From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5BF393B78D; Tue, 16 Apr 2024 08:26:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713255966; cv=none; b=AgkhBHO6IKtr5SP7nKddLXqBI3HX7TDv7wElh8eVYzYrMo5gfZlGwiVOELih2ZHxBjax2wXWJgLAGvG7I+6+87Z8C22lALA6kYEdC1QRP4c0BzR1VWWNEqvrcqDCEEvXtYQqWr17+e83cwejmEwz3JsFJdoU1/nWY/7kyqfsXlQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713255966; c=relaxed/simple; bh=dU7PkEFRm93LBS1Z28p9N1XSH6G5tnTgOH3s9Y4nZt4=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition:In-Reply-To; b=uXzfKjBalvINkwB0RIsdxA/Exytxc5/UPmmPYtpIiaxLJvvaO6yM6vZUUxv17t+hgE9i8nymoR2eWMOuKVrznKB0Zt6SkJYoKK2m3DywRbY5xpFQ9UFklm7SLCfX2SuY3XtjeZGGqJSRcCd9XmXa3f3heYQMhbQjbnsAQdMhVf4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=WKHWYhR5; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="WKHWYhR5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B3887C113CE; Tue, 16 Apr 2024 08:26:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1713255965; bh=dU7PkEFRm93LBS1Z28p9N1XSH6G5tnTgOH3s9Y4nZt4=; h=Date:From:To:Cc:Subject:In-Reply-To:From; b=WKHWYhR5mbbNVzGbhCPf7kl3oB3jDL3oHMn4Q3PKGa5PZXdSv3F82AMPzTnllqrB4 eZBDrqWP3HqjL+d8FxqNuISmb9y7y4WCaIE1AKWLLrnaaF0NASBwhgLGvWRYLecpTO ttEfbAtfQ8AJvE0g7ukarqYG4cu6ptpkcv9VPL9XAGDJtrUvUjgz3YtAF7LDMUgrDa s/zksYEOphxkiemLTBFR2/kTS9c5z3U4A2SCiAAxhWpDiRw6Bwmz98kZLETHOr9Bg7 eyAiL1mqWCvwl0QT9oRiiwzTJzltC9q8nqukrrPuz9rMas7Qhl8FYpTAxdzmV9SdoI 9XFSIr6NmMG1Q== Date: Tue, 16 Apr 2024 10:25:58 +0200 From: Christian Brauner To: =?utf-8?B?QmrDtnJuIFTDtnBlbA==?= , Nam Cao , Mike Rapoport Cc: Andreas Dilger , Al Viro , linux-fsdevel , Jan Kara , Linux Kernel Mailing List , linux-riscv@lists.infradead.org, Theodore Ts'o , Ext4 Developers List , Conor Dooley , "Matthew Wilcox (Oracle)" , Anders Roxell Subject: Re: riscv32 EXT4 splat, 6.8 regression? Message-ID: <20240416-deppen-gasleitung-8098fcfd6bbd@brauner> Precedence: bulk X-Mailing-List: linux-ext4@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <87le5e393x.fsf@all.your.base.are.belong.to.us> <20240416084417.569356d3@namcao> [Adding Mike who's knowledgeable in this area] On Mon, Apr 15, 2024 at 06:04:50PM +0200, Björn Töpel wrote: > Christian Brauner writes: > > > On Sun, Apr 14, 2024 at 04:08:11PM +0200, Björn Töpel wrote: > >> Andreas Dilger writes: > >> > >> > On Apr 13, 2024, at 8:15 PM, Al Viro wrote: > >> >> > >> >> On Sat, Apr 13, 2024 at 07:46:03PM -0600, Andreas Dilger wrote: > >> >> > >> >>> As to whether the 0xfffff000 address itself is valid for riscv32 is > >> >>> outside my realm, but given that RAM is cheap it doesn't seem unlikely > >> >>> to have 4GB+ of RAM and want to use it all. The riscv32 might consider > >> >>> reserving this page address from allocation to avoid similar issues in > >> >>> other parts of the