From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.6 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78D55C433DF for ; Sun, 11 Oct 2020 15:48:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2D0CF20773 for ; Sun, 11 Oct 2020 15:48:58 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EFjSvhy+" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727694AbgJKPsE (ORCPT ); Sun, 11 Oct 2020 11:48:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55224 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725863AbgJKPsE (ORCPT ); Sun, 11 Oct 2020 11:48:04 -0400 Received: from mail-il1-x141.google.com (mail-il1-x141.google.com [IPv6:2607:f8b0:4864:20::141]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1E40BC0613CE; Sun, 11 Oct 2020 08:48:04 -0700 (PDT) Received: by mail-il1-x141.google.com with SMTP id p16so5240725ilq.5; Sun, 11 Oct 2020 08:48:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=kHYKIDIDeTpulpqBIExZneN//1D7RUZTGs0zWXRmJ+M=; b=EFjSvhy+/Vg/RFNcVz2tme2sumnn0FacIrta33xPBDecSiUBT6VNbWvyMPUKqDiYuW GJgc8g8l1Dy+mrZBsrIxGpiGIVTDCWWVBJhbltxCgIeUv2Annfr5mKCSTOdm/LClJqac /zVkVt0x7jRq+NxSNbsgxtaPwbtWUnvoI6rZJWlUKYjB4i5oI5guRCDkeVubU4CRcbBo iWJ9L5GQhMnOXywEyUsyMqDrCl1CHBQ0mYUVgJI4Tux55fabBB4++Qn49otksuUqAVQ9 pAMbDEo0mho+JR/Jcd1QVOBhMf0UdXhwIevaTCms5UDXBm3rmEZvsAet4N9ToQk6uK42 fKOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=kHYKIDIDeTpulpqBIExZneN//1D7RUZTGs0zWXRmJ+M=; b=JY6g/bR4jSWlpeoiMsnkWy4q5vVpx80eRAr1BJ2hmUCWa0QpZPfC2KgAcal1WwVD6J KtiotnqTXXlfTtyvlPW6HBaBCpn9IO1VOmM+0g/RSbGUkktSGSUrM0jfgndalvVGv6fl rhjRL8hQSNT91B+scGfn7UiGwI9BlLlDspeHq4ay6T8ZsYWY4az49Msx6vEc1V2gMowX DZWc6D7rlo8sEvNfTKaEjhaIFJXD5KPDtKTD66V6Msqvi24jjWXC0qWu9JjDkeO+Lt04 lBEcfTa084eKArt9GFgjXq8AlkYV5Wz+OT+aHNg3p3SdX09wdbJFDx0Cn0eR64DxzQbd MPxw== X-Gm-Message-State: AOAM532426yH4WvHGcYCs7on2IY2UDm2y4ZjfXhODBvz9B/lr7f7r42p lWLaoUxqF8hXxDtI9P0e2yo= X-Google-Smtp-Source: ABdhPJxdpQmSIcqRQBJfPSqhL1iyg/P2LaQ6twyD/J1ifUFOWtn0aKy5GDo9N52ZEhcBdLks8X+haw== X-Received: by 2002:a92:dd0f:: with SMTP id n15mr17002201ilm.227.1602431283142; Sun, 11 Oct 2020 08:48:03 -0700 (PDT) Received: from localhost.localdomain (host-173-230-99-154.tnkngak.clients.pavlovmedia.com. [173.230.99.154]) by smtp.gmail.com with ESMTPSA id q16sm7502881ilj.71.2020.10.11.08.48.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2020 08:48:02 -0700 (PDT) From: YiFei Zhu To: containers@lists.linux-foundation.org Cc: YiFei Zhu , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, Aleksa Sarai , Andrea Arcangeli , Andy Lutomirski , David Laight , Dimitrios Skarlatos , Giuseppe Scrivano , Hubertus Franke , Jack Chen , Jann Horn , Josep Torrellas , Kees Cook , Tianyin Xu , Tobin Feldman-Fitzthum , Tycho Andersen , Valentin Rothberg , Will Drewry Subject: [PATCH v5 seccomp 0/5]seccomp: Add bitmap cache of constant allow filter results Date: Sun, 11 Oct 2020 10:47:41 -0500 