From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.6 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT, USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A06FC4346A for ; Tue, 28 Jul 2020 21:37:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E6BB52075D for ; Tue, 28 Jul 2020 21:37:33 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="bdg19jzm" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729895AbgG1VhT (ORCPT ); Tue, 28 Jul 2020 17:37:19 -0400 Received: from linux.microsoft.com ([13.77.154.182]:47162 "EHLO linux.microsoft.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729322AbgG1Vga (ORCPT ); Tue, 28 Jul 2020 17:36:30 -0400 Received: from dede-linux-virt.corp.microsoft.com (unknown [131.107.160.54]) by linux.microsoft.com (Postfix) with ESMTPSA id 7686A20B4908; Tue, 28 Jul 2020 14:36:26 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 7686A20B4908 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1595972186; bh=IUsemAyVX0FQV1bZyFoMwubQ4fhjQXfylDIWaG16ty0=; h=From:To:Cc:Subject:Date:From; b=bdg19jzmSfbNjLwM+4QAiTexBxE/O571Y8p6v7DUS7MsbSQ7IO9RQOo0McKXLWLst x+2oMlrTkLPYg0v+7TritOt82j9Rqxr+fVlPQnpH/OlxEhG79ykSldJTFTz7Xhbn+V pR/SDdiJpbiWVSGxr1SQuS7keFRY3MPceJR9dfUE= From: Deven Bowers To: agk@redhat.com, axboe@kernel.dk, snitzer@redhat.com, jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com, viro@zeniv.linux.org.uk, paul@paul-moore.com, eparis@redhat.com, jannh@google.com, dm-devel@redhat.com, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-block@vger.kernel.org, linux-audit@redhat.com Cc: tyhicks@linux.microsoft.com, linux-kernel@vger.kernel.org, corbet@lwn.net, sashal@kernel.org, jaskarankhurana@linux.microsoft.com, mdsakib@microsoft.com, nramas@linux.microsoft.com, pasha.tatashin@soleen.com Subject: [RFC PATCH v5 00/11] Integrity Policy Enforcement LSM (IPE) Date: Tue, 28 Jul 2020 14:36:00 -0700 Message-Id: <20200728213614.586312-1-deven.desai@linux.microsoft.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org Overview: ------------------------------------ IPE is a Linux Security Module which allows for a configurable policy to enforce integrity requirements on the whole system. It attempts to solve the issue of Code Integrity: that any code being executed (or files being read), are identical to the version that was built by a trusted source. The type of system for which IPE is designed for use is an embedded device with a specific purpose (e.g. network firewall device in a data center), where all software and configuration is built and provisioned by the owner. Specifically, a system which leverages IPE is not intended for general purpose computing and does not utilize any software or configuration built by a third party. An ideal system to leverage IPE has both mutable and immutable components, however, all binary executable code is immutable. The scope of IPE is constrained to the OS. It is assumed that platform firmware verifies the the kernel and optionally the root filesystem (e.g. via U-Boot verified boot). IPE then utilizes LSM hooks to enforce a flexible, kernel-resident integrity verification policy. IPE differs from other LSMs which provide integrity checking (for instance, IMA), as it has no dependency on the filesystem metadata itself. The attributes that IPE checks are deterministic properties that exist solely in the kernel. Additionally, IPE provides no additional mechanisms of verifying these files (e.g. IMA Signatures) - all of the attributes of verifying files are existing features within the kernel, such as dm-verity or fsverity. IPE provides a policy that allows owners of the system to easily specify integrity requirements and uses dm-verity signatures to simplify the authentication of allowed objects like authorized code and data. IPE supports two modes, permissive (similar to SELinux's permissive mode) and enforce. Permissive mode performs the same checks, and logs policy violations as enforce mode, but will not enforce the policy. This allows users to test policies before enforcing them. The default mode is enforce, and can be changed via the kernel commandline parameter `ipe.enforce=(0|1)`, or the securityfs node `/sys/kernel/security/ipe/enforce`. The ability to switch modes can be compiled out of the LSM via setting the config CONFIG_SECURITY_IPE_PERMISSIVE_SWITCH to N. IPE additionally supports success auditing. When enabled, all events that pass IPE policy and are not blocked will emit an audit event. This is disabled by default, and can be enabled via the kernel commandline `ipe.success_audit=(0|1)` or the securityfs node `/sys/kernel/security/ipe/success_audit`. Policies can be staged at runtime through securityfs and activated through sysfs. Please see the Deploying Policies section of this cover letter for more information. The IPE LSM is compiled under CONFIG_SECURITY_IPE. Policy: ------------------------------------ IPE policy is designed to be both forward compatible and backwards compatible. There is one required line, at the top of the policy, indicating the policy name, and the policy version, for instance: policy_name="Ex Policy" policy_version=0.0.0 The policy version indicates the current version of the policy (NOT the policy syntax version). This is used to prevent roll-back of policy to potentially insecure previous versions of the policy. The next portion of IPE policy, are rules. Rules are formed by key=value pairs, known as properties. IPE rules require two properties: "action", which determines what IPE does when it encounters a match against the policy, and "op", which determines when that rule should be evaluated. Thus, a minimal rule is: op=EXECUTE action=ALLOW This example will allow any execution. Additional properties are used to restrict attributes about the files being evaluated. These properties are intended to be deterministic attributes that are resident in the kernel. Available properties for IPE described in the properties section of this cover-letter, the repository available in Appendix A, and the kernel documentation page. Order does not matter for the rule's properties - they can be listed in any order, however it is encouraged to have the "op" property be first, and the "action" property be last, for readability. Additionally, rules are evaluated top-to-bottom. As a result, any revocation rules, or denies should be placed early in the file to ensure that these rules are evaluated before a rule with "action=ALLOW" is hit. Any unknown syntax in IPE policy will result in a fatal error to parse the policy. User mode can interrogate the kernel to understand what properties and the associated versions through the securityfs node, $securityfs/ipe/property_config, which will return a string of form: key1=version1 key2=version2 . . . keyN=versionN User-mode should correlate these versions with the supported values identified in the documentation to determine whether a policy should be accepted by the system. Additionally, a DEFAULT operation must be set for all understood operations within IPE. For policies to remain completely forwards compatible, it is recommended that users add a "DEFAULT action=ALLOW" and override the defaults on a per-operation basis. For more information about the policy syntax, please see Appendix A or the kernel documentation page. Early Usermode Protection: -------------------------- IPE can be provided with a policy at startup to load and enforce. This is intended to be a minimal policy to get the system to a state where userland is setup and ready to receive commands, at which point a policy can be deployed via securityfs. This "boot policy" can be specified via the config, SECURITY_IPE_BOOT_POLICY, which accepts a path to a plain-text version of the IPE policy to apply. This policy will be compiled into the kernel. If not specified, IPE will be disabled until a policy is deployed and activated through the method above. Policy Examples: ------------------------------------ Allow all: policy_name="Allow All" policy_version=0.0.0 DEFAULT action=ALLOW Allow only initial superblock: policy_name="Allow All Initial SB" policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW Allow any signed dm-verity volume and the initial superblock: policy_name="AllowSignedAndInitial" policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=TRUE action=ALLOW Prohibit execution from a specific dm-verity volume: policy_name="AllowSignedAndInitial" policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE dmverity_roothash=401fcec5944823ae12f62726e8184407a5fa9599783f030dec146938 action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=TRUE action=ALLOW Allow only a specific dm-verity volume: policy_name="AllowSignedAndInitial" policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE dmverity_roothash=401fcec5944823ae12f62726e8184407a5fa9599783f030dec146938 action=ALLOW Deploying Policies: ------------------- Deploying policies is simple. First sign a plain text policy, with a certificate that is present in the SYSTEM_TRUSTED_KEYRING of your test machine. Through openssl, the signing can be done via: openssl smime -sign -in "$MY_POLICY" -signer "$MY_CERTIFICATE" \ -inkey "$MY_PRIVATE_KEY" -binary -outform der -noattr -nodetach \ -out "$MY_POLICY.p7s" Then, simply cat the file into the IPE's "new_policy" securityfs node: cat "$MY_POLICY.p7s" > /sys/kernel/security/ipe/new_policy The policy should now be present under the policies/ subdirectory, under its "policy_name" attribute. The policy is now present in the kernel and can be marked as active, via the sysctl "ipe.active_policy": echo -n 1 > "/sys/kernel/security/ipe/$MY_POLICY_NAME/active" This will now mark the policy as active and the system will be enforcing $MY_POLICY_NAME. At any point the policy can be updated on the provision that the policy version to be deployed is greater than or equal to the running version (to prevent roll-back attacks). This update can be done by redirecting the file into the policy's "raw" node, under the policies subdirectory: cat "$MY_UPDATED_POLICY.p7s" > \ "/sys/kernel/security/ipe/policies/$MY_POLICY_NAME/raw" Additionally, policies can be deleted via the "del_policy" securityfs node. Simply write the name of the policy to be deleted to that node: echo -n 1 > "/sys/kernel/security/ipe/policies/$MY_POLICY_NAME/delete" There are two requirements to delete policies: 1. The policy being deleted must not be the active policy. 2. The policy being deleted must not be the boot policy. It's important to know above that the "echo" command will add a newline to the end of the input, and this will be considered as part of the filename. You can remove the newline via the -n parameter. NOTE: If a MAC LSM is enabled, the securityfs commands will require CAP_MAC_ADMIN. This is due to sysfs supporting fine-grained MAC attributes, while securityfs at the current moment does not. Properties: ------------------------------------ This initial patchset introducing IPE adds three properties: 'boot_verified', 'dmverity_signature' and 'dmverity_roothash'. boot_verified (CONFIG_IPE_BOOT_PROP): This property can be utilized for authorization of the first super-block that is mounted on the system, where IPE attempts to evaluate a file. Typically this is used for systems with an initramfs or other initial disk, where this is unmounted before the system becomes available, and is not covered by any other property. The format of this property is: boot_verified=(TRUE|FALSE) WARNING: This property will trust any disk where the first IPE evaluation occurs. If you do not have a startup disk that is unpacked and unmounted (like initramfs), then it will automatically trust the root filesystem and potentially overauthorize the entire disk. dmverity_roothash (CONFIG_IPE_DM_VERITY_ROOTHASH): This property can be utilized for authorization or revocation of specific dmverity volumes, identified via root hash. It has a dependency on the DM_VERITY module. The format of this property is: dmverity_roothash= dmverity_signature (CONFIG_IPE_DM_VERITY_SIGNATURE): This property can be utilized for authorization of all dm-verity volumes that have a signed roothash that chains to the system trusted keyring. It has a dependency on the DM_VERITY_VERIFY_ROOTHASH_SIG config. The format of this property is: dmverity_signature=(TRUE|FALSE) Testing: ------------------------------------ A test suite is available (Appendix B) for ease of use. For manual instructions: Enable IPE through the following Kconfigs: CONFIG_SECURITY_IPE=y CONFIG_SECURITY_IPE_BOOT_POLICY="../AllowAllInitialSB.pol" CONFIG_SECURITY_IPE_PERMISSIVE_SWITCH=y CONFIG_IPE_BOOT_PROP=y CONFIG_IPE_DM_VERITY_ROOTHASH=y CONFIG_IPE_DM_VERITY_SIGNATURE=y CONFIG_DM_VERITY=y CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="/path/to/my/cert/list.pem" Start a test system, that boots directly from the filesystem, without an initrd. I recommend testing in permissive mode until all tests pass, then switch to enforce to ensure behavior remains identical. boot_verified: If booted correctly, the filesystem mounted on / should be marked as boot_verified. Verify by turning on success auditing (sysctl ipe.success_audit=1), and run a binary. In the audit output, `prop_boot_verified` should be `TRUE`. To test denials, mount a temporary filesystem (mount -t tmpfs -o size=4M tmp tmp), and copy a binary (e.g. ls) to this new filesystem. Disable success auditing and attempt to run the file. The file should have an audit event, but be allowed to execute in permissive mode, and prop_boot_verified should be FALSE. dmverity_roothash: First, you must create a dm-verity volume. This can be done through squashfs-tools and veritysetup (provided by cryptsetup). Creating a squashfs volume: mksquashfs /path/to/directory/with/executable /path/to/output.squashfs Format the volume for use with dm-verity & save the root hash: output_rh=$(veritysetup format output.squashfs output.hashtree | \ tee verity_out.txt | awk "/Root hash/" | \ sed -E "s/Root hash:\s+//g") echo -n $output_rh > output.roothash Create a two policies, filling in the appropriate fields below: Policy 1: policy_name="roothash-denial" policy_version=0.0.0 DEFAULT action=ALLOW op=EXECUTE dmverity_roothash=$output_rh action=DENY Policy 2: policy_name="roothash-allow" policy_version=0.0.0 DEFAULT action=ALLOW DEFAULT op=EXECUTE action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_roothash=$output_rh action=ALLOW Deploy each policy, then mark the first, "roothash-denial" as active, per the "Deploying Policies" section of this cover letter. Mount the dm-verity volume: veritysetup open output.squashfs output.hashtree unverified \ `cat output.roothash` mount /dev/mapper/unverified /my/mount/point Attempt to execute a binary in the mount point, and it should emit an audit event for a match against the rule: op=EXECUTE dmverity_roothash=$output_rh action=DENY To test the second policy, perform the same steps, but this time, enable success auditing before running the executable. The success audit event should be a match against this rule: op=EXECUTE dmverity_roothash=$output_rh action=ALLOW dmverity_signature: Follow the setup steps for dmverity_roothash. Sign the roothash via: openssl smime -sign -in "output.roothash" -signer "$MY_CERTIFICATE" \ -inkey "$MY_PRIVATE_KEY" -binary -outform der -noattr \ -out "output.p7s" Create a policy: policy_name="verified" policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_verified=TRUE action=ALLOW Deploy the policy, and mark as active, per the "Deploying Policies" section of this cover letter. Mount the dm-verity volume with verification: veritysetup open output.squashfs output.hashtree unverified \ `cat output.roothash` --root-hash-signature=output.p7s mount /dev/mapper/unverified /my/mount/point NOTE: The --root-hash-signature option was introduced in veritysetup 2.3.0 Turn on success auditing and attempt to execute a binary in the mount point, and it should emit an audit event for a match against the rule: op=EXECUTE dmverity_verified=TRUE action=ALLOW To test denials, mount the dm-verity volume the same way as the "dmverity_roothash" section, and attempt to execute a binary. Failure should occur. Documentation: ------------------------------------ Full documentation is available on github in IPE's master repository (Appendix A). This is intended to be an exhaustive source of documentation around IPE. Additionally, there is higher level documentation in the admin-guide. Technical diagrams are available here: http://microsoft.github.io/ipe/technical/diagrams/ Known Gaps: ------------------------------------ IPE has two known gaps: 1. IPE cannot verify the integrity of anonymous executable memory, such as the trampolines created by gcc closures and libffi, or JIT'd code. Unfortunately, as this is dynamically generated code, there is no way for IPE to detect that this code has not been tampered with in transition from where it was built, to where it is running. As a result, IPE is incapable of tackling this problem for dynamically generated code. However, there is a patch series being prepared that addresses this problem for libffi and gcc closures by implemeting a safer kernel trampoline API. 2. IPE cannot verify the integrity of interpreted languages' programs when these scripts invoked via ` `. This is because the way interpreters execute these files, the scripts themselves are not evaluated as executable code through one of IPE's hooks. Interpreters can be enlightened to the usage of IPE by trying to mmap a file into executable memory (+X), after opening the file and responding to the error code appropriately. This also applies to included files, or high value files, such as configuration files of critical system components. This specific gap is planned on being addressed within IPE. For more information on how we plan to address this gap, please see the Future Development section, below. Future Development: ------------------------------------ Support for filtering signatures by specific certificates. In this case, our "dmverity_signature" (or a separate property) can be set to a specific certificate declared in IPE's policy, allowing for more controlled use-cases determine by a user's PKI structure. Support for integrity verification for general file reads. This addresses the script interpreter issue indicated in the "Known Gaps" section, as these script files are typically opened with O_RDONLY. We are evaluating whether to do this by comparing the original userland filepath passed into the open syscall, thereby allowing existing callers to take advantage without any code changes; the alternate design is to extend the new openat2(2) syscall, with an new flag, tentatively called "O_VERIFY". While the second option requires a code change for all the interpreters, frameworks and languages that wish to leverage it, it is a wholly cleaner implementation in the kernel. For interpreters specifically, the O_MAYEXEC patch series published by Mickaël Salaün[1] is a similar implementation to the O_VERIFY idea described above. Onboarding IPE's test suite to KernelCI. Currently we are developing a test suite in the same vein as SELinux's test suite. Once development of the test suite is complete, and provided IPE is accepted, we intend to onboard this test suite onto KernelCI. Hardened resistance against roll-back attacks. Currently there exists a window of opportunity between user-mode setup and the user-policy being deployed, where a prior user-policy can be loaded, that is potentially insecure. However, with a kernel update, you can revise the boot policy's version to be the same version as the latest policy, closing this window. In the future, I would like to close this window of opportunity without a kernel update, using some persistent storage mechanism. Open Issues: ------------ For linux-audit/integrity folks: 1. Introduction of new audit definitions in the kernel integrity range - is this preferred, as opposed to reusing definitions with existing IMA definitions? TODOs: ------ linux-audit changes to support the new audit events. Appendix: ------------------------------------ A. IPE Github Repository: https://github.com/microsoft/ipe Hosted Documentation: https://microsoft.github.io/ipe B. IPE Users' Guide: Documentation/admin-guide/LSM/ipe.rst C. IPE Test Suite: *TBA* (under development) References: ------------------------------------ 1. https://lore.kernel.org/linux-integrity/20200505153156.925111-1-mic@digikod.net/ Changelog: ------------------------------------ v1: Introduced v2: Split the second patch of the previous series into two. Minor corrections in the cover-letter and documentation comments regarding CAP_MAC_ADMIN checks in IPE. v3: Address various comments by Jann Horn. Highlights: Switch various audit allocators to GFP_KERNEL. Utilize rcu_access_pointer() in various locations. Strip out the caching system for properties Strip comments from headers Move functions around in patches Remove kernel command line parameters Reconcile the race condition on the delete node for policy by expanding the policy critical section. Address a few comments by Jonathan Corbet around the documentation pages for IPE. Fix an issue with the initialization of IPE policy with a "-0" version, caused by not initializing the hlist entries before freeing. v4: Address a concern around IPE's behavior with unknown syntax. Specifically, make any unknown syntax a fatal error instead of a warning, as suggested by Mickaël Salaün. Introduce a new securityfs node, $securityfs/ipe/property_config, which provides a listing of what properties are enabled by the kernel and their versions. This allows usermode to predict what policies should be allowed. Strip some comments from c files that I missed. Clarify some documentation comments around 'boot_verified'. While this currently does not functionally change the property itself, the distinction is important when IPE can enforce verified reads. Additionally, 'KERNEL_READ' was omitted from the documentation. This has been corrected. Change SecurityFS and SHA1 to a reverse dependency. Update the cover-letter with the updated behavior of unknown syntax. Remove all sysctls, making an equivalent function in securityfs. Rework the active/delete mechanism to be a node under the policy in $securityfs/ipe/policies. The kernel command line parameters ipe.enforce and ipe.success_audit have returned as this functionality is no longer exposed through sysfs. v5: Correct some grammatical errors reported by Randy Dunlap. Fix some warnings reported by kernel test bot. Change convention around security_bdev_setsecurity. -ENOSYS is now expected if an LSM does not implement a particular @name, as suggested by Casey Schaufler. Minor string corrections related to the move from sysfs to securityfs Correct a spelling of an #ifdef for the permissive argument. Add the kernel parameters re-added to the documentation.Integrity Policy Enforcement LSM (IPE) Overview: ------------------------------------ IPE is a Linux Security Module which allows for a configurable policy to enforce integrity requirements on the whole system. It attempts to solve the issue of Code Integrity: that any code being executed (or files being read), are identical to the version that was built by a trusted source. The type of system for which IPE is designed for use is an embedded device with a specific