code, as is done with the NULL/0 page address. > >> >> > >> >> Not a chance. *Any* page mapped there is a serious bug on any 32bit > >> >> box. Recall what ERR_PTR() is... > >> >> > >> >> On any architecture the virtual addresses in range (unsigned long)-512.. > >> >> (unsigned long)-1 must never resolve to valid kernel objects. > >> >> In other words, any kind of wraparound here is asking for an oops on > >> >> attempts to access the elements of buffer - kernel dereference of > >> >> (char *)0xfffff000 on a 32bit box is already a bug. > >> >> > >> >> It might be getting an invalid pointer, but arithmetical overflows > >> >> are irrelevant. > >> > > >> > The original bug report stated that search_buf = 0xfffff000 on entry, > >> > and I'd quoted that at the start of my email: > >> > > >> > On Apr 12, 2024, at 8:57 AM, Björn Töpel wrote: > >> >> What I see in ext4_search_dir() is that search_buf is 0xfffff000, and at > >> >> some point the address wraps to zero, and boom. I doubt that 0xfffff000 > >> >> is a sane address. > >> > > >> > Now that you mention ERR_PTR() it definitely makes sense that this last > >> > page HAS to be excluded. > >> > > >> > So some other bug is passing the bad pointer to this code before this > >> > error, or the arch is not correctly excluding this page from allocation. > >> > >> Yeah, something is off for sure. > >> > >> (FWIW, I manage to hit this for Linus' master as well.) > >> > >> I added a print (close to trace_mm_filemap_add_to_page_cache()), and for > >> this BT: > >> > >> [] __filemap_add_folio+0x322/0x508 > >> [] filemap_add_folio+0x54/0xce > >> [] __filemap_get_folio+0x156/0x2aa > >> [] __getblk_slow+0xcc/0x302 > >> [] bdev_getblk+0x76/0x7a > >> [] ext4_getblk+0xbc/0x2c4 > >> [] ext4_bread_batch+0x56/0x186 > >> [] __ext4_find_entry+0x156/0x578 > >> [] ext4_lookup+0x86/0x1f4 > >> [] __lookup_slow+0x8e/0x142 > >> [] walk_component+0x104/0x174 > >> [] path_lookupat+0x78/0x182 > >> [] filename_lookup+0x96/0x158 > >> [] kern_path+0x38/0x56 > >> [] init_mount+0x5c/0xac > >> [] devtmpfs_mount+0x44/0x7a > >> [] prepare_namespace+0x226/0x27c > >> [] kernel_init_freeable+0x286/0x2a8 > >> [] kernel_init+0x2a/0x156 > >> [] ret_from_fork+0xe/0x20 > >> > >> I get a folio where folio_address(folio) == 0xfffff000 (which is > >> broken). > >> > >> Need to go into the weeds here... > > > > I don't see anything obvious that could explain this right away. Did you > > manage to reproduce this on any other architecture and/or filesystem? > > > > Fwiw, iirc there were a bunch of fs/buffer.c changes that came in > > through the mm/ layer between v6.7 and v6.8 that might also be > > interesting. But really I'm poking in the dark currently. > > Thanks for getting back! Spent some more time one it today. > > It seems that the