Message-Id: X-Mailer: git-send-email 2.28.0 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org From: YiFei Zhu Alternative: https://lore.kernel.org/lkml/20200923232923.3142503-1-keescook@chromium.org/T/ Major differences from the linked alternative by Kees: * No x32 special-case handling -- not worth the complexity * No caching of denylist -- not worth the complexity * No seccomp arch pinning -- I think this is an independent feature * The bitmaps are part of the filters rather than the task. This series adds a bitmap to cache seccomp filter results if the result permits a syscall and is indepenent of syscall arguments. This visibly decreases seccomp overhead for most common seccomp filters with very little memory footprint. The overhead of running Seccomp filters has been part of some past discussions [1][2][3]. Oftentimes, the filters have a large number of instructions that check syscall numbers one by one and jump based on that. Some users chain BPF filters which further enlarge the overhead. A recent work [6] comprehensively measures the Seccomp overhead and shows that the overhead is non-negligible and has a non-trivial impact on application performance. We observed some common filters, such as docker's [4] or systemd's [5], will make most decisions based only on the syscall numbers, and as past discussions considered, a bitmap where each bit represents a syscall makes most sense for these filters. In order to build this bitmap at filter attach time, each filter is emulated for every syscall (under each possible architecture), and checked for any accesses of struct seccomp_data that are not the "arch" nor "nr" (syscall) members. If only "arch" and "nr" are examined, and the program returns allow, then we can be sure that the filter must return allow independent from syscall arguments. When it is concluded that an allow must occur for the given architecture and syscall pair, seccomp will immediately allow the syscall, bypassing further BPF execution. Ongoing work is to further support arguments with fast hash table lookups. We are investigating the performance of doing so [6], and how to best integrate with the existing seccomp infrastructure. Some benchmarks are performed with results in patch 5, copied below: Current BPF sysctl settings: net.core.bpf_jit_enable = 1 net.core.bpf_jit_harden = 0 Benchmarking 200000000 syscalls... 129.359381409 - 0.008724424 = 129350656985 (129.4s) getpid native: 646 ns 264.385890006 - 129.360453229 = 135025436777 (135.0s) getpid RET_ALLOW 1 filter (bitmap): 675 ns 399.400511893 - 264.387045901 = 135013465992 (135.0s) getpid RET_ALLOW 2 filters (bitmap): 675 ns 545.872866260 - 399.401718327 = 146471147933 (146.5s) getpid RET_ALLOW 3 filters (full): 732 ns 696.337101319 - 545.874097681 = 150463003638 (150.5s) getpid RET_ALLOW 4 filters (full): 752 ns Estimated total seccomp overhead for 1 bitmapped