purpose (e.g. network firewall device in a data center), where all software and configuration is built and provisioned by the owner. Specifically, a system which leverages IPE is not intended for general purpose computing and does not utilize any software or configuration built by a third party. An ideal system to leverage IPE has both mutable and immutable components, however, all binary executable code is immutable. The scope of IPE is constrained to the OS. It is assumed that platform firmware verifies the the kernel and optionally the root filesystem (e.g. via U-Boot verified boot). IPE then utilizes LSM hooks to enforce a flexible, kernel-resident integrity verification policy. IPE differs from other LSMs which provide integrity checking (for instance, IMA), as it has no dependency on the filesystem metadata itself. The attributes that IPE checks are deterministic properties that exist solely in the kernel. Additionally, IPE provides no additional mechanisms of verifying these files (e.g. IMA Signatures) - all of the attributes of verifying files are existing features within the kernel, such as dm-verity or fsverity. IPE provides a policy that allows owners of the system to easily specify integrity requirements and uses dm-verity signatures to simplify the authentication of allowed objects like authorized code and data. IPE supports two modes, permissive (similar to SELinux's permissive mode) and enforce. Permissive mode performs the same checks, and logs policy violations as enforce mode, but will not enforce the policy. This allows users to test policies before enforcing them. The default mode is enforce, and can be changed via the kernel commandline parameter `ipe.enforce=(0|1)`, or the securityfs node `/sys/kernel/security/ipe/enforce`. The ability to switch modes can be compiled out of the LSM via setting the config CONFIG_SECURITY_IPE_PERMISSIVE_SWITCH to N. IPE additionally supports success auditing. When enabled, all events that pass IPE policy and are not blocked will emit an audit event. This is disabled by default, and can be enabled via the kernel commandline `ipe.success_audit=(0|1)` or the securityfs node `/sys/kernel/security/ipe/success_audit`. Policies can be staged at runtime through securityfs and activated through sysfs. Please see the Deploying Policies section of this cover letter for more information. The IPE LSM is compiled under CONFIG_SECURITY_IPE. Policy: ------------------------------------ IPE policy is designed to be both forward compatible and backwards compatible. There is one required line, at the top of the policy, indicating the policy name, and the policy version, for instance: policy_name="Ex Policy" policy_version=0.0.0 The policy version indicates the current version of the policy (NOT the policy syntax version). This is used to prevent roll-back of policy to potentially insecure previous versions of the policy. The next portion of IPE policy, are rules. Rules are formed by key=value pairs, known as properties. IPE rules require two properties: "action", which determines what IPE does when it encounters a match against the policy, and "op", which determines when that rule should be evaluated. Thus, a minimal rule is: op=EXECUTE action=ALLOW This example will allow any execution. Additional properties are used to restrict attributes about the files being evaluated. These properties are intended to be deterministic attributes that are resident in the kernel. Available properties for IPE described in the properties section of this cover-letter, the repository available in Appendix A, and the kernel documentation page. Order does not matter for the rule's properties - they can be listed in any order, however it is encouraged to have the "op" property be first, and the "action" property be last, for readability. Additionally, rules are evaluated top-to-bottom. As a result, any revocation rules, or denies should be placed early in the file to ensure that these rules are evaluated before a rule with "action=ALLOW" is hit. Any unknown syntax in IPE policy will result in a fatal error to parse the policy. User mode can interrogate the kernel to understand what properties and the associated versions through the securityfs node, $securityfs/ipe/property_config, which will return a string of form: key1=version1 key2=version2 . . . keyN=versionN User-mode should correlate these versions with the supported values identified in the documentation to determine whether a policy should be accepted by the system. Additionally, a DEFAULT operation must be set for all understood operations within IPE. For policies to remain completely forwards compatible, it is recommended that users add a "DEFAULT action=ALLOW" and override the defaults on a per-operation basis. For more information about the policy syntax, please see Appendix A or the kernel documentation page. Early Usermode Protection: -------------------------- IPE can be provided with a policy at startup to load and enforce. This is intended to be a minimal policy to get the system to a state where userland is setup and ready to receive commands, at which point a policy can be deployed via securityfs. This "boot policy" can be specified via the config, SECURITY_IPE_BOOT_POLICY, which accepts a path to a plain-text version of the IPE policy to apply. This policy will be compiled into the kernel. If not specified, IPE will be disabled until a policy is deployed and activated through the method above. Policy Examples: ------------------------------------ Allow all: policy_name="Allow All" policy_version=0.0.0 DEFAULT action=ALLOW Allow only initial superblock: policy_name="Allow All Initial SB" policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW Allow any signed dm-verity volume and the initial superblock: policy_name="AllowSignedAndInitial" policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=TRUE action=ALLOW Prohibit execution from a specific dm-verity volume: policy_name="AllowSignedAndInitial" policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE dmverity_roothash=401fcec5944823ae12f62726e8184407a5fa9599783f030dec146938 action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=TRUE action=ALLOW Allow only a specific dm-verity volume: policy_name="AllowSignedAndInitial" policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE dmverity_roothash=401fcec5944823ae12f62726e8184407a5fa9599783f030dec146938 action=ALLOW Deploying Policies: ------------------- Deploying policies is simple. First sign a plain text policy, with a certificate that is present in the SYSTEM_TRUSTED_KEYRING of your test machine. Through openssl, the signing can be done via: openssl smime -sign -in "$MY_POLICY" -signer "$MY_CERTIFICATE" \ -inkey "$MY_PRIVATE_KEY" -binary -outform der -noattr -nodetach \ -out "$MY_POLICY.p7s" Then, simply cat the file into the IPE's "new_policy" securityfs node: cat "$MY_POLICY.p7s" > /sys/kernel/security/ipe/new_policy The policy should now be present under the policies/ subdirectory, under its "policy_name" attribute. The policy is now present in the kernel and can be marked as active, via the sysctl "ipe.active_policy": echo -n 1 > "/sys/kernel/security/ipe/$MY_POLICY_NAME/active" This will now mark the policy as active and the system will be enforcing $MY_POLICY_NAME. At any point the policy can be updated on the provision that the policy version to be deployed is greater than or equal to the running version (to prevent roll-back attacks). This update can be done by redirecting the file into the policy's "raw" node, under the policies subdirectory: cat "$MY_UPDATED_POLICY.p7s" > \ "/sys/kernel/security/ipe/policies/$MY_POLICY_NAME/raw" Additionally, policies can be deleted via the "del_policy" securityfs node. Simply write the name of the policy to be deleted to that node: echo -n 1 > "/sys/kernel/security/ipe/policies/$MY_POLICY_NAME/delete" There are two requirements to delete policies: 1. The policy being deleted must not be the active policy. 2. The policy being deleted must not be the boot policy. It's important to know above that the "echo" command will add a newline to the end of the input, and this will be considered as part of the filename. You can remove the newline via the -n parameter. NOTE: If a MAC LSM is enabled, the securityfs commands will require CAP_MAC_ADMIN. This is due to sysfs supporting fine-grained MAC attributes, while securityfs at the current moment does not. Properties: ------------------------------------ This initial patchset introducing IPE adds three properties: 'boot_verified', 'dmverity_signature' and 'dmverity_roothash'. boot_verified (CONFIG_IPE_BOOT_PROP): This property can be utilized for authorization of the first super-block that is mounted on the system, where IPE attempts to evaluate a file. Typically this is used for systems with an initramfs or other initial disk, where this is unmounted before the system becomes available, and is not covered by any other property. The format of this property is: boot_verified=(TRUE|FALSE) WARNING: This property will trust any disk where the first IPE evaluation occurs. If you do not have a startup disk that is unpacked and unmounted (like initramfs), then it will automatically trust the root filesystem and potentially overauthorize the entire disk. dmverity_roothash (CONFIG_IPE_DM_VERITY_ROOTHASH): This property can be utilized for authorization or revocation of specific dmverity volumes, identified via root hash. It has a dependency on the DM_VERITY module. The format of this property is: dmverity_roothash= dmverity_signature (CONFIG_IPE_DM_VERITY_SIGNATURE): This property can be utilized for authorization of all dm-verity volumes that have a signed roothash that chains to the system trusted keyring. It has a dependency on the DM_VERITY_VERIFY_ROOTHASH_SIG config. The format of this property is: dmverity_signature=(TRUE|FALSE) Testing: ------------------------------------ A test suite is available (Appendix B) for ease of use. For manual instructions: Enable IPE through the following Kconfigs: CONFIG_SECURITY_IPE=y CONFIG_SECURITY_IPE_BOOT_POLICY="../AllowAllInitialSB.pol" CONFIG_SECURITY_IPE_PERMISSIVE_SWITCH=y CONFIG_IPE_BOOT_PROP=y CONFIG_IPE_DM_VERITY_ROOTHASH=y CONFIG_IPE_DM_VERITY_SIGNATURE=y CONFIG_DM_VERITY=y CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="/path/to/my/cert/list.pem" Start a test system, that boots directly from the filesystem, without an initrd. I recommend testing in permissive mode until all tests pass, then switch to enforce to ensure behavior remains identical. boot_verified: If booted correctly, the filesystem mounted on / should be marked as boot_verified. Verify by turning on success auditing (sysctl ipe.success_audit=1), and run a binary. In the audit output, `prop_boot_verified` should be `TRUE`. To test denials, mount a temporary filesystem (mount -t tmpfs -o size=4M tmp tmp), and copy a binary (e.g. ls) to this new filesystem. Disable success auditing and attempt to run the file. The file should have an audit event, but be allowed to execute in permissive mode, and prop_boot_verified should be FALSE. dmverity_roothash: First, you must create a dm-verity volume. This can be done through squashfs-tools and veritysetup (provided by cryptsetup). Creating a squashfs volume: mksquashfs /path/to/directory/with/executable /path/to/output.squashfs Format the volume for use with dm-verity & save the root hash: output_rh=$(veritysetup format output.squashfs output.hashtree | \ tee verity_out.txt | awk "/Root hash/" | \ sed -E "s/Root hash:\s+//g") echo -n $output_rh > output.roothash Create a two policies, filling in the appropriate fields below: Policy 1: policy_name="roothash-denial" policy_version=0.0.0 DEFAULT action=ALLOW op=EXECUTE dmverity_roothash=$output_rh action=DENY Policy 2: policy_name="roothash-allow" policy_version=0.0.0 DEFAULT action=ALLOW DEFAULT op=EXECUTE action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_roothash=$output_rh action=ALLOW Deploy each policy, then mark the first, "roothash-denial" as active, per the "Deploying Policies" section of this cover letter. Mount the dm-verity volume: veritysetup open output.squashfs output.hashtree unverified \ `cat output.roothash` mount /dev/mapper/unverified /my/mount/point Attempt to execute a binary in the mount point, and it should emit an audit event for a match against the rule: op=EXECUTE dmverity_roothash=$output_rh action=DENY To test the second policy, perform the same steps, but this time, enable success auditing before running the executable. The success audit event should be a match against this rule: op=EXECUTE dmverity_roothash=$output_rh action=ALLOW dmverity_signature: Follow the setup steps for dmverity_roothash. Sign the roothash via: openssl smime -sign -in "output.roothash" -signer "$MY_CERTIFICATE" \ -inkey "$MY_PRIVATE_KEY" -binary -outform der -noattr \ -out "output.p7s" Create a policy: policy_name="verified" policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_verified=TRUE action=ALLOW Deploy the policy, and mark as active, per the "Deploying Policies" section of this cover letter. Mount the dm-verity volume with verification: veritysetup open output.squashfs output.hashtree unverified \ `cat output.roothash` --root-hash-signature=output.p7s mount /dev/mapper/unverified /my/mount/point NOTE: The --root-hash-signature option was introduced in veritysetup 2.3.0 Turn on success auditing and attempt to execute a binary in the mount point, and it should emit an audit event for a match against the rule: op=EXECUTE dmverity_verified=TRUE action=ALLOW To test denials, mount the dm-verity volume the same way as the "dmverity_roothash" section, and attempt to execute a binary. Failure should occur. Documentation: ------------------------------------ Full documentation is available on github in IPE's master repository (Appendix A). This is intended to be an exhaustive source of documentation around IPE. Additionally, there is higher level documentation in the admin-guide. Technical diagrams are available here: http://microsoft.github.io/ipe/technical/diagrams/ Known Gaps: ------------------------------------ IPE has two known gaps: 1. IPE cannot verify the integrity of anonymous executable memory, such as the trampolines created by gcc closures and libffi, or JIT'd code. Unfortunately, as this is dynamically generated code, there is no way for IPE to detect that this code has not been tampered with in transition from where it was built, to where it is running. As a result, IPE is incapable of tackling this problem for dynamically generated code. However, there is a patch series being prepared that addresses this problem for libffi and gcc closures by implemeting a safer kernel trampoline API. 2. IPE cannot verify the integrity of interpreted languages' programs when these scripts invoked via ` `. This is because the way interpreters execute these files, the scripts themselves are not evaluated as executable code through one of IPE's hooks. Interpreters can be enlightened to the usage of IPE by trying to mmap a file into executable memory (+X), after opening the file and responding to the error code appropriately. This also applies to included files, or high value files, such as configuration files of critical system components. This specific gap is planned on being addressed within IPE. For more information on how we plan to address this gap, please see the Future Development section, below. Future Development: ------------------------------------ Support for filtering signatures by specific certificates. In this case, our "dmverity_signature" (or a separate property) can be set to a specific certificate declared in IPE's policy, allowing for more controlled use-cases determine by a user's PKI structure. Support for integrity verification for general file reads. This addresses the script interpreter issue indicated in the "Known Gaps" section, as these script files are typically opened with O_RDONLY. We are evaluating whether to do this by comparing the original userland filepath passed into the open syscall, thereby allowing existing callers to take advantage without any code changes; the alternate design is to extend the new openat2(2) syscall, with an new flag, tentatively called "O_VERIFY". While the second option requires a code change for all the interpreters, frameworks and languages that wish to leverage it, it is a wholly cleaner implementation in the kernel. For interpreters specifically, the O_MAYEXEC patch series published by Mickaël Salaün[1] is a similar implementation to the O_VERIFY idea described above. Onboarding IPE's test suite to KernelCI. Currently we are developing a test suite in the same vein as SELinux's test suite. Once development of the test suite is complete, and provided IPE is accepted, we intend to onboard this test suite onto KernelCI. Hardened resistance against roll-back attacks. Currently there exists a window of opportunity between user-mode setup and the user-policy being deployed, where a prior user-policy can be loaded, that is potentially insecure. However, with a kernel update, you can revise the boot policy's version to be the same version as the latest policy, closing this window. In the future, I would like to close this window of opportunity without a kernel update, using some persistent storage mechanism. Open Issues: ------------ For linux-audit/integrity folks: 1. Introduction of new audit definitions in the kernel integrity range - is this preferred, as opposed to reusing definitions with existing IMA definitions? TODOs: ------ linux-audit changes to support the new audit events. Appendix: ------------------------------------ A. IPE Github Repository: https://github.com/microsoft/ipe Hosted Documentation: https://microsoft.github.io/ipe B. IPE Users' Guide: Documentation/admin-guide/LSM/ipe.rst C. IPE Test Suite: *TBA* (under development) References: ------------------------------------ 1. https://lore.kernel.org/linux-integrity/20200505153156.925111-1-mic@digikod.net/ Changelog: ------------------------------------ v1: Introduced v2: Split the second patch of the previous series into two. Minor corrections in the cover-letter and documentation comments regarding CAP_MAC_ADMIN checks in IPE. v3: Address various comments by Jann Horn. Highlights: Switch various audit allocators to GFP_KERNEL. Utilize rcu_access_pointer() in various locations. Strip out the caching system for properties Strip comments from headers Move functions around in patches Remove kernel command line parameters Reconcile the race condition on the delete node for policy by expanding the policy critical section. Address a few comments by Jonathan Corbet around the documentation pages for IPE. Fix an issue with the initialization of IPE policy with a "-0" version, caused by not initializing the hlist entries before freeing. v4: Address a concern around IPE's behavior with unknown syntax. Specifically, make any unknown syntax a fatal error instead of a warning, as suggested by Mickaël Salaün. Introduce a new securityfs node, $securityfs/ipe/property_config, which provides a listing of what properties are enabled by the kernel and their versions. This allows usermode to predict what policies should be allowed. Strip some comments from c files that I missed. Clarify some documentation comments around 'boot_verified'. While this currently does not functionally change the property itself, the distinction is important when IPE can enforce verified reads. Additionally, 'KERNEL_READ' was omitted from the documentation. This has been corrected. Change SecurityFS and SHA1 to a reverse dependency. Update the cover-letter with the updated behavior of unknown syntax. Remove all sysctls, making an equivalent function in securityfs. Rework the active/delete mechanism to be a node under the policy in $securityfs/ipe/policies. The kernel command line parameters ipe.enforce and ipe.success_audit have returned as this functionality is no longer exposed through sysfs. v5: Correct some grammatical errors reported by Randy Dunlap. Fix some warnings reported by kernel test bot. Change convention around security_bdev_setsecurity. -ENOSYS is now expected if an LSM does not implement a particular @name, as suggested by Casey Schaufler. Minor string corrections related to the move from sysfs to securityfs Correct a spelling of an #ifdef for the permissive argument. Add the kernel parameters re-added to the documentation. Fix a minor bug where the mode being audited on permissive switch was the original mode, not the mode being swapped to. Cleanup doc comments, fix some whitespace alignment issues. Deven Bowers (11): scripts: add ipe tooling to generate boot policy security: add ipe lsm evaluation loop and audit system security: add ipe lsm policy parser and policy loading ipe: add property for trust of boot volume fs: add security blob and hooks for block_device dm-verity: move signature check after tree validation dm-verity: add bdev_setsecurity hook for dm-verity signature ipe: add property for signed dmverity volumes dm-verity: add bdev_setsecurity hook for root-hash documentation: add ipe documentation cleanup: uapi/linux/audit.h Documentation/admin-guide/LSM/index.rst | 1 + Documentation/admin-guide/LSM/ipe.rst | 508 +++++++ .../admin-guide/kernel-parameters.txt | 12 + MAINTAINERS | 8 + drivers/md/dm-verity-target.c | 52 +- drivers/md/dm-verity-verify-sig.c | 147 +- drivers/md/dm-verity-verify-sig.h | 24 +- drivers/md/dm-verity.h | 2 +- fs/block_dev.c | 8 + include/linux/device-mapper.h | 3 + include/linux/fs.h | 1 + include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 12 + include/linux/security.h | 22 + include/uapi/linux/audit.h | 36 +- scripts/Makefile | 1 + scripts/ipe/Makefile | 2 + scripts/ipe/polgen/.gitignore | 1 + scripts/ipe/polgen/Makefile | 7 + scripts/ipe/polgen/polgen.c | 136 ++ security/Kconfig | 12 +- security/Makefile | 2 + security/ipe/.gitignore | 2 + security/ipe/Kconfig | 48 + security/ipe/Makefile | 33 + security/ipe/ipe-audit.c | 303 ++++ security/ipe/ipe-audit.h | 24 + security/ipe/ipe-blobs.c | 95 ++ security/ipe/ipe-blobs.h | 18 + security/ipe/ipe-engine.c | 213 +++ security/ipe/ipe-engine.h | 49 + security/ipe/ipe-hooks.c | 169 +++ security/ipe/ipe-hooks.h | 70 + security/ipe/ipe-parse.c | 889 +++++++++++ security/ipe/ipe-parse.h | 17 + security/ipe/ipe-pin.c | 93 ++ security/ipe/ipe-pin.h | 36 + security/ipe/ipe-policy.c | 149 ++ security/ipe/ipe-policy.h | 69 + security/ipe/ipe-prop-internal.h | 49 + security/ipe/ipe-property.c | 143 ++ security/ipe/ipe-property.h | 100 ++ security/ipe/ipe-secfs.c | 1309 +++++++++++++++++ security/ipe/ipe-secfs.h | 14 + security/ipe/ipe.c | 115 ++ security/ipe/ipe.h | 22 + security/ipe/properties/Kconfig | 36 + security/ipe/properties/Makefile | 13 + security/ipe/properties/boot-verified.c | 82 ++ security/ipe/properties/dmverity-roothash.c | 153 ++ security/ipe/properties/dmverity-signature.c | 82 ++ security/ipe/properties/prop-entry.h | 38 + security/ipe/utility.h | 32 + security/security.c | 74 + 54 files changed, 5443 insertions(+), 98 deletions(-) create mode 100644 Documentation/admin-guide/LSM/ipe.rst create mode 100644 scripts/ipe/Makefile create mode 100644 scripts/ipe/polgen/.gitignore create mode 100644 scripts/ipe/polgen/Makefile create mode 100644 scripts/ipe/polgen/polgen.c create mode 100644 security/ipe/.gitignore create mode 100644 security/ipe/Kconfig create mode 100644 security/ipe/Makefile create mode 100644 security/ipe/ipe-audit.c create mode 100644 security/ipe/ipe-audit.h create mode 100644 security/ipe/ipe-blobs.c create mode 100644 security/ipe/ipe-blobs.h create mode 100644 security/ipe/ipe-engine.c create mode 100644 security/ipe/ipe-engine.h create mode 100644 security/ipe/ipe-hooks.c create mode 100644 security/ipe/ipe-hooks.h create mode 100644 security/ipe/ipe-parse.c create mode 100644 security/ipe/ipe-parse.h create mode 100644 security/ipe/ipe-pin.c create mode 100644 security/ipe/ipe-pin.h create mode 100644 security/ipe/ipe-policy.c create mode 100644 security/ipe/ipe-policy.h create mode 100644 security/ipe/ipe-prop-internal.h create mode 100644 security/ipe/ipe-property.c create mode 100644 security/ipe/ipe-property.h create mode 100644 security/ipe/ipe-secfs.c create mode 100644 security/ipe/ipe-secfs.h create mode 100644 security/ipe/ipe.c create mode 100644 security/ipe/ipe.h create mode 100644 security/ipe/properties/Kconfig create mode 100644 security/ipe/properties/Makefile create mode 100644 security/ipe/properties/boot-verified.c create mode 100644 security/ipe/properties/dmverity-roothash.c create mode 100644 security/ipe/properties/dmverity-signature.c create mode 100644 security/ipe/properties/prop-entry.h create mode 100644 security/ipe/utility.h -- 2.27.0 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22FB2C433E4 for ; Tue, 28 Jul 2020 21:47:57 +0000 (UTC) Received: from us-smtp-delivery-74.mimecast.com (us-smtp-delivery-74.mimecast.com [63.128.21.