buddy allocator *can* return a page with a VA that can > wrap (0xfffff000 -- pointed out by Nam and myself). > > Further, it seems like riscv32 indeed inserts a page like that to the > buddy allocator, when the memblock is free'd: > > | [] __free_one_page+0x2a4/0x3ea > | [] __free_pages_ok+0x158/0x3cc > | [] __free_pages_core+0xe8/0x12c > | [] memblock_free_pages+0x1a/0x22 > | [] memblock_free_all+0x1ee/0x278 > | [] mem_init+0x10/0xa4 > | [] mm_core_init+0x11a/0x2da > | [] start_kernel+0x3c4/0x6de > > Here, a page with VA 0xfffff000 is a added to the freelist. We were just > lucky (unlucky?) that page was used for the page cache. > > A nasty patch like: > --8<-- > diff --git a/mm/mm_init.c b/mm/mm_init.c > index 549e76af8f82..a6a6abbe71b0 100644 > --- a/mm/mm_init.c > +++ b/mm/mm_init.c > @@ -2566,6 +2566,9 @@ void __init set_dma_reserve(unsigned long new_dma_reserve) > void __init memblock_free_pages(struct page *page, unsigned long pfn, > unsigned int order) > { > + if ((long)page_address(page) == 0xfffff000L) { > + return; // leak it > + } > > if (IS_ENABLED(CONFIG_DEFERRED_STRUCT_PAGE_INIT)) { > int nid = early_pfn_to_nid(pfn); > --8<-- > > ...and it's gone. > > I need to think more about what a proper fix is. Regardless; Christian, > Al, and Ted can all relax. ;-) > > > Björn On Tue, Apr 16, 2024 at 08:44:17AM +0200, Nam Cao wrote: > On 2024-04-15 Björn Töpel wrote: > > Thanks for getting back! Spent some more time one it today. > > > > It seems that the buddy allocator *can* return a page with a VA that can > > wrap (0xfffff000 -- pointed out by Nam and myself). > > > > Further, it seems like riscv32 indeed inserts a page like that to the > > buddy allocator, when the memblock is free'd: > > > > | [] __free_one_page+0x2a4/0x3ea > > | [] __free_pages_ok+0x158/0x3cc > > | [] __free_pages_core+0xe8/0x12c > > | [] memblock_free_pages+0x1a/0x22 > > | [] memblock_free_all+0x1ee/0x278 > > | [] mem_init+0x10/0xa4 > > | [] mm_core_init+0x11a/0x2da > > | [] start_kernel+0x3c4/0x6de > > > > Here, a page with VA 0xfffff000 is a added to the freelist. We were just > > lucky (unlucky?) that page was used for the page cache. > > I just educated myself about memory mapping last night, so the below > may be complete nonsense. Take it with a grain of salt. > > In riscv's setup_bootmem(), we have this line: > max_low_pfn = max_pfn = PFN_DOWN(phys_ram_end); > > I think this is the root cause: max_low_pfn indicates the last page > to be mapped. Problem is: nothing prevents PFN_DOWN(phys_ram_end) from > getting mapped to the last page (0xfffff000). If max_low_pfn is mapped > to the last page, we get the reported problem. > > There seems to be some code to make sure the last page is not used > (the call to memblock_set_current_limit() right above this