filter: 29 ns Estimated total seccomp overhead for 2 bitmapped filters: 29 ns Estimated total seccomp overhead for 3 full filters: 86 ns Estimated total seccomp overhead for 4 full filters: 106 ns Estimated seccomp entry overhead: 29 ns Estimated seccomp per-filter overhead (last 2 diff): 20 ns Estimated seccomp per-filter overhead (filters / 4): 19 ns Expectations: native ≤ 1 bitmap (646 ≤ 675): ✔️ native ≤ 1 filter (646 ≤ 732): ✔️ per-filter (last 2 diff) ≈ per-filter (filters / 4) (20 ≈ 19): ✔️ 1 bitmapped ≈ 2 bitmapped (29 ≈ 29): ✔️ entry ≈ 1 bitmapped (29 ≈ 29): ✔️ entry ≈ 2 bitmapped (29 ≈ 29): ✔️ native + entry + (per filter * 4) ≈ 4 filters total (755 ≈ 752): ✔️ v4 -> v5: * Typo and wording fixes * Skip arch number test when there are only one arch * Fixed prog instruction number check. * Added comment about the behavior of x32. * /proc/pid/seccomp_cache return -ESRCH for exiting process. * Fixed /proc/pid/seccomp_cache depend on the architecture. * Fixed struct seq_file visibility reported by kernel test robot. v3 -> v4: * Reordered patches * Naming changes * Fixed racing in /proc/pid/seccomp_cache against filter being released from task, using Jann's suggestion of sighand spinlock. * Cache no longer configurable. * Copied some description from cover letter to commit messages. * Used Kees's logic to set clear bits from bitmap, rather than set bits. v2 -> v3: * Added array_index_nospec guards * No more syscall_arches[] array and expecting on loop unrolling. Arches are configured with per-arch seccomp.h. * Moved filter emulation to attach time (from prepare time). * Further simplified emulator, basing on Kees's code. * Guard /proc/pid/seccomp_cache with CAP_SYS_ADMIN. v1 -> v2: * Corrected one outdated function documentation. RFC -> v1: * Config made on by default across all arches that could support it. * Added arch numbers array and emulate filter for each arch number, and have a per-arch bitmap. * Massively simplified the emulator so it would only support the common instructions in Kees's list. * Fixed inheriting bitmap across filters (filter->prev is always NULL during prepare). * Stole the selftest from Kees. * Added a /proc/pid/seccomp_cache by Jann's suggestion. Patch 1 implements the test_bit against the bitmaps. Patch 2 implements the emulator that finds if a filter must return allow, Patch 3 adds the arch macros for x86. Patch 4 updates the selftest to better show the new semantics. Patch 5 implements /proc/pid/seccomp_cache. [1] https://lore.kernel.org/linux-security-module/c22a6c3cefc2412cad00ae14c1371711@huawei.com/T/ [2] https://lore.kernel.org/lkml/202005181120.971232B7B@keescook/T/ [3] https://github.com/seccomp/libseccomp/issues/116 [4] https://github.com/moby/moby/blob/ae0ef82b90356ac613f329a8ef5ee42ca923417d/profiles/seccomp/default.json [5] https://github.com/systemd/systemd/blob/6743a1caf4037f03dc51a1277855018e4ab61957/src/shared/seccomp-util.c#L270 [6] Draco: Architectural and Operating System Support for System Call Security https://tianyin.github.io/pub/draco.pdf, MICRO-53, Oct. 2020 Kees Cook (2): x86: Enable seccomp architecture tracking selftests/seccomp: Compare bitmap vs filter overhead YiFei Zhu (3): seccomp/cache: Lookup syscall allowlist bitmap for fast path seccomp/cache: Add "emulator" to check if filter is constant allow seccomp/cache: Report cache data through /proc/pid/seccomp_cache arch/Kconfig | 24 ++ arch/x86/Kconfig | 1 + arch/x86/include/asm/seccomp.h | 20 ++ fs/proc/base.c | 6 + include/linux/seccomp.h | 7 + kernel/seccomp.c | 292 +++++++++++++++++- .../selftests/seccomp/seccomp_benchmark.c | 151 +++++++-- tools/testing/selftests/seccomp/settings | 2 +- 8 files changed, 479 insertions(+), 24 deletions(-) -- 2.28.0 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.3 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8F8DC433E7 for ; Sun, 11 Oct 2020 15:48:08 +0000 (UTC) Received: from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 304AF20757 for ; Sun, 11 Oct 2020 15:48:07 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EFjSvhy+" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 304AF20757 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=containers-bounces@lists.linux-foundation.org Received: from localhost (localhost [127.0.0.1]) by hemlock.osuosl.org (Postfix) with ESMTP id C68E087091; Sun, 11 Oct 2020 15:48:07 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from hemlock.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fd0zH-rRvB3S; Sun, 11 Oct 2020 15:48:06 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by hemlock.osuosl.org (Postfix) with ESMTP id DB6D087083; Sun, 11 Oct 2020 15:48:06 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id B143CC07FF; Sun, 11 Oct 2020 15:48:06 +0000 (UTC) Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists.linuxfoundation.org (Postfix) with ESMTP id 6D3B1C0051 for ; Sun, 11 Oct 2020 15:48:05 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 527CC86194 for ; Sun, 11 Oct 2020 15:48:05 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 442pkn8KImCQ for ; Sun, 11 Oct 2020 15:48:04 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-il1-f196.google.com (mail-il1-f196.google.com [209.85.166.196]) by fraxinus.osuosl.org (Postfix) with ESMTPS id 2344E86542 for ; Sun, 11 Oct 2020 15:48:04 +0000 (UTC) Received: by mail-il1-f196.google.com with SMTP id r10so8812545ilm.11 for ; Sun, 11 Oct 2020 08:48:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=kHYKIDIDeTpulpqBIExZneN//1D7RUZTGs0zWXRmJ+M=; b=EFjSvhy+/Vg/RFNcVz2tme2sumnn0FacIrta33xPBDecSiUBT6VNbWvyMPUKqDiYuW GJgc8g8l1Dy+mrZBsrIxGpiGIVTDCWWVBJhbltxCgIeUv2Annfr5mKCSTOdm/LClJqac /zVkVt0x7jRq+NxSNbsgxtaPwbtWUnvoI6rZJWlUKYjB4i5oI5guRCDkeVubU4CRcbBo