about summary refs log tree commit diff
path: root/sysdeps/unix
Commit message (Collapse)AuthorAgeFilesLines
...
* posix: Add pidfd_spawn and pidfd_spawnp (BZ 30349)Adhemerval Zanella Netto2023-09-0551-3/+499
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Returning a pidfd allows a process to keep a race-free handle for a child process, otherwise, the caller will need to either use pidfd_open (which still might be subject to TOCTOU) or keep the old racy interface base on pid_t. To correct use pifd_spawn, the kernel must support not only returning the pidfd with clone/clone3 but also waitid (P_PIDFD) (added on Linux 5.4). If kernel does not support the waitid, pidfd return ENOSYS. It avoids the need to racy workarounds, such as reading the procfs fdinfo to get the pid to use along with other wait interfaces. These interfaces are similar to the posix_spawn and posix_spawnp, with the only difference being it returns a process file descriptor (int) instead of a process ID (pid_t). Their prototypes are: int pidfd_spawn (int *restrict pidfd, const char *restrict file, const posix_spawn_file_actions_t *restrict facts, const posix_spawnattr_t *restrict attrp, char *const argv[restrict], char *const envp[restrict]) int pidfd_spawnp (int *restrict pidfd, const char *restrict path, const posix_spawn_file_actions_t *restrict facts, const posix_spawnattr_t *restrict attrp, char *const argv[restrict_arr], char *const envp[restrict_arr]); A new symbol is used instead of a posix_spawn extension to avoid possible issues with language bindings that might track the return argument lifetime. Although on Linux pid_t and int are interchangeable, POSIX only states that pid_t should be a signed integer. Both symbols reuse the posix_spawn posix_spawn_file_actions_t and posix_spawnattr_t, to void rehash posix_spawn API or add a new one. It also means that both interfaces support the same attribute and file actions, and a new flag or file action on posix_spawn is also added automatically for pidfd_spawn. Also, using posix_spawn plumbing allows the reusing of most of the current testing with some changes: - waitid is used instead of waitpid since it is a more generic interface. - tst-posix_spawn-setsid.c is adapted to take into consideration that the caller can check for session id directly. The test now spawns itself and writes the session id as a file instead. - tst-spawn3.c need to know where pidfd_spawn is used so it keeps an extra file description unused. Checked on x86_64-linux-gnu on Linux 4.15 (no CLONE_PIDFD or waitid support), Linux 5.4 (full support), and Linux 6.2. Reviewed-by: Florian Weimer <fweimer@redhat.com>
* linux: Add posix_spawnattr_{get, set}cgroup_np (BZ 26371)Adhemerval Zanella Netto2023-09-0541-3/+414
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | These functions allow to posix_spawn and posix_spawnp to use CLONE_INTO_CGROUP with clone3, allowing the child process to be created in a different cgroup version 2. These are GNU extensions that are available only for Linux, and also only for the architectures that implement clone3 wrapper (HAVE_CLONE3_WRAPPER). To create a process on a different cgroupv2, one can use the: posix_spawnattr_t attr; posix_spawnattr_init (&attr); posix_spawnattr_setflags (&attr, POSIX_SPAWN_SETCGROUP); posix_spawnattr_setcgroup_np (&attr, cgroup); posix_spawn (...) Similar to other posix_spawn flags, POSIX_SPAWN_SETCGROUP control whether the cgroup file descriptor will be used or not with clone3. There is no fallback if either clone3 does not support the flag or if the architecture does not provide the clone3 wrapper, in this case posix_spawn returns EOPNOTSUPP. Checked on x86_64-linux-gnu. Reviewed-by: Florian Weimer <fweimer@redhat.com>
* linux: Define __ASSUME_CLONE3 to 0 for alpha, ia64, nios2, sh, and sparcAdhemerval Zanella Netto2023-09-055-0/+40
| | | | | | Not all architectures added clone3 syscall. Reviewed-by: Florian Weimer <fweimer@redhat.com>
* mips: Add the clone3 wrapperAdhemerval Zanella Netto2023-09-052-0/+141
| | | | | | | | | | It follows the internal signature: extern int clone3 (struct clone_args *__cl_args, size_t __size, int (*__func) (void *__arg), void *__arg); Checked on mips64el-linux-gnueabihf, mips64el-n32-linux-gnu, and mipsel-linux-gnu.