line). It is > unclear to me why this still lets the problem slip through. > > The fix is simple: never let max_low_pfn gets mapped to the last page. > The below patch fixes the problem for me. But I am not entirely sure if > this is the correct fix, further investigation needed. > > Best regards, > Nam > > diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c > index fa34cf55037b..17cab0a52726 100644 > --- a/arch/riscv/mm/init.c > +++ b/arch/riscv/mm/init.c > @@ -251,7 +251,8 @@ static void __init setup_bootmem(void) > } > > min_low_pfn = PFN_UP(phys_ram_base); > - max_low_pfn = max_pfn = PFN_DOWN(phys_ram_end); > + max_low_pfn = PFN_DOWN(memblock_get_current_limit()); > + max_pfn = PFN_DOWN(phys_ram_end); > high_memory = (void *)(__va(PFN_PHYS(max_low_pfn))); > > dma32_phys_limit = min(4UL * SZ_1G, (unsigned long)PFN_PHYS(max_low_pfn)); From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9E64AC04FF6 for ; Tue, 16 Apr 2024 08:26:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:Message-ID: Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:References: List-Owner; bh=81apMSQLiKI2qVPLIXqldoyeusP+Uo+2cM6G6YRF64E=; b=LKPjBMQU1hroZd dCph/UOK+AYqOjbv0xEbEEwVAlHlh5SACXYijX3IeBczG8qUUnKwKiwxgMk9Kr884aS+/2EUcWKFW Ni81sZVAPstPHqJDw8lnzrkggr6/vbSCN6zdC7ZJl4pRsZgy11Ak0ZP5Jixb+PqZQhShBHaxER60C OGmJzBJ4oO6iHofMouv0hSJ3zmLN71zktq9rY6FCL23Z+cdBBw/WlHKWqWxsttxvviLFubVW4Tn7i MYZRFBIoDiz3LeQOWmFFxV7LqgEqA3WiTzj9lHdtm/HJec5hXfbi5AqsvuNZ4bLY4xonzO2GiRT/r 5e9Sj2z/y9JPY5eAFCBg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rwe8r-0000000BRnr-2ePe; Tue, 16 Apr 2024 08:26:13 +0000 Received: from sin.source.kernel.org ([2604:1380:40e1:4800::1]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rwe8n-0000000BRlf-0znC for linux-riscv@lists.infradead.org; Tue, 16 Apr 2024 08:26:11 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id A99B5CE0F0E; Tue, 16 Apr 2024 08:26:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B3887C113CE; Tue, 16 Apr 2024 08:26:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1713255965; bh=dU7PkEFRm93LBS1Z28p9N1XSH6G5tnTgOH3s9Y4nZt4=; h=Date:From:To:Cc:Subject:In-Reply-To:From; b=WKHWYhR5mbbNVzGbhCPf7kl3oB3jDL3oHMn4Q3PKGa5PZXdSv3F82AMPzTnllqrB4 eZBDrqWP3HqjL+d8FxqNuISmb9y7y4WCaIE1AKWLLrnaaF0NASBwhgLGvWRYLecpTO ttEfbAtfQ8AJvE0g7ukarqYG4cu6ptpkcv9VPL9XAGDJtrUvUjgz3YtAF7LDMUgrDa s/zksYEOphxkiemLTBFR2/kTS9c5z3U4A2SCiAAxhWpDiRw6Bwmz98kZLETHOr9Bg7 eyAiL1mqWCvwl0QT9oRiiwzTJzltC9q8nqukrrPuz9rMas7Qhl8FYpTAxdzmV9SdoI 9XFSIr6NmMG1Q== Date: Tue, 16 Apr 2024 10:25:58 +0200 From: Christian Brauner To: =?utf-8?B?QmrDtnJuIFTDtnBlbA==?