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id AC78C2075D for ; Tue, 28 Jul 2020 21:47:56 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AC78C2075D Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linux-audit-bounces@redhat.com Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-398--dLg1VbXPai4Cr6BMey6RA-1; Tue, 28 Jul 2020 17:47:53 -0400 X-MC-Unique: -dLg1VbXPai4Cr6BMey6RA-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id C59551030C28; Tue, 28 Jul 2020 21:47:49 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 5862E5D9E8; Tue, 28 Jul 2020 21:47:49 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 394E5A35AC; Tue, 28 Jul 2020 21:47:49 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 06SLadUG019964 for ; Tue, 28 Jul 2020 17:36:39 -0400 Received: by smtp.corp.redhat.com (Postfix) id 5FE032026D67; Tue, 28 Jul 2020 21:36:39 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast06.extmail.prod.ext.rdu2.redhat.com [10.11.55.22]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 5A1602029F60 for ; Tue, 28 Jul 2020 21:36:33 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id C3DD21832D2E for ; Tue, 28 Jul 2020 21:36:33 +0000 (UTC) Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by relay.mimecast.com with ESMTP id us-mta-413-Pf86U7lqPISZPo43BC9BBw-1; Tue, 28 Jul 2020 17:36:28 -0400 X-MC-Unique: Pf86U7lqPISZPo43BC9BBw-1 Received: from dede-linux-virt.corp.microsoft.com (unknown [131.107.160.54]) by linux.microsoft.com (Postfix) with ESMTPSA id 7686A20B4908; Tue, 28 Jul 2020 14:36:26 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 7686A20B4908 From: Deven Bowers To: agk@redhat.com, axboe@kernel.dk, snitzer@redhat.com, jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com, viro@zeniv.linux.org.uk, paul@paul-moore.com, eparis@redhat.com, jannh@google.com, dm-devel@redhat.com, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-block@vger.kernel.org, linux-audit@redhat.com Subject: [RFC PATCH v5 00/11] Integrity Policy Enforcement LSM (IPE) Date: Tue, 28 Jul 2020 14:36:00 -0700 Message-Id: <20200728213614.586312-1-deven.desai@linux.microsoft.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-MIME-Autoconverted: from quoted-printable to 8bit by lists01.pubmisc.prod.ext.phx2.redhat.com id 06SLadUG019964 X-loop: linux-audit@redhat.com X-Mailman-Approved-At: Tue, 28 Jul 2020 17:47:37 -0400 Cc: sashal@kernel.org, pasha.tatashin@soleen.com, mdsakib@microsoft.com, corbet@lwn.net, linux-kernel@vger.kernel.org, nramas@linux.microsoft.com, tyhicks@linux.microsoft.com, jaskarankhurana@linux.microsoft.com X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T3ZlcnZpZXc6Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIGlzIGEg TGludXggU2VjdXJpdHkgTW9kdWxlIHdoaWNoIGFsbG93cyBmb3IgYSBjb25maWd1cmFibGUKcG9s aWN5IHRvIGVuZm9yY2UgaW50ZWdyaXR5IHJlcXVpcmVtZW50cyBvbiB0aGUgd2hvbGUgc3lzdGVt LiBJdAphdHRlbXB0cyB0byBzb2x2ZSB0aGUgaXNzdWUgb2YgQ29kZSBJbnRlZ3JpdHk6IHRoYXQg YW55IGNvZGUgYmVpbmcKZXhlY3V0ZWQgKG9yIGZpbGVzIGJlaW5nIHJlYWQpLCBhcmUgaWRlbnRp Y2FsIHRvIHRoZSB2ZXJzaW9uIHRoYXQKd2FzIGJ1aWx0IGJ5IGEgdHJ1c3RlZCBzb3VyY2UuCgpU aGUgdHlwZSBvZiBzeXN0ZW0gZm9yIHdoaWNoIElQRSBpcyBkZXNpZ25lZCBmb3IgdXNlIGlzIGFu IGVtYmVkZGVkIGRldmljZQp3aXRoIGEgc3BlY2lmaWMgcHVycG9zZSAoZS5nLiBuZXR3b3JrIGZp cmV3YWxsIGRldmljZSBpbiBhIGRhdGEgY2VudGVyKSwKd2hlcmUgYWxsIHNvZnR3YXJlIGFuZCBj b25maWd1cmF0aW9uIGlzIGJ1aWx0IGFuZCBwcm92aXNpb25lZCBieSB0aGUgb3duZXIuCgpTcGVj aWZpY2FsbHksIGEgc3lzdGVtIHdoaWNoIGxldmVyYWdlcyBJUEUgaXMgbm90IGludGVuZGVkIGZv ciBnZW5lcmFsCnB1cnBvc2UgY29tcHV0aW5nIGFuZCBkb2VzIG5vdCB1dGlsaXplIGFueSBzb2Z0 d2FyZSBvciBjb25maWd1cmF0aW9uCmJ1aWx0IGJ5IGEgdGhpcmQgcGFydHkuIEFuIGlkZWFsIHN5 c3RlbSB0byBsZXZlcmFnZSBJUEUgaGFzIGJvdGggbXV0YWJsZQphbmQgaW1tdXRhYmxlIGNvbXBv bmVudHMsIGhvd2V2ZXIsIGFsbCBiaW5hcnkgZXhlY3V0YWJsZSBjb2RlIGlzIGltbXV0YWJsZS4K ClRoZSBzY29wZSBvZiBJUEUgaXMgY29uc3RyYWluZWQgdG8gdGhlIE9TLiBJdCBpcyBhc3N1bWVk IHRoYXQgcGxhdGZvcm0KZmlybXdhcmUgdmVyaWZpZXMgdGhlIHRoZSBrZXJuZWwgYW5kIG9wdGlv bmFsbHkgdGhlIHJvb3QgZmlsZXN5c3RlbSAoZS5nLgp2aWEgVS1Cb290IHZlcmlmaWVkIGJvb3Qp LiBJUEUgdGhlbiB1dGlsaXplcyBMU00gaG9va3MgdG8gZW5mb3JjZSBhCmZsZXhpYmxlLCBrZXJu ZWwtcmVzaWRlbnQgaW50ZWdyaXR5IHZlcmlmaWNhdGlvbiBwb2xpY3kuCgpJUEUgZGlmZmVycyBm cm9tIG90aGVyIExTTXMgd2hpY2ggcHJvdmlkZSBpbnRlZ3JpdHkgY2hlY2tpbmcgKGZvciBpbnN0 YW5jZSwKSU1BKSwgYXMgaXQgaGFzIG5vIGRlcGVuZGVuY3kgb24gdGhlIGZpbGVzeXN0ZW0gbWV0 YWRhdGEgaXRzZWxmLiBUaGUKYXR0cmlidXRlcyB0aGF0IElQRSBjaGVja3MgYXJlIGRldGVybWlu aXN0aWMgcHJvcGVydGllcyB0aGF0IGV4aXN0IHNvbGVseQppbiB0aGUga2VybmVsLiBBZGRpdGlv bmFsbHksIElQRSBwcm92aWRlcyBubyBhZGRpdGlvbmFsIG1lY2hhbmlzbXMgb2YKdmVyaWZ5aW5n IHRoZXNlIGZpbGVzIChlLmcuIElNQSBTaWduYXR1cmVzKSAtIGFsbCBvZiB0aGUgYXR0cmlidXRl cyBvZgp2ZXJpZnlpbmcgZmlsZXMgYXJlIGV4aXN0aW5nIGZlYXR1cmVzIHdpdGhpbiB0aGUga2Vy bmVsLCBzdWNoIGFzIGRtLXZlcml0eQpvciBmc3Zlcml0eS4KCklQRSBwcm92aWRlcyBhIHBvbGlj eSB0aGF0IGFsbG93cyBvd25lcnMgb2YgdGhlIHN5c3RlbSB0byBlYXNpbHkgc3BlY2lmeQppbnRl Z3JpdHkgcmVxdWlyZW1lbnRzIGFuZCB1c2VzIGRtLXZlcml0eSBzaWduYXR1cmVzIHRvIHNpbXBs aWZ5IHRoZQphdXRoZW50aWNhdGlvbiBvZiBhbGxvd2VkIG9iamVjdHMgbGlrZSBhdXRob3JpemVk IGNvZGUgYW5kIGRhdGEuCgpJUEUgc3VwcG9ydHMgdHdvIG1vZGVzLCBwZXJtaXNzaXZlIChzaW1p bGFyIHRvIFNFTGludXgncyBwZXJtaXNzaXZlIG1vZGUpCmFuZCBlbmZvcmNlLiBQZXJtaXNzaXZl IG1vZGUgcGVyZm9ybXMgdGhlIHNhbWUgY2hlY2tzLCBhbmQgbG9ncyBwb2xpY3kKdmlvbGF0aW9u cyBhcyBlbmZvcmNlIG1vZGUsIGJ1dCB3aWxsIG5vdCBlbmZvcmNlIHRoZSBwb2xpY3kuIFRoaXMg YWxsb3dzCnVzZXJzIHRvIHRlc3QgcG9saWNpZXMgYmVmb3JlIGVuZm9yY2luZyB0aGVtLgoKVGhl IGRlZmF1bHQgbW9kZSBpcyBlbmZvcmNlLCBhbmQgY2FuIGJlIGNoYW5nZWQgdmlhIHRoZSBrZXJu ZWwgY29tbWFuZGxpbmUKcGFyYW1ldGVyIGBpcGUuZW5mb3JjZT0oMHwxKWAsIG9yIHRoZSBzZWN1 cml0eWZzIG5vZGUKYC9zeXMva2VybmVsL3NlY3VyaXR5L2lwZS9lbmZvcmNlYC4gVGhlIGFiaWxp dHkgdG8gc3dpdGNoIG1vZGVzIGNhbiBiZQpjb21waWxlZCBvdXQgb2YgdGhlIExTTSB2aWEgc2V0 dGluZyB0aGUgY29uZmlnCkNPTkZJR19TRUNVUklUWV9JUEVfUEVSTUlTU0lWRV9TV0lUQ0ggdG8g Ti4KCklQRSBhZGRpdGlvbmFsbHkgc3VwcG9ydHMgc3VjY2VzcyBhdWRpdGluZy4gV2hlbiBlbmFi bGVkLCBhbGwgZXZlbnRzCnRoYXQgcGFzcyBJUEUgcG9saWN5IGFuZCBhcmUgbm90IGJsb2NrZWQg d2lsbCBlbWl0IGFuIGF1ZGl0IGV2ZW50LiBUaGlzCmlzIGRpc2FibGVkIGJ5IGRlZmF1bHQsIGFu ZCBjYW4gYmUgZW5hYmxlZCB2aWEgdGhlIGtlcm5lbCBjb21tYW5kbGluZQpgaXBlLnN1Y2Nlc3Nf YXVkaXQ9KDB8MSlgIG9yIHRoZSBzZWN1cml0eWZzIG5vZGUKYC9zeXMva2VybmVsL3NlY3VyaXR5 L2lwZS9zdWNjZXNzX2F1ZGl0YC4KClBvbGljaWVzIGNhbiBiZSBzdGFnZWQgYXQgcnVudGltZSB0 aHJvdWdoIHNlY3VyaXR5ZnMgYW5kIGFjdGl2YXRlZCB0aHJvdWdoCnN5c2ZzLiBQbGVhc2Ugc2Vl IHRoZSBEZXBsb3lpbmcgUG9saWNpZXMgc2VjdGlvbiBvZiB0aGlzIGNvdmVyIGxldHRlciBmb3IK bW9yZSBpbmZvcm1hdGlvbi4KClRoZSBJUEUgTFNNIGlzIGNvbXBpbGVkIHVuZGVyIENPTkZJR19T RUNVUklUWV9JUEUuCgpQb2xpY3k6Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LQoKSVBFIHBvbGljeSBpcyBkZXNpZ25lZCB0byBiZSBib3RoIGZvcndhcmQgY29tcGF0aWJsZSBh bmQgYmFja3dhcmRzCmNvbXBhdGlibGUuIFRoZXJlIGlzIG9uZSByZXF1aXJlZCBsaW5lLCBhdCB0 aGUgdG9wIG9mIHRoZSBwb2xpY3ksCmluZGljYXRpbmcgdGhlIHBvbGljeSBuYW1lLCBhbmQgdGhl IHBvbGljeSB2ZXJzaW9uLCBmb3IgaW5zdGFuY2U6CgogIHBvbGljeV9uYW1lPSJFeCBQb2xpY3ki IHBvbGljeV92ZXJzaW9uPTAuMC4wCgpUaGUgcG9saWN5IHZlcnNpb24gaW5kaWNhdGVzIHRoZSBj dXJyZW50IHZlcnNpb24gb2YgdGhlIHBvbGljeSAoTk9UIHRoZQpwb2xpY3kgc3ludGF4IHZlcnNp b24pLiBUaGlzIGlzIHVzZWQgdG8gcHJldmVudCByb2xsLWJhY2sgb2YgcG9saWN5IHRvCnBvdGVu dGlhbGx5IGluc2VjdXJlIHByZXZpb3VzIHZlcnNpb25zIG9mIHRoZSBwb2xpY3kuCgpUaGUgbmV4 dCBwb3J0aW9uIG9mIElQRSBwb2xpY3ksIGFyZSBydWxlcy4gUnVsZXMgYXJlIGZvcm1lZCBieSBr ZXk9dmFsdWUKcGFpcnMsIGtub3duIGFzIHByb3BlcnRpZXMuIElQRSBydWxlcyByZXF1aXJlIHR3 byBwcm9wZXJ0aWVzOiAiYWN0aW9uIiwKd2hpY2ggZGV0ZXJtaW5lcyB3aGF0IElQRSBkb2VzIHdo ZW4gaXQgZW5jb3VudGVycyBhIG1hdGNoIGFnYWluc3QgdGhlCnBvbGljeSwgYW5kICJvcCIsIHdo aWNoIGRldGVybWluZXMgd2hlbiB0aGF0IHJ1bGUgc2hvdWxkIGJlIGV2YWx1YXRlZC4KVGh1cywg YSBtaW5pbWFsIHJ1bGUgaXM6CgogIG9wPUVYRUNVVEUgYWN0aW9uPUFMTE9XCgpUaGlzIGV4YW1w bGUgd2lsbCBhbGxvdyBhbnkgZXhlY3V0aW9uLiBBZGRpdGlvbmFsIHByb3BlcnRpZXMgYXJlIHVz ZWQgdG8KcmVzdHJpY3QgYXR0cmlidXRlcyBhYm91dCB0aGUgZmlsZXMgYmVpbmcgZXZhbHVhdGVk LiBUaGVzZSBwcm9wZXJ0aWVzIGFyZQppbnRlbmRlZCB0byBiZSBkZXRlcm1pbmlzdGljIGF0dHJp YnV0ZXMgdGhhdCBhcmUgcmVzaWRlbnQgaW4gdGhlIGtlcm5lbC4KQXZhaWxhYmxlIHByb3BlcnRp ZXMgZm9yIElQRSBkZXNjcmliZWQgaW4gdGhlIHByb3BlcnRpZXMgc2VjdGlvbiBvZiB0aGlzCmNv dmVyLWxldHRlciwgdGhlIHJlcG9zaXRvcnkgYXZhaWxhYmxlIGluIEFwcGVuZGl4IEEsIGFuZCB0 aGUga2VybmVsCmRvY3VtZW50YXRpb24gcGFnZS4KCk9yZGVyIGRvZXMgbm90IG1hdHRlciBmb3Ig dGhlIHJ1bGUncyBwcm9wZXJ0aWVzIC0gdGhleSBjYW4gYmUgbGlzdGVkIGluCmFueSBvcmRlciwg aG93ZXZlciBpdCBpcyBlbmNvdXJhZ2VkIHRvIGhhdmUgdGhlICJvcCIgcHJvcGVydHkgYmUgZmly c3QsCmFuZCB0aGUgImFjdGlvbiIgcHJvcGVydHkgYmUgbGFzdCwgZm9yIHJlYWRhYmlsaXR5LgoK QWRkaXRpb25hbGx5LCBydWxlcyBhcmUgZXZhbHVhdGVkIHRvcC10by1ib3R0b20uIEFzIGEgcmVz dWx0LCBhbnkKcmV2b2NhdGlvbiBydWxlcywgb3IgZGVuaWVzIHNob3VsZCBiZSBwbGFjZWQgZWFy bHkgaW4gdGhlIGZpbGUgdG8gZW5zdXJlCnRoYXQgdGhlc2UgcnVsZXMgYXJlIGV2YWx1YXRlZCBi ZWZvcmUgYSBydWxlIHdpdGggImFjdGlvbj1BTExPVyIgaXMgaGl0LgoKQW55IHVua25vd24gc3lu dGF4IGluIElQRSBwb2xpY3kgd2lsbCByZXN1bHQgaW4gYSBmYXRhbCBlcnJvciB0byBwYXJzZQp0 aGUgcG9saWN5LiBVc2VyIG1vZGUgY2FuIGludGVycm9nYXRlIHRoZSBrZXJuZWwgdG8gdW5kZXJz dGFuZCB3aGF0CnByb3BlcnRpZXMgYW5kIHRoZSBhc3NvY2lhdGVkIHZlcnNpb25zIHRocm91Z2gg dGhlIHNlY3VyaXR5ZnMgbm9kZSwKJHNlY3VyaXR5ZnMvaXBlL3Byb3BlcnR5X2NvbmZpZywgd2hp Y2ggd2lsbCByZXR1cm4gYSBzdHJpbmcgb2YgZm9ybToKCiAga2V5MT12ZXJzaW9uMQogIGtleTI9 dmVyc2lvbjIKICAuCiAgLgogIC4KICBrZXlOPXZlcnNpb25OCgpVc2VyLW1vZGUgc2hvdWxkIGNv cnJlbGF0ZSB0aGVzZSB2ZXJzaW9ucyB3aXRoIHRoZSBzdXBwb3J0ZWQgdmFsdWVzCmlkZW50aWZp ZWQgaW4gdGhlIGRvY3VtZW50YXRpb24gdG8gZGV0ZXJtaW5lIHdoZXRoZXIgYSBwb2xpY3kgc2hv dWxkCmJlIGFjY2VwdGVkIGJ5IHRoZSBzeXN0ZW0uCgpBZGRpdGlvbmFsbHksIGEgREVGQVVMVCBv cGVyYXRpb24gbXVzdCBiZSBzZXQgZm9yIGFsbCB1bmRlcnN0b29kCm9wZXJhdGlvbnMgd2l0aGlu IElQRS4gRm9yIHBvbGljaWVzIHRvIHJlbWFpbiBjb21wbGV0ZWx5IGZvcndhcmRzCmNvbXBhdGli bGUsIGl0IGlzIHJlY29tbWVuZGVkIHRoYXQgdXNlcnMgYWRkIGEgIkRFRkFVTFQgYWN0aW9uPUFM TE9XIgphbmQgb3ZlcnJpZGUgdGhlIGRlZmF1bHRzIG9uIGEgcGVyLW9wZXJhdGlvbiBiYXNpcy4K CkZvciBtb3JlIGluZm9ybWF0aW9uIGFib3V0IHRoZSBwb2xpY3kgc3ludGF4LCBwbGVhc2Ugc2Vl IEFwcGVuZGl4IEEgb3IKdGhlIGtlcm5lbCBkb2N1bWVudGF0aW9uIHBhZ2UuCgpFYXJseSBVc2Vy bW9kZSBQcm90ZWN0aW9uOgotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIGNhbiBiZSBw cm92aWRlZCB3aXRoIGEgcG9saWN5IGF0IHN0YXJ0dXAgdG8gbG9hZCBhbmQgZW5mb3JjZS4KVGhp cyBpcyBpbnRlbmRlZCB0byBiZSBhIG1pbmltYWwgcG9saWN5IHRvIGdldCB0aGUgc3lzdGVtIHRv IGEgc3RhdGUKd2hlcmUgdXNlcmxhbmQgaXMgc2V0dXAgYW5kIHJlYWR5IHRvIHJlY2VpdmUgY29t bWFuZHMsIGF0IHdoaWNoCnBvaW50IGEgcG9saWN5IGNhbiBiZSBkZXBsb3llZCB2aWEgc2VjdXJp dHlmcy4gVGhpcyAiYm9vdCBwb2xpY3kiIGNhbiBiZQpzcGVjaWZpZWQgdmlhIHRoZSBjb25maWcs IFNFQ1VSSVRZX0lQRV9CT09UX1BPTElDWSwgd2hpY2ggYWNjZXB0cyBhIHBhdGgKdG8gYSBwbGFp bi10ZXh0IHZlcnNpb24gb2YgdGhlIElQRSBwb2xpY3kgdG8gYXBwbHkuIFRoaXMgcG9saWN5IHdp bGwgYmUKY29tcGlsZWQgaW50byB0aGUga2VybmVsLiBJZiBub3Qgc3BlY2lmaWVkLCBJUEUgd2ls bCBiZSBkaXNhYmxlZCB1bnRpbCBhCnBvbGljeSBpcyBkZXBsb3llZCBhbmQgYWN0aXZhdGVkIHRo cm91Z2ggdGhlIG1ldGhvZCBhYm92ZS4KClBvbGljeSBFeGFtcGxlczoKLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tCgpBbGxvdyBhbGw6CgogIHBvbGljeV9uYW1lPSJBbGxvdyBB bGwiIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249QUxMT1cKCkFsbG93IG9u bHkgaW5pdGlhbCBzdXBlcmJsb2NrOgoKICBwb2xpY3lfbmFtZT0iQWxsb3cgQWxsIEluaXRpYWwg U0IiIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249REVOWQoKICBvcD1FWEVD VVRFIGJvb3RfdmVyaWZpZWQ9VFJVRSBhY3Rpb249QUxMT1cKCkFsbG93IGFueSBzaWduZWQgZG0t dmVyaXR5IHZvbHVtZSBhbmQgdGhlIGluaXRpYWwgc3VwZXJibG9jazoKCiAgcG9saWN5X25hbWU9 IkFsbG93U2lnbmVkQW5kSW5pdGlhbCIgcG9saWN5X3ZlcnNpb249MC4wLjAKICBERUZBVUxUIGFj dGlvbj1ERU5ZCgogIG9wPUVYRUNVVEUgYm9vdF92ZXJpZmllZD1UUlVFIGFjdGlvbj1BTExPVwog IG9wPUVYRUNVVEUgZG12ZXJpdHlfc2lnbmF0dXJlPVRSVUUgYWN0aW9uPUFMTE9XCgpQcm9oaWJp dCBleGVjdXRpb24gZnJvbSBhIHNwZWNpZmljIGRtLXZlcml0eSB2b2x1bWU6CgogIHBvbGljeV9u YW1lPSJBbGxvd1NpZ25lZEFuZEluaXRpYWwiIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVM VCBhY3Rpb249REVOWQoKICBvcD1FWEVDVVRFIGRtdmVyaXR5X3Jvb3RoYXNoPTQwMWZjZWM1OTQ0 ODIzYWUxMmY2MjcyNmU4MTg0NDA3YTVmYTk1OTk3ODNmMDMwZGVjMTQ2OTM4IGFjdGlvbj1ERU5Z CiAgb3A9RVhFQ1VURSBib290X3ZlcmlmaWVkPVRSVUUgYWN0aW9uPUFMTE9XCiAgb3A9RVhFQ1VU RSBkbXZlcml0eV9zaWduYXR1cmU9VFJVRSBhY3Rpb249QUxMT1cKCkFsbG93IG9ubHkgYSBzcGVj aWZpYyBkbS12ZXJpdHkgdm9sdW1lOgoKICBwb2xpY3lfbmFtZT0iQWxsb3dTaWduZWRBbmRJbml0 aWFsIiBwb2xpY3lfdmVyc2lvbj0wLjAuMAogIERFRkFVTFQgYWN0aW9uPURFTlkKCiAgb3A9RVhF Q1VURSBkbXZlcml0eV9yb290aGFzaD00MDFmY2VjNTk0NDgyM2FlMTJmNjI3MjZlODE4NDQwN2E1 ZmE5NTk5NzgzZjAzMGRlYzE0NjkzOCBhY3Rpb249QUxMT1cKCkRlcGxveWluZyBQb2xpY2llczoK LS0tLS0tLS0tLS0tLS0tLS0tLQoKRGVwbG95aW5nIHBvbGljaWVzIGlzIHNpbXBsZS4gRmlyc3Qg c2lnbiBhIHBsYWluIHRleHQgcG9saWN5LCB3aXRoIGEKY2VydGlmaWNhdGUgdGhhdCBpcyBwcmVz ZW50IGluIHRoZSBTWVNURU1fVFJVU1RFRF9LRVlSSU5HIG9mIHlvdXIgdGVzdAptYWNoaW5lLiBU aHJvdWdoIG9wZW5zc2wsIHRoZSBzaWduaW5nIGNhbiBiZSBkb25lIHZpYToKCiAgb3BlbnNzbCBz bWltZSAtc2lnbiAtaW4gIiRNWV9QT0xJQ1kiIC1zaWduZXIgIiRNWV9DRVJUSUZJQ0FURSIgXAog ICAgLWlua2V5ICIkTVlfUFJJVkFURV9LRVkiIC1iaW5hcnkgLW91dGZvcm0gZGVyIC1ub2F0dHIg LW5vZGV0YWNoIFwKICAgIC1vdXQgIiRNWV9QT0xJQ1kucDdzIgoKVGhlbiwgc2ltcGx5IGNhdCB0 aGUgZmlsZSBpbnRvIHRoZSBJUEUncyAibmV3X3BvbGljeSIgc2VjdXJpdHlmcyBub2RlOgoKICBj YXQgIiRNWV9QT0xJQ1kucDdzIiA+IC9zeXMva2VybmVsL3NlY3VyaXR5L2lwZS9uZXdfcG9saWN5 CgpUaGUgcG9saWN5IHNob3VsZCBub3cgYmUgcHJlc2VudCB1bmRlciB0aGUgcG9saWNpZXMvIHN1 YmRpcmVjdG9yeSwgdW5kZXIKaXRzICJwb2xpY3lfbmFtZSIgYXR0cmlidXRlLgoKVGhlIHBvbGlj eSBpcyBub3cgcHJlc2VudCBpbiB0aGUga2VybmVsIGFuZCBjYW4gYmUgbWFya2VkIGFzIGFjdGl2 ZSwKdmlhIHRoZSBzeXNjdGwgImlwZS5hY3RpdmVfcG9saWN5IjoKCiAgZWNobyAtbiAxID4gIi9z eXMva2VybmVsL3NlY3VyaXR5L2lwZS8kTVlfUE9MSUNZX05BTUUvYWN0aXZlIgoKVGhpcyB3aWxs IG5vdyBtYXJrIHRoZSBwb2xpY3kgYXMgYWN0aXZlIGFuZCB0aGUgc3lzdGVtIHdpbGwgYmUgZW5m b3JjaW5nCiRNWV9QT0xJQ1lfTkFNRS4gQXQgYW55IHBvaW50IHRoZSBwb2xpY3kgY2FuIGJlIHVw ZGF0ZWQgb24gdGhlIHByb3Zpc2lvbgp0aGF0IHRoZSBwb2xpY3kgdmVyc2lvbiB0byBiZSBkZXBs b3llZCBpcyBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gdGhlCnJ1bm5pbmcgdmVyc2lvbiAodG8g cHJldmVudCByb2xsLWJhY2sgYXR0YWNrcykuIFRoaXMgdXBkYXRlIGNhbiBiZSBkb25lCmJ5IHJl ZGlyZWN0aW5nIHRoZSBmaWxlIGludG8gdGhlIHBvbGljeSdzICJyYXciIG5vZGUsIHVuZGVyIHRo ZSBwb2xpY2llcwpzdWJkaXJlY3Rvcnk6CgogIGNhdCAiJE1ZX1VQREFURURfUE9MSUNZLnA3cyIg PiBcCiAgICAiL3N5cy9rZXJuZWwvc2VjdXJpdHkvaXBlL3BvbGljaWVzLyRNWV9QT0xJQ1lfTkFN RS9yYXciCgpBZGRpdGlvbmFsbHksIHBvbGljaWVzIGNhbiBiZSBkZWxldGVkIHZpYSB0aGUgImRl bF9wb2xpY3kiIHNlY3VyaXR5ZnMKbm9kZS4gU2ltcGx5IHdyaXRlIHRoZSBuYW1lIG9mIHRoZSBw b2xpY3kgdG8gYmUgZGVsZXRlZCB0byB0aGF0IG5vZGU6CgogIGVjaG8gLW4gMSA+CiAgICAiL3N5 cy9rZXJuZWwvc2VjdXJpdHkvaXBlL3BvbGljaWVzLyRNWV9QT0xJQ1lfTkFNRS9kZWxldGUiCgpU aGVyZSBhcmUgdHdvIHJlcXVpcmVtZW50cyB0byBkZWxldGUgcG9saWNpZXM6CgoxLiBUaGUgcG9s aWN5IGJlaW5nIGRlbGV0ZWQgbXVzdCBub3QgYmUgdGhlIGFjdGl2ZSBwb2xpY3kuCjIuIFRoZSBw b2xpY3kgYmVpbmcgZGVsZXRlZCBtdXN0IG5vdCBiZSB0aGUgYm9vdCBwb2xpY3kuCgpJdCdzIGlt cG9ydGFudCB0byBrbm93IGFib3ZlIHRoYXQgdGhlICJlY2hvIiBjb21tYW5kIHdpbGwgYWRkIGEg bmV3bGluZQp0byB0aGUgZW5kIG9mIHRoZSBpbnB1dCwgYW5kIHRoaXMgd2lsbCBiZSBjb25zaWRl cmVkIGFzIHBhcnQgb2YgdGhlCmZpbGVuYW1lLiBZb3UgY2FuIHJlbW92ZSB0aGUgbmV3bGluZSB2 aWEgdGhlIC1uIHBhcmFtZXRlci4KCk5PVEU6IElmIGEgTUFDIExTTSBpcyBlbmFibGVkLCB0aGUg c2VjdXJpdHlmcyBjb21tYW5kcyB3aWxsIHJlcXVpcmUKQ0FQX01BQ19BRE1JTi4gVGhpcyBpcyBk dWUgdG8gc3lzZnMgc3VwcG9ydGluZyBmaW5lLWdyYWluZWQgTUFDCmF0dHJpYnV0ZXMsIHdoaWxl IHNlY3VyaXR5ZnMgYXQgdGhlIGN1cnJlbnQgbW9tZW50IGRvZXMgbm90LgoKUHJvcGVydGllczoK LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCgpUaGlzIGluaXRpYWwgcGF0Y2hz ZXQgaW50cm9kdWNpbmcgSVBFIGFkZHMgdGhyZWUgcHJvcGVydGllczoKJ2Jvb3RfdmVyaWZpZWQn LCAnZG12ZXJpdHlfc2lnbmF0dXJlJyBhbmQgJ2RtdmVyaXR5X3Jvb3RoYXNoJy4KCmJvb3RfdmVy aWZpZWQgKENPTkZJR19JUEVfQk9PVF9QUk9QKToKICBUaGlzIHByb3BlcnR5IGNhbiBiZSB1dGls aXplZCBmb3IgYXV0aG9yaXphdGlvbiBvZiB0aGUgZmlyc3QKICBzdXBlci1ibG9jayB0aGF0IGlz IG1vdW50ZWQgb24gdGhlIHN5c3RlbSwgd2hlcmUgSVBFIGF0dGVtcHRzCiAgdG8gZXZhbHVhdGUg YSBmaWxlLiBUeXBpY2FsbHkgdGhpcyBpcyB1c2VkIGZvciBzeXN0ZW1zIHdpdGgKICBhbiBpbml0 cmFtZnMgb3Igb3RoZXIgaW5pdGlhbCBkaXNrLCB3aGVyZSB0aGlzIGlzIHVubW91bnRlZCBiZWZv cmUKICB0aGUgc3lzdGVtIGJlY29tZXMgYXZhaWxhYmxlLCBhbmQgaXMgbm90IGNvdmVyZWQgYnkg YW55IG90aGVyIHByb3BlcnR5LgogIFRoZSBmb3JtYXQgb2YgdGhpcyBwcm9wZXJ0eSBpczoKCiAg ICBib290X3ZlcmlmaWVkPShUUlVFfEZBTFNFKQoKICBXQVJOSU5HOiBUaGlzIHByb3BlcnR5IHdp bGwgdHJ1c3QgYW55IGRpc2sgd2hlcmUgdGhlIGZpcnN0IElQRQogIGV2YWx1YXRpb24gb2NjdXJz LiBJZiB5b3UgZG8gbm90IGhhdmUgYSBzdGFydHVwIGRpc2sgdGhhdCBpcwogIHVucGFja2VkIGFu ZCB1bm1vdW50ZWQgKGxpa2UgaW5pdHJhbWZzKSwgdGhlbiBpdCB3aWxsIGF1dG9tYXRpY2FsbHkK ICB0cnVzdCB0aGUgcm9vdCBmaWxlc3lzdGVtIGFuZCBwb3RlbnRpYWxseSBvdmVyYXV0aG9yaXpl IHRoZSBlbnRpcmUKICBkaXNrLgoKZG12ZXJpdHlfcm9vdGhhc2ggKENPTkZJR19JUEVfRE1fVkVS SVRZX1JPT1RIQVNIKToKICBUaGlzIHByb3BlcnR5IGNhbiBiZSB1dGlsaXplZCBmb3IgYXV0aG9y aXphdGlvbiBvciByZXZvY2F0aW9uIG9mCiAgc3BlY2lmaWMgZG12ZXJpdHkgdm9sdW1lcywgaWRl bnRpZmllZCB2aWEgcm9vdCBoYXNoLiBJdCBoYXMgYQogIGRlcGVuZGVuY3kgb24gdGhlIERNX1ZF UklUWSBtb2R1bGUuIFRoZSBmb3JtYXQgb2YgdGhpcyBwcm9wZXJ0eSBpczoKCiAgICBkbXZlcml0 eV9yb290aGFzaD08SGFzaEhleERpZ2VzdD4KCmRtdmVyaXR5X3NpZ25hdHVyZSAoQ09ORklHX0lQ RV9ETV9WRVJJVFlfU0lHTkFUVVJFKToKICBUaGlzIHByb3BlcnR5IGNhbiBiZSB1dGlsaXplZCBm b3IgYXV0aG9yaXphdGlvbiBvZiBhbGwgZG0tdmVyaXR5CiAgdm9sdW1lcyB0aGF0IGhhdmUgYSBz aWduZWQgcm9vdGhhc2ggdGhhdCBjaGFpbnMgdG8gdGhlIHN5c3RlbQogIHRydXN0ZWQga2V5cmlu Zy4gSXQgaGFzIGEgZGVwZW5kZW5jeSBvbiB0aGUKICBETV9WRVJJVFlfVkVSSUZZX1JPT1RIQVNI X1NJRyBjb25maWcuIFRoZSBmb3JtYXQgb2YgdGhpcyBwcm9wZXJ0eSBpczoKCiAgICBkbXZlcml0 eV9zaWduYXR1cmU9KFRSVUV8RkFMU0UpCgpUZXN0aW5nOgotLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0KCkEgdGVzdCBzdWl0ZSBpcyBhdmFpbGFibGUgKEFwcGVuZGl4IEIpIGZv ciBlYXNlIG9mIHVzZS4gRm9yIG1hbnVhbAppbnN0cnVjdGlvbnM6CgpFbmFibGUgSVBFIHRocm91 Z2ggdGhlIGZvbGxvd2luZyBLY29uZmlnczoKCiAgQ09ORklHX1NFQ1VSSVRZX0lQRT15CiAgQ09O RklHX1NFQ1VSSVRZX0lQRV9CT09UX1BPTElDWT0iLi4vQWxsb3dBbGxJbml0aWFsU0IucG9sIgog IENPTkZJR19TRUNVUklUWV9JUEVfUEVSTUlTU0lWRV9TV0lUQ0g9eQogIENPTkZJR19JUEVfQk9P VF9QUk9QPXkKICBDT05GSUdfSVBFX0RNX1ZFUklUWV9ST09USEFTSD15CiAgQ09ORklHX0lQRV9E TV9WRVJJVFlfU0lHTkFUVVJFPXkKICBDT05GSUdfRE1fVkVSSVRZPXkKICBDT05GSUdfRE1fVkVS SVRZX1ZFUklGWV9ST09USEFTSF9TSUc9eQogIENPTkZJR19TWVNURU1fVFJVU1RFRF9LRVlSSU5H PXkKICBDT05GSUdfU1lTVEVNX1RSVVNURURfS0VZUz0iL3BhdGgvdG8vbXkvY2VydC9saXN0LnBl bSIKClN0YXJ0IGEgdGVzdCBzeXN0ZW0sIHRoYXQgYm9vdHMgZGlyZWN0bHkgZnJvbSB0aGUgZmls ZXN5c3RlbSwgd2l0aG91dAphbiBpbml0cmQuIEkgcmVjb21tZW5kIHRlc3RpbmcgaW4gcGVybWlz c2l2ZSBtb2RlIHVudGlsIGFsbCB0ZXN0cwpwYXNzLCB0aGVuIHN3aXRjaCB0byBlbmZvcmNlIHRv IGVuc3VyZSBiZWhhdmlvciByZW1haW5zIGlkZW50aWNhbC4KCmJvb3RfdmVyaWZpZWQ6CgogIElm IGJvb3RlZCBjb3JyZWN0bHksIHRoZSBmaWxlc3lzdGVtIG1vdW50ZWQgb24gLyBzaG91bGQgYmUg bWFya2VkIGFzCiAgYm9vdF92ZXJpZmllZC4gVmVyaWZ5IGJ5IHR1cm5pbmcgb24gc3VjY2VzcyBh dWRpdGluZyAoc3lzY3RsCiAgaXBlLnN1Y2Nlc3NfYXVkaXQ9MSksIGFuZCBydW4gYSBiaW5hcnku IEluIHRoZSBhdWRpdCBvdXRwdXQsCiAgYHByb3BfYm9vdF92ZXJpZmllZGAgc2hvdWxkIGJlIGBU UlVFYC4KCiAgVG8gdGVzdCBkZW5pYWxzLCBtb3VudCBhIHRlbXBvcmFyeSBmaWxlc3lzdGVtICht b3VudCAtdCB0bXBmcyAtbwogIHNpemU9NE0gdG1wIHRtcCksIGFuZCBjb3B5IGEgYmluYXJ5IChl LmcuIGxzKSB0byB0aGlzIG5ldwogIGZpbGVzeXN0ZW0uIERpc2FibGUgc3VjY2VzcyBhdWRpdGlu ZyBhbmQgYXR0ZW1wdCB0byBydW4gdGhlIGZpbGUuCiAgVGhlIGZpbGUgc2hvdWxkIGhhdmUgYW4g YXVkaXQgZXZlbnQsIGJ1dCBiZSBhbGxvd2VkIHRvIGV4ZWN1dGUgaW4KICBwZXJtaXNzaXZlIG1v ZGUsIGFuZCBwcm9wX2Jvb3RfdmVyaWZpZWQgc2hvdWxkIGJlIEZBTFNFLgoKZG12ZXJpdHlfcm9v dGhhc2g6CgogIEZpcnN0LCB5b3UgbXVzdCBjcmVhdGUgYSBkbS12ZXJpdHkgdm9sdW1lLiBUaGlz IGNhbiBiZSBkb25lIHRocm91Z2gKICBzcXVhc2hmcy10b29scyBhbmQgdmVyaXR5c2V0dXAgKHBy b3ZpZGVkIGJ5IGNyeXB0c2V0dXApLgoKICBDcmVhdGluZyBhIHNxdWFzaGZzIHZvbHVtZToKCiAg ICBta3NxdWFzaGZzIC9wYXRoL3RvL2RpcmVjdG9yeS93aXRoL2V4ZWN1dGFibGUgL3BhdGgvdG8v b3V0cHV0LnNxdWFzaGZzCgogIEZvcm1hdCB0aGUgdm9sdW1lIGZvciB1c2Ugd2l0aCBkbS12ZXJp dHkgJiBzYXZlIHRoZSByb290IGhhc2g6CgogICAgb3V0cHV0X3JoPSQodmVyaXR5c2V0dXAgZm9y bWF0IG91dHB1dC5zcXVhc2hmcyBvdXRwdXQuaGFzaHRyZWUgfCBcCiAgICAgIHRlZSB2ZXJpdHlf b3V0LnR4dCB8IGF3ayAiL1Jvb3QgaGFzaC8iIHwgXAogICAgICBzZWQgLUUgInMvUm9vdCBoYXNo OlxzKy8vZyIpCgogICAgZWNobyAtbiAkb3V0cHV0X3JoID4gb3V0cHV0LnJvb3RoYXNoCgogIENy ZWF0ZSBhIHR3byBwb2xpY2llcywgZmlsbGluZyBpbiB0aGUgYXBwcm9wcmlhdGUgZmllbGRzIGJl bG93OgoKICAgIFBvbGljeSAxOgoKICAgICAgcG9saWN5X25hbWU9InJvb3RoYXNoLWRlbmlhbCIg cG9saWN5X3ZlcnNpb249MC4wLjAKICAgICAgREVGQVVMVCBhY3Rpb249QUxMT1cKICAgICAgb3A9 RVhFQ1VURSBkbXZlcml0eV9yb290aGFzaD0kb3V0cHV0X3JoIGFjdGlvbj1ERU5ZCgogICAgUG9s aWN5IDI6CgogICAgICBwb2xpY3lfbmFtZT0icm9vdGhhc2gtYWxsb3ciIHBvbGljeV92ZXJzaW9u PTAuMC4wCiAgICAgIERFRkFVTFQgYWN0aW9uPUFMTE9XCiAgICAgIERFRkFVTFQgb3A9RVhFQ1VU RSBhY3Rpb249REVOWQoKICAgICAgb3A9RVhFQ1VURSBib290X3ZlcmlmaWVkPVRSVUUgYWN0aW9u PUFMTE9XCiAgICAgIG9wPUVYRUNVVEUgZG12ZXJpdHlfcm9vdGhhc2g9JG91dHB1dF9yaCBhY3Rp b249QUxMT1cKCiAgRGVwbG95IGVhY2ggcG9saWN5LCB0aGVuIG1hcmsgdGhlIGZpcnN0LCAicm9v dGhhc2gtZGVuaWFsIiBhcyBhY3RpdmUsCiAgcGVyIHRoZSAiRGVwbG95aW5nIFBvbGljaWVzIiBz ZWN0aW9uIG9mIHRoaXMgY292ZXIgbGV0dGVyLiBNb3VudCB0aGUKICBkbS12ZXJpdHkgdm9sdW1l OgoKICAgIHZlcml0eXNldHVwIG9wZW4gb3V0cHV0LnNxdWFzaGZzIG91dHB1dC5oYXNodHJlZSB1 bnZlcmlmaWVkIFwKICAgICAgYGNhdCBvdXRwdXQucm9vdGhhc2hgCgogICAgbW91bnQgL2Rldi9t YXBwZXIvdW52ZXJpZmllZCAvbXkvbW91bnQvcG9pbnQKCiAgQXR0ZW1wdCB0byBleGVjdXRlIGEg YmluYXJ5IGluIHRoZSBtb3VudCBwb2ludCwgYW5kIGl0IHNob3VsZCBlbWl0IGFuCiAgYXVkaXQg ZXZlbnQgZm9yIGEgbWF0Y2ggYWdhaW5zdCB0aGUgcnVsZToKICAKICAgIG9wPUVYRUNVVEUgZG12 ZXJpdHlfcm9vdGhhc2g9JG91dHB1dF9yaCBhY3Rpb249REVOWQoKICBUbyB0ZXN0IHRoZSBzZWNv bmQgcG9saWN5LCBwZXJmb3JtIHRoZSBzYW1lIHN0ZXBzLCBidXQgdGhpcyB0aW1lLCBlbmFibGUK ICBzdWNjZXNzIGF1ZGl0aW5nIGJlZm9yZSBydW5uaW5nIHRoZSBleGVjdXRhYmxlLiBUaGUgc3Vj Y2VzcyBhdWRpdCBldmVudAogIHNob3VsZCBiZSBhIG1hdGNoIGFnYWluc3QgdGhpcyBydWxlOgoK ICAgIG9wPUVYRUNVVEUgZG12ZXJpdHlfcm9vdGhhc2g9JG91dHB1dF9yaCBhY3Rpb249QUxMT1cK CmRtdmVyaXR5X3NpZ25hdHVyZToKCiAgRm9sbG93IHRoZSBzZXR1cCBzdGVwcyBmb3IgZG12ZXJp dHlfcm9vdGhhc2guIFNpZ24gdGhlIHJvb3RoYXNoIHZpYToKCiAgICBvcGVuc3NsIHNtaW1lIC1z aWduIC1pbiAib3V0cHV0LnJvb3RoYXNoIiAtc2lnbmVyICIkTVlfQ0VSVElGSUNBVEUiIFwKICAg ICAgLWlua2V5ICIkTVlfUFJJVkFURV9LRVkiIC1iaW5hcnkgLW91dGZvcm0gZGVyIC1ub2F0dHIg XAogICAgICAtb3V0ICJvdXRwdXQucDdzIgoKICAgIENyZWF0ZSBhIHBvbGljeToKCiAgICAgIHBv bGljeV9uYW1lPSJ2ZXJpZmllZCIgcG9saWN5X3ZlcnNpb249MC4wLjAKICAgICAgREVGQVVMVCBh Y3Rpb249REVOWQoKICAgICAgb3A9RVhFQ1VURSBib290X3ZlcmlmaWVkPVRSVUUgYWN0aW9uPUFM TE9XCiAgICAgIG9wPUVYRUNVVEUgZG12ZXJpdHlfdmVyaWZpZWQ9VFJVRSBhY3Rpb249QUxMT1cK