXRhIHRoYXQgYXJlIG5vdCB0aGUgImFyY2giCm5vciAibnIiIChzeXNjYWxsKSBtZW1i ZXJzLiBJZiBvbmx5ICJhcmNoIiBhbmQgIm5yIiBhcmUgZXhhbWluZWQsIGFuZAp0aGUgcHJvZ3Jh bSByZXR1cm5zIGFsbG93LCB0aGVuIHdlIGNhbiBiZSBzdXJlIHRoYXQgdGhlIGZpbHRlciBtdXN0 CnJldHVybiBhbGxvdyBpbmRlcGVuZGVudCBmcm9tIHN5c2NhbGwgYXJndW1lbnRzLgoKV2hlbiBp dCBpcyBjb25jbHVkZWQgdGhhdCBhbiBhbGxvdyBtdXN0IG9jY3VyIGZvciB0aGUgZ2l2ZW4KYXJj aGl0ZWN0dXJlIGFuZCBzeXNjYWxsIHBhaXIsIHNlY2NvbXAgd2lsbCBpbW1lZGlhdGVseSBhbGxv dwp0aGUgc3lzY2FsbCwgYnlwYXNzaW5nIGZ1cnRoZXIgQlBGIGV4ZWN1dGlvbi4KCk9uZ29pbmcg d29yayBpcyB0byBmdXJ0aGVyIHN1cHBvcnQgYXJndW1lbnRzIHdpdGggZmFzdCBoYXNoIHRhYmxl Cmxvb2t1cHMuIFdlIGFyZSBpbnZlc3RpZ2F0aW5nIHRoZSBwZXJmb3JtYW5jZSBvZiBkb2luZyBz byBbNl0sIGFuZCBob3cKdG8gYmVzdCBpbnRlZ3JhdGUgd2l0aCB0aGUgZXhpc3Rpbmcgc2VjY29t cCBpbmZyYXN0cnVjdHVyZS4KClNvbWUgYmVuY2htYXJrcyBhcmUgcGVyZm9ybWVkIHdpdGggcmVz dWx0cyBpbiBwYXRjaCA1LCBjb3BpZWQgYmVsb3c6CiAgQ3VycmVudCBCUEYgc3lzY3RsIHNldHRp bmdzOgogIG5ldC5jb3JlLmJwZl9qaXRfZW5hYmxlID0gMQogIG5ldC5jb3JlLmJwZl9qaXRfaGFy ZGVuID0gMAogIEJlbmNobWFya2luZyAxMDAwMDAwMDAgc3lzY2FsbHMuLi4KICA2My44OTYyNTUz NTggLSAwLjAwODUwNDUyOSA9IDYzODg3NzUwODI5ICg2My45cykKICBnZXRwaWQgbmF0aXZlOiA2 MzggbnMKICAxMzAuMzgzMzEyNDIzIC0gNjMuODk3MzE1MTg5ID0gNjY0ODU5OTcyMzQgKDY2LjVz KQogIGdldHBpZCBSRVRfQUxMT1cgMSBmaWx0ZXIgKGJpdG1hcCk6IDY2NCBucwogIDE5Ni43ODkw ODA0MjEgLSAxMzAuMzg0NDE0OTgzID0gNjY0MDQ2NjU0MzggKDY2LjRzKQogIGdldHBpZCBSRVRf QUxMT1cgMiBmaWx0ZXJzIChiaXRtYXApOiA2NjQgbnMKICAyNjguODQ0NjQzMzA0IC0gMTk2Ljc5 MDIzNDE2OCA9IDcyMDU0NDA5MTM2ICg3Mi4xcykKICBnZXRwaWQgUkVUX0FMTE9XIDMgZmlsdGVy cyAoZnVsbCk6IDcyMCBucwogIDM0Mi42Mjc0NzI1MTUgLSAyNjguODQ1Nzk5MTAzID0gNzM3ODE2 NzM0MTIgKDczLjhzKQogIGdldHBpZCBSRVRfQUxMT1cgNCBmaWx0ZXJzIChmdWxsKTogNzM3IG5z CiAgRXN0aW1hdGVkIHRvdGFsIHNlY2NvbXAgb3ZlcmhlYWQgZm9yIDEgYml0bWFwcGVkIGZpbHRl cjogMjYgbnMKICBFc3RpbWF0ZWQgdG90YWwgc2VjY29tcCBvdmVyaGVhZCBmb3IgMiBiaXRtYXBw ZWQgZmlsdGVyczogMjYgbnMKICBFc3RpbWF0ZWQgdG90YWwgc2VjY29tcCBvdmVyaGVhZCBmb3Ig MyBmdWxsIGZpbHRlcnM6IDgyIG5zCiAgRXN0aW1hdGVkIHRvdGFsIHNlY2NvbXAgb3ZlcmhlYWQg Zm9yIDQgZnVsbCBmaWx0ZXJzOiA5OSBucwogIEVzdGltYXRlZCBzZWNjb21wIGVudHJ5IG92ZXJo ZWFkOiAyNiBucwogIEVzdGltYXRlZCBzZWNjb21wIHBlci1maWx0ZXIgb3ZlcmhlYWQgKGxhc3Qg MiBkaWZmKTogMTcgbnMKICBFc3RpbWF0ZWQgc2VjY29tcCBwZXItZmlsdGVyIG92ZXJoZWFkIChm aWx0ZXJzIC8gNCk6IDE4IG5zCiAgRXhwZWN0YXRpb25zOgogIAluYXRpdmUg4omkIDEgYml0bWFw