= , Nam Cao , Mike Rapoport Cc: Andreas Dilger , Al Viro , linux-fsdevel , Jan Kara , Linux Kernel Mailing List , linux-riscv@lists.infradead.org, Theodore Ts'o , Ext4 Developers List , Conor Dooley , "Matthew Wilcox (Oracle)" , Anders Roxell Subject: Re: riscv32 EXT4 splat, 6.8 regression? Message-ID: <20240416-deppen-gasleitung-8098fcfd6bbd@brauner> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <87le5e393x.fsf@all.your.base.are.belong.to.us> <20240416084417.569356d3@namcao> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240416_012609_686495_75F18011 X-CRM114-Status: GOOD ( 55.69 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org W0FkZGluZyBNaWtlIHdobydzIGtub3dsZWRnZWFibGUgaW4gdGhpcyBhcmVhXQoKT24gTW9uLCBB cHIgMTUsIDIwMjQgYXQgMDY6MDQ6NTBQTSArMDIwMCwgQmrDtnJuIFTDtnBlbCB3cm90ZToKPiBD aHJpc3RpYW4gQnJhdW5lciA8YnJhdW5lckBrZXJuZWwub3JnPiB3cml0ZXM6Cj4gCj4gPiBPbiBT dW4sIEFwciAxNCwgMjAyNCBhdCAwNDowODoxMVBNICswMjAwLCBCasO2cm4gVMO2cGVsIHdyb3Rl Ogo+ID4+IEFuZHJlYXMgRGlsZ2VyIDxhZGlsZ2VyQGRpbGdlci5jYT4gd3JpdGVzOgo+ID4+IAo+ ID4+ID4gT24gQXByIDEzLCAyMDI0LCBhdCA4OjE1IFBNLCBBbCBWaXJvIDx2aXJvQHplbml2Lmxp bnV4Lm9yZy51az4gd3JvdGU6Cj4gPj4gPj4gCj4gPj4gPj4gT24gU2F0LCBBcHIgMTMsIDIwMjQg YXQgMDc6NDY6MDNQTSAtMDYwMCwgQW5kcmVhcyBEaWxnZXIgd3JvdGU6Cj4gPj4gPj4gCj4gPj4g Pj4+IEFzIHRvIHdoZXRoZXIgdGhlIDB4ZmZmZmYwMDAgYWRkcmVzcyBpdHNlbGYgaXMgdmFsaWQg Zm9yIHJpc2N2MzIgaXMKPiA+PiA+Pj4gb3V0c2lkZSBteSByZWFsbSwgYnV0IGdpdmVuIHRoYXQg UkFNIGlzIGNoZWFwIGl0IGRvZXNuJ3Qgc2VlbSB1bmxpa2VseQo+ID4+ID4+PiB0byBoYXZlIDRH Qisgb2YgUkFNIGFuZCB3YW50IHRvIHVzZSBpdCBhbGwuICBUaGUgcmlzY3YzMiBtaWdodCBjb25z aWRlcgo+ID4+ID4+PiByZXNlcnZpbmcgdGhpcyBwYWdlIGFkZHJlc3MgZnJvbSBhbGxvY2F0aW9u IHRvIGF2b2lkIHNpbWlsYXIgaXNzdWVzIGluCj4gPj4gPj4+IG90aGVyIHBhcnRzIG9mIHRoZSBj b2RlLCBhcyBpcyBkb25lIHdpdGggdGhlIE5VTEwvMCBwYWdlIGFkZHJlc3MuCj4gPj4gPj4gCj4g Pj4gPj4gTm90IGEgY2hhbmNlLiAgKkFueSogcGFnZSBtYXBwZWQgdGhlcmUgaXMgYSBzZXJpb3Vz IGJ1ZyBvbiBhbnkgMzJiaXQKPiA+PiA+PiBib3guICBSZWNhbGwgd2hhdCBFUlJfUFRSKCkgaXMu Li4KPiA+PiA+PiAKPiA+PiA+PiBPbiBhbnkgYXJjaGl0ZWN0dXJlIHRoZSB2aXJ0dWFsIGFkZHJl c3NlcyBpbiByYW5nZSAodW5zaWduZWQgbG9uZyktNTEyLi4KPiA+PiA+PiAodW5zaWduZWQgbG9u ZyktMSBtdXN0IG5ldmVyIHJlc29sdmUgdG8gdmFsaWQga2VybmVsIG9iamVjdHMuCj4gPj4gPj4g SW4gb3RoZXIgd29yZHMsIGFueSBraW5kIG9mIHdyYXBhcm91bmQgaGVyZSBpcyBhc2tpbmcgZm9y IGFuIG9vcHMgb24KPiA+PiA+PiBhdHRlbXB0cyB0byBhY2Nlc3MgdGhlIGVsZW1lbnRzIG9mIGJ1 ZmZlciAtIGtlcm5lbCBkZXJlZmVyZW5jZSBvZgo+ID4+ID4+IChjaGFyICopMHhmZmZmZjAwMCBv biBhIDMyYml0IGJveCBpcyBhbHJlYWR5IGEgYnVnLgo+ID4+ID4+IAo+ID4+ID4+IEl0IG1pZ2h0 IGJlIGdldHRpbmcgYW4gaW52YWxpZCBwb2ludGVyLCBidXQgYXJpdGhtZXRpY2FsIG92ZXJmbG93 cwo+ID4+ID4+IGFyZSBpcnJlbGV2YW50Lgo+ID4+ID4KPiA+PiA+IFRoZSBvcmlnaW5hbCBidWcg cmVwb3J0IHN0YXRlZCB0aGF0IHNlYXJjaF9idWYgPSAweGZmZmZmMDAwIG9uIGVudHJ5LAo+ID4+ ID4gYW5kIEknZCBxdW90ZWQgdGhhdCBhdCB0aGUgc3RhcnQgb2YgbXkgZW1haWw6Cj4gPj4gPgo+ ID4+ID4gT24gQXByIDEyLCAyMDI0LCBhdCA4OjU3IEFNLCBCasO2cm4gVMO2cGVsIDxiam9ybkBr ZXJuZWwub3JnPiB3cm90ZToKPiA+PiA+PiBXaGF0IEkgc2VlIGluIGV4dDRfc2VhcmNoX2Rpcigp