CiAgRGVwbG95IHRoZSBwb2xpY3ksIGFuZCBtYXJrIGFzIGFjdGl2ZSwgcGVyIHRoZSAiRGVwbG95 aW5nIFBvbGljaWVzIgogIHNlY3Rpb24gb2YgdGhpcyBjb3ZlciBsZXR0ZXIuIE1vdW50IHRoZSBk bS12ZXJpdHkgdm9sdW1lIHdpdGgKICB2ZXJpZmljYXRpb246CgogICAgdmVyaXR5c2V0dXAgb3Bl biBvdXRwdXQuc3F1YXNoZnMgb3V0cHV0Lmhhc2h0cmVlIHVudmVyaWZpZWQgXAogICAgICBgY2F0 IG91dHB1dC5yb290aGFzaGAgLS1yb290LWhhc2gtc2lnbmF0dXJlPW91dHB1dC5wN3MKCiAgICBt b3VudCAvZGV2L21hcHBlci91bnZlcmlmaWVkIC9teS9tb3VudC9wb2ludAoKICBOT1RFOiBUaGUg LS1yb290LWhhc2gtc2lnbmF0dXJlIG9wdGlvbiB3YXMgaW50cm9kdWNlZCBpbiB2ZXJpdHlzZXR1 cAogIDIuMy4wCgogIFR1cm4gb24gc3VjY2VzcyBhdWRpdGluZyBhbmQgYXR0ZW1wdCB0byBleGVj dXRlIGEgYmluYXJ5IGluIHRoZSBtb3VudAogIHBvaW50LCBhbmQgaXQgc2hvdWxkIGVtaXQgYW4g YXVkaXQgZXZlbnQgZm9yIGEgbWF0Y2ggYWdhaW5zdCB0aGUgcnVsZToKCiAgICBvcD1FWEVDVVRF IGRtdmVyaXR5X3ZlcmlmaWVkPVRSVUUgYWN0aW9uPUFMTE9XCgogIFRvIHRlc3QgZGVuaWFscywg bW91bnQgdGhlIGRtLXZlcml0eSB2b2x1bWUgdGhlIHNhbWUgd2F5IGFzIHRoZQogICJkbXZlcml0 eV9yb290aGFzaCIgc2VjdGlvbiwgYW5kIGF0dGVtcHQgdG8gZXhlY3V0ZSBhIGJpbmFyeS4gRmFp bHVyZQogIHNob3VsZCBvY2N1ci4KCkRvY3VtZW50YXRpb246Ci0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLQoKRnVsbCBkb2N1bWVudGF0aW9uIGlzIGF2YWlsYWJsZSBvbiBnaXRo dWIgaW4gSVBFJ3MgbWFzdGVyIHJlcG9zaXRvcnkKKEFwcGVuZGl4IEEpLiBUaGlzIGlzIGludGVu ZGVkIHRvIGJlIGFuIGV4aGF1c3RpdmUgc291cmNlIG9mIGRvY3VtZW50YXRpb24KYXJvdW5kIElQ RS4KCkFkZGl0aW9uYWxseSwgdGhlcmUgaXMgaGlnaGVyIGxldmVsIGRvY3VtZW50YXRpb24gaW4g dGhlIGFkbWluLWd1aWRlLgoKVGVjaG5pY2FsIGRpYWdyYW1zIGFyZSBhdmFpbGFibGUgaGVyZToK CiAgaHR0cDovL21pY3Jvc29mdC5naXRodWIuaW8vaXBlL3RlY2huaWNhbC9kaWFncmFtcy8KCktu b3duIEdhcHM6Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIGhhcyB0 d28ga25vd24gZ2FwczoKCjEuIElQRSBjYW5ub3QgdmVyaWZ5IHRoZSBpbnRlZ3JpdHkgb2YgYW5v bnltb3VzIGV4ZWN1dGFibGUgbWVtb3J5LCBzdWNoIGFzCiAgdGhlIHRyYW1wb2xpbmVzIGNyZWF0 ZWQgYnkgZ2NjIGNsb3N1cmVzIGFuZCBsaWJmZmksIG9yIEpJVCdkIGNvZGUuCiAgVW5mb3J0dW5h dGVseSwgYXMgdGhpcyBpcyBkeW5hbWljYWxseSBnZW5lcmF0ZWQgY29kZSwgdGhlcmUgaXMgbm8g d2F5IGZvcgogIElQRSB0byBkZXRlY3QgdGhhdCB0aGlzIGNvZGUgaGFzIG5vdCBiZWVuIHRhbXBl cmVkIHdpdGggaW4gdHJhbnNpdGlvbgogIGZyb20gd2hlcmUgaXQgd2FzIGJ1aWx0LCB0byB3aGVy ZSBpdCBpcyBydW5uaW5nLiBBcyBhIHJlc3VsdCwgSVBFIGlzCiAgaW5jYXBhYmxlIG9mIHRhY2ts aW5nIHRoaXMgcHJvYmxlbSBmb3IgZHluYW1pY2FsbHkgZ2VuZXJhdGVkIGNvZGUuCiAgSG93ZXZl ciwgdGhlcmUgaXMgYSBwYXRjaCBzZXJpZXMgYmVpbmcgcHJlcGFyZWQgdGhhdCBhZGRyZXNzZXMg dGhpcwogIHByb2JsZW0gZm9yIGxpYmZmaSBhbmQgZ2NjIGNsb3N1cmVzIGJ5IGltcGxlbWV0aW5n IGEgc2FmZXIga2VybmVsCiAgdHJhbXBvbGluZSBBUEkuIAoKMi4gSVBFIGNhbm5vdCB2ZXJpZnkg dGhlIGludGVncml0eSBvZiBpbnRlcnByZXRlZCBsYW5ndWFnZXMnIHByb2dyYW1zIHdoZW4KICB0 aGVzZSBzY3JpcHRzIGludm9rZWQgdmlhIGA8aW50ZXJwcmV0ZXI+IDxmaWxlPmAuIFRoaXMgaXMg YmVjYXVzZSB0aGUgd2F5CiAgaW50ZXJwcmV0ZXJzIGV4ZWN1dGUgdGhlc2UgZmlsZXMsIHRoZSBz Y3JpcHRzIHRoZW1zZWx2ZXMgYXJlIG5vdAogIGV2YWx1YXRlZCBhcyBleGVjdXRhYmxlIGNvZGUg dGhyb3VnaCBvbmUgb2YgSVBFJ3MgaG9va3MuIEludGVycHJldGVycwogIGNhbiBiZSBlbmxpZ2h0 ZW5lZCB0byB0aGUgdXNhZ2Ugb2YgSVBFIGJ5IHRyeWluZyB0byBtbWFwIGEgZmlsZSBpbnRvCiAg ZXhlY3V0YWJsZSBtZW1vcnkgKCtYKSwgYWZ0ZXIgb3BlbmluZyB0aGUgZmlsZSBhbmQgcmVzcG9u ZGluZyB0byB0aGUKICBlcnJvciBjb2RlIGFwcHJvcHJpYXRlbHkuIFRoaXMgYWxzbyBhcHBsaWVz IHRvIGluY2x1ZGVkIGZpbGVzLCBvciBoaWdoCiAgdmFsdWUgZmlsZXMsIHN1Y2ggYXMgY29uZmln dXJhdGlvbiBmaWxlcyBvZiBjcml0aWNhbCBzeXN0ZW0gY29tcG9uZW50cy4KICBUaGlzIHNwZWNp ZmljIGdhcCBpcyBwbGFubmVkIG9uIGJlaW5nIGFkZHJlc3NlZCB3aXRoaW4gSVBFLiBGb3IgbW9y ZQogIGluZm9ybWF0aW9uIG9uIGhvdyB3ZSBwbGFuIHRvIGFkZHJlc3MgdGhpcyBnYXAsIHBsZWFz ZSBzZWUgdGhlIEZ1dHVyZQogIERldmVsb3BtZW50IHNlY3Rpb24sIGJlbG93LgoKRnV0dXJlIERl dmVsb3BtZW50OgotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KClN1cHBvcnQg Zm9yIGZpbHRlcmluZyBzaWduYXR1cmVzIGJ5IHNwZWNpZmljIGNlcnRpZmljYXRlcy4gSW4gdGhp cyBjYXNlLApvdXIgImRtdmVyaXR5X3NpZ25hdHVyZSIgKG9yIGEgc2VwYXJhdGUgcHJvcGVydHkp IGNhbiBiZSBzZXQgdG8gYQpzcGVjaWZpYyBjZXJ0aWZpY2F0ZSBkZWNsYXJlZCBpbiBJUEUncyBw b2xpY3ksIGFsbG93aW5nIGZvciBtb3JlCmNvbnRyb2xsZWQgdXNlLWNhc2VzIGRldGVybWluZSBi eSBhIHVzZXIncyBQS0kgc3RydWN0dXJlLgoKU3VwcG9ydCBmb3IgaW50ZWdyaXR5IHZlcmlmaWNh dGlvbiBmb3IgZ2VuZXJhbCBmaWxlIHJlYWRzLiBUaGlzIGFkZHJlc3Nlcwp0aGUgc2NyaXB0IGlu dGVycHJldGVyIGlzc3VlIGluZGljYXRlZCBpbiB0aGUgIktub3duIEdhcHMiIHNlY3Rpb24sIGFz CnRoZXNlIHNjcmlwdCBmaWxlcyBhcmUgdHlwaWNhbGx5IG9wZW5lZCB3aXRoIE9fUkRPTkxZLiBX ZSBhcmUgZXZhbHVhdGluZwp3aGV0aGVyIHRvIGRvIHRoaXMgYnkgY29tcGFyaW5nIHRoZSBvcmln aW5hbCB1c2VybGFuZCBmaWxlcGF0aCBwYXNzZWQgaW50bwp0aGUgb3BlbiBzeXNjYWxsLCB0aGVy ZWJ5IGFsbG93aW5nIGV4aXN0aW5nIGNhbGxlcnMgdG8gdGFrZSBhZHZhbnRhZ2UKd2l0aG91dCBh bnkgY29kZSBjaGFuZ2VzOyB0aGUgYWx0ZXJuYXRlIGRlc2lnbiBpcyB0byBleHRlbmQgdGhlIG5l dwpvcGVuYXQyKDIpIHN5c2NhbGwsIHdpdGggYW4gbmV3IGZsYWcsIHRlbnRhdGl2ZWx5IGNhbGxl ZCAiT19WRVJJRlkiLiBXaGlsZQp0aGUgc2Vjb25kIG9wdGlvbiByZXF1aXJlcyBhIGNvZGUgY2hh bmdlIGZvciBhbGwgdGhlIGludGVycHJldGVycywKZnJhbWV3b3JrcyBhbmQgbGFuZ3VhZ2VzIHRo YXQgd2lzaCB0byBsZXZlcmFnZSBpdCwgaXQgaXMgYSB3aG9sbHkgY2xlYW5lcgppbXBsZW1lbnRh dGlvbiBpbiB0aGUga2VybmVsLiBGb3IgaW50ZXJwcmV0ZXJzIHNwZWNpZmljYWxseSwgdGhlIE9f TUFZRVhFQwpwYXRjaCBzZXJpZXMgcHVibGlzaGVkIGJ5IE1pY2thw4PCq2wgU2FsYcODwrxuWzFd IGlzIGEgc2ltaWxhciBpbXBsZW1lbnRhdGlvbgp0byB0aGUgT19WRVJJRlkgaWRlYSBkZXNjcmli ZWQgYWJvdmUuCgpPbmJvYXJkaW5nIElQRSdzIHRlc3Qgc3VpdGUgdG8gS2VybmVsQ0kuIEN1cnJl bnRseSB3ZSBhcmUgZGV2ZWxvcGluZyBhCnRlc3Qgc3VpdGUgaW4gdGhlIHNhbWUgdmVpbiBhcyBT RUxpbnV4J3MgdGVzdCBzdWl0ZS4gT25jZSBkZXZlbG9wbWVudApvZiB0aGUgdGVzdCBzdWl0ZSBp cyBjb21wbGV0ZSwgYW5kIHByb3ZpZGVkIElQRSBpcyBhY2NlcHRlZCwgd2UgaW50ZW5kCnRvIG9u Ym9hcmQgdGhpcyB0ZXN0IHN1aXRlIG9udG8gS2VybmVsQ0kuCgpIYXJkZW5lZCByZXNpc3RhbmNl IGFnYWluc3Qgcm9sbC1iYWNrIGF0dGFja3MuIEN1cnJlbnRseSB0aGVyZSBleGlzdHMgYQp3aW5k b3cgb2Ygb3Bwb3J0dW5pdHkgYmV0d2VlbiB1c2VyLW1vZGUgc2V0dXAgYW5kIHRoZSB1c2VyLXBv bGljeSBiZWluZwpkZXBsb3llZCwgd2hlcmUgYSBwcmlvciB1c2VyLXBvbGljeSBjYW4gYmUgbG9h ZGVkLCB0aGF0IGlzIHBvdGVudGlhbGx5Cmluc2VjdXJlLiBIb3dldmVyLCB3aXRoIGEga2VybmVs IHVwZGF0ZSwgeW91IGNhbiByZXZpc2UgdGhlIGJvb3QgcG9saWN5J3MKdmVyc2lvbiB0byBiZSB0 aGUgc2FtZSB2ZXJzaW9uIGFzIHRoZSBsYXRlc3QgcG9saWN5LCBjbG9zaW5nIHRoaXMgd2luZG93 LgpJbiB0aGUgZnV0dXJlLCBJIHdvdWxkIGxpa2UgdG8gY2xvc2UgdGhpcyB3aW5kb3cgb2Ygb3Bw b3J0dW5pdHkgd2l0aG91dAphIGtlcm5lbCB1cGRhdGUsIHVzaW5nIHNvbWUgcGVyc2lzdGVudCBz dG9yYWdlIG1lY2hhbmlzbS4KCk9wZW4gSXNzdWVzOgotLS0tLS0tLS0tLS0KCkZvciBsaW51eC1h dWRpdC9pbnRlZ3JpdHkgZm9sa3M6CjEuIEludHJvZHVjdGlvbiBvZiBuZXcgYXVkaXQgZGVmaW5p dGlvbnMgaW4gdGhlIGtlcm5lbCBpbnRlZ3JpdHkgcmFuZ2UgLSBpcwogIHRoaXMgcHJlZmVycmVk LCBhcyBvcHBvc2VkIHRvIHJldXNpbmcgZGVmaW5pdGlvbnMgd2l0aCBleGlzdGluZyBJTUEKICBk ZWZpbml0aW9ucz8KClRPRE9zOgotLS0tLS0KCmxpbnV4LWF1ZGl0IGNoYW5nZXMgdG8gc3VwcG9y dCB0aGUgbmV3IGF1ZGl0IGV2ZW50cy4KCgpBcHBlbmRpeDoKLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tCgpBLiBJUEUgR2l0aHViIFJlcG9zaXRvcnk6IGh0dHBzOi8vZ2l0aHVi LmNvbS9taWNyb3NvZnQvaXBlCiAgIEhvc3RlZCBEb2N1bWVudGF0aW9uOiBodHRwczovL21pY3Jv c29mdC5naXRodWIuaW8vaXBlCkIuIElQRSBVc2VycycgR3VpZGU6IERvY3VtZW50YXRpb24vYWRt aW4tZ3VpZGUvTFNNL2lwZS5yc3QKQy4gSVBFIFRlc3QgU3VpdGU6ICpUQkEqICh1bmRlciBkZXZl bG9wbWVudCkKClJlZmVyZW5jZXM6Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LQoKMS4gaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcvbGludXgtaW50ZWdyaXR5LzIwMjAwNTA1MTUz MTU2LjkyNTExMS0xLW1pY0BkaWdpa29kLm5ldC8KCkNoYW5nZWxvZzoKLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tCgp2MTogSW50cm9kdWNlZAoKdjI6CiAgU3BsaXQgdGhlIHNl Y29uZCBwYXRjaCBvZiB0aGUgcHJldmlvdXMgc2VyaWVzIGludG8gdHdvLgogIE1pbm9yIGNvcnJl Y3Rpb25zIGluIHRoZSBjb3Zlci1sZXR0ZXIgYW5kIGRvY3VtZW50YXRpb24KICBjb21tZW50cyBy ZWdhcmRpbmcgQ0FQX01BQ19BRE1JTiBjaGVja3MgaW4gSVBFLgoKdjM6CiAgQWRkcmVzcyB2YXJp b3VzIGNvbW1lbnRzIGJ5IEphbm4gSG9ybi4gSGlnaGxpZ2h0czoKICAgIFN3aXRjaCB2YXJpb3Vz IGF1ZGl0IGFsbG9jYXRvcnMgdG8gR0ZQX0tFUk5FTC4KICAgIFV0aWxpemUgcmN1X2FjY2Vzc19w b2ludGVyKCkgaW4gdmFyaW91cyBsb2NhdGlvbnMuCiAgICBTdHJpcCBvdXQgdGhlIGNhY2hpbmcg c3lzdGVtIGZvciBwcm9wZXJ0aWVzCiAgICBTdHJpcCBjb21tZW50cyBmcm9tIGhlYWRlcnMKICAg IE1vdmUgZnVuY3Rpb25zIGFyb3VuZCBpbiBwYXRjaGVzCiAgICBSZW1vdmUga2VybmVsIGNvbW1h bmQgbGluZSBwYXJhbWV0ZXJzCiAgICBSZWNvbmNpbGUgdGhlIHJhY2UgY29uZGl0aW9uIG9uIHRo ZSBkZWxldGUgbm9kZSBmb3IgcG9saWN5IGJ5CiAgICAgIGV4cGFuZGluZyB0aGUgcG9saWN5IGNy aXRpY2FsIHNlY3Rpb24uCgogIEFkZHJlc3MgYSBmZXcgY29tbWVudHMgYnkgSm9uYXRoYW4gQ29y YmV0IGFyb3VuZCB0aGUgZG9jdW1lbnRhdGlvbgogICAgcGFnZXMgZm9yIElQRS4KCiAgRml4IGFu IGlzc3VlIHdpdGggdGhlIGluaXRpYWxpemF0aW9uIG9mIElQRSBwb2xpY3kgd2l0aCBhICItMCIK ICAgIHZlcnNpb24sIGNhdXNlZCBieSBub3QgaW5pdGlhbGl6aW5nIHRoZSBobGlzdCBlbnRyaWVz IGJlZm9yZQogICAgZnJlZWluZy4KCnY0OgogIEFkZHJlc3MgYSBjb25jZXJuIGFyb3VuZCBJUEUn cyBiZWhhdmlvciB3aXRoIHVua25vd24gc3ludGF4LgogICAgU3BlY2lmaWNhbGx5LCBtYWtlIGFu eSB1bmtub3duIHN5bnRheCBhIGZhdGFsIGVycm9yIGluc3RlYWQgb2YgYQogICAgd2FybmluZywg YXMgc3VnZ2VzdGVkIGJ5IE1pY2thw6tsIFNhbGHDvG4uCiAgSW50cm9kdWNlIGEgbmV3IHNlY3Vy aXR5ZnMgbm9kZSwgJHNlY3VyaXR5ZnMvaXBlL3Byb3BlcnR5X2NvbmZpZywKICAgIHdoaWNoIHBy b3ZpZGVzIGEgbGlzdGluZyBvZiB3aGF0IHByb3BlcnRpZXMgYXJlIGVuYWJsZWQgYnkgdGhlCiAg ICBrZXJuZWwgYW5kIHRoZWlyIHZlcnNpb25zLiBUaGlzIGFsbG93cyB1c2VybW9kZSB0byBwcmVk aWN0IHdoYXQKICAgIHBvbGljaWVzIHNob3VsZCBiZSBhbGxvd2VkLgogIFN0cmlwIHNvbWUgY29t bWVudHMgZnJvbSBjIGZpbGVzIHRoYXQgSSBtaXNzZWQuCiAgQ2xhcmlmeSBzb21lIGRvY3VtZW50 YXRpb24gY29tbWVudHMgYXJvdW5kICdib290X3ZlcmlmaWVkJy4KICAgIFdoaWxlIHRoaXMgY3Vy cmVudGx5IGRvZXMgbm90IGZ1bmN0aW9uYWxseSBjaGFuZ2UgdGhlIHByb3BlcnR5CiAgICBpdHNl bGYsIHRoZSBkaXN0aW5jdGlvbiBpcyBpbXBvcnRhbnQgd2hlbiBJUEUgY2FuIGVuZm9yY2UgdmVy aWZpZWQKICAgIHJlYWRzLiBBZGRpdGlvbmFsbHksICdLRVJORUxfUkVBRCcgd2FzIG9taXR0ZWQg ZnJvbSB0aGUgZG9jdW1lbnRhdGlvbi4KICAgIFRoaXMgaGFzIGJlZW4gY29ycmVjdGVkLgogIENo YW5nZSBTZWN1cml0eUZTIGFuZCBTSEExIHRvIGEgcmV2ZXJzZSBkZXBlbmRlbmN5LgogIFVwZGF0 ZSB0aGUgY292ZXItbGV0dGVyIHdpdGggdGhlIHVwZGF0ZWQgYmVoYXZpb3Igb2YgdW5rbm93biBz eW50YXguCiAgUmVtb3ZlIGFsbCBzeXNjdGxzLCBtYWtpbmcgYW4gZXF1aXZhbGVudCBmdW5jdGlv biBpbiBzZWN1cml0eWZzLgogIFJld29yayB0aGUgYWN0aXZlL2RlbGV0ZSBtZWNoYW5pc20gdG8g YmUgYSBub2RlIHVuZGVyIHRoZSBwb2xpY3kgaW4KICAgICRzZWN1cml0eWZzL2lwZS9wb2xpY2ll cy4KICBUaGUga2VybmVsIGNvbW1hbmQgbGluZSBwYXJhbWV0ZXJzIGlwZS5lbmZvcmNlIGFuZCBp cGUuc3VjY2Vzc19hdWRpdAogICAgaGF2ZSByZXR1cm5lZCBhcyB0aGlzIGZ1bmN0aW9uYWxpdHkg aXMgbm8gbG9uZ2VyIGV4cG9zZWQgdGhyb3VnaAogICAgc3lzZnMuCgp2NToKICBDb3JyZWN0IHNv bWUgZ3JhbW1hdGljYWwgZXJyb3JzIHJlcG9ydGVkIGJ5IFJhbmR5IER1bmxhcC4KICBGaXggc29t ZSB3YXJuaW5ncyByZXBvcnRlZCBieSBrZXJuZWwgdGVzdCBib3QuCiAgQ2hhbmdlIGNvbnZlbnRp b24gYXJvdW5kIHNlY3VyaXR5X2JkZXZfc2V0c2VjdXJpdHkuIC1FTk9TWVMKICAgIGlzIG5vdyBl eHBlY3RlZCBpZiBhbiBMU00gZG9lcyBub3QgaW1wbGVtZW50IGEgcGFydGljdWxhciBAbmFtZSwK ICAgIGFzIHN1Z2dlc3RlZCBieSBDYXNleSBTY2hhdWZsZXIuCiAgTWlub3Igc3RyaW5nIGNvcnJl Y3Rpb25zIHJlbGF0ZWQgdG8gdGhlIG1vdmUgZnJvbSBzeXNmcyB0byBzZWN1cml0eWZzCiAgQ29y cmVjdCBhIHNwZWxsaW5nIG9mIGFuICNpZmRlZiBmb3IgdGhlIHBlcm1pc3NpdmUgYXJndW1lbnQu CiAgQWRkIHRoZSBrZXJuZWwgcGFyYW1ldGVycyByZS1hZGRlZCB0byB0aGUgZG9jdW1lbnRhdGlv bi5JbnRlZ3JpdHkgUG9saWN5IEVuZm9yY2VtZW50IExTTSAoSVBFKQoKT3ZlcnZpZXc6Ci0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIGlzIGEgTGludXggU2VjdXJpdHkg TW9kdWxlIHdoaWNoIGFsbG93cyBmb3IgYSBjb25maWd1cmFibGUKcG9saWN5IHRvIGVuZm9yY2Ug aW50ZWdyaXR5IHJlcXVpcmVtZW50cyBvbiB0aGUgd2hvbGUgc3lzdGVtLiBJdAphdHRlbXB0cyB0 byBzb2x2ZSB0aGUgaXNzdWUgb2YgQ29kZSBJbnRlZ3JpdHk6IHRoYXQgYW55IGNvZGUgYmVpbmcK ZXhlY3V0ZWQgKG9yIGZpbGVzIGJlaW5nIHJlYWQpLCBhcmUgaWRlbnRpY2FsIHRvIHRoZSB2ZXJz aW9uIHRoYXQKd2FzIGJ1aWx0IGJ5IGEgdHJ1c3RlZCBzb3VyY2UuCgpUaGUgdHlwZSBvZiBzeXN0 ZW0gZm9yIHdoaWNoIElQRSBpcyBkZXNpZ25lZCBmb3IgdXNlIGlzIGFuIGVtYmVkZGVkIGRldmlj ZQp3aXRoIGEgc3BlY2lmaWMgcHVycG9zZSAoZS5nLiBuZXR3b3JrIGZpcmV3YWxsIGRldmljZSBp biBhIGRhdGEgY2VudGVyKSwKd2hlcmUgYWxsIHNvZnR3YXJlIGFuZCBjb25maWd1cmF0aW9uIGlz IGJ1aWx0IGFuZCBwcm92aXNpb25lZCBieSB0aGUgb3duZXIuCgpTcGVjaWZpY2FsbHksIGEgc3lz dGVtIHdoaWNoIGxldmVyYWdlcyBJUEUgaXMgbm90IGludGVuZGVkIGZvciBnZW5lcmFsCnB1cnBv c2UgY29tcHV0aW5nIGFuZCBkb2VzIG5vdCB1dGlsaXplIGFueSBzb2Z0d2FyZSBvciBjb25maWd1 cmF0aW9uCmJ1aWx0IGJ5IGEgdGhpcmQgcGFydHkuIEFuIGlkZWFsIHN5c3RlbSB0byBsZXZlcmFn ZSBJUEUgaGFzIGJvdGggbXV0YWJsZQphbmQgaW1tdXRhYmxlIGNvbXBvbmVudHMsIGhvd2V2ZXIs IGFsbCBiaW5hcnkgZXhlY3V0YWJsZSBjb2RlIGlzIGltbXV0YWJsZS4KClRoZSBzY29wZSBvZiBJ UEUgaXMgY29uc3RyYWluZWQgdG8gdGhlIE9TLiBJdCBpcyBhc3N1bWVkIHRoYXQgcGxhdGZvcm0K ZmlybXdhcmUgdmVyaWZpZXMgdGhlIHRoZSBrZXJuZWwgYW5kIG9wdGlvbmFsbHkgdGhlIHJvb3Qg ZmlsZXN5c3RlbSAoZS5nLgp2aWEgVS1Cb290IHZlcmlmaWVkIGJvb3QpLiBJUEUgdGhlbiB1dGls aXplcyBMU00gaG9va3MgdG8gZW5mb3JjZSBhCmZsZXhpYmxlLCBrZXJuZWwtcmVzaWRlbnQgaW50 ZWdyaXR5IHZlcmlmaWNhdGlvbiBwb2xpY3kuCgpJUEUgZGlmZmVycyBmcm9tIG90aGVyIExTTXMg d2hpY2ggcHJvdmlkZSBpbnRlZ3JpdHkgY2hlY2tpbmcgKGZvciBpbnN0YW5jZSwKSU1BKSwgYXMg aXQgaGFzIG5vIGRlcGVuZGVuY3kgb24gdGhlIGZpbGVzeXN0ZW0gbWV0YWRhdGEgaXRzZWxmLiBU aGUKYXR0cmlidXRlcyB0aGF0IElQRSBjaGVja3MgYXJlIGRldGVybWluaXN0aWMgcHJvcGVydGll cyB0aGF0IGV4aXN0IHNvbGVseQppbiB0aGUga2VybmVsLiBBZGRpdGlvbmFsbHksIElQRSBwcm92 aWRlcyBubyBhZGRpdGlvbmFsIG1lY2hhbmlzbXMgb2YKdmVyaWZ5aW5nIHRoZXNlIGZpbGVzIChl LmcuIElNQSBTaWduYXR1cmVzKSAtIGFsbCBvZiB0aGUgYXR0cmlidXRlcyBvZgp2ZXJpZnlpbmcg ZmlsZXMgYXJlIGV4aXN0aW5nIGZlYXR1cmVzIHdpdGhpbiB0aGUga2VybmVsLCBzdWNoIGFzIGRt LXZlcml0eQpvciBmc3Zlcml0eS4KCklQRSBwcm92aWRlcyBhIHBvbGljeSB0aGF0IGFsbG93cyBv d25lcnMgb2YgdGhlIHN5c3RlbSB0byBlYXNpbHkgc3BlY2lmeQppbnRlZ3JpdHkgcmVxdWlyZW1l bnRzIGFuZCB1c2VzIGRtLXZlcml0eSBzaWduYXR1cmVzIHRvIHNpbXBsaWZ5IHRoZQphdXRoZW50 aWNhdGlvbiBvZiBhbGxvd2VkIG9iamVjdHMgbGlrZSBhdXRob3JpemVkIGNvZGUgYW5kIGRhdGEu CgpJUEUgc3VwcG9ydHMgdHdvIG1vZGVzLCBwZXJtaXNzaXZlIChzaW1pbGFyIHRvIFNFTGludXgn cyBwZXJtaXNzaXZlIG1vZGUpCmFuZCBlbmZvcmNlLiBQZXJtaXNzaXZlIG1vZGUgcGVyZm9ybXMg dGhlIHNhbWUgY2hlY2tzLCBhbmQgbG9ncyBwb2xpY3kKdmlvbGF0aW9ucyBhcyBlbmZvcmNlIG1v ZGUsIGJ1dCB3aWxsIG5vdCBlbmZvcmNlIHRoZSBwb2xpY3kuIFRoaXMgYWxsb3dzCnVzZXJzIHRv IHRlc3QgcG9saWNpZXMgYmVmb3JlIGVuZm9yY2luZyB0aGVtLgoKVGhlIGRlZmF1bHQgbW9kZSBp cyBlbmZvcmNlLCBhbmQgY2FuIGJlIGNoYW5nZWQgdmlhIHRoZSBrZXJuZWwgY29tbWFuZGxpbmUK cGFyYW1ldGVyIGBpcGUuZW5mb3JjZT0oMHwxKWAsIG9yIHRoZSBzZWN1cml0eWZzIG5vZGUKYC9z eXMva2VybmVsL3NlY3VyaXR5L2lwZS9lbmZvcmNlYC4gVGhlIGFiaWxpdHkgdG8gc3dpdGNoIG1v ZGVzIGNhbiBiZQpjb21waWxlZCBvdXQgb2YgdGhlIExTTSB2aWEgc2V0dGluZyB0aGUgY29uZmln CkNPTkZJR19TRUNVUklUWV9JUEVfUEVSTUlTU0lWRV9TV0lUQ0ggdG8gTi4KCklQRSBhZGRpdGlv bmFsbHkgc3VwcG9ydHMgc3VjY2VzcyBhdWRpdGluZy4gV2hlbiBlbmFibGVkLCBhbGwgZXZlbnRz CnRoYXQgcGFzcyBJUEUgcG9saWN5IGFuZCBhcmUgbm90IGJsb2NrZWQgd2lsbCBlbWl0IGFuIGF1 ZGl0IGV2ZW50LiBUaGlzCmlzIGRpc2FibGVkIGJ5IGRlZmF1bHQsIGFuZCBjYW4gYmUgZW5hYmxl ZCB2aWEgdGhlIGtlcm5lbCBjb21tYW5kbGluZQpgaXBlLnN1Y2Nlc3NfYXVkaXQ9KDB8MSlgIG9y IHRoZSBzZWN1cml0eWZzIG5vZGUKYC9zeXMva2VybmVsL3NlY3VyaXR5L2lwZS9zdWNjZXNzX2F1 ZGl0YC4KClBvbGljaWVzIGNhbiBiZSBzdGFnZWQgYXQgcnVudGltZSB0aHJvdWdoIHNlY3VyaXR5 ZnMgYW5kIGFjdGl2YXRlZCB0aHJvdWdoCnN5c2ZzLiBQbGVhc2Ugc2VlIHRoZSBEZXBsb3lpbmcg UG9saWNpZXMgc2VjdGlvbiBvZiB0aGlzIGNvdmVyIGxldHRlciBmb3IKbW9yZSBpbmZvcm1hdGlv bi4KClRoZSBJUEUgTFNNIGlzIGNvbXBpbGVkIHVuZGVyIENPTkZJR19TRUNVUklUWV9JUEUuCgpQ b2xpY3k6Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIHBvbGljeSBp cyBkZXNpZ25lZCB0byBiZSBib3RoIGZvcndhcmQgY29tcGF0aWJsZSBhbmQgYmFja3dhcmRzCmNv bXBhdGlibGUuIFRoZXJlIGlzIG9uZSByZXF1aXJlZCBsaW5lLCBhdCB0aGUgdG9wIG9mIHRoZSBw b2xpY3ksCmluZGljYXRpbmcgdGhlIHBvbGljeSBuYW1lLCBhbmQgdGhlIHBvbGljeSB2ZXJzaW9u LCBmb3IgaW5zdGFuY2U6CgogIHBvbGljeV9uYW1lPSJFeCBQb2xpY3kiIHBvbGljeV92ZXJzaW9u PTAuMC4wCgpUaGUgcG9saWN5IHZlcnNpb24gaW5kaWNhdGVzIHRoZSBjdXJyZW50IHZlcnNpb24g b2YgdGhlIHBvbGljeSAoTk9UIHRoZQpwb2xpY3kgc3ludGF4IHZlcnNpb24pLiBUaGlzIGlzIHVz ZWQgdG8gcHJldmVudCByb2xsLWJhY2sgb2YgcG9saWN5IHRvCnBvdGVudGlhbGx5IGluc2VjdXJl IHByZXZpb3VzIHZlcnNpb25zIG9mIHRoZSBwb2xpY3kuCgpUaGUgbmV4dCBwb3J0aW9uIG9mIElQ RSBwb2xpY3ksIGFyZSBydWxlcy4gUnVsZXMgYXJlIGZvcm1lZCBieSBrZXk9dmFsdWUKcGFpcnMs IGtub3duIGFzIHByb3BlcnRpZXMuIElQRSBydWxlcyByZXF1aXJlIHR3byBwcm9wZXJ0aWVzOiAi YWN0aW9uIiwKd2hpY2ggZGV0ZXJtaW5lcyB3aGF0IElQRSBkb2VzIHdoZW4gaXQgZW5jb3VudGVy cyBhIG1hdGNoIGFnYWluc3QgdGhlCnBvbGljeSwgYW5kICJvcCIsIHdoaWNoIGRldGVybWluZXMg d2hlbiB0aGF0IHJ1bGUgc2hvdWxkIGJlIGV2YWx1YXRlZC4KVGh1cywgYSBtaW5pbWFsIHJ1bGUg aXM6CgogIG9wPUVYRUNVVEUgYWN0aW9uPUFMTE9XCgpUaGlzIGV4YW1wbGUgd2lsbCBhbGxvdyBh bnkgZXhlY3V0aW9uLiBBZGRpdGlvbmFsIHByb3BlcnRpZXMgYXJlIHVzZWQgdG8KcmVzdHJpY3Qg YXR0cmlidXRlcyBhYm91dCB0aGUgZmlsZXMgYmVpbmcgZXZhbHVhdGVkLiBUaGVzZSBwcm9wZXJ0 aWVzIGFyZQppbnRlbmRlZCB0byBiZSBkZXRlcm1pbmlzdGljIGF0dHJpYnV0ZXMgdGhhdCBhcmUg cmVzaWRlbnQgaW4gdGhlIGtlcm5lbC4KQXZhaWxhYmxlIHByb3BlcnRpZXMgZm9yIElQRSBkZXNj cmliZWQgaW4gdGhlIHByb3BlcnRpZXMgc2VjdGlvbiBvZiB0aGlzCmNvdmVyLWxldHRlciwgdGhl IHJlcG9zaXRvcnkgYXZhaWxhYmxlIGluIEFwcGVuZGl4IEEsIGFuZCB0aGUga2VybmVsCmRvY3Vt ZW50YXRpb24gcGFnZS4KCk9yZGVyIGRvZXMgbm90IG1hdHRlciBmb3IgdGhlIHJ1bGUncyBwcm9w ZXJ0aWVzIC0gdGhleSBjYW4gYmUgbGlzdGVkIGluCmFueSBvcmRlciwgaG93ZXZlciBpdCBpcyBl bmNvdXJhZ2VkIHRvIGhhdmUgdGhlICJvcCIgcHJvcGVydHkgYmUgZmlyc3QsCmFuZCB0aGUgImFj dGlvbiIgcHJvcGVydHkgYmUgbGFzdCwgZm9yIHJlYWRhYmlsaXR5LgoKQWRkaXRpb25hbGx5LCBy dWxlcyBhcmUgZXZhbHVhdGVkIHRvcC10by1ib3R0b20uIEFzIGEgcmVzdWx0LCBhbnkKcmV2b2Nh dGlvbiBydWxlcywgb3IgZGVuaWVzIHNob3VsZCBiZSBwbGFjZWQgZWFybHkgaW4gdGhlIGZpbGUg dG8gZW5zdXJlCnRoYXQgdGhlc2UgcnVsZXMgYXJlIGV2YWx1YXRlZCBiZWZvcmUgYSBydWxlIHdp dGggImFjdGlvbj1BTExPVyIgaXMgaGl0LgoKQW55IHVua25vd24gc3ludGF4IGluIElQRSBwb2xp Y3kgd2lsbCByZXN1bHQgaW4gYSBmYXRhbCBlcnJvciB0byBwYXJzZQp0aGUgcG9saWN5LiBVc2Vy IG1vZGUgY2FuIGludGVycm9nYXRlIHRoZSBrZXJuZWwgdG8gdW5kZXJzdGFuZCB3aGF0CnByb3Bl cnRpZXMgYW5kIHRoZSBhc3NvY2lhdGVkIHZlcnNpb25zIHRocm91Z2ggdGhlIHNlY3VyaXR5ZnMg bm9kZSwKJHNlY3VyaXR5ZnMvaXBlL3Byb3BlcnR5X2NvbmZpZywgd2hpY2ggd2lsbCByZXR1cm4g YSBzdHJpbmcgb2YgZm9ybToKCiAga2V5MT12ZXJzaW9uMQogIGtleTI9dmVyc2lvbjIKICAuCiAg LgogIC4KICBrZXlOPXZlcnNpb25OCgpVc2VyLW1vZGUgc2hvdWxkIGNvcnJlbGF0ZSB0aGVzZSB2 ZXJzaW9ucyB3aXRoIHRoZSBzdXBwb3J0ZWQgdmFsdWVzCmlkZW50aWZpZWQgaW4gdGhlIGRvY3Vt ZW50YXRpb24gdG8gZGV0ZXJtaW5lIHdoZXRoZXIgYSBwb2xpY3kgc2hvdWxkCmJlIGFjY2VwdGVk IGJ5IHRoZSBzeXN0ZW0uCgpBZGRpdGlvbmFsbHksIGEgREVGQVVMVCBvcGVyYXRpb24gbXVzdCBi ZSBzZXQgZm9yIGFsbCB1bmRlcnN0b29kCm9wZXJhdGlvbnMgd2l0aGluIElQRS4gRm9yIHBvbGlj aWVzIHRvIHJlbWFpbiBjb21wbGV0ZWx5IGZvcndhcmRzCmNvbXBhdGlibGUsIGl0IGlzIHJlY29t bWVuZGVkIHRoYXQgdXNlcnMgYWRkIGEgIkRFRkFVTFQgYWN0aW9uPUFMTE9XIgphbmQgb3ZlcnJp ZGUgdGhlIGRlZmF1bHRzIG9uIGEgcGVyLW9wZXJhdGlvbiBiYXNpcy4KCkZvciBtb3JlIGluZm9y bWF0aW9uIGFib3V0IHRoZSBwb2xpY3kgc3ludGF4LCBwbGVhc2Ugc2VlIEFwcGVuZGl4IEEgb3IK dGhlIGtlcm5lbCBkb2N1bWVudGF0aW9uIHBhZ2UuCgpFYXJseSBVc2VybW9kZSBQcm90ZWN0aW9u OgotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIGNhbiBiZSBwcm92aWRlZCB3aXRoIGEg cG9saWN5IGF0IHN0YXJ0dXAgdG8gbG9hZCBhbmQgZW5mb3JjZS4KVGhpcyBpcyBpbnRlbmRlZCB0 byBiZSBhIG1pbmltYWwgcG9saWN5IHRvIGdldCB0aGUgc3lzdGVtIHRvIGEgc3RhdGUKd2hlcmUg dXNlcmxhbmQgaXMgc2V0dXAgYW5kIHJlYWR5IHRvIHJlY2VpdmUgY29tbWFuZHMsIGF0IHdoaWNo CnBvaW50IGEgcG9saWN5IGNhbiBiZSBkZXBsb3llZCB2aWEgc2VjdXJpdHlmcy4gVGhpcyAiYm9v dCBwb2xpY3kiIGNhbiBiZQpzcGVjaWZpZWQgdmlhIHRoZSBjb25maWcsIFNFQ1VSSVRZX0lQRV9C T09UX1BPTElDWSwgd2hpY2ggYWNjZXB0cyBhIHBhdGgKdG8gYSBwbGFpbi10ZXh0IHZlcnNpb24g b2YgdGhlIElQRSBwb2xpY3kgdG8gYXBwbHkuIFRoaXMgcG9saWN5IHdpbGwgYmUKY29tcGlsZWQg aW50byB0aGUga2VybmVsLiBJZiBub3Qgc3BlY2lmaWVkLCBJUEUgd2lsbCBiZSBkaXNhYmxlZCB1 bnRpbCBhCnBvbGljeSBpcyBkZXBsb3llZCBhbmQgYWN0aXZhdGVkIHRocm91Z2ggdGhlIG1ldGhv ZCBhYm92ZS4KClBvbGljeSBFeGFtcGxlczoKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tCgpBbGxvdyBhbGw6CgogIHBvbGljeV9uYW1lPSJBbGxvdyBBbGwiIHBvbGljeV92ZXJz aW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249QUxMT1cKCkFsbG93IG9ubHkgaW5pdGlhbCBzdXBl cmJsb2NrOgoKICBwb2xpY3lfbmFtZT0iQWxsb3cgQWxsIEluaXRpYWwgU0IiIHBvbGljeV92ZXJz aW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249REVOWQoKICBvcD1FWEVDVVRFIGJvb3RfdmVyaWZp ZWQ9VFJVRSBhY3Rpb249QUxMT1cKCkFsbG93IGFueSBzaWduZWQgZG0tdmVyaXR5IHZvbHVtZSBh bmQgdGhlIGluaXRpYWwgc3VwZXJibG9jazoKCiAgcG9saWN5X25hbWU9IkFsbG93U2lnbmVkQW5k SW5pdGlhbCIgcG9saWN5X3ZlcnNpb249MC4wLjAKICBERUZBVUxUIGFjdGlvbj1ERU5ZCgogIG9w PUVYRUNVVEUgYm9vdF92ZXJpZmllZD1UUlVFIGFjdGlvbj1BTExPVwogIG9wPUVYRUNVVEUgZG12 ZXJpdHlfc2lnbmF0dXJlPVRSVUUgYWN0aW9uPUFMTE9XCgpQcm9oaWJpdCBleGVjdXRpb24gZnJv bSBhIHNwZWNpZmljIGRtLXZlcml0eSB2b2x1bWU6CgogIHBvbGljeV9uYW1lPSJBbGxvd1NpZ25l ZEFuZEluaXRpYWwiIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249REVOWQoK ICBvcD1FWEVDVVRFIGRtdmVyaXR5X3Jvb3RoYXNoPTQwMWZjZWM1OTQ0ODIzYWUxMmY2MjcyNmU4 MTg0NDA3YTVmYTk1OTk3ODNmMDMwZGVjMTQ2OTM4IGFjdGlvbj1ERU5ZCiAgb3A9RVhFQ1VURSBi b290X3ZlcmlmaWVkPVRSVUUgYWN0aW9uPUFMTE9XCiAgb3A9RVhFQ1VURSBkbXZlcml0eV9zaWdu YXR1cmU9VFJVRSBhY3Rpb249QUxMT1cKCkFsbG93IG9ubHkgYSBzcGVjaWZpYyBkbS12ZXJpdHkg dm9sdW1lOgoKICBwb2xpY3lfbmFtZT0iQWxsb3dTaWduZWRBbmRJbml0aWFsIiBwb2xpY3lfdmVy c2lvbj0wLjAuMAogIERFRkFVTFQgYWN0aW9uPURFTlkKCiAgb3A9RVhFQ1VURSBkbXZlcml0eV9y b290aGFzaD00MDFmY2VjNTk0NDgyM2FlMTJmNjI3MjZlODE4NDQwN2E1ZmE5NTk5NzgzZjAzMGRl YzE0NjkzOCBhY3Rpb249QUxMT1cKCkRlcGxveWluZyBQb2xpY2llczoKLS0tLS0tLS0tLS0tLS0t LS0tLQoKRGVwbG95aW5nIHBvbGljaWVzIGlzIHNpbXBsZS4gRmlyc3Qgc2lnbiBhIHBsYWluIHRl eHQgcG9saWN5LCB3aXRoIGEKY2VydGlmaWNhdGUgdGhhdCBpcyBwcmVzZW50IGluIHRoZSBTWVNU RU1fVFJVU1RFRF9LRVlSSU5HIG9mIHlvdXIgdGVzdAptYWNoaW5lLiBUaHJvdWdoIG9wZW5zc2ws IHRoZSBzaWduaW5nIGNhbiBiZSBkb25lIHZpYToKCiAgb3BlbnNzbCBzbWltZSAtc2lnbiAtaW4g IiRNWV9QT0xJQ1kiIC1zaWduZXIgIiRNWV9DRVJUSUZJQ0FURSIgXAogICAgLWlua2V5ICIkTVlf UFJJVkFURV9LRVkiIC1iaW5hcnkgLW91dGZvcm0gZGVyIC1ub2F0dHIgLW5vZGV0YWNoIFwKICAg IC1vdXQgIiRNWV9QT0xJQ1kucDdzIgoKVGhlbiwgc2ltcGx5IGNhdCB0aGUgZmlsZSBpbnRvIHRo ZSBJUEUncyAibmV3X3BvbGljeSIgc2VjdXJpdHlmcyBub2RlOgoKICBjYXQgIiRNWV9QT0xJQ1ku cDdzIiA+IC9zeXMva2VybmVsL3NlY3VyaXR5L2lwZS9uZXdfcG9saWN5CgpUaGUgcG9saWN5IHNo b3VsZCBub3cgYmUgcHJlc2VudCB1bmRlciB0aGUgcG9saWNpZXMvIHN1YmRpcmVjdG9yeSwgdW5k ZXIKaXRzICJwb2xpY3lfbmFtZSIgYXR0cmlidXRlLgoKVGhlIHBvbGljeSBpcyBub3cgcHJlc2Vu dCBpbiB0aGUga2VybmVsIGFuZCBjYW4gYmUgbWFya2VkIGFzIGFjdGl2ZSwKdmlhIHRoZSBzeXNj dGwgImlwZS5hY3RpdmVfcG9saWN5IjoKCiAgZWNobyAtbiAxID4gIi9zeXMva2VybmVsL3NlY3Vy aXR5L2lwZS8kTVlfUE9MSUNZX05BTUUvYWN0aXZlIgoKVGhpcyB3aWxsIG5vdyBtYXJrIHRoZSBw b2xpY3kgYXMgYWN0aXZlIGFuZCB0aGUgc3lzdGVtIHdpbGwgYmUgZW5mb3JjaW5nCiRNWV9QT0xJ Q1lfTkFNRS4gQXQgYW55IHBvaW50IHRoZSBwb2xpY3kgY2FuIGJlIHVwZGF0ZWQgb24gdGhlIHBy b3Zpc2lvbgp0aGF0IHRoZSBwb2xpY3kgdmVyc2lvbiB0byBiZSBkZXBsb3llZCBpcyBncmVhdGVy IHRoYW4gb3IgZXF1YWwgdG8gdGhlCnJ1bm5pbmcgdmVyc2lvbiAodG8gcHJldmVudCByb2xsLWJh Y2sgYXR0YWNrcykuIFRoaXMgdXBkYXRlIGNhbiBiZSBkb25lCmJ5IHJlZGlyZWN0aW5nIHRoZSBm aWxlIGludG8gdGhlIHBvbGljeSdzICJyYXciIG5vZGUsIHVuZGVyIHRoZSBwb2xpY2llcwpzdWJk aXJlY3Rvcnk6CgogIGNhdCAiJE1ZX1VQREFURURfUE9MSUNZLnA3cyIgPiBcCiAgICAiL3N5cy9r ZXJuZWwvc2VjdXJpdHkvaXBlL3BvbGljaWVzLyRNWV9QT0xJQ1lfTkFNRS9yYXciCgpBZGRpdGlv bmFsbHksIHBvbGljaWVzIGNhbiBiZSBkZWxldGVkIHZpYSB0aGUgImRlbF9wb2xpY3kiIHNlY3Vy aXR5ZnMKbm9kZS4gU2ltcGx5IHdyaXRlIHRoZSBuYW1lIG9mIHRoZSBwb2xpY3kgdG8gYmUgZGVs ZXRlZCB0byB0aGF0IG5vZGU6CgogIGVjaG8gLW4gMSA+CiAgICAiL3N5cy9rZXJuZWwvc2VjdXJp dHkvaXBlL3BvbGljaWVzLyRNWV9QT0xJQ1lfTkFNRS9kZWxldGUiCgpUaGVyZSBhcmUgdHdvIHJl cXVpcmVtZW50cyB0byBkZWxldGUgcG9saWNpZXM6CgoxLiBUaGUgcG9saWN5IGJlaW5nIGRlbGV0 ZWQgbXVzdCBub3QgYmUgdGhlIGFjdGl2ZSBwb2xpY3kuCjIuIFRoZSBwb2xpY3kgYmVpbmcgZGVs ZXRlZCBtdXN0IG5vdCBiZSB0aGUgYm9vdCBwb2xpY3kuCgpJdCdzIGltcG9ydGFudCB0byBrbm93 IGFib3ZlIHRoYXQgdGhlICJlY2hvIiBjb21tYW5kIHdpbGwgYWRkIGEgbmV3bGluZQp0byB0aGUg ZW5kIG9mIHRoZSBpbnB1dCwgYW5kIHRoaXMgd2lsbCBiZSBjb25zaWRlcmVkIGFzIHBhcnQgb2Yg dGhlCmZpbGVuYW1lLiBZb3UgY2FuIHJlbW92ZSB0aGUgbmV3bGluZSB2aWEgdGhlIC1uIHBhcmFt ZXRlci4KCk5PVEU6IElmIGEgTUFDIExTTSBpcyBlbmFibGVkLCB0aGUgc2VjdXJpdHlmcyBjb21t YW5kcyB3aWxsIHJlcXVpcmUKQ0FQX01BQ19BRE1JTi4gVGhpcyBpcyBkdWUgdG8gc3lzZnMgc3Vw cG9ydGluZyBmaW5lLWdyYWluZWQgTUFDCmF0dHJpYnV0ZXMsIHdoaWxlIHNlY3VyaXR5ZnMgYXQg dGhlIGN1cnJlbnQgbW9tZW50IGRvZXMgbm90LgoKUHJvcGVydGllczoKLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tCgpUaGlzIGluaXRpYWwgcGF0Y2hzZXQgaW50cm9kdWNpbmcg SVBFIGFkZHMgdGhyZWUgcHJvcGVydGllczoKJ2Jvb3RfdmVyaWZpZWQnLCAnZG12ZXJpdHlfc2ln bmF0dXJlJyBhbmQgJ2RtdmVyaXR5X3Jvb3RoYXNoJy4KCmJvb3RfdmVyaWZpZWQgKENPTkZJR19J UEVfQk9PVF9QUk9QKToKICBUaGlzIHByb3BlcnR5IGNhbiBiZSB1dGlsaXplZCBmb3IgYXV0aG9y aXphdGlvbiBvZiB0aGUgZmlyc3QKICBzdXBlci1ibG9jayB0aGF0IGlzIG1vdW50ZWQgb24gdGhl