* arm: Add the clone3 wrapperAdhemerval Zanella Netto2023-09-052-0/+81
| | | | | | | | | It follows the internal signature: extern int clone3 (struct clone_args *__cl_args, size_t __size, int (*__func) (void *__arg), void *__arg); Checked on arm-linux-gnueabihf.
* LoongArch: Micro-optimize LD_PCRELXi Ruoyao2023-08-291-6/+4
| | | | | | | We are requiring Binutils >= 2.41, so explicit relocation syntax is always supported by the assembler. Use it to reduce one instruction. Signed-off-by: Xi Ruoyao <xry111@xry111.site>
* Add F_SEAL_EXEC from Linux 6.3 to bits/fcntl-linux.h.Kir Kolyshkin2023-08-281-0/+1
| | | | | | | | This patch adds the new F_SEAL_EXEC constant from Linux 6.3 (see Linux commit 6fd7353829c ("mm/memfd: add F_SEAL_EXEC") to bits/fcntl-linux.h. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Linux: Avoid conflicting types in ld.so --list-diagnosticsFlorian Weimer2023-08-231-5/+8
| | | | | | | | The path auxv[*].a_val could either be an integer or a string, depending on the a_type value. Use a separate field, a_val_string, to simplify mechanical parsing of the --list-diagnostics output. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* sysdeps: tst-bz21269: fix -Wreturn-typeSam James2023-08-171-2/+0
| | | | | | | Thanks to Andreas Schwab for reporting. Fixes: 652b9fdb77d9fd056d4dd26dad2c14142768ab49 Signed-off-by: Sam James <sam@gentoo.org>
* sysdeps: tst-bz21269: handle ENOSYS & skip appropriatelySam James2023-08-161-1/+10
| | | | | | | | | SYS_modify_ldt requires CONFIG_MODIFY_LDT_SYSCALL to be set in the kernel, which some distributions may disable for hardening. Check if that's the case (unset) and mark the test as UNSUPPORTED if so. Reviewed-by: DJ Delorie <dj@redhat.com> Signed-off-by: Sam James <sam@gentoo.org>
* sysdeps: tst-bz21269: fix test parameterSam James2023-08-161-1/+1
| | | | | | | | All callers pass 1 or 0x11 anyway (same meaning according to man page), but still. Reviewed-by: DJ Delorie <dj@redhat.com> Signed-off-by: Sam James <sam@gentoo.org>
* Loongarch: Add ifunc support and add different versions of strlendengjianbo2023-08-141-0/+2
| | | | | | strlen-lasx is implemeted by LASX simd instructions(256bit) strlen-lsx is implemeted by LSX simd instructions(128bit) strlen-align is implemented by LA basic instructions and never use unaligned memory acess
* nscd: Do not rebuild getaddrinfo (bug 30709)Florian Weimer2023-08-111-16/+1
| | | | | | | | | | | | | | | | The nscd daemon caches hosts data from NSS modules verbatim, without filtering protocol families or sorting them (otherwise separate caches would be needed for certain ai_flags combinations). The cache implementation is complete separate from the getaddrinfo code. This means that rebuilding getaddrinfo is not needed. The only function actually used is __bump_nl_timestamp from check_pf.c, and this change moves it into nscd/connections.c. Tested on x86_64-linux-gnu with -fexceptions, built with build-many-glibcs.py. I also backported this patch into a distribution that still supports nscd and verified manually that caching still works. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* Add PTRACE_SET_SYSCALL_USER_DISPATCH_CONFIG etc. from Linux 6.4 to sys/ptrace.hJoseph Myers2023-08-089-7/+103
| | | | | | | | | | | Linux 6.4 adds new constants PTRACE_SET_SYSCALL_USER_DISPATCH_CONFIG and PTRACE_GET_SYSCALL_USER_DISPATCH_CONFIG. Add those to all relevant sys/ptrace.h headers, along with adding the associated argument structure to bits/ptrace-shared.h (named struct __ptrace_sud_config there following the usual convention for such structures). Tested for x86_64 and with build-many-glibcs.py.