IGlzIHRoYXQgc2VhcmNoX2J1ZiBpcyAweGZmZmZmMDAwLCBhbmQgYXQKPiA+PiA+PiBzb21lIHBv aW50IHRoZSBhZGRyZXNzIHdyYXBzIHRvIHplcm8sIGFuZCBib29tLiBJIGRvdWJ0IHRoYXQgMHhm ZmZmZjAwMAo+ID4+ID4+IGlzIGEgc2FuZSBhZGRyZXNzLgo+ID4+ID4KPiA+PiA+IE5vdyB0aGF0 IHlvdSBtZW50aW9uIEVSUl9QVFIoKSBpdCBkZWZpbml0ZWx5IG1ha2VzIHNlbnNlIHRoYXQgdGhp cyBsYXN0Cj4gPj4gPiBwYWdlIEhBUyB0byBiZSBleGNsdWRlZC4KPiA+PiA+Cj4gPj4gPiBTbyBz b21lIG90aGVyIGJ1ZyBpcyBwYXNzaW5nIHRoZSBiYWQgcG9pbnRlciB0byB0aGlzIGNvZGUgYmVm b3JlIHRoaXMKPiA+PiA+IGVycm9yLCBvciB0aGUgYXJjaCBpcyBub3QgY29ycmVjdGx5IGV4Y2x1 ZGluZyB0aGlzIHBhZ2UgZnJvbSBhbGxvY2F0aW9uLgo+ID4+IAo+ID4+IFllYWgsIHNvbWV0aGlu ZyBpcyBvZmYgZm9yIHN1cmUuCj4gPj4gCj4gPj4gKEZXSVcsIEkgbWFuYWdlIHRvIGhpdCB0aGlz IGZvciBMaW51cycgbWFzdGVyIGFzIHdlbGwuKQo+ID4+IAo+ID4+IEkgYWRkZWQgYSBwcmludCAo Y2xvc2UgdG8gdHJhY2VfbW1fZmlsZW1hcF9hZGRfdG9fcGFnZV9jYWNoZSgpKSwgYW5kIGZvcgo+ ID4+IHRoaXMgQlQ6Cj4gPj4gCj4gPj4gICBbPGMwMWU4YjM0Pl0gX19maWxlbWFwX2FkZF9mb2xp bysweDMyMi8weDUwOAo+ID4+ICAgWzxjMDFlOGQ2ZT5dIGZpbGVtYXBfYWRkX2ZvbGlvKzB4NTQv MHhjZQo+ID4+ICAgWzxjMDFlYTA3Nj5dIF9fZmlsZW1hcF9nZXRfZm9saW8rMHgxNTYvMHgyYWEK PiA+PiAgIFs8YzAyZGYzNDY+XSBfX2dldGJsa19zbG93KzB4Y2MvMHgzMDIKPiA+PiAgIFs8YzAy ZGY1ZjI+XSBiZGV2X2dldGJsaysweDc2LzB4N2EKPiA+PiAgIFs8YzAzNTE5ZGE+XSBleHQ0X2dl dGJsaysweGJjLzB4MmM0Cj4gPj4gICBbPGMwMzUxY2MyPl0gZXh0NF9icmVhZF9iYXRjaCsweDU2 LzB4MTg2Cj4gPj4gICBbPGMwMzZiY2FhPl0gX19leHQ0X2ZpbmRfZW50cnkrMHgxNTYvMHg1NzgK PiA+PiAgIFs8YzAzNmMxNTI+XSBleHQ0X2xvb2t1cCsweDg2LzB4MWY0Cj4gPj4gICBbPGMwMmEz MjUyPl0gX19sb29rdXBfc2xvdysweDhlLzB4MTQyCj4gPj4gICBbPGMwMmE2ZDcwPl0gd2Fsa19j b21wb25lbnQrMHgxMDQvMHgxNzQKPiA+PiAgIFs8YzAyYTc5M2M+XSBwYXRoX2xvb2t1cGF0KzB4 NzgvMHgxODIKPiA+PiAgIFs8YzAyYThjN2M+XSBmaWxlbmFtZV9sb29rdXArMHg5Ni8weDE1OAo+ ID4+ICAgWzxjMDJhOGQ3Nj5dIGtlcm5fcGF0aCsweDM4LzB4NTYKPiA+PiAgIFs8YzBjMWNiN2E+ XSBpbml0X21vdW50KzB4NWMvMHhhYwo+ID4+ICAgWzxjMGMyYmE0Yz5dIGRldnRtcGZzX21vdW50 KzB4NDQvMHg3YQo+ID4+ICAgWzxjMGMwMWNjZT5dIHByZXBhcmVfbmFtZXNwYWNlKzB4MjI2LzB4 MjdjCj4gPj4gICBbPGMwYzAxMWM2Pl0ga2VybmVsX2luaXRfZnJlZWFibGUrMHgyODYvMHgyYTgK PiA+PiAgIFs8YzBiOTdhYjg+XSBrZXJuZWxfaW5pdCsweDJhLzB4MTU2Cj4gPj4gICBbPGMwYmEy MmNhPl0gcmV0X2Zyb21fZm9yaysweGUvMHgyMAo+ID4+IAo+ID4+IEkgZ2V0IGEgZm9saW8gd2hl cmUgZm9saW9fYWRkcmVzcyhmb2xpbykgPT0gMHhmZmZmZjAwMCAod2hpY2ggaXMKPiA+PiBicm9r ZW4pLgo+ID4+IAo+ID4+IE5lZWQgdG8gZ28gaW50byB0aGUgd2VlZHMgaGVyZS4uLgo+ID4KPiA+ IEkgZG9uJ3Qgc2VlIGFueXRoaW5nIG9idmlvdXMgdGhhdCBjb3VsZCBleHBsYWluIHRoaXMgcmln aHQgYXdheS4gRGlkIHlvdQo+ID4gbWFuYWdlIHRvIHJlcHJvZHVjZSB0aGlzIG9uIGFueSBvdGhl ciBhcmNoaXRlY3R1cmUgYW5kL29yIGZpbGVzeXN0ZW0/Cj4gPgo+ID4gRndpdywgaWlyYyB0aGVy ZSB3ZXJlIGEgYnVuY2ggb2YgZnMvYnVmZmVyLmMgY2hhbmdlcyB0aGF0IGNhbWUgaW4KPiA+IHRo cm91Z2ggdGhlIG1tLyBsYXllciBiZXR3ZWVuIHY2LjcgYW5kIHY2LjggdGhhdCBtaWdodCBhbHNv IGJlCj4gPiBpbnRlcmVzdGluZy4gQnV0IHJlYWxseSBJJ20gcG9raW5nIGluIHRoZSBkYXJrIGN1 