IHN5c3RlbSwgd2hlcmUgSVBFIGF0dGVtcHRzCiAgdG8gZXZhbHVhdGUgYSBmaWxlLiBUeXBpY2Fs bHkgdGhpcyBpcyB1c2VkIGZvciBzeXN0ZW1zIHdpdGgKICBhbiBpbml0cmFtZnMgb3Igb3RoZXIg aW5pdGlhbCBkaXNrLCB3aGVyZSB0aGlzIGlzIHVubW91bnRlZCBiZWZvcmUKICB0aGUgc3lzdGVt IGJlY29tZXMgYXZhaWxhYmxlLCBhbmQgaXMgbm90IGNvdmVyZWQgYnkgYW55IG90aGVyIHByb3Bl cnR5LgogIFRoZSBmb3JtYXQgb2YgdGhpcyBwcm9wZXJ0eSBpczoKCiAgICBib290X3ZlcmlmaWVk PShUUlVFfEZBTFNFKQoKICBXQVJOSU5HOiBUaGlzIHByb3BlcnR5IHdpbGwgdHJ1c3QgYW55IGRp c2sgd2hlcmUgdGhlIGZpcnN0IElQRQogIGV2YWx1YXRpb24gb2NjdXJzLiBJZiB5b3UgZG8gbm90 IGhhdmUgYSBzdGFydHVwIGRpc2sgdGhhdCBpcwogIHVucGFja2VkIGFuZCB1bm1vdW50ZWQgKGxp a2UgaW5pdHJhbWZzKSwgdGhlbiBpdCB3aWxsIGF1dG9tYXRpY2FsbHkKICB0cnVzdCB0aGUgcm9v dCBmaWxlc3lzdGVtIGFuZCBwb3RlbnRpYWxseSBvdmVyYXV0aG9yaXplIHRoZSBlbnRpcmUKICBk aXNrLgoKZG12ZXJpdHlfcm9vdGhhc2ggKENPTkZJR19JUEVfRE1fVkVSSVRZX1JPT1RIQVNIKToK ICBUaGlzIHByb3BlcnR5IGNhbiBiZSB1dGlsaXplZCBmb3IgYXV0aG9yaXphdGlvbiBvciByZXZv Y2F0aW9uIG9mCiAgc3BlY2lmaWMgZG12ZXJpdHkgdm9sdW1lcywgaWRlbnRpZmllZCB2aWEgcm9v dCBoYXNoLiBJdCBoYXMgYQogIGRlcGVuZGVuY3kgb24gdGhlIERNX1ZFUklUWSBtb2R1bGUuIFRo ZSBmb3JtYXQgb2YgdGhpcyBwcm9wZXJ0eSBpczoKCiAgICBkbXZlcml0eV9yb290aGFzaD08SGFz aEhleERpZ2VzdD4KCmRtdmVyaXR5X3NpZ25hdHVyZSAoQ09ORklHX0lQRV9ETV9WRVJJVFlfU0lH TkFUVVJFKToKICBUaGlzIHByb3BlcnR5IGNhbiBiZSB1dGlsaXplZCBmb3IgYXV0aG9yaXphdGlv biBvZiBhbGwgZG0tdmVyaXR5CiAgdm9sdW1lcyB0aGF0IGhhdmUgYSBzaWduZWQgcm9vdGhhc2gg dGhhdCBjaGFpbnMgdG8gdGhlIHN5c3RlbQogIHRydXN0ZWQga2V5cmluZy4gSXQgaGFzIGEgZGVw ZW5kZW5jeSBvbiB0aGUKICBETV9WRVJJVFlfVkVSSUZZX1JPT1RIQVNIX1NJRyBjb25maWcuIFRo ZSBmb3JtYXQgb2YgdGhpcyBwcm9wZXJ0eSBpczoKCiAgICBkbXZlcml0eV9zaWduYXR1cmU9KFRS VUV8RkFMU0UpCgpUZXN0aW5nOgotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0K CkEgdGVzdCBzdWl0ZSBpcyBhdmFpbGFibGUgKEFwcGVuZGl4IEIpIGZvciBlYXNlIG9mIHVzZS4g Rm9yIG1hbnVhbAppbnN0cnVjdGlvbnM6CgpFbmFibGUgSVBFIHRocm91Z2ggdGhlIGZvbGxvd2lu ZyBLY29uZmlnczoKCiAgQ09ORklHX1NFQ1VSSVRZX0lQRT15CiAgQ09ORklHX1NFQ1VSSVRZX0lQ RV9CT09UX1BPTElDWT0iLi4vQWxsb3dBbGxJbml0aWFsU0IucG9sIgogIENPTkZJR19TRUNVUklU WV9JUEVfUEVSTUlTU0lWRV9TV0lUQ0g9eQogIENPTkZJR19JUEVfQk9PVF9QUk9QPXkKICBDT05G SUdfSVBFX0RNX1ZFUklUWV9ST09USEFTSD15CiAgQ09ORklHX0lQRV9ETV9WRVJJVFlfU0lHTkFU VVJFPXkKICBDT05GSUdfRE1fVkVSSVRZPXkKICBDT05GSUdfRE1fVkVSSVRZX1ZFUklGWV9ST09U SEFTSF9TSUc9eQogIENPTkZJR19TWVNURU1fVFJVU1RFRF9LRVlSSU5HPXkKICBDT05GSUdfU1lT VEVNX1RSVVNURURfS0VZUz0iL3BhdGgvdG8vbXkvY2VydC9saXN0LnBlbSIKClN0YXJ0IGEgdGVz dCBzeXN0ZW0sIHRoYXQgYm9vdHMgZGlyZWN0bHkgZnJvbSB0aGUgZmlsZXN5c3RlbSwgd2l0aG91 dAphbiBpbml0cmQuIEkgcmVjb21tZW5kIHRlc3RpbmcgaW4gcGVybWlzc2l2ZSBtb2RlIHVudGls IGFsbCB0ZXN0cwpwYXNzLCB0aGVuIHN3aXRjaCB0byBlbmZvcmNlIHRvIGVuc3VyZSBiZWhhdmlv ciByZW1haW5zIGlkZW50aWNhbC4KCmJvb3RfdmVyaWZpZWQ6CgogIElmIGJvb3RlZCBjb3JyZWN0 bHksIHRoZSBmaWxlc3lzdGVtIG1vdW50ZWQgb24gLyBzaG91bGQgYmUgbWFya2VkIGFzCiAgYm9v dF92ZXJpZmllZC4gVmVyaWZ5IGJ5IHR1cm5pbmcgb24gc3VjY2VzcyBhdWRpdGluZyAoc3lzY3Rs CiAgaXBlLnN1Y2Nlc3NfYXVkaXQ9MSksIGFuZCBydW4gYSBiaW5hcnkuIEluIHRoZSBhdWRpdCBv dXRwdXQsCiAgYHByb3BfYm9vdF92ZXJpZmllZGAgc2hvdWxkIGJlIGBUUlVFYC4KCiAgVG8gdGVz dCBkZW5pYWxzLCBtb3VudCBhIHRlbXBvcmFyeSBmaWxlc3lzdGVtIChtb3VudCAtdCB0bXBmcyAt bwogIHNpemU9NE0gdG1wIHRtcCksIGFuZCBjb3B5IGEgYmluYXJ5IChlLmcuIGxzKSB0byB0aGlz IG5ldwogIGZpbGVzeXN0ZW0uIERpc2FibGUgc3VjY2VzcyBhdWRpdGluZyBhbmQgYXR0ZW1wdCB0 byBydW4gdGhlIGZpbGUuCiAgVGhlIGZpbGUgc2hvdWxkIGhhdmUgYW4gYXVkaXQgZXZlbnQsIGJ1 dCBiZSBhbGxvd2VkIHRvIGV4ZWN1dGUgaW4KICBwZXJtaXNzaXZlIG1vZGUsIGFuZCBwcm9wX2Jv b3RfdmVyaWZpZWQgc2hvdWxkIGJlIEZBTFNFLgoKZG12ZXJpdHlfcm9vdGhhc2g6CgogIEZpcnN0 LCB5b3UgbXVzdCBjcmVhdGUgYSBkbS12ZXJpdHkgdm9sdW1lLiBUaGlzIGNhbiBiZSBkb25lIHRo cm91Z2gKICBzcXVhc2hmcy10b29scyBhbmQgdmVyaXR5c2V0dXAgKHByb3ZpZGVkIGJ5IGNyeXB0 c2V0dXApLgoKICBDcmVhdGluZyBhIHNxdWFzaGZzIHZvbHVtZToKCiAgICBta3NxdWFzaGZzIC9w YXRoL3RvL2RpcmVjdG9yeS93aXRoL2V4ZWN1dGFibGUgL3BhdGgvdG8vb3V0cHV0LnNxdWFzaGZz CgogIEZvcm1hdCB0aGUgdm9sdW1lIGZvciB1c2Ugd2l0aCBkbS12ZXJpdHkgJiBzYXZlIHRoZSBy b290IGhhc2g6CgogICAgb3V0cHV0X3JoPSQodmVyaXR5c2V0dXAgZm9ybWF0IG91dHB1dC5zcXVh c2hmcyBvdXRwdXQuaGFzaHRyZWUgfCBcCiAgICAgIHRlZSB2ZXJpdHlfb3V0LnR4dCB8IGF3ayAi L1Jvb3QgaGFzaC8iIHwgXAogICAgICBzZWQgLUUgInMvUm9vdCBoYXNoOlxzKy8vZyIpCgogICAg ZWNobyAtbiAkb3V0cHV0X3JoID4gb3V0cHV0LnJvb3RoYXNoCgogIENyZWF0ZSBhIHR3byBwb2xp Y2llcywgZmlsbGluZyBpbiB0aGUgYXBwcm9wcmlhdGUgZmllbGRzIGJlbG93OgoKICAgIFBvbGlj eSAxOgoKICAgICAgcG9saWN5X25hbWU9InJvb3RoYXNoLWRlbmlhbCIgcG9saWN5X3ZlcnNpb249 MC4wLjAKICAgICAgREVGQVVMVCBhY3Rpb249QUxMT1cKICAgICAgb3A9RVhFQ1VURSBkbXZlcml0 eV9yb290aGFzaD0kb3V0cHV0X3JoIGFjdGlvbj1ERU5ZCgogICAgUG9saWN5IDI6CgogICAgICBw b2xpY3lfbmFtZT0icm9vdGhhc2gtYWxsb3ciIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgICAgIERF RkFVTFQgYWN0aW9uPUFMTE9XCiAgICAgIERFRkFVTFQgb3A9RVhFQ1VURSBhY3Rpb249REVOWQoK ICAgICAgb3A9RVhFQ1VURSBib290X3ZlcmlmaWVkPVRSVUUgYWN0aW9uPUFMTE9XCiAgICAgIG9w PUVYRUNVVEUgZG12ZXJpdHlfcm9vdGhhc2g9JG91dHB1dF9yaCBhY3Rpb249QUxMT1cKCiAgRGVw bG95IGVhY2ggcG9saWN5LCB0aGVuIG1hcmsgdGhlIGZpcnN0LCAicm9vdGhhc2gtZGVuaWFsIiBh cyBhY3RpdmUsCiAgcGVyIHRoZSAiRGVwbG95aW5nIFBvbGljaWVzIiBzZWN0aW9uIG9mIHRoaXMg Y292ZXIgbGV0dGVyLiBNb3VudCB0aGUKICBkbS12ZXJpdHkgdm9sdW1lOgoKICAgIHZlcml0eXNl dHVwIG9wZW4gb3V0cHV0LnNxdWFzaGZzIG91dHB1dC5oYXNodHJlZSB1bnZlcmlmaWVkIFwKICAg ICAgYGNhdCBvdXRwdXQucm9vdGhhc2hgCgogICAgbW91bnQgL2Rldi9tYXBwZXIvdW52ZXJpZmll ZCAvbXkvbW91bnQvcG9pbnQKCiAgQXR0ZW1wdCB0byBleGVjdXRlIGEgYmluYXJ5IGluIHRoZSBt b3VudCBwb2ludCwgYW5kIGl0IHNob3VsZCBlbWl0IGFuCiAgYXVkaXQgZXZlbnQgZm9yIGEgbWF0 Y2ggYWdhaW5zdCB0aGUgcnVsZToKICAKICAgIG9wPUVYRUNVVEUgZG12ZXJpdHlfcm9vdGhhc2g9 JG91dHB1dF9yaCBhY3Rpb249REVOWQoKICBUbyB0ZXN0IHRoZSBzZWNvbmQgcG9saWN5LCBwZXJm b3JtIHRoZSBzYW1lIHN0ZXBzLCBidXQgdGhpcyB0aW1lLCBlbmFibGUKICBzdWNjZXNzIGF1ZGl0 aW5nIGJlZm9yZSBydW5uaW5nIHRoZSBleGVjdXRhYmxlLiBUaGUgc3VjY2VzcyBhdWRpdCBldmVu dAogIHNob3VsZCBiZSBhIG1hdGNoIGFnYWluc3QgdGhpcyBydWxlOgoKICAgIG9wPUVYRUNVVEUg ZG12ZXJpdHlfcm9vdGhhc2g9JG91dHB1dF9yaCBhY3Rpb249QUxMT1cKCmRtdmVyaXR5X3NpZ25h dHVyZToKCiAgRm9sbG93IHRoZSBzZXR1cCBzdGVwcyBmb3IgZG12ZXJpdHlfcm9vdGhhc2guIFNp Z24gdGhlIHJvb3RoYXNoIHZpYToKCiAgICBvcGVuc3NsIHNtaW1lIC1zaWduIC1pbiAib3V0cHV0 LnJvb3RoYXNoIiAtc2lnbmVyICIkTVlfQ0VSVElGSUNBVEUiIFwKICAgICAgLWlua2V5ICIkTVlf UFJJVkFURV9LRVkiIC1iaW5hcnkgLW91dGZvcm0gZGVyIC1ub2F0dHIgXAogICAgICAtb3V0ICJv dXRwdXQucDdzIgoKICAgIENyZWF0ZSBhIHBvbGljeToKCiAgICAgIHBvbGljeV9uYW1lPSJ2ZXJp ZmllZCIgcG9saWN5X3ZlcnNpb249MC4wLjAKICAgICAgREVGQVVMVCBhY3Rpb249REVOWQoKICAg ICAgb3A9RVhFQ1VURSBib290X3ZlcmlmaWVkPVRSVUUgYWN0aW9uPUFMTE9XCiAgICAgIG9wPUVY RUNVVEUgZG12ZXJpdHlfdmVyaWZpZWQ9VFJVRSBhY3Rpb249QUxMT1cKCiAgRGVwbG95IHRoZSBw b2xpY3ksIGFuZCBtYXJrIGFzIGFjdGl2ZSwgcGVyIHRoZSAiRGVwbG95aW5nIFBvbGljaWVzIgog IHNlY3Rpb24gb2YgdGhpcyBjb3ZlciBsZXR0ZXIuIE1vdW50IHRoZSBkbS12ZXJpdHkgdm9sdW1l IHdpdGgKICB2ZXJpZmljYXRpb246CgogICAgdmVyaXR5c2V0dXAgb3BlbiBvdXRwdXQuc3F1YXNo ZnMgb3V0cHV0Lmhhc2h0cmVlIHVudmVyaWZpZWQgXAogICAgICBgY2F0IG91dHB1dC5yb290aGFz aGAgLS1yb290LWhhc2gtc2lnbmF0dXJlPW91dHB1dC5wN3MKCiAgICBtb3VudCAvZGV2L21hcHBl ci91bnZlcmlmaWVkIC9teS9tb3VudC9wb2ludAoKICBOT1RFOiBUaGUgLS1yb290LWhhc2gtc2ln bmF0dXJlIG9wdGlvbiB3YXMgaW50cm9kdWNlZCBpbiB2ZXJpdHlzZXR1cAogIDIuMy4wCgogIFR1 cm4gb24gc3VjY2VzcyBhdWRpdGluZyBhbmQgYXR0ZW1wdCB0byBleGVjdXRlIGEgYmluYXJ5IGlu IHRoZSBtb3VudAogIHBvaW50LCBhbmQgaXQgc2hvdWxkIGVtaXQgYW4gYXVkaXQgZXZlbnQgZm9y IGEgbWF0Y2ggYWdhaW5zdCB0aGUgcnVsZToKCiAgICBvcD1FWEVDVVRFIGRtdmVyaXR5X3Zlcmlm aWVkPVRSVUUgYWN0aW9uPUFMTE9XCgogIFRvIHRlc3QgZGVuaWFscywgbW91bnQgdGhlIGRtLXZl cml0eSB2b2x1bWUgdGhlIHNhbWUgd2F5IGFzIHRoZQogICJkbXZlcml0eV9yb290aGFzaCIgc2Vj dGlvbiwgYW5kIGF0dGVtcHQgdG8gZXhlY3V0ZSBhIGJpbmFyeS4gRmFpbHVyZQogIHNob3VsZCBv Y2N1ci4KCkRvY3VtZW50YXRpb246Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LQoKRnVsbCBkb2N1bWVudGF0aW9uIGlzIGF2YWlsYWJsZSBvbiBnaXRodWIgaW4gSVBFJ3MgbWFz dGVyIHJlcG9zaXRvcnkKKEFwcGVuZGl4IEEpLiBUaGlzIGlzIGludGVuZGVkIHRvIGJlIGFuIGV4 aGF1c3RpdmUgc291cmNlIG9mIGRvY3VtZW50YXRpb24KYXJvdW5kIElQRS4KCkFkZGl0aW9uYWxs eSwgdGhlcmUgaXMgaGlnaGVyIGxldmVsIGRvY3VtZW50YXRpb24gaW4gdGhlIGFkbWluLWd1aWRl LgoKVGVjaG5pY2FsIGRpYWdyYW1zIGFyZSBhdmFpbGFibGUgaGVyZToKCiAgaHR0cDovL21pY3Jv c29mdC5naXRodWIuaW8vaXBlL3RlY2huaWNhbC9kaWFncmFtcy8KCktub3duIEdhcHM6Ci0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIGhhcyB0d28ga25vd24gZ2FwczoK CjEuIElQRSBjYW5ub3QgdmVyaWZ5IHRoZSBpbnRlZ3JpdHkgb2YgYW5vbnltb3VzIGV4ZWN1dGFi bGUgbWVtb3J5LCBzdWNoIGFzCiAgdGhlIHRyYW1wb2xpbmVzIGNyZWF0ZWQgYnkgZ2NjIGNsb3N1 cmVzIGFuZCBsaWJmZmksIG9yIEpJVCdkIGNvZGUuCiAgVW5mb3J0dW5hdGVseSwgYXMgdGhpcyBp cyBkeW5hbWljYWxseSBnZW5lcmF0ZWQgY29kZSwgdGhlcmUgaXMgbm8gd2F5IGZvcgogIElQRSB0 byBkZXRlY3QgdGhhdCB0aGlzIGNvZGUgaGFzIG5vdCBiZWVuIHRhbXBlcmVkIHdpdGggaW4gdHJh bnNpdGlvbgogIGZyb20gd2hlcmUgaXQgd2FzIGJ1aWx0LCB0byB3aGVyZSBpdCBpcyBydW5uaW5n LiBBcyBhIHJlc3VsdCwgSVBFIGlzCiAgaW5jYXBhYmxlIG9mIHRhY2tsaW5nIHRoaXMgcHJvYmxl bSBmb3IgZHluYW1pY2FsbHkgZ2VuZXJhdGVkIGNvZGUuCiAgSG93ZXZlciwgdGhlcmUgaXMgYSBw YXRjaCBzZXJpZXMgYmVpbmcgcHJlcGFyZWQgdGhhdCBhZGRyZXNzZXMgdGhpcwogIHByb2JsZW0g Zm9yIGxpYmZmaSBhbmQgZ2NjIGNsb3N1cmVzIGJ5IGltcGxlbWV0aW5nIGEgc2FmZXIga2VybmVs CiAgdHJhbXBvbGluZSBBUEkuIAoKMi4gSVBFIGNhbm5vdCB2ZXJpZnkgdGhlIGludGVncml0eSBv ZiBpbnRlcnByZXRlZCBsYW5ndWFnZXMnIHByb2dyYW1zIHdoZW4KICB0aGVzZSBzY3JpcHRzIGlu dm9rZWQgdmlhIGA8aW50ZXJwcmV0ZXI+IDxmaWxlPmAuIFRoaXMgaXMgYmVjYXVzZSB0aGUgd2F5 CiAgaW50ZXJwcmV0ZXJzIGV4ZWN1dGUgdGhlc2UgZmlsZXMsIHRoZSBzY3JpcHRzIHRoZW1zZWx2 ZXMgYXJlIG5vdAogIGV2YWx1YXRlZCBhcyBleGVjdXRhYmxlIGNvZGUgdGhyb3VnaCBvbmUgb2Yg SVBFJ3MgaG9va3MuIEludGVycHJldGVycwogIGNhbiBiZSBlbmxpZ2h0ZW5lZCB0byB0aGUgdXNh Z2Ugb2YgSVBFIGJ5IHRyeWluZyB0byBtbWFwIGEgZmlsZSBpbnRvCiAgZXhlY3V0YWJsZSBtZW1v cnkgKCtYKSwgYWZ0ZXIgb3BlbmluZyB0aGUgZmlsZSBhbmQgcmVzcG9uZGluZyB0byB0aGUKICBl cnJvciBjb2RlIGFwcHJvcHJpYXRlbHkuIFRoaXMgYWxzbyBhcHBsaWVzIHRvIGluY2x1ZGVkIGZp bGVzLCBvciBoaWdoCiAgdmFsdWUgZmlsZXMsIHN1Y2ggYXMgY29uZmlndXJhdGlvbiBmaWxlcyBv ZiBjcml0aWNhbCBzeXN0ZW0gY29tcG9uZW50cy4KICBUaGlzIHNwZWNpZmljIGdhcCBpcyBwbGFu bmVkIG9uIGJlaW5nIGFkZHJlc3NlZCB3aXRoaW4gSVBFLiBGb3IgbW9yZQogIGluZm9ybWF0aW9u IG9uIGhvdyB3ZSBwbGFuIHRvIGFkZHJlc3MgdGhpcyBnYXAsIHBsZWFzZSBzZWUgdGhlIEZ1dHVy ZQogIERldmVsb3BtZW50IHNlY3Rpb24sIGJlbG93LgoKRnV0dXJlIERldmVsb3BtZW50OgotLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KClN1cHBvcnQgZm9yIGZpbHRlcmluZyBz aWduYXR1cmVzIGJ5IHNwZWNpZmljIGNlcnRpZmljYXRlcy4gSW4gdGhpcyBjYXNlLApvdXIgImRt dmVyaXR5X3NpZ25hdHVyZSIgKG9yIGEgc2VwYXJhdGUgcHJvcGVydHkpIGNhbiBiZSBzZXQgdG8g YQpzcGVjaWZpYyBjZXJ0aWZpY2F0ZSBkZWNsYXJlZCBpbiBJUEUncyBwb2xpY3ksIGFsbG93aW5n IGZvciBtb3JlCmNvbnRyb2xsZWQgdXNlLWNhc2VzIGRldGVybWluZSBieSBhIHVzZXIncyBQS0kg c3RydWN0dXJlLgoKU3VwcG9ydCBmb3IgaW50ZWdyaXR5IHZlcmlmaWNhdGlvbiBmb3IgZ2VuZXJh bCBmaWxlIHJlYWRzLiBUaGlzIGFkZHJlc3Nlcwp0aGUgc2NyaXB0IGludGVycHJldGVyIGlzc3Vl IGluZGljYXRlZCBpbiB0aGUgIktub3duIEdhcHMiIHNlY3Rpb24sIGFzCnRoZXNlIHNjcmlwdCBm aWxlcyBhcmUgdHlwaWNhbGx5IG9wZW5lZCB3aXRoIE9fUkRPTkxZLiBXZSBhcmUgZXZhbHVhdGlu Zwp3aGV0aGVyIHRvIGRvIHRoaXMgYnkgY29tcGFyaW5nIHRoZSBvcmlnaW5hbCB1c2VybGFuZCBm aWxlcGF0aCBwYXNzZWQgaW50bwp0aGUgb3BlbiBzeXNjYWxsLCB0aGVyZWJ5IGFsbG93aW5nIGV4 aXN0aW5nIGNhbGxlcnMgdG8gdGFrZSBhZHZhbnRhZ2UKd2l0aG91dCBhbnkgY29kZSBjaGFuZ2Vz OyB0aGUgYWx0ZXJuYXRlIGRlc2lnbiBpcyB0byBleHRlbmQgdGhlIG5ldwpvcGVuYXQyKDIpIHN5 c2NhbGwsIHdpdGggYW4gbmV3IGZsYWcsIHRlbnRhdGl2ZWx5IGNhbGxlZCAiT19WRVJJRlkiLiBX aGlsZQp0aGUgc2Vjb25kIG9wdGlvbiByZXF1aXJlcyBhIGNvZGUgY2hhbmdlIGZvciBhbGwgdGhl IGludGVycHJldGVycywKZnJhbWV3b3JrcyBhbmQgbGFuZ3VhZ2VzIHRoYXQgd2lzaCB0byBsZXZl cmFnZSBpdCwgaXQgaXMgYSB3aG9sbHkgY2xlYW5lcgppbXBsZW1lbnRhdGlvbiBpbiB0aGUga2Vy bmVsLiBGb3IgaW50ZXJwcmV0ZXJzIHNwZWNpZmljYWxseSwgdGhlIE9fTUFZRVhFQwpwYXRjaCBz ZXJpZXMgcHVibGlzaGVkIGJ5IE1pY2thw4PCq2wgU2FsYcODwrxuWzFdIGlzIGEgc2ltaWxhciBp bXBsZW1lbnRhdGlvbgp0byB0aGUgT19WRVJJRlkgaWRlYSBkZXNjcmliZWQgYWJvdmUuCgpPbmJv YXJkaW5nIElQRSdzIHRlc3Qgc3VpdGUgdG8gS2VybmVsQ0kuIEN1cnJlbnRseSB3ZSBhcmUgZGV2 ZWxvcGluZyBhCnRlc3Qgc3VpdGUgaW4gdGhlIHNhbWUgdmVpbiBhcyBTRUxpbnV4J3MgdGVzdCBz dWl0ZS4gT25jZSBkZXZlbG9wbWVudApvZiB0aGUgdGVzdCBzdWl0ZSBpcyBjb21wbGV0ZSwgYW5k IHByb3ZpZGVkIElQRSBpcyBhY2NlcHRlZCwgd2UgaW50ZW5kCnRvIG9uYm9hcmQgdGhpcyB0ZXN0 IHN1aXRlIG9udG8gS2VybmVsQ0kuCgpIYXJkZW5lZCByZXNpc3RhbmNlIGFnYWluc3Qgcm9sbC1i YWNrIGF0dGFja3MuIEN1cnJlbnRseSB0aGVyZSBleGlzdHMgYQp3aW5kb3cgb2Ygb3Bwb3J0dW5p dHkgYmV0d2VlbiB1c2VyLW1vZGUgc2V0dXAgYW5kIHRoZSB1c2VyLXBvbGljeSBiZWluZwpkZXBs b3llZCwgd2hlcmUgYSBwcmlvciB1c2VyLXBvbGljeSBjYW4gYmUgbG9hZGVkLCB0aGF0IGlzIHBv dGVudGlhbGx5Cmluc2VjdXJlLiBIb3dldmVyLCB3aXRoIGEga2VybmVsIHVwZGF0ZSwgeW91IGNh biByZXZpc2UgdGhlIGJvb3QgcG9saWN5J3MKdmVyc2lvbiB0byBiZSB0aGUgc2FtZSB2ZXJzaW9u IGFzIHRoZSBsYXRlc3QgcG9saWN5LCBjbG9zaW5nIHRoaXMgd2luZG93LgpJbiB0aGUgZnV0dXJl LCBJIHdvdWxkIGxpa2UgdG8gY2xvc2UgdGhpcyB3aW5kb3cgb2Ygb3Bwb3J0dW5pdHkgd2l0aG91 dAphIGtlcm5lbCB1cGRhdGUsIHVzaW5nIHNvbWUgcGVyc2lzdGVudCBzdG9yYWdlIG1lY2hhbmlz bS4KCk9wZW4gSXNzdWVzOgotLS0tLS0tLS0tLS0KCkZvciBsaW51eC1hdWRpdC9pbnRlZ3JpdHkg Zm9sa3M6CjEuIEludHJvZHVjdGlvbiBvZiBuZXcgYXVkaXQgZGVmaW5pdGlvbnMgaW4gdGhlIGtl cm5lbCBpbnRlZ3JpdHkgcmFuZ2UgLSBpcwogIHRoaXMgcHJlZmVycmVkLCBhcyBvcHBvc2VkIHRv IHJldXNpbmcgZGVmaW5pdGlvbnMgd2l0aCBleGlzdGluZyBJTUEKICBkZWZpbml0aW9ucz8KClRP RE9zOgotLS0tLS0KCmxpbnV4LWF1ZGl0IGNoYW5nZXMgdG8gc3VwcG9ydCB0aGUgbmV3IGF1ZGl0 IGV2ZW50cy4KCgpBcHBlbmRpeDoKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t CgpBLiBJUEUgR2l0aHViIFJlcG9zaXRvcnk6IGh0dHBzOi8vZ2l0aHViLmNvbS9taWNyb3NvZnQv aXBlCiAgIEhvc3RlZCBEb2N1bWVudGF0aW9uOiBodHRwczovL21pY3Jvc29mdC5naXRodWIuaW8v aXBlCkIuIElQRSBVc2VycycgR3VpZGU6IERvY3VtZW50YXRpb24vYWRtaW4tZ3VpZGUvTFNNL2lw ZS5yc3QKQy4gSVBFIFRlc3QgU3VpdGU6ICpUQkEqICh1bmRlciBkZXZlbG9wbWVudCkKClJlZmVy ZW5jZXM6Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKMS4gaHR0cHM6Ly9s b3JlLmtlcm5lbC5vcmcvbGludXgtaW50ZWdyaXR5LzIwMjAwNTA1MTUzMTU2LjkyNTExMS0xLW1p Y0BkaWdpa29kLm5ldC8KCkNoYW5nZWxvZzoKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tCgp2MTogSW50cm9kdWNlZAoKdjI6CiAgU3BsaXQgdGhlIHNlY29uZCBwYXRjaCBvZiB0 aGUgcHJldmlvdXMgc2VyaWVzIGludG8gdHdvLgogIE1pbm9yIGNvcnJlY3Rpb25zIGluIHRoZSBj b3Zlci1sZXR0ZXIgYW5kIGRvY3VtZW50YXRpb24KICBjb21tZW50cyByZWdhcmRpbmcgQ0FQX01B Q19BRE1JTiBjaGVja3MgaW4gSVBFLgoKdjM6CiAgQWRkcmVzcyB2YXJpb3VzIGNvbW1lbnRzIGJ5 IEphbm4gSG9ybi4gSGlnaGxpZ2h0czoKICAgIFN3aXRjaCB2YXJpb3VzIGF1ZGl0IGFsbG9jYXRv cnMgdG8gR0ZQX0tFUk5FTC4KICAgIFV0aWxpemUgcmN1X2FjY2Vzc19wb2ludGVyKCkgaW4gdmFy aW91cyBsb2NhdGlvbnMuCiAgICBTdHJpcCBvdXQgdGhlIGNhY2hpbmcgc3lzdGVtIGZvciBwcm9w ZXJ0aWVzCiAgICBTdHJpcCBjb21tZW50cyBmcm9tIGhlYWRlcnMKICAgIE1vdmUgZnVuY3Rpb25z IGFyb3VuZCBpbiBwYXRjaGVzCiAgICBSZW1vdmUga2VybmVsIGNvbW1hbmQgbGluZSBwYXJhbWV0 ZXJzCiAgICBSZWNvbmNpbGUgdGhlIHJhY2UgY29uZGl0aW9uIG9uIHRoZSBkZWxldGUgbm9kZSBm b3IgcG9saWN5IGJ5CiAgICAgIGV4cGFuZGluZyB0aGUgcG9saWN5IGNyaXRpY2FsIHNlY3Rpb24u CgogIEFkZHJlc3MgYSBmZXcgY29tbWVudHMgYnkgSm9uYXRoYW4gQ29yYmV0IGFyb3VuZCB0aGUg ZG9jdW1lbnRhdGlvbgogICAgcGFnZXMgZm9yIElQRS4KCiAgRml4IGFuIGlzc3VlIHdpdGggdGhl IGluaXRpYWxpemF0aW9uIG9mIElQRSBwb2xpY3kgd2l0aCBhICItMCIKICAgIHZlcnNpb24sIGNh dXNlZCBieSBub3QgaW5pdGlhbGl6aW5nIHRoZSBobGlzdCBlbnRyaWVzIGJlZm9yZQogICAgZnJl ZWluZy4KCnY0OgogIEFkZHJlc3MgYSBjb25jZXJuIGFyb3VuZCBJUEUncyBiZWhhdmlvciB3aXRo IHVua25vd24gc3ludGF4LgogICAgU3BlY2lmaWNhbGx5LCBtYWtlIGFueSB1bmtub3duIHN5bnRh eCBhIGZhdGFsIGVycm9yIGluc3RlYWQgb2YgYQogICAgd2FybmluZywgYXMgc3VnZ2VzdGVkIGJ5 IE1pY2thw6tsIFNhbGHDvG4uCiAgSW50cm9kdWNlIGEgbmV3IHNlY3VyaXR5ZnMgbm9kZSwgJHNl Y3VyaXR5ZnMvaXBlL3Byb3BlcnR5X2NvbmZpZywKICAgIHdoaWNoIHByb3ZpZGVzIGEgbGlzdGlu ZyBvZiB3aGF0IHByb3BlcnRpZXMgYXJlIGVuYWJsZWQgYnkgdGhlCiAgICBrZXJuZWwgYW5kIHRo ZWlyIHZlcnNpb25zLiBUaGlzIGFsbG93cyB1c2VybW9kZSB0byBwcmVkaWN0IHdoYXQKICAgIHBv bGljaWVzIHNob3VsZCBiZSBhbGxvd2VkLgogIFN0cmlwIHNvbWUgY29tbWVudHMgZnJvbSBjIGZp bGVzIHRoYXQgSSBtaXNzZWQuCiAgQ2xhcmlmeSBzb21lIGRvY3VtZW50YXRpb24gY29tbWVudHMg YXJvdW5kICdib290X3ZlcmlmaWVkJy4KICAgIFdoaWxlIHRoaXMgY3VycmVudGx5IGRvZXMgbm90 IGZ1bmN0aW9uYWxseSBjaGFuZ2UgdGhlIHByb3BlcnR5CiAgICBpdHNlbGYsIHRoZSBkaXN0aW5j dGlvbiBpcyBpbXBvcnRhbnQgd2hlbiBJUEUgY2FuIGVuZm9yY2UgdmVyaWZpZWQKICAgIHJlYWRz LiBBZGRpdGlvbmFsbHksICdLRVJORUxfUkVBRCcgd2FzIG9taXR0ZWQgZnJvbSB0aGUgZG9jdW1l bnRhdGlvbi4KICAgIFRoaXMgaGFzIGJlZW4gY29ycmVjdGVkLgogIENoYW5nZSBTZWN1cml0eUZT IGFuZCBTSEExIHRvIGEgcmV2ZXJzZSBkZXBlbmRlbmN5LgogIFVwZGF0ZSB0aGUgY292ZXItbGV0 dGVyIHdpdGggdGhlIHVwZGF0ZWQgYmVoYXZpb3Igb2YgdW5rbm93biBzeW50YXguCiAgUmVtb3Zl IGFsbCBzeXNjdGxzLCBtYWtpbmcgYW4gZXF1aXZhbGVudCBmdW5jdGlvbiBpbiBzZWN1cml0eWZz LgogIFJld29yayB0aGUgYWN0aXZlL2RlbGV0ZSBtZWNoYW5pc20gdG8gYmUgYSBub2RlIHVuZGVy IHRoZSBwb2xpY3kgaW4KICAgICRzZWN1cml0eWZzL2lwZS9wb2xpY2llcy4KICBUaGUga2VybmVs IGNvbW1hbmQgbGluZSBwYXJhbWV0ZXJzIGlwZS5lbmZvcmNlIGFuZCBpcGUuc3VjY2Vzc19hdWRp dAogICAgaGF2ZSByZXR1cm5lZCBhcyB0aGlzIGZ1bmN0aW9uYWxpdHkgaXMgbm8gbG9uZ2VyIGV4 cG9zZWQgdGhyb3VnaAogICAgc3lzZnMuCgp2NToKICBDb3JyZWN0IHNvbWUgZ3JhbW1hdGljYWwg ZXJyb3JzIHJlcG9ydGVkIGJ5IFJhbmR5IER1bmxhcC4KICBGaXggc29tZSB3YXJuaW5ncyByZXBv cnRlZCBieSBrZXJuZWwgdGVzdCBib3QuCiAgQ2hhbmdlIGNvbnZlbnRpb24gYXJvdW5kIHNlY3Vy aXR5X2JkZXZfc2V0c2VjdXJpdHkuIC1FTk9TWVMKICAgIGlzIG5vdyBleHBlY3RlZCBpZiBhbiBM U00gZG9lcyBub3QgaW1wbGVtZW50IGEgcGFydGljdWxhciBAbmFtZSwKICAgIGFzIHN1Z2dlc3Rl ZCBieSBDYXNleSBTY2hhdWZsZXIuCiAgTWlub3Igc3RyaW5nIGNvcnJlY3Rpb25zIHJlbGF0ZWQg dG8gdGhlIG1vdmUgZnJvbSBzeXNmcyB0byBzZWN1cml0eWZzCiAgQ29ycmVjdCBhIHNwZWxsaW5n IG9mIGFuICNpZmRlZiBmb3IgdGhlIHBlcm1pc3NpdmUgYXJndW1lbnQuCiAgQWRkIHRoZSBrZXJu ZWwgcGFyYW1ldGVycyByZS1hZGRlZCB0byB0aGUgZG9jdW1lbnRhdGlvbi4KICBGaXggYSBtaW5v ciBidWcgd2hlcmUgdGhlIG1vZGUgYmVpbmcgYXVkaXRlZCBvbiBwZXJtaXNzaXZlIHN3aXRjaAog ICAgd2FzIHRoZSBvcmlnaW5hbCBtb2RlLCBub3QgdGhlIG1vZGUgYmVpbmcgc3dhcHBlZCB0by4K ICBDbGVhbnVwIGRvYyBjb21tZW50cywgZml4IHNvbWUgd2hpdGVzcGFjZSBhbGlnbm1lbnQgaXNz dWVzLgoKRGV2ZW4gQm93ZXJzICgxMSk6CiAgc2NyaXB0czogYWRkIGlwZSB0b29saW5nIHRvIGdl bmVyYXRlIGJvb3QgcG9saWN5CiAgc2VjdXJpdHk6IGFkZCBpcGUgbHNtIGV2YWx1YXRpb24gbG9v cCBhbmQgYXVkaXQgc3lzdGVtCiAgc2VjdXJpdHk6IGFkZCBpcGUgbHNtIHBvbGljeSBwYXJzZXIg YW5kIHBvbGljeSBsb2FkaW5nCiAgaXBlOiBhZGQgcHJvcGVydHkgZm9yIHRydXN0IG9mIGJvb3Qg dm9sdW1lCiAgZnM6IGFkZCBzZWN1cml0eSBibG9iIGFuZCBob29rcyBmb3IgYmxvY2tfZGV2aWNl CiAgZG0tdmVyaXR5OiBtb3ZlIHNpZ25hdHVyZSBjaGVjayBhZnRlciB0cmVlIHZhbGlkYXRpb24K ICBkbS12ZXJpdHk6IGFkZCBiZGV2X3NldHNlY3VyaXR5IGhvb2sgZm9yIGRtLXZlcml0eSBzaWdu YXR1cmUKICBpcGU6IGFkZCBwcm9wZXJ0eSBmb3Igc2lnbmVkIGRtdmVyaXR5IHZvbHVtZXMKICBk bS12ZXJpdHk6IGFkZCBiZGV2X3NldHNlY3VyaXR5IGhvb2sgZm9yIHJvb3QtaGFzaAogIGRvY3Vt ZW50YXRpb246IGFkZCBpcGUgZG9jdW1lbnRhdGlvbgogIGNsZWFudXA6IHVhcGkvbGludXgvYXVk aXQuaAoKIERvY3VtZW50YXRpb24vYWRtaW4tZ3VpZGUvTFNNL2luZGV4LnJzdCAgICAgICB8ICAg IDEgKwogRG9jdW1lbnRhdGlvbi9hZG1pbi1ndWlkZS9MU00vaXBlLnJzdCAgICAgICAgIHwgIDUw OCArKysrKysrCiAuLi4vYWRtaW4tZ3VpZGUva2VybmVsLXBhcmFtZXRlcnMudHh0ICAgICAgICAg fCAgIDEyICsKIE1BSU5UQUlORVJTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 ICAgIDggKwogZHJpdmVycy9tZC9kbS12ZXJpdHktdGFyZ2V0LmMgICAgICAgICAgICAgICAgIHwg ICA1MiArLQogZHJpdmVycy9tZC9kbS12ZXJpdHktdmVyaWZ5LXNpZy5jICAgICAgICAgICAgIHwg IDE0NyArLQogZHJpdmVycy9tZC9kbS12ZXJpdHktdmVyaWZ5LXNpZy5oICAgICAgICAgICAgIHwg ICAyNCArLQogZHJpdmVycy9tZC9kbS12ZXJpdHkuaCAgICAgICAgICAgICAgICAgICAgICAgIHwg ICAgMiArLQogZnMvYmxvY2tfZGV2LmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwg ICAgOCArCiBpbmNsdWRlL2xpbnV4L2RldmljZS1tYXBwZXIuaCAgICAgICAgICAgICAgICAgfCAg ICAzICsKIGluY2x1ZGUvbGludXgvZnMuaCAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAg IDEgKwogaW5jbHVkZS9saW51eC9sc21faG9va19kZWZzLmggICAgICAgICAgICAgICAgIHwgICAg NSArCiBpbmNsdWRlL2xpbnV4L2xzbV9ob29rcy5oICAgICAgICAgICAgICAgICAgICAgfCAgIDEy ICsKIGluY2x1ZGUvbGludXgvc2VjdXJpdHkuaCAgICAgICAgICAgICAgICAgICAgICB8ICAgMjIg KwogaW5jbHVkZS91YXBpL2xpbnV4L2F1ZGl0LmggICAgICAgICAgICAgICAgICAgIHwgICAzNiAr LQogc2NyaXB0cy9NYWtlZmlsZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgMSAr CiBzY3JpcHRzL2lwZS9NYWtlZmlsZSAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAyICsK IHNjcmlwdHMvaXBlL3BvbGdlbi8uZ2l0aWdub3JlICAgICAgICAgICAgICAgICB8ICAgIDEgKwog c2NyaXB0cy9pcGUvcG9sZ2VuL01ha2VmaWxlICAgICAgICAgICAgICAgICAgIHwgICAgNyArCiBz Y3JpcHRzL2lwZS9wb2xnZW4vcG9sZ2VuLmMgICAgICAgICAgICAgICAgICAgfCAgMTM2ICsrCiBz ZWN1cml0eS9LY29uZmlnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDEyICstCiBz ZWN1cml0eS9NYWtlZmlsZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAyICsKIHNl Y3VyaXR5L2lwZS8uZ2l0aWdub3JlICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDIgKwogc2Vj dXJpdHkvaXBlL0tjb25maWcgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICA0OCArCiBzZWN1 cml0eS9pcGUvTWFrZWZpbGUgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDMzICsKIHNlY3Vy aXR5L2lwZS9pcGUtYXVkaXQuYyAgICAgICAgICAgICAgICAgICAgICB8ICAzMDMgKysrKwogc2Vj dXJpdHkvaXBlL2lwZS1hdWRpdC5oICAgICAgICAgICAgICAgICAgICAgIHwgICAyNCArCiBzZWN1 cml0eS9pcGUvaXBlLWJsb2JzLmMgICAgICAgICAgICAgICAgICAgICAgfCAgIDk1ICsrCiBzZWN1 cml0eS9pcGUvaXBlLWJsb2JzLmggICAgICAgICAgICAgICAgICAgICAgfCAgIDE4ICsKIHNlY3Vy aXR5L2lwZS9pcGUtZW5naW5lLmMgICAgICAgICAgICAgICAgICAgICB8ICAyMTMgKysrCiBzZWN1 cml0eS9pcGUvaXBlLWVuZ2luZS5oICAgICAgICAgICAgICAgICAgICAgfCAgIDQ5ICsKIHNlY3Vy aXR5L2lwZS9pcGUtaG9va3MuYyAgICAgICAgICAgICAgICAgICAgICB8ICAxNjkgKysrCiBzZWN1 cml0eS9pcGUvaXBlLWhvb2tzLmggICAgICAgICAgICAgICAgICAgICAgfCAgIDcwICsKIHNlY3Vy aXR5L2lwZS9pcGUtcGFyc2UuYyAgICAgICAgICAgICAgICAgICAgICB8ICA4ODkgKysrKysrKysr KysKIHNlY3VyaXR5L2lwZS9pcGUtcGFyc2UuaCAgICAgICAgICAgICAgICAgICAgICB8ICAgMTcg Kwogc2VjdXJpdHkvaXBlL2lwZS1waW4uYyAgICAgICAgICAgICAgICAgICAgICAgIHwgICA5MyAr Kwogc2VjdXJpdHkvaXBlL2lwZS1waW4uaCAgICAgICAgICAgICAgICAgICAgICAgIHwgICAzNiAr CiBzZWN1cml0eS9pcGUvaXBlLXBvbGljeS5jICAgICAgICAgICAgICAgICAgICAgfCAgMTQ5ICsr CiBzZWN1cml0eS9pcGUvaXBlLXBvbGljeS5oICAgICAgICAgICAgICAgICAgICAgfCAgIDY5ICsK IHNlY3VyaXR5L2lwZS9pcGUtcHJvcC1pbnRlcm5hbC5oICAgICAgICAgICAgICB8ICAgNDkgKwog c2VjdXJpdHkvaXBlL2lwZS1wcm9wZXJ0eS5jICAgICAgICAgICAgICAgICAgIHwgIDE0MyArKwog c2VjdXJpdHkvaXBlL2lwZS1wcm9wZXJ0eS5oICAgICAgICAgICAgICAgICAgIHwgIDEwMCArKwog c2VjdXJpdHkvaXBlL2lwZS1zZWNmcy5jICAgICAgICAgICAgICAgICAgICAgIHwgMTMwOSArKysr KysrKysrKysrKysrKwogc2VjdXJpdHkvaXBlL2lwZS1zZWNmcy5oICAgICAgICAgICAgICAgICAg ICAgIHwgICAxNCArCiBzZWN1cml0eS9pcGUvaXBlLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgMTE1ICsrCiBzZWN1cml0eS9pcGUvaXBlLmggICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDIyICsKIHNlY3VyaXR5L2lwZS9wcm9wZXJ0aWVzL0tjb25maWcgICAgICAgICAgICAg ICB8ICAgMzYgKwogc2VjdXJpdHkvaXBlL3Byb3BlcnRpZXMvTWFrZWZpbGUgICAgICAgICAgICAg IHwgICAxMyArCiBzZWN1cml0eS9pcGUvcHJvcGVydGllcy9ib290LXZlcmlmaWVkLmMgICAgICAg fCAgIDgyICsrCiBzZWN1cml0eS9pcGUvcHJvcGVydGllcy9kbXZlcml0eS1yb290aGFzaC5jICAg fCAgMTUzICsrCiBzZWN1cml0eS9pcGUvcHJvcGVydGllcy9kbXZlcml0eS1zaWduYXR1cmUuYyAg fCAgIDgyICsrCiBzZWN1cml0eS9pcGUvcHJvcGVydGllcy9wcm9wLWVudHJ5LmggICAgICAgICAg fCAgIDM4ICsKIHNlY3VyaXR5L2lwZS91dGlsaXR5LmggICAgICAgICAgICAgICAgICAgICAgICB8 ICAgMzIgKwogc2VjdXJpdHkvc2VjdXJpdHkuYyAgICAgICAgICAgICAgICAgICAgICAgICAgIHwg ICA3NCArCiA1NCBmaWxlcyBjaGFuZ2VkLCA1NDQzIGluc2VydGlvbnMoKyksIDk4IGRlbGV0aW9u cygtKQogY3JlYXRlIG1vZGUgMTAwNjQ0IERvY3VtZW50YXRpb24vYWRtaW4tZ3VpZGUvTFNNL2lw ZS5yc3QKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzY3JpcHRzL2lwZS9NYWtlZmlsZQogY3JlYXRlIG1v ZGUgMTAwNjQ0IHNjcmlwdHMvaXBlL3BvbGdlbi8uZ2l0aWdub3JlCiBjcmVhdGUgbW9kZSAxMDA2 NDQgc2NyaXB0cy9pcGUvcG9sZ2VuL01ha2VmaWxlCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2NyaXB0 cy9pcGUvcG9sZ2VuL3BvbGdlbi5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlLy5n aXRpZ25vcmUKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvS2NvbmZpZwogY3JlYXRl IG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9NYWtlZmlsZQogY3JlYXRlIG1vZGUgMTAwNjQ0IHNl Y3VyaXR5L2lwZS9pcGUtYXVkaXQuYwogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9p cGUtYXVkaXQuaAogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9pcGUtYmxvYnMuYwog Y3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9pcGUtYmxvYnMuaAogY3JlYXRlIG1vZGUg MTAwNjQ0IHNlY3VyaXR5L2lwZS9pcGUtZW5naW5lLmMKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1 cml0eS9pcGUvaXBlLWVuZ2luZS5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lw ZS1ob29rcy5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lwZS1ob29rcy5oCiBj cmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lwZS1wYXJzZS5jCiBjcmVhdGUgbW9kZSAx MDA2NDQgc2VjdXJpdHkvaXBlL2lwZS1wYXJzZS5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJp dHkvaXBlL2lwZS1waW4uYwogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9pcGUtcGlu LmgKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvaXBlLXBvbGljeS5jCiBjcmVhdGUg bW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lwZS1wb2xpY3kuaAogY3JlYXRlIG1vZGUgMTAwNjQ0 IHNlY3VyaXR5L2lwZS9pcGUtcHJvcC1pbnRlcm5hbC5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2Vj dXJpdHkvaXBlL2lwZS1wcm9wZXJ0eS5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBl L2lwZS1wcm9wZXJ0eS5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lwZS1zZWNm cy5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lwZS1zZWNmcy5oCiBjcmVhdGUg bW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lwZS5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJp dHkvaXBlL2lwZS5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL3Byb3BlcnRpZXMv S2NvbmZpZwogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9wcm9wZXJ0aWVzL01ha2Vm aWxlCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL3Byb3BlcnRpZXMvYm9vdC12ZXJp ZmllZC5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL3Byb3BlcnRpZXMvZG12ZXJp dHktcm9vdGhhc2guYwogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9wcm9wZXJ0aWVz L2RtdmVyaXR5LXNpZ25hdHVyZS5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL3By b3BlcnRpZXMvcHJvcC1lbnRyeS5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL3V0 aWxpdHkuaAoKLS0gCjIuMjcuMAoKCi0tCkxpbnV4LWF1ZGl0IG1haWxpbmcgbGlzdApMaW51eC1h dWRpdEByZWRoYXQuY29tCmh0dHBzOi8vd3d3LnJlZGhhdC5jb20vbWFpbG1hbi9saXN0aW5mby9s aW51eC1hdWRpdA== From mboxrd@z Thu Jan 1 00:00:00 1970 From: Deven Bowers Subject: [RFC PATCH v5 00/11] Integrity Policy Enforcement LSM (IPE) Date: Tue, 28 Jul 2020 14:36:00 -0700 Message-ID: <20200728213614.586312-1-deven.desai@linux.microsoft.