ICg2Mzgg4omkIDY2NCk6IOKclO+4jwogIAluYXRpdmUg4omkIDEgZmlsdGVyICg2Mzgg4omkIDcy MCk6IOKclO+4jwogIAlwZXItZmlsdGVyIChsYXN0IDIgZGlmZikg4omIIHBlci1maWx0ZXIgKGZp bHRlcnMgLyA0KSAoMTcg4omIIDE4KTog4pyU77iPCiAgCTEgYml0bWFwcGVkIOKJiCAyIGJpdG1h cHBlZCAoMjYg4omIIDI2KTog4pyU77iPCiAgCWVudHJ5IOKJiCAxIGJpdG1hcHBlZCAoMjYg4omI IDI2KTog4pyU77iPCiAgCWVudHJ5IOKJiCAyIGJpdG1hcHBlZCAoMjYg4omIIDI2KTog4pyU77iP CiAgCW5hdGl2ZSArIGVudHJ5ICsgKHBlciBmaWx0ZXIgKiA0KSDiiYggNCBmaWx0ZXJzIHRvdGFs ICg3MzIg4omIIDczNyk6IOKclO+4jwoKUkZDIC0+IHYxOgoqIENvbmZpZyBtYWRlIG9uIGJ5IGRl ZmF1bHQgYWNyb3NzIGFsbCBhcmNoZXMgdGhhdCBjb3VsZCBzdXBwb3J0IGl0LgoqIEFkZGVkIGFy Y2ggbnVtYmVycyBhcnJheSBhbmQgZW11bGF0ZSBmaWx0ZXIgZm9yIGVhY2ggYXJjaCBudW1iZXIs IGFuZAogIGhhdmUgYSBwZXItYXJjaCBiaXRtYXAuCiogTWFzc2l2ZWx5IHNpbXBsaWZpZWQgdGhl IGVtdWxhdG9yIHNvIGl0IHdvdWxkIG9ubHkgc3VwcG9ydCB0aGUgY29tbW9uCiAgaW5zdHJ1Y3Rp b25zIGluIEtlZXMncyBsaXN0LgoqIEZpeGVkIGluaGVyaXRpbmcgYml0bWFwIGFjcm9zcyBmaWx0 ZXJzIChmaWx0ZXItPnByZXYgaXMgYWx3YXlzIE5VTEwKICBkdXJpbmcgcHJlcGFyZSkuCiogU3Rv bGUgdGhlIHNlbGZ0ZXN0IGZyb20gS2Vlcy4KKiBBZGRlZCBhIC9wcm9jL3BpZC9zZWNjb21wX2Nh Y2hlIGJ5IEphbm4ncyBzdWdnZXN0aW9uLgoKUGF0Y2ggMSBtb3ZlcyB0aGUgU0VDQ09NUCBLY29t ZmlnIG9wdGlvbiB0byBhcmNoL0tjb25maWcuCgpQYXRjaCAyIGFkZHMgYSBzeXNjYWxsX2FyY2hl cyBhcnJheSBzbyB0aGUgZW11bGF0b3IgY2FuIGVudW1lcmF0ZSBpdC4KClBhdGNoIDMgaW1wbGVt ZW50cyB0aGUgZW11bGF0b3IgdGhhdCBmaW5kcyBpZiBhIGZpbHRlciBtdXN0IHJldHVybiBhbGxv dywKClBhdGNoIDQgaW1wbGVtZW50cyB0aGUgdGVzdF9iaXQgYWdhaW5zdCB0aGUgYml0bWFwcy4K ClBhdGNoIDUgdXBkYXRlcyB0aGUgc2VsZnRlc3QgdG8gYmV0dGVyIHNob3cgdGhlIG5ldyBzZW1h bnRpY3MuCgpQYXRjaCA2IGltcGxlbWVudHMgL3Byb2MvcGlkL3NlY2NvbXBfY2FjaGUuCgpbMV0g aHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcvbGludXgtc2VjdXJpdHktbW9kdWxlL2MyMmE2YzNjZWZj MjQxMmNhZDAwYWUxNGMxMzcxNzExQGh1YXdlaS5jb20vVC8KWzJdIGh0dHBzOi8vbG9yZS5rZXJu ZWwub3JnL2xrbWwvMjAyMDA1MTgxMTIwLjk3MTIzMkI3QkBrZWVzY29vay9ULwpbM10gaHR0cHM6 Ly9naXRodWIuY29tL3NlY2NvbXAvbGlic2VjY29tcC9pc3N1ZXMvMTE2Cls0XSBodHRwczovL2dp dGh1Yi5jb20vbW9ieS9tb2J5L2Jsb2IvYWUwZWY4MmI5MDM1NmFjNjEzZjMyOWE4ZWY1ZWU0MmNh OTIzNDE3ZC9wcm9maWxlcy9zZWNjb21wL2RlZmF1bHQuanNvbgpbNV0gaHR0cHM6Ly9naXRodWIu Y29tL3N5c3RlbWQvc3lzdGVtZC9ibG9iLzY3NDNhMWNhZjQwMzdmMDNkYzUxYTEyNzc4NTUwMThl NGFiNjE5NTcvc3JjL3NoYXJlZC9zZWNjb21wLXV0aWwuYyNMMjcwCls2XSBEcmFjbzogQXJjaGl0 