cnJlbnRseS4KPiAKPiBUaGFua3MgZm9yIGdldHRpbmcgYmFjayEgU3BlbnQgc29tZSBtb3JlIHRp bWUgb25lIGl0IHRvZGF5Lgo+IAo+IEl0IHNlZW1zIHRoYXQgdGhlIGJ1ZGR5IGFsbG9jYXRvciAq Y2FuKiByZXR1cm4gYSBwYWdlIHdpdGggYSBWQSB0aGF0IGNhbgo+IHdyYXAgKDB4ZmZmZmYwMDAg LS0gcG9pbnRlZCBvdXQgYnkgTmFtIGFuZCBteXNlbGYpLgo+IAo+IEZ1cnRoZXIsIGl0IHNlZW1z IGxpa2UgcmlzY3YzMiBpbmRlZWQgaW5zZXJ0cyBhIHBhZ2UgbGlrZSB0aGF0IHRvIHRoZQo+IGJ1 ZGR5IGFsbG9jYXRvciwgd2hlbiB0aGUgbWVtYmxvY2sgaXMgZnJlZSdkOgo+IAo+ICAgfCBbPGMw MjQ5NjFjPl0gX19mcmVlX29uZV9wYWdlKzB4MmE0LzB4M2VhCj4gICB8IFs8YzAyNGE0NDg+XSBf X2ZyZWVfcGFnZXNfb2srMHgxNTgvMHgzY2MKPiAgIHwgWzxjMDI0YjFhND5dIF9fZnJlZV9wYWdl c19jb3JlKzB4ZTgvMHgxMmMKPiAgIHwgWzxjMGMxNDM1YT5dIG1lbWJsb2NrX2ZyZWVfcGFnZXMr MHgxYS8weDIyCj4gICB8IFs8YzBjMTc2NzY+XSBtZW1ibG9ja19mcmVlX2FsbCsweDFlZS8weDI3 OAo+ICAgfCBbPGMwYzA1MGIwPl0gbWVtX2luaXQrMHgxMC8weGE0Cj4gICB8IFs8YzBjMTQ0N2M+ XSBtbV9jb3JlX2luaXQrMHgxMWEvMHgyZGEKPiAgIHwgWzxjMGMwMGJiNj5dIHN0YXJ0X2tlcm5l bCsweDNjNC8weDZkZQo+IAo+IEhlcmUsIGEgcGFnZSB3aXRoIFZBIDB4ZmZmZmYwMDAgaXMgYSBh ZGRlZCB0byB0aGUgZnJlZWxpc3QuIFdlIHdlcmUganVzdAo+IGx1Y2t5ICh1bmx1Y2t5PykgdGhh dCBwYWdlIHdhcyB1c2VkIGZvciB0aGUgcGFnZSBjYWNoZS4KPiAKPiBBIG5hc3R5IHBhdGNoIGxp a2U6Cj4gLS04PC0tCj4gZGlmZiAtLWdpdCBhL21tL21tX2luaXQuYyBiL21tL21tX2luaXQuYwo+ IGluZGV4IDU0OWU3NmFmOGY4Mi4uYTZhNmFiYmU3MWIwIDEwMDY0NAo+IC0tLSBhL21tL21tX2lu aXQuYwo+ICsrKyBiL21tL21tX2luaXQuYwo+IEBAIC0yNTY2LDYgKzI1NjYsOSBAQCB2b2lkIF9f aW5pdCBzZXRfZG1hX3Jlc2VydmUodW5zaWduZWQgbG9uZyBuZXdfZG1hX3Jlc2VydmUpCj4gIHZv aWQgX19pbml0IG1lbWJsb2NrX2ZyZWVfcGFnZXMoc3RydWN0IHBhZ2UgKnBhZ2UsIHVuc2lnbmVk IGxvbmcgcGZuLAo+ICAJCQkJCQkJdW5zaWduZWQgaW50IG9yZGVyKQo+ICB7Cj4gKwlpZiAoKGxv bmcpcGFnZV9hZGRyZXNzKHBhZ2UpID09IDB4ZmZmZmYwMDBMKSB7Cj4gKwkJcmV0dXJuOyAvLyBs ZWFrIGl0Cj4gKwl9Cj4gIAo+ICAJaWYgKElTX0VOQUJMRUQoQ09ORklHX0RFRkVSUkVEX1NUUlVD VF9QQUdFX0lOSVQpKSB7Cj4gIAkJaW50IG5pZCA9IGVhcmx5X3Bmbl90b19uaWQocGZuKTsKPiAt LTg8LS0KPiAKPiAuLi5hbmQgaXQncyBnb25lLgo+IAo+IEkgbmVlZCB0byB0aGluayBtb3JlIGFi b3V0IHdoYXQgYSBwcm9wZXIgZml4IGlzLiBSZWdhcmRsZXNzOyBDaHJpc3RpYW4sCj4gQWwsIGFu ZCBUZWQgY2FuIGFsbCByZWxheC4gOy0pCj4gCj4gCj4gQmrDtnJuCgpPbiBUdWUsIEFwciAxNiwg MjAyNCBhdCAwODo0NDoxN0FNICswMjAwLCBOYW0gQ2FvIHdyb3RlOgo+IE9uIDIwMjQtMDQtMTUg QmrDtnJuIFTDtnBlbCB3cm90ZToKPiA+IFRoYW5rcyBmb3IgZ2V0dGluZyBiYWNrISBTcGVudCBz b21lIG1vcmUgdGltZSBvbmUgaXQgdG9kYXkuCj4gPiAKPiA+IEl0IHNlZW1zIHRoYXQgdGhlIGJ1 ZGR5IGFsbG9jYXRvciAqY2FuKiByZXR1cm4gYSBwYWdlIHdpdGggYSBWQSB0aGF0IGNhbgo+ID4g d3JhcCAoMHhmZmZmZjAwMCAtLSBwb2ludGVkIG91dCBieSBOYW0gYW5kIG15c2VsZikuCj4gPiAK PiA+IEZ1cnRoZXIsIGl0IHNlZW1zIGxpa2UgcmlzY3YzMiBpbmRlZWQgaW5zZXJ0cyBhIHBhZ2Ug bGlrZSB0aGF0IHRvIHRoZQo+ID4gYnVkZHkgYWxsb2NhdG9yLCB3aGVuIHRoZSBtZW1ibG9jayBp cyBmcmVlJ2Q6Cj4gPiAKPiA+ICAgfCBbPGMwMjQ5NjFjPl0gX19mcmVlX29uZV9wYWdlKzB4MmE0 LzB4M2VhCj4gPiAgIHwgWzxjMDI0YTQ0OD5dIF9fZnJlZV9wYWdlc19vaysweDE1OC8weDNjYwo+ ID4gICB8IFs8YzAyNGIxYTQ+XSBfX2ZyZWVfcGFnZXNfY29yZSsweGU4LzB4MTJjCj4gPiAgIHwg