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dm-devel-bounces@redhat.com Errors-To: dm-devel-bounces@redhat.com To: agk@redhat.com, axboe@kernel.dk, snitzer@redhat.com, jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com, viro@zeniv.linux.org.uk, paul@paul-moore.com, eparis@redhat.com, jannh@google.com, dm-devel@redhat.com, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-block@vger.kernel.org, linux-audit@redhat.com Cc: sashal@kernel.org, pasha.tatashin@soleen.com, mdsakib@microsoft.com, corbet@lwn.net, linux-kernel@vger.kernel.org, nramas@linux.microsoft.com, tyhicks@linux.microsoft.com, jaskarankhurana@linux.microsoft.com List-Id: dm-devel.ids T3ZlcnZpZXc6Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIGlzIGEg TGludXggU2VjdXJpdHkgTW9kdWxlIHdoaWNoIGFsbG93cyBmb3IgYSBjb25maWd1cmFibGUKcG9s aWN5IHRvIGVuZm9yY2UgaW50ZWdyaXR5IHJlcXVpcmVtZW50cyBvbiB0aGUgd2hvbGUgc3lzdGVt LiBJdAphdHRlbXB0cyB0byBzb2x2ZSB0aGUgaXNzdWUgb2YgQ29kZSBJbnRlZ3JpdHk6IHRoYXQg YW55IGNvZGUgYmVpbmcKZXhlY3V0ZWQgKG9yIGZpbGVzIGJlaW5nIHJlYWQpLCBhcmUgaWRlbnRp Y2FsIHRvIHRoZSB2ZXJzaW9uIHRoYXQKd2FzIGJ1aWx0IGJ5IGEgdHJ1c3RlZCBzb3VyY2UuCgpU aGUgdHlwZSBvZiBzeXN0ZW0gZm9yIHdoaWNoIElQRSBpcyBkZXNpZ25lZCBmb3IgdXNlIGlzIGFu IGVtYmVkZGVkIGRldmljZQp3aXRoIGEgc3BlY2lmaWMgcHVycG9zZSAoZS5nLiBuZXR3b3JrIGZp cmV3YWxsIGRldmljZSBpbiBhIGRhdGEgY2VudGVyKSwKd2hlcmUgYWxsIHNvZnR3YXJlIGFuZCBj b25maWd1cmF0aW9uIGlzIGJ1aWx0IGFuZCBwcm92aXNpb25lZCBieSB0aGUgb3duZXIuCgpTcGVj aWZpY2FsbHksIGEgc3lzdGVtIHdoaWNoIGxldmVyYWdlcyBJUEUgaXMgbm90IGludGVuZGVkIGZv ciBnZW5lcmFsCnB1cnBvc2UgY29tcHV0aW5nIGFuZCBkb2VzIG5vdCB1dGlsaXplIGFueSBzb2Z0 d2FyZSBvciBjb25maWd1cmF0aW9uCmJ1aWx0IGJ5IGEgdGhpcmQgcGFydHkuIEFuIGlkZWFsIHN5 c3RlbSB0byBsZXZlcmFnZSBJUEUgaGFzIGJvdGggbXV0YWJsZQphbmQgaW1tdXRhYmxlIGNvbXBv bmVudHMsIGhvd2V2ZXIsIGFsbCBiaW5hcnkgZXhlY3V0YWJsZSBjb2RlIGlzIGltbXV0YWJsZS4K ClRoZSBzY29wZSBvZiBJUEUgaXMgY29uc3RyYWluZWQgdG8gdGhlIE9TLiBJdCBpcyBhc3N1bWVk IHRoYXQgcGxhdGZvcm0KZmlybXdhcmUgdmVyaWZpZXMgdGhlIHRoZSBrZXJuZWwgYW5kIG9wdGlv bmFsbHkgdGhlIHJvb3QgZmlsZXN5c3RlbSAoZS5nLgp2aWEgVS1Cb290IHZlcmlmaWVkIGJvb3Qp LiBJUEUgdGhlbiB1dGlsaXplcyBMU00gaG9va3MgdG8gZW5mb3JjZSBhCmZsZXhpYmxlLCBrZXJu ZWwtcmVzaWRlbnQgaW50ZWdyaXR5IHZlcmlmaWNhdGlvbiBwb2xpY3kuCgpJUEUgZGlmZmVycyBm cm9tIG90aGVyIExTTXMgd2hpY2ggcHJvdmlkZSBpbnRlZ3JpdHkgY2hlY2tpbmcgKGZvciBpbnN0 YW5jZSwKSU1BKSwgYXMgaXQgaGFzIG5vIGRlcGVuZGVuY3kgb24gdGhlIGZpbGVzeXN0ZW0gbWV0 YWRhdGEgaXRzZWxmLiBUaGUKYXR0cmlidXRlcyB0aGF0IElQRSBjaGVja3MgYXJlIGRldGVybWlu aXN0aWMgcHJvcGVydGllcyB0aGF0IGV4aXN0IHNvbGVseQppbiB0aGUga2VybmVsLiBBZGRpdGlv bmFsbHksIElQRSBwcm92aWRlcyBubyBhZGRpdGlvbmFsIG1lY2hhbmlzbXMgb2YKdmVyaWZ5aW5n IHRoZXNlIGZpbGVzIChlLmcuIElNQSBTaWduYXR1cmVzKSAtIGFsbCBvZiB0aGUgYXR0cmlidXRl cyBvZgp2ZXJpZnlpbmcgZmlsZXMgYXJlIGV4aXN0aW5nIGZlYXR1cmVzIHdpdGhpbiB0aGUga2Vy bmVsLCBzdWNoIGFzIGRtLXZlcml0eQpvciBmc3Zlcml0eS4KCklQRSBwcm92aWRlcyBhIHBvbGlj eSB0aGF0IGFsbG93cyBvd25lcnMgb2YgdGhlIHN5c3RlbSB0byBlYXNpbHkgc3BlY2lmeQppbnRl Z3JpdHkgcmVxdWlyZW1lbnRzIGFuZCB1c2VzIGRtLXZlcml0eSBzaWduYXR1cmVzIHRvIHNpbXBs aWZ5IHRoZQphdXRoZW50aWNhdGlvbiBvZiBhbGxvd2VkIG9iamVjdHMgbGlrZSBhdXRob3JpemVk IGNvZGUgYW5kIGRhdGEuCgpJUEUgc3VwcG9ydHMgdHdvIG1vZGVzLCBwZXJtaXNzaXZlIChzaW1p bGFyIHRvIFNFTGludXgncyBwZXJtaXNzaXZlIG1vZGUpCmFuZCBlbmZvcmNlLiBQZXJtaXNzaXZl IG1vZGUgcGVyZm9ybXMgdGhlIHNhbWUgY2hlY2tzLCBhbmQgbG9ncyBwb2xpY3kKdmlvbGF0aW9u cyBhcyBlbmZvcmNlIG1vZGUsIGJ1dCB3aWxsIG5vdCBlbmZvcmNlIHRoZSBwb2xpY3kuIFRoaXMg YWxsb3dzCnVzZXJzIHRvIHRlc3QgcG9saWNpZXMgYmVmb3JlIGVuZm9yY2luZyB0aGVtLgoKVGhl IGRlZmF1bHQgbW9kZSBpcyBlbmZvcmNlLCBhbmQgY2FuIGJlIGNoYW5nZWQgdmlhIHRoZSBrZXJu ZWwgY29tbWFuZGxpbmUKcGFyYW1ldGVyIGBpcGUuZW5mb3JjZT0oMHwxKWAsIG9yIHRoZSBzZWN1 cml0eWZzIG5vZGUKYC9zeXMva2VybmVsL3NlY3VyaXR5L2lwZS9lbmZvcmNlYC4gVGhlIGFiaWxp dHkgdG8gc3dpdGNoIG1vZGVzIGNhbiBiZQpjb21waWxlZCBvdXQgb2YgdGhlIExTTSB2aWEgc2V0 dGluZyB0aGUgY29uZmlnCkNPTkZJR19TRUNVUklUWV9JUEVfUEVSTUlTU0lWRV9TV0lUQ0ggdG8g Ti4KCklQRSBhZGRpdGlvbmFsbHkgc3VwcG9ydHMgc3VjY2VzcyBhdWRpdGluZy4gV2hlbiBlbmFi bGVkLCBhbGwgZXZlbnRzCnRoYXQgcGFzcyBJUEUgcG9saWN5IGFuZCBhcmUgbm90IGJsb2NrZWQg d2lsbCBlbWl0IGFuIGF1ZGl0IGV2ZW50LiBUaGlzCmlzIGRpc2FibGVkIGJ5IGRlZmF1bHQsIGFu ZCBjYW4gYmUgZW5hYmxlZCB2aWEgdGhlIGtlcm5lbCBjb21tYW5kbGluZQpgaXBlLnN1Y2Nlc3Nf YXVkaXQ9KDB8MSlgIG9yIHRoZSBzZWN1cml0eWZzIG5vZGUKYC9zeXMva2VybmVsL3NlY3VyaXR5 L2lwZS9zdWNjZXNzX2F1ZGl0YC4KClBvbGljaWVzIGNhbiBiZSBzdGFnZWQgYXQgcnVudGltZSB0 aHJvdWdoIHNlY3VyaXR5ZnMgYW5kIGFjdGl2YXRlZCB0aHJvdWdoCnN5c2ZzLiBQbGVhc2Ugc2Vl IHRoZSBEZXBsb3lpbmcgUG9saWNpZXMgc2VjdGlvbiBvZiB0aGlzIGNvdmVyIGxldHRlciBmb3IK bW9yZSBpbmZvcm1hdGlvbi4KClRoZSBJUEUgTFNNIGlzIGNvbXBpbGVkIHVuZGVyIENPTkZJR19T RUNVUklUWV9JUEUuCgpQb2xpY3k6Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LQoKSVBFIHBvbGljeSBpcyBkZXNpZ25lZCB0byBiZSBib3RoIGZvcndhcmQgY29tcGF0aWJsZSBh bmQgYmFja3dhcmRzCmNvbXBhdGlibGUuIFRoZXJlIGlzIG9uZSByZXF1aXJlZCBsaW5lLCBhdCB0 aGUgdG9wIG9mIHRoZSBwb2xpY3ksCmluZGljYXRpbmcgdGhlIHBvbGljeSBuYW1lLCBhbmQgdGhl IHBvbGljeSB2ZXJzaW9uLCBmb3IgaW5zdGFuY2U6CgogIHBvbGljeV9uYW1lPSJFeCBQb2xpY3ki IHBvbGljeV92ZXJzaW9uPTAuMC4wCgpUaGUgcG9saWN5IHZlcnNpb24gaW5kaWNhdGVzIHRoZSBj dXJyZW50IHZlcnNpb24gb2YgdGhlIHBvbGljeSAoTk9UIHRoZQpwb2xpY3kgc3ludGF4IHZlcnNp b24pLiBUaGlzIGlzIHVzZWQgdG8gcHJldmVudCByb2xsLWJhY2sgb2YgcG9saWN5IHRvCnBvdGVu dGlhbGx5IGluc2VjdXJlIHByZXZpb3VzIHZlcnNpb25zIG9mIHRoZSBwb2xpY3kuCgpUaGUgbmV4 dCBwb3J0aW9uIG9mIElQRSBwb2xpY3ksIGFyZSBydWxlcy4gUnVsZXMgYXJlIGZvcm1lZCBieSBr ZXk9dmFsdWUKcGFpcnMsIGtub3duIGFzIHByb3BlcnRpZXMuIElQRSBydWxlcyByZXF1aXJlIHR3 byBwcm9wZXJ0aWVzOiAiYWN0aW9uIiwKd2hpY2ggZGV0ZXJtaW5lcyB3aGF0IElQRSBkb2VzIHdo ZW4gaXQgZW5jb3VudGVycyBhIG1hdGNoIGFnYWluc3QgdGhlCnBvbGljeSwgYW5kICJvcCIsIHdo aWNoIGRldGVybWluZXMgd2hlbiB0aGF0IHJ1bGUgc2hvdWxkIGJlIGV2YWx1YXRlZC4KVGh1cywg YSBtaW5pbWFsIHJ1bGUgaXM6CgogIG9wPUVYRUNVVEUgYWN0aW9uPUFMTE9XCgpUaGlzIGV4YW1w bGUgd2lsbCBhbGxvdyBhbnkgZXhlY3V0aW9uLiBBZGRpdGlvbmFsIHByb3BlcnRpZXMgYXJlIHVz ZWQgdG8KcmVzdHJpY3QgYXR0cmlidXRlcyBhYm91dCB0aGUgZmlsZXMgYmVpbmcgZXZhbHVhdGVk LiBUaGVzZSBwcm9wZXJ0aWVzIGFyZQppbnRlbmRlZCB0byBiZSBkZXRlcm1pbmlzdGljIGF0dHJp YnV0ZXMgdGhhdCBhcmUgcmVzaWRlbnQgaW4gdGhlIGtlcm5lbC4KQXZhaWxhYmxlIHByb3BlcnRp ZXMgZm9yIElQRSBkZXNjcmliZWQgaW4gdGhlIHByb3BlcnRpZXMgc2VjdGlvbiBvZiB0aGlzCmNv dmVyLWxldHRlciwgdGhlIHJlcG9zaXRvcnkgYXZhaWxhYmxlIGluIEFwcGVuZGl4IEEsIGFuZCB0 aGUga2VybmVsCmRvY3VtZW50YXRpb24gcGFnZS4KCk9yZGVyIGRvZXMgbm90IG1hdHRlciBmb3Ig dGhlIHJ1bGUncyBwcm9wZXJ0aWVzIC0gdGhleSBjYW4gYmUgbGlzdGVkIGluCmFueSBvcmRlciwg aG93ZXZlciBpdCBpcyBlbmNvdXJhZ2VkIHRvIGhhdmUgdGhlICJvcCIgcHJvcGVydHkgYmUgZmly c3QsCmFuZCB0aGUgImFjdGlvbiIgcHJvcGVydHkgYmUgbGFzdCwgZm9yIHJlYWRhYmlsaXR5LgoK QWRkaXRpb25hbGx5LCBydWxlcyBhcmUgZXZhbHVhdGVkIHRvcC10by1ib3R0b20uIEFzIGEgcmVz dWx0LCBhbnkKcmV2b2NhdGlvbiBydWxlcywgb3IgZGVuaWVzIHNob3VsZCBiZSBwbGFjZWQgZWFy bHkgaW4gdGhlIGZpbGUgdG8gZW5zdXJlCnRoYXQgdGhlc2UgcnVsZXMgYXJlIGV2YWx1YXRlZCBi ZWZvcmUgYSBydWxlIHdpdGggImFjdGlvbj1BTExPVyIgaXMgaGl0LgoKQW55IHVua25vd24gc3lu dGF4IGluIElQRSBwb2xpY3kgd2lsbCByZXN1bHQgaW4gYSBmYXRhbCBlcnJvciB0byBwYXJzZQp0 aGUgcG9saWN5LiBVc2VyIG1vZGUgY2FuIGludGVycm9nYXRlIHRoZSBrZXJuZWwgdG8gdW5kZXJz dGFuZCB3aGF0CnByb3BlcnRpZXMgYW5kIHRoZSBhc3NvY2lhdGVkIHZlcnNpb25zIHRocm91Z2gg dGhlIHNlY3VyaXR5ZnMgbm9kZSwKJHNlY3VyaXR5ZnMvaXBlL3Byb3BlcnR5X2NvbmZpZywgd2hp Y2ggd2lsbCByZXR1cm4gYSBzdHJpbmcgb2YgZm9ybToKCiAga2V5MT12ZXJzaW9uMQogIGtleTI9 dmVyc2lvbjIKICAuCiAgLgogIC4KICBrZXlOPXZlcnNpb25OCgpVc2VyLW1vZGUgc2hvdWxkIGNv cnJlbGF0ZSB0aGVzZSB2ZXJzaW9ucyB3aXRoIHRoZSBzdXBwb3J0ZWQgdmFsdWVzCmlkZW50aWZp ZWQgaW4gdGhlIGRvY3VtZW50YXRpb24gdG8gZGV0ZXJtaW5lIHdoZXRoZXIgYSBwb2xpY3kgc2hv dWxkCmJlIGFjY2VwdGVkIGJ5IHRoZSBzeXN0ZW0uCgpBZGRpdGlvbmFsbHksIGEgREVGQVVMVCBv cGVyYXRpb24gbXVzdCBiZSBzZXQgZm9yIGFsbCB1bmRlcnN0b29kCm9wZXJhdGlvbnMgd2l0aGlu IElQRS4gRm9yIHBvbGljaWVzIHRvIHJlbWFpbiBjb21wbGV0ZWx5IGZvcndhcmRzCmNvbXBhdGli bGUsIGl0IGlzIHJlY29tbWVuZGVkIHRoYXQgdXNlcnMgYWRkIGEgIkRFRkFVTFQgYWN0aW9uPUFM TE9XIgphbmQgb3ZlcnJpZGUgdGhlIGRlZmF1bHRzIG9uIGEgcGVyLW9wZXJhdGlvbiBiYXNpcy4K CkZvciBtb3JlIGluZm9ybWF0aW9uIGFib3V0IHRoZSBwb2xpY3kgc3ludGF4LCBwbGVhc2Ugc2Vl IEFwcGVuZGl4IEEgb3IKdGhlIGtlcm5lbCBkb2N1bWVudGF0aW9uIHBhZ2UuCgpFYXJseSBVc2Vy bW9kZSBQcm90ZWN0aW9uOgotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIGNhbiBiZSBw cm92aWRlZCB3aXRoIGEgcG9saWN5IGF0IHN0YXJ0dXAgdG8gbG9hZCBhbmQgZW5mb3JjZS4KVGhp cyBpcyBpbnRlbmRlZCB0byBiZSBhIG1pbmltYWwgcG9saWN5IHRvIGdldCB0aGUgc3lzdGVtIHRv IGEgc3RhdGUKd2hlcmUgdXNlcmxhbmQgaXMgc2V0dXAgYW5kIHJlYWR5IHRvIHJlY2VpdmUgY29t bWFuZHMsIGF0IHdoaWNoCnBvaW50IGEgcG9saWN5IGNhbiBiZSBkZXBsb3llZCB2aWEgc2VjdXJp dHlmcy4gVGhpcyAiYm9vdCBwb2xpY3kiIGNhbiBiZQpzcGVjaWZpZWQgdmlhIHRoZSBjb25maWcs IFNFQ1VSSVRZX0lQRV9CT09UX1BPTElDWSwgd2hpY2ggYWNjZXB0cyBhIHBhdGgKdG8gYSBwbGFp bi10ZXh0IHZlcnNpb24gb2YgdGhlIElQRSBwb2xpY3kgdG8gYXBwbHkuIFRoaXMgcG9saWN5IHdp bGwgYmUKY29tcGlsZWQgaW50byB0aGUga2VybmVsLiBJZiBub3Qgc3BlY2lmaWVkLCBJUEUgd2ls bCBiZSBkaXNhYmxlZCB1bnRpbCBhCnBvbGljeSBpcyBkZXBsb3llZCBhbmQgYWN0aXZhdGVkIHRo cm91Z2ggdGhlIG1ldGhvZCBhYm92ZS4KClBvbGljeSBFeGFtcGxlczoKLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tCgpBbGxvdyBhbGw6CgogIHBvbGljeV9uYW1lPSJBbGxvdyBB bGwiIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249QUxMT1cKCkFsbG93IG9u bHkgaW5pdGlhbCBzdXBlcmJsb2NrOgoKICBwb2xpY3lfbmFtZT0iQWxsb3cgQWxsIEluaXRpYWwg U0IiIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249REVOWQoKICBvcD1FWEVD VVRFIGJvb3RfdmVyaWZpZWQ9VFJVRSBhY3Rpb249QUxMT1cKCkFsbG93IGFueSBzaWduZWQgZG0t dmVyaXR5IHZvbHVtZSBhbmQgdGhlIGluaXRpYWwgc3VwZXJibG9jazoKCiAgcG9saWN5X25hbWU9 IkFsbG93U2lnbmVkQW5kSW5pdGlhbCIgcG9saWN5X3ZlcnNpb249MC4wLjAKICBERUZBVUxUIGFj dGlvbj1ERU5ZCgogIG9wPUVYRUNVVEUgYm9vdF92ZXJpZmllZD1UUlVFIGFjdGlvbj1BTExPVwog IG9wPUVYRUNVVEUgZG12ZXJpdHlfc2lnbmF0dXJlPVRSVUUgYWN0aW9uPUFMTE9XCgpQcm9oaWJp dCBleGVjdXRpb24gZnJvbSBhIHNwZWNpZmljIGRtLXZlcml0eSB2b2x1bWU6CgogIHBvbGljeV9u YW1lPSJBbGxvd1NpZ25lZEFuZEluaXRpYWwiIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVM VCBhY3Rpb249REVOWQoKICBvcD1FWEVDVVRFIGRtdmVyaXR5X3Jvb3RoYXNoPTQwMWZjZWM1OTQ0 ODIzYWUxMmY2MjcyNmU4MTg0NDA3YTVmYTk1OTk3ODNmMDMwZGVjMTQ2OTM4IGFjdGlvbj1ERU5Z CiAgb3A9RVhFQ1VURSBib290X3ZlcmlmaWVkPVRSVUUgYWN0aW9uPUFMTE9XCiAgb3A9RVhFQ1VU RSBkbXZlcml0eV9zaWduYXR1cmU9VFJVRSBhY3Rpb249QUxMT1cKCkFsbG93IG9ubHkgYSBzcGVj aWZpYyBkbS12ZXJpdHkgdm9sdW1lOgoKICBwb2xpY3lfbmFtZT0iQWxsb3dTaWduZWRBbmRJbml0 aWFsIiBwb2xpY3lfdmVyc2lvbj0wLjAuMAogIERFRkFVTFQgYWN0aW9uPURFTlkKCiAgb3A9RVhF Q1VURSBkbXZlcml0eV9yb290aGFzaD00MDFmY2VjNTk0NDgyM2FlMTJmNjI3MjZlODE4NDQwN2E1 ZmE5NTk5NzgzZjAzMGRlYzE0NjkzOCBhY3Rpb249QUxMT1cKCkRlcGxveWluZyBQb2xpY2llczoK LS0tLS0tLS0tLS0tLS0tLS0tLQoKRGVwbG95aW5nIHBvbGljaWVzIGlzIHNpbXBsZS4gRmlyc3Qg c2lnbiBhIHBsYWluIHRleHQgcG9saWN5LCB3aXRoIGEKY2VydGlmaWNhdGUgdGhhdCBpcyBwcmVz ZW50IGluIHRoZSBTWVNURU1fVFJVU1RFRF9LRVlSSU5HIG9mIHlvdXIgdGVzdAptYWNoaW5lLiBU aHJvdWdoIG9wZW5zc2wsIHRoZSBzaWduaW5nIGNhbiBiZSBkb25lIHZpYToKCiAgb3BlbnNzbCBz bWltZSAtc2lnbiAtaW4gIiRNWV9QT0xJQ1kiIC1zaWduZXIgIiRNWV9DRVJUSUZJQ0FURSIgXAog ICAgLWlua2V5ICIkTVlfUFJJVkFURV9LRVkiIC1iaW5hcnkgLW91dGZvcm0gZGVyIC1ub2F0dHIg LW5vZGV0YWNoIFwKICAgIC1vdXQgIiRNWV9QT0xJQ1kucDdzIgoKVGhlbiwgc2ltcGx5IGNhdCB0 aGUgZmlsZSBpbnRvIHRoZSBJUEUncyAibmV3X3BvbGljeSIgc2VjdXJpdHlmcyBub2RlOgoKICBj YXQgIiRNWV9QT0xJQ1kucDdzIiA+IC9zeXMva2VybmVsL3NlY3VyaXR5L2lwZS9uZXdfcG9saWN5 CgpUaGUgcG9saWN5IHNob3VsZCBub3cgYmUgcHJlc2VudCB1bmRlciB0aGUgcG9saWNpZXMvIHN1 YmRpcmVjdG9yeSwgdW5kZXIKaXRzICJwb2xpY3lfbmFtZSIgYXR0cmlidXRlLgoKVGhlIHBvbGlj eSBpcyBub3cgcHJlc2VudCBpbiB0aGUga2VybmVsIGFuZCBjYW4gYmUgbWFya2VkIGFzIGFjdGl2 ZSwKdmlhIHRoZSBzeXNjdGwgImlwZS5hY3RpdmVfcG9saWN5IjoKCiAgZWNobyAtbiAxID4gIi9z eXMva2VybmVsL3NlY3VyaXR5L2lwZS8kTVlfUE9MSUNZX05BTUUvYWN0aXZlIgoKVGhpcyB3aWxs IG5vdyBtYXJrIHRoZSBwb2xpY3kgYXMgYWN0aXZlIGFuZCB0aGUgc3lzdGVtIHdpbGwgYmUgZW5m b3JjaW5nCiRNWV9QT0xJQ1lfTkFNRS4gQXQgYW55IHBvaW50IHRoZSBwb2xpY3kgY2FuIGJlIHVw ZGF0ZWQgb24gdGhlIHByb3Zpc2lvbgp0aGF0IHRoZSBwb2xpY3kgdmVyc2lvbiB0byBiZSBkZXBs b3llZCBpcyBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gdGhlCnJ1bm5pbmcgdmVyc2lvbiAodG8g cHJldmVudCByb2xsLWJhY2sgYXR0YWNrcykuIFRoaXMgdXBkYXRlIGNhbiBiZSBkb25lCmJ5IHJl ZGlyZWN0aW5nIHRoZSBmaWxlIGludG8gdGhlIHBvbGljeSdzICJyYXciIG5vZGUsIHVuZGVyIHRo ZSBwb2xpY2llcwpzdWJkaXJlY3Rvcnk6CgogIGNhdCAiJE1ZX1VQREFURURfUE9MSUNZLnA3cyIg PiBcCiAgICAiL3N5cy9rZXJuZWwvc2VjdXJpdHkvaXBlL3BvbGljaWVzLyRNWV9QT0xJQ1lfTkFN RS9yYXciCgpBZGRpdGlvbmFsbHksIHBvbGljaWVzIGNhbiBiZSBkZWxldGVkIHZpYSB0aGUgImRl bF9wb2xpY3kiIHNlY3VyaXR5ZnMKbm9kZS4gU2ltcGx5IHdyaXRlIHRoZSBuYW1lIG9mIHRoZSBw b2xpY3kgdG8gYmUgZGVsZXRlZCB0byB0aGF0IG5vZGU6CgogIGVjaG8gLW4gMSA+CiAgICAiL3N5 cy9rZXJuZWwvc2VjdXJpdHkvaXBlL3BvbGljaWVzLyRNWV9QT0xJQ1lfTkFNRS9kZWxldGUiCgpU aGVyZSBhcmUgdHdvIHJlcXVpcmVtZW50cyB0byBkZWxldGUgcG9saWNpZXM6CgoxLiBUaGUgcG9s aWN5IGJlaW5nIGRlbGV0ZWQgbXVzdCBub3QgYmUgdGhlIGFjdGl2ZSBwb2xpY3kuCjIuIFRoZSBw b2xpY3kgYmVpbmcgZGVsZXRlZCBtdXN0IG5vdCBiZSB0aGUgYm9vdCBwb2xpY3kuCgpJdCdzIGlt cG9ydGFudCB0byBrbm93IGFib3ZlIHRoYXQgdGhlICJlY2hvIiBjb21tYW5kIHdpbGwgYWRkIGEg bmV3bGluZQp0byB0aGUgZW5kIG9mIHRoZSBpbnB1dCwgYW5kIHRoaXMgd2lsbCBiZSBjb25zaWRl cmVkIGFzIHBhcnQgb2YgdGhlCmZpbGVuYW1lLiBZb3UgY2FuIHJlbW92ZSB0aGUgbmV3bGluZSB2 aWEgdGhlIC1uIHBhcmFtZXRlci4KCk5PVEU6IElmIGEgTUFDIExTTSBpcyBlbmFibGVkLCB0aGUg c2VjdXJpdHlmcyBjb21tYW5kcyB3aWxsIHJlcXVpcmUKQ0FQX01BQ19BRE1JTi4gVGhpcyBpcyBk dWUgdG8gc3lzZnMgc3VwcG9ydGluZyBmaW5lLWdyYWluZWQgTUFDCmF0dHJpYnV0ZXMsIHdoaWxl IHNlY3VyaXR5ZnMgYXQgdGhlIGN1cnJlbnQgbW9tZW50IGRvZXMgbm90LgoKUHJvcGVydGllczoK LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCgpUaGlzIGluaXRpYWwgcGF0Y2hz ZXQgaW50cm9kdWNpbmcgSVBFIGFkZHMgdGhyZWUgcHJvcGVydGllczoKJ2Jvb3RfdmVyaWZpZWQn LCAnZG12ZXJpdHlfc2lnbmF0dXJlJyBhbmQgJ2RtdmVyaXR5X3Jvb3RoYXNoJy4KCmJvb3RfdmVy aWZpZWQgKENPTkZJR19JUEVfQk9PVF9QUk9QKToKICBUaGlzIHByb3BlcnR5IGNhbiBiZSB1dGls aXplZCBmb3IgYXV0aG9yaXphdGlvbiBvZiB0aGUgZmlyc3QKICBzdXBlci1ibG9jayB0aGF0IGlz IG1vdW50ZWQgb24gdGhlIHN5c3RlbSwgd2hlcmUgSVBFIGF0dGVtcHRzCiAgdG8gZXZhbHVhdGUg YSBmaWxlLiBUeXBpY2FsbHkgdGhpcyBpcyB1c2VkIGZvciBzeXN0ZW1zIHdpdGgKICBhbiBpbml0 cmFtZnMgb3Igb3RoZXIgaW5pdGlhbCBkaXNrLCB3aGVyZSB0aGlzIGlzIHVubW91bnRlZCBiZWZv cmUKICB0aGUgc3lzdGVtIGJlY29tZXMgYXZhaWxhYmxlLCBhbmQgaXMgbm90IGNvdmVyZWQgYnkg YW55IG90aGVyIHByb3BlcnR5LgogIFRoZSBmb3JtYXQgb2YgdGhpcyBwcm9wZXJ0eSBpczoKCiAg ICBib290X3ZlcmlmaWVkPShUUlVFfEZBTFNFKQoKICBXQVJOSU5HOiBUaGlzIHByb3BlcnR5IHdp bGwgdHJ1c3QgYW55IGRpc2sgd2hlcmUgdGhlIGZpcnN0IElQRQogIGV2YWx1YXRpb24gb2NjdXJz LiBJZiB5b3UgZG8gbm90IGhhdmUgYSBzdGFydHVwIGRpc2sgdGhhdCBpcwogIHVucGFja2VkIGFu ZCB1bm1vdW50ZWQgKGxpa2UgaW5pdHJhbWZzKSwgdGhlbiBpdCB3aWxsIGF1dG9tYXRpY2FsbHkK ICB0cnVzdCB0aGUgcm9vdCBmaWxlc3lzdGVtIGFuZCBwb3RlbnRpYWxseSBvdmVyYXV0aG9yaXpl IHRoZSBlbnRpcmUKICBkaXNrLgoKZG12ZXJpdHlfcm9vdGhhc2ggKENPTkZJR19JUEVfRE1fVkVS SVRZX1JPT1RIQVNIKToKICBUaGlzIHByb3BlcnR5IGNhbiBiZSB1dGlsaXplZCBmb3IgYXV0aG9y aXphdGlvbiBvciByZXZvY2F0aW9uIG9mCiAgc3BlY2lmaWMgZG12ZXJpdHkgdm9sdW1lcywgaWRl bnRpZmllZCB2aWEgcm9vdCBoYXNoLiBJdCBoYXMgYQogIGRlcGVuZGVuY3kgb24gdGhlIERNX1ZF UklUWSBtb2R1bGUuIFRoZSBmb3JtYXQgb2YgdGhpcyBwcm9wZXJ0eSBpczoKCiAgICBkbXZlcml0 eV9yb290aGFzaD08SGFzaEhleERpZ2VzdD4KCmRtdmVyaXR5X3NpZ25hdHVyZSAoQ09ORklHX0lQ RV9ETV9WRVJJVFlfU0lHTkFUVVJFKToKICBUaGlzIHByb3BlcnR5IGNhbiBiZSB1dGlsaXplZCBm b3IgYXV0aG9yaXphdGlvbiBvZiBhbGwgZG0tdmVyaXR5CiAgdm9sdW1lcyB0aGF0IGhhdmUgYSBz aWduZWQgcm9vdGhhc2ggdGhhdCBjaGFpbnMgdG8gdGhlIHN5c3RlbQogIHRydXN0ZWQga2V5cmlu Zy4gSXQgaGFzIGEgZGVwZW5kZW5jeSBvbiB0aGUKICBETV9WRVJJVFlfVkVSSUZZX1JPT1RIQVNI X1NJRyBjb25maWcuIFRoZSBmb3JtYXQgb2YgdGhpcyBwcm9wZXJ0eSBpczoKCiAgICBkbXZlcml0 eV9zaWduYXR1cmU9KFRSVUV8RkFMU0UpCgpUZXN0aW5nOgotLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0KCkEgdGVzdCBzdWl0ZSBpcyBhdmFpbGFibGUgKEFwcGVuZGl4IEIpIGZv ciBlYXNlIG9mIHVzZS4gRm9yIG1hbnVhbAppbnN0cnVjdGlvbnM6CgpFbmFibGUgSVBFIHRocm91 Z2ggdGhlIGZvbGxvd2luZyBLY29uZmlnczoKCiAgQ09ORklHX1NFQ1VSSVRZX0lQRT15CiAgQ09O RklHX1NFQ1VSSVRZX0lQRV9CT09UX1BPTElDWT0iLi4vQWxsb3dBbGxJbml0aWFsU0IucG9sIgog IENPTkZJR19TRUNVUklUWV9JUEVfUEVSTUlTU0lWRV9TV0lUQ0g9eQogIENPTkZJR19JUEVfQk9P VF9QUk9QPXkKICBDT05GSUdfSVBFX0RNX1ZFUklUWV9ST09USEFTSD15CiAgQ09ORklHX0lQRV9E TV9WRVJJVFlfU0lHTkFUVVJFPXkKICBDT05GSUdfRE1fVkVSSVRZPXkKICBDT05GSUdfRE1fVkVS SVRZX1ZFUklGWV9ST09USEFTSF9TSUc9eQogIENPTkZJR19TWVNURU1fVFJVU1RFRF9LRVlSSU5H PXkKICBDT05GSUdfU1lTVEVNX1RSVVNURURfS0VZUz0iL3BhdGgvdG8vbXkvY2VydC9saXN0LnBl bSIKClN0YXJ0IGEgdGVzdCBzeXN0ZW0sIHRoYXQgYm9vdHMgZGlyZWN0bHkgZnJvbSB0aGUgZmls ZXN5c3RlbSwgd2l0aG91dAphbiBpbml0cmQuIEkgcmVjb21tZW5kIHRlc3RpbmcgaW4gcGVybWlz c2l2ZSBtb2RlIHVudGlsIGFsbCB0ZXN0cwpwYXNzLCB0aGVuIHN3aXRjaCB0byBlbmZvcmNlIHRv IGVuc3VyZSBiZWhhdmlvciByZW1haW5zIGlkZW50aWNhbC4KCmJvb3RfdmVyaWZpZWQ6CgogIElm IGJvb3RlZCBjb3JyZWN0bHksIHRoZSBmaWxlc3lzdGVtIG1vdW50ZWQgb24gLyBzaG91bGQgYmUg bWFya2VkIGFzCiAgYm9vdF92ZXJpZmllZC4gVmVyaWZ5IGJ5IHR1cm5pbmcgb24gc3VjY2VzcyBh dWRpdGluZyAoc3lzY3RsCiAgaXBlLnN1Y2Nlc3NfYXVkaXQ9MSksIGFuZCBydW4gYSBiaW5hcnku IEluIHRoZSBhdWRpdCBvdXRwdXQsCiAgYHByb3BfYm9vdF92ZXJpZmllZGAgc2hvdWxkIGJlIGBU UlVFYC4KCiAgVG8gdGVzdCBkZW5pYWxzLCBtb3VudCBhIHRlbXBvcmFyeSBmaWxlc3lzdGVtICht b3VudCAtdCB0bXBmcyAtbwogIHNpemU9NE0gdG1wIHRtcCksIGFuZCBjb3B5IGEgYmluYXJ5IChl LmcuIGxzKSB0byB0aGlzIG5ldwogIGZpbGVzeXN0ZW0uIERpc2FibGUgc3VjY2VzcyBhdWRpdGlu ZyBhbmQgYXR0ZW1wdCB0byBydW4gdGhlIGZpbGUuCiAgVGhlIGZpbGUgc2hvdWxkIGhhdmUgYW4g YXVkaXQgZXZlbnQsIGJ1dCBiZSBhbGxvd2VkIHRvIGV4ZWN1dGUgaW4KICBwZXJtaXNzaXZlIG1v ZGUsIGFuZCBwcm9wX2Jvb3RfdmVyaWZpZWQgc2hvdWxkIGJlIEZBTFNFLgoKZG12ZXJpdHlfcm9v dGhhc2g6CgogIEZpcnN0LCB5b3UgbXVzdCBjcmVhdGUgYSBkbS12ZXJpdHkgdm9sdW1lLiBUaGlz IGNhbiBiZSBkb25lIHRocm91Z2gKICBzcXVhc2hmcy10b29scyBhbmQgdmVyaXR5c2V0dXAgKHBy b3ZpZGVkIGJ5IGNyeXB0c2V0dXApLgoKICBDcmVhdGluZyBhIHNxdWFzaGZzIHZvbHVtZToKCiAg ICBta3NxdWFzaGZzIC9wYXRoL3RvL2RpcmVjdG9yeS93aXRoL2V4ZWN1dGFibGUgL3BhdGgvdG8v b3V0cHV0LnNxdWFzaGZzCgogIEZvcm1hdCB0aGUgdm9sdW1lIGZvciB1c2Ugd2l0aCBkbS12ZXJp dHkgJiBzYXZlIHRoZSByb290IGhhc2g6CgogICAgb3V0cHV0X3JoPSQodmVyaXR5c2V0dXAgZm9y bWF0IG91dHB1dC5zcXVhc2hmcyBvdXRwdXQuaGFzaHRyZWUgfCBcCiAgICAgIHRlZSB2ZXJpdHlf b3V0LnR4dCB8IGF3ayAiL1Jvb3QgaGFzaC8iIHwgXAogICAgICBzZWQgLUUgInMvUm9vdCBoYXNo OlxzKy8vZyIpCgogICAgZWNobyAtbiAkb3V0cHV0X3JoID4gb3V0cHV0LnJvb3RoYXNoCgogIENy ZWF0ZSBhIHR3byBwb2xpY2llcywgZmlsbGluZyBpbiB0aGUgYXBwcm9wcmlhdGUgZmllbGRzIGJl bG93OgoKICAgIFBvbGljeSAxOgoKICAgICAgcG9saWN5X25hbWU9InJvb3RoYXNoLWRlbmlhbCIg cG9saWN5X3ZlcnNpb249MC4wLjAKICAgICAgREVGQVVMVCBhY3Rpb249QUxMT1cKICAgICAgb3A9 RVhFQ1VURSBkbXZlcml0eV9yb290aGFzaD0kb3V0cHV0X3JoIGFjdGlvbj1ERU5ZCgogICAgUG9s aWN5IDI6CgogICAgICBwb2xpY3lfbmFtZT0icm9vdGhhc2gtYWxsb3ciIHBvbGljeV92ZXJzaW9u PTAuMC4wCiAgICAgIERFRkFVTFQgYWN0aW9uPUFMTE9XCiAgICAgIERFRkFVTFQgb3A9RVhFQ1VU RSBhY3Rpb249REVOWQoKICAgICAgb3A9RVhFQ1VURSBib290X3ZlcmlmaWVkPVRSVUUgYWN0aW9u PUFMTE9XCiAgICAgIG9wPUVYRUNVVEUgZG12ZXJpdHlfcm9vdGhhc2g9JG91dHB1dF9yaCBhY3Rp b249QUxMT1cKCiAgRGVwbG95IGVhY2ggcG9saWN5LCB0aGVuIG1hcmsgdGhlIGZpcnN0LCAicm9v dGhhc2gtZGVuaWFsIiBhcyBhY3RpdmUsCiAgcGVyIHRoZSAiRGVwbG95aW5nIFBvbGljaWVzIiBz ZWN0aW9uIG9mIHRoaXMgY292ZXIgbGV0dGVyLiBNb3VudCB0aGUKICBkbS12ZXJpdHkgdm9sdW1l OgoKICAgIHZlcml0eXNldHVwIG9wZW4gb3V0cHV0LnNxdWFzaGZzIG91dHB1dC5oYXNodHJlZSB1 bnZlcmlmaWVkIFwKICAgICAgYGNhdCBvdXRwdXQucm9vdGhhc2hgCgogICAgbW91bnQgL2Rldi9t YXBwZXIvdW52ZXJpZmllZCAvbXkvbW91bnQvcG9pbnQKCiAgQXR0ZW1wdCB0byBleGVjdXRlIGEg YmluYXJ5IGluIHRoZSBtb3VudCBwb2ludCwgYW5kIGl0IHNob3VsZCBlbWl0IGFuCiAgYXVkaXQg ZXZlbnQgZm9yIGEgbWF0Y2ggYWdhaW5zdCB0aGUgcnVsZToKICAKICAgIG9wPUVYRUNVVEUgZG12 ZXJpdHlfcm9vdGhhc2g9JG91dHB1dF9yaCBhY3Rpb249REVOWQoKICBUbyB0ZXN0IHRoZSBzZWNv bmQgcG9saWN5LCBwZXJmb3JtIHRoZSBzYW1lIHN0ZXBzLCBidXQgdGhpcyB0aW1lLCBlbmFibGUK ICBzdWNjZXNzIGF1ZGl0aW5nIGJlZm9yZSBydW5uaW5nIHRoZSBleGVjdXRhYmxlLiBUaGUgc3Vj Y2VzcyBhdWRpdCBldmVudAogIHNob3VsZCBiZSBhIG1hdGNoIGFnYWluc3QgdGhpcyBydWxlOgoK ICAgIG9wPUVYRUNVVEUgZG12ZXJpdHlfcm9vdGhhc2g9JG91dHB1dF9yaCBhY3Rpb249QUxMT1cK CmRtdmVyaXR5X3NpZ25hdHVyZToKCiAgRm9sbG93IHRoZSBzZXR1cCBzdGVwcyBmb3IgZG12ZXJp dHlfcm9vdGhhc2guIFNpZ24gdGhlIHJvb3RoYXNoIHZpYToKCiAgICBvcGVuc3NsIHNtaW1lIC1z aWduIC1pbiAib3V0cHV0LnJvb3RoYXNoIiAtc2lnbmVyICIkTVlfQ0VSVElGSUNBVEUiIFwKICAg ICAgLWlua2V5ICIkTVlfUFJJVkFURV9LRVkiIC1iaW5hcnkgLW91dGZvcm0gZGVyIC1ub2F0dHIg XAogICAgICAtb3V0ICJvdXRwdXQucDdzIgoKICAgIENyZWF0ZSBhIHBvbGljeToKCiAgICAgIHBv bGljeV9uYW1lPSJ2ZXJpZmllZCIgcG9saWN5X3ZlcnNpb249MC4wLjAKICAgICAgREVGQVVMVCBh Y3Rpb249REVOWQoKICAgICAgb3A9RVhFQ1VURSBib290X3ZlcmlmaWVkPVRSVUUgYWN0aW9uPUFM TE9XCiAgICAgIG9wPUVYRUNVVEUgZG12ZXJpdHlfdmVyaWZpZWQ9VFJVRSBhY3Rpb249QUxMT1cK CiAgRGVwbG95IHRoZSBwb2xpY3ksIGFuZCBtYXJrIGFzIGFjdGl2ZSwgcGVyIHRoZSAiRGVwbG95 aW5nIFBvbGljaWVzIgogIHNlY3Rpb24gb2YgdGhpcyBjb3ZlciBsZXR0ZXIuIE1vdW50IHRoZSBk bS12ZXJpdHkgdm9sdW1lIHdpdGgKICB2ZXJpZmljYXRpb246CgogICAgdmVyaXR5c2V0dXAgb3Bl biBvdXRwdXQuc3F1YXNoZnMgb3V0cHV0Lmhhc2h0cmVlIHVudmVyaWZpZWQgXAogICAgICBgY2F0 IG91dHB1dC5yb290aGFzaGAgLS1yb290LWhhc2gtc2lnbmF0dXJlPW91dHB1dC5wN3MKCiAgICBt b3VudCAvZGV2L21hcHBlci91bnZlcmlmaWVkIC9teS9tb3VudC9wb2ludAoKICBOT1RFOiBUaGUg LS1yb290LWhhc2gtc2lnbmF0dXJlIG9wdGlvbiB3YXMgaW50cm9kdWNlZCBpbiB2ZXJpdHlzZXR1 cAogIDIuMy4wCgogIFR1cm4gb24gc3VjY2VzcyBhdWRpdGluZyBhbmQgYXR0ZW1wdCB0byBleGVj dXRlIGEgYmluYXJ5IGluIHRoZSBtb3VudAogIHBvaW50LCBhbmQgaXQgc2hvdWxkIGVtaXQgYW4g YXVkaXQgZXZlbnQgZm9yIGEgbWF0Y2ggYWdhaW5zdCB0aGUgcnVsZToKCiAgICBvcD1FWEVDVVRF IGRtdmVyaXR5X3ZlcmlmaWVkPVRSVUUgYWN0aW9uPUFMTE9XCgogIFRvIHRlc3QgZGVuaWFscywg bW91bnQgdGhlIGRtLXZlcml0eSB2b2x1bWUgdGhlIHNhbWUgd2F5IGFzIHRoZQogICJkbXZlcml0 eV9yb290aGFzaCIgc2VjdGlvbiwgYW5kIGF0dGVtcHQgdG8gZXhlY3V0ZSBhIGJpbmFyeS4gRmFp bHVyZQogIHNob3VsZCBvY2N1ci4KCkRvY3VtZW50YXRpb246Ci0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLQoKRnVsbCBkb2N1bWVudGF0aW9uIGlzIGF2YWlsYWJsZSBvbiBnaXRo dWIgaW4gSVBFJ3MgbWFzdGVyIHJlcG9zaXRvcnkKKEFwcGVuZGl4IEEpLiBUaGlzIGlzIGludGVu ZGVkIHRvIGJlIGFuIGV4aGF1c3RpdmUgc291cmNlIG9mIGRvY3VtZW50YXRpb24KYXJvdW5kIElQ RS4KCkFkZGl0aW9uYWxseSwgdGhlcmUgaXMgaGlnaGVyIGxldmVsIGRvY3VtZW50YXRpb24gaW4g dGhlIGFkbWluLWd1aWRlLgoKVGVjaG5pY2FsIGRpYWdyYW1zIGFyZSBhdmFpbGFibGUgaGVyZToK CiAgaHR0cDovL21pY3Jvc29mdC5naXRodWIuaW8vaXBlL3RlY2huaWNhbC9kaWFncmFtcy8KCktu b3duIEdhcHM6Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIGhhcyB0 