From mboxrd@z Thu Jan 1 00:00:00 1970 From: Xen.org security team Subject: Xen Security Advisory 241 (CVE-2017-15588) - Stale TLB entry due to page type release race Date: Wed, 18 Oct 2017 12:08:34 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary Return-path: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com Cc: "Xen.org security team" List-Id: xen-devel@lists.xenproject.org --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2017-15588 / XSA-241 version 4 Stale TLB entry due to page type release race UPDATES IN VERSION 4 ==================== CVE assigned. ISSUE DESCRIPTION ================= x86 PV guests effect TLB flushes by way of a hypercall. Xen tries to reduce the number of TLB flushes by delaying them as much as possible. When the last type reference of a page is dropped, the need for a TLB flush (before the page is re-used) is recorded. If a guest TLB flush request involves an Inter Processor Interrupt (IPI) to a CPU in which is the process of dropping the last type reference of some page, and if that IPI arrives at exactly the right instruction boundary, a stale time stamp may be recorded, possibly resulting in the later omission of the necessary TLB flush for that page. IMPACT ====== A malicious x86 PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks. VULNERABLE SYSTEMS ================== All Xen versions from at least 3.2 onwards are vulnerable. Earlier versions have not been checked. Only x86 systems are affected. ARM systems are not affected. Only x86 PV guests can leverage the vulnerability. x86 HVM guests cannot leverage the vulnerability. RISK ASSESSMENT =============== A successful attack would require introducing an extended delay between two adjacent operations on one cpu -- long enough for two hypercalls to complete on another cpu. The security team currently has no proof-of-concept for this vulnerability. However, techniques for these sorts of timing-based attacks are continually advancing, so we still recommend users potentially affected by this issue apply the patch as soon as reasonably possible. MITIGATION ========== Running only HVM guests will avoid this vulnerability. For PV guests, the vulnerability can be avoided if the guest kernel is controlled by the host rather than guest administrator, provided that further steps are taken to prevent the guest administrator from loading code into the kernel (e.g. by disabling loadable modules etc) or from using other mechanisms which allow them to run code at kernel privilege. CREDITS ======= This issue was discovered by Jann Horn of Google Project Zero. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. xsa241.patch xen-unstable xsa241-4.9.patch Xen 4.9.x xsa241-4.8.patch Xen 4.8.x, Xen 4.7.x, Xen 4.6.x, Xen 4.5.x $ sha256sum xsa241* 5e239ba4dbd74fd61e59a27f9abc8ea6ba32532bdf81eeb2d7e66f0fd53e40b4 xsa241.meta b8db933d53e7e289652ffda6c46ce284a0254a9f8bc9e1be6793e388009f49ce xsa241.patch 443a5b0818045ada44fad0370ac01af0c96181be5a4078ae3b2575799e4a4e5b xsa241-4.8.patch 927ef14d875556481c38d4065f501211a78eec1c2396a954a4a4abfb9255960f xsa241-4.9.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBCAAGBQJZ50QlAAoJEIP+FMlX6CvZp/cH/2z+BXU30Jg8PlfnXM7LDulR +ZyoPggsqJfE8AlY7XmsPXo8qY1vsG1NHI6D0YoTvgQyFDVa2h2IBkIc/aZd7jfW iUYTluAQcxFKSC7G02HCrMdY6w9HkpIo4AtYw9Rm6tueF9/0vaWm0jy7MCMrNxAt Dbx8a91dkKiJ9MImLralZUMewK6kym1p2PhVPgWmF3lprvLiLSbRu19eiYSAdjBa C8ulKhUZsDymM3Lpe+F7+9FATZ58sEyvqgAach0Wn/vhaJ0axHroW3KKVCdNMNVJ AqFHjv6NKgHGS3HU9TEOCfCptYqE+Ne/UB4M19nVOZulfZn4Ok2MgBvogJXIA/Q= =7sHr -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa241.meta" Content-Disposition: attachment; filename="xsa241.meta" Content-Transfer-Encoding: base64 ewogICJYU0EiOiAyNDEsCiAgIlN1cHBvcnRlZFZlcnNpb25zIjogWwogICAg Im1hc3RlciIsCiAgICAiNC45IiwKICAgICI0LjgiLAogICAgIjQuNyIsCiAg ICAiNC42IiwKICAgICI0LjUiCiAgXSwKICAiVHJlZXMiOiBbCiAgICAieGVu IgogIF0sCiAgIlJlY2lwZXMiOiB7CiAgICAiNC41IjogewogICAgICAiWGVu VmVyc2lvbiI6ICI0LjUiLAogICAgICAiUmVjaXBlcyI6IHsKICAgICAgICAi eGVuIjogewogICAgICAgICAgIlN0YWJsZVJlZiI6ICI4MzcyNGQ5ZjNhZTIx YTNiOTYzNjI3NDJlMmYwNTJiMTlkOWY1NTlhIiwKICAgICAgICAgICJQcmVy ZXFzIjogWwogICAgICAgICAgICAyMzcsCiAgICAgICAgICAgIDIzOCwKICAg ICAgICAgICAgMjM5LAogICAgICAgICAgICAyNDAKICAgICAgICAgIF0sCiAg ICAgICAgICAiUGF0Y2hlcyI6IFsKICAgICAgICAgICAgInhzYTI0MS00Ljku cGF0Y2giCiAgICAgICAgICBdCiAgICAgICAgfQogICAgICB9CiAgICB9LAog ICAgIjQuNiI6IHsKICAgICAgIlhlblZlcnNpb24iOiAiNC42IiwKICAgICAg IlJlY2lwZXMiOiB7CiAgICAgICAgInhlbiI6IHsKICAgICAgICAgICJTdGFi bGVSZWYiOiAiMTY1OGE4NzY5MGFjODM5ZTg1ZGIxMmJiZjQwOWJlNjJiYjkz ODY0MCIsCiAgICAgICAgICAiUHJlcmVxcyI6IFsKICAgICAgICAgICAgMjM3 LAogICAgICAgICAgICAyMzgsCiAgICAgICAgICAgIDIzOSwKICAgICAgICAg ICAgMjQwCiAgICAgICAgICBdLAogICAgICAgICAgIlBhdGNoZXMiOiBbCiAg ICAgICAgICAgICJ4c2EyNDEtNC45LnBhdGNoIgogICAgICAgICAgXQogICAg ICAgIH0KICAgICAgfQogICAgfSwKICAgICI0LjciOiB7CiAgICAgICJYZW5W ZXJzaW9uIjogIjQuNyIsCiAgICAgICJSZWNpcGVzIjogewogICAgICAgICJ4 ZW4iOiB7CiAgICAgICAgICAiU3RhYmxlUmVmIjogImM3NzgzZDljMjZmYzE5 MTg2MmQ5ODgzZGEyMjM4NzM0MGIxZmFiMTgiLAogICAgICAgICAgIlByZXJl cXMiOiBbCiAgICAgICAgICAgIDIzNywKICAgICAgICAgICAgMjM4LAogICAg ICAgICAgICAyMzksCiAgICAgICAgICAgIDI0MAogICAgICAgICAgXSwKICAg ICAgICAgICJQYXRjaGVzIjogWwogICAgICAgICAgICAieHNhMjQxLTQuOS5w YXRjaCIKICAgICAgICAgIF0KICAgICAgICB9CiAgICAgIH0KICAgIH0sCiAg ICAiNC44IjogewogICAgICAiWGVuVmVyc2lvbiI6ICI0LjgiLAogICAgICAi UmVjaXBlcyI6IHsKICAgICAgICAieGVuIjogewogICAgICAgICAgIlN0YWJs ZVJlZiI6ICIzNjg5OGViMTI1NzJmMGExZjg1Y2I1NGQ0YTllOTBhZmNiNmY3 MDQ1IiwKICAgICAgICAgICJQcmVyZXFzIjogWwogICAgICAgICAgICAyMzcs CiAgICAgICAgICAgIDIzOCwKICAgICAgICAgICAgMjM5LAogICAgICAgICAg ICAyNDAKICAgICAgICAgIF0sCiAgICAgICAgICAiUGF0Y2hlcyI6IFsKICAg ICAgICAgICAgInhzYTI0MS00LjkucGF0Y2giCiAgICAgICAgICBdCiAgICAg ICAgfQogICAgICB9CiAgICB9LAogICAgIjQuOSI6IHsKICAgICAgIlhlblZl cnNpb24iOiAiNC45IiwKICAgICAgIlJlY2lwZXMiOiB7CiAgICAgICAgInhl biI6IHsKICAgICAgICAgICJTdGFibGVSZWYiOiAiMmNjM2QzMmY0MGM3MWNi MjQyNDc3YTNmODkzODA3NGQ0ZmMzNjgyOSIsCiAgICAgICAgICAiUHJlcmVx cyI6IFsKICAgICAgICAgICAgMjM3LAogICAgICAgICAgICAyMzgsCiAgICAg ICAgICAgIDIzOSwKICAgICAgICAgICAgMjQwCiAgICAgICAgICBdLAogICAg ICAgICAgIlBhdGNoZXMiOiBbCiAgICAgICAgICAgICJ4c2EyNDEtNC45LnBh dGNoIgogICAgICAgICAgXQogICAgICAgIH0KICAgICAgfQogICAgfSwKICAg ICJtYXN0ZXIiOiB7CiAgICAgICJYZW5WZXJzaW9uIjogIm1hc3RlciIsCiAg ICAgICJSZWNpcGVzIjogewogICAgICAgICJ4ZW4iOiB7CiAgICAgICAgICAi U3RhYmxlUmVmIjogImE4ZWE2ZTI2ODgxMThhM2UxOWUyOWIzOWUzMTZmYWE1 Zjk2YWI5ZDEiLAogICAgICAgICAgIlByZXJlcXMiOiBbCiAgICAgICAgICAg IDIzNywKICAgICAgICAgICAgMjM4LAogICAgICAgICAgICAyMzksCiAgICAg ICAgICAgIDI0MAogICAgICAgICAgXSwKICAgICAgICAgICJQYXRjaGVzIjog WwogICAgICAgICAgICAieHNhMjQxLnBhdGNoIgogICAgICAgICAgXQogICAg ICAgIH0KICAgICAgfQogICAgfQogIH0KfQ== --=separator Content-Type: application/octet-stream; name="xsa241.patch" Content-Disposition: attachment; filename="xsa241.patch" Content-Transfer-Encoding: base64 RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0 OiB4ODY6IGRvbid0IHN0b3JlIHBvc3NpYmx5IHN0YWxlIFRMQiBmbHVzaCB0 aW1lIHN0YW1wCgpXaGlsZSB0aGUgdGltaW5nIHdpbmRvdyBpcyBleHRyZW1l bHkgbmFycm93LCBpdCBpcyB0aGVvcmV0aWNhbGx5CnBvc3NpYmxlIGZvciBh biB1cGRhdGUgdG8gdGhlIFRMQiBmbHVzaCBjbG9jayBhbmQgYSBzdWJzZXF1 ZW50IGZsdXNoCklQSSB0byBoYXBwZW4gYmV0d2VlbiB0aGUgcmVhZCBhbmQg d3JpdGUgcGFydHMgb2YgdGhlIHVwZGF0ZSBvZiB0aGUKcGVyLXBhZ2Ugc3Rh bXAuIEV4Y2x1ZGUgdGhpcyBwb3NzaWJpbGl0eSBieSBkaXNhYmxpbmcgaW50 ZXJydXB0cwphY3Jvc3MgdGhlIHVwZGF0ZSwgcHJldmVudGluZyB0aGUgSVBJ IHRvIGJlIHNlcnZpY2VkIGluIHRoZSBtaWRkbGUuCgpUaGlzIGlzIFhTQS0y NDEuCgpSZXBvcnRlZC1ieTogSmFubiBIb3JuIDxqYW5uaEBnb29nbGUuY29t PgpTdWdnZXN0ZWQtYnk6IEdlb3JnZSBEdW5sYXAgPGdlb3JnZS5kdW5sYXBA Y2l0cml4LmNvbT4KU2lnbmVkLW9mZi1ieTogSmFuIEJldWxpY2ggPGpiZXVs aWNoQHN1c2UuY29tPgpSZXZpZXdlZC1ieTogR2VvcmdlIER1bmxhcCA8Z2Vv cmdlLmR1bmxhcEBjaXRyaXguY29tPgotLS0KdjM6IEZpeCBBUk0gYnVpbGQg aXNzdWUuCnYyOiBSZWJhc2Ugb24gdG9wIG9mIHN0YWdpbmcgKyAoMjM3LTI0 MCkKCi0tLSBhL3hlbi9hcmNoL2FybS9zbXAuYworKysgYi94ZW4vYXJjaC9h cm0vc21wLmMKQEAgLTEsMyArMSw0IEBACisjaW5jbHVkZSA8eGVuL21tLmg+ CiAjaW5jbHVkZSA8YXNtL3N5c3RlbS5oPgogI2luY2x1ZGUgPGFzbS9zbXAu aD4KICNpbmNsdWRlIDxhc20vY3ByZWdzLmg+Ci0tLSBhL3hlbi9hcmNoL3g4 Ni9tbS5jCisrKyBiL3hlbi9hcmNoL3g4Ni9tbS5jCkBAIC00ODgsNyArNDg4 LDcgQEAgdm9pZCB1cGRhdGVfY3IzKHN0cnVjdCB2Y3B1ICp2KQogICAgIG1h a2VfY3IzKHYsIGNyM19tZm4pOwogfQogCi1zdGF0aWMgaW5saW5lIHZvaWQg cGFnZV9zZXRfdGxiZmx1c2hfdGltZXN0YW1wKHN0cnVjdCBwYWdlX2luZm8g KnBhZ2UpCitzdGF0aWMgaW5saW5lIHZvaWQgc2V0X3RsYmZsdXNoX3RpbWVz dGFtcChzdHJ1Y3QgcGFnZV9pbmZvICpwYWdlKQogewogICAgIC8qCiAgICAg ICogUmVjb3JkIFRMQiBpbmZvcm1hdGlvbiBmb3IgZmx1c2ggbGF0ZXIuIFdl IGRvIG5vdCBzdGFtcCBwYWdlIHRhYmxlcwpAQCAtNDk5LDcgKzQ5OSw3IEBA IHN0YXRpYyBpbmxpbmUgdm9pZCBwYWdlX3NldF90bGJmbHVzaF90aW1lc3Rh bXAoc3RydWN0IHBhZ2VfaW5mbyAqcGFnZSkKICAgICAgKi8KICAgICBpZiAo ICEocGFnZS0+Y291bnRfaW5mbyAmIFBHQ19wYWdlX3RhYmxlKSB8fAogICAg ICAgICAgIXNoYWRvd19tb2RlX2VuYWJsZWQocGFnZV9nZXRfb3duZXIocGFn ZSkpICkKLSAgICAgICAgcGFnZS0+dGxiZmx1c2hfdGltZXN0YW1wID0gdGxi Zmx1c2hfY3VycmVudF90aW1lKCk7CisgICAgICAgIHBhZ2Vfc2V0X3RsYmZs dXNoX3RpbWVzdGFtcChwYWdlKTsKIH0KIAogY29uc3QgY2hhciBfX3NlY3Rp b24oIi5ic3MucGFnZV9hbGlnbmVkLmNvbnN0IikgX19hbGlnbmVkKFBBR0Vf U0laRSkKQEAgLTIyMzIsNyArMjIzMiw3IEBAIHN0YXRpYyBpbnQgX3B1dF9m aW5hbF9wYWdlX3R5cGUoc3RydWN0IHBhZ2VfaW5mbyAqcGFnZSwgdW5zaWdu ZWQgbG9uZyB0eXBlLAogICAgICAgICAgICAgZGVjX2xpbmVhcl9lbnRyaWVz KHB0cGcpOwogICAgICAgICB9CiAgICAgICAgIEFTU0VSVCghcGFnZS0+bGlu ZWFyX3B0X2NvdW50IHx8IHBhZ2VfZ2V0X293bmVyKHBhZ2UpLT5pc19keWlu Zyk7Ci0gICAgICAgIHBhZ2Vfc2V0X3RsYmZsdXNoX3RpbWVzdGFtcChwYWdl KTsKKyAgICAgICAgc2V0X3RsYmZsdXNoX3RpbWVzdGFtcChwYWdlKTsKICAg ICAgICAgc21wX3dtYigpOwogICAgICAgICBwYWdlLT51LmludXNlLnR5cGVf aW5mby0tOwogICAgIH0KQEAgLTIyNDAsNyArMjI0MCw3IEBAIHN0YXRpYyBp bnQgX3B1dF9maW5hbF9wYWdlX3R5cGUoc3RydWN0IHBhZ2VfaW5mbyAqcGFn ZSwgdW5zaWduZWQgbG9uZyB0eXBlLAogICAgIHsKICAgICAgICAgQVNTRVJU KChwYWdlLT51LmludXNlLnR5cGVfaW5mbyAmCiAgICAgICAgICAgICAgICAg KFBHVF9jb3VudF9tYXNrfFBHVF92YWxpZGF0ZWR8UEdUX3BhcnRpYWwpKSA9 PSAxKTsKLSAgICAgICAgcGFnZV9zZXRfdGxiZmx1c2hfdGltZXN0YW1wKHBh Z2UpOworICAgICAgICBzZXRfdGxiZmx1c2hfdGltZXN0YW1wKHBhZ2UpOwog ICAgICAgICBzbXBfd21iKCk7CiAgICAgICAgIHBhZ2UtPnUuaW51c2UudHlw ZV9pbmZvIHw9IFBHVF92YWxpZGF0ZWQ7CiAgICAgfQpAQCAtMjI5NCw3ICsy Mjk0LDcgQEAgc3RhdGljIGludCBfcHV0X3BhZ2VfdHlwZShzdHJ1Y3QgcGFn ZV9pbmZvICpwYWdlLCBib29sIHByZWVtcHRpYmxlLAogICAgICAgICAgICAg aWYgKCBwdHBnICYmIFBHVF90eXBlX2VxdWFsKHgsIHB0cGctPnUuaW51c2Uu dHlwZV9pbmZvKSApCiAgICAgICAgICAgICB7CiAgICAgICAgICAgICAgICAg LyoKLSAgICAgICAgICAgICAgICAgKiBwYWdlX3NldF90bGJmbHVzaF90aW1l c3RhbXAoKSBhY2Nlc3NlcyB0aGUgc2FtZSB1bmlvbgorICAgICAgICAgICAg ICAgICAqIHNldF90bGJmbHVzaF90aW1lc3RhbXAoKSBhY2Nlc3NlcyB0aGUg c2FtZSB1bmlvbgogICAgICAgICAgICAgICAgICAqIGxpbmVhcl9wdF9jb3Vu dCBsaXZlcyBpbi4gVW52YWxpZGF0ZWQgcGFnZSB0YWJsZSBwYWdlcywKICAg ICAgICAgICAgICAgICAgKiBob3dldmVyLCBzaG91bGQgb2NjdXIgZHVyaW5n IGRvbWFpbiBkZXN0cnVjdGlvbiBvbmx5CiAgICAgICAgICAgICAgICAgICog YW55d2F5LiAgVXBkYXRpbmcgb2YgbGluZWFyX3B0X2NvdW50IGx1Y2tpbHkg aXMgbm90CkBAIC0yMzA2LDcgKzIzMDYsNyBAQCBzdGF0aWMgaW50IF9wdXRf cGFnZV90eXBlKHN0cnVjdCBwYWdlX2luZm8gKnBhZ2UsIGJvb2wgcHJlZW1w dGlibGUsCiAgICAgICAgICAgICAgICAgcHRwZyA9IE5VTEw7CiAgICAgICAg ICAgICB9CiAKLSAgICAgICAgICAgIHBhZ2Vfc2V0X3RsYmZsdXNoX3RpbWVz dGFtcChwYWdlKTsKKyAgICAgICAgICAgIHNldF90bGJmbHVzaF90aW1lc3Rh bXAocGFnZSk7CiAgICAgICAgIH0KIAogICAgICAgICBpZiAoIGxpa2VseSgo eSA9IGNtcHhjaGcoJnBhZ2UtPnUuaW51c2UudHlwZV9pbmZvLCB4LCBueCkp ID09IHgpICkKZGlmZiAtLWdpdCBhL3hlbi9hcmNoL3g4Ni9tbS9zaGFkb3cv Y29tbW9uLmMgYi94ZW4vYXJjaC94ODYvbW0vc2hhZG93L2NvbW1vbi5jCmlu ZGV4IDg2MTg2Y2NjZGYuLjdiMTZlZDk4NWQgMTAwNjQ0Ci0tLSBhL3hlbi9h cmNoL3g4Ni9tbS9zaGFkb3cvY29tbW9uLmMKKysrIGIveGVuL2FyY2gveDg2 L21tL3NoYWRvdy9jb21tb24uYwpAQCAtMTQ2NCw3ICsxNDY0LDcgQEAgdm9p ZCBzaGFkb3dfZnJlZShzdHJ1Y3QgZG9tYWluICpkLCBtZm5fdCBzbWZuKQog ICAgICAgICAgKiBUTEJzIHdoZW4gd2UgcmV1c2UgdGhlIHBhZ2UuICBCZWNh dXNlIHRoZSBkZXN0cnVjdG9ycyBsZWF2ZSB0aGUKICAgICAgICAgICogY29u dGVudHMgb2YgdGhlIHBhZ2VzIGluIHBsYWNlLCB3ZSBjYW4gZGVsYXkgVExC IGZsdXNoZXMgdW50aWwKICAgICAgICAgICoganVzdCBiZWZvcmUgdGhlIGFs bG9jYXRvciBoYW5kcyB0aGUgcGFnZSBvdXQgYWdhaW4uICovCi0gICAgICAg IHNwLT50bGJmbHVzaF90aW1lc3RhbXAgPSB0bGJmbHVzaF9jdXJyZW50X3Rp bWUoKTsKKyAgICAgICAgcGFnZV9zZXRfdGxiZmx1c2hfdGltZXN0YW1wKHNw KTsKICAgICAgICAgcGVyZmNfZGVjcihzaGFkb3dfYWxsb2NfY291bnQpOwog ICAgICAgICBwYWdlX2xpc3RfYWRkX3RhaWwoc3AsICZkLT5hcmNoLnBhZ2lu Zy5zaGFkb3cuZnJlZWxpc3QpOwogICAgICAgICBzcCA9IG5leHQ7CmRpZmYg LS1naXQgYS94ZW4vY29tbW9uL3BhZ2VfYWxsb2MuYyBiL3hlbi9jb21tb24v cGFnZV9hbGxvYy5jCmluZGV4IDBiOWY2Y2M2ZGYuLjBkNmU1M2NjZmEgMTAw NjQ0Ci0tLSBhL3hlbi9jb21tb24vcGFnZV9hbGxvYy5jCisrKyBiL3hlbi9j b21tb24vcGFnZV9hbGxvYy5jCkBAIC0xMzU4LDcgKzEzNTgsNyBAQCBzdGF0 aWMgdm9pZCBmcmVlX2hlYXBfcGFnZXMoCiAgICAgICAgIC8qIElmIGEgcGFn ZSBoYXMgbm8gb3duZXIgaXQgd2lsbCBuZWVkIG5vIHNhZmV0eSBUTEIgZmx1 c2guICovCiAgICAgICAgIHBnW2ldLnUuZnJlZS5uZWVkX3RsYmZsdXNoID0g KHBhZ2VfZ2V0X293bmVyKCZwZ1tpXSkgIT0gTlVMTCk7CiAgICAgICAgIGlm ICggcGdbaV0udS5mcmVlLm5lZWRfdGxiZmx1c2ggKQotICAgICAgICAgICAg cGdbaV0udGxiZmx1c2hfdGltZXN0YW1wID0gdGxiZmx1c2hfY3VycmVudF90 aW1lKCk7CisgICAgICAgICAgICBwYWdlX3NldF90bGJmbHVzaF90aW1lc3Rh bXAoJnBnW2ldKTsKIAogICAgICAgICAvKiBUaGlzIHBhZ2UgaXMgbm90IGEg Z3Vlc3QgZnJhbWUgYW55IG1vcmUuICovCiAgICAgICAgIHBhZ2Vfc2V0X293 bmVyKCZwZ1tpXSwgTlVMTCk7IC8qIHNldF9ncGZuX2Zyb21fbWZuIHNub29w cyBwZyBvd25lciAqLwpkaWZmIC0tZ2l0IGEveGVuL2luY2x1ZGUvYXNtLWFy bS9mbHVzaHRsYi5oIGIveGVuL2luY2x1ZGUvYXNtLWFybS9mbHVzaHRsYi5o CmluZGV4IGE4ZThhMDUzNjMuLjgzZmY5ZmE4YjMgMTAwNjQ0Ci0tLSBhL3hl bi9pbmNsdWRlL2FzbS1hcm0vZmx1c2h0bGIuaAorKysgYi94ZW4vaW5jbHVk ZS9hc20tYXJtL2ZsdXNodGxiLmgKQEAgLTEyLDYgKzEyLDExIEBAIHN0YXRp YyBpbmxpbmUgdm9pZCB0bGJmbHVzaF9maWx0ZXIoY3B1bWFza190ICptYXNr LCB1aW50MzJfdCBwYWdlX3RpbWVzdGFtcCkge30KIAogI2RlZmluZSB0bGJm bHVzaF9jdXJyZW50X3RpbWUoKSAgICAgICAgICAgICAgICAgKDApCiAKK3N0 YXRpYyBpbmxpbmUgdm9pZCBwYWdlX3NldF90bGJmbHVzaF90aW1lc3RhbXAo c3RydWN0IHBhZ2VfaW5mbyAqcGFnZSkKK3sKKyAgICBwYWdlLT50bGJmbHVz aF90aW1lc3RhbXAgPSB0bGJmbHVzaF9jdXJyZW50X3RpbWUoKTsKK30KKwog I2lmIGRlZmluZWQoQ09ORklHX0FSTV8zMikKICMgaW5jbHVkZSA8YXNtL2Fy bTMyL2ZsdXNodGxiLmg+CiAjZWxpZiBkZWZpbmVkKENPTkZJR19BUk1fNjQp CmRpZmYgLS1naXQgYS94ZW4vaW5jbHVkZS9hc20teDg2L2ZsdXNodGxiLmgg Yi94ZW4vaW5jbHVkZS9hc20teDg2L2ZsdXNodGxiLmgKaW5kZXggMTMxYjMx Y2ZjYy4uNDEzZGI2OTJlMSAxMDA2NDQKLS0tIGEveGVuL2luY2x1ZGUvYXNt LXg4Ni9mbHVzaHRsYi5oCisrKyBiL3hlbi9pbmNsdWRlL2FzbS14ODYvZmx1 c2h0bGIuaApAQCAtMjMsNiArMjMsMjAgQEAgREVDTEFSRV9QRVJfQ1BVKHUz MiwgdGxiZmx1c2hfdGltZSk7CiAKICNkZWZpbmUgdGxiZmx1c2hfY3VycmVu dF90aW1lKCkgdGxiZmx1c2hfY2xvY2sKIAorc3RhdGljIGlubGluZSB2b2lk IHBhZ2Vfc2V0X3RsYmZsdXNoX3RpbWVzdGFtcChzdHJ1Y3QgcGFnZV9pbmZv ICpwYWdlKQoreworICAgIC8qCisgICAgICogUHJldmVudCBzdG9yaW5nIGEg c3RhbGUgdGltZSBzdGFtcCwgd2hpY2ggY291bGQgaGFwcGVuIGlmIGFuIHVw ZGF0ZQorICAgICAqIHRvIHRsYmZsdXNoX2Nsb2NrIHBsdXMgYSBzdWJzZXF1 ZW50IGZsdXNoIElQSSBoYXBwZW4gYmV0d2VlbiB0aGUKKyAgICAgKiByZWFk aW5nIG9mIHRsYmZsdXNoX2Nsb2NrIGFuZCB0aGUgd3JpdGluZyBvZiB0aGUg c3RydWN0IHBhZ2VfaW5mbworICAgICAqIGZpZWxkLgorICAgICAqLworICAg IEFTU0VSVChsb2NhbF9pcnFfaXNfZW5hYmxlZCgpKTsKKyAgICBsb2NhbF9p cnFfZGlzYWJsZSgpOworICAgIHBhZ2UtPnRsYmZsdXNoX3RpbWVzdGFtcCA9 IHRsYmZsdXNoX2N1cnJlbnRfdGltZSgpOworICAgIGxvY2FsX2lycV9lbmFi bGUoKTsKK30KKwogLyoKICAqIEBjcHVfc3RhbXAgaXMgdGhlIHRpbWVzdGFt cCBhdCBsYXN0IFRMQiBmbHVzaCBmb3IgdGhlIENQVSB3ZSBhcmUgdGVzdGlu Zy4KICAqIEBsYXN0dXNlX3N0YW1wIGlzIGEgdGltZXN0YW1wIHRha2VuIHdo ZW4gdGhlIFBGTiB3ZSBhcmUgdGVzdGluZyB3YXMgbGFzdCAKLS0gCjIuMTQu MQoK --=separator Content-Type: application/octet-stream; name="xsa241-4.8.patch" Content-Disposition: attachment; filename="xsa241-4.8.patch" Content-Transfer-Encoding: base64 eDg2OiBkb24ndCBzdG9yZSBwb3NzaWJseSBzdGFsZSBUTEIgZmx1c2ggdGlt ZSBzdGFtcAoKV2hpbGUgdGhlIHRpbWluZyB3aW5kb3cgaXMgZXh0cmVtZWx5 IG5hcnJvdywgaXQgaXMgdGhlb3JldGljYWxseQpwb3NzaWJsZSBmb3IgYW4g dXBkYXRlIHRvIHRoZSBUTEIgZmx1c2ggY2xvY2sgYW5kIGEgc3Vic2VxdWVu dCBmbHVzaApJUEkgdG8gaGFwcGVuIGJldHdlZW4gdGhlIHJlYWQgYW5kIHdy aXRlIHBhcnRzIG9mIHRoZSB1cGRhdGUgb2YgdGhlCnBlci1wYWdlIHN0YW1w LiBFeGNsdWRlIHRoaXMgcG9zc2liaWxpdHkgYnkgZGlzYWJsaW5nIGludGVy cnVwdHMKYWNyb3NzIHRoZSB1cGRhdGUsIHByZXZlbnRpbmcgdGhlIElQSSB0 byBiZSBzZXJ2aWNlZCBpbiB0aGUgbWlkZGxlLgoKVGhpcyBpcyBYU0EtMjQx LgoKUmVwb3J0ZWQtYnk6IEphbm4gSG9ybiA8amFubmhAZ29vZ2xlLmNvbT4K U3VnZ2VzdGVkLWJ5OiBHZW9yZ2UgRHVubGFwIDxnZW9yZ2UuZHVubGFwQGNp dHJpeC5jb20+ClNpZ25lZC1vZmYtYnk6IEphbiBCZXVsaWNoIDxqYmV1bGlj aEBzdXNlLmNvbT4KUmV2aWV3ZWQtYnk6IEdlb3JnZSBEdW5sYXAgPGdlb3Jn ZS5kdW5sYXBAY2l0cml4LmNvbT4KCi0tLSBhL3hlbi9hcmNoL2FybS9zbXAu YworKysgYi94ZW4vYXJjaC9hcm0vc21wLmMKQEAgLTEsNCArMSw1IEBACiAj aW5jbHVkZSA8eGVuL2NvbmZpZy5oPgorI2luY2x1ZGUgPHhlbi9tbS5oPgog I2luY2x1ZGUgPGFzbS9zeXN0ZW0uaD4KICNpbmNsdWRlIDxhc20vc21wLmg+ CiAjaW5jbHVkZSA8YXNtL2NwcmVncy5oPgotLS0gYS94ZW4vYXJjaC94ODYv bW0uYworKysgYi94ZW4vYXJjaC94ODYvbW0uYwpAQCAtMjUyNCw3ICsyNTI0 LDcgQEAgc3RhdGljIGludCBfcHV0X2ZpbmFsX3BhZ2VfdHlwZShzdHJ1Y3Qg cAogICAgICAgICAgKi8KICAgICAgICAgaWYgKCAhKHNoYWRvd19tb2RlX2Vu YWJsZWQocGFnZV9nZXRfb3duZXIocGFnZSkpICYmCiAgICAgICAgICAgICAg ICAocGFnZS0+Y291bnRfaW5mbyAmIFBHQ19wYWdlX3RhYmxlKSkgKQotICAg ICAgICAgICAgcGFnZS0+dGxiZmx1c2hfdGltZXN0YW1wID0gdGxiZmx1c2hf Y3VycmVudF90aW1lKCk7CisgICAgICAgICAgICBwYWdlX3NldF90bGJmbHVz aF90aW1lc3RhbXAocGFnZSk7CiAgICAgICAgIHdtYigpOwogICAgICAgICBw YWdlLT51LmludXNlLnR5cGVfaW5mby0tOwogICAgIH0KQEAgLTI1MzQsNyAr MjUzNCw3IEBAIHN0YXRpYyBpbnQgX3B1dF9maW5hbF9wYWdlX3R5cGUoc3Ry dWN0IHAKICAgICAgICAgICAgICAgICAoUEdUX2NvdW50X21hc2t8UEdUX3Zh bGlkYXRlZHxQR1RfcGFydGlhbCkpID09IDEpOwogICAgICAgICBpZiAoICEo c2hhZG93X21vZGVfZW5hYmxlZChwYWdlX2dldF9vd25lcihwYWdlKSkgJiYK ICAgICAgICAgICAgICAgIChwYWdlLT5jb3VudF9pbmZvICYgUEdDX3BhZ2Vf dGFibGUpKSApCi0gICAgICAgICAgICBwYWdlLT50bGJmbHVzaF90aW1lc3Rh bXAgPSB0bGJmbHVzaF9jdXJyZW50X3RpbWUoKTsKKyAgICAgICAgICAgIHBh Z2Vfc2V0X3RsYmZsdXNoX3RpbWVzdGFtcChwYWdlKTsKICAgICAgICAgd21i KCk7CiAgICAgICAgIHBhZ2UtPnUuaW51c2UudHlwZV9pbmZvIHw9IFBHVF92 YWxpZGF0ZWQ7CiAgICAgfQpAQCAtMjU4OCw3ICsyNTg4LDcgQEAgc3RhdGlj IGludCBfcHV0X3BhZ2VfdHlwZShzdHJ1Y3QgcGFnZV9pbgogICAgICAgICAg ICAgaWYgKCBwdHBnICYmIFBHVF90eXBlX2VxdWFsKHgsIHB0cGctPnUuaW51 c2UudHlwZV9pbmZvKSApCiAgICAgICAgICAgICB7CiAgICAgICAgICAgICAg ICAgLyoKLSAgICAgICAgICAgICAgICAgKiBwYWdlX3NldF90bGJmbHVzaF90 aW1lc3RhbXAoKSBhY2Nlc3NlcyB0aGUgc2FtZSB1bmlvbgorICAgICAgICAg ICAgICAgICAqIHNldF90bGJmbHVzaF90aW1lc3RhbXAoKSBhY2Nlc3NlcyB0 aGUgc2FtZSB1bmlvbgogICAgICAgICAgICAgICAgICAqIGxpbmVhcl9wdF9j b3VudCBsaXZlcyBpbi4gVW52YWxpZGF0ZWQgcGFnZSB0YWJsZSBwYWdlcywK ICAgICAgICAgICAgICAgICAgKiBob3dldmVyLCBzaG91bGQgb2NjdXIgZHVy aW5nIGRvbWFpbiBkZXN0cnVjdGlvbiBvbmx5CiAgICAgICAgICAgICAgICAg ICogYW55d2F5LiAgVXBkYXRpbmcgb2YgbGluZWFyX3B0X2NvdW50IGx1Y2tp bHkgaXMgbm90CkBAIC0yNjA5LDcgKzI2MDksNyBAQCBzdGF0aWMgaW50IF9w dXRfcGFnZV90eXBlKHN0cnVjdCBwYWdlX2luCiAgICAgICAgICAgICAgKi8K ICAgICAgICAgICAgIGlmICggIShzaGFkb3dfbW9kZV9lbmFibGVkKHBhZ2Vf Z2V0X293bmVyKHBhZ2UpKSAmJgogICAgICAgICAgICAgICAgICAgIChwYWdl LT5jb3VudF9pbmZvICYgUEdDX3BhZ2VfdGFibGUpKSApCi0gICAgICAgICAg ICAgICAgcGFnZS0+dGxiZmx1c2hfdGltZXN0YW1wID0gdGxiZmx1c2hfY3Vy cmVudF90aW1lKCk7CisgICAgICAgICAgICAgICAgcGFnZV9zZXRfdGxiZmx1 c2hfdGltZXN0YW1wKHBhZ2UpOwogICAgICAgICB9CiAKICAgICAgICAgaWYg KCBsaWtlbHkoKHkgPSBjbXB4Y2hnKCZwYWdlLT51LmludXNlLnR5cGVfaW5m bywgeCwgbngpKSA9PSB4KSApCi0tLSBhL3hlbi9hcmNoL3g4Ni9tbS9zaGFk b3cvY29tbW9uLmMKKysrIGIveGVuL2FyY2gveDg2L21tL3NoYWRvdy9jb21t b24uYwpAQCAtMTQ2NCw3ICsxNDY0LDcgQEAgdm9pZCBzaGFkb3dfZnJlZShz dHJ1Y3QgZG9tYWluICpkLCBtZm5fdAogICAgICAgICAgKiBUTEJzIHdoZW4g d2UgcmV1c2UgdGhlIHBhZ2UuICBCZWNhdXNlIHRoZSBkZXN0cnVjdG9ycyBs ZWF2ZSB0aGUKICAgICAgICAgICogY29udGVudHMgb2YgdGhlIHBhZ2VzIGlu IHBsYWNlLCB3ZSBjYW4gZGVsYXkgVExCIGZsdXNoZXMgdW50aWwKICAgICAg ICAgICoganVzdCBiZWZvcmUgdGhlIGFsbG9jYXRvciBoYW5kcyB0aGUgcGFn ZSBvdXQgYWdhaW4uICovCi0gICAgICAgIHNwLT50bGJmbHVzaF90aW1lc3Rh bXAgPSB0bGJmbHVzaF9jdXJyZW50X3RpbWUoKTsKKyAgICAgICAgcGFnZV9z ZXRfdGxiZmx1c2hfdGltZXN0YW1wKHNwKTsKICAgICAgICAgcGVyZmNfZGVj cihzaGFkb3dfYWxsb2NfY291bnQpOwogICAgICAgICBwYWdlX2xpc3RfYWRk X3RhaWwoc3AsICZkLT5hcmNoLnBhZ2luZy5zaGFkb3cuZnJlZWxpc3QpOwog ICAgICAgICBzcCA9IG5leHQ7Ci0tLSBhL3hlbi9jb21tb24vcGFnZV9hbGxv Yy5jCisrKyBiL3hlbi9jb21tb24vcGFnZV9hbGxvYy5jCkBAIC05NjAsNyAr OTYwLDcgQEAgc3RhdGljIHZvaWQgZnJlZV9oZWFwX3BhZ2VzKAogICAgICAg ICAvKiBJZiBhIHBhZ2UgaGFzIG5vIG93bmVyIGl0IHdpbGwgbmVlZCBubyBz YWZldHkgVExCIGZsdXNoLiAqLwogICAgICAgICBwZ1tpXS51LmZyZWUubmVl ZF90bGJmbHVzaCA9IChwYWdlX2dldF9vd25lcigmcGdbaV0pICE9IE5VTEwp OwogICAgICAgICBpZiAoIHBnW2ldLnUuZnJlZS5uZWVkX3RsYmZsdXNoICkK LSAgICAgICAgICAgIHBnW2ldLnRsYmZsdXNoX3RpbWVzdGFtcCA9IHRsYmZs dXNoX2N1cnJlbnRfdGltZSgpOworICAgICAgICAgICAgcGFnZV9zZXRfdGxi Zmx1c2hfdGltZXN0YW1wKCZwZ1tpXSk7CiAKICAgICAgICAgLyogVGhpcyBw YWdlIGlzIG5vdCBhIGd1ZXN0IGZyYW1lIGFueSBtb3JlLiAqLwogICAgICAg ICBwYWdlX3NldF9vd25lcigmcGdbaV0sIE5VTEwpOyAvKiBzZXRfZ3Bmbl9m cm9tX21mbiBzbm9vcHMgcGcgb3duZXIgKi8KLS0tIGEveGVuL2luY2x1ZGUv YXNtLWFybS9mbHVzaHRsYi5oCisrKyBiL3hlbi9pbmNsdWRlL2FzbS1hcm0v Zmx1c2h0bGIuaApAQCAtMTIsNiArMTIsMTEgQEAgc3RhdGljIGlubGluZSB2 b2lkIHRsYmZsdXNoX2ZpbHRlcihjcHVtYQogCiAjZGVmaW5lIHRsYmZsdXNo X2N1cnJlbnRfdGltZSgpICAgICAgICAgICAgICAgICAoMCkKIAorc3RhdGlj IGlubGluZSB2b2lkIHBhZ2Vfc2V0X3RsYmZsdXNoX3RpbWVzdGFtcChzdHJ1 Y3QgcGFnZV9pbmZvICpwYWdlKQoreworICAgIHBhZ2UtPnRsYmZsdXNoX3Rp bWVzdGFtcCA9IHRsYmZsdXNoX2N1cnJlbnRfdGltZSgpOworfQorCiAjaWYg ZGVmaW5lZChDT05GSUdfQVJNXzMyKQogIyBpbmNsdWRlIDxhc20vYXJtMzIv Zmx1c2h0bGIuaD4KICNlbGlmIGRlZmluZWQoQ09ORklHX0FSTV82NCkKLS0t IGEveGVuL2luY2x1ZGUvYXNtLXg4Ni9mbHVzaHRsYi5oCisrKyBiL3hlbi9p bmNsdWRlL2FzbS14ODYvZmx1c2h0bGIuaApAQCAtMjMsNiArMjMsMjAgQEAg REVDTEFSRV9QRVJfQ1BVKHUzMiwgdGxiZmx1c2hfdGltZSk7CiAKICNkZWZp bmUgdGxiZmx1c2hfY3VycmVudF90aW1lKCkgdGxiZmx1c2hfY2xvY2sKIAor c3RhdGljIGlubGluZSB2b2lkIHBhZ2Vfc2V0X3RsYmZsdXNoX3RpbWVzdGFt cChzdHJ1Y3QgcGFnZV9pbmZvICpwYWdlKQoreworICAgIC8qCisgICAgICog UHJldmVudCBzdG9yaW5nIGEgc3RhbGUgdGltZSBzdGFtcCwgd2hpY2ggY291 bGQgaGFwcGVuIGlmIGFuIHVwZGF0ZQorICAgICAqIHRvIHRsYmZsdXNoX2Ns b2NrIHBsdXMgYSBzdWJzZXF1ZW50IGZsdXNoIElQSSBoYXBwZW4gYmV0d2Vl biB0aGUKKyAgICAgKiByZWFkaW5nIG9mIHRsYmZsdXNoX2Nsb2NrIGFuZCB0 aGUgd3JpdGluZyBvZiB0aGUgc3RydWN0IHBhZ2VfaW5mbworICAgICAqIGZp ZWxkLgorICAgICAqLworICAgIEFTU0VSVChsb2NhbF9pcnFfaXNfZW5hYmxl ZCgpKTsKKyAgICBsb2NhbF9pcnFfZGlzYWJsZSgpOworICAgIHBhZ2UtPnRs YmZsdXNoX3RpbWVzdGFtcCA9IHRsYmZsdXNoX2N1cnJlbnRfdGltZSgpOwor ICAgIGxvY2FsX2lycV9lbmFibGUoKTsKK30KKwogLyoKICAqIEBjcHVfc3Rh bXAgaXMgdGhlIHRpbWVzdGFtcCBhdCBsYXN0IFRMQiBmbHVzaCBmb3IgdGhl IENQVSB3ZSBhcmUgdGVzdGluZy4KICAqIEBsYXN0dXNlX3N0YW1wIGlzIGEg dGltZXN0YW1wIHRha2VuIHdoZW4gdGhlIFBGTiB3ZSBhcmUgdGVzdGluZyB3 YXMgbGFzdCAK --=separator Content-Type: application/octet-stream; name="xsa241-4.9.patch" Content-Disposition: attachment; filename="xsa241-4.9.patch" Content-Transfer-Encoding: base64 RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0 OiB4ODY6IGRvbid0IHN0b3JlIHBvc3NpYmx5IHN0YWxlIFRMQiBmbHVzaCB0 aW1lIHN0YW1wCgpXaGlsZSB0aGUgdGltaW5nIHdpbmRvdyBpcyBleHRyZW1l bHkgbmFycm93LCBpdCBpcyB0aGVvcmV0aWNhbGx5CnBvc3NpYmxlIGZvciBh biB1cGRhdGUgdG8gdGhlIFRMQiBmbHVzaCBjbG9jayBhbmQgYSBzdWJzZXF1 ZW50IGZsdXNoCklQSSB0byBoYXBwZW4gYmV0d2VlbiB0aGUgcmVhZCBhbmQg d3JpdGUgcGFydHMgb2YgdGhlIHVwZGF0ZSBvZiB0aGUKcGVyLXBhZ2Ugc3Rh bXAuIEV4Y2x1ZGUgdGhpcyBwb3NzaWJpbGl0eSBieSBkaXNhYmxpbmcgaW50 ZXJydXB0cwphY3Jvc3MgdGhlIHVwZGF0ZSwgcHJldmVudGluZyB0aGUgSVBJ IHRvIGJlIHNlcnZpY2VkIGluIHRoZSBtaWRkbGUuCgpUaGlzIGlzIFhTQS0y NDEuCgpSZXBvcnRlZC1ieTogSmFubiBIb3JuIDxqYW5uaEBnb29nbGUuY29t PgpTdWdnZXN0ZWQtYnk6IEdlb3JnZSBEdW5sYXAgPGdlb3JnZS5kdW5sYXBA Y2l0cml4LmNvbT4KU2lnbmVkLW9mZi1ieTogSmFuIEJldWxpY2ggPGpiZXVs aWNoQHN1c2UuY29tPgpSZXZpZXdlZC1ieTogR2VvcmdlIER1bmxhcCA8Z2Vv cmdlLmR1bmxhcEBjaXRyaXguY29tPgoKLS0tIGEveGVuL2FyY2gvYXJtL3Nt cC5jCisrKyBiL3hlbi9hcmNoL2FybS9zbXAuYwpAQCAtMSwzICsxLDQgQEAK KyNpbmNsdWRlIDx4ZW4vbW0uaD4KICNpbmNsdWRlIDxhc20vc3lzdGVtLmg+ CiAjaW5jbHVkZSA8YXNtL3NtcC5oPgogI2luY2x1ZGUgPGFzbS9jcHJlZ3Mu aD4KLS0tIGEveGVuL2FyY2gveDg2L21tLmMKKysrIGIveGVuL2FyY2gveDg2 L21tLmMKQEAgLTI1MjQsNyArMjUyNCw3IEBAIHN0YXRpYyBpbnQgX3B1dF9m aW5hbF9wYWdlX3R5cGUoc3RydWN0IHAKICAgICAgICAgICovCiAgICAgICAg IGlmICggIShzaGFkb3dfbW9kZV9lbmFibGVkKHBhZ2VfZ2V0X293bmVyKHBh Z2UpKSAmJgogICAgICAgICAgICAgICAgKHBhZ2UtPmNvdW50X2luZm8gJiBQ R0NfcGFnZV90YWJsZSkpICkKLSAgICAgICAgICAgIHBhZ2UtPnRsYmZsdXNo X3RpbWVzdGFtcCA9IHRsYmZsdXNoX2N1cnJlbnRfdGltZSgpOworICAgICAg ICAgICAgcGFnZV9zZXRfdGxiZmx1c2hfdGltZXN0YW1wKHBhZ2UpOwogICAg ICAgICB3bWIoKTsKICAgICAgICAgcGFnZS0+dS5pbnVzZS50eXBlX2luZm8t LTsKICAgICB9CkBAIC0yNTM0LDcgKzI1MzQsNyBAQCBzdGF0aWMgaW50IF9w dXRfZmluYWxfcGFnZV90eXBlKHN0cnVjdCBwCiAgICAgICAgICAgICAgICAg KFBHVF9jb3VudF9tYXNrfFBHVF92YWxpZGF0ZWR8UEdUX3BhcnRpYWwpKSA9 PSAxKTsKICAgICAgICAgaWYgKCAhKHNoYWRvd19tb2RlX2VuYWJsZWQocGFn ZV9nZXRfb3duZXIocGFnZSkpICYmCiAgICAgICAgICAgICAgICAocGFnZS0+ Y291bnRfaW5mbyAmIFBHQ19wYWdlX3RhYmxlKSkgKQotICAgICAgICAgICAg cGFnZS0+dGxiZmx1c2hfdGltZXN0YW1wID0gdGxiZmx1c2hfY3VycmVudF90 aW1lKCk7CisgICAgICAgICAgICBwYWdlX3NldF90bGJmbHVzaF90aW1lc3Rh bXAocGFnZSk7CiAgICAgICAgIHdtYigpOwogICAgICAgICBwYWdlLT51Lmlu dXNlLnR5cGVfaW5mbyB8PSBQR1RfdmFsaWRhdGVkOwogICAgIH0KQEAgLTI1 ODgsNyArMjU4OCw3IEBAIHN0YXRpYyBpbnQgX3B1dF9wYWdlX3R5cGUoc3Ry dWN0IHBhZ2VfaW4KICAgICAgICAgICAgIGlmICggcHRwZyAmJiBQR1RfdHlw ZV9lcXVhbCh4LCBwdHBnLT51LmludXNlLnR5cGVfaW5mbykgKQogICAgICAg ICAgICAgewogICAgICAgICAgICAgICAgIC8qCi0gICAgICAgICAgICAgICAg ICogcGFnZV9zZXRfdGxiZmx1c2hfdGltZXN0YW1wKCkgYWNjZXNzZXMgdGhl IHNhbWUgdW5pb24KKyAgICAgICAgICAgICAgICAgKiBzZXRfdGxiZmx1c2hf dGltZXN0YW1wKCkgYWNjZXNzZXMgdGhlIHNhbWUgdW5pb24KICAgICAgICAg ICAgICAgICAgKiBsaW5lYXJfcHRfY291bnQgbGl2ZXMgaW4uIFVudmFsaWRh dGVkIHBhZ2UgdGFibGUgcGFnZXMsCiAgICAgICAgICAgICAgICAgICogaG93 ZXZlciwgc2hvdWxkIG9jY3VyIGR1cmluZyBkb21haW4gZGVzdHJ1Y3Rpb24g b25seQogICAgICAgICAgICAgICAgICAqIGFueXdheS4gIFVwZGF0aW5nIG9m IGxpbmVhcl9wdF9jb3VudCBsdWNraWx5IGlzIG5vdApAQCAtMjYwOSw3ICsy NjA5LDcgQEAgc3RhdGljIGludCBfcHV0X3BhZ2VfdHlwZShzdHJ1Y3QgcGFn ZV9pbgogICAgICAgICAgICAgICovCiAgICAgICAgICAgICBpZiAoICEoc2hh ZG93X21vZGVfZW5hYmxlZChwYWdlX2dldF9vd25lcihwYWdlKSkgJiYKICAg ICAgICAgICAgICAgICAgICAocGFnZS0+Y291bnRfaW5mbyAmIFBHQ19wYWdl X3RhYmxlKSkgKQotICAgICAgICAgICAgICAgIHBhZ2UtPnRsYmZsdXNoX3Rp bWVzdGFtcCA9IHRsYmZsdXNoX2N1cnJlbnRfdGltZSgpOworICAgICAgICAg ICAgICAgIHBhZ2Vfc2V0X3RsYmZsdXNoX3RpbWVzdGFtcChwYWdlKTsKICAg ICAgICAgfQogCiAgICAgICAgIGlmICggbGlrZWx5KCh5ID0gY21weGNoZygm cGFnZS0+dS5pbnVzZS50eXBlX2luZm8sIHgsIG54KSkgPT0geCkgKQotLS0g YS94ZW4vYXJjaC94ODYvbW0vc2hhZG93L2NvbW1vbi5jCisrKyBiL3hlbi9h cmNoL3g4Ni9tbS9zaGFkb3cvY29tbW9uLmMKQEAgLTE0NjQsNyArMTQ2NCw3 IEBAIHZvaWQgc2hhZG93X2ZyZWUoc3RydWN0IGRvbWFpbiAqZCwgbWZuX3QK ICAgICAgICAgICogVExCcyB3aGVuIHdlIHJldXNlIHRoZSBwYWdlLiAgQmVj YXVzZSB0aGUgZGVzdHJ1Y3RvcnMgbGVhdmUgdGhlCiAgICAgICAgICAqIGNv bnRlbnRzIG9mIHRoZSBwYWdlcyBpbiBwbGFjZSwgd2UgY2FuIGRlbGF5IFRM QiBmbHVzaGVzIHVudGlsCiAgICAgICAgICAqIGp1c3QgYmVmb3JlIHRoZSBh bGxvY2F0b3IgaGFuZHMgdGhlIHBhZ2Ugb3V0IGFnYWluLiAqLwotICAgICAg ICBzcC0+dGxiZmx1c2hfdGltZXN0YW1wID0gdGxiZmx1c2hfY3VycmVudF90 aW1lKCk7CisgICAgICAgIHBhZ2Vfc2V0X3RsYmZsdXNoX3RpbWVzdGFtcChz cCk7CiAgICAgICAgIHBlcmZjX2RlY3Ioc2hhZG93X2FsbG9jX2NvdW50KTsK ICAgICAgICAgcGFnZV9saXN0X2FkZF90YWlsKHNwLCAmZC0+YXJjaC5wYWdp bmcuc2hhZG93LmZyZWVsaXN0KTsKICAgICAgICAgc3AgPSBuZXh0OwotLS0g YS94ZW4vY29tbW9uL3BhZ2VfYWxsb2MuYworKysgYi94ZW4vY29tbW9uL3Bh Z2VfYWxsb2MuYwpAQCAtOTYwLDcgKzk2MCw3IEBAIHN0YXRpYyB2b2lkIGZy ZWVfaGVhcF9wYWdlcygKICAgICAgICAgLyogSWYgYSBwYWdlIGhhcyBubyBv d25lciBpdCB3aWxsIG5lZWQgbm8gc2FmZXR5IFRMQiBmbHVzaC4gKi8KICAg ICAgICAgcGdbaV0udS5mcmVlLm5lZWRfdGxiZmx1c2ggPSAocGFnZV9nZXRf b3duZXIoJnBnW2ldKSAhPSBOVUxMKTsKICAgICAgICAgaWYgKCBwZ1tpXS51 LmZyZWUubmVlZF90bGJmbHVzaCApCi0gICAgICAgICAgICBwZ1tpXS50bGJm bHVzaF90aW1lc3RhbXAgPSB0bGJmbHVzaF9jdXJyZW50X3RpbWUoKTsKKyAg ICAgICAgICAgIHBhZ2Vfc2V0X3RsYmZsdXNoX3RpbWVzdGFtcCgmcGdbaV0p OwogCiAgICAgICAgIC8qIFRoaXMgcGFnZSBpcyBub3QgYSBndWVzdCBmcmFt ZSBhbnkgbW9yZS4gKi8KICAgICAgICAgcGFnZV9zZXRfb3duZXIoJnBnW2ld LCBOVUxMKTsgLyogc2V0X2dwZm5fZnJvbV9tZm4gc25vb3BzIHBnIG93bmVy ICovCi0tLSBhL3hlbi9pbmNsdWRlL2FzbS1hcm0vZmx1c2h0bGIuaAorKysg Yi94ZW4vaW5jbHVkZS9hc20tYXJtL2ZsdXNodGxiLmgKQEAgLTEyLDYgKzEy LDExIEBAIHN0YXRpYyBpbmxpbmUgdm9pZCB0bGJmbHVzaF9maWx0ZXIoY3B1 bWEKIAogI2RlZmluZSB0bGJmbHVzaF9jdXJyZW50X3RpbWUoKSAgICAgICAg ICAgICAgICAgKDApCiAKK3N0YXRpYyBpbmxpbmUgdm9pZCBwYWdlX3NldF90 bGJmbHVzaF90aW1lc3RhbXAoc3RydWN0IHBhZ2VfaW5mbyAqcGFnZSkKK3sK KyAgICBwYWdlLT50bGJmbHVzaF90aW1lc3RhbXAgPSB0bGJmbHVzaF9jdXJy ZW50X3RpbWUoKTsKK30KKwogI2lmIGRlZmluZWQoQ09ORklHX0FSTV8zMikK ICMgaW5jbHVkZSA8YXNtL2FybTMyL2ZsdXNodGxiLmg+CiAjZWxpZiBkZWZp bmVkKENPTkZJR19BUk1fNjQpCi0tLSBhL3hlbi9pbmNsdWRlL2FzbS14ODYv Zmx1c2h0bGIuaAorKysgYi94ZW4vaW5jbHVkZS9hc20teDg2L2ZsdXNodGxi LmgKQEAgLTIzLDYgKzIzLDIwIEBAIERFQ0xBUkVfUEVSX0NQVSh1MzIsIHRs YmZsdXNoX3RpbWUpOwogCiAjZGVmaW5lIHRsYmZsdXNoX2N1cnJlbnRfdGlt ZSgpIHRsYmZsdXNoX2Nsb2NrCiAKK3N0YXRpYyBpbmxpbmUgdm9pZCBwYWdl X3NldF90bGJmbHVzaF90aW1lc3RhbXAoc3RydWN0IHBhZ2VfaW5mbyAqcGFn ZSkKK3sKKyAgICAvKgorICAgICAqIFByZXZlbnQgc3RvcmluZyBhIHN0YWxl IHRpbWUgc3RhbXAsIHdoaWNoIGNvdWxkIGhhcHBlbiBpZiBhbiB1cGRhdGUK KyAgICAgKiB0byB0bGJmbHVzaF9jbG9jayBwbHVzIGEgc3Vic2VxdWVudCBm bHVzaCBJUEkgaGFwcGVuIGJldHdlZW4gdGhlCisgICAgICogcmVhZGluZyBv ZiB0bGJmbHVzaF9jbG9jayBhbmQgdGhlIHdyaXRpbmcgb2YgdGhlIHN0cnVj dCBwYWdlX2luZm8KKyAgICAgKiBmaWVsZC4KKyAgICAgKi8KKyAgICBBU1NF UlQobG9jYWxfaXJxX2lzX2VuYWJsZWQoKSk7CisgICAgbG9jYWxfaXJxX2Rp c2FibGUoKTsKKyAgICBwYWdlLT50bGJmbHVzaF90aW1lc3RhbXAgPSB0bGJm bHVzaF9jdXJyZW50X3RpbWUoKTsKKyAgICBsb2NhbF9pcnFfZW5hYmxlKCk7 Cit9CisKIC8qCiAgKiBAY3B1X3N0YW1wIGlzIHRoZSB0aW1lc3RhbXAgYXQg bGFzdCBUTEIgZmx1c2ggZm9yIHRoZSBDUFUgd2UgYXJlIHRlc3RpbmcuCiAg KiBAbGFzdHVzZV9zdGFtcCBpcyBhIHRpbWVzdGFtcCB0YWtlbiB3aGVuIHRo ZSBQRk4gd2UgYXJlIHRlc3Rpbmcgd2FzIGxhc3QgCg== --=separator Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KWGVuLWRldmVs IG1haWxpbmcgbGlzdApYZW4tZGV2ZWxAbGlzdHMueGVuLm9yZwpodHRwczovL2xpc3RzLnhlbi5v cmcveGVuLWRldmVsCg== --=separator--