iWJ9L5GQhMnOXywEyUsyMqDrCl1CHBQ0mYUVgJI4Tux55fabBB4++Qn49otksuUqAVQ9 pAMbDEo0mho+JR/Jcd1QVOBhMf0UdXhwIevaTCms5UDXBm3rmEZvsAet4N9ToQk6uK42 fKOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=kHYKIDIDeTpulpqBIExZneN//1D7RUZTGs0zWXRmJ+M=; b=fo+avdUdIgWrr/xCEkAO2RPA1DdWn3Jctd+JpCna68Xdy6OMI9L0L8KLrBMkYoqmAS g6ubh1c2hK6grLEcnLSgr7+lJiusW07FBTJpNmEG079yRCHGX4I2/OrcVy+I3miA4J3k Re5NKFcuZDRwlnlbMfCgp80SnsfFOxudB8Rshee6EdqsF3NCg8zRu3/pmqsIgVlm0SKs Y1/IMf0VQFg3cpfwrVg86uyEBWbs/Iezu3U+v/28VqLj+YglMo01u64OY91Z64/AanYY Z3n3ZROxVirNDMeuqy8k7Fcgn1dpdFsowpPEEFb8gywMCcJ4cX9WcRW3AciSRzMCjH7e Gb+g== X-Gm-Message-State: AOAM532BYBg/aiGd/w31cmwNvvHBHtDKvo5ng7OQYWM+UFu2d6P8X5OK oOAbcBBCCU+tJOtV9m1rG4QuU9QXfqqTiw== X-Google-Smtp-Source: ABdhPJxdpQmSIcqRQBJfPSqhL1iyg/P2LaQ6twyD/J1ifUFOWtn0aKy5GDo9N52ZEhcBdLks8X+haw== X-Received: by 2002:a92:dd0f:: with SMTP id n15mr17002201ilm.227.1602431283142; Sun, 11 Oct 2020 08:48:03 -0700 (PDT) Received: from localhost.localdomain (host-173-230-99-154.tnkngak.clients.pavlovmedia.com. [173.230.99.154]) by smtp.gmail.com with ESMTPSA id q16sm7502881ilj.71.2020.10.11.08.48.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2020 08:48:02 -0700 (PDT) From: YiFei Zhu To: containers@lists.linux-foundation.org Subject: [PATCH v5 seccomp 0/5]seccomp: Add bitmap cache of constant allow filter results Date: Sun, 11 Oct 2020 10:47:41 -0500 Message-Id: X-Mailer: git-send-email 2.28.0 In-Reply-To: References: MIME-Version: 1.0 Cc: Andrea Arcangeli , Giuseppe Scrivano , Valentin Rothberg , Kees Cook , Jann Horn , YiFei Zhu , Tobin Feldman-Fitzthum , linux-kernel@vger.kernel.org, Andy Lutomirski , Hubertus Franke , David Laight , Jack Chen , Dimitrios Skarlatos , Josep Torrellas , Will Drewry , bpf@vger.kernel.org, Tianyin Xu X-BeenThere: containers@lists.linux-foundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Linux Containers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: containers-bounces@lists.linux-foundation.org Sender: "Containers" RnJvbTogWWlGZWkgWmh1IDx5aWZlaWZ6MkBpbGxpbm9pcy5lZHU+CgpBbHRlcm5hdGl2ZTogaHR0 cHM6Ly9sb3JlLmtlcm5lbC5vcmcvbGttbC8yMDIwMDkyMzIzMjkyMy4zMTQyNTAzLTEta2Vlc2Nv b2tAY2hyb21pdW0ub3JnL1QvCgpNYWpvciBkaWZmZXJlbmNlcyBmcm9tIHRoZSBsaW5rZWQgYWx0 ZXJuYXRpdmUgYnkgS2VlczoKKiBObyB4MzIgc3BlY2lhbC1jYXNlIGhhbmRsaW5nIC0tIG5vdCB3 b3J0aCB0aGUgY29tcGxleGl0eQoqIE5vIGNhY2hpbmcgb2YgZGVueWxpc3QgLS0gbm90IHdvcnRo IHRoZSBjb21wbGV4aXR5CiogTm8gc2VjY29tcCBhcmNoIHBpbm5pbmcgLS0gSSB0aGluayB0aGlz IGlzIGFuIGluZGVwZW5kZW50IGZlYXR1cmUKKiBUaGUgYml0bWFwcyBhcmUgcGFydCBvZiB0aGUg ZmlsdGVycyByYXRoZXIgdGhhbiB0aGUgdGFzay4KClRoaXMgc2VyaWVzIGFkZHMgYSBiaXRtYXAg dG8gY2FjaGUgc2VjY29tcCBmaWx0ZXIgcmVzdWx0cyBpZiB0aGUKcmVzdWx0IHBlcm1pdHMgYSBz eXNjYWxsIGFuZCBpcyBpbmRlcGVuZW50IG9mIHN5c2NhbGwgYXJndW1lbnRzLgpUaGlzIHZpc2li bHkgZGVjcmVhc2VzIHNlY2NvbXAgb3ZlcmhlYWQgZm9yIG1vc3QgY29tbW9uIHNlY2NvbXAKZmls dGVycyB3aXRoIHZlcnkgbGl0dGxlIG1lbW9yeSBmb290cHJpbnQuCgpUaGUgb3ZlcmhlYWQgb2Yg