From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pandora.armlinux.org.uk (pandora.armlinux.org.uk [78.32.30.218]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EE52F7E116; Tue, 9 Apr 2024 08:16:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=78.32.30.218 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712650566; cv=none; b=YJP+oJvKuXmFfF7lXw5baHuzN1Z+PAh2hbQ8aCk0BD6kocjtUmVmdNMCgPoQnUhaFl3TMbId9TbjfR+YjaV1T6u6OWneBdPXwLQBgpsUFAYAnl4IiievpNzlGMefIaYyvNeZAzAt603i18ZXEUvp/Hw3huuWfHo3Xq+XLEBpW6w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712650566; c=relaxed/simple; bh=8HvCApuiy6ONW7tfYfgKhurDV6wmKYxjw6pCqGJW4qw=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=G2bIjaIxp4lOcwoi1USzcCf+uCFHhK99UlgLpOucklMvxjqqRPjSaed7F4aMbYbf/6rgRSS29Zdu+GFRq8ix11uwiNv5Uig1bZLnA06y1ciiRpADR9FAK/OJ0jI4NuHPcye4MgSIgKzfRyfYYvYr0LpKECWx2j9wWVeTAISQIfQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=armlinux.org.uk; spf=none smtp.mailfrom=armlinux.org.uk; dkim=pass (2048-bit key) header.d=armlinux.org.uk header.i=@armlinux.org.uk header.b=Tkch436q; arc=none smtp.client-ip=78.32.30.218 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=armlinux.org.uk Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=armlinux.org.uk Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=armlinux.org.uk header.i=@armlinux.org.uk header.b="Tkch436q" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=armlinux.org.uk; s=pandora-2019; h=Sender:In-Reply-To: Content-Transfer-Encoding:Content-Type:MIME-Version:References:Message-ID: Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=RRSBY6/rtPwcAAaFW3HJTN9NeVlK6dzskGTvl9SWwlk=; b=Tkch436qG2RJnWFcSMxqYvcDnX KG41Odci/LVUbafwNby6jvXCU7pWNzdA7kTCzKMIXwBqhUsCZdJQ/m1WO7P1wwVr3UWL3FKQ84DTj 3Y0Nm7/Hb8z/7M+x6gGufi1w4MnaBd/4/kw/q8rIge2shXxnq0XNhUGsMBqnP7+8WgGYrD+R5O7RW NmzLSh2XxGZb86K7eqKxsrt/5DqkIIQfcns4vAJNATXV6HCg58Pn5e8GEpmAjVI2PqCA2s2GECvwP LzPvDC4wbDZCF//QQEu6xOkY4cHn4GnwTHJAMtx8aYcWFfb6kVs5yKlSvvAWZkkP7UAVJfivrERak 0CriE9Ug==; Received: from shell.armlinux.org.uk ([fd8f:7570:feb6:1:5054:ff:fe00:4ec]:38758) by pandora.armlinux.org.uk with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1ru6dz-000640-0N; Tue, 09 Apr 2024 