177745 2017-10-02 07:47:58 -0700 [Linux] Enable Gigacage in x64 Linux environment 2017-10-24 23:55:43 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=177923 InRadar P2 Normal --- 1 ysuzuki ysuzuki aperez bugs-noreply cgarcia clopez commit-queue cturner fpizlo mcatanzaro webkit-bug-importer zan oldest_to_newest 1355230 0 ysuzuki 2017-10-02 07:47:58 -0700 Proposal: Enabling Gigacage in Linux. Gigacage is implemented largely by fpizlo and it is a feature to limit the area referenced from a caged pointer. Once a pointer is caged, it can only reference to a specific area called Gigacage. This mechanism is implemented by `basePointer + (cagedPointer & cageMask)` This is good for security. Many exploit first attempts to replace ArrayBuffer's buffer pointer to a arbitrary area to modify arbitrary memory including JIT-executable ones. Caged pointer reduces the effectiveness of this attack by limitting the area that can be referenced from ArrayBuffer's caged pointer. Gigacage is now enabled in Darwin x64 environment. And Darwin + ARM64 work is ongoing (bug 177586). 1355232 1 ysuzuki 2017-10-02 07:58:10 -0700 Note: Gigacage works fine on Linux as of https://trac.webkit.org/r221548 change. 1355327 2 322393 ysuzuki 2017-10-02 11:01:57 -0700 Created attachment 322393 Patch 1355368 3 322393 ysuzuki 2017-10-02 11:55:12 -0700 Comment on attachment 322393 Patch I've just discussed with Filip and decided to enable it :) 1355389 4 322393 commit-queue 2017-10-02 12:20:04 -0700 Comment on attachment 322393 Patch Clearing flags on attachment: 322393 Committed r222731: <http://trac.webkit.org/changeset/222731> 1355390 5 commit-queue 2017-10-02 12:20:05 -0700 All reviewed patches have been landed. Closing bug. 1355392 6 webkit-bug-importer 2017-10-02 12:21:04 -0700 <rdar://problem/34773148> 1356346 7 cturner 2017-10-04 04:35:28 -0700 I get a segfault about not being able to allocate the gigacage when I try to run under Valgrind, my workaround for now is to export Malloc=1 to disable bmalloc. Not sure if there's a better way to continue using bmalloc without a gigacage. 1356384 8 mcatanzaro 2017-10-04 06:40:25 -0700 I would not expect bmalloc to work well under valgrind anyway. Malloc=1 seems like an acceptable solution, right? 1356400 9 ysuzuki 2017-10-04 07:26:24 -0700 (In reply to Michael Catanzaro from comment #8) > I would not expect bmalloc to work well under valgrind anyway. Malloc=1 > seems like an acceptable solution, right? Oh, nice catch. I'm not sure malloc can work with valgrind without any annotations. Out of curiousity: does valgrind work with WASM Memory allocation? WASM memory also allocates large virtual memory region. 1356417 10 cturner 2017-10-04 07:56:01 -0700 (In reply to Michael Catanzaro from comment #8) > I would not expect bmalloc to work well under valgrind anyway. Malloc=1 > seems like an acceptable solution, right? Valgrind has never worked very well for me with WebKit anyway, but the Malloc=1 thing was not required before gigacages, I'm just checking it would be a sensible thing to suggest in our port documentation. 1356477 11 clopez 2017-10-04 10:06:58 -0700 (In reply to Charlie Turner from comment #10) > (In reply to Michael Catanzaro from comment #8) > > I would not expect bmalloc to work well under valgrind anyway. Malloc=1 > > seems like an acceptable solution, right? > > Valgrind has never worked very well for me with WebKit anyway, but the > Malloc=1 thing was not required before gigacages, I'm just checking it would > be a sensible thing to suggest in our port documentation. It will be, please free to add that info to the wiki (for example: https://trac.webkit.org/wiki/WebKitGTK/Debugging ) It may be also a good idea to check if "Tools/Scripts/run-webkit-tests --leaks" are still working for GTK+, and if not maybe propose a patch to set that env var from the webkitpy tooling before starting the tests. 1363541 12 mcatanzaro 2017-10-23 20:30:09 -0700 So unfortunately this broke core dumps. I know Gigacage is a great security feature, but it's not more important than being able to debug crashes. So I'm going to roll this out, sorry. :/ Specifically, Gigacage has resulted in massive core dumps that get truncated at whatever the max limit in /etc/systemd/coredump.conf, resulting in an unusable backtrace. By default the size limit 2 GB, but I tried raising it to 8 GB and the limit was still reached by every crash. 1363543 13 mcatanzaro 2017-10-23 20:32:32 -0700 Committed r223877: <https://trac.webkit.org/changeset/223877> 1363544 14 mcatanzaro 2017-10-23 20:33:37 -0700 Reopening 1363641 15 ysuzuki 2017-10-24 02:21:09 -0700 (In reply to Michael Catanzaro from comment #12) > So unfortunately this broke core dumps. I know Gigacage is a great security > feature, but it's not more important than being able to debug crashes. So > I'm going to roll this out, sorry. :/ > > Specifically, Gigacage has resulted in massive core dumps that get truncated > at whatever the max limit in /etc/systemd/coredump.conf, resulting in an > unusable backtrace. By default the size limit 2 GB, but I tried raising it > to 8 GB and the limit was still reached by every crash. Hmm, this is really sad. OK, once we move Platform.h to bmalloc layer, I'll enable this on JSCOnly port. 1363666 16 aperez 2017-10-24 07:02:20 -0700 It turns out that the problem is not with gigacage: It's systemd-coredump. If the kernel is allowed to write the core dumps by itself by changing the value of “/proc/sys/kernel/core_pattern”, it works fine — systems which do not use systemd-coredump or have it disabled still get fine coredumps. My (unverified) suspicion is that sparse files with holes are being written by the kernel and systemd-coredump tries to write the full extents of the file and it is not detecting the holes when reading from the pipe (maybe it's not possible?). The net result is that systemd-coredump hits the core file size limit and truncates it. Unfortunately, the systemd developers have decided that truncated cores “are still useful” and not a bug (see https://github.com/systemd/systemd/issues/3883) I think gigacage should be re-enabled, and that systemd-coredump is buggy if it cannot handle core files that the kernel can generate without batting an eye. 1363676 17 mcatanzaro 2017-10-24 07:46:35 -0700 (In reply to Adrian Perez from comment #16) > My (unverified) suspicion is that sparse files with holes are being written > by the kernel and systemd-coredump tries to write the full extents of the > file and it is not detecting the holes when reading from the pipe (maybe > it's not possible?). The net result is that systemd-coredump hits the core > file size limit and truncates it. Unfortunately, the systemd developers > have decided that truncated cores “are still useful” and not a bug (see > https://github.com/systemd/systemd/issues/3883) Interesting. Alicia suggested we might try teaching coredumpctl to write out sparse files. Perhaps we should pursue this approach. > I think gigacage should be re-enabled, and that systemd-coredump is buggy > if it cannot handle core files that the kernel can generate without batting > an eye. We discussed this internally but did not come to an agreement. 1363794 18 324694 zan 2017-10-24 11:56:04 -0700 Created attachment 324694 Patch Yusuke, can you have a look? 1363803 19 324694 ysuzuki 2017-10-24 12:07:31 -0700 Comment on attachment 324694 Patch r=me. I don't like adding BOS(LINUX) much, but madvise is inherently platform dependent. And here, madvice needs to be called twice. So if we can consolidate these virtual memory operation difference in each platform into VMAllocate.h, I think it's OK. 1363827 20 324694 mcatanzaro 2017-10-24 13:04:45 -0700 Comment on attachment 324694 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=324694&action=review Awesome! > Source/bmalloc/bmalloc/Gigacage.h:55 > +#if ((BOS(DARWIN) || BOS(LINUX)) && (BCPU(ARM64) || BCPU(X86_64))) Only one comment from me. This is not the condition we had before. Previously we had Gigacage enabled only for Linux x86_64, not for ARM64. You have a separate patch in bug #178130 to enable it there. (Yusuke, you'd probably be the best reviewer for that patch.) The condition we had here before was: #if (BOS(DARWIN) && (BCPU(ARM64) || BCPU(X86_64))) || (BOS(LINUX) && BCPU(X86_64)) 1364112 21 324694 zan 2017-10-24 23:05:44 -0700 Comment on attachment 324694 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=324694&action=review >> Source/bmalloc/bmalloc/Gigacage.h:55 >> +#if ((BOS(DARWIN) || BOS(LINUX)) && (BCPU(ARM64) || BCPU(X86_64))) > > Only one comment from me. This is not the condition we had before. Previously we had Gigacage enabled only for Linux x86_64, not for ARM64. You have a separate patch in bug #178130 to enable it there. (Yusuke, you'd probably be the best reviewer for that patch.) > > The condition we had here before was: > > #if (BOS(DARWIN) && (BCPU(ARM64) || BCPU(X86_64))) || (BOS(LINUX) && BCPU(X86_64)) Right, confused this with the work in #178130. 1364114 22 324797 zan 2017-10-24 23:08:23 -0700 Created attachment 324797 Patch for landing 1364126 23 324797 zan 2017-10-24 23:55:38 -0700 Comment on attachment 324797 Patch for landing Clearing flags on attachment: 324797 Committed r223950: <https://trac.webkit.org/changeset/223950> 1364127 24 zan 2017-10-24 23:55:43 -0700 All reviewed patches have been landed. Closing bug. 322393 2017-10-02 11:01:57 -0700 2017-10-24 11:56:00 -0700 Patch bug-177745-20171003030156.patch text/plain 1407 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMjIyNzA4CmRpZmYgLS1naXQgYS9Tb3VyY2UvYm1hbGxvYy9D aGFuZ2VMb2cgYi9Tb3VyY2UvYm1hbGxvYy9DaGFuZ2VMb2cKaW5kZXggZWUyNjE2NjI3ODIxNGY3 ZmEwMTczOTFkZmY4ZmIyYTI0MDkxNTgxOS4uNTk4ZGQ4NWYyZGJmYWNlNmIyZjc2N2Q2ZWI0YTEz NjhkNWIyNmE4YiAxMDA2NDQKLS0tIGEvU291cmNlL2JtYWxsb2MvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9ibWFsbG9jL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDE3LTEwLTAyICBZdXN1 a2UgU3V6dWtpICA8dXRhdGFuZS50ZWFAZ21haWwuY29tPgorCisgICAgICAgIFtMaW51eF0gRW5h YmxlIEdpZ2FjYWdlIGluIHg2NCBMaW51eCBlbnZpcm9ubWVudAorICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTc3NzQ1CisKKyAgICAgICAgUmV2aWV3ZWQg YnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGhpcyBwYXRjaCBlbmFibGVzIEdpZ2FjYWdl IGluIHg2NCBMaW51eCBlbnZpcm9ubWVudC4KKyAgICAgICAgR2lnYWNhZ2UgZW5mb3JjZXMgYSBj YWdlZCBwb2ludGVyIHRvIHJlZmVyZW5jZSB0byB0aGUKKyAgICAgICAgc3BlY2lmaWMgbWVtb3J5 IHJlZ2lvbi4gVGhpcyByZWR1Y2VzIHRoZSBlZmZlY3RpdmVuZXNzCisgICAgICAgIG9mIHNvbWUg dHlwZXMgb2YgYXR0YWNrcyBzZXR0aW5nIGEgcG9pbnRlciB0byBBcnJheUJ1ZmZlcgorICAgICAg ICBhbmQgbW9kaWZ5aW5nIGFyYml0cmFyeSBtZW1vcnkgcmVnaW9uLgorCisgICAgICAgICogYm1h bGxvYy9HaWdhY2FnZS5oOgorCiAyMDE3LTA5LTI5ICBDb21taXQgUXVldWUgIDxjb21taXQtcXVl dWVAd2Via2l0Lm9yZz4KIAogICAgICAgICBVbnJldmlld2VkLCByb2xsaW5nIG91dCByMjIyNjI1 LgpkaWZmIC0tZ2l0IGEvU291cmNlL2JtYWxsb2MvYm1hbGxvYy9HaWdhY2FnZS5oIGIvU291cmNl L2JtYWxsb2MvYm1hbGxvYy9HaWdhY2FnZS5oCmluZGV4IDQ2ZWNiOTQ1YWM1MDQ4Njg2MzYzMjNk OTM4NWMwN2RlZjA4ZDNmNTUuLjNiNzU3OWJiNjdkMGIxYzc3MDU5ODExYTEzNjVkZWM3YmMwMWRl NmEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9ibWFsbG9jL2JtYWxsb2MvR2lnYWNhZ2UuaAorKysgYi9T b3VyY2UvYm1hbGxvYy9ibWFsbG9jL0dpZ2FjYWdlLmgKQEAgLTUxLDcgKzUxLDcgQEAKICNkZWZp bmUgSlNWQUxVRV9HSUdBQ0FHRV9SVU5XQVkgMAogI2RlZmluZSBTVFJJTkdfR0lHQUNBR0VfUlVO V0FZIDAKIAotI2lmIEJPUyhEQVJXSU4pICYmIEJDUFUoWDg2XzY0KQorI2lmIChCT1MoREFSV0lO KSB8fCBCT1MoTElOVVgpKSAmJiBCQ1BVKFg4Nl82NCkKICNkZWZpbmUgR0lHQUNBR0VfRU5BQkxF RCAxCiAjZWxzZQogI2RlZmluZSBHSUdBQ0FHRV9FTkFCTEVEIDAK 324694 2017-10-24 11:56:04 -0700 2017-10-24 23:08:19 -0700 Patch bug-177745-20171024205603.patch text/plain 3179 zan U3VidmVyc2lvbiBSZXZpc2lvbjogMjIzODg3CmRpZmYgLS1naXQgYS9Tb3VyY2UvYm1hbGxvYy9D aGFuZ2VMb2cgYi9Tb3VyY2UvYm1hbGxvYy9DaGFuZ2VMb2cKaW5kZXggYmRhMGZmYzg5MDQ0ZTFl OGYzNDM5MDU0MDg4ZDdjZjJlYmZjYWEzZi4uZDg3ZjczZDBhMGFmODg1ZTAwNjY2OTdjMTBiOWNm NDEyMWRkN2I4OSAxMDA2NDQKLS0tIGEvU291cmNlL2JtYWxsb2MvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9ibWFsbG9jL0NoYW5nZUxvZwpAQCAtMSwzICsxLDMxIEBACisyMDE3LTEwLTI0ICBaYW4g RG9iZXJzZWsgIDx6ZG9iZXJzZWtAaWdhbGlhLmNvbT4KKworICAgICAgICBbTGludXhdIEVuYWJs ZSBHaWdhY2FnZSBpbiB4NjQgTGludXggZW52aXJvbm1lbnQKKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE3Nzc0NQorICAgICAgICA8cmRhcjovL3Byb2Js ZW0vMzQ3NzMxNDg+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgUmUtZW5hYmxlIEdpZ2FjYWdlIG9uIHg4Nl82NCBMaW51eCBwbGF0Zm9ybXMgYWZ0ZXIg aXQgd2FzIGRpc2FibGVkIGluIDIyMzg3Ny4KKworICAgICAgICBUaGUgY2F1c2UgZm9yIHRoZSBy ZXZlcnQgd2FzIHByb2JsZW1zIHdpdGggaHVnZSBjb3JlZHVtcHMgYmVpbmcgZ2VuZXJhdGVkCisg ICAgICAgIHdoaWxlIEdpZ2FjYWdlIHdhcyBlbmFibGVkLiBUaGUgZmVhdHVyZSB2aXJ0dWFsbHkg YWxsb2NhdGVzIGFib3V0IDgwR0Igb2YKKyAgICAgICAgbWVtb3J5IGF0IHRoZSBiZWdpbm5pbmcg b2YgdGhlIHByb2Nlc3MgbGlmZXRpbWUuIFRoaXMgaXMgbm90IGEgcHJvYmxlbSBpbgorICAgICAg ICBpdHNlbGYgc2luY2UgdGhlIG1lbW9yeSByYW5nZSBpcyBtYXJrZWQgYXMgbm90IG5lZWRlZCB0 aHJvdWdoIG1hZHZpc2UoKSwKKyAgICAgICAgYnV0IGFsbCB0aGlzIG1lbW9yeSB3YXMgc3RpbGwg aW5jbHVkZWQgdXBvbiBjb3JlIGR1bXAgZ2VuZXJhdGlvbiBvbiBMaW51eC4KKyAgICAgICAgU2lu Y2UgdGhlcmUgYXJlIHJlYXNvbmFibGUgbGltaXRzIGVuZm9yY2VkIHVwb24gY29yZSBkdW1wcywg dGhlc2Ugd2VyZQorICAgICAgICBiZWluZyB0cnVuY2F0ZWQgZXZlcnkgdGltZSwgbm90IHlpZWxk aW5nIGFueSB1c2VmdWwgaW5mb3JtYXRpb24uCisKKyAgICAgICAgVG8gYXZvaWQgdGhpcywgb24g TGludXgsIGludm9jYXRpb25zIG9mIG1hZHZpc2UoKSB3aXRoIHRoZSBNQURWX05PUk1BTCBhbmQK KyAgICAgICAgTUFEVl9ET05UTkVFRCBhZHZpY2UgcGFyYW1ldGVycyBzaG91bGQgYmUgYWNjb21w YW5pZWQgd2l0aCByZXNwZWN0aXZlbHkKKyAgICAgICAgbWF0Y2hpbmcgTUFEVl9ET0RVTVAgYW5k IE1BRFZfRE9OVERVTVAgbWFkdmlzZSgpIGNhbGxzLiBUaGlzIGNvcnJlY3RseQorICAgICAgICBh dm9pZHMgY29yZS1kdW1waW5nIGFueSBtZW1vcnkgdGhhdCdzIG5vdCB5ZXQgYmVlbiBwaHlzaWNh bGx5IGFsbG9jYXRlZC4KKworICAgICAgICAqIGJtYWxsb2MvR2lnYWNhZ2UuaDoKKyAgICAgICAg KiBibWFsbG9jL1ZNQWxsb2NhdGUuaDoKKyAgICAgICAgKGJtYWxsb2M6OnZtRGVhbGxvY2F0ZVBo eXNpY2FsUGFnZXMpOgorICAgICAgICAoYm1hbGxvYzo6dm1BbGxvY2F0ZVBoeXNpY2FsUGFnZXMp OgorCiAyMDE3LTEwLTIzICBNaWNoYWVsIENhdGFuemFybyAgPG1jYXRhbnphcm9AaWdhbGlhLmNv bT4KIAogICAgICAgICBVbnJldmlld2VkLCByb2xsIG91dCByMjIyNzMxCmRpZmYgLS1naXQgYS9T b3VyY2UvYm1hbGxvYy9ibWFsbG9jL0dpZ2FjYWdlLmggYi9Tb3VyY2UvYm1hbGxvYy9ibWFsbG9j L0dpZ2FjYWdlLmgKaW5kZXggNzE0YjFhZGM1NjY3NmM2MTNlM2U2OGZjYzBkMTA5ZTM5NDdkMTE1 OS4uNmEyMjM0ZDZlYTE4Zjk0ODQxYWI2Zjg2OTU3YzA1NmJiYzg0ZWEwNCAxMDA2NDQKLS0tIGEv U291cmNlL2JtYWxsb2MvYm1hbGxvYy9HaWdhY2FnZS5oCisrKyBiL1NvdXJjZS9ibWFsbG9jL2Jt YWxsb2MvR2lnYWNhZ2UuaApAQCAtNTIsNyArNTIsNyBAQAogI2RlZmluZSBKU1ZBTFVFX0dJR0FD QUdFX01BU0sgR0lHQUNBR0VfU0laRV9UT19NQVNLKEpTVkFMVUVfR0lHQUNBR0VfU0laRSkKICNk ZWZpbmUgU1RSSU5HX0dJR0FDQUdFX01BU0sgR0lHQUNBR0VfU0laRV9UT19NQVNLKFNUUklOR19H SUdBQ0FHRV9TSVpFKQogCi0jaWYgKEJPUyhEQVJXSU4pICYmIChCQ1BVKEFSTTY0KSB8fCBCQ1BV KFg4Nl82NCkpKQorI2lmICgoQk9TKERBUldJTikgfHwgQk9TKExJTlVYKSkgJiYgKEJDUFUoQVJN NjQpIHx8IEJDUFUoWDg2XzY0KSkpCiAjZGVmaW5lIEdJR0FDQUdFX0VOQUJMRUQgMQogI2Vsc2UK ICNkZWZpbmUgR0lHQUNBR0VfRU5BQkxFRCAwCmRpZmYgLS1naXQgYS9Tb3VyY2UvYm1hbGxvYy9i bWFsbG9jL1ZNQWxsb2NhdGUuaCBiL1NvdXJjZS9ibWFsbG9jL2JtYWxsb2MvVk1BbGxvY2F0ZS5o CmluZGV4IGFmN2I2YjAwMzZkNzg4MWQwNWIzYmYyYThhNDRjOGQ2YjI1OGVmMTQuLjMxZjQ2NDEw Y2Y2NDU0MGE2MmQ0NzYxZDkwYmQyNjE2ZGY4NTg5MWEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9ibWFs bG9jL2JtYWxsb2MvVk1BbGxvY2F0ZS5oCisrKyBiL1NvdXJjZS9ibWFsbG9jL2JtYWxsb2MvVk1B bGxvY2F0ZS5oCkBAIC0xOTMsNiArMTkzLDkgQEAgaW5saW5lIHZvaWQgdm1EZWFsbG9jYXRlUGh5 c2ljYWxQYWdlcyh2b2lkKiBwLCBzaXplX3Qgdm1TaXplKQogICAgIFNZU0NBTEwobWFkdmlzZShw LCB2bVNpemUsIE1BRFZfRlJFRV9SRVVTQUJMRSkpOwogI2Vsc2UKICAgICBTWVNDQUxMKG1hZHZp c2UocCwgdm1TaXplLCBNQURWX0RPTlRORUVEKSk7CisjaWYgQk9TKExJTlVYKQorICAgIFNZU0NB TEwobWFkdmlzZShwLCB2bVNpemUsIE1BRFZfRE9OVERVTVApKTsKKyNlbmRpZgogI2VuZGlmCiB9 CiAKQEAgLTIwMyw2ICsyMDYsOSBAQCBpbmxpbmUgdm9pZCB2bUFsbG9jYXRlUGh5c2ljYWxQYWdl cyh2b2lkKiBwLCBzaXplX3Qgdm1TaXplKQogICAgIFNZU0NBTEwobWFkdmlzZShwLCB2bVNpemUs IE1BRFZfRlJFRV9SRVVTRSkpOwogI2Vsc2UKICAgICBTWVNDQUxMKG1hZHZpc2UocCwgdm1TaXpl LCBNQURWX05PUk1BTCkpOworI2lmIEJPUyhMSU5VWCkKKyAgICBTWVNDQUxMKG1hZHZpc2UocCwg dm1TaXplLCBNQURWX0RPRFVNUCkpOworI2VuZGlmCiAjZW5kaWYKIH0KIAo= 324797 2017-10-24 23:08:23 -0700 2017-10-24 23:08:23 -0700 Patch for landing bug-177745-20171025080821.patch text/plain 3233 zan U3VidmVyc2lvbiBSZXZpc2lvbjogMjIzOTQ3CmRpZmYgLS1naXQgYS9Tb3VyY2UvYm1hbGxvYy9D aGFuZ2VMb2cgYi9Tb3VyY2UvYm1hbGxvYy9DaGFuZ2VMb2cKaW5kZXggNTZlNjc2OTRlNDJlMjJm YTQ0YWJjNDJmYjNiY2RhMzlkZmRiODU0OC4uNGNlOGYxYjk2N2Q3ZDlmODNhMTM3MDg2ODBiNmZh OTYwYmFiYzZjYyAxMDA2NDQKLS0tIGEvU291cmNlL2JtYWxsb2MvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9ibWFsbG9jL0NoYW5nZUxvZwpAQCAtMSwzICsxLDMxIEBACisyMDE3LTEwLTI0ICBaYW4g RG9iZXJzZWsgIDx6ZG9iZXJzZWtAaWdhbGlhLmNvbT4KKworICAgICAgICBbTGludXhdIEVuYWJs ZSBHaWdhY2FnZSBpbiB4NjQgTGludXggZW52aXJvbm1lbnQKKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE3Nzc0NQorICAgICAgICA8cmRhcjovL3Byb2Js ZW0vMzQ3NzMxNDg+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgWXVzdWtlIFN1enVraS4KKworICAg ICAgICBSZS1lbmFibGUgR2lnYWNhZ2Ugb24geDg2XzY0IExpbnV4IHBsYXRmb3JtcyBhZnRlciBp dCB3YXMgZGlzYWJsZWQgaW4gMjIzODc3LgorCisgICAgICAgIFRoZSBjYXVzZSBmb3IgdGhlIHJl dmVydCB3YXMgcHJvYmxlbXMgd2l0aCBodWdlIGNvcmVkdW1wcyBiZWluZyBnZW5lcmF0ZWQKKyAg ICAgICAgd2hpbGUgR2lnYWNhZ2Ugd2FzIGVuYWJsZWQuIFRoZSBmZWF0dXJlIHZpcnR1YWxseSBh bGxvY2F0ZXMgYWJvdXQgODBHQiBvZgorICAgICAgICBtZW1vcnkgYXQgdGhlIGJlZ2lubmluZyBv ZiB0aGUgcHJvY2VzcyBsaWZldGltZS4gVGhpcyBpcyBub3QgYSBwcm9ibGVtIGluCisgICAgICAg IGl0c2VsZiBzaW5jZSB0aGUgbWVtb3J5IHJhbmdlIGlzIG1hcmtlZCBhcyBub3QgbmVlZGVkIHRo cm91Z2ggbWFkdmlzZSgpLAorICAgICAgICBidXQgYWxsIHRoaXMgbWVtb3J5IHdhcyBzdGlsbCBp bmNsdWRlZCB1cG9uIGNvcmUgZHVtcCBnZW5lcmF0aW9uIG9uIExpbnV4LgorICAgICAgICBTaW5j ZSB0aGVyZSBhcmUgcmVhc29uYWJsZSBsaW1pdHMgZW5mb3JjZWQgdXBvbiBjb3JlIGR1bXBzLCB0 aGVzZSB3ZXJlCisgICAgICAgIGJlaW5nIHRydW5jYXRlZCBldmVyeSB0aW1lLCBub3QgeWllbGRp bmcgYW55IHVzZWZ1bCBpbmZvcm1hdGlvbi4KKworICAgICAgICBUbyBhdm9pZCB0aGlzLCBvbiBM aW51eCwgaW52b2NhdGlvbnMgb2YgbWFkdmlzZSgpIHdpdGggdGhlIE1BRFZfTk9STUFMIGFuZAor ICAgICAgICBNQURWX0RPTlRORUVEIGFkdmljZSBwYXJhbWV0ZXJzIHNob3VsZCBiZSBhY2NvbXBh bmllZCB3aXRoIHJlc3BlY3RpdmVseQorICAgICAgICBtYXRjaGluZyBNQURWX0RPRFVNUCBhbmQg TUFEVl9ET05URFVNUCBtYWR2aXNlKCkgY2FsbHMuIFRoaXMgY29ycmVjdGx5CisgICAgICAgIGF2 b2lkcyBjb3JlLWR1bXBpbmcgYW55IG1lbW9yeSB0aGF0J3Mgbm90IHlldCBiZWVuIHBoeXNpY2Fs bHkgYWxsb2NhdGVkLgorCisgICAgICAgICogYm1hbGxvYy9HaWdhY2FnZS5oOgorICAgICAgICAq IGJtYWxsb2MvVk1BbGxvY2F0ZS5oOgorICAgICAgICAoYm1hbGxvYzo6dm1EZWFsbG9jYXRlUGh5 c2ljYWxQYWdlcyk6CisgICAgICAgIChibWFsbG9jOjp2bUFsbG9jYXRlUGh5c2ljYWxQYWdlcyk6 CisKIDIwMTctMTAtMjQgIERhdmlkIEtpbHplciAgPGRka2lsemVyQGFwcGxlLmNvbT4KIAogICAg ICAgICBOZWVkIHRvIHBhc3Mgbm9uLW5pbCBhcmd1bWVudCB0byBTaW11bGF0ZUNyYXNoKCkgaW4g Ym1hbGxvYzo6bG9nVk1GYWlsdXJlKCkKZGlmZiAtLWdpdCBhL1NvdXJjZS9ibWFsbG9jL2JtYWxs b2MvR2lnYWNhZ2UuaCBiL1NvdXJjZS9ibWFsbG9jL2JtYWxsb2MvR2lnYWNhZ2UuaAppbmRleCA3 MTRiMWFkYzU2Njc2YzYxM2UzZTY4ZmNjMGQxMDllMzk0N2QxMTU5Li4xODFhN2U2MjRjZTAwOGM5 NzUxMDc5MGYyNWRmMjVlMjY2OTE3YjQ4IDEwMDY0NAotLS0gYS9Tb3VyY2UvYm1hbGxvYy9ibWFs bG9jL0dpZ2FjYWdlLmgKKysrIGIvU291cmNlL2JtYWxsb2MvYm1hbGxvYy9HaWdhY2FnZS5oCkBA IC01Miw3ICs1Miw3IEBACiAjZGVmaW5lIEpTVkFMVUVfR0lHQUNBR0VfTUFTSyBHSUdBQ0FHRV9T SVpFX1RPX01BU0soSlNWQUxVRV9HSUdBQ0FHRV9TSVpFKQogI2RlZmluZSBTVFJJTkdfR0lHQUNB R0VfTUFTSyBHSUdBQ0FHRV9TSVpFX1RPX01BU0soU1RSSU5HX0dJR0FDQUdFX1NJWkUpCiAKLSNp ZiAoQk9TKERBUldJTikgJiYgKEJDUFUoQVJNNjQpIHx8IEJDUFUoWDg2XzY0KSkpCisjaWYgKEJP UyhEQVJXSU4pICYmIChCQ1BVKEFSTTY0KSB8fCBCQ1BVKFg4Nl82NCkpKSB8fCAoQk9TKExJTlVY KSAmJiBCQ1BVKFg4Nl82NCkpCiAjZGVmaW5lIEdJR0FDQUdFX0VOQUJMRUQgMQogI2Vsc2UKICNk ZWZpbmUgR0lHQUNBR0VfRU5BQkxFRCAwCmRpZmYgLS1naXQgYS9Tb3VyY2UvYm1hbGxvYy9ibWFs bG9jL1ZNQWxsb2NhdGUuaCBiL1NvdXJjZS9ibWFsbG9jL2JtYWxsb2MvVk1BbGxvY2F0ZS5oCmlu ZGV4IGU2YTE1NmNiZGVlZmIzNTZmNGQ5NmI1YzQ1ZGE3Njk1NWZjN2M1MjIuLjFjZWIwNGU0NmE4 ODM5ZTU3ZWExZDEyZDBmNDI2NzJkNGQ1ZjMyN2IgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9ibWFsbG9j L2JtYWxsb2MvVk1BbGxvY2F0ZS5oCisrKyBiL1NvdXJjZS9ibWFsbG9jL2JtYWxsb2MvVk1BbGxv Y2F0ZS5oCkBAIC0xOTMsNiArMTkzLDkgQEAgaW5saW5lIHZvaWQgdm1EZWFsbG9jYXRlUGh5c2lj YWxQYWdlcyh2b2lkKiBwLCBzaXplX3Qgdm1TaXplKQogICAgIFNZU0NBTEwobWFkdmlzZShwLCB2 bVNpemUsIE1BRFZfRlJFRV9SRVVTQUJMRSkpOwogI2Vsc2UKICAgICBTWVNDQUxMKG1hZHZpc2Uo cCwgdm1TaXplLCBNQURWX0RPTlRORUVEKSk7CisjaWYgQk9TKExJTlVYKQorICAgIFNZU0NBTEwo bWFkdmlzZShwLCB2bVNpemUsIE1BRFZfRE9OVERVTVApKTsKKyNlbmRpZgogI2VuZGlmCiB9CiAK QEAgLTIwMyw2ICsyMDYsOSBAQCBpbmxpbmUgdm9pZCB2bUFsbG9jYXRlUGh5c2ljYWxQYWdlcyh2 b2lkKiBwLCBzaXplX3Qgdm1TaXplKQogICAgIFNZU0NBTEwobWFkdmlzZShwLCB2bVNpemUsIE1B RFZfRlJFRV9SRVVTRSkpOwogI2Vsc2UKICAgICBTWVNDQUxMKG1hZHZpc2UocCwgdm1TaXplLCBN QURWX05PUk1BTCkpOworI2lmIEJPUyhMSU5VWCkKKyAgICBTWVNDQUxMKG1hZHZpc2UocCwgdm1T aXplLCBNQURWX0RPRFVNUCkpOworI2VuZGlmCiAjZW5kaWYKIH0KIAo=