* Add PACKET_VNET_HDR_SZ from Linux 6.4 to netpacket/packet.hJoseph Myers2023-08-081-0/+1
| | | | | | | Linux 6.4 adds a new constant PACKET_VNET_HDR_SZ; add it to glibc's netpacket/packet.h. Tested for x86_64.
* linux: statvfs: allocate spare for f_typeнаб2023-08-082-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | This is the only missing part in struct statvfs. The LSB calls [f]statfs() deprecated, and its weird types are definitely off-putting. However, its use is required to get f_type. Instead, allocate one of the six spares to f_type, copied directly from struct statfs. This then becomes a small glibc extension to the standard interface on Linux and the Hurd, instead of two different interfaces, one of which is quite odd due to being an ABI type, and there no longer is any reason to use statfs(). The underlying kernel type is a mess, but all architectures agree on u32 (or more) for the ABI, and all filesystem magicks are 32-bit integers. We don't lose any generality by using u32, and by doing so we both make the API consistent with the Hurd, and allow C++ switch(f_type) { case RAMFS_MAGIC: ...; } Also fix tst-statvfs so that it actually fails; as it stood, all it did was return 0 always. Test statfs()' and statvfs()' f_types are the same. Link: https://lore.kernel.org/linux-man/f54kudgblgk643u32tb6at4cd3kkzha6hslahv24szs4raroaz@ogivjbfdaqtb/t/#u Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Add IP_PROTOCOL from Linux 6.4 to bits/in.hJoseph Myers2023-08-011-0/+1
| | | | | | | Linux 6.4 adds a new constant IP_PROTOCOL; add it to glibc's bits/in.h. Tested for x86_64.
* Update kernel version to 6.4 in header constant testsJoseph Myers2023-08-013-4/+4
| | | | | | | | | This patch updates the kernel version in the tests tst-mman-consts.py, tst-mount-consts.py and tst-pidfd-consts.py to 6.4. (There are no new constants covered by these tests in 6.4 that need any other header changes.) Tested with build-many-glibcs.py.
* PowerPC: Influence cpu/arch hwcap features via GLIBC_TUNABLESMahesh Bodapati2023-08-014-3/+390
| | | | | | | | | | | This patch enables the option to influence hwcaps used by PowerPC. The environment variable, GLIBC_TUNABLES=glibc.cpu.hwcaps=-xxx,yyy,-zzz...., can be used to enable CPU/ARCH feature yyy, disable CPU/ARCH feature xxx and zzz, where the feature name is case-sensitive and has to match the ones mentioned in the file{sysdeps/powerpc/dl-procinfo.c}. Note that the hwcap tunables only used in the IFUNC selection. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* linux: Fix i686 with gcc6Adhemerval Zanella Netto2023-07-261-0/+9
| | | | | | | | | | | | On __convert_scm_timestamps GCC 6 issues an warning that tvts[0]/tvts[1] maybe be used uninitialized, however it would be used if type is set to a value different than 0 (done by either COMPAT_SO_TIMESTAMP_OLD or COMPAT_SO_TIMESTAMPNS_OLD) which will fallthrough to 'common' label. It does not show with gcc 7 or more recent versions. Checked on i686-linux-gnu. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* Include sys/rseq.h in tst-rseq-disable.cStefan Liebler2023-07-251-0/+1
| | | | | | | | | | | Starting with commit 2c6b4b272e6b4d07303af25709051c3e96288f2d "nptl: Unconditionally use a 32-byte rseq area", the testcase misc/tst-rseq-disable is UNSUPPORTED as RSEQ_SIG is not defined. The mentioned commit removes inclusion of sys/rseq.h in nptl/descr.h. Thus just include sys/rseq.h in the tst-rseq-disable.c as also done in tst-rseq.c and tst-rseq-nptl.c. Reviewed-by: Florian Weimer <fweimer@redhat.com>