cnVubmluZyBTZWNjb21wIGZpbHRlcnMgaGFzIGJlZW4gcGFydCBvZiBzb21lIHBhc3QKZGlzY3Vz c2lvbnMgWzFdWzJdWzNdLiBPZnRlbnRpbWVzLCB0aGUgZmlsdGVycyBoYXZlIGEgbGFyZ2UgbnVt YmVyCm9mIGluc3RydWN0aW9ucyB0aGF0IGNoZWNrIHN5c2NhbGwgbnVtYmVycyBvbmUgYnkgb25l IGFuZCBqdW1wIGJhc2VkCm9uIHRoYXQuIFNvbWUgdXNlcnMgY2hhaW4gQlBGIGZpbHRlcnMgd2hp Y2ggZnVydGhlciBlbmxhcmdlIHRoZQpvdmVyaGVhZC4gQSByZWNlbnQgd29yayBbNl0gY29tcHJl aGVuc2l2ZWx5IG1lYXN1cmVzIHRoZSBTZWNjb21wCm92ZXJoZWFkIGFuZCBzaG93cyB0aGF0IHRo ZSBvdmVyaGVhZCBpcyBub24tbmVnbGlnaWJsZSBhbmQgaGFzIGEKbm9uLXRyaXZpYWwgaW1wYWN0 IG9uIGFwcGxpY2F0aW9uIHBlcmZvcm1hbmNlLgoKV2Ugb2JzZXJ2ZWQgc29tZSBjb21tb24gZmls dGVycywgc3VjaCBhcyBkb2NrZXIncyBbNF0gb3IKc3lzdGVtZCdzIFs1XSwgd2lsbCBtYWtlIG1v c3QgZGVjaXNpb25zIGJhc2VkIG9ubHkgb24gdGhlIHN5c2NhbGwKbnVtYmVycywgYW5kIGFzIHBh c3QgZGlzY3Vzc2lvbnMgY29uc2lkZXJlZCwgYSBiaXRtYXAgd2hlcmUgZWFjaCBiaXQKcmVwcmVz ZW50cyBhIHN5c2NhbGwgbWFrZXMgbW9zdCBzZW5zZSBmb3IgdGhlc2UgZmlsdGVycy4KCkluIG9y ZGVyIHRvIGJ1aWxkIHRoaXMgYml0bWFwIGF0IGZpbHRlciBhdHRhY2ggdGltZSwgZWFjaCBmaWx0 ZXIgaXMKZW11bGF0ZWQgZm9yIGV2ZXJ5IHN5c2NhbGwgKHVuZGVyIGVhY2ggcG9zc2libGUgYXJj aGl0ZWN0dXJlKSwgYW5kCmNoZWNrZWQgZm9yIGFueSBhY2Nlc3NlcyBvZiBzdHJ1Y3Qgc2VjY29t cF9kYXRhIHRoYXQgYXJlIG5vdCB0aGUgImFyY2giCm5vciAibnIiIChzeXNjYWxsKSBtZW1iZXJz LiBJZiBvbmx5ICJhcmNoIiBhbmQgIm5yIiBhcmUgZXhhbWluZWQsIGFuZAp0aGUgcHJvZ3JhbSBy ZXR1cm5zIGFsbG93LCB0aGVuIHdlIGNhbiBiZSBzdXJlIHRoYXQgdGhlIGZpbHRlciBtdXN0CnJl dHVybiBhbGxvdyBpbmRlcGVuZGVudCBmcm9tIHN5c2NhbGwgYXJndW1lbnRzLgoKV2hlbiBpdCBp cyBjb25jbHVkZWQgdGhhdCBhbiBhbGxvdyBtdXN0IG9jY3VyIGZvciB0aGUgZ2l2ZW4KYXJjaGl0 ZWN0dXJlIGFuZCBzeXNjYWxsIHBhaXIsIHNlY2NvbXAgd2lsbCBpbW1lZGlhdGVseSBhbGxvdwp0 aGUgc3lzY2FsbCwgYnlwYXNzaW5nIGZ1cnRoZXIgQlBGIGV4ZWN1dGlvbi4KCk9uZ29pbmcgd29y ayBpcyB0byBmdXJ0aGVyIHN1cHBvcnQgYXJndW1lbnRzIHdpdGggZmFzdCBoYXNoIHRhYmxlCmxv b2t1cHMuIFdlIGFyZSBpbnZlc3RpZ2F0aW5nIHRoZSBwZXJmb3JtYW5jZSBvZiBkb2luZyBzbyBb Nl0sIGFuZCBob3cKdG8gYmVzdCBpbnRlZ3JhdGUgd2l0aCB0aGUgZXhpc3Rpbmcgc2VjY29tcCBp bmZyYXN0cnVjdHVyZS4KClNvbWUgYmVuY2htYXJrcyBhcmUgcGVyZm9ybWVkIHdpdGggcmVzdWx0 cyBpbiBwYXRjaCA1LCBjb3BpZWQgYmVsb3c6CiAgQ3VycmVudCBCUEYgc3lzY3RsIHNldHRpbmdz OgogIG5ldC5jb3JlLmJwZl9qaXRfZW5hYmxlID0gMQogIG5ldC5jb3JlLmJwZl9qaXRfaGFyZGVu ID0gMAogIEJlbmNobWFya2luZyAyMDAwMDAwMDAgc3lzY2FsbHMuLi4KICAxMjkuMzU5MzgxNDA5 IC0gMC4wMDg3MjQ0MjQgPSAxMjkzNTA2NTY5ODUgKDEyOS40cykKICBnZXRwaWQgbmF0aXZlOiA2 NDYgbnMKICAyNjQuMzg1ODkwMDA2IC0gMTI5LjM2MDQ1MzIyOSA9IDEzNTAyNTQzNjc3NyAoMTM1 LjBzKQogIGdldHBpZCBSRVRfQUxMT1cgMSBmaWx0ZXIgKGJpdG1hcCk6IDY3NSBucwogIDM5OS40 MDA1MTE4OTMgLSAyNjQuMzg3MDQ1OTAxID0gMTM1MDEzNDY1OTkyICgxMzUuMHMpCiAgZ2V0cGlk IFJFVF9BTExPVyAyIGZpbHRlcnMgKGJpdG1hcCk6IDY3NSBucwogIDU0NS44NzI4NjYyNjAgLSAz OTkuNDAxNzE4MzI3ID0gMTQ2NDcxMTQ3OTMzICgxNDYuNXMpCiAgZ2V0cGlkIFJFVF9BTExPVyAz IGZpbHRlcnMgKGZ1bGwpOiA3MzIgbnMKICA2OTYuMzM3MTAxMzE5IC0gNTQ1Ljg3NDA5NzY4MSA9 IDE1MDQ2MzAwMzYzOCAoMTUwLjVzKQogIGdldHBpZCBSRVRfQUxMT1cgNCBmaWx0ZXJzIChmdWxs