d28ga25vd24gZ2FwczoKCjEuIElQRSBjYW5ub3QgdmVyaWZ5IHRoZSBpbnRlZ3JpdHkgb2YgYW5v bnltb3VzIGV4ZWN1dGFibGUgbWVtb3J5LCBzdWNoIGFzCiAgdGhlIHRyYW1wb2xpbmVzIGNyZWF0 ZWQgYnkgZ2NjIGNsb3N1cmVzIGFuZCBsaWJmZmksIG9yIEpJVCdkIGNvZGUuCiAgVW5mb3J0dW5h dGVseSwgYXMgdGhpcyBpcyBkeW5hbWljYWxseSBnZW5lcmF0ZWQgY29kZSwgdGhlcmUgaXMgbm8g d2F5IGZvcgogIElQRSB0byBkZXRlY3QgdGhhdCB0aGlzIGNvZGUgaGFzIG5vdCBiZWVuIHRhbXBl cmVkIHdpdGggaW4gdHJhbnNpdGlvbgogIGZyb20gd2hlcmUgaXQgd2FzIGJ1aWx0LCB0byB3aGVy ZSBpdCBpcyBydW5uaW5nLiBBcyBhIHJlc3VsdCwgSVBFIGlzCiAgaW5jYXBhYmxlIG9mIHRhY2ts aW5nIHRoaXMgcHJvYmxlbSBmb3IgZHluYW1pY2FsbHkgZ2VuZXJhdGVkIGNvZGUuCiAgSG93ZXZl ciwgdGhlcmUgaXMgYSBwYXRjaCBzZXJpZXMgYmVpbmcgcHJlcGFyZWQgdGhhdCBhZGRyZXNzZXMg dGhpcwogIHByb2JsZW0gZm9yIGxpYmZmaSBhbmQgZ2NjIGNsb3N1cmVzIGJ5IGltcGxlbWV0aW5n IGEgc2FmZXIga2VybmVsCiAgdHJhbXBvbGluZSBBUEkuIAoKMi4gSVBFIGNhbm5vdCB2ZXJpZnkg dGhlIGludGVncml0eSBvZiBpbnRlcnByZXRlZCBsYW5ndWFnZXMnIHByb2dyYW1zIHdoZW4KICB0 aGVzZSBzY3JpcHRzIGludm9rZWQgdmlhIGA8aW50ZXJwcmV0ZXI+IDxmaWxlPmAuIFRoaXMgaXMg YmVjYXVzZSB0aGUgd2F5CiAgaW50ZXJwcmV0ZXJzIGV4ZWN1dGUgdGhlc2UgZmlsZXMsIHRoZSBz Y3JpcHRzIHRoZW1zZWx2ZXMgYXJlIG5vdAogIGV2YWx1YXRlZCBhcyBleGVjdXRhYmxlIGNvZGUg dGhyb3VnaCBvbmUgb2YgSVBFJ3MgaG9va3MuIEludGVycHJldGVycwogIGNhbiBiZSBlbmxpZ2h0 ZW5lZCB0byB0aGUgdXNhZ2Ugb2YgSVBFIGJ5IHRyeWluZyB0byBtbWFwIGEgZmlsZSBpbnRvCiAg ZXhlY3V0YWJsZSBtZW1vcnkgKCtYKSwgYWZ0ZXIgb3BlbmluZyB0aGUgZmlsZSBhbmQgcmVzcG9u ZGluZyB0byB0aGUKICBlcnJvciBjb2RlIGFwcHJvcHJpYXRlbHkuIFRoaXMgYWxzbyBhcHBsaWVz IHRvIGluY2x1ZGVkIGZpbGVzLCBvciBoaWdoCiAgdmFsdWUgZmlsZXMsIHN1Y2ggYXMgY29uZmln dXJhdGlvbiBmaWxlcyBvZiBjcml0aWNhbCBzeXN0ZW0gY29tcG9uZW50cy4KICBUaGlzIHNwZWNp ZmljIGdhcCBpcyBwbGFubmVkIG9uIGJlaW5nIGFkZHJlc3NlZCB3aXRoaW4gSVBFLiBGb3IgbW9y ZQogIGluZm9ybWF0aW9uIG9uIGhvdyB3ZSBwbGFuIHRvIGFkZHJlc3MgdGhpcyBnYXAsIHBsZWFz ZSBzZWUgdGhlIEZ1dHVyZQogIERldmVsb3BtZW50IHNlY3Rpb24sIGJlbG93LgoKRnV0dXJlIERl dmVsb3BtZW50OgotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KClN1cHBvcnQg Zm9yIGZpbHRlcmluZyBzaWduYXR1cmVzIGJ5IHNwZWNpZmljIGNlcnRpZmljYXRlcy4gSW4gdGhp cyBjYXNlLApvdXIgImRtdmVyaXR5X3NpZ25hdHVyZSIgKG9yIGEgc2VwYXJhdGUgcHJvcGVydHkp IGNhbiBiZSBzZXQgdG8gYQpzcGVjaWZpYyBjZXJ0aWZpY2F0ZSBkZWNsYXJlZCBpbiBJUEUncyBw b2xpY3ksIGFsbG93aW5nIGZvciBtb3JlCmNvbnRyb2xsZWQgdXNlLWNhc2VzIGRldGVybWluZSBi eSBhIHVzZXIncyBQS0kgc3RydWN0dXJlLgoKU3VwcG9ydCBmb3IgaW50ZWdyaXR5IHZlcmlmaWNh dGlvbiBmb3IgZ2VuZXJhbCBmaWxlIHJlYWRzLiBUaGlzIGFkZHJlc3Nlcwp0aGUgc2NyaXB0IGlu dGVycHJldGVyIGlzc3VlIGluZGljYXRlZCBpbiB0aGUgIktub3duIEdhcHMiIHNlY3Rpb24sIGFz CnRoZXNlIHNjcmlwdCBmaWxlcyBhcmUgdHlwaWNhbGx5IG9wZW5lZCB3aXRoIE9fUkRPTkxZLiBX ZSBhcmUgZXZhbHVhdGluZwp3aGV0aGVyIHRvIGRvIHRoaXMgYnkgY29tcGFyaW5nIHRoZSBvcmln aW5hbCB1c2VybGFuZCBmaWxlcGF0aCBwYXNzZWQgaW50bwp0aGUgb3BlbiBzeXNjYWxsLCB0aGVy ZWJ5IGFsbG93aW5nIGV4aXN0aW5nIGNhbGxlcnMgdG8gdGFrZSBhZHZhbnRhZ2UKd2l0aG91dCBh bnkgY29kZSBjaGFuZ2VzOyB0aGUgYWx0ZXJuYXRlIGRlc2lnbiBpcyB0byBleHRlbmQgdGhlIG5l dwpvcGVuYXQyKDIpIHN5c2NhbGwsIHdpdGggYW4gbmV3IGZsYWcsIHRlbnRhdGl2ZWx5IGNhbGxl ZCAiT19WRVJJRlkiLiBXaGlsZQp0aGUgc2Vjb25kIG9wdGlvbiByZXF1aXJlcyBhIGNvZGUgY2hh bmdlIGZvciBhbGwgdGhlIGludGVycHJldGVycywKZnJhbWV3b3JrcyBhbmQgbGFuZ3VhZ2VzIHRo YXQgd2lzaCB0byBsZXZlcmFnZSBpdCwgaXQgaXMgYSB3aG9sbHkgY2xlYW5lcgppbXBsZW1lbnRh dGlvbiBpbiB0aGUga2VybmVsLiBGb3IgaW50ZXJwcmV0ZXJzIHNwZWNpZmljYWxseSwgdGhlIE9f TUFZRVhFQwpwYXRjaCBzZXJpZXMgcHVibGlzaGVkIGJ5IE1pY2thw4PCq2wgU2FsYcODwrxuWzFd IGlzIGEgc2ltaWxhciBpbXBsZW1lbnRhdGlvbgp0byB0aGUgT19WRVJJRlkgaWRlYSBkZXNjcmli ZWQgYWJvdmUuCgpPbmJvYXJkaW5nIElQRSdzIHRlc3Qgc3VpdGUgdG8gS2VybmVsQ0kuIEN1cnJl bnRseSB3ZSBhcmUgZGV2ZWxvcGluZyBhCnRlc3Qgc3VpdGUgaW4gdGhlIHNhbWUgdmVpbiBhcyBT RUxpbnV4J3MgdGVzdCBzdWl0ZS4gT25jZSBkZXZlbG9wbWVudApvZiB0aGUgdGVzdCBzdWl0ZSBp cyBjb21wbGV0ZSwgYW5kIHByb3ZpZGVkIElQRSBpcyBhY2NlcHRlZCwgd2UgaW50ZW5kCnRvIG9u Ym9hcmQgdGhpcyB0ZXN0IHN1aXRlIG9udG8gS2VybmVsQ0kuCgpIYXJkZW5lZCByZXNpc3RhbmNl IGFnYWluc3Qgcm9sbC1iYWNrIGF0dGFja3MuIEN1cnJlbnRseSB0aGVyZSBleGlzdHMgYQp3aW5k b3cgb2Ygb3Bwb3J0dW5pdHkgYmV0d2VlbiB1c2VyLW1vZGUgc2V0dXAgYW5kIHRoZSB1c2VyLXBv bGljeSBiZWluZwpkZXBsb3llZCwgd2hlcmUgYSBwcmlvciB1c2VyLXBvbGljeSBjYW4gYmUgbG9h ZGVkLCB0aGF0IGlzIHBvdGVudGlhbGx5Cmluc2VjdXJlLiBIb3dldmVyLCB3aXRoIGEga2VybmVs IHVwZGF0ZSwgeW91IGNhbiByZXZpc2UgdGhlIGJvb3QgcG9saWN5J3MKdmVyc2lvbiB0byBiZSB0 aGUgc2FtZSB2ZXJzaW9uIGFzIHRoZSBsYXRlc3QgcG9saWN5LCBjbG9zaW5nIHRoaXMgd2luZG93 LgpJbiB0aGUgZnV0dXJlLCBJIHdvdWxkIGxpa2UgdG8gY2xvc2UgdGhpcyB3aW5kb3cgb2Ygb3Bw b3J0dW5pdHkgd2l0aG91dAphIGtlcm5lbCB1cGRhdGUsIHVzaW5nIHNvbWUgcGVyc2lzdGVudCBz dG9yYWdlIG1lY2hhbmlzbS4KCk9wZW4gSXNzdWVzOgotLS0tLS0tLS0tLS0KCkZvciBsaW51eC1h dWRpdC9pbnRlZ3JpdHkgZm9sa3M6CjEuIEludHJvZHVjdGlvbiBvZiBuZXcgYXVkaXQgZGVmaW5p dGlvbnMgaW4gdGhlIGtlcm5lbCBpbnRlZ3JpdHkgcmFuZ2UgLSBpcwogIHRoaXMgcHJlZmVycmVk LCBhcyBvcHBvc2VkIHRvIHJldXNpbmcgZGVmaW5pdGlvbnMgd2l0aCBleGlzdGluZyBJTUEKICBk ZWZpbml0aW9ucz8KClRPRE9zOgotLS0tLS0KCmxpbnV4LWF1ZGl0IGNoYW5nZXMgdG8gc3VwcG9y dCB0aGUgbmV3IGF1ZGl0IGV2ZW50cy4KCgpBcHBlbmRpeDoKLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tCgpBLiBJUEUgR2l0aHViIFJlcG9zaXRvcnk6IGh0dHBzOi8vZ2l0aHVi LmNvbS9taWNyb3NvZnQvaXBlCiAgIEhvc3RlZCBEb2N1bWVudGF0aW9uOiBodHRwczovL21pY3Jv c29mdC5naXRodWIuaW8vaXBlCkIuIElQRSBVc2VycycgR3VpZGU6IERvY3VtZW50YXRpb24vYWRt aW4tZ3VpZGUvTFNNL2lwZS5yc3QKQy4gSVBFIFRlc3QgU3VpdGU6ICpUQkEqICh1bmRlciBkZXZl bG9wbWVudCkKClJlZmVyZW5jZXM6Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LQoKMS4gaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcvbGludXgtaW50ZWdyaXR5LzIwMjAwNTA1MTUz MTU2LjkyNTExMS0xLW1pY0BkaWdpa29kLm5ldC8KCkNoYW5nZWxvZzoKLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tCgp2MTogSW50cm9kdWNlZAoKdjI6CiAgU3BsaXQgdGhlIHNl Y29uZCBwYXRjaCBvZiB0aGUgcHJldmlvdXMgc2VyaWVzIGludG8gdHdvLgogIE1pbm9yIGNvcnJl Y3Rpb25zIGluIHRoZSBjb3Zlci1sZXR0ZXIgYW5kIGRvY3VtZW50YXRpb24KICBjb21tZW50cyBy ZWdhcmRpbmcgQ0FQX01BQ19BRE1JTiBjaGVja3MgaW4gSVBFLgoKdjM6CiAgQWRkcmVzcyB2YXJp b3VzIGNvbW1lbnRzIGJ5IEphbm4gSG9ybi4gSGlnaGxpZ2h0czoKICAgIFN3aXRjaCB2YXJpb3Vz IGF1ZGl0IGFsbG9jYXRvcnMgdG8gR0ZQX0tFUk5FTC4KICAgIFV0aWxpemUgcmN1X2FjY2Vzc19w b2ludGVyKCkgaW4gdmFyaW91cyBsb2NhdGlvbnMuCiAgICBTdHJpcCBvdXQgdGhlIGNhY2hpbmcg c3lzdGVtIGZvciBwcm9wZXJ0aWVzCiAgICBTdHJpcCBjb21tZW50cyBmcm9tIGhlYWRlcnMKICAg IE1vdmUgZnVuY3Rpb25zIGFyb3VuZCBpbiBwYXRjaGVzCiAgICBSZW1vdmUga2VybmVsIGNvbW1h bmQgbGluZSBwYXJhbWV0ZXJzCiAgICBSZWNvbmNpbGUgdGhlIHJhY2UgY29uZGl0aW9uIG9uIHRo ZSBkZWxldGUgbm9kZSBmb3IgcG9saWN5IGJ5CiAgICAgIGV4cGFuZGluZyB0aGUgcG9saWN5IGNy aXRpY2FsIHNlY3Rpb24uCgogIEFkZHJlc3MgYSBmZXcgY29tbWVudHMgYnkgSm9uYXRoYW4gQ29y YmV0IGFyb3VuZCB0aGUgZG9jdW1lbnRhdGlvbgogICAgcGFnZXMgZm9yIElQRS4KCiAgRml4IGFu IGlzc3VlIHdpdGggdGhlIGluaXRpYWxpemF0aW9uIG9mIElQRSBwb2xpY3kgd2l0aCBhICItMCIK ICAgIHZlcnNpb24sIGNhdXNlZCBieSBub3QgaW5pdGlhbGl6aW5nIHRoZSBobGlzdCBlbnRyaWVz IGJlZm9yZQogICAgZnJlZWluZy4KCnY0OgogIEFkZHJlc3MgYSBjb25jZXJuIGFyb3VuZCBJUEUn cyBiZWhhdmlvciB3aXRoIHVua25vd24gc3ludGF4LgogICAgU3BlY2lmaWNhbGx5LCBtYWtlIGFu eSB1bmtub3duIHN5bnRheCBhIGZhdGFsIGVycm9yIGluc3RlYWQgb2YgYQogICAgd2FybmluZywg YXMgc3VnZ2VzdGVkIGJ5IE1pY2thw6tsIFNhbGHDvG4uCiAgSW50cm9kdWNlIGEgbmV3IHNlY3Vy aXR5ZnMgbm9kZSwgJHNlY3VyaXR5ZnMvaXBlL3Byb3BlcnR5X2NvbmZpZywKICAgIHdoaWNoIHBy b3ZpZGVzIGEgbGlzdGluZyBvZiB3aGF0IHByb3BlcnRpZXMgYXJlIGVuYWJsZWQgYnkgdGhlCiAg ICBrZXJuZWwgYW5kIHRoZWlyIHZlcnNpb25zLiBUaGlzIGFsbG93cyB1c2VybW9kZSB0byBwcmVk aWN0IHdoYXQKICAgIHBvbGljaWVzIHNob3VsZCBiZSBhbGxvd2VkLgogIFN0cmlwIHNvbWUgY29t bWVudHMgZnJvbSBjIGZpbGVzIHRoYXQgSSBtaXNzZWQuCiAgQ2xhcmlmeSBzb21lIGRvY3VtZW50 YXRpb24gY29tbWVudHMgYXJvdW5kICdib290X3ZlcmlmaWVkJy4KICAgIFdoaWxlIHRoaXMgY3Vy cmVudGx5IGRvZXMgbm90IGZ1bmN0aW9uYWxseSBjaGFuZ2UgdGhlIHByb3BlcnR5CiAgICBpdHNl bGYsIHRoZSBkaXN0aW5jdGlvbiBpcyBpbXBvcnRhbnQgd2hlbiBJUEUgY2FuIGVuZm9yY2UgdmVy aWZpZWQKICAgIHJlYWRzLiBBZGRpdGlvbmFsbHksICdLRVJORUxfUkVBRCcgd2FzIG9taXR0ZWQg ZnJvbSB0aGUgZG9jdW1lbnRhdGlvbi4KICAgIFRoaXMgaGFzIGJlZW4gY29ycmVjdGVkLgogIENo YW5nZSBTZWN1cml0eUZTIGFuZCBTSEExIHRvIGEgcmV2ZXJzZSBkZXBlbmRlbmN5LgogIFVwZGF0 ZSB0aGUgY292ZXItbGV0dGVyIHdpdGggdGhlIHVwZGF0ZWQgYmVoYXZpb3Igb2YgdW5rbm93biBz eW50YXguCiAgUmVtb3ZlIGFsbCBzeXNjdGxzLCBtYWtpbmcgYW4gZXF1aXZhbGVudCBmdW5jdGlv biBpbiBzZWN1cml0eWZzLgogIFJld29yayB0aGUgYWN0aXZlL2RlbGV0ZSBtZWNoYW5pc20gdG8g YmUgYSBub2RlIHVuZGVyIHRoZSBwb2xpY3kgaW4KICAgICRzZWN1cml0eWZzL2lwZS9wb2xpY2ll cy4KICBUaGUga2VybmVsIGNvbW1hbmQgbGluZSBwYXJhbWV0ZXJzIGlwZS5lbmZvcmNlIGFuZCBp cGUuc3VjY2Vzc19hdWRpdAogICAgaGF2ZSByZXR1cm5lZCBhcyB0aGlzIGZ1bmN0aW9uYWxpdHkg aXMgbm8gbG9uZ2VyIGV4cG9zZWQgdGhyb3VnaAogICAgc3lzZnMuCgp2NToKICBDb3JyZWN0IHNv bWUgZ3JhbW1hdGljYWwgZXJyb3JzIHJlcG9ydGVkIGJ5IFJhbmR5IER1bmxhcC4KICBGaXggc29t ZSB3YXJuaW5ncyByZXBvcnRlZCBieSBrZXJuZWwgdGVzdCBib3QuCiAgQ2hhbmdlIGNvbnZlbnRp b24gYXJvdW5kIHNlY3VyaXR5X2JkZXZfc2V0c2VjdXJpdHkuIC1FTk9TWVMKICAgIGlzIG5vdyBl eHBlY3RlZCBpZiBhbiBMU00gZG9lcyBub3QgaW1wbGVtZW50IGEgcGFydGljdWxhciBAbmFtZSwK ICAgIGFzIHN1Z2dlc3RlZCBieSBDYXNleSBTY2hhdWZsZXIuCiAgTWlub3Igc3RyaW5nIGNvcnJl Y3Rpb25zIHJlbGF0ZWQgdG8gdGhlIG1vdmUgZnJvbSBzeXNmcyB0byBzZWN1cml0eWZzCiAgQ29y cmVjdCBhIHNwZWxsaW5nIG9mIGFuICNpZmRlZiBmb3IgdGhlIHBlcm1pc3NpdmUgYXJndW1lbnQu CiAgQWRkIHRoZSBrZXJuZWwgcGFyYW1ldGVycyByZS1hZGRlZCB0byB0aGUgZG9jdW1lbnRhdGlv bi5JbnRlZ3JpdHkgUG9saWN5IEVuZm9yY2VtZW50IExTTSAoSVBFKQoKT3ZlcnZpZXc6Ci0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIGlzIGEgTGludXggU2VjdXJpdHkg TW9kdWxlIHdoaWNoIGFsbG93cyBmb3IgYSBjb25maWd1cmFibGUKcG9saWN5IHRvIGVuZm9yY2Ug aW50ZWdyaXR5IHJlcXVpcmVtZW50cyBvbiB0aGUgd2hvbGUgc3lzdGVtLiBJdAphdHRlbXB0cyB0 byBzb2x2ZSB0aGUgaXNzdWUgb2YgQ29kZSBJbnRlZ3JpdHk6IHRoYXQgYW55IGNvZGUgYmVpbmcK ZXhlY3V0ZWQgKG9yIGZpbGVzIGJlaW5nIHJlYWQpLCBhcmUgaWRlbnRpY2FsIHRvIHRoZSB2ZXJz aW9uIHRoYXQKd2FzIGJ1aWx0IGJ5IGEgdHJ1c3RlZCBzb3VyY2UuCgpUaGUgdHlwZSBvZiBzeXN0 ZW0gZm9yIHdoaWNoIElQRSBpcyBkZXNpZ25lZCBmb3IgdXNlIGlzIGFuIGVtYmVkZGVkIGRldmlj ZQp3aXRoIGEgc3BlY2lmaWMgcHVycG9zZSAoZS5nLiBuZXR3b3JrIGZpcmV3YWxsIGRldmljZSBp biBhIGRhdGEgY2VudGVyKSwKd2hlcmUgYWxsIHNvZnR3YXJlIGFuZCBjb25maWd1cmF0aW9uIGlz IGJ1aWx0IGFuZCBwcm92aXNpb25lZCBieSB0aGUgb3duZXIuCgpTcGVjaWZpY2FsbHksIGEgc3lz dGVtIHdoaWNoIGxldmVyYWdlcyBJUEUgaXMgbm90IGludGVuZGVkIGZvciBnZW5lcmFsCnB1cnBv c2UgY29tcHV0aW5nIGFuZCBkb2VzIG5vdCB1dGlsaXplIGFueSBzb2Z0d2FyZSBvciBjb25maWd1 cmF0aW9uCmJ1aWx0IGJ5IGEgdGhpcmQgcGFydHkuIEFuIGlkZWFsIHN5c3RlbSB0byBsZXZlcmFn ZSBJUEUgaGFzIGJvdGggbXV0YWJsZQphbmQgaW1tdXRhYmxlIGNvbXBvbmVudHMsIGhvd2V2ZXIs IGFsbCBiaW5hcnkgZXhlY3V0YWJsZSBjb2RlIGlzIGltbXV0YWJsZS4KClRoZSBzY29wZSBvZiBJ UEUgaXMgY29uc3RyYWluZWQgdG8gdGhlIE9TLiBJdCBpcyBhc3N1bWVkIHRoYXQgcGxhdGZvcm0K ZmlybXdhcmUgdmVyaWZpZXMgdGhlIHRoZSBrZXJuZWwgYW5kIG9wdGlvbmFsbHkgdGhlIHJvb3Qg ZmlsZXN5c3RlbSAoZS5nLgp2aWEgVS1Cb290IHZlcmlmaWVkIGJvb3QpLiBJUEUgdGhlbiB1dGls aXplcyBMU00gaG9va3MgdG8gZW5mb3JjZSBhCmZsZXhpYmxlLCBrZXJuZWwtcmVzaWRlbnQgaW50 ZWdyaXR5IHZlcmlmaWNhdGlvbiBwb2xpY3kuCgpJUEUgZGlmZmVycyBmcm9tIG90aGVyIExTTXMg d2hpY2ggcHJvdmlkZSBpbnRlZ3JpdHkgY2hlY2tpbmcgKGZvciBpbnN0YW5jZSwKSU1BKSwgYXMg aXQgaGFzIG5vIGRlcGVuZGVuY3kgb24gdGhlIGZpbGVzeXN0ZW0gbWV0YWRhdGEgaXRzZWxmLiBU aGUKYXR0cmlidXRlcyB0aGF0IElQRSBjaGVja3MgYXJlIGRldGVybWluaXN0aWMgcHJvcGVydGll cyB0aGF0IGV4aXN0IHNvbGVseQppbiB0aGUga2VybmVsLiBBZGRpdGlvbmFsbHksIElQRSBwcm92 aWRlcyBubyBhZGRpdGlvbmFsIG1lY2hhbmlzbXMgb2YKdmVyaWZ5aW5nIHRoZXNlIGZpbGVzIChl LmcuIElNQSBTaWduYXR1cmVzKSAtIGFsbCBvZiB0aGUgYXR0cmlidXRlcyBvZgp2ZXJpZnlpbmcg ZmlsZXMgYXJlIGV4aXN0aW5nIGZlYXR1cmVzIHdpdGhpbiB0aGUga2VybmVsLCBzdWNoIGFzIGRt LXZlcml0eQpvciBmc3Zlcml0eS4KCklQRSBwcm92aWRlcyBhIHBvbGljeSB0aGF0IGFsbG93cyBv d25lcnMgb2YgdGhlIHN5c3RlbSB0byBlYXNpbHkgc3BlY2lmeQppbnRlZ3JpdHkgcmVxdWlyZW1l bnRzIGFuZCB1c2VzIGRtLXZlcml0eSBzaWduYXR1cmVzIHRvIHNpbXBsaWZ5IHRoZQphdXRoZW50 aWNhdGlvbiBvZiBhbGxvd2VkIG9iamVjdHMgbGlrZSBhdXRob3JpemVkIGNvZGUgYW5kIGRhdGEu CgpJUEUgc3VwcG9ydHMgdHdvIG1vZGVzLCBwZXJtaXNzaXZlIChzaW1pbGFyIHRvIFNFTGludXgn cyBwZXJtaXNzaXZlIG1vZGUpCmFuZCBlbmZvcmNlLiBQZXJtaXNzaXZlIG1vZGUgcGVyZm9ybXMg dGhlIHNhbWUgY2hlY2tzLCBhbmQgbG9ncyBwb2xpY3kKdmlvbGF0aW9ucyBhcyBlbmZvcmNlIG1v ZGUsIGJ1dCB3aWxsIG5vdCBlbmZvcmNlIHRoZSBwb2xpY3kuIFRoaXMgYWxsb3dzCnVzZXJzIHRv IHRlc3QgcG9saWNpZXMgYmVmb3JlIGVuZm9yY2luZyB0aGVtLgoKVGhlIGRlZmF1bHQgbW9kZSBp cyBlbmZvcmNlLCBhbmQgY2FuIGJlIGNoYW5nZWQgdmlhIHRoZSBrZXJuZWwgY29tbWFuZGxpbmUK cGFyYW1ldGVyIGBpcGUuZW5mb3JjZT0oMHwxKWAsIG9yIHRoZSBzZWN1cml0eWZzIG5vZGUKYC9z eXMva2VybmVsL3NlY3VyaXR5L2lwZS9lbmZvcmNlYC4gVGhlIGFiaWxpdHkgdG8gc3dpdGNoIG1v ZGVzIGNhbiBiZQpjb21waWxlZCBvdXQgb2YgdGhlIExTTSB2aWEgc2V0dGluZyB0aGUgY29uZmln CkNPTkZJR19TRUNVUklUWV9JUEVfUEVSTUlTU0lWRV9TV0lUQ0ggdG8gTi4KCklQRSBhZGRpdGlv bmFsbHkgc3VwcG9ydHMgc3VjY2VzcyBhdWRpdGluZy4gV2hlbiBlbmFibGVkLCBhbGwgZXZlbnRz CnRoYXQgcGFzcyBJUEUgcG9saWN5IGFuZCBhcmUgbm90IGJsb2NrZWQgd2lsbCBlbWl0IGFuIGF1 ZGl0IGV2ZW50LiBUaGlzCmlzIGRpc2FibGVkIGJ5IGRlZmF1bHQsIGFuZCBjYW4gYmUgZW5hYmxl ZCB2aWEgdGhlIGtlcm5lbCBjb21tYW5kbGluZQpgaXBlLnN1Y2Nlc3NfYXVkaXQ9KDB8MSlgIG9y IHRoZSBzZWN1cml0eWZzIG5vZGUKYC9zeXMva2VybmVsL3NlY3VyaXR5L2lwZS9zdWNjZXNzX2F1 ZGl0YC4KClBvbGljaWVzIGNhbiBiZSBzdGFnZWQgYXQgcnVudGltZSB0aHJvdWdoIHNlY3VyaXR5 ZnMgYW5kIGFjdGl2YXRlZCB0aHJvdWdoCnN5c2ZzLiBQbGVhc2Ugc2VlIHRoZSBEZXBsb3lpbmcg UG9saWNpZXMgc2VjdGlvbiBvZiB0aGlzIGNvdmVyIGxldHRlciBmb3IKbW9yZSBpbmZvcm1hdGlv bi4KClRoZSBJUEUgTFNNIGlzIGNvbXBpbGVkIHVuZGVyIENPTkZJR19TRUNVUklUWV9JUEUuCgpQ b2xpY3k6Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIHBvbGljeSBp cyBkZXNpZ25lZCB0byBiZSBib3RoIGZvcndhcmQgY29tcGF0aWJsZSBhbmQgYmFja3dhcmRzCmNv bXBhdGlibGUuIFRoZXJlIGlzIG9uZSByZXF1aXJlZCBsaW5lLCBhdCB0aGUgdG9wIG9mIHRoZSBw b2xpY3ksCmluZGljYXRpbmcgdGhlIHBvbGljeSBuYW1lLCBhbmQgdGhlIHBvbGljeSB2ZXJzaW9u LCBmb3IgaW5zdGFuY2U6CgogIHBvbGljeV9uYW1lPSJFeCBQb2xpY3kiIHBvbGljeV92ZXJzaW9u PTAuMC4wCgpUaGUgcG9saWN5IHZlcnNpb24gaW5kaWNhdGVzIHRoZSBjdXJyZW50IHZlcnNpb24g b2YgdGhlIHBvbGljeSAoTk9UIHRoZQpwb2xpY3kgc3ludGF4IHZlcnNpb24pLiBUaGlzIGlzIHVz ZWQgdG8gcHJldmVudCByb2xsLWJhY2sgb2YgcG9saWN5IHRvCnBvdGVudGlhbGx5IGluc2VjdXJl IHByZXZpb3VzIHZlcnNpb25zIG9mIHRoZSBwb2xpY3kuCgpUaGUgbmV4dCBwb3J0aW9uIG9mIElQ RSBwb2xpY3ksIGFyZSBydWxlcy4gUnVsZXMgYXJlIGZvcm1lZCBieSBrZXk9dmFsdWUKcGFpcnMs IGtub3duIGFzIHByb3BlcnRpZXMuIElQRSBydWxlcyByZXF1aXJlIHR3byBwcm9wZXJ0aWVzOiAi YWN0aW9uIiwKd2hpY2ggZGV0ZXJtaW5lcyB3aGF0IElQRSBkb2VzIHdoZW4gaXQgZW5jb3VudGVy cyBhIG1hdGNoIGFnYWluc3QgdGhlCnBvbGljeSwgYW5kICJvcCIsIHdoaWNoIGRldGVybWluZXMg d2hlbiB0aGF0IHJ1bGUgc2hvdWxkIGJlIGV2YWx1YXRlZC4KVGh1cywgYSBtaW5pbWFsIHJ1bGUg aXM6CgogIG9wPUVYRUNVVEUgYWN0aW9uPUFMTE9XCgpUaGlzIGV4YW1wbGUgd2lsbCBhbGxvdyBh bnkgZXhlY3V0aW9uLiBBZGRpdGlvbmFsIHByb3BlcnRpZXMgYXJlIHVzZWQgdG8KcmVzdHJpY3Qg YXR0cmlidXRlcyBhYm91dCB0aGUgZmlsZXMgYmVpbmcgZXZhbHVhdGVkLiBUaGVzZSBwcm9wZXJ0 aWVzIGFyZQppbnRlbmRlZCB0byBiZSBkZXRlcm1pbmlzdGljIGF0dHJpYnV0ZXMgdGhhdCBhcmUg cmVzaWRlbnQgaW4gdGhlIGtlcm5lbC4KQXZhaWxhYmxlIHByb3BlcnRpZXMgZm9yIElQRSBkZXNj cmliZWQgaW4gdGhlIHByb3BlcnRpZXMgc2VjdGlvbiBvZiB0aGlzCmNvdmVyLWxldHRlciwgdGhl IHJlcG9zaXRvcnkgYXZhaWxhYmxlIGluIEFwcGVuZGl4IEEsIGFuZCB0aGUga2VybmVsCmRvY3Vt ZW50YXRpb24gcGFnZS4KCk9yZGVyIGRvZXMgbm90IG1hdHRlciBmb3IgdGhlIHJ1bGUncyBwcm9w ZXJ0aWVzIC0gdGhleSBjYW4gYmUgbGlzdGVkIGluCmFueSBvcmRlciwgaG93ZXZlciBpdCBpcyBl bmNvdXJhZ2VkIHRvIGhhdmUgdGhlICJvcCIgcHJvcGVydHkgYmUgZmlyc3QsCmFuZCB0aGUgImFj dGlvbiIgcHJvcGVydHkgYmUgbGFzdCwgZm9yIHJlYWRhYmlsaXR5LgoKQWRkaXRpb25hbGx5LCBy dWxlcyBhcmUgZXZhbHVhdGVkIHRvcC10by1ib3R0b20uIEFzIGEgcmVzdWx0LCBhbnkKcmV2b2Nh dGlvbiBydWxlcywgb3IgZGVuaWVzIHNob3VsZCBiZSBwbGFjZWQgZWFybHkgaW4gdGhlIGZpbGUg dG8gZW5zdXJlCnRoYXQgdGhlc2UgcnVsZXMgYXJlIGV2YWx1YXRlZCBiZWZvcmUgYSBydWxlIHdp dGggImFjdGlvbj1BTExPVyIgaXMgaGl0LgoKQW55IHVua25vd24gc3ludGF4IGluIElQRSBwb2xp Y3kgd2lsbCByZXN1bHQgaW4gYSBmYXRhbCBlcnJvciB0byBwYXJzZQp0aGUgcG9saWN5LiBVc2Vy IG1vZGUgY2FuIGludGVycm9nYXRlIHRoZSBrZXJuZWwgdG8gdW5kZXJzdGFuZCB3aGF0CnByb3Bl cnRpZXMgYW5kIHRoZSBhc3NvY2lhdGVkIHZlcnNpb25zIHRocm91Z2ggdGhlIHNlY3VyaXR5ZnMg bm9kZSwKJHNlY3VyaXR5ZnMvaXBlL3Byb3BlcnR5X2NvbmZpZywgd2hpY2ggd2lsbCByZXR1cm4g YSBzdHJpbmcgb2YgZm9ybToKCiAga2V5MT12ZXJzaW9uMQogIGtleTI9dmVyc2lvbjIKICAuCiAg LgogIC4KICBrZXlOPXZlcnNpb25OCgpVc2VyLW1vZGUgc2hvdWxkIGNvcnJlbGF0ZSB0aGVzZSB2 ZXJzaW9ucyB3aXRoIHRoZSBzdXBwb3J0ZWQgdmFsdWVzCmlkZW50aWZpZWQgaW4gdGhlIGRvY3Vt ZW50YXRpb24gdG8gZGV0ZXJtaW5lIHdoZXRoZXIgYSBwb2xpY3kgc2hvdWxkCmJlIGFjY2VwdGVk IGJ5IHRoZSBzeXN0ZW0uCgpBZGRpdGlvbmFsbHksIGEgREVGQVVMVCBvcGVyYXRpb24gbXVzdCBi ZSBzZXQgZm9yIGFsbCB1bmRlcnN0b29kCm9wZXJhdGlvbnMgd2l0aGluIElQRS4gRm9yIHBvbGlj aWVzIHRvIHJlbWFpbiBjb21wbGV0ZWx5IGZvcndhcmRzCmNvbXBhdGlibGUsIGl0IGlzIHJlY29t bWVuZGVkIHRoYXQgdXNlcnMgYWRkIGEgIkRFRkFVTFQgYWN0aW9uPUFMTE9XIgphbmQgb3ZlcnJp ZGUgdGhlIGRlZmF1bHRzIG9uIGEgcGVyLW9wZXJhdGlvbiBiYXNpcy4KCkZvciBtb3JlIGluZm9y bWF0aW9uIGFib3V0IHRoZSBwb2xpY3kgc3ludGF4LCBwbGVhc2Ugc2VlIEFwcGVuZGl4IEEgb3IK dGhlIGtlcm5lbCBkb2N1bWVudGF0aW9uIHBhZ2UuCgpFYXJseSBVc2VybW9kZSBQcm90ZWN0aW9u OgotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIGNhbiBiZSBwcm92aWRlZCB3aXRoIGEg cG9saWN5IGF0IHN0YXJ0dXAgdG8gbG9hZCBhbmQgZW5mb3JjZS4KVGhpcyBpcyBpbnRlbmRlZCB0 byBiZSBhIG1pbmltYWwgcG9saWN5IHRvIGdldCB0aGUgc3lzdGVtIHRvIGEgc3RhdGUKd2hlcmUg dXNlcmxhbmQgaXMgc2V0dXAgYW5kIHJlYWR5IHRvIHJlY2VpdmUgY29tbWFuZHMsIGF0IHdoaWNo CnBvaW50IGEgcG9saWN5IGNhbiBiZSBkZXBsb3llZCB2aWEgc2VjdXJpdHlmcy4gVGhpcyAiYm9v dCBwb2xpY3kiIGNhbiBiZQpzcGVjaWZpZWQgdmlhIHRoZSBjb25maWcsIFNFQ1VSSVRZX0lQRV9C T09UX1BPTElDWSwgd2hpY2ggYWNjZXB0cyBhIHBhdGgKdG8gYSBwbGFpbi10ZXh0IHZlcnNpb24g b2YgdGhlIElQRSBwb2xpY3kgdG8gYXBwbHkuIFRoaXMgcG9saWN5IHdpbGwgYmUKY29tcGlsZWQg aW50byB0aGUga2VybmVsLiBJZiBub3Qgc3BlY2lmaWVkLCBJUEUgd2lsbCBiZSBkaXNhYmxlZCB1 bnRpbCBhCnBvbGljeSBpcyBkZXBsb3llZCBhbmQgYWN0aXZhdGVkIHRocm91Z2ggdGhlIG1ldGhv ZCBhYm92ZS4KClBvbGljeSBFeGFtcGxlczoKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tCgpBbGxvdyBhbGw6CgogIHBvbGljeV9uYW1lPSJBbGxvdyBBbGwiIHBvbGljeV92ZXJz aW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249QUxMT1cKCkFsbG93IG9ubHkgaW5pdGlhbCBzdXBl cmJsb2NrOgoKICBwb2xpY3lfbmFtZT0iQWxsb3cgQWxsIEluaXRpYWwgU0IiIHBvbGljeV92ZXJz aW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249REVOWQoKICBvcD1FWEVDVVRFIGJvb3RfdmVyaWZp ZWQ9VFJVRSBhY3Rpb249QUxMT1cKCkFsbG93IGFueSBzaWduZWQgZG0tdmVyaXR5IHZvbHVtZSBh bmQgdGhlIGluaXRpYWwgc3VwZXJibG9jazoKCiAgcG9saWN5X25hbWU9IkFsbG93U2lnbmVkQW5k SW5pdGlhbCIgcG9saWN5X3ZlcnNpb249MC4wLjAKICBERUZBVUxUIGFjdGlvbj1ERU5ZCgogIG9w PUVYRUNVVEUgYm9vdF92ZXJpZmllZD1UUlVFIGFjdGlvbj1BTExPVwogIG9wPUVYRUNVVEUgZG12 ZXJpdHlfc2lnbmF0dXJlPVRSVUUgYWN0aW9uPUFMTE9XCgpQcm9oaWJpdCBleGVjdXRpb24gZnJv bSBhIHNwZWNpZmljIGRtLXZlcml0eSB2b2x1bWU6CgogIHBvbGljeV9uYW1lPSJBbGxvd1NpZ25l ZEFuZEluaXRpYWwiIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249REVOWQoK ICBvcD1FWEVDVVRFIGRtdmVyaXR5X3Jvb3RoYXNoPTQwMWZjZWM1OTQ0ODIzYWUxMmY2MjcyNmU4 MTg0NDA3YTVmYTk1OTk3ODNmMDMwZGVjMTQ2OTM4IGFjdGlvbj1ERU5ZCiAgb3A9RVhFQ1VURSBi b290X3ZlcmlmaWVkPVRSVUUgYWN0aW9uPUFMTE9XCiAgb3A9RVhFQ1VURSBkbXZlcml0eV9zaWdu YXR1cmU9VFJVRSBhY3Rpb249QUxMT1cKCkFsbG93IG9ubHkgYSBzcGVjaWZpYyBkbS12ZXJpdHkg dm9sdW1lOgoKICBwb2xpY3lfbmFtZT0iQWxsb3dTaWduZWRBbmRJbml0aWFsIiBwb2xpY3lfdmVy c2lvbj0wLjAuMAogIERFRkFVTFQgYWN0aW9uPURFTlkKCiAgb3A9RVhFQ1VURSBkbXZlcml0eV9y b290aGFzaD00MDFmY2VjNTk0NDgyM2FlMTJmNjI3MjZlODE4NDQwN2E1ZmE5NTk5NzgzZjAzMGRl YzE0NjkzOCBhY3Rpb249QUxMT1cKCkRlcGxveWluZyBQb2xpY2llczoKLS0tLS0tLS0tLS0tLS0t LS0tLQoKRGVwbG95aW5nIHBvbGljaWVzIGlzIHNpbXBsZS4gRmlyc3Qgc2lnbiBhIHBsYWluIHRl eHQgcG9saWN5LCB3aXRoIGEKY2VydGlmaWNhdGUgdGhhdCBpcyBwcmVzZW50IGluIHRoZSBTWVNU RU1fVFJVU1RFRF9LRVlSSU5HIG9mIHlvdXIgdGVzdAptYWNoaW5lLiBUaHJvdWdoIG9wZW5zc2ws IHRoZSBzaWduaW5nIGNhbiBiZSBkb25lIHZpYToKCiAgb3BlbnNzbCBzbWltZSAtc2lnbiAtaW4g IiRNWV9QT0xJQ1kiIC1zaWduZXIgIiRNWV9DRVJUSUZJQ0FURSIgXAogICAgLWlua2V5ICIkTVlf UFJJVkFURV9LRVkiIC1iaW5hcnkgLW91dGZvcm0gZGVyIC1ub2F0dHIgLW5vZGV0YWNoIFwKICAg IC1vdXQgIiRNWV9QT0xJQ1kucDdzIgoKVGhlbiwgc2ltcGx5IGNhdCB0aGUgZmlsZSBpbnRvIHRo ZSBJUEUncyAibmV3X3BvbGljeSIgc2VjdXJpdHlmcyBub2RlOgoKICBjYXQgIiRNWV9QT0xJQ1ku cDdzIiA+IC9zeXMva2VybmVsL3NlY3VyaXR5L2lwZS9uZXdfcG9saWN5CgpUaGUgcG9saWN5IHNo b3VsZCBub3cgYmUgcHJlc2VudCB1bmRlciB0aGUgcG9saWNpZXMvIHN1YmRpcmVjdG9yeSwgdW5k ZXIKaXRzICJwb2xpY3lfbmFtZSIgYXR0cmlidXRlLgoKVGhlIHBvbGljeSBpcyBub3cgcHJlc2Vu dCBpbiB0aGUga2VybmVsIGFuZCBjYW4gYmUgbWFya2VkIGFzIGFjdGl2ZSwKdmlhIHRoZSBzeXNj dGwgImlwZS5hY3RpdmVfcG9saWN5IjoKCiAgZWNobyAtbiAxID4gIi9zeXMva2VybmVsL3NlY3Vy aXR5L2lwZS8kTVlfUE9MSUNZX05BTUUvYWN0aXZlIgoKVGhpcyB3aWxsIG5vdyBtYXJrIHRoZSBw b2xpY3kgYXMgYWN0aXZlIGFuZCB0aGUgc3lzdGVtIHdpbGwgYmUgZW5mb3JjaW5nCiRNWV9QT0xJ Q1lfTkFNRS4gQXQgYW55IHBvaW50IHRoZSBwb2xpY3kgY2FuIGJlIHVwZGF0ZWQgb24gdGhlIHBy b3Zpc2lvbgp0aGF0IHRoZSBwb2xpY3kgdmVyc2lvbiB0byBiZSBkZXBsb3llZCBpcyBncmVhdGVy IHRoYW4gb3IgZXF1YWwgdG8gdGhlCnJ1bm5pbmcgdmVyc2lvbiAodG8gcHJldmVudCByb2xsLWJh Y2sgYXR0YWNrcykuIFRoaXMgdXBkYXRlIGNhbiBiZSBkb25lCmJ5IHJlZGlyZWN0aW5nIHRoZSBm aWxlIGludG8gdGhlIHBvbGljeSdzICJyYXciIG5vZGUsIHVuZGVyIHRoZSBwb2xpY2llcwpzdWJk aXJlY3Rvcnk6CgogIGNhdCAiJE1ZX1VQREFURURfUE9MSUNZLnA3cyIgPiBcCiAgICAiL3N5cy9r ZXJuZWwvc2VjdXJpdHkvaXBlL3BvbGljaWVzLyRNWV9QT0xJQ1lfTkFNRS9yYXciCgpBZGRpdGlv bmFsbHksIHBvbGljaWVzIGNhbiBiZSBkZWxldGVkIHZpYSB0aGUgImRlbF9wb2xpY3kiIHNlY3Vy aXR5ZnMKbm9kZS4gU2ltcGx5IHdyaXRlIHRoZSBuYW1lIG9mIHRoZSBwb2xpY3kgdG8gYmUgZGVs ZXRlZCB0byB0aGF0IG5vZGU6CgogIGVjaG8gLW4gMSA+CiAgICAiL3N5cy9rZXJuZWwvc2VjdXJp dHkvaXBlL3BvbGljaWVzLyRNWV9QT0xJQ1lfTkFNRS9kZWxldGUiCgpUaGVyZSBhcmUgdHdvIHJl cXVpcmVtZW50cyB0byBkZWxldGUgcG9saWNpZXM6CgoxLiBUaGUgcG9saWN5IGJlaW5nIGRlbGV0 ZWQgbXVzdCBub3QgYmUgdGhlIGFjdGl2ZSBwb2xpY3kuCjIuIFRoZSBwb2xpY3kgYmVpbmcgZGVs ZXRlZCBtdXN0IG5vdCBiZSB0aGUgYm9vdCBwb2xpY3kuCgpJdCdzIGltcG9ydGFudCB0byBrbm93 IGFib3ZlIHRoYXQgdGhlICJlY2hvIiBjb21tYW5kIHdpbGwgYWRkIGEgbmV3bGluZQp0byB0aGUg ZW5kIG9mIHRoZSBpbnB1dCwgYW5kIHRoaXMgd2lsbCBiZSBjb25zaWRlcmVkIGFzIHBhcnQgb2Yg dGhlCmZpbGVuYW1lLiBZb3UgY2FuIHJlbW92ZSB0aGUgbmV3bGluZSB2aWEgdGhlIC1uIHBhcmFt ZXRlci4KCk5PVEU6IElmIGEgTUFDIExTTSBpcyBlbmFibGVkLCB0aGUgc2VjdXJpdHlmcyBjb21t YW5kcyB3aWxsIHJlcXVpcmUKQ0FQX01BQ19BRE1JTi4gVGhpcyBpcyBkdWUgdG8gc3lzZnMgc3Vw cG9ydGluZyBmaW5lLWdyYWluZWQgTUFDCmF0dHJpYnV0ZXMsIHdoaWxlIHNlY3VyaXR5ZnMgYXQg dGhlIGN1cnJlbnQgbW9tZW50IGRvZXMgbm90LgoKUHJvcGVydGllczoKLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tCgpUaGlzIGluaXRpYWwgcGF0Y2hzZXQgaW50cm9kdWNpbmcg SVBFIGFkZHMgdGhyZWUgcHJvcGVydGllczoKJ2Jvb3RfdmVyaWZpZWQnLCAnZG12ZXJpdHlfc2ln bmF0dXJlJyBhbmQgJ2RtdmVyaXR5X3Jvb3RoYXNoJy4KCmJvb3RfdmVyaWZpZWQgKENPTkZJR19J UEVfQk9PVF9QUk9QKToKICBUaGlzIHByb3BlcnR5IGNhbiBiZSB1dGlsaXplZCBmb3IgYXV0aG9y aXphdGlvbiBvZiB0aGUgZmlyc3QKICBzdXBlci1ibG9jayB0aGF0IGlzIG1vdW50ZWQgb24gdGhl IHN5c3RlbSwgd2hlcmUgSVBFIGF0dGVtcHRzCiAgdG8gZXZhbHVhdGUgYSBmaWxlLiBUeXBpY2Fs bHkgdGhpcyBpcyB1c2VkIGZvciBzeXN0ZW1zIHdpdGgKICBhbiBpbml0cmFtZnMgb3Igb3RoZXIg aW5pdGlhbCBkaXNrLCB3aGVyZSB0aGlzIGlzIHVubW91bnRlZCBiZWZvcmUKICB0aGUgc3lzdGVt IGJlY29tZXMgYXZhaWxhYmxlLCBhbmQgaXMgbm90IGNvdmVyZWQgYnkgYW55IG90aGVyIHByb3Bl cnR5LgogIFRoZSBmb3JtYXQgb2YgdGhpcyBwcm9wZXJ0eSBpczoKCiAgICBib290X3ZlcmlmaWVk PShUUlVFfEZBTFNFKQoKICBXQVJOSU5HOiBUaGlzIHByb3BlcnR5IHdpbGwgdHJ1c3QgYW55IGRp c2sgd2hlcmUgdGhlIGZpcnN0IElQRQogIGV2YWx1YXRpb24gb2NjdXJzLiBJZiB5b3UgZG8gbm90 IGhhdmUgYSBzdGFydHVwIGRpc2sgdGhhdCBpcwogIHVucGFja2VkIGFuZCB1bm1vdW50ZWQgKGxp a2UgaW5pdHJhbWZzKSwgdGhlbiBpdCB3aWxsIGF1dG9tYXRpY2FsbHkKICB0cnVzdCB0aGUgcm9v dCBmaWxlc3lzdGVtIGFuZCBwb3RlbnRpYWxseSBvdmVyYXV0aG9yaXplIHRoZSBlbnRpcmUKICBk aXNrLgoKZG12ZXJpdHlfcm9vdGhhc2ggKENPTkZJR19JUEVfRE1fVkVSSVRZX1JPT1RIQVNIKToK ICBUaGlzIHByb3BlcnR5IGNhbiBiZSB1dGlsaXplZCBmb3IgYXV0aG9yaXphdGlvbiBvciByZXZv Y2F0aW9uIG9mCiAgc3BlY2lmaWMgZG12ZXJpdHkgdm9sdW1lcywgaWRlbnRpZmllZCB2aWEgcm9v dCBoYXNoLiBJdCBoYXMgYQogIGRlcGVuZGVuY3kgb24gdGhlIERNX1ZFUklUWSBtb2R1bGUuIFRo ZSBmb3JtYXQgb2YgdGhpcyBwcm9wZXJ0eSBpczoKCiAgICBkbXZlcml0eV9yb290aGFzaD08SGFz aEhleERpZ2VzdD4KCmRtdmVyaXR5X3NpZ25hdHVyZSAoQ09ORklHX0lQRV9ETV9WRVJJVFlfU0lH TkFUVVJFKToKICBUaGlzIHByb3BlcnR5IGNhbiBiZSB1dGlsaXplZCBmb3IgYXV0aG9yaXphdGlv biBvZiBhbGwgZG0tdmVyaXR5CiAgdm9sdW1lcyB0aGF0IGhhdmUgYSBzaWduZWQgcm9vdGhhc2gg dGhhdCBjaGFpbnMgdG8gdGhlIHN5c3RlbQogIHRydXN0ZWQga2V5cmluZy4gSXQgaGFzIGEgZGVw ZW5kZW5jeSBvbiB0aGUKICBETV9WRVJJVFlfVkVSSUZZX1JPT1RIQVNIX1NJRyBjb25maWcuIFRo ZSBmb3JtYXQgb2YgdGhpcyBwcm9wZXJ0eSBpczoKCiAgICBkbXZlcml0eV9zaWduYXR1cmU9KFRS VUV8RkFMU0UpCgpUZXN0aW5nOgotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0K