WzxjMGMxNDM1YT5dIG1lbWJsb2NrX2ZyZWVfcGFnZXMrMHgxYS8weDIyCj4gPiAgIHwgWzxjMGMx NzY3Nj5dIG1lbWJsb2NrX2ZyZWVfYWxsKzB4MWVlLzB4Mjc4Cj4gPiAgIHwgWzxjMGMwNTBiMD5d IG1lbV9pbml0KzB4MTAvMHhhNAo+ID4gICB8IFs8YzBjMTQ0N2M+XSBtbV9jb3JlX2luaXQrMHgx MWEvMHgyZGEKPiA+ICAgfCBbPGMwYzAwYmI2Pl0gc3RhcnRfa2VybmVsKzB4M2M0LzB4NmRlCj4g PiAKPiA+IEhlcmUsIGEgcGFnZSB3aXRoIFZBIDB4ZmZmZmYwMDAgaXMgYSBhZGRlZCB0byB0aGUg ZnJlZWxpc3QuIFdlIHdlcmUganVzdAo+ID4gbHVja3kgKHVubHVja3k/KSB0aGF0IHBhZ2Ugd2Fz IHVzZWQgZm9yIHRoZSBwYWdlIGNhY2hlLgo+IAo+IEkganVzdCBlZHVjYXRlZCBteXNlbGYgYWJv dXQgbWVtb3J5IG1hcHBpbmcgbGFzdCBuaWdodCwgc28gdGhlIGJlbG93Cj4gbWF5IGJlIGNvbXBs ZXRlIG5vbnNlbnNlLiBUYWtlIGl0IHdpdGggYSBncmFpbiBvZiBzYWx0Lgo+IAo+IEluIHJpc2N2 J3Mgc2V0dXBfYm9vdG1lbSgpLCB3ZSBoYXZlIHRoaXMgbGluZToKPiAJbWF4X2xvd19wZm4gPSBt YXhfcGZuID0gUEZOX0RPV04ocGh5c19yYW1fZW5kKTsKPiAKPiBJIHRoaW5rIHRoaXMgaXMgdGhl IHJvb3QgY2F1c2U6IG1heF9sb3dfcGZuIGluZGljYXRlcyB0aGUgbGFzdCBwYWdlCj4gdG8gYmUg bWFwcGVkLiBQcm9ibGVtIGlzOiBub3RoaW5nIHByZXZlbnRzIFBGTl9ET1dOKHBoeXNfcmFtX2Vu ZCkgZnJvbQo+IGdldHRpbmcgbWFwcGVkIHRvIHRoZSBsYXN0IHBhZ2UgKDB4ZmZmZmYwMDApLiBJ ZiBtYXhfbG93X3BmbiBpcyBtYXBwZWQKPiB0byB0aGUgbGFzdCBwYWdlLCB3ZSBnZXQgdGhlIHJl cG9ydGVkIHByb2JsZW0uCj4gCj4gVGhlcmUgc2VlbXMgdG8gYmUgc29tZSBjb2RlIHRvIG1ha2Ug c3VyZSB0aGUgbGFzdCBwYWdlIGlzIG5vdCB1c2VkCj4gKHRoZSBjYWxsIHRvIG1lbWJsb2NrX3Nl dF9jdXJyZW50X2xpbWl0KCkgcmlnaHQgYWJvdmUgdGhpcyBsaW5lKS4gSXQgaXMKPiB1bmNsZWFy IHRvIG1lIHdoeSB0aGlzIHN0aWxsIGxldHMgdGhlIHByb2JsZW0gc2xpcCB0aHJvdWdoLgo+IAo+ IFRoZSBmaXggaXMgc2ltcGxlOiBuZXZlciBsZXQgbWF4X2xvd19wZm4gZ2V0cyBtYXBwZWQgdG8g dGhlIGxhc3QgcGFnZS4KPiBUaGUgYmVsb3cgcGF0Y2ggZml4ZXMgdGhlIHByb2JsZW0gZm9yIG1l LiBCdXQgSSBhbSBub3QgZW50aXJlbHkgc3VyZSBpZgo+IHRoaXMgaXMgdGhlIGNvcnJlY3QgZml4 LCBmdXJ0aGVyIGludmVzdGlnYXRpb24gbmVlZGVkLgo+IAo+IEJlc3QgcmVnYXJkcywKPiBOYW0K PiAKPiBkaWZmIC0tZ2l0IGEvYXJjaC9yaXNjdi9tbS9pbml0LmMgYi9hcmNoL3Jpc2N2L21tL2lu aXQuYwo+IGluZGV4IGZhMzRjZjU1MDM3Yi4uMTdjYWIwYTUyNzI2IDEwMDY0NAo+IC0tLSBhL2Fy Y2gvcmlzY3YvbW0vaW5pdC5jCj4gKysrIGIvYXJjaC9yaXNjdi9tbS9pbml0LmMKPiBAQCAtMjUx LDcgKzI1MSw4IEBAIHN0YXRpYyB2b2lkIF9faW5pdCBzZXR1cF9ib290bWVtKHZvaWQpCj4gIAl9 Cj4gIAo+ICAJbWluX2xvd19wZm4gPSBQRk5fVVAocGh5c19yYW1fYmFzZSk7Cj4gLQltYXhfbG93 X3BmbiA9IG1heF9wZm4gPSBQRk5fRE9XTihwaHlzX3JhbV9lbmQpOwo+ICsJbWF4X2xvd19wZm4g PSBQRk5fRE9XTihtZW1ibG9ja19nZXRfY3VycmVudF9saW1pdCgpKTsKPiArCW1heF9wZm4gPSBQ Rk5fRE9XTihwaHlzX3JhbV9lbmQpOwo+ICAJaGlnaF9tZW1vcnkgPSAodm9pZCAqKShfX3ZhKFBG Tl9QSFlTKG1heF9sb3dfcGZuKSkpOwo+ICAKPiAgCWRtYTMyX3BoeXNfbGltaXQgPSBtaW4oNFVM ICogU1pfMUcsICh1bnNpZ25lZCBsb25nKVBGTl9QSFlTKG1heF9sb3dfcGZuKSk7CgpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpsaW51eC1yaXNjdiBtYWls aW5nIGxpc3QKbGludXgtcmlzY3ZAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5m cmFkZWFkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LXJpc2N2Cg==