KTogNzUyIG5zCiAgRXN0aW1hdGVkIHRvdGFsIHNlY2NvbXAgb3ZlcmhlYWQgZm9yIDEgYml0bWFw cGVkIGZpbHRlcjogMjkgbnMKICBFc3RpbWF0ZWQgdG90YWwgc2VjY29tcCBvdmVyaGVhZCBmb3Ig MiBiaXRtYXBwZWQgZmlsdGVyczogMjkgbnMKICBFc3RpbWF0ZWQgdG90YWwgc2VjY29tcCBvdmVy aGVhZCBmb3IgMyBmdWxsIGZpbHRlcnM6IDg2IG5zCiAgRXN0aW1hdGVkIHRvdGFsIHNlY2NvbXAg b3ZlcmhlYWQgZm9yIDQgZnVsbCBmaWx0ZXJzOiAxMDYgbnMKICBFc3RpbWF0ZWQgc2VjY29tcCBl bnRyeSBvdmVyaGVhZDogMjkgbnMKICBFc3RpbWF0ZWQgc2VjY29tcCBwZXItZmlsdGVyIG92ZXJo ZWFkIChsYXN0IDIgZGlmZik6IDIwIG5zCiAgRXN0aW1hdGVkIHNlY2NvbXAgcGVyLWZpbHRlciBv dmVyaGVhZCAoZmlsdGVycyAvIDQpOiAxOSBucwogIEV4cGVjdGF0aW9uczoKICAJbmF0aXZlIOKJ pCAxIGJpdG1hcCAoNjQ2IOKJpCA2NzUpOiDinJTvuI8KICAJbmF0aXZlIOKJpCAxIGZpbHRlciAo NjQ2IOKJpCA3MzIpOiDinJTvuI8KICAJcGVyLWZpbHRlciAobGFzdCAyIGRpZmYpIOKJiCBwZXIt ZmlsdGVyIChmaWx0ZXJzIC8gNCkgKDIwIOKJiCAxOSk6IOKclO+4jwogIAkxIGJpdG1hcHBlZCDi iYggMiBiaXRtYXBwZWQgKDI5IOKJiCAyOSk6IOKclO+4jwogIAllbnRyeSDiiYggMSBiaXRtYXBw ZWQgKDI5IOKJiCAyOSk6IOKclO+4jwogIAllbnRyeSDiiYggMiBiaXRtYXBwZWQgKDI5IOKJiCAy OSk6IOKclO+4jwogIAluYXRpdmUgKyBlbnRyeSArIChwZXIgZmlsdGVyICogNCkg4omIIDQgZmls dGVycyB0b3RhbCAoNzU1IOKJiCA3NTIpOiDinJTvuI8KCnY0IC0+IHY1OgoqIFR5cG8gYW5kIHdv cmRpbmcgZml4ZXMKKiBTa2lwIGFyY2ggbnVtYmVyIHRlc3Qgd2hlbiB0aGVyZSBhcmUgb25seSBv bmUgYXJjaAoqIEZpeGVkIHByb2cgaW5zdHJ1Y3Rpb24gbnVtYmVyIGNoZWNrLgoqIEFkZGVkIGNv bW1lbnQgYWJvdXQgdGhlIGJlaGF2aW9yIG9mIHgzMi4KKiAvcHJvYy9waWQvc2VjY29tcF9jYWNo ZSByZXR1cm4gLUVTUkNIIGZvciBleGl0aW5nIHByb2Nlc3MuCiogRml4ZWQgL3Byb2MvcGlkL3Nl Y2NvbXBfY2FjaGUgZGVwZW5kIG9uIHRoZSBhcmNoaXRlY3R1cmUuCiogRml4ZWQgc3RydWN0IHNl cV9maWxlIHZpc2liaWxpdHkgcmVwb3J0ZWQgYnkga2VybmVsIHRlc3Qgcm9ib3QuCgp2MyAtPiB2 NDoKKiBSZW9yZGVyZWQgcGF0Y2hlcwoqIE5hbWluZyBjaGFuZ2VzCiogRml4ZWQgcmFjaW5nIGlu IC9wcm9jL3BpZC9zZWNjb21wX2NhY2hlIGFnYWluc3QgZmlsdGVyIGJlaW5nIHJlbGVhc2VkCiAg ZnJvbSB0YXNrLCB1c2luZyBKYW5uJ3Mgc3VnZ2VzdGlvbiBvZiBzaWdoYW5kIHNwaW5sb2NrLgoq IENhY2hlIG5vIGxvbmdlciBjb25maWd1cmFibGUuCiogQ29waWVkIHNvbWUgZGVzY3JpcHRpb24g ZnJvbSBjb3ZlciBsZXR0ZXIgdG8gY29tbWl0IG1lc3NhZ2VzLgoqIFVzZWQgS2VlcydzIGxvZ2lj IHRvIHNldCBjbGVhciBiaXRzIGZyb20gYml0bWFwLCByYXRoZXIgdGhhbiBzZXQgYml0cy4KCnYy IC0+IHYzOgoqIEFkZGVkIGFycmF5X2luZGV4X25vc3BlYyBndWFyZHMKKiBObyBtb3JlIHN5c2Nh bGxfYXJjaGVzW10gYXJyYXkgYW5kIGV4cGVjdGluZyBvbiBsb29wIHVucm9sbGluZy4gQXJjaGVz CiAgYXJlIGNvbmZpZ3VyZWQgd2l0aCBwZXItYXJjaCBzZWNjb21wLmguCiogTW92ZWQgZmlsdGVy IGVtdWxhdGlvbiB0byBhdHRhY2ggdGltZSAoZnJvbSBwcmVwYXJlIHRpbWUpLgoqIEZ1cnRoZXIg c2ltcGxpZmllZCBlbXVsYXRvciwgYmFzaW5nIG9uIEtlZXMncyBjb2RlLgoqIEd1YXJkIC9wcm9j L3BpZC9zZWNjb21wX2NhY2hlIHdpdGggQ0FQX1NZU19BRE1JTi4KCnYxIC0+IHYyOgoqIENvcnJl Y3RlZCBvbmUgb3V0ZGF0ZWQgZnVuY3Rpb24gZG9jdW1lbnRhdGlvbi4KClJGQyAtPiB2MToKKiBD b25maWcgbWFkZSBvbiBieSBkZWZhdWx0IGFjcm9zcyBhbGwgYXJjaGVzIHRoYXQgY291bGQgc3Vw cG9ydCBpdC4KKiBBZGRlZCBhcmNoIG51bWJlcnMgYXJyYXkgYW5kIGVtdWxhdGUgZmlsdGVyIGZv ciBlYWNoIGFyY2ggbnVtYmVyLCBhbmQKICBoYXZlIGEgcGVyLWFyY2ggYml0bWFwLgoqIE1hc3Np dmVseSBzaW1wbGlmaWVkIHRoZSBlbXVsYXRvciBzbyBpdCB3b3VsZCBvbmx5IHN1cHBvcnQgdGhl