* configure: Use autoconf 2.71Siddhesh Poyarekar2023-07-1726-272/+376
| | | | | | | | | | | | | | Bump autoconf requirement to 2.71 to allow regenerating configure on more recent distributions. autoconf 2.71 has been in Fedora since F36 and is the current version in Debian stable (bookworm). It appears to be current in Gentoo as well. All sysdeps configure and preconfigure scripts have also been regenerated; all changes are trivial transformations that do not affect functionality. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* s390: Add the clone3 wrapperAdhemerval Zanella2023-07-133-0/+157
| | | | | | | | | It follows the internal signature: extern int clone3 (struct clone_args *__cl_args, size_t __size, int (*__func) (void *__arg), void *__arg); Checked on s390x-linux-gnu and s390-linux-gnu.
* LoongArch: Add vector implementation for _dl_runtime_resolve.caiyinyu2023-07-112-0/+66
|
* Exclude routines from fortificationFrédéric Bérat2023-07-051-0/+3
| | | | | | | | | | | | | | | | | Since the _FORTIFY_SOURCE feature uses some routines of Glibc, they need to be excluded from the fortification. On top of that: - some tests explicitly verify that some level of fortification works appropriately, we therefore shouldn't modify the level set for them. - some objects need to be build with optimization disabled, which prevents _FORTIFY_SOURCE to be used for them. Assembler files that implement architecture specific versions of the fortified routines were not excluded from _FORTIFY_SOURCE as there is no C header included that would impact their behavior. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* hppa: xfail debug/tst-ssp-1 when have-ssp is yes (gcc-12 and later)John David Anglin2023-07-011-0/+4
|
* aarch64: Add vector implementations of exp routinesJoe Ramsay2023-06-301-0/+4
| | | | | | | | | | | | Optimised implementations for single and double precision, Advanced SIMD and SVE, copied from Arm Optimized Routines. As previously, data tables are used via a barrier to prevent overly aggressive constant inlining. Special-case handlers are marked NOINLINE to avoid incurring the penalty of switching call standards unnecessarily. Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
* aarch64: Add vector implementations of log routinesJoe Ramsay2023-06-301-0/+4
| | | | | | | | | | | | | | Optimised implementations for single and double precision, Advanced SIMD and SVE, copied from Arm Optimized Routines. Log lookup table added as HIDDEN symbol to allow it to be shared between AdvSIMD and SVE variants. As previously, data tables are used via a barrier to prevent overly aggressive constant inlining. Special-case handlers are marked NOINLINE to avoid incurring the penalty of switching call standards unnecessarily. Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
* aarch64: Add vector implementations of sin routinesJoe Ramsay2023-06-301-0/+4
| | | | | | | | | | | | Optimised implementations for single and double precision, Advanced SIMD and SVE, copied from Arm Optimized Routines. As previously, data tables are used via a barrier to prevent overly aggressive constant inlining. Special-case handlers are marked NOINLINE to avoid incurring the penalty of switching call standards unnecessarily. Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
* Update syscall lists for Linux 6.4Joseph Myers2023-06-285-2/+7
| | | | | | | | Linux 6.4 adds the riscv_hwprobe syscall on riscv and enables memfd_secret on s390. Update syscall-names.list and regenerate the arch-syscall.h headers with build-many-glibcs.py update-syscalls. Tested with build-many-glibcs.py.