CkEgdGVzdCBzdWl0ZSBpcyBhdmFpbGFibGUgKEFwcGVuZGl4IEIpIGZvciBlYXNlIG9mIHVzZS4g Rm9yIG1hbnVhbAppbnN0cnVjdGlvbnM6CgpFbmFibGUgSVBFIHRocm91Z2ggdGhlIGZvbGxvd2lu ZyBLY29uZmlnczoKCiAgQ09ORklHX1NFQ1VSSVRZX0lQRT15CiAgQ09ORklHX1NFQ1VSSVRZX0lQ RV9CT09UX1BPTElDWT0iLi4vQWxsb3dBbGxJbml0aWFsU0IucG9sIgogIENPTkZJR19TRUNVUklU WV9JUEVfUEVSTUlTU0lWRV9TV0lUQ0g9eQogIENPTkZJR19JUEVfQk9PVF9QUk9QPXkKICBDT05G SUdfSVBFX0RNX1ZFUklUWV9ST09USEFTSD15CiAgQ09ORklHX0lQRV9ETV9WRVJJVFlfU0lHTkFU VVJFPXkKICBDT05GSUdfRE1fVkVSSVRZPXkKICBDT05GSUdfRE1fVkVSSVRZX1ZFUklGWV9ST09U SEFTSF9TSUc9eQogIENPTkZJR19TWVNURU1fVFJVU1RFRF9LRVlSSU5HPXkKICBDT05GSUdfU1lT VEVNX1RSVVNURURfS0VZUz0iL3BhdGgvdG8vbXkvY2VydC9saXN0LnBlbSIKClN0YXJ0IGEgdGVz dCBzeXN0ZW0sIHRoYXQgYm9vdHMgZGlyZWN0bHkgZnJvbSB0aGUgZmlsZXN5c3RlbSwgd2l0aG91 dAphbiBpbml0cmQuIEkgcmVjb21tZW5kIHRlc3RpbmcgaW4gcGVybWlzc2l2ZSBtb2RlIHVudGls IGFsbCB0ZXN0cwpwYXNzLCB0aGVuIHN3aXRjaCB0byBlbmZvcmNlIHRvIGVuc3VyZSBiZWhhdmlv ciByZW1haW5zIGlkZW50aWNhbC4KCmJvb3RfdmVyaWZpZWQ6CgogIElmIGJvb3RlZCBjb3JyZWN0 bHksIHRoZSBmaWxlc3lzdGVtIG1vdW50ZWQgb24gLyBzaG91bGQgYmUgbWFya2VkIGFzCiAgYm9v dF92ZXJpZmllZC4gVmVyaWZ5IGJ5IHR1cm5pbmcgb24gc3VjY2VzcyBhdWRpdGluZyAoc3lzY3Rs CiAgaXBlLnN1Y2Nlc3NfYXVkaXQ9MSksIGFuZCBydW4gYSBiaW5hcnkuIEluIHRoZSBhdWRpdCBv dXRwdXQsCiAgYHByb3BfYm9vdF92ZXJpZmllZGAgc2hvdWxkIGJlIGBUUlVFYC4KCiAgVG8gdGVz dCBkZW5pYWxzLCBtb3VudCBhIHRlbXBvcmFyeSBmaWxlc3lzdGVtIChtb3VudCAtdCB0bXBmcyAt bwogIHNpemU9NE0gdG1wIHRtcCksIGFuZCBjb3B5IGEgYmluYXJ5IChlLmcuIGxzKSB0byB0aGlz IG5ldwogIGZpbGVzeXN0ZW0uIERpc2FibGUgc3VjY2VzcyBhdWRpdGluZyBhbmQgYXR0ZW1wdCB0 byBydW4gdGhlIGZpbGUuCiAgVGhlIGZpbGUgc2hvdWxkIGhhdmUgYW4gYXVkaXQgZXZlbnQsIGJ1 dCBiZSBhbGxvd2VkIHRvIGV4ZWN1dGUgaW4KICBwZXJtaXNzaXZlIG1vZGUsIGFuZCBwcm9wX2Jv b3RfdmVyaWZpZWQgc2hvdWxkIGJlIEZBTFNFLgoKZG12ZXJpdHlfcm9vdGhhc2g6CgogIEZpcnN0 LCB5b3UgbXVzdCBjcmVhdGUgYSBkbS12ZXJpdHkgdm9sdW1lLiBUaGlzIGNhbiBiZSBkb25lIHRo cm91Z2gKICBzcXVhc2hmcy10b29scyBhbmQgdmVyaXR5c2V0dXAgKHByb3ZpZGVkIGJ5IGNyeXB0 c2V0dXApLgoKICBDcmVhdGluZyBhIHNxdWFzaGZzIHZvbHVtZToKCiAgICBta3NxdWFzaGZzIC9w YXRoL3RvL2RpcmVjdG9yeS93aXRoL2V4ZWN1dGFibGUgL3BhdGgvdG8vb3V0cHV0LnNxdWFzaGZz CgogIEZvcm1hdCB0aGUgdm9sdW1lIGZvciB1c2Ugd2l0aCBkbS12ZXJpdHkgJiBzYXZlIHRoZSBy b290IGhhc2g6CgogICAgb3V0cHV0X3JoPSQodmVyaXR5c2V0dXAgZm9ybWF0IG91dHB1dC5zcXVh c2hmcyBvdXRwdXQuaGFzaHRyZWUgfCBcCiAgICAgIHRlZSB2ZXJpdHlfb3V0LnR4dCB8IGF3ayAi L1Jvb3QgaGFzaC8iIHwgXAogICAgICBzZWQgLUUgInMvUm9vdCBoYXNoOlxzKy8vZyIpCgogICAg ZWNobyAtbiAkb3V0cHV0X3JoID4gb3V0cHV0LnJvb3RoYXNoCgogIENyZWF0ZSBhIHR3byBwb2xp Y2llcywgZmlsbGluZyBpbiB0aGUgYXBwcm9wcmlhdGUgZmllbGRzIGJlbG93OgoKICAgIFBvbGlj eSAxOgoKICAgICAgcG9saWN5X25hbWU9InJvb3RoYXNoLWRlbmlhbCIgcG9saWN5X3ZlcnNpb249 MC4wLjAKICAgICAgREVGQVVMVCBhY3Rpb249QUxMT1cKICAgICAgb3A9RVhFQ1VURSBkbXZlcml0 eV9yb290aGFzaD0kb3V0cHV0X3JoIGFjdGlvbj1ERU5ZCgogICAgUG9saWN5IDI6CgogICAgICBw b2xpY3lfbmFtZT0icm9vdGhhc2gtYWxsb3ciIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgICAgIERF RkFVTFQgYWN0aW9uPUFMTE9XCiAgICAgIERFRkFVTFQgb3A9RVhFQ1VURSBhY3Rpb249REVOWQoK ICAgICAgb3A9RVhFQ1VURSBib290X3ZlcmlmaWVkPVRSVUUgYWN0aW9uPUFMTE9XCiAgICAgIG9w PUVYRUNVVEUgZG12ZXJpdHlfcm9vdGhhc2g9JG91dHB1dF9yaCBhY3Rpb249QUxMT1cKCiAgRGVw bG95IGVhY2ggcG9saWN5LCB0aGVuIG1hcmsgdGhlIGZpcnN0LCAicm9vdGhhc2gtZGVuaWFsIiBh cyBhY3RpdmUsCiAgcGVyIHRoZSAiRGVwbG95aW5nIFBvbGljaWVzIiBzZWN0aW9uIG9mIHRoaXMg Y292ZXIgbGV0dGVyLiBNb3VudCB0aGUKICBkbS12ZXJpdHkgdm9sdW1lOgoKICAgIHZlcml0eXNl dHVwIG9wZW4gb3V0cHV0LnNxdWFzaGZzIG91dHB1dC5oYXNodHJlZSB1bnZlcmlmaWVkIFwKICAg ICAgYGNhdCBvdXRwdXQucm9vdGhhc2hgCgogICAgbW91bnQgL2Rldi9tYXBwZXIvdW52ZXJpZmll ZCAvbXkvbW91bnQvcG9pbnQKCiAgQXR0ZW1wdCB0byBleGVjdXRlIGEgYmluYXJ5IGluIHRoZSBt b3VudCBwb2ludCwgYW5kIGl0IHNob3VsZCBlbWl0IGFuCiAgYXVkaXQgZXZlbnQgZm9yIGEgbWF0 Y2ggYWdhaW5zdCB0aGUgcnVsZToKICAKICAgIG9wPUVYRUNVVEUgZG12ZXJpdHlfcm9vdGhhc2g9 JG91dHB1dF9yaCBhY3Rpb249REVOWQoKICBUbyB0ZXN0IHRoZSBzZWNvbmQgcG9saWN5LCBwZXJm b3JtIHRoZSBzYW1lIHN0ZXBzLCBidXQgdGhpcyB0aW1lLCBlbmFibGUKICBzdWNjZXNzIGF1ZGl0 aW5nIGJlZm9yZSBydW5uaW5nIHRoZSBleGVjdXRhYmxlLiBUaGUgc3VjY2VzcyBhdWRpdCBldmVu dAogIHNob3VsZCBiZSBhIG1hdGNoIGFnYWluc3QgdGhpcyBydWxlOgoKICAgIG9wPUVYRUNVVEUg ZG12ZXJpdHlfcm9vdGhhc2g9JG91dHB1dF9yaCBhY3Rpb249QUxMT1cKCmRtdmVyaXR5X3NpZ25h dHVyZToKCiAgRm9sbG93IHRoZSBzZXR1cCBzdGVwcyBmb3IgZG12ZXJpdHlfcm9vdGhhc2guIFNp Z24gdGhlIHJvb3RoYXNoIHZpYToKCiAgICBvcGVuc3NsIHNtaW1lIC1zaWduIC1pbiAib3V0cHV0 LnJvb3RoYXNoIiAtc2lnbmVyICIkTVlfQ0VSVElGSUNBVEUiIFwKICAgICAgLWlua2V5ICIkTVlf UFJJVkFURV9LRVkiIC1iaW5hcnkgLW91dGZvcm0gZGVyIC1ub2F0dHIgXAogICAgICAtb3V0ICJv dXRwdXQucDdzIgoKICAgIENyZWF0ZSBhIHBvbGljeToKCiAgICAgIHBvbGljeV9uYW1lPSJ2ZXJp ZmllZCIgcG9saWN5X3ZlcnNpb249MC4wLjAKICAgICAgREVGQVVMVCBhY3Rpb249REVOWQoKICAg ICAgb3A9RVhFQ1VURSBib290X3ZlcmlmaWVkPVRSVUUgYWN0aW9uPUFMTE9XCiAgICAgIG9wPUVY RUNVVEUgZG12ZXJpdHlfdmVyaWZpZWQ9VFJVRSBhY3Rpb249QUxMT1cKCiAgRGVwbG95IHRoZSBw b2xpY3ksIGFuZCBtYXJrIGFzIGFjdGl2ZSwgcGVyIHRoZSAiRGVwbG95aW5nIFBvbGljaWVzIgog IHNlY3Rpb24gb2YgdGhpcyBjb3ZlciBsZXR0ZXIuIE1vdW50IHRoZSBkbS12ZXJpdHkgdm9sdW1l IHdpdGgKICB2ZXJpZmljYXRpb246CgogICAgdmVyaXR5c2V0dXAgb3BlbiBvdXRwdXQuc3F1YXNo ZnMgb3V0cHV0Lmhhc2h0cmVlIHVudmVyaWZpZWQgXAogICAgICBgY2F0IG91dHB1dC5yb290aGFz aGAgLS1yb290LWhhc2gtc2lnbmF0dXJlPW91dHB1dC5wN3MKCiAgICBtb3VudCAvZGV2L21hcHBl ci91bnZlcmlmaWVkIC9teS9tb3VudC9wb2ludAoKICBOT1RFOiBUaGUgLS1yb290LWhhc2gtc2ln bmF0dXJlIG9wdGlvbiB3YXMgaW50cm9kdWNlZCBpbiB2ZXJpdHlzZXR1cAogIDIuMy4wCgogIFR1 cm4gb24gc3VjY2VzcyBhdWRpdGluZyBhbmQgYXR0ZW1wdCB0byBleGVjdXRlIGEgYmluYXJ5IGlu IHRoZSBtb3VudAogIHBvaW50LCBhbmQgaXQgc2hvdWxkIGVtaXQgYW4gYXVkaXQgZXZlbnQgZm9y IGEgbWF0Y2ggYWdhaW5zdCB0aGUgcnVsZToKCiAgICBvcD1FWEVDVVRFIGRtdmVyaXR5X3Zlcmlm aWVkPVRSVUUgYWN0aW9uPUFMTE9XCgogIFRvIHRlc3QgZGVuaWFscywgbW91bnQgdGhlIGRtLXZl cml0eSB2b2x1bWUgdGhlIHNhbWUgd2F5IGFzIHRoZQogICJkbXZlcml0eV9yb290aGFzaCIgc2Vj dGlvbiwgYW5kIGF0dGVtcHQgdG8gZXhlY3V0ZSBhIGJpbmFyeS4gRmFpbHVyZQogIHNob3VsZCBv Y2N1ci4KCkRvY3VtZW50YXRpb246Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LQoKRnVsbCBkb2N1bWVudGF0aW9uIGlzIGF2YWlsYWJsZSBvbiBnaXRodWIgaW4gSVBFJ3MgbWFz dGVyIHJlcG9zaXRvcnkKKEFwcGVuZGl4IEEpLiBUaGlzIGlzIGludGVuZGVkIHRvIGJlIGFuIGV4 aGF1c3RpdmUgc291cmNlIG9mIGRvY3VtZW50YXRpb24KYXJvdW5kIElQRS4KCkFkZGl0aW9uYWxs eSwgdGhlcmUgaXMgaGlnaGVyIGxldmVsIGRvY3VtZW50YXRpb24gaW4gdGhlIGFkbWluLWd1aWRl LgoKVGVjaG5pY2FsIGRpYWdyYW1zIGFyZSBhdmFpbGFibGUgaGVyZToKCiAgaHR0cDovL21pY3Jv c29mdC5naXRodWIuaW8vaXBlL3RlY2huaWNhbC9kaWFncmFtcy8KCktub3duIEdhcHM6Ci0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKSVBFIGhhcyB0d28ga25vd24gZ2FwczoK CjEuIElQRSBjYW5ub3QgdmVyaWZ5IHRoZSBpbnRlZ3JpdHkgb2YgYW5vbnltb3VzIGV4ZWN1dGFi bGUgbWVtb3J5LCBzdWNoIGFzCiAgdGhlIHRyYW1wb2xpbmVzIGNyZWF0ZWQgYnkgZ2NjIGNsb3N1 cmVzIGFuZCBsaWJmZmksIG9yIEpJVCdkIGNvZGUuCiAgVW5mb3J0dW5hdGVseSwgYXMgdGhpcyBp cyBkeW5hbWljYWxseSBnZW5lcmF0ZWQgY29kZSwgdGhlcmUgaXMgbm8gd2F5IGZvcgogIElQRSB0 byBkZXRlY3QgdGhhdCB0aGlzIGNvZGUgaGFzIG5vdCBiZWVuIHRhbXBlcmVkIHdpdGggaW4gdHJh bnNpdGlvbgogIGZyb20gd2hlcmUgaXQgd2FzIGJ1aWx0LCB0byB3aGVyZSBpdCBpcyBydW5uaW5n LiBBcyBhIHJlc3VsdCwgSVBFIGlzCiAgaW5jYXBhYmxlIG9mIHRhY2tsaW5nIHRoaXMgcHJvYmxl bSBmb3IgZHluYW1pY2FsbHkgZ2VuZXJhdGVkIGNvZGUuCiAgSG93ZXZlciwgdGhlcmUgaXMgYSBw YXRjaCBzZXJpZXMgYmVpbmcgcHJlcGFyZWQgdGhhdCBhZGRyZXNzZXMgdGhpcwogIHByb2JsZW0g Zm9yIGxpYmZmaSBhbmQgZ2NjIGNsb3N1cmVzIGJ5IGltcGxlbWV0aW5nIGEgc2FmZXIga2VybmVs CiAgdHJhbXBvbGluZSBBUEkuIAoKMi4gSVBFIGNhbm5vdCB2ZXJpZnkgdGhlIGludGVncml0eSBv ZiBpbnRlcnByZXRlZCBsYW5ndWFnZXMnIHByb2dyYW1zIHdoZW4KICB0aGVzZSBzY3JpcHRzIGlu dm9rZWQgdmlhIGA8aW50ZXJwcmV0ZXI+IDxmaWxlPmAuIFRoaXMgaXMgYmVjYXVzZSB0aGUgd2F5 CiAgaW50ZXJwcmV0ZXJzIGV4ZWN1dGUgdGhlc2UgZmlsZXMsIHRoZSBzY3JpcHRzIHRoZW1zZWx2 ZXMgYXJlIG5vdAogIGV2YWx1YXRlZCBhcyBleGVjdXRhYmxlIGNvZGUgdGhyb3VnaCBvbmUgb2Yg SVBFJ3MgaG9va3MuIEludGVycHJldGVycwogIGNhbiBiZSBlbmxpZ2h0ZW5lZCB0byB0aGUgdXNh Z2Ugb2YgSVBFIGJ5IHRyeWluZyB0byBtbWFwIGEgZmlsZSBpbnRvCiAgZXhlY3V0YWJsZSBtZW1v cnkgKCtYKSwgYWZ0ZXIgb3BlbmluZyB0aGUgZmlsZSBhbmQgcmVzcG9uZGluZyB0byB0aGUKICBl cnJvciBjb2RlIGFwcHJvcHJpYXRlbHkuIFRoaXMgYWxzbyBhcHBsaWVzIHRvIGluY2x1ZGVkIGZp bGVzLCBvciBoaWdoCiAgdmFsdWUgZmlsZXMsIHN1Y2ggYXMgY29uZmlndXJhdGlvbiBmaWxlcyBv ZiBjcml0aWNhbCBzeXN0ZW0gY29tcG9uZW50cy4KICBUaGlzIHNwZWNpZmljIGdhcCBpcyBwbGFu bmVkIG9uIGJlaW5nIGFkZHJlc3NlZCB3aXRoaW4gSVBFLiBGb3IgbW9yZQogIGluZm9ybWF0aW9u IG9uIGhvdyB3ZSBwbGFuIHRvIGFkZHJlc3MgdGhpcyBnYXAsIHBsZWFzZSBzZWUgdGhlIEZ1dHVy ZQogIERldmVsb3BtZW50IHNlY3Rpb24sIGJlbG93LgoKRnV0dXJlIERldmVsb3BtZW50OgotLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KClN1cHBvcnQgZm9yIGZpbHRlcmluZyBz aWduYXR1cmVzIGJ5IHNwZWNpZmljIGNlcnRpZmljYXRlcy4gSW4gdGhpcyBjYXNlLApvdXIgImRt dmVyaXR5X3NpZ25hdHVyZSIgKG9yIGEgc2VwYXJhdGUgcHJvcGVydHkpIGNhbiBiZSBzZXQgdG8g YQpzcGVjaWZpYyBjZXJ0aWZpY2F0ZSBkZWNsYXJlZCBpbiBJUEUncyBwb2xpY3ksIGFsbG93aW5n IGZvciBtb3JlCmNvbnRyb2xsZWQgdXNlLWNhc2VzIGRldGVybWluZSBieSBhIHVzZXIncyBQS0kg c3RydWN0dXJlLgoKU3VwcG9ydCBmb3IgaW50ZWdyaXR5IHZlcmlmaWNhdGlvbiBmb3IgZ2VuZXJh bCBmaWxlIHJlYWRzLiBUaGlzIGFkZHJlc3Nlcwp0aGUgc2NyaXB0IGludGVycHJldGVyIGlzc3Vl IGluZGljYXRlZCBpbiB0aGUgIktub3duIEdhcHMiIHNlY3Rpb24sIGFzCnRoZXNlIHNjcmlwdCBm aWxlcyBhcmUgdHlwaWNhbGx5IG9wZW5lZCB3aXRoIE9fUkRPTkxZLiBXZSBhcmUgZXZhbHVhdGlu Zwp3aGV0aGVyIHRvIGRvIHRoaXMgYnkgY29tcGFyaW5nIHRoZSBvcmlnaW5hbCB1c2VybGFuZCBm aWxlcGF0aCBwYXNzZWQgaW50bwp0aGUgb3BlbiBzeXNjYWxsLCB0aGVyZWJ5IGFsbG93aW5nIGV4 aXN0aW5nIGNhbGxlcnMgdG8gdGFrZSBhZHZhbnRhZ2UKd2l0aG91dCBhbnkgY29kZSBjaGFuZ2Vz OyB0aGUgYWx0ZXJuYXRlIGRlc2lnbiBpcyB0byBleHRlbmQgdGhlIG5ldwpvcGVuYXQyKDIpIHN5 c2NhbGwsIHdpdGggYW4gbmV3IGZsYWcsIHRlbnRhdGl2ZWx5IGNhbGxlZCAiT19WRVJJRlkiLiBX aGlsZQp0aGUgc2Vjb25kIG9wdGlvbiByZXF1aXJlcyBhIGNvZGUgY2hhbmdlIGZvciBhbGwgdGhl IGludGVycHJldGVycywKZnJhbWV3b3JrcyBhbmQgbGFuZ3VhZ2VzIHRoYXQgd2lzaCB0byBsZXZl cmFnZSBpdCwgaXQgaXMgYSB3aG9sbHkgY2xlYW5lcgppbXBsZW1lbnRhdGlvbiBpbiB0aGUga2Vy bmVsLiBGb3IgaW50ZXJwcmV0ZXJzIHNwZWNpZmljYWxseSwgdGhlIE9fTUFZRVhFQwpwYXRjaCBz ZXJpZXMgcHVibGlzaGVkIGJ5IE1pY2thw4PCq2wgU2FsYcODwrxuWzFdIGlzIGEgc2ltaWxhciBp bXBsZW1lbnRhdGlvbgp0byB0aGUgT19WRVJJRlkgaWRlYSBkZXNjcmliZWQgYWJvdmUuCgpPbmJv YXJkaW5nIElQRSdzIHRlc3Qgc3VpdGUgdG8gS2VybmVsQ0kuIEN1cnJlbnRseSB3ZSBhcmUgZGV2 ZWxvcGluZyBhCnRlc3Qgc3VpdGUgaW4gdGhlIHNhbWUgdmVpbiBhcyBTRUxpbnV4J3MgdGVzdCBz dWl0ZS4gT25jZSBkZXZlbG9wbWVudApvZiB0aGUgdGVzdCBzdWl0ZSBpcyBjb21wbGV0ZSwgYW5k IHByb3ZpZGVkIElQRSBpcyBhY2NlcHRlZCwgd2UgaW50ZW5kCnRvIG9uYm9hcmQgdGhpcyB0ZXN0 IHN1aXRlIG9udG8gS2VybmVsQ0kuCgpIYXJkZW5lZCByZXNpc3RhbmNlIGFnYWluc3Qgcm9sbC1i YWNrIGF0dGFja3MuIEN1cnJlbnRseSB0aGVyZSBleGlzdHMgYQp3aW5kb3cgb2Ygb3Bwb3J0dW5p dHkgYmV0d2VlbiB1c2VyLW1vZGUgc2V0dXAgYW5kIHRoZSB1c2VyLXBvbGljeSBiZWluZwpkZXBs b3llZCwgd2hlcmUgYSBwcmlvciB1c2VyLXBvbGljeSBjYW4gYmUgbG9hZGVkLCB0aGF0IGlzIHBv dGVudGlhbGx5Cmluc2VjdXJlLiBIb3dldmVyLCB3aXRoIGEga2VybmVsIHVwZGF0ZSwgeW91IGNh biByZXZpc2UgdGhlIGJvb3QgcG9saWN5J3MKdmVyc2lvbiB0byBiZSB0aGUgc2FtZSB2ZXJzaW9u IGFzIHRoZSBsYXRlc3QgcG9saWN5LCBjbG9zaW5nIHRoaXMgd2luZG93LgpJbiB0aGUgZnV0dXJl LCBJIHdvdWxkIGxpa2UgdG8gY2xvc2UgdGhpcyB3aW5kb3cgb2Ygb3Bwb3J0dW5pdHkgd2l0aG91 dAphIGtlcm5lbCB1cGRhdGUsIHVzaW5nIHNvbWUgcGVyc2lzdGVudCBzdG9yYWdlIG1lY2hhbmlz bS4KCk9wZW4gSXNzdWVzOgotLS0tLS0tLS0tLS0KCkZvciBsaW51eC1hdWRpdC9pbnRlZ3JpdHkg Zm9sa3M6CjEuIEludHJvZHVjdGlvbiBvZiBuZXcgYXVkaXQgZGVmaW5pdGlvbnMgaW4gdGhlIGtl cm5lbCBpbnRlZ3JpdHkgcmFuZ2UgLSBpcwogIHRoaXMgcHJlZmVycmVkLCBhcyBvcHBvc2VkIHRv IHJldXNpbmcgZGVmaW5pdGlvbnMgd2l0aCBleGlzdGluZyBJTUEKICBkZWZpbml0aW9ucz8KClRP RE9zOgotLS0tLS0KCmxpbnV4LWF1ZGl0IGNoYW5nZXMgdG8gc3VwcG9ydCB0aGUgbmV3IGF1ZGl0 IGV2ZW50cy4KCgpBcHBlbmRpeDoKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t CgpBLiBJUEUgR2l0aHViIFJlcG9zaXRvcnk6IGh0dHBzOi8vZ2l0aHViLmNvbS9taWNyb3NvZnQv aXBlCiAgIEhvc3RlZCBEb2N1bWVudGF0aW9uOiBodHRwczovL21pY3Jvc29mdC5naXRodWIuaW8v aXBlCkIuIElQRSBVc2VycycgR3VpZGU6IERvY3VtZW50YXRpb24vYWRtaW4tZ3VpZGUvTFNNL2lw ZS5yc3QKQy4gSVBFIFRlc3QgU3VpdGU6ICpUQkEqICh1bmRlciBkZXZlbG9wbWVudCkKClJlZmVy ZW5jZXM6Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKMS4gaHR0cHM6Ly9s b3JlLmtlcm5lbC5vcmcvbGludXgtaW50ZWdyaXR5LzIwMjAwNTA1MTUzMTU2LjkyNTExMS0xLW1p Y0BkaWdpa29kLm5ldC8KCkNoYW5nZWxvZzoKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tCgp2MTogSW50cm9kdWNlZAoKdjI6CiAgU3BsaXQgdGhlIHNlY29uZCBwYXRjaCBvZiB0 aGUgcHJldmlvdXMgc2VyaWVzIGludG8gdHdvLgogIE1pbm9yIGNvcnJlY3Rpb25zIGluIHRoZSBj b3Zlci1sZXR0ZXIgYW5kIGRvY3VtZW50YXRpb24KICBjb21tZW50cyByZWdhcmRpbmcgQ0FQX01B Q19BRE1JTiBjaGVja3MgaW4gSVBFLgoKdjM6CiAgQWRkcmVzcyB2YXJpb3VzIGNvbW1lbnRzIGJ5 IEphbm4gSG9ybi4gSGlnaGxpZ2h0czoKICAgIFN3aXRjaCB2YXJpb3VzIGF1ZGl0IGFsbG9jYXRv cnMgdG8gR0ZQX0tFUk5FTC4KICAgIFV0aWxpemUgcmN1X2FjY2Vzc19wb2ludGVyKCkgaW4gdmFy aW91cyBsb2NhdGlvbnMuCiAgICBTdHJpcCBvdXQgdGhlIGNhY2hpbmcgc3lzdGVtIGZvciBwcm9w ZXJ0aWVzCiAgICBTdHJpcCBjb21tZW50cyBmcm9tIGhlYWRlcnMKICAgIE1vdmUgZnVuY3Rpb25z IGFyb3VuZCBpbiBwYXRjaGVzCiAgICBSZW1vdmUga2VybmVsIGNvbW1hbmQgbGluZSBwYXJhbWV0 ZXJzCiAgICBSZWNvbmNpbGUgdGhlIHJhY2UgY29uZGl0aW9uIG9uIHRoZSBkZWxldGUgbm9kZSBm b3IgcG9saWN5IGJ5CiAgICAgIGV4cGFuZGluZyB0aGUgcG9saWN5IGNyaXRpY2FsIHNlY3Rpb24u CgogIEFkZHJlc3MgYSBmZXcgY29tbWVudHMgYnkgSm9uYXRoYW4gQ29yYmV0IGFyb3VuZCB0aGUg ZG9jdW1lbnRhdGlvbgogICAgcGFnZXMgZm9yIElQRS4KCiAgRml4IGFuIGlzc3VlIHdpdGggdGhl IGluaXRpYWxpemF0aW9uIG9mIElQRSBwb2xpY3kgd2l0aCBhICItMCIKICAgIHZlcnNpb24sIGNh dXNlZCBieSBub3QgaW5pdGlhbGl6aW5nIHRoZSBobGlzdCBlbnRyaWVzIGJlZm9yZQogICAgZnJl ZWluZy4KCnY0OgogIEFkZHJlc3MgYSBjb25jZXJuIGFyb3VuZCBJUEUncyBiZWhhdmlvciB3aXRo IHVua25vd24gc3ludGF4LgogICAgU3BlY2lmaWNhbGx5LCBtYWtlIGFueSB1bmtub3duIHN5bnRh eCBhIGZhdGFsIGVycm9yIGluc3RlYWQgb2YgYQogICAgd2FybmluZywgYXMgc3VnZ2VzdGVkIGJ5 IE1pY2thw6tsIFNhbGHDvG4uCiAgSW50cm9kdWNlIGEgbmV3IHNlY3VyaXR5ZnMgbm9kZSwgJHNl Y3VyaXR5ZnMvaXBlL3Byb3BlcnR5X2NvbmZpZywKICAgIHdoaWNoIHByb3ZpZGVzIGEgbGlzdGlu ZyBvZiB3aGF0IHByb3BlcnRpZXMgYXJlIGVuYWJsZWQgYnkgdGhlCiAgICBrZXJuZWwgYW5kIHRo ZWlyIHZlcnNpb25zLiBUaGlzIGFsbG93cyB1c2VybW9kZSB0byBwcmVkaWN0IHdoYXQKICAgIHBv bGljaWVzIHNob3VsZCBiZSBhbGxvd2VkLgogIFN0cmlwIHNvbWUgY29tbWVudHMgZnJvbSBjIGZp bGVzIHRoYXQgSSBtaXNzZWQuCiAgQ2xhcmlmeSBzb21lIGRvY3VtZW50YXRpb24gY29tbWVudHMg YXJvdW5kICdib290X3ZlcmlmaWVkJy4KICAgIFdoaWxlIHRoaXMgY3VycmVudGx5IGRvZXMgbm90 IGZ1bmN0aW9uYWxseSBjaGFuZ2UgdGhlIHByb3BlcnR5CiAgICBpdHNlbGYsIHRoZSBkaXN0aW5j dGlvbiBpcyBpbXBvcnRhbnQgd2hlbiBJUEUgY2FuIGVuZm9yY2UgdmVyaWZpZWQKICAgIHJlYWRz LiBBZGRpdGlvbmFsbHksICdLRVJORUxfUkVBRCcgd2FzIG9taXR0ZWQgZnJvbSB0aGUgZG9jdW1l bnRhdGlvbi4KICAgIFRoaXMgaGFzIGJlZW4gY29ycmVjdGVkLgogIENoYW5nZSBTZWN1cml0eUZT IGFuZCBTSEExIHRvIGEgcmV2ZXJzZSBkZXBlbmRlbmN5LgogIFVwZGF0ZSB0aGUgY292ZXItbGV0 dGVyIHdpdGggdGhlIHVwZGF0ZWQgYmVoYXZpb3Igb2YgdW5rbm93biBzeW50YXguCiAgUmVtb3Zl IGFsbCBzeXNjdGxzLCBtYWtpbmcgYW4gZXF1aXZhbGVudCBmdW5jdGlvbiBpbiBzZWN1cml0eWZz LgogIFJld29yayB0aGUgYWN0aXZlL2RlbGV0ZSBtZWNoYW5pc20gdG8gYmUgYSBub2RlIHVuZGVy IHRoZSBwb2xpY3kgaW4KICAgICRzZWN1cml0eWZzL2lwZS9wb2xpY2llcy4KICBUaGUga2VybmVs IGNvbW1hbmQgbGluZSBwYXJhbWV0ZXJzIGlwZS5lbmZvcmNlIGFuZCBpcGUuc3VjY2Vzc19hdWRp dAogICAgaGF2ZSByZXR1cm5lZCBhcyB0aGlzIGZ1bmN0aW9uYWxpdHkgaXMgbm8gbG9uZ2VyIGV4 cG9zZWQgdGhyb3VnaAogICAgc3lzZnMuCgp2NToKICBDb3JyZWN0IHNvbWUgZ3JhbW1hdGljYWwg ZXJyb3JzIHJlcG9ydGVkIGJ5IFJhbmR5IER1bmxhcC4KICBGaXggc29tZSB3YXJuaW5ncyByZXBv cnRlZCBieSBrZXJuZWwgdGVzdCBib3QuCiAgQ2hhbmdlIGNvbnZlbnRpb24gYXJvdW5kIHNlY3Vy aXR5X2JkZXZfc2V0c2VjdXJpdHkuIC1FTk9TWVMKICAgIGlzIG5vdyBleHBlY3RlZCBpZiBhbiBM U00gZG9lcyBub3QgaW1wbGVtZW50IGEgcGFydGljdWxhciBAbmFtZSwKICAgIGFzIHN1Z2dlc3Rl ZCBieSBDYXNleSBTY2hhdWZsZXIuCiAgTWlub3Igc3RyaW5nIGNvcnJlY3Rpb25zIHJlbGF0ZWQg dG8gdGhlIG1vdmUgZnJvbSBzeXNmcyB0byBzZWN1cml0eWZzCiAgQ29ycmVjdCBhIHNwZWxsaW5n IG9mIGFuICNpZmRlZiBmb3IgdGhlIHBlcm1pc3NpdmUgYXJndW1lbnQuCiAgQWRkIHRoZSBrZXJu ZWwgcGFyYW1ldGVycyByZS1hZGRlZCB0byB0aGUgZG9jdW1lbnRhdGlvbi4KICBGaXggYSBtaW5v ciBidWcgd2hlcmUgdGhlIG1vZGUgYmVpbmcgYXVkaXRlZCBvbiBwZXJtaXNzaXZlIHN3aXRjaAog ICAgd2FzIHRoZSBvcmlnaW5hbCBtb2RlLCBub3QgdGhlIG1vZGUgYmVpbmcgc3dhcHBlZCB0by4K ICBDbGVhbnVwIGRvYyBjb21tZW50cywgZml4IHNvbWUgd2hpdGVzcGFjZSBhbGlnbm1lbnQgaXNz dWVzLgoKRGV2ZW4gQm93ZXJzICgxMSk6CiAgc2NyaXB0czogYWRkIGlwZSB0b29saW5nIHRvIGdl bmVyYXRlIGJvb3QgcG9saWN5CiAgc2VjdXJpdHk6IGFkZCBpcGUgbHNtIGV2YWx1YXRpb24gbG9v cCBhbmQgYXVkaXQgc3lzdGVtCiAgc2VjdXJpdHk6IGFkZCBpcGUgbHNtIHBvbGljeSBwYXJzZXIg YW5kIHBvbGljeSBsb2FkaW5nCiAgaXBlOiBhZGQgcHJvcGVydHkgZm9yIHRydXN0IG9mIGJvb3Qg dm9sdW1lCiAgZnM6IGFkZCBzZWN1cml0eSBibG9iIGFuZCBob29rcyBmb3IgYmxvY2tfZGV2aWNl CiAgZG0tdmVyaXR5OiBtb3ZlIHNpZ25hdHVyZSBjaGVjayBhZnRlciB0cmVlIHZhbGlkYXRpb24K ICBkbS12ZXJpdHk6IGFkZCBiZGV2X3NldHNlY3VyaXR5IGhvb2sgZm9yIGRtLXZlcml0eSBzaWdu YXR1cmUKICBpcGU6IGFkZCBwcm9wZXJ0eSBmb3Igc2lnbmVkIGRtdmVyaXR5IHZvbHVtZXMKICBk bS12ZXJpdHk6IGFkZCBiZGV2X3NldHNlY3VyaXR5IGhvb2sgZm9yIHJvb3QtaGFzaAogIGRvY3Vt ZW50YXRpb246IGFkZCBpcGUgZG9jdW1lbnRhdGlvbgogIGNsZWFudXA6IHVhcGkvbGludXgvYXVk aXQuaAoKIERvY3VtZW50YXRpb24vYWRtaW4tZ3VpZGUvTFNNL2luZGV4LnJzdCAgICAgICB8ICAg IDEgKwogRG9jdW1lbnRhdGlvbi9hZG1pbi1ndWlkZS9MU00vaXBlLnJzdCAgICAgICAgIHwgIDUw OCArKysrKysrCiAuLi4vYWRtaW4tZ3VpZGUva2VybmVsLXBhcmFtZXRlcnMudHh0ICAgICAgICAg fCAgIDEyICsKIE1BSU5UQUlORVJTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 ICAgIDggKwogZHJpdmVycy9tZC9kbS12ZXJpdHktdGFyZ2V0LmMgICAgICAgICAgICAgICAgIHwg ICA1MiArLQogZHJpdmVycy9tZC9kbS12ZXJpdHktdmVyaWZ5LXNpZy5jICAgICAgICAgICAgIHwg IDE0NyArLQogZHJpdmVycy9tZC9kbS12ZXJpdHktdmVyaWZ5LXNpZy5oICAgICAgICAgICAgIHwg ICAyNCArLQogZHJpdmVycy9tZC9kbS12ZXJpdHkuaCAgICAgICAgICAgICAgICAgICAgICAgIHwg ICAgMiArLQogZnMvYmxvY2tfZGV2LmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwg ICAgOCArCiBpbmNsdWRlL2xpbnV4L2RldmljZS1tYXBwZXIuaCAgICAgICAgICAgICAgICAgfCAg ICAzICsKIGluY2x1ZGUvbGludXgvZnMuaCAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAg IDEgKwogaW5jbHVkZS9saW51eC9sc21faG9va19kZWZzLmggICAgICAgICAgICAgICAgIHwgICAg NSArCiBpbmNsdWRlL2xpbnV4L2xzbV9ob29rcy5oICAgICAgICAgICAgICAgICAgICAgfCAgIDEy ICsKIGluY2x1ZGUvbGludXgvc2VjdXJpdHkuaCAgICAgICAgICAgICAgICAgICAgICB8ICAgMjIg KwogaW5jbHVkZS91YXBpL2xpbnV4L2F1ZGl0LmggICAgICAgICAgICAgICAgICAgIHwgICAzNiAr LQogc2NyaXB0cy9NYWtlZmlsZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgMSAr CiBzY3JpcHRzL2lwZS9NYWtlZmlsZSAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAyICsK IHNjcmlwdHMvaXBlL3BvbGdlbi8uZ2l0aWdub3JlICAgICAgICAgICAgICAgICB8ICAgIDEgKwog c2NyaXB0cy9pcGUvcG9sZ2VuL01ha2VmaWxlICAgICAgICAgICAgICAgICAgIHwgICAgNyArCiBz Y3JpcHRzL2lwZS9wb2xnZW4vcG9sZ2VuLmMgICAgICAgICAgICAgICAgICAgfCAgMTM2ICsrCiBz ZWN1cml0eS9LY29uZmlnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDEyICstCiBz ZWN1cml0eS9NYWtlZmlsZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAyICsKIHNl Y3VyaXR5L2lwZS8uZ2l0aWdub3JlICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDIgKwogc2Vj dXJpdHkvaXBlL0tjb25maWcgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICA0OCArCiBzZWN1 cml0eS9pcGUvTWFrZWZpbGUgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDMzICsKIHNlY3Vy aXR5L2lwZS9pcGUtYXVkaXQuYyAgICAgICAgICAgICAgICAgICAgICB8ICAzMDMgKysrKwogc2Vj dXJpdHkvaXBlL2lwZS1hdWRpdC5oICAgICAgICAgICAgICAgICAgICAgIHwgICAyNCArCiBzZWN1 cml0eS9pcGUvaXBlLWJsb2JzLmMgICAgICAgICAgICAgICAgICAgICAgfCAgIDk1ICsrCiBzZWN1 cml0eS9pcGUvaXBlLWJsb2JzLmggICAgICAgICAgICAgICAgICAgICAgfCAgIDE4ICsKIHNlY3Vy aXR5L2lwZS9pcGUtZW5naW5lLmMgICAgICAgICAgICAgICAgICAgICB8ICAyMTMgKysrCiBzZWN1 cml0eS9pcGUvaXBlLWVuZ2luZS5oICAgICAgICAgICAgICAgICAgICAgfCAgIDQ5ICsKIHNlY3Vy aXR5L2lwZS9pcGUtaG9va3MuYyAgICAgICAgICAgICAgICAgICAgICB8ICAxNjkgKysrCiBzZWN1 cml0eS9pcGUvaXBlLWhvb2tzLmggICAgICAgICAgICAgICAgICAgICAgfCAgIDcwICsKIHNlY3Vy aXR5L2lwZS9pcGUtcGFyc2UuYyAgICAgICAgICAgICAgICAgICAgICB8ICA4ODkgKysrKysrKysr KysKIHNlY3VyaXR5L2lwZS9pcGUtcGFyc2UuaCAgICAgICAgICAgICAgICAgICAgICB8ICAgMTcg Kwogc2VjdXJpdHkvaXBlL2lwZS1waW4uYyAgICAgICAgICAgICAgICAgICAgICAgIHwgICA5MyAr Kwogc2VjdXJpdHkvaXBlL2lwZS1waW4uaCAgICAgICAgICAgICAgICAgICAgICAgIHwgICAzNiAr CiBzZWN1cml0eS9pcGUvaXBlLXBvbGljeS5jICAgICAgICAgICAgICAgICAgICAgfCAgMTQ5ICsr CiBzZWN1cml0eS9pcGUvaXBlLXBvbGljeS5oICAgICAgICAgICAgICAgICAgICAgfCAgIDY5ICsK IHNlY3VyaXR5L2lwZS9pcGUtcHJvcC1pbnRlcm5hbC5oICAgICAgICAgICAgICB8ICAgNDkgKwog c2VjdXJpdHkvaXBlL2lwZS1wcm9wZXJ0eS5jICAgICAgICAgICAgICAgICAgIHwgIDE0MyArKwog c2VjdXJpdHkvaXBlL2lwZS1wcm9wZXJ0eS5oICAgICAgICAgICAgICAgICAgIHwgIDEwMCArKwog c2VjdXJpdHkvaXBlL2lwZS1zZWNmcy5jICAgICAgICAgICAgICAgICAgICAgIHwgMTMwOSArKysr KysrKysrKysrKysrKwogc2VjdXJpdHkvaXBlL2lwZS1zZWNmcy5oICAgICAgICAgICAgICAgICAg ICAgIHwgICAxNCArCiBzZWN1cml0eS9pcGUvaXBlLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgMTE1ICsrCiBzZWN1cml0eS9pcGUvaXBlLmggICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDIyICsKIHNlY3VyaXR5L2lwZS9wcm9wZXJ0aWVzL0tjb25maWcgICAgICAgICAgICAg ICB8ICAgMzYgKwogc2VjdXJpdHkvaXBlL3Byb3BlcnRpZXMvTWFrZWZpbGUgICAgICAgICAgICAg IHwgICAxMyArCiBzZWN1cml0eS9pcGUvcHJvcGVydGllcy9ib290LXZlcmlmaWVkLmMgICAgICAg fCAgIDgyICsrCiBzZWN1cml0eS9pcGUvcHJvcGVydGllcy9kbXZlcml0eS1yb290aGFzaC5jICAg fCAgMTUzICsrCiBzZWN1cml0eS9pcGUvcHJvcGVydGllcy9kbXZlcml0eS1zaWduYXR1cmUuYyAg fCAgIDgyICsrCiBzZWN1cml0eS9pcGUvcHJvcGVydGllcy9wcm9wLWVudHJ5LmggICAgICAgICAg fCAgIDM4ICsKIHNlY3VyaXR5L2lwZS91dGlsaXR5LmggICAgICAgICAgICAgICAgICAgICAgICB8 ICAgMzIgKwogc2VjdXJpdHkvc2VjdXJpdHkuYyAgICAgICAgICAgICAgICAgICAgICAgICAgIHwg ICA3NCArCiA1NCBmaWxlcyBjaGFuZ2VkLCA1NDQzIGluc2VydGlvbnMoKyksIDk4IGRlbGV0aW9u cygtKQogY3JlYXRlIG1vZGUgMTAwNjQ0IERvY3VtZW50YXRpb24vYWRtaW4tZ3VpZGUvTFNNL2lw ZS5yc3QKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzY3JpcHRzL2lwZS9NYWtlZmlsZQogY3JlYXRlIG1v ZGUgMTAwNjQ0IHNjcmlwdHMvaXBlL3BvbGdlbi8uZ2l0aWdub3JlCiBjcmVhdGUgbW9kZSAxMDA2 NDQgc2NyaXB0cy9pcGUvcG9sZ2VuL01ha2VmaWxlCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2NyaXB0 cy9pcGUvcG9sZ2VuL3BvbGdlbi5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlLy5n aXRpZ25vcmUKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvS2NvbmZpZwogY3JlYXRl IG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9NYWtlZmlsZQogY3JlYXRlIG1vZGUgMTAwNjQ0IHNl Y3VyaXR5L2lwZS9pcGUtYXVkaXQuYwogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9p cGUtYXVkaXQuaAogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9pcGUtYmxvYnMuYwog Y3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9pcGUtYmxvYnMuaAogY3JlYXRlIG1vZGUg MTAwNjQ0IHNlY3VyaXR5L2lwZS9pcGUtZW5naW5lLmMKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1 cml0eS9pcGUvaXBlLWVuZ2luZS5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lw ZS1ob29rcy5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lwZS1ob29rcy5oCiBj cmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lwZS1wYXJzZS5jCiBjcmVhdGUgbW9kZSAx MDA2NDQgc2VjdXJpdHkvaXBlL2lwZS1wYXJzZS5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJp dHkvaXBlL2lwZS1waW4uYwogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9pcGUtcGlu LmgKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvaXBlLXBvbGljeS5jCiBjcmVhdGUg bW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lwZS1wb2xpY3kuaAogY3JlYXRlIG1vZGUgMTAwNjQ0 IHNlY3VyaXR5L2lwZS9pcGUtcHJvcC1pbnRlcm5hbC5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2Vj dXJpdHkvaXBlL2lwZS1wcm9wZXJ0eS5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBl L2lwZS1wcm9wZXJ0eS5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lwZS1zZWNm cy5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lwZS1zZWNmcy5oCiBjcmVhdGUg bW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2lwZS5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJp dHkvaXBlL2lwZS5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL3Byb3BlcnRpZXMv S2NvbmZpZwogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9wcm9wZXJ0aWVzL01ha2Vm aWxlCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL3Byb3BlcnRpZXMvYm9vdC12ZXJp ZmllZC5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL3Byb3BlcnRpZXMvZG12ZXJp dHktcm9vdGhhc2guYwogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9wcm9wZXJ0aWVz L2RtdmVyaXR5LXNpZ25hdHVyZS5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL3By b3BlcnRpZXMvcHJvcC1lbnRyeS5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL3V0 aWxpdHkuaAoKLS0gCjIuMjcuMAoKCi0tCmRtLWRldmVsIG1haWxpbmcgbGlzdApkbS1kZXZlbEBy ZWRoYXQuY29tCmh0dHBzOi8vd3d3LnJlZGhhdC5jb20vbWFpbG1hbi9saXN0aW5mby9kbS1kZXZl bA==