ZWN0dXJhbCBhbmQgT3BlcmF0aW5nIFN5c3RlbSBTdXBwb3J0IGZvciBTeXN0ZW0gQ2FsbCBTZWN1 cml0eQogICAgaHR0cHM6Ly90aWFueWluLmdpdGh1Yi5pby9wdWIvZHJhY28ucGRmLCBNSUNSTy01 MywgT2N0LiAyMDIwCgpLZWVzIENvb2sgKDEpOgogIHNlbGZ0ZXN0cy9zZWNjb21wOiBDb21wYXJl IGJpdG1hcCB2cyBmaWx0ZXIgb3ZlcmhlYWQKCllpRmVpIFpodSAoNSk6CiAgc2VjY29tcDogTW92 ZSBjb25maWcgb3B0aW9uIFNFQ0NPTVAgdG8gYXJjaC9LY29uZmlnCiAgYXNtL3N5c2NhbGwuaDog QWRkIHN5c2NhbGxfYXJjaGVzW10gYXJyYXkKICBzZWNjb21wL2NhY2hlOiBBZGQgImVtdWxhdG9y IiB0byBjaGVjayBpZiBmaWx0ZXIgaXMgYXJnLWRlcGVuZGVudAogIHNlY2NvbXAvY2FjaGU6IExv b2t1cCBzeXNjYWxsIGFsbG93bGlzdCBmb3IgZmFzdCBwYXRoCiAgc2VjY29tcC9jYWNoZTogUmVw b3J0IGNhY2hlIGRhdGEgdGhyb3VnaCAvcHJvYy9waWQvc2VjY29tcF9jYWNoZQoKIGFyY2gvS2Nv bmZpZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICA1NiArKysrCiBhcmNoL2Fs cGhhL2luY2x1ZGUvYXNtL3N5c2NhbGwuaCAgICAgICAgICAgICAgfCAgIDQgKwogYXJjaC9hcmMv aW5jbHVkZS9hc20vc3lzY2FsbC5oICAgICAgICAgICAgICAgIHwgIDI0ICstCiBhcmNoL2FybS9L Y29uZmlnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgMTUgKy0KIGFyY2gvYXJtL2lu Y2x1ZGUvYXNtL3N5c2NhbGwuaCAgICAgICAgICAgICAgICB8ICAgNCArCiBhcmNoL2FybTY0L0tj b25maWcgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgMTMgLQogYXJjaC9hcm02NC9pbmNs dWRlL2FzbS9zeXNjYWxsLmggICAgICAgICAgICAgIHwgICA0ICsKIGFyY2gvYzZ4L2luY2x1ZGUv YXNtL3N5c2NhbGwuaCAgICAgICAgICAgICAgICB8ICAxMyArLQogYXJjaC9jc2t5L0tjb25maWcg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgIDEzIC0KIGFyY2gvY3NreS9pbmNsdWRlL2Fz bS9zeXNjYWxsLmggICAgICAgICAgICAgICB8ICAgNCArCiBhcmNoL2g4MzAwL2luY2x1ZGUvYXNt L3N5c2NhbGwuaCAgICAgICAgICAgICAgfCAgIDQgKwogYXJjaC9oZXhhZ29uL2luY2x1ZGUvYXNt L3N5c2NhbGwuaCAgICAgICAgICAgIHwgICA0ICsKIGFyY2gvaWE2NC9pbmNsdWRlL2FzbS9zeXNj YWxsLmggICAgICAgICAgICAgICB8ICAgNCArCiBhcmNoL202OGsvaW5jbHVkZS9hc20vc3lzY2Fs bC5oICAgICAgICAgICAgICAgfCAgIDQgKwogYXJjaC9taWNyb2JsYXplL0tjb25maWcgICAgICAg ICAgICAgICAgICAgICAgIHwgIDE4ICstCiBhcmNoL21pY3JvYmxhemUvaW5jbHVkZS9hc20vc3lz Y2FsbC5oICAgICAgICAgfCAgIDQgKwogYXJjaC9taXBzL0tjb25maWcgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHwgIDE3IC0tCiBhcmNoL21pcHMvaW5jbHVkZS9hc20vc3lzY2FsbC5oICAg ICAgICAgICAgICAgfCAgMTYgKysKIGFyY2gvbmRzMzIvaW5jbHVkZS9hc20vc3lzY2FsbC5oICAg ICAgICAgICAgICB8ICAxMyArLQogYXJjaC9uaW9zMi9pbmNsdWRlL2FzbS9zeXNjYWxsLmggICAg ICAgICAgICAgIHwgICA0ICsKIGFyY2gvb3BlbnJpc2MvaW5jbHVkZS9hc20vc3lzY2FsbC5oICAg