* linux: Return unsupported if procfs can not be mount on tst-ttyname-namespaceAdhemerval Zanella2023-06-281-12/+16
| | | | | | | | | | | | | | | | Trying to mount procfs can fail due multiples reasons: proc is locked due the container configuration, mount syscall is filtered by a Linux Secuirty Module, or any other security or hardening mechanism that Linux might eventually add. The tests does require a new procfs without binding to parent, and to fully fix it would require to change how the container was created (which is out of the scope of the test itself). Instead of trying to foresee any possible scenario, if procfs can not be mount fail with unsupported. Checked on aarch64-linux-gnu. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* linux: Split tst-ttynameAdhemerval Zanella2023-06-284-206/+259
| | | | | | | | | | The tst-ttyname-direct.c checks the ttyname with procfs mounted in bind mode (MS_BIND|MS_REC), while tst-ttyname-namespace.c checks with procfs mount with MS_NOSUID|MS_NOEXEC|MS_NODEV in a new namespace. Checked on x86_64-linux-gnu and aarch64-linux-gnu. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* x86: Adjust Linux x32 dl-cache inclusion pathAdhemerval Zanella2023-06-261-1/+1
| | | | | | It fixes the x32 build failure introduced by 45e2483a6c. Checked on a x86_64-linux-gnu-x32 build.
* check_native: Get rid of allocaJoe Simmons-Talbott2023-06-261-24/+11
| | | | | | Use malloc rather than alloca to avoid potential stack overflow. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* ifaddrs: Get rid of allocaJoe Simmons-Talbott2023-06-261-26/+20
| | | | | | Use scratch_buffer and malloc rather than alloca to avoid potential stack overflows. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* x86: Make dl-cache.h and readelflib.c not Linux-specificSergey Bugaev2023-06-262-141/+0
| | | | | | | These files could be useful to any port that wants to use ld.so.cache. Signed-off-by: Sergey Bugaev <bugaevc@gmail.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* benchtests: fix warn unused resultFrederic Berat2023-06-221-1/+2
| | | | | | | Few tests needed to properly check for asprintf and system calls return values with _FORTIFY_SOURCE enabled. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* grantpt: Get rid of allocaJoe Simmons-Talbott2023-06-181-1/+11
| | | | | Replace alloca with a scratch_buffer to avoid potential stack overflows. Message-Id: <20230613191631.1080455-1-josimmon@redhat.com>
* Add the wcslcpy, wcslcat functionsFlorian Weimer2023-06-1434-0/+136
| | | | | | | These functions are about to be added to POSIX, under Austin Group issue 986. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* Implement strlcpy and strlcat [BZ #178]Florian Weimer2023-06-1434-0/+136
| | | | | | | | | | | These functions are about to be added to POSIX, under Austin Group issue 986. The fortified strlcat implementation does not raise SIGABRT if the destination buffer does not contain a null terminator, it just inherits the non-failing regular strlcat behavior. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* linux: Fail as unsupported if personality call is filteredAdhemerval Zanella2023-06-051-12/+21
| | | | | | | | | | | | | | | | | | | | | Container management default seccomp filter [1] only accepts personality(2) with PER_LINUX, (0x0), UNAME26 (0x20000), PER_LINUX32 (0x8), UNAME26 | PER_LINUX32, and 0xffffffff (to query current personality) Although the documentation only state it is blocked to prevent 'enabling BSD emulation' (PER_BSD, not implemented by Linux), checking on repository log the real reason is to block ASLR disable flag (ADDR_NO_RANDOMIZE) and other poorly support emulations. So handle EPERM and fail as UNSUPPORTED if we can really check for BZ#19408. Checked on aarch64-linux-gnu. [1] https://github.com/moby/moby/blob/master/profiles/seccomp/default.json Reviewed-by: Florian Weimer <fweimer@redhat.com>
* Remove MAP_VARIABLE from hppa bits/mman.hJoseph Myers2023-06-051-1/+0
| | | | | | | | | As suggested in <https://sourceware.org/pipermail/libc-alpha/2023-February/145890.html>, remove the MAP_VARIABLE define from the hppa bits/mman.h, for consistency with Linux 6.2 which removed the define there. Tested with build-many-glibcs.py for hppa-linux-gnu.