IGNvbW1vbgogIGluc3RydWN0aW9ucyBpbiBLZWVzJ3MgbGlzdC4KKiBGaXhlZCBpbmhlcml0aW5n IGJpdG1hcCBhY3Jvc3MgZmlsdGVycyAoZmlsdGVyLT5wcmV2IGlzIGFsd2F5cyBOVUxMCiAgZHVy aW5nIHByZXBhcmUpLgoqIFN0b2xlIHRoZSBzZWxmdGVzdCBmcm9tIEtlZXMuCiogQWRkZWQgYSAv cHJvYy9waWQvc2VjY29tcF9jYWNoZSBieSBKYW5uJ3Mgc3VnZ2VzdGlvbi4KClBhdGNoIDEgaW1w bGVtZW50cyB0aGUgdGVzdF9iaXQgYWdhaW5zdCB0aGUgYml0bWFwcy4KClBhdGNoIDIgaW1wbGVt ZW50cyB0aGUgZW11bGF0b3IgdGhhdCBmaW5kcyBpZiBhIGZpbHRlciBtdXN0IHJldHVybiBhbGxv dywKClBhdGNoIDMgYWRkcyB0aGUgYXJjaCBtYWNyb3MgZm9yIHg4Ni4KClBhdGNoIDQgdXBkYXRl cyB0aGUgc2VsZnRlc3QgdG8gYmV0dGVyIHNob3cgdGhlIG5ldyBzZW1hbnRpY3MuCgpQYXRjaCA1 IGltcGxlbWVudHMgL3Byb2MvcGlkL3NlY2NvbXBfY2FjaGUuCgpbMV0gaHR0cHM6Ly9sb3JlLmtl cm5lbC5vcmcvbGludXgtc2VjdXJpdHktbW9kdWxlL2MyMmE2YzNjZWZjMjQxMmNhZDAwYWUxNGMx MzcxNzExQGh1YXdlaS5jb20vVC8KWzJdIGh0dHBzOi8vbG9yZS5rZXJuZWwub3JnL2xrbWwvMjAy MDA1MTgxMTIwLjk3MTIzMkI3QkBrZWVzY29vay9ULwpbM10gaHR0cHM6Ly9naXRodWIuY29tL3Nl Y2NvbXAvbGlic2VjY29tcC9pc3N1ZXMvMTE2Cls0XSBodHRwczovL2dpdGh1Yi5jb20vbW9ieS9t b2J5L2Jsb2IvYWUwZWY4MmI5MDM1NmFjNjEzZjMyOWE4ZWY1ZWU0MmNhOTIzNDE3ZC9wcm9maWxl cy9zZWNjb21wL2RlZmF1bHQuanNvbgpbNV0gaHR0cHM6Ly9naXRodWIuY29tL3N5c3RlbWQvc3lz dGVtZC9ibG9iLzY3NDNhMWNhZjQwMzdmMDNkYzUxYTEyNzc4NTUwMThlNGFiNjE5NTcvc3JjL3No YXJlZC9zZWNjb21wLXV0aWwuYyNMMjcwCls2XSBEcmFjbzogQXJjaGl0ZWN0dXJhbCBhbmQgT3Bl cmF0aW5nIFN5c3RlbSBTdXBwb3J0IGZvciBTeXN0ZW0gQ2FsbCBTZWN1cml0eQogICAgaHR0cHM6 Ly90aWFueWluLmdpdGh1Yi5pby9wdWIvZHJhY28ucGRmLCBNSUNSTy01MywgT2N0LiAyMDIwCgpL ZWVzIENvb2sgKDIpOgogIHg4NjogRW5hYmxlIHNlY2NvbXAgYXJjaGl0ZWN0dXJlIHRyYWNraW5n CiAgc2VsZnRlc3RzL3NlY2NvbXA6IENvbXBhcmUgYml0bWFwIHZzIGZpbHRlciBvdmVyaGVhZAoK WWlGZWkgWmh1ICgzKToKICBzZWNjb21wL2NhY2hlOiBMb29rdXAgc3lzY2FsbCBhbGxvd2xpc3Qg Yml0bWFwIGZvciBmYXN0IHBhdGgKICBzZWNjb21wL2NhY2hlOiBBZGQgImVtdWxhdG9yIiB0byBj aGVjayBpZiBmaWx0ZXIgaXMgY29uc3RhbnQgYWxsb3cKICBzZWNjb21wL2NhY2hlOiBSZXBvcnQg Y2FjaGUgZGF0YSB0aHJvdWdoIC9wcm9jL3BpZC9zZWNjb21wX2NhY2hlCgogYXJjaC9LY29uZmln ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgIDI0ICsrCiBhcmNoL3g4Ni9LY29u ZmlnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDEgKwogYXJjaC94ODYvaW5jbHVk ZS9hc20vc2VjY29tcC5oICAgICAgICAgICAgICAgIHwgIDIwICsrCiBmcy9wcm9jL2Jhc2UuYyAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDYgKwogaW5jbHVkZS9saW51eC9zZWNj b21wLmggICAgICAgICAgICAgICAgICAgICAgIHwgICA3ICsKIGtlcm5lbC9zZWNjb21wLmMgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB8IDI5MiArKysrKysrKysrKysrKysrKy0KIC4uLi9z ZWxmdGVzdHMvc2VjY29tcC9zZWNjb21wX2JlbmNobWFyay5jICAgICB8IDE1MSArKysrKysrLS0K IHRvb2xzL3Rlc3Rpbmcvc2VsZnRlc3RzL3NlY2NvbXAvc2V0dGluZ3MgICAgICB8ICAgMiArLQog OCBmaWxlcyBjaGFuZ2VkLCA0NzkgaW5zZXJ0aW9ucygrKSwgMjQgZGVsZXRpb25zKC0pCgotLQoy LjI4LjAKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KQ29u dGFpbmVycyBtYWlsaW5nIGxpc3QKQ29udGFpbmVyc0BsaXN0cy5saW51eC1mb3VuZGF0aW9uLm9y ZwpodHRwczovL2xpc3RzLmxpbnV4Zm91bmRhdGlvbi5vcmcvbWFpbG1hbi9saXN0aW5mby9jb250 YWluZXJz