ICAgICAgICB8ICAgNCArCiBhcmNoL3BhcmlzYy9LY29uZmlnICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgMTYgLS0KIGFyY2gvcGFyaXNjL2luY2x1ZGUvYXNtL3N5c2NhbGwuaCAgICAgICAg ICAgICB8ICAgNyArCiBhcmNoL3Bvd2VycGMvS2NvbmZpZyAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgMTcgLS0KIGFyY2gvcG93ZXJwYy9pbmNsdWRlL2FzbS9zeXNjYWxsLmggICAgICAgICAg ICB8ICAxNCArCiBhcmNoL3Jpc2N2L0tjb25maWcgICAgICAgICAgICAgICAgICAgICAgICAgICAg fCAgMTMgLQogYXJjaC9yaXNjdi9pbmNsdWRlL2FzbS9zeXNjYWxsLmggICAgICAgICAgICAgIHwg IDE0ICstCiBhcmNoL3MzOTAvS2NvbmZpZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg MTcgLS0KIGFyY2gvczM5MC9pbmNsdWRlL2FzbS9zeXNjYWxsLmggICAgICAgICAgICAgICB8ICAg NyArCiBhcmNoL3NoL0tjb25maWcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgMTYg LS0KIGFyY2gvc2gvaW5jbHVkZS9hc20vc3lzY2FsbF8zMi5oICAgICAgICAgICAgICB8ICAxNyAr LQogYXJjaC9zcGFyYy9LY29uZmlnICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgIDE4ICst CiBhcmNoL3NwYXJjL2luY2x1ZGUvYXNtL3N5c2NhbGwuaCAgICAgICAgICAgICAgfCAgIDkgKwog YXJjaC91bS9LY29uZmlnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgIDE2IC0tCiBh cmNoL3g4Ni9LY29uZmlnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgMTYgLS0KIGFy Y2gveDg2L2luY2x1ZGUvYXNtL3N5c2NhbGwuaCAgICAgICAgICAgICAgICB8ICAxMSArCiBhcmNo L3g4Ni91bS9hc20vc3lzY2FsbC5oICAgICAgICAgICAgICAgICAgICAgfCAgMTQgKy0KIGFyY2gv eHRlbnNhL0tjb25maWcgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAxNCAtCiBhcmNoL3h0 ZW5zYS9pbmNsdWRlL2FzbS9zeXNjYWxsLmggICAgICAgICAgICAgfCAgIDQgKwogZnMvcHJvYy9i YXNlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICA3ICstCiBpbmNsdWRlL2xp bnV4L3NlY2NvbXAuaCAgICAgICAgICAgICAgICAgICAgICAgfCAgIDUgKwoga2VybmVsL3NlY2Nv bXAuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgMjU5ICsrKysrKysrKysrKysrKysr LQogLi4uL3NlbGZ0ZXN0cy9zZWNjb21wL3NlY2NvbXBfYmVuY2htYXJrLmMgICAgIHwgMTUxICsr KysrKysrLS0KIHRvb2xzL3Rlc3Rpbmcvc2VsZnRlc3RzL3NlY2NvbXAvc2V0dGluZ3MgICAgICB8 ICAgMiArLQogNDQgZmlsZXMgY2hhbmdlZCwgNjQxIGluc2VydGlvbnMoKyksIDI2NSBkZWxldGlv bnMoLSkKCi0tCjIuMjguMApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwpDb250YWluZXJzIG1haWxpbmcgbGlzdApDb250YWluZXJzQGxpc3RzLmxpbnV4LWZv dW5kYXRpb24ub3JnCmh0dHBzOi8vbGlzdHMubGludXhmb3VuZGF0aW9uLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2NvbnRhaW5lcnM=