* Use __nonnull for the epoll_wait(2) family of syscallsAlejandro Colomar2023-06-011-4/+4
| | | | | Signed-off-by: Alejandro Colomar <alx@kernel.org> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Fix invalid use of NULL in epoll_pwait2(2) testAlejandro Colomar2023-06-011-1/+3
| | | | | | | | | epoll_pwait2(2)'s second argument should be nonnull. We're going to add __nonnull to the prototype, so let's fix the test accordingly. We can use a dummy variable to avoid passing NULL. Reported-by: Adhemerval Zanella Netto <adhemerval.zanella@linaro.org> Signed-off-by: Alejandro Colomar <alx@kernel.org>
* getipv4sourcefilter: Get rid of allocaJoe Simmons-Talbott2023-06-011-17/+7
| | | | | | Use a scratch_buffer rather than alloca to avoid potential stack overflows. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* getsourcefilter: Get rid of alloca.Joe Simmons-Talbott2023-06-011-17/+7
| | | | | | Use a scratch_buffer rather than alloca to avoid potential stack overflows. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* io: Fix F_GETLK, F_SETLK, and F_SETLKW for powerpc64Adhemerval Zanella2023-05-311-0/+6
| | | | | | | | | | | | | | | | | | Different than other 64 bit architectures, powerpc64 defines the LFS POSIX lock constants with values similar to 32 ABI, which are meant to be used with fcntl64 syscall. Since powerpc64 kABI does not have fcntl, the constants are adjusted with the FCNTL_ADJUST_CMD macro. The 4d0fe291aed3a476a changed the logic of generic constants LFS value are equal to the default values; which is now wrong for powerpc64. Fix the value by explicit define the previous glibc constants (powerpc64 does not need to use the 32 kABI value, but it simplifies the FCNTL_ADJUST_CMD which should be kept as compatibility). Checked on powerpc64-linux-gnu and powerpc-linux-gnu.
* io: Fix record locking contants on 32 bit arch with 64 bit default time_t ↵Adhemerval Zanella2023-05-301-1/+1
| | | | | | | | | | | | | | | | | | (BZ#30477) For architecture with default 64 bit time_t support, the kernel does not provide LFS and non-LFS values for F_GETLK, F_GETLK, and F_GETLK (the default value used for 64 bit architecture are used). This is might be considered an ABI break, but the currenct exported values is bogus anyway. The POSIX lockf is not affected since it is aliased to lockf64, which already uses the LFS values. Checked on i686-linux-gnu and the new tests on a riscv32. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* LoongArch: Fix inconsistency in SHMLBA macro values between glibc and kernelcaiyinyu2023-05-301-0/+24
| | | | | | | | | The LoongArch glibc was using the value of the SHMLBA macro from common code, which is __getpagesize() (16k), but this was inconsistent with the value of the SHMLBA macro in the kernel, which is SZ_64K (64k). This caused several shmat-related tests in LTP (Linux Test Project) to fail. This commit fixes the issue by ensuring that the glibc's SHMLBA macro value matches the value used in the kernel like other architectures.
* riscv: Add the clone3 wrapperAdhemerval Zanella2023-05-292-0/+80
| | | | | | | | | | | It follows the internal signature: extern int clone3 (struct clone_args *__cl_args, size_t __size, int (*__func) (void *__arg), void *__arg); Checked on riscv64-linux-gnu-rv64imafdc-lp64d. Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com>