From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150053.outbound.protection.outlook.com [40.107.15.53]) by sourceware.org (Postfix) with ESMTPS id 438BC3842407 for ; Tue, 21 Jul 2020 15:18:18 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 438BC3842407 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=arm.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=Matthew.Malcomson@arm.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=umAZ1biE6JaPXo81c1Z2Eh/xPw7kjdXm+iKu1/jVXe4=; b=5R3CjQRcdUDmNgzMTuvLzkRknuiVFAvR5OT2OfkpPzWK9hVRzJ1LGIbJXV98aMlBodI2JMTi9YgOobphl+uB7WrBX3zKFjsSwL7iVhRS8BXYskMZio1R7UBl+8kjmr+FFbHuK/D3djrHyGAffbU706j5LTFmBGR1KM5r5HB2ByQ= Received: from AM6PR02CA0007.eurprd02.prod.outlook.com (2603:10a6:20b:6e::20) by DBBPR08MB4919.eurprd08.prod.outlook.com (2603:10a6:10:f0::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.23; Tue, 21 Jul 2020 15:18:16 +0000 Received: from VE1EUR03FT061.eop-EUR03.prod.protection.outlook.com (2603:10a6:20b:6e:cafe::4e) by AM6PR02CA0007.outlook.office365.com (2603:10a6:20b:6e::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.20 via Frontend Transport; Tue, 21 Jul 2020 15:18:16 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; gcc.gnu.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;gcc.gnu.org; dmarc=bestguesspass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT061.mail.protection.outlook.com (10.152.19.220) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.18 via Frontend Transport; Tue, 21 Jul 2020 15:18:16 +0000 Received: ("Tessian outbound 1c27ecaec3d6:v62"); Tue, 21 Jul 2020 15:18:15 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: 969f520313baa910 X-CR-MTA-TID: 64aa7808 Received: from 0d9834cd50e2.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id D6B5771A-002B-4647-8960-D3AC453EDA28.1; Tue, 21 Jul 2020 15:18:09 +0000 Received: from EUR02-AM5-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 0d9834cd50e2.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Tue, 21 Jul 2020 15:18:09 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mSFRztMvlbsTjfm9JG7eDClvhH3ActqzCY5CawbS6MCKQxbU4iJhWxTzhyHf9ec5/rXhOI7K7xC/GQ4AKHZ7a2QmNA8T9erbmAV/m0XF7xSFeBkN/FgNJ7XuMEAPIy33HFvua9COKldkVhPitVG6RF/wf6H0XtCmMUS5e7nAVAghSvGOUK9WmvQrq4dMoh8UtOL4zZiP5HGkehPIsofQlG4js6emOhhkmrCVoQsa97czHU79ECa7jJB3A5fgXPsWDLhPl7R/CLbNHTzY3qtHLwjLixJoMaKBBWZ6qIMJh8jm2plFRqP2kajdB9cnofEfJryeXlbvM5YVfL89eOhHqQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=umAZ1biE6JaPXo81c1Z2Eh/xPw7kjdXm+iKu1/jVXe4=; b=mDJzOsgEc5b7Goj8q8ra1E/rmxRb5XagOfkhWvJNGu6TkZC209TWTaKWzvjsNZTbJPdD2Ff30VG2DVlFBZpBxG2WHKLAfuJerrTz1P9uMsRyL/b3ymzHCqC7fFw/ullKUc29GYTGRgQ1/HQleasSfkMdER6Noz8AKQSD3etumuoAIAP4i2MrvPcoH7wGfkxmad0LTNMKsoiB6/8+7YiBwX5CzJ+PfhicQUfFJLUXRkYHBxvECXzMcR2AQGUr2TAY0wwDuSUOduio93Nxw6DlFQaiw6vSaxDhM70WSJtd+P2ywuIFtbbTsEiTHfASG0iA0o//XAeHMohriVAvskxOcQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=umAZ1biE6JaPXo81c1Z2Eh/xPw7kjdXm+iKu1/jVXe4=; b=5R3CjQRcdUDmNgzMTuvLzkRknuiVFAvR5OT2OfkpPzWK9hVRzJ1LGIbJXV98aMlBodI2JMTi9YgOobphl+uB7WrBX3zKFjsSwL7iVhRS8BXYskMZio1R7UBl+8kjmr+FFbHuK/D3djrHyGAffbU706j5LTFmBGR1KM5r5HB2ByQ= Authentication-Results-Original: gcc.gnu.org; dkim=none (message not signed) header.d=none;gcc.gnu.org; dmarc=none action=none header.from=arm.com; Received: from AM6PR08MB3157.eurprd08.prod.outlook.com (2603:10a6:209:48::24) by AM6PR08MB3288.eurprd08.prod.outlook.com (2603:10a6:209:47::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.23; Tue, 21 Jul 2020 15:18:07 +0000 Received: from AM6PR08MB3157.eurprd08.prod.outlook.com ([fe80::5f9:be56:311a:c1dd]) by AM6PR08MB3157.eurprd08.prod.outlook.com ([fe80::5f9:be56:311a:c1dd%3]) with mapi id 15.20.3195.026; Tue, 21 Jul 2020 15:18:07 +0000 Content-Type: multipart/mixed; boundary="===============0152312779251849756==" From: Matthew Malcomson Date: Tue, 21 Jul 2020 16:15:34 +0100 To: gcc-patches@gcc.gnu.org Cc: Richard.Earnshaw@arm.com, Kyrylo.Tkachov@arm.com, Ross Burton Subject: aarch64: (GCC-9 Backport) Introduce SLS mitigation for RET and BR instructions In-Reply-To: <159534453451.25601.18119761260522884038.scripted-patch-series@arm.com> References: <159534453451.25601.18119761260522884038.scripted-patch-series@arm.com> X-ClientProxiedBy: LO2P123CA0030.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600::18) To AM6PR08MB3157.eurprd08.prod.outlook.com (2603:10a6:209:48::24) Message-ID: MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from e120487-lin.cambridge.arm.com (217.140.106.52) by LO2P123CA0030.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.18 via Frontend Transport; Tue, 21 Jul 2020 15:18:07 +0000 X-Originating-IP: [217.140.106.52] X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: bcab0121-7356-4655-83b7-08d82d894ad5 X-MS-TrafficTypeDiagnostic: AM6PR08MB3288:|DBBPR08MB4919: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true NoDisclaimer: true X-MS-Oob-TLC-OOBClassifiers: OLM:2958;OLM:2958; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: +u9YtzCRbhHwtyCmmbiQ/3hAwxOCaGKrups1aMy4ybs4V9wa6lgW6yP95v4mjuNV1fuiTBSlQcZGDn7e/r9qEjNVYexElLANJeXqV5Len/gn2Q8gy2ExVONOv7Pnr+okyJqIZUqlDWMa0yiQfCGggvyk+cOold4chZDDVyp6aPEOSpJZmcS3pLJ5m1zQ6h+4Nyxik/Nr3VVZpxpJv7WF8ETjXv5ffV1pqVJaO6VlG7KstsZ/EIB+EZ1NkXGGYxvjSu/Z/TWWpYlF0ZEQRi3Z+X6SqnVnTgPwEj4y2hx1Zbb/QFn0B7gmzGwVhBSODyfZwqzeERmKymgQwEECRxowqYYGV7P0HAzP4+fTfYVISBxsekoi/P/sXe+NRtMMvkBuYxUyVgi68oaltqYEJdQT9Lf9MDDFI7DPAdC3KSjAgu8BuryC3Tn5qXcv+PYnj09WKIOCCLW3iGxFw7Dy9Pkpvw== X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM6PR08MB3157.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(136003)(396003)(346002)(39860400002)(376002)(366004)(186003)(44832011)(235185007)(52116002)(33964004)(2906002)(5660300002)(956004)(86362001)(8936002)(66476007)(6666004)(66556008)(66946007)(6486002)(8676002)(16526019)(26005)(52536014)(6512007)(9686003)(66616009)(478600001)(33656002)(30864003)(6916009)(83380400001)(4326008)(316002)(2004002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: KnB4H84VZkLsezE4kgRicg8Zhm8ip03A5/jmV4qCCs24YJf1krNUYw8zlVRtIriRAEaevR0l4Mvq3vqDmVktT+YyQFtWfkX2jMtyOVFi5ViguyIuIXdCBrsflhYsSkMaAaR8pi+Asahr/xyGh89nHC+QsGNU0ty8tc0g03Jwgz3heyPBtliTrqZIOzPHHKz6DeoCZlBn8D+3bYV3jZZIGKUYHRWIM/ctL3gDVOdDI0s2H2deqiU0Zgdu7X5nZoLTaK9Cj/elqQ8XqXHOnJ7SQX1sNg508y/lHsjUyGIwGJXAL8QA3qNxjChNwtvf4mYjzIELa0UVfejXKdX3sfehB+vYtJdb9OXNic7A/HBphpMIOHKZunj84rIINY5dElQaebTAG0Mq3gqmQapNY6+p+dViM4EcIMMfuSkJ+vosh88PDjdThd4dPBzhxVYDnwzedk1wnAufcek44iMMcKQE7mdW1N51euIVqR5ebJAviI4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB3288 Original-Authentication-Results: gcc.gnu.org; dkim=none (message not signed) header.d=none;gcc.gnu.org; dmarc=none action=none header.from=arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT061.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFTY:; SFS:(4636009)(396003)(136003)(346002)(376002)(39860400002)(46966005)(82310400002)(356005)(316002)(33964004)(6666004)(956004)(33656002)(6486002)(81166007)(16526019)(186003)(26005)(5660300002)(86362001)(66616009)(70206006)(83380400001)(70586007)(235185007)(82740400003)(44832011)(47076004)(36906005)(336012)(52536014)(30864003)(6512007)(6916009)(8676002)(478600001)(2906002)(8936002)(4326008)(9686003)(2004002); DIR:OUT; SFP:1101; X-MS-Office365-Filtering-Correlation-Id-Prvs: a779c424-1eaa-4bed-3cec-08d82d894585 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 8LDGx1dUOsZwlyF2trcCskC8xDYjMd5E0/1x/b5uOC7cmVRysqiWRDg/r5nrS7wsNv4qlhifpl4nZVK8Z50KVvTcf1k2okSDLH7HHnXsNfv6NpA23VhbA57lA8kc2o3jIBwE2Z0DIoUsOQ1aLYPQUAnibSZ5/zYAuEhupAE4JBB53IqMpF/5K5SKUYxXF+vt0oxAvVJExUmrB/UARliEQPWRmx6trDef4Pxc1bu3/1sruUk5HGb7/cHcBsnQUOHDQyNwNkQ5wy3aNaxzMITv00blj2+7EkMPQrTKbcPNFqZD3choLT7VaSL+m9q6vb9WoGL/fS61aJHakdDjOQB95bsWDCsMZF3e5S5GJ10YItSHtFQWPdWttP7PgQXsknw/2clW1TR50GZvXeTE7IYFOgAzsC/B4VzfrWoti4LCs6J5zImoqjpNF4DZH0affKy/CoNXqrH5+WQ4aFm3pJQWsLBGT0B/oH3wa3kuIK9aeMkAZZ6FxA74X3jBzyomGjsT X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jul 2020 15:18:16.0262 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: bcab0121-7356-4655-83b7-08d82d894ad5 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-AuthSource: VE1EUR03FT061.eop-EUR03.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB4919 X-Spam-Status: No, score=-16.6 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, GIT_PATCH_0, KAM_LOTSOFHASH, KAM_SHORT, MSGID_FROM_MTA_HEADER, RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2, SPF_HELO_PASS, SPF_PASS, TXREP, UNPARSEABLE_RELAY autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 15:18:22 -0000 --===============0152312779251849756== Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Instructions following RET or BR are not necessarily executed. In order to avoid speculation past RET and BR we can simply append a speculation barrier. Since these speculation barriers will not be architecturally executed, they are not expected to add a high performance penalty. The speculation barrier is to be SB when targeting architectures which have this enabled, and DSB SY + ISB otherwise. We add tests for each of the cases where such an instruction was seen. This is implemented by modifying each machine description pattern that emits either a RET or a BR instruction. We choose not to use something like `TARGET_ASM_FUNCTION_EPILOGUE` since it does not affect the `indirect_jump`, `jump`, `sibcall_insn` and `sibcall_value_insn` patterns and we find it preferable to implement the functionality in the same way for every pattern. There is one particular case which is slightly tricky. The implementation of TARGET_ASM_TRAMPOLINE_TEMPLATE uses a BR which needs to be mitigated against. The trampoline template is used *once* per compilation unit, and the TRAMPOLINE_SIZE is exposed to the user via the builtin macro __LIBGCC_TRAMPOLINE_SIZE__. In the future we may implement function specific attributes to turn on and off hardening on a per-function basis. The fixed nature of the trampoline described above implies it will be safer to ensure this speculation barrier is always used. Testing: Bootstrap and regtest done on aarch64-none-linux Used a temporary hack(1) to use these options on every test in the testsuite and a script to check that the output never emitted an unmitigated RET or BR. 1) Temporary hack was a change to the testsuite to always use `-save-temps` and run a script on the assembly output of those compilations which produced one to ensure every RET or BR is immediately followed by a speculation barrier. gcc/ChangeLog: * config/aarch64/aarch64-protos.h (aarch64_sls_barrier): New. * config/aarch64/aarch64.c (aarch64_output_casesi): Emit speculation barrier after BR instruction if needs be. (aarch64_trampoline_init): Handle ptr_mode value & adjust size of code copied. (aarch64_sls_barrier): New. (aarch64_asm_trampoline_template): Add needed barriers. * config/aarch64/aarch64.h (AARCH64_ISA_SB): New. (TARGET_SB): New. (TRAMPOLINE_SIZE): Account for barrier. * config/aarch64/aarch64.md (indirect_jump, *casesi_dispatch, simple_return, *do_return, *sibcall_insn, *sibcall_value_insn): Emit barrier if needs be, also account for possible barrier using "sls_length" attribute. (sls_length): New attribute. (length): Determine default using any non-default sls_length value. gcc/testsuite/ChangeLog: * gcc.target/aarch64/sls-mitigation/sls-miti-retbr.c: New test. * gcc.target/aarch64/sls-mitigation/sls-miti-retbr-pacret.c: New test. * gcc.target/aarch64/sls-mitigation/sls-mitigation.exp: New file. * lib/target-supports.exp (check_effective_target_aarch64_asm_sb_ok): New proc. (cherry picked from be178ecd5ac1fe1510d960ff95c66d0ff831afe1) ############### Attachment also inlined for ease of reply ############### diff --git a/gcc/config/aarch64/aarch64-protos.h b/gcc/config/aarch64/aarch64-protos.h index db5a6a3a1813abbbeeaaa7009466ac58595e12bc..46196fe648e06f6b7543d8656cd6be6b39f8f774 100644 --- a/gcc/config/aarch64/aarch64-protos.h +++ b/gcc/config/aarch64/aarch64-protos.h @@ -658,6 +658,7 @@ extern const atomic_ool_names aarch64_ool_ldset_names; extern const atomic_ool_names aarch64_ool_ldclr_names; extern const atomic_ool_names aarch64_ool_ldeor_names; +const char *aarch64_sls_barrier (int); extern bool aarch64_harden_sls_retbr_p (void); extern bool aarch64_harden_sls_blr_p (void); diff --git a/gcc/config/aarch64/aarch64.h b/gcc/config/aarch64/aarch64.h index 0e9b79e23f05f34cfee5fdccf5792af077a95798..8dcc9b1cec347104ca3bbcc34a45b30fcf35a886 100644 --- a/gcc/config/aarch64/aarch64.h +++ b/gcc/config/aarch64/aarch64.h @@ -235,6 +235,7 @@ extern unsigned aarch64_architecture_version; #define AARCH64_ISA_F16FML (aarch64_isa_flags & AARCH64_FL_F16FML) #define AARCH64_ISA_RCPC8_4 (aarch64_isa_flags & AARCH64_FL_RCPC8_4) #define AARCH64_ISA_V8_5 (aarch64_isa_flags & AARCH64_FL_V8_5) +#define AARCH64_ISA_SB (aarch64_isa_flags & AARCH64_FL_SB) /* Crypto is an optional extension to AdvSIMD. */ #define TARGET_CRYPTO (TARGET_SIMD && AARCH64_ISA_CRYPTO) @@ -285,6 +286,9 @@ extern unsigned aarch64_architecture_version; #define TARGET_FIX_ERR_A53_835769_DEFAULT 1 #endif +/* SB instruction is enabled through +sb. */ +#define TARGET_SB (AARCH64_ISA_SB) + /* Apply the workaround for Cortex-A53 erratum 835769. */ #define TARGET_FIX_ERR_A53_835769 \ ((aarch64_fix_a53_err835769 == 2) \ @@ -931,8 +935,10 @@ typedef struct #define RETURN_ADDR_RTX aarch64_return_addr -/* BTI c + 3 insns + 2 pointer-sized entries. */ -#define TRAMPOLINE_SIZE (TARGET_ILP32 ? 24 : 32) +/* BTI c + 3 insns + + sls barrier of DSB + ISB. + + 2 pointer-sized entries. */ +#define TRAMPOLINE_SIZE (24 + (TARGET_ILP32 ? 8 : 16)) /* Trampolines contain dwords, so must be dword aligned. */ #define TRAMPOLINE_ALIGNMENT 64 diff --git a/gcc/config/aarch64/aarch64.c b/gcc/config/aarch64/aarch64.c index 0903370b6128e19016f97cb6b0fd44e6b51e569e..13bcc71356eadaddaa66bfd05900abd785693c87 100644 --- a/gcc/config/aarch64/aarch64.c +++ b/gcc/config/aarch64/aarch64.c @@ -8469,8 +8469,8 @@ aarch64_return_addr (int count, rtx frame ATTRIBUTE_UNUSED) static void aarch64_asm_trampoline_template (FILE *f) { - int offset1 = 16; - int offset2 = 20; + int offset1 = 24; + int offset2 = 28; if (aarch64_bti_enabled ()) { @@ -8493,6 +8493,17 @@ aarch64_asm_trampoline_template (FILE *f) } asm_fprintf (f, "\tbr\t%s\n", reg_names [IP1_REGNUM]); + /* We always emit a speculation barrier. + This is because the same trampoline template is used for every nested + function. Since nested functions are not particularly common or + performant we don't worry too much about the extra instructions to copy + around. + This is not yet a problem, since we have not yet implemented function + specific attributes to choose between hardening against straight line + speculation or not, but such function specific attributes are likely to + happen in the future. */ + asm_fprintf (f, "\tdsb\tsy\n\tisb\n"); + /* The trampoline needs an extra padding instruction. In case if BTI is enabled the padding instruction is replaced by the BTI instruction at the beginning. */ @@ -8507,10 +8518,14 @@ static void aarch64_trampoline_init (rtx m_tramp, tree fndecl, rtx chain_value) { rtx fnaddr, mem, a_tramp; - const int tramp_code_sz = 16; + const int tramp_code_sz = 24; /* Don't need to copy the trailing D-words, we fill those in below. */ - emit_block_move (m_tramp, assemble_trampoline_template (), + /* We create our own memory address in Pmode so that `emit_block_move` can + use parts of the backend which expect Pmode addresses. */ + rtx temp = convert_memory_address (Pmode, XEXP (m_tramp, 0)); + emit_block_move (gen_rtx_MEM (BLKmode, temp), + assemble_trampoline_template (), GEN_INT (tramp_code_sz), BLOCK_OP_NORMAL); mem = adjust_address (m_tramp, ptr_mode, tramp_code_sz); fnaddr = XEXP (DECL_RTL (fndecl), 0); @@ -8697,6 +8712,8 @@ aarch64_output_casesi (rtx *operands) output_asm_insn (buf, operands); output_asm_insn (patterns[index][1], operands); output_asm_insn ("br\t%3", operands); + output_asm_insn (aarch64_sls_barrier (aarch64_harden_sls_retbr_p ()), + operands); assemble_label (asm_out_file, label); return ""; } @@ -19111,6 +19128,22 @@ aarch64_file_end_indicate_exec_stack () #undef GNU_PROPERTY_AARCH64_FEATURE_1_BTI #undef GNU_PROPERTY_AARCH64_FEATURE_1_AND +/* Helper function for straight line speculation. + Return what barrier should be emitted for straight line speculation + mitigation. + When not mitigating against straight line speculation this function returns + an empty string. + When mitigating against straight line speculation, use: + * SB when the v8.5-A SB extension is enabled. + * DSB+ISB otherwise. */ +const char * +aarch64_sls_barrier (int mitigation_required) +{ + return mitigation_required + ? (TARGET_SB ? "sb" : "dsb\tsy\n\tisb") + : ""; +} + /* Target-specific selftests. */ #if CHECKING_P diff --git a/gcc/config/aarch64/aarch64.md b/gcc/config/aarch64/aarch64.md index cc5a887d404999adc91ef3fddb8a64686d468ad8..494aee964ff22f934b1b11b7b088f4eabf0cec86 100644 --- a/gcc/config/aarch64/aarch64.md +++ b/gcc/config/aarch64/aarch64.md @@ -331,10 +331,25 @@ ;; Attribute that specifies whether the alternative uses MOVPRFX. (define_attr "movprfx" "no,yes" (const_string "no")) +;; Attribute to specify that an alternative has the length of a single +;; instruction plus a speculation barrier. +(define_attr "sls_length" "none,retbr,casesi" (const_string "none")) + (define_attr "length" "" (cond [(eq_attr "movprfx" "yes") (const_int 8) - ] (const_int 4))) + + (eq_attr "sls_length" "retbr") + (cond [(match_test "!aarch64_harden_sls_retbr_p ()") (const_int 4) + (match_test "TARGET_SB") (const_int 8)] + (const_int 12)) + + (eq_attr "sls_length" "casesi") + (cond [(match_test "!aarch64_harden_sls_retbr_p ()") (const_int 16) + (match_test "TARGET_SB") (const_int 20)] + (const_int 24)) + ] + (const_int 4))) ;; Strictly for compatibility with AArch32 in pipeline models, since AArch64 has ;; no predicated insns. @@ -370,8 +385,12 @@ (define_insn "indirect_jump" [(set (pc) (match_operand:DI 0 "register_operand" "r"))] "" - "br\\t%0" - [(set_attr "type" "branch")] + { + output_asm_insn ("br\\t%0", operands); + return aarch64_sls_barrier (aarch64_harden_sls_retbr_p ()); + } + [(set_attr "type" "branch") + (set_attr "sls_length" "retbr")] ) (define_insn "jump" @@ -657,7 +676,7 @@ "* return aarch64_output_casesi (operands); " - [(set_attr "length" "16") + [(set_attr "sls_length" "casesi") (set_attr "type" "branch")] ) @@ -736,14 +755,18 @@ [(return)] "" { + const char *ret = NULL; if (aarch64_return_address_signing_enabled () && TARGET_ARMV8_3 && !crtl->calls_eh_return) - return "retaa"; - - return "ret"; + ret = "retaa"; + else + ret = "ret"; + output_asm_insn (ret, operands); + return aarch64_sls_barrier (aarch64_harden_sls_retbr_p ()); } - [(set_attr "type" "branch")] + [(set_attr "type" "branch") + (set_attr "sls_length" "retbr")] ) (define_expand "return" @@ -755,8 +778,12 @@ (define_insn "simple_return" [(simple_return)] "aarch64_use_simple_return_insn_p ()" - "ret" - [(set_attr "type" "branch")] + { + output_asm_insn ("ret", operands); + return aarch64_sls_barrier (aarch64_harden_sls_retbr_p ()); + } + [(set_attr "type" "branch") + (set_attr "sls_length" "retbr")] ) (define_insn "*cb1" @@ -947,10 +974,16 @@ (match_operand 1 "" "")) (return)] "SIBLING_CALL_P (insn)" - "@ - br\\t%0 - b\\t%c0" - [(set_attr "type" "branch, branch")] + { + if (which_alternative == 0) + { + output_asm_insn ("br\\t%0", operands); + return aarch64_sls_barrier (aarch64_harden_sls_retbr_p ()); + } + return "b\\t%c0"; + } + [(set_attr "type" "branch, branch") + (set_attr "sls_length" "retbr,none")] ) (define_insn "*sibcall_value_insn" @@ -960,10 +993,16 @@ (match_operand 2 "" ""))) (return)] "SIBLING_CALL_P (insn)" - "@ - br\\t%1 - b\\t%c1" - [(set_attr "type" "branch, branch")] + { + if (which_alternative == 0) + { + output_asm_insn ("br\\t%1", operands); + return aarch64_sls_barrier (aarch64_harden_sls_retbr_p ()); + } + return "b\\t%c1"; + } + [(set_attr "type" "branch, branch") + (set_attr "sls_length" "retbr,none")] ) ;; Call subroutine returning any type. diff --git a/gcc/testsuite/gcc.target/aarch64/sls-mitigation/sls-miti-retbr-pacret.c b/gcc/testsuite/gcc.target/aarch64/sls-mitigation/sls-miti-retbr-pacret.c new file mode 100644 index 0000000000000000000000000000000000000000..7656123ee7b1b6ebd8aedbc1ce8316216f6e7de8 --- /dev/null +++ b/gcc/testsuite/gcc.target/aarch64/sls-mitigation/sls-miti-retbr-pacret.c @@ -0,0 +1,15 @@ +/* Avoid ILP32 since pacret is only available for LP64 */ +/* { dg-do compile { target { ! ilp32 } } } */ +/* { dg-additional-options "-mharden-sls=retbr -mbranch-protection=pac-ret -march=armv8.3-a" } */ + +/* Testing the do_return pattern for retaa. */ +long retbr_subcall(void); +long retbr_do_return_retaa(void) +{ + return retbr_subcall()+1; +} + +/* Ensure there are no BR or RET instructions which are not directly followed + by a speculation barrier. */ +/* { dg-final { scan-assembler-not {\t(br|ret|retaa)\tx[0-9][0-9]?\n\t(?!dsb\tsy\n\tisb)} } } */ +/* { dg-final { scan-assembler-not {ret\t} } } */ diff --git a/gcc/testsuite/gcc.target/aarch64/sls-mitigation/sls-miti-retbr.c b/gcc/testsuite/gcc.target/aarch64/sls-mitigation/sls-miti-retbr.c new file mode 100644 index 0000000000000000000000000000000000000000..573b30cdc167b5a7224b67d9d0909b19a5978d20 --- /dev/null +++ b/gcc/testsuite/gcc.target/aarch64/sls-mitigation/sls-miti-retbr.c @@ -0,0 +1,119 @@ +/* We ensure that -Wpedantic is off since it complains about the trampolines + we explicitly want to test. */ +/* { dg-additional-options "-mharden-sls=retbr -Wno-pedantic " } */ +/* + Ensure that the SLS hardening of RET and BR leaves no unprotected RET/BR + instructions. + */ +typedef int (foo) (int, int); +typedef void (bar) (int, int); +struct sls_testclass { + foo *x; + bar *y; + int left; + int right; +}; + +int +retbr_sibcall_value_insn (struct sls_testclass x) +{ + return x.x(x.left, x.right); +} + +void +retbr_sibcall_insn (struct sls_testclass x) +{ + x.y(x.left, x.right); +} + +/* Aim to test two different returns. + One that introduces a tail call in the middle of the function, and one that + has a normal return. */ +int +retbr_multiple_returns (struct sls_testclass x) +{ + int temp; + if (x.left % 10) + return x.x(x.left, 100); + else if (x.right % 20) + { + return x.x(x.left * x.right, 100); + } + temp = x.left % x.right; + temp *= 100; + temp /= 2; + return temp % 3; +} + +void +retbr_multiple_returns_void (struct sls_testclass x) +{ + if (x.left % 10) + { + x.y(x.left, 100); + } + else if (x.right % 20) + { + x.y(x.left * x.right, 100); + } + return; +} + +/* Testing the casesi jump via register. */ +__attribute__ ((optimize ("Os"))) +int +retbr_casesi_dispatch (struct sls_testclass x) +{ + switch (x.left) + { + case -5: + return -2; + case -3: + return -1; + case 0: + return 0; + case 3: + return 1; + case 5: + break; + default: + __builtin_unreachable (); + } + return x.right; +} + +/* Testing the BR in trampolines is mitigated against. */ +void f1 (void *); +void f3 (void *, void (*)(void *)); +void f2 (void *); + +int +retbr_trampolines (void *a, int b) +{ + if (!b) + { + f1 (a); + return 1; + } + if (b) + { + void retbr_tramp_internal (void *c) + { + if (c == a) + f2 (c); + } + f3 (a, retbr_tramp_internal); + } + return 0; +} + +/* Testing the indirect_jump pattern. */ +void +retbr_indirect_jump (int *buf) +{ + __builtin_longjmp(buf, 1); +} + +/* Ensure there are no BR or RET instructions which are not directly followed + by a speculation barrier. */ +/* { dg-final { scan-assembler-not {\t(br|ret|retaa)\tx[0-9][0-9]?\n\t(?!dsb\tsy\n\tisb|sb)} } } */ diff --git a/gcc/testsuite/gcc.target/aarch64/sls-mitigation/sls-mitigation.exp b/gcc/testsuite/gcc.target/aarch64/sls-mitigation/sls-mitigation.exp new file mode 100644 index 0000000000000000000000000000000000000000..812250379f877b3a924667c6e53b06cd7fecca7b --- /dev/null +++ b/gcc/testsuite/gcc.target/aarch64/sls-mitigation/sls-mitigation.exp @@ -0,0 +1,73 @@ +# Regression driver for SLS mitigation on AArch64. +# Copyright (C) 2020 Free Software Foundation, Inc. +# Contributed by ARM Ltd. +# +# This file is part of GCC. +# +# GCC is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3, or (at your option) +# any later version. +# +# GCC is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with GCC; see the file COPYING3. If not see +# . */ + +# Exit immediately if this isn't an AArch64 target. +if {![istarget aarch64*-*-*] } then { + return +} + +# Load support procs. +load_lib gcc-dg.exp +load_lib torture-options.exp + +# If a testcase doesn't have special options, use these. +global DEFAULT_CFLAGS +if ![info exists DEFAULT_CFLAGS] then { + set DEFAULT_CFLAGS " " +} + +# Initialize `dg'. +dg-init +torture-init + +# Use different architectures as well as the normal optimisation options. +# (i.e. use both SB and DSB+ISB barriers). + +set save-dg-do-what-default ${dg-do-what-default} +# Main loop. +# Run with torture tests (i.e. a bunch of different optimisation levels) just +# to increase test coverage. +set dg-do-what-default assemble +gcc-dg-runtest [lsort [glob -nocomplain $srcdir/$subdir/*.\[cCS\]]] \ + "-save-temps" $DEFAULT_CFLAGS + +# Run the same tests but this time with SB extension. +# Since not all supported assemblers will support that extension we decide +# whether to assemble or just compile based on whether the extension is +# supported for the available assembler. + +set templist {} +foreach x $DG_TORTURE_OPTIONS { + lappend templist "$x -march=armv8.3-a+sb " + lappend templist "$x -march=armv8-a+sb " +} +set-torture-options $templist +if { [check_effective_target_aarch64_asm_sb_ok] } { + set dg-do-what-default assemble +} else { + set dg-do-what-default compile +} +gcc-dg-runtest [lsort [glob -nocomplain $srcdir/$subdir/*.\[cCS\]]] \ + "-save-temps" $DEFAULT_CFLAGS +set dg-do-what-default ${save-dg-do-what-default} + +# All done. +torture-finish +dg-finish diff --git a/gcc/testsuite/lib/target-supports.exp b/gcc/testsuite/lib/target-supports.exp index ea9a50ccb27bc03195d10eaf088ca215fd855135..79482f9b69cbe2e1f3d6abc2266e1d2d3d533342 100644 --- a/gcc/testsuite/lib/target-supports.exp +++ b/gcc/testsuite/lib/target-supports.exp @@ -8579,7 +8579,8 @@ proc check_effective_target_aarch64_tiny { } { # Create functions to check that the AArch64 assembler supports the # various architecture extensions via the .arch_extension pseudo-op. -foreach { aarch64_ext } { "fp" "simd" "crypto" "crc" "lse" "dotprod" "sve"} { +foreach { aarch64_ext } { "fp" "simd" "crypto" "crc" "lse" "dotprod" "sve" + "sb"} { eval [string map [list FUNC $aarch64_ext] { proc check_effective_target_aarch64_asm_FUNC_ok { } { if { [istarget aarch64*-*-*] } { --===============0152312779251849756== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="sls-backport-gcc91.patch" ZGlmZiAtLWdpdCBhL2djYy9jb25maWcvYWFyY2g2NC9hYXJjaDY0LXByb3Rvcy5oIGIvZ2NjL2Nv bmZpZy9hYXJjaDY0L2FhcmNoNjQtcHJvdG9zLmgKaW5kZXggZGI1YTZhM2ExODEzYWJiYmVlYWFh NzAwOTQ2NmFjNTg1OTVlMTJiYy4uNDYxOTZmZTY0OGUwNmY2Yjc1NDNkODY1NmNkNmJlNmIzOWY4 Zjc3NCAxMDA2NDQKLS0tIGEvZ2NjL2NvbmZpZy9hYXJjaDY0L2FhcmNoNjQtcHJvdG9zLmgKKysr IGIvZ2NjL2NvbmZpZy9hYXJjaDY0L2FhcmNoNjQtcHJvdG9zLmgKQEAgLTY1OCw2ICs2NTgsNyBA QCBleHRlcm4gY29uc3QgYXRvbWljX29vbF9uYW1lcyBhYXJjaDY0X29vbF9sZHNldF9uYW1lczsK IGV4dGVybiBjb25zdCBhdG9taWNfb29sX25hbWVzIGFhcmNoNjRfb29sX2xkY2xyX25hbWVzOwog ZXh0ZXJuIGNvbnN0IGF0b21pY19vb2xfbmFtZXMgYWFyY2g2NF9vb2xfbGRlb3JfbmFtZXM7CiAK K2NvbnN0IGNoYXIgKmFhcmNoNjRfc2xzX2JhcnJpZXIgKGludCk7CiBleHRlcm4gYm9vbCBhYXJj aDY0X2hhcmRlbl9zbHNfcmV0YnJfcCAodm9pZCk7CiBleHRlcm4gYm9vbCBhYXJjaDY0X2hhcmRl bl9zbHNfYmxyX3AgKHZvaWQpOwogCmRpZmYgLS1naXQgYS9nY2MvY29uZmlnL2FhcmNoNjQvYWFy Y2g2NC5oIGIvZ2NjL2NvbmZpZy9hYXJjaDY0L2FhcmNoNjQuaAppbmRleCAwZTliNzllMjNmMDVm MzRjZmVlNWZkY2NmNTc5MmFmMDc3YTk1Nzk4Li44ZGNjOWIxY2VjMzQ3MTA0Y2EzYmJjYzM0YTQ1 YjMwZmNmMzVhODg2IDEwMDY0NAotLS0gYS9nY2MvY29uZmlnL2FhcmNoNjQvYWFyY2g2NC5oCisr KyBiL2djYy9jb25maWcvYWFyY2g2NC9hYXJjaDY0LmgKQEAgLTIzNSw2ICsyMzUsNyBAQCBleHRl cm4gdW5zaWduZWQgYWFyY2g2NF9hcmNoaXRlY3R1cmVfdmVyc2lvbjsKICNkZWZpbmUgQUFSQ0g2 NF9JU0FfRjE2Rk1MCSAgIChhYXJjaDY0X2lzYV9mbGFncyAmIEFBUkNINjRfRkxfRjE2Rk1MKQog I2RlZmluZSBBQVJDSDY0X0lTQV9SQ1BDOF80CSAgIChhYXJjaDY0X2lzYV9mbGFncyAmIEFBUkNI NjRfRkxfUkNQQzhfNCkKICNkZWZpbmUgQUFSQ0g2NF9JU0FfVjhfNQkgICAoYWFyY2g2NF9pc2Ff ZmxhZ3MgJiBBQVJDSDY0X0ZMX1Y4XzUpCisjZGVmaW5lIEFBUkNINjRfSVNBX1NCCQkgICAoYWFy Y2g2NF9pc2FfZmxhZ3MgJiBBQVJDSDY0X0ZMX1NCKQogCiAvKiBDcnlwdG8gaXMgYW4gb3B0aW9u YWwgZXh0ZW5zaW9uIHRvIEFkdlNJTUQuICAqLwogI2RlZmluZSBUQVJHRVRfQ1JZUFRPIChUQVJH RVRfU0lNRCAmJiBBQVJDSDY0X0lTQV9DUllQVE8pCkBAIC0yODUsNiArMjg2LDkgQEAgZXh0ZXJu IHVuc2lnbmVkIGFhcmNoNjRfYXJjaGl0ZWN0dXJlX3ZlcnNpb247CiAjZGVmaW5lIFRBUkdFVF9G SVhfRVJSX0E1M184MzU3NjlfREVGQVVMVCAxCiAjZW5kaWYKIAorLyogU0IgaW5zdHJ1Y3Rpb24g aXMgZW5hYmxlZCB0aHJvdWdoICtzYi4gICovCisjZGVmaW5lIFRBUkdFVF9TQiAoQUFSQ0g2NF9J U0FfU0IpCisKIC8qIEFwcGx5IHRoZSB3b3JrYXJvdW5kIGZvciBDb3J0ZXgtQTUzIGVycmF0dW0g ODM1NzY5LiAgKi8KICNkZWZpbmUgVEFSR0VUX0ZJWF9FUlJfQTUzXzgzNTc2OQlcCiAgICgoYWFy Y2g2NF9maXhfYTUzX2VycjgzNTc2OSA9PSAyKQlcCkBAIC05MzEsOCArOTM1LDEwIEBAIHR5cGVk ZWYgc3RydWN0CiAKICNkZWZpbmUgUkVUVVJOX0FERFJfUlRYIGFhcmNoNjRfcmV0dXJuX2FkZHIK IAotLyogQlRJIGMgKyAzIGluc25zICsgMiBwb2ludGVyLXNpemVkIGVudHJpZXMuICAqLwotI2Rl ZmluZSBUUkFNUE9MSU5FX1NJWkUJKFRBUkdFVF9JTFAzMiA/IDI0IDogMzIpCisvKiBCVEkgYyAr IDMgaW5zbnMKKyAgICsgc2xzIGJhcnJpZXIgb2YgRFNCICsgSVNCLgorICAgKyAyIHBvaW50ZXIt c2l6ZWQgZW50cmllcy4gICovCisjZGVmaW5lIFRSQU1QT0xJTkVfU0laRQkoMjQgKyAoVEFSR0VU X0lMUDMyID8gOCA6IDE2KSkKIAogLyogVHJhbXBvbGluZXMgY29udGFpbiBkd29yZHMsIHNvIG11 c3QgYmUgZHdvcmQgYWxpZ25lZC4gICovCiAjZGVmaW5lIFRSQU1QT0xJTkVfQUxJR05NRU5UIDY0 CmRpZmYgLS1naXQgYS9nY2MvY29uZmlnL2FhcmNoNjQvYWFyY2g2NC5jIGIvZ2NjL2NvbmZpZy9h YXJjaDY0L2FhcmNoNjQuYwppbmRleCAwOTAzMzcwYjYxMjhlMTkwMTZmOTdjYjZiMGZkNDRlNmI1 MWU1NjllLi4xM2JjYzcxMzU2ZWFkYWRkYWE2NmJmZDA1OTAwYWJkNzg1NjkzYzg3IDEwMDY0NAot LS0gYS9nY2MvY29uZmlnL2FhcmNoNjQvYWFyY2g2NC5jCisrKyBiL2djYy9jb25maWcvYWFyY2g2 NC9hYXJjaDY0LmMKQEAgLTg0NjksOCArODQ2OSw4IEBAIGFhcmNoNjRfcmV0dXJuX2FkZHIgKGlu dCBjb3VudCwgcnR4IGZyYW1lIEFUVFJJQlVURV9VTlVTRUQpCiBzdGF0aWMgdm9pZAogYWFyY2g2 NF9hc21fdHJhbXBvbGluZV90ZW1wbGF0ZSAoRklMRSAqZikKIHsKLSAgaW50IG9mZnNldDEgPSAx NjsKLSAgaW50IG9mZnNldDIgPSAyMDsKKyAgaW50IG9mZnNldDEgPSAyNDsKKyAgaW50IG9mZnNl dDIgPSAyODsKIAogICBpZiAoYWFyY2g2NF9idGlfZW5hYmxlZCAoKSkKICAgICB7CkBAIC04NDkz LDYgKzg0OTMsMTcgQEAgYWFyY2g2NF9hc21fdHJhbXBvbGluZV90ZW1wbGF0ZSAoRklMRSAqZikK ICAgICB9CiAgIGFzbV9mcHJpbnRmIChmLCAiXHRiclx0JXNcbiIsIHJlZ19uYW1lcyBbSVAxX1JF R05VTV0pOwogCisgIC8qIFdlIGFsd2F5cyBlbWl0IGEgc3BlY3VsYXRpb24gYmFycmllci4KKyAg ICAgVGhpcyBpcyBiZWNhdXNlIHRoZSBzYW1lIHRyYW1wb2xpbmUgdGVtcGxhdGUgaXMgdXNlZCBm b3IgZXZlcnkgbmVzdGVkCisgICAgIGZ1bmN0aW9uLiAgU2luY2UgbmVzdGVkIGZ1bmN0aW9ucyBh cmUgbm90IHBhcnRpY3VsYXJseSBjb21tb24gb3IKKyAgICAgcGVyZm9ybWFudCB3ZSBkb24ndCB3 b3JyeSB0b28gbXVjaCBhYm91dCB0aGUgZXh0cmEgaW5zdHJ1Y3Rpb25zIHRvIGNvcHkKKyAgICAg YXJvdW5kLgorICAgICBUaGlzIGlzIG5vdCB5ZXQgYSBwcm9ibGVtLCBzaW5jZSB3ZSBoYXZlIG5v dCB5ZXQgaW1wbGVtZW50ZWQgZnVuY3Rpb24KKyAgICAgc3BlY2lmaWMgYXR0cmlidXRlcyB0byBj aG9vc2UgYmV0d2VlbiBoYXJkZW5pbmcgYWdhaW5zdCBzdHJhaWdodCBsaW5lCisgICAgIHNwZWN1 bGF0aW9uIG9yIG5vdCwgYnV0IHN1Y2ggZnVuY3Rpb24gc3BlY2lmaWMgYXR0cmlidXRlcyBhcmUg bGlrZWx5IHRvCisgICAgIGhhcHBlbiBpbiB0aGUgZnV0dXJlLiAgKi8KKyAgYXNtX2ZwcmludGYg KGYsICJcdGRzYlx0c3lcblx0aXNiXG4iKTsKKwogICAvKiBUaGUgdHJhbXBvbGluZSBuZWVkcyBh biBleHRyYSBwYWRkaW5nIGluc3RydWN0aW9uLiAgSW4gY2FzZSBpZiBCVEkgaXMKICAgICAgZW5h YmxlZCB0aGUgcGFkZGluZyBpbnN0cnVjdGlvbiBpcyByZXBsYWNlZCBieSB0aGUgQlRJIGluc3Ry dWN0aW9uIGF0CiAgICAgIHRoZSBiZWdpbm5pbmcuICAqLwpAQCAtODUwNywxMCArODUxOCwxNCBA QCBzdGF0aWMgdm9pZAogYWFyY2g2NF90cmFtcG9saW5lX2luaXQgKHJ0eCBtX3RyYW1wLCB0cmVl IGZuZGVjbCwgcnR4IGNoYWluX3ZhbHVlKQogewogICBydHggZm5hZGRyLCBtZW0sIGFfdHJhbXA7 Ci0gIGNvbnN0IGludCB0cmFtcF9jb2RlX3N6ID0gMTY7CisgIGNvbnN0IGludCB0cmFtcF9jb2Rl X3N6ID0gMjQ7CiAKICAgLyogRG9uJ3QgbmVlZCB0byBjb3B5IHRoZSB0cmFpbGluZyBELXdvcmRz LCB3ZSBmaWxsIHRob3NlIGluIGJlbG93LiAgKi8KLSAgZW1pdF9ibG9ja19tb3ZlIChtX3RyYW1w LCBhc3NlbWJsZV90cmFtcG9saW5lX3RlbXBsYXRlICgpLAorICAvKiBXZSBjcmVhdGUgb3VyIG93 biBtZW1vcnkgYWRkcmVzcyBpbiBQbW9kZSBzbyB0aGF0IGBlbWl0X2Jsb2NrX21vdmVgIGNhbgor ICAgICB1c2UgcGFydHMgb2YgdGhlIGJhY2tlbmQgd2hpY2ggZXhwZWN0IFBtb2RlIGFkZHJlc3Nl cy4gICovCisgIHJ0eCB0ZW1wID0gY29udmVydF9tZW1vcnlfYWRkcmVzcyAoUG1vZGUsIFhFWFAg KG1fdHJhbXAsIDApKTsKKyAgZW1pdF9ibG9ja19tb3ZlIChnZW5fcnR4X01FTSAoQkxLbW9kZSwg dGVtcCksCisJCSAgIGFzc2VtYmxlX3RyYW1wb2xpbmVfdGVtcGxhdGUgKCksCiAJCSAgIEdFTl9J TlQgKHRyYW1wX2NvZGVfc3opLCBCTE9DS19PUF9OT1JNQUwpOwogICBtZW0gPSBhZGp1c3RfYWRk cmVzcyAobV90cmFtcCwgcHRyX21vZGUsIHRyYW1wX2NvZGVfc3opOwogICBmbmFkZHIgPSBYRVhQ IChERUNMX1JUTCAoZm5kZWNsKSwgMCk7CkBAIC04Njk3LDYgKzg3MTIsOCBAQCBhYXJjaDY0X291 dHB1dF9jYXNlc2kgKHJ0eCAqb3BlcmFuZHMpCiAgIG91dHB1dF9hc21faW5zbiAoYnVmLCBvcGVy YW5kcyk7CiAgIG91dHB1dF9hc21faW5zbiAocGF0dGVybnNbaW5kZXhdWzFdLCBvcGVyYW5kcyk7 CiAgIG91dHB1dF9hc21faW5zbiAoImJyXHQlMyIsIG9wZXJhbmRzKTsKKyAgb3V0cHV0X2FzbV9p bnNuIChhYXJjaDY0X3Nsc19iYXJyaWVyIChhYXJjaDY0X2hhcmRlbl9zbHNfcmV0YnJfcCAoKSks CisJCSAgIG9wZXJhbmRzKTsKICAgYXNzZW1ibGVfbGFiZWwgKGFzbV9vdXRfZmlsZSwgbGFiZWwp OwogICByZXR1cm4gIiI7CiB9CkBAIC0xOTExMSw2ICsxOTEyOCwyMiBAQCBhYXJjaDY0X2ZpbGVf ZW5kX2luZGljYXRlX2V4ZWNfc3RhY2sgKCkKICN1bmRlZiBHTlVfUFJPUEVSVFlfQUFSQ0g2NF9G RUFUVVJFXzFfQlRJCiAjdW5kZWYgR05VX1BST1BFUlRZX0FBUkNINjRfRkVBVFVSRV8xX0FORAog CisvKiBIZWxwZXIgZnVuY3Rpb24gZm9yIHN0cmFpZ2h0IGxpbmUgc3BlY3VsYXRpb24uCisgICBS ZXR1cm4gd2hhdCBiYXJyaWVyIHNob3VsZCBiZSBlbWl0dGVkIGZvciBzdHJhaWdodCBsaW5lIHNw ZWN1bGF0aW9uCisgICBtaXRpZ2F0aW9uLgorICAgV2hlbiBub3QgbWl0aWdhdGluZyBhZ2FpbnN0 IHN0cmFpZ2h0IGxpbmUgc3BlY3VsYXRpb24gdGhpcyBmdW5jdGlvbiByZXR1cm5zCisgICBhbiBl bXB0eSBzdHJpbmcuCisgICBXaGVuIG1pdGlnYXRpbmcgYWdhaW5zdCBzdHJhaWdodCBsaW5lIHNw ZWN1bGF0aW9uLCB1c2U6CisgICAqIFNCIHdoZW4gdGhlIHY4LjUtQSBTQiBleHRlbnNpb24gaXMg ZW5hYmxlZC4KKyAgICogRFNCK0lTQiBvdGhlcndpc2UuICAqLworY29uc3QgY2hhciAqCithYXJj aDY0X3Nsc19iYXJyaWVyIChpbnQgbWl0aWdhdGlvbl9yZXF1aXJlZCkKK3sKKyAgcmV0dXJuIG1p dGlnYXRpb25fcmVxdWlyZWQKKyAgICA/IChUQVJHRVRfU0IgPyAic2IiIDogImRzYlx0c3lcblx0 aXNiIikKKyAgICA6ICIiOworfQorCiAvKiBUYXJnZXQtc3BlY2lmaWMgc2VsZnRlc3RzLiAgKi8K IAogI2lmIENIRUNLSU5HX1AKZGlmZiAtLWdpdCBhL2djYy9jb25maWcvYWFyY2g2NC9hYXJjaDY0 Lm1kIGIvZ2NjL2NvbmZpZy9hYXJjaDY0L2FhcmNoNjQubWQKaW5kZXggY2M1YTg4N2Q0MDQ5OTlh ZGM5MWVmM2ZkZGI4YTY0Njg2ZDQ2OGFkOC4uNDk0YWVlOTY0ZmYyMmY5MzRiMWIxMWI3YjA4OGY0 ZWFiZjBjZWM4NiAxMDA2NDQKLS0tIGEvZ2NjL2NvbmZpZy9hYXJjaDY0L2FhcmNoNjQubWQKKysr IGIvZ2NjL2NvbmZpZy9hYXJjaDY0L2FhcmNoNjQubWQKQEAgLTMzMSwxMCArMzMxLDI1IEBACiA7 OyBBdHRyaWJ1dGUgdGhhdCBzcGVjaWZpZXMgd2hldGhlciB0aGUgYWx0ZXJuYXRpdmUgdXNlcyBN T1ZQUkZYLgogKGRlZmluZV9hdHRyICJtb3ZwcmZ4IiAibm8seWVzIiAoY29uc3Rfc3RyaW5nICJu byIpKQogCis7OyBBdHRyaWJ1dGUgdG8gc3BlY2lmeSB0aGF0IGFuIGFsdGVybmF0aXZlIGhhcyB0 aGUgbGVuZ3RoIG9mIGEgc2luZ2xlCis7OyBpbnN0cnVjdGlvbiBwbHVzIGEgc3BlY3VsYXRpb24g YmFycmllci4KKyhkZWZpbmVfYXR0ciAic2xzX2xlbmd0aCIgIm5vbmUscmV0YnIsY2FzZXNpIiAo Y29uc3Rfc3RyaW5nICJub25lIikpCisKIChkZWZpbmVfYXR0ciAibGVuZ3RoIiAiIgogICAoY29u ZCBbKGVxX2F0dHIgIm1vdnByZngiICJ5ZXMiKQogICAgICAgICAgICAoY29uc3RfaW50IDgpCi0g ICAgICAgIF0gKGNvbnN0X2ludCA0KSkpCisKKwkgKGVxX2F0dHIgInNsc19sZW5ndGgiICJyZXRi ciIpCisJICAgKGNvbmQgWyhtYXRjaF90ZXN0ICIhYWFyY2g2NF9oYXJkZW5fc2xzX3JldGJyX3Ag KCkiKSAoY29uc3RfaW50IDQpCisJCSAgKG1hdGNoX3Rlc3QgIlRBUkdFVF9TQiIpIChjb25zdF9p bnQgOCldCisJCSAoY29uc3RfaW50IDEyKSkKKworCSAoZXFfYXR0ciAic2xzX2xlbmd0aCIgImNh c2VzaSIpCisJICAgKGNvbmQgWyhtYXRjaF90ZXN0ICIhYWFyY2g2NF9oYXJkZW5fc2xzX3JldGJy X3AgKCkiKSAoY29uc3RfaW50IDE2KQorCQkgIChtYXRjaF90ZXN0ICJUQVJHRVRfU0IiKSAoY29u c3RfaW50IDIwKV0KKwkJIChjb25zdF9pbnQgMjQpKQorCV0KKwkgIChjb25zdF9pbnQgNCkpKQog CiA7OyBTdHJpY3RseSBmb3IgY29tcGF0aWJpbGl0eSB3aXRoIEFBcmNoMzIgaW4gcGlwZWxpbmUg bW9kZWxzLCBzaW5jZSBBQXJjaDY0IGhhcwogOzsgbm8gcHJlZGljYXRlZCBpbnNucy4KQEAgLTM3 MCw4ICszODUsMTIgQEAKIChkZWZpbmVfaW5zbiAiaW5kaXJlY3RfanVtcCIKICAgWyhzZXQgKHBj KSAobWF0Y2hfb3BlcmFuZDpESSAwICJyZWdpc3Rlcl9vcGVyYW5kIiAiciIpKV0KICAgIiIKLSAg ImJyXFx0JTAiCi0gIFsoc2V0X2F0dHIgInR5cGUiICJicmFuY2giKV0KKyAgeworICAgIG91dHB1 dF9hc21faW5zbiAoImJyXFx0JTAiLCBvcGVyYW5kcyk7CisgICAgcmV0dXJuIGFhcmNoNjRfc2xz X2JhcnJpZXIgKGFhcmNoNjRfaGFyZGVuX3Nsc19yZXRicl9wICgpKTsKKyAgfQorICBbKHNldF9h dHRyICJ0eXBlIiAiYnJhbmNoIikKKyAgIChzZXRfYXR0ciAic2xzX2xlbmd0aCIgInJldGJyIild CiApCiAKIChkZWZpbmVfaW5zbiAianVtcCIKQEAgLTY1Nyw3ICs2NzYsNyBAQAogICAiKgogICBy ZXR1cm4gYWFyY2g2NF9vdXRwdXRfY2FzZXNpIChvcGVyYW5kcyk7CiAgICIKLSAgWyhzZXRfYXR0 ciAibGVuZ3RoIiAiMTYiKQorICBbKHNldF9hdHRyICJzbHNfbGVuZ3RoIiAiY2FzZXNpIikKICAg IChzZXRfYXR0ciAidHlwZSIgImJyYW5jaCIpXQogKQogCkBAIC03MzYsMTQgKzc1NSwxOCBAQAog ICBbKHJldHVybildCiAgICIiCiAgIHsKKyAgICBjb25zdCBjaGFyICpyZXQgPSBOVUxMOwogICAg IGlmIChhYXJjaDY0X3JldHVybl9hZGRyZXNzX3NpZ25pbmdfZW5hYmxlZCAoKQogCSYmIFRBUkdF VF9BUk1WOF8zCiAJJiYgIWNydGwtPmNhbGxzX2VoX3JldHVybikKLSAgICAgIHJldHVybiAicmV0 YWEiOwotCi0gICAgcmV0dXJuICJyZXQiOworICAgICAgcmV0ID0gInJldGFhIjsKKyAgICBlbHNl CisgICAgICByZXQgPSAicmV0IjsKKyAgICBvdXRwdXRfYXNtX2luc24gKHJldCwgb3BlcmFuZHMp OworICAgIHJldHVybiBhYXJjaDY0X3Nsc19iYXJyaWVyIChhYXJjaDY0X2hhcmRlbl9zbHNfcmV0 YnJfcCAoKSk7CiAgIH0KLSAgWyhzZXRfYXR0ciAidHlwZSIgImJyYW5jaCIpXQorICBbKHNldF9h dHRyICJ0eXBlIiAiYnJhbmNoIikKKyAgIChzZXRfYXR0ciAic2xzX2xlbmd0aCIgInJldGJyIild CiApCiAKIChkZWZpbmVfZXhwYW5kICJyZXR1cm4iCkBAIC03NTUsOCArNzc4LDEyIEBACiAoZGVm aW5lX2luc24gInNpbXBsZV9yZXR1cm4iCiAgIFsoc2ltcGxlX3JldHVybildCiAgICJhYXJjaDY0 X3VzZV9zaW1wbGVfcmV0dXJuX2luc25fcCAoKSIKLSAgInJldCIKLSAgWyhzZXRfYXR0ciAidHlw ZSIgImJyYW5jaCIpXQorICB7CisgICAgb3V0cHV0X2FzbV9pbnNuICgicmV0Iiwgb3BlcmFuZHMp OworICAgIHJldHVybiBhYXJjaDY0X3Nsc19iYXJyaWVyIChhYXJjaDY0X2hhcmRlbl9zbHNfcmV0 YnJfcCAoKSk7CisgIH0KKyAgWyhzZXRfYXR0ciAidHlwZSIgImJyYW5jaCIpCisgICAoc2V0X2F0 dHIgInNsc19sZW5ndGgiICJyZXRiciIpXQogKQogCiAoZGVmaW5lX2luc24gIipjYjxvcHRhYj48 bW9kZT4xIgpAQCAtOTQ3LDEwICs5NzQsMTYgQEAKIAkgKG1hdGNoX29wZXJhbmQgMSAiIiAiIikp CiAgICAocmV0dXJuKV0KICAgIlNJQkxJTkdfQ0FMTF9QIChpbnNuKSIKLSAgIkAKLSAgIGJyXFx0 JTAKLSAgIGJcXHQlYzAiCi0gIFsoc2V0X2F0dHIgInR5cGUiICJicmFuY2gsIGJyYW5jaCIpXQor ICB7CisgICAgaWYgKHdoaWNoX2FsdGVybmF0aXZlID09IDApCisgICAgICB7CisJb3V0cHV0X2Fz bV9pbnNuICgiYnJcXHQlMCIsIG9wZXJhbmRzKTsKKwlyZXR1cm4gYWFyY2g2NF9zbHNfYmFycmll ciAoYWFyY2g2NF9oYXJkZW5fc2xzX3JldGJyX3AgKCkpOworICAgICAgfQorICAgIHJldHVybiAi YlxcdCVjMCI7CisgIH0KKyAgWyhzZXRfYXR0ciAidHlwZSIgImJyYW5jaCwgYnJhbmNoIikKKyAg IChzZXRfYXR0ciAic2xzX2xlbmd0aCIgInJldGJyLG5vbmUiKV0KICkKIAogKGRlZmluZV9pbnNu ICIqc2liY2FsbF92YWx1ZV9pbnNuIgpAQCAtOTYwLDEwICs5OTMsMTYgQEAKIAkgICAgICAobWF0 Y2hfb3BlcmFuZCAyICIiICIiKSkpCiAgICAocmV0dXJuKV0KICAgIlNJQkxJTkdfQ0FMTF9QIChp bnNuKSIKLSAgIkAKLSAgIGJyXFx0JTEKLSAgIGJcXHQlYzEiCi0gIFsoc2V0X2F0dHIgInR5cGUi ICJicmFuY2gsIGJyYW5jaCIpXQorICB7CisgICAgaWYgKHdoaWNoX2FsdGVybmF0aXZlID09IDAp CisgICAgICB7CisJb3V0cHV0X2FzbV9pbnNuICgiYnJcXHQlMSIsIG9wZXJhbmRzKTsKKwlyZXR1 cm4gYWFyY2g2NF9zbHNfYmFycmllciAoYWFyY2g2NF9oYXJkZW5fc2xzX3JldGJyX3AgKCkpOwor ICAgICAgfQorICAgIHJldHVybiAiYlxcdCVjMSI7CisgIH0KKyAgWyhzZXRfYXR0ciAidHlwZSIg ImJyYW5jaCwgYnJhbmNoIikKKyAgIChzZXRfYXR0ciAic2xzX2xlbmd0aCIgInJldGJyLG5vbmUi KV0KICkKIAogOzsgQ2FsbCBzdWJyb3V0aW5lIHJldHVybmluZyBhbnkgdHlwZS4KZGlmZiAtLWdp dCBhL2djYy90ZXN0c3VpdGUvZ2NjLnRhcmdldC9hYXJjaDY0L3Nscy1taXRpZ2F0aW9uL3Nscy1t aXRpLXJldGJyLXBhY3JldC5jIGIvZ2NjL3Rlc3RzdWl0ZS9nY2MudGFyZ2V0L2FhcmNoNjQvc2xz LW1pdGlnYXRpb24vc2xzLW1pdGktcmV0YnItcGFjcmV0LmMKbmV3IGZpbGUgbW9kZSAxMDA2NDQK aW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uNzY1NjEyM2Vl N2IxYjZlYmQ4YWVkYmMxY2U4MzE2MjE2ZjZlN2RlOAotLS0gL2Rldi9udWxsCisrKyBiL2djYy90 ZXN0c3VpdGUvZ2NjLnRhcmdldC9hYXJjaDY0L3Nscy1taXRpZ2F0aW9uL3Nscy1taXRpLXJldGJy LXBhY3JldC5jCkBAIC0wLDAgKzEsMTUgQEAKKy8qIEF2b2lkIElMUDMyIHNpbmNlIHBhY3JldCBp cyBvbmx5IGF2YWlsYWJsZSBmb3IgTFA2NCAqLworLyogeyBkZy1kbyBjb21waWxlIHsgdGFyZ2V0 IHsgISBpbHAzMiB9IH0gfSAqLworLyogeyBkZy1hZGRpdGlvbmFsLW9wdGlvbnMgIi1taGFyZGVu LXNscz1yZXRiciAtbWJyYW5jaC1wcm90ZWN0aW9uPXBhYy1yZXQgLW1hcmNoPWFybXY4LjMtYSIg fSAqLworCisvKiBUZXN0aW5nIHRoZSBkb19yZXR1cm4gcGF0dGVybiBmb3IgcmV0YWEuICAqLwor bG9uZyByZXRicl9zdWJjYWxsKHZvaWQpOworbG9uZyByZXRicl9kb19yZXR1cm5fcmV0YWEodm9p ZCkKK3sKKyAgICByZXR1cm4gcmV0YnJfc3ViY2FsbCgpKzE7Cit9CisKKy8qIEVuc3VyZSB0aGVy ZSBhcmUgbm8gQlIgb3IgUkVUIGluc3RydWN0aW9ucyB3aGljaCBhcmUgbm90IGRpcmVjdGx5IGZv bGxvd2VkCisgICBieSBhIHNwZWN1bGF0aW9uIGJhcnJpZXIuICAqLworLyogeyBkZy1maW5hbCB7 IHNjYW4tYXNzZW1ibGVyLW5vdCB7XHQoYnJ8cmV0fHJldGFhKVx0eFswLTldWzAtOV0/XG5cdCg/ IWRzYlx0c3lcblx0aXNiKX0gfSB9ICovCisvKiB7IGRnLWZpbmFsIHsgc2Nhbi1hc3NlbWJsZXIt bm90IHtyZXRcdH0gfSB9ICovCmRpZmYgLS1naXQgYS9nY2MvdGVzdHN1aXRlL2djYy50YXJnZXQv YWFyY2g2NC9zbHMtbWl0aWdhdGlvbi9zbHMtbWl0aS1yZXRici5jIGIvZ2NjL3Rlc3RzdWl0ZS9n Y2MudGFyZ2V0L2FhcmNoNjQvc2xzLW1pdGlnYXRpb24vc2xzLW1pdGktcmV0YnIuYwpuZXcgZmls ZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwLi41NzNiMzBjZGMxNjdiNWE3MjI0YjY3ZDlkMDkwOWIxOWE1OTc4ZDIwCi0tLSAvZGV2L251 bGwKKysrIGIvZ2NjL3Rlc3RzdWl0ZS9nY2MudGFyZ2V0L2FhcmNoNjQvc2xzLW1pdGlnYXRpb24v c2xzLW1pdGktcmV0YnIuYwpAQCAtMCwwICsxLDExOSBAQAorLyogV2UgZW5zdXJlIHRoYXQgLVdw ZWRhbnRpYyBpcyBvZmYgc2luY2UgaXQgY29tcGxhaW5zIGFib3V0IHRoZSB0cmFtcG9saW5lcwor ICAgd2UgZXhwbGljaXRseSB3YW50IHRvIHRlc3QuICAqLworLyogeyBkZy1hZGRpdGlvbmFsLW9w dGlvbnMgIi1taGFyZGVuLXNscz1yZXRiciAtV25vLXBlZGFudGljICIgfSAqLworLyoKKyAgIEVu c3VyZSB0aGF0IHRoZSBTTFMgaGFyZGVuaW5nIG9mIFJFVCBhbmQgQlIgbGVhdmVzIG5vIHVucHJv dGVjdGVkIFJFVC9CUgorICAgaW5zdHJ1Y3Rpb25zLgorICAqLwordHlwZWRlZiBpbnQgKGZvbykg KGludCwgaW50KTsKK3R5cGVkZWYgdm9pZCAoYmFyKSAoaW50LCBpbnQpOworc3RydWN0IHNsc190 ZXN0Y2xhc3MgeworICAgIGZvbyAqeDsKKyAgICBiYXIgKnk7CisgICAgaW50IGxlZnQ7CisgICAg aW50IHJpZ2h0OworfTsKKworaW50CityZXRicl9zaWJjYWxsX3ZhbHVlX2luc24gKHN0cnVjdCBz bHNfdGVzdGNsYXNzIHgpCit7CisgIHJldHVybiB4LngoeC5sZWZ0LCB4LnJpZ2h0KTsKK30KKwor dm9pZAorcmV0YnJfc2liY2FsbF9pbnNuIChzdHJ1Y3Qgc2xzX3Rlc3RjbGFzcyB4KQoreworICB4 LnkoeC5sZWZ0LCB4LnJpZ2h0KTsKK30KKworLyogQWltIHRvIHRlc3QgdHdvIGRpZmZlcmVudCBy ZXR1cm5zLgorICAgT25lIHRoYXQgaW50cm9kdWNlcyBhIHRhaWwgY2FsbCBpbiB0aGUgbWlkZGxl IG9mIHRoZSBmdW5jdGlvbiwgYW5kIG9uZSB0aGF0CisgICBoYXMgYSBub3JtYWwgcmV0dXJuLiAg Ki8KK2ludAorcmV0YnJfbXVsdGlwbGVfcmV0dXJucyAoc3RydWN0IHNsc190ZXN0Y2xhc3MgeCkK K3sKKyAgaW50IHRlbXA7CisgIGlmICh4LmxlZnQgJSAxMCkKKyAgICByZXR1cm4geC54KHgubGVm dCwgMTAwKTsKKyAgZWxzZSBpZiAoeC5yaWdodCAlIDIwKQorICAgIHsKKyAgICAgIHJldHVybiB4 LngoeC5sZWZ0ICogeC5yaWdodCwgMTAwKTsKKyAgICB9CisgIHRlbXAgPSB4LmxlZnQgJSB4LnJp Z2h0OworICB0ZW1wICo9IDEwMDsKKyAgdGVtcCAvPSAyOworICByZXR1cm4gdGVtcCAlIDM7Cit9 CisKK3ZvaWQKK3JldGJyX211bHRpcGxlX3JldHVybnNfdm9pZCAoc3RydWN0IHNsc190ZXN0Y2xh c3MgeCkKK3sKKyAgaWYgKHgubGVmdCAlIDEwKQorICAgIHsKKyAgICAgIHgueSh4LmxlZnQsIDEw MCk7CisgICAgfQorICBlbHNlIGlmICh4LnJpZ2h0ICUgMjApCisgICAgeworICAgICAgeC55KHgu bGVmdCAqIHgucmlnaHQsIDEwMCk7CisgICAgfQorICByZXR1cm47Cit9CisKKy8qIFRlc3Rpbmcg dGhlIGNhc2VzaSBqdW1wIHZpYSByZWdpc3Rlci4gICovCitfX2F0dHJpYnV0ZV9fICgob3B0aW1p emUgKCJPcyIpKSkKK2ludAorcmV0YnJfY2FzZXNpX2Rpc3BhdGNoIChzdHJ1Y3Qgc2xzX3Rlc3Rj bGFzcyB4KQoreworICBzd2l0Y2ggKHgubGVmdCkKKyAgICB7CisgICAgY2FzZSAtNToKKyAgICAg IHJldHVybiAtMjsKKyAgICBjYXNlIC0zOgorICAgICAgcmV0dXJuIC0xOworICAgIGNhc2UgMDoK KyAgICAgIHJldHVybiAwOworICAgIGNhc2UgMzoKKyAgICAgIHJldHVybiAxOworICAgIGNhc2Ug NToKKyAgICAgIGJyZWFrOworICAgIGRlZmF1bHQ6CisgICAgICBfX2J1aWx0aW5fdW5yZWFjaGFi bGUgKCk7CisgICAgfQorICByZXR1cm4geC5yaWdodDsKK30KKworLyogVGVzdGluZyB0aGUgQlIg aW4gdHJhbXBvbGluZXMgaXMgbWl0aWdhdGVkIGFnYWluc3QuICAqLwordm9pZCBmMSAodm9pZCAq KTsKK3ZvaWQgZjMgKHZvaWQgKiwgdm9pZCAoKikodm9pZCAqKSk7Cit2b2lkIGYyICh2b2lkICop OworCitpbnQKK3JldGJyX3RyYW1wb2xpbmVzICh2b2lkICphLCBpbnQgYikKK3sKKyAgaWYgKCFi KQorICAgIHsKKyAgICAgIGYxIChhKTsKKyAgICAgIHJldHVybiAxOworICAgIH0KKyAgaWYgKGIp CisgICAgeworICAgICAgdm9pZCByZXRicl90cmFtcF9pbnRlcm5hbCAodm9pZCAqYykKKyAgICAg IHsKKwlpZiAoYyA9PSBhKQorCSAgZjIgKGMpOworICAgICAgfQorICAgICAgZjMgKGEsIHJldGJy X3RyYW1wX2ludGVybmFsKTsKKyAgICB9CisgIHJldHVybiAwOworfQorCisvKiBUZXN0aW5nIHRo ZSBpbmRpcmVjdF9qdW1wIHBhdHRlcm4uICAqLwordm9pZAorcmV0YnJfaW5kaXJlY3RfanVtcCAo aW50ICpidWYpCit7CisgIF9fYnVpbHRpbl9sb25nam1wKGJ1ZiwgMSk7Cit9CisKKy8qIEVuc3Vy ZSB0aGVyZSBhcmUgbm8gQlIgb3IgUkVUIGluc3RydWN0aW9ucyB3aGljaCBhcmUgbm90IGRpcmVj dGx5IGZvbGxvd2VkCisgICBieSBhIHNwZWN1bGF0aW9uIGJhcnJpZXIuICAqLworLyogeyBkZy1m aW5hbCB7IHNjYW4tYXNzZW1ibGVyLW5vdCB7XHQoYnJ8cmV0fHJldGFhKVx0eFswLTldWzAtOV0/ XG5cdCg/IWRzYlx0c3lcblx0aXNifHNiKX0gfSB9ICovCmRpZmYgLS1naXQgYS9nY2MvdGVzdHN1 aXRlL2djYy50YXJnZXQvYWFyY2g2NC9zbHMtbWl0aWdhdGlvbi9zbHMtbWl0aWdhdGlvbi5leHAg Yi9nY2MvdGVzdHN1aXRlL2djYy50YXJnZXQvYWFyY2g2NC9zbHMtbWl0aWdhdGlvbi9zbHMtbWl0 aWdhdGlvbi5leHAKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uODEyMjUwMzc5Zjg3N2IzYTkyNDY2N2M2ZTUzYjA2Y2Q3 ZmVjY2E3YgotLS0gL2Rldi9udWxsCisrKyBiL2djYy90ZXN0c3VpdGUvZ2NjLnRhcmdldC9hYXJj aDY0L3Nscy1taXRpZ2F0aW9uL3Nscy1taXRpZ2F0aW9uLmV4cApAQCAtMCwwICsxLDczIEBACisj ICBSZWdyZXNzaW9uIGRyaXZlciBmb3IgU0xTIG1pdGlnYXRpb24gb24gQUFyY2g2NC4KKyMgIENv cHlyaWdodCAoQykgMjAyMCBGcmVlIFNvZnR3YXJlIEZvdW5kYXRpb24sIEluYy4KKyMgIENvbnRy aWJ1dGVkIGJ5IEFSTSBMdGQuCisjCisjICBUaGlzIGZpbGUgaXMgcGFydCBvZiBHQ0MuCisjCisj ICBHQ0MgaXMgZnJlZSBzb2Z0d2FyZTsgeW91IGNhbiByZWRpc3RyaWJ1dGUgaXQgYW5kL29yIG1v ZGlmeSBpdAorIyAgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGlj ZW5zZSBhcyBwdWJsaXNoZWQgYnkKKyMgIHRoZSBGcmVlIFNvZnR3YXJlIEZvdW5kYXRpb247IGVp dGhlciB2ZXJzaW9uIDMsIG9yIChhdCB5b3VyIG9wdGlvbikKKyMgIGFueSBsYXRlciB2ZXJzaW9u LgorIworIyAgR0NDIGlzIGRpc3RyaWJ1dGVkIGluIHRoZSBob3BlIHRoYXQgaXQgd2lsbCBiZSB1 c2VmdWwsIGJ1dAorIyAgV0lUSE9VVCBBTlkgV0FSUkFOVFk7IHdpdGhvdXQgZXZlbiB0aGUgaW1w bGllZCB3YXJyYW50eSBvZgorIyAgTUVSQ0hBTlRBQklMSVRZIG9yIEZJVE5FU1MgRk9SIEEgUEFS VElDVUxBUiBQVVJQT1NFLiAgU2VlIHRoZSBHTlUKKyMgIEdlbmVyYWwgUHVibGljIExpY2Vuc2Ug Zm9yIG1vcmUgZGV0YWlscy4KKyMKKyMgIFlvdSBzaG91bGQgaGF2ZSByZWNlaXZlZCBhIGNvcHkg b2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlCisjICBhbG9uZyB3aXRoIEdDQzsgc2Vl IHRoZSBmaWxlIENPUFlJTkczLiAgSWYgbm90IHNlZQorIyAgPGh0dHA6Ly93d3cuZ251Lm9yZy9s aWNlbnNlcy8+LiAgKi8KKworIyBFeGl0IGltbWVkaWF0ZWx5IGlmIHRoaXMgaXNuJ3QgYW4gQUFy Y2g2NCB0YXJnZXQuCitpZiB7IVtpc3RhcmdldCBhYXJjaDY0Ki0qLSpdIH0gdGhlbiB7CisgIHJl dHVybgorfQorCisjIExvYWQgc3VwcG9ydCBwcm9jcy4KK2xvYWRfbGliIGdjYy1kZy5leHAKK2xv YWRfbGliIHRvcnR1cmUtb3B0aW9ucy5leHAKKworIyBJZiBhIHRlc3RjYXNlIGRvZXNuJ3QgaGF2 ZSBzcGVjaWFsIG9wdGlvbnMsIHVzZSB0aGVzZS4KK2dsb2JhbCBERUZBVUxUX0NGTEFHUworaWYg IVtpbmZvIGV4aXN0cyBERUZBVUxUX0NGTEFHU10gdGhlbiB7CisgICAgc2V0IERFRkFVTFRfQ0ZM QUdTICIgIgorfQorCisjIEluaXRpYWxpemUgYGRnJy4KK2RnLWluaXQKK3RvcnR1cmUtaW5pdAor CisjIFVzZSBkaWZmZXJlbnQgYXJjaGl0ZWN0dXJlcyBhcyB3ZWxsIGFzIHRoZSBub3JtYWwgb3B0 aW1pc2F0aW9uIG9wdGlvbnMuCisjIChpLmUuIHVzZSBib3RoIFNCIGFuZCBEU0IrSVNCIGJhcnJp ZXJzKS4KKworc2V0IHNhdmUtZGctZG8td2hhdC1kZWZhdWx0ICR7ZGctZG8td2hhdC1kZWZhdWx0 fQorIyBNYWluIGxvb3AuCisjIFJ1biB3aXRoIHRvcnR1cmUgdGVzdHMgKGkuZS4gYSBidW5jaCBv ZiBkaWZmZXJlbnQgb3B0aW1pc2F0aW9uIGxldmVscykganVzdAorIyB0byBpbmNyZWFzZSB0ZXN0 IGNvdmVyYWdlLgorc2V0IGRnLWRvLXdoYXQtZGVmYXVsdCBhc3NlbWJsZQorZ2NjLWRnLXJ1bnRl c3QgW2xzb3J0IFtnbG9iIC1ub2NvbXBsYWluICRzcmNkaXIvJHN1YmRpci8qLlxbY0NTXF1dXSBc CisJIi1zYXZlLXRlbXBzIiAkREVGQVVMVF9DRkxBR1MKKworIyBSdW4gdGhlIHNhbWUgdGVzdHMg YnV0IHRoaXMgdGltZSB3aXRoIFNCIGV4dGVuc2lvbi4KKyMgU2luY2Ugbm90IGFsbCBzdXBwb3J0 ZWQgYXNzZW1ibGVycyB3aWxsIHN1cHBvcnQgdGhhdCBleHRlbnNpb24gd2UgZGVjaWRlCisjIHdo ZXRoZXIgdG8gYXNzZW1ibGUgb3IganVzdCBjb21waWxlIGJhc2VkIG9uIHdoZXRoZXIgdGhlIGV4 dGVuc2lvbiBpcworIyBzdXBwb3J0ZWQgZm9yIHRoZSBhdmFpbGFibGUgYXNzZW1ibGVyLgorCitz ZXQgdGVtcGxpc3Qge30KK2ZvcmVhY2ggeCAkREdfVE9SVFVSRV9PUFRJT05TIHsKKyAgbGFwcGVu ZCB0ZW1wbGlzdCAiJHggLW1hcmNoPWFybXY4LjMtYStzYiAiCisgIGxhcHBlbmQgdGVtcGxpc3Qg IiR4IC1tYXJjaD1hcm12OC1hK3NiICIKK30KK3NldC10b3J0dXJlLW9wdGlvbnMgJHRlbXBsaXN0 CitpZiB7IFtjaGVja19lZmZlY3RpdmVfdGFyZ2V0X2FhcmNoNjRfYXNtX3NiX29rXSB9IHsKKyAg ICBzZXQgZGctZG8td2hhdC1kZWZhdWx0IGFzc2VtYmxlCit9IGVsc2UgeworICAgIHNldCBkZy1k by13aGF0LWRlZmF1bHQgY29tcGlsZQorfQorZ2NjLWRnLXJ1bnRlc3QgW2xzb3J0IFtnbG9iIC1u b2NvbXBsYWluICRzcmNkaXIvJHN1YmRpci8qLlxbY0NTXF1dXSBcCisJIi1zYXZlLXRlbXBzIiAk REVGQVVMVF9DRkxBR1MKK3NldCBkZy1kby13aGF0LWRlZmF1bHQgJHtzYXZlLWRnLWRvLXdoYXQt ZGVmYXVsdH0KKworIyBBbGwgZG9uZS4KK3RvcnR1cmUtZmluaXNoCitkZy1maW5pc2gKZGlmZiAt LWdpdCBhL2djYy90ZXN0c3VpdGUvbGliL3RhcmdldC1zdXBwb3J0cy5leHAgYi9nY2MvdGVzdHN1 aXRlL2xpYi90YXJnZXQtc3VwcG9ydHMuZXhwCmluZGV4IGVhOWE1MGNjYjI3YmMwMzE5NWQxMGVh ZjA4OGNhMjE1ZmQ4NTUxMzUuLjc5NDgyZjliNjljYmUyZTFmM2Q2YWJjMjI2NmUxZDJkM2Q1MzMz NDIgMTAwNjQ0Ci0tLSBhL2djYy90ZXN0c3VpdGUvbGliL3RhcmdldC1zdXBwb3J0cy5leHAKKysr IGIvZ2NjL3Rlc3RzdWl0ZS9saWIvdGFyZ2V0LXN1cHBvcnRzLmV4cApAQCAtODU3OSw3ICs4NTc5 LDggQEAgcHJvYyBjaGVja19lZmZlY3RpdmVfdGFyZ2V0X2FhcmNoNjRfdGlueSB7IH0gewogIyBD cmVhdGUgZnVuY3Rpb25zIHRvIGNoZWNrIHRoYXQgdGhlIEFBcmNoNjQgYXNzZW1ibGVyIHN1cHBv cnRzIHRoZQogIyB2YXJpb3VzIGFyY2hpdGVjdHVyZSBleHRlbnNpb25zIHZpYSB0aGUgLmFyY2hf ZXh0ZW5zaW9uIHBzZXVkby1vcC4KIAotZm9yZWFjaCB7IGFhcmNoNjRfZXh0IH0geyAiZnAiICJz aW1kIiAiY3J5cHRvIiAiY3JjIiAibHNlIiAiZG90cHJvZCIgInN2ZSJ9IHsKK2ZvcmVhY2ggeyBh YXJjaDY0X2V4dCB9IHsgImZwIiAic2ltZCIgImNyeXB0byIgImNyYyIgImxzZSIgImRvdHByb2Qi ICJzdmUiCisJCQkgICJzYiJ9IHsKICAgICBldmFsIFtzdHJpbmcgbWFwIFtsaXN0IEZVTkMgJGFh cmNoNjRfZXh0XSB7CiAJcHJvYyBjaGVja19lZmZlY3RpdmVfdGFyZ2V0X2FhcmNoNjRfYXNtX0ZV TkNfb2sgeyB9IHsKIAkgIGlmIHsgW2lzdGFyZ2V0IGFhcmNoNjQqLSotKl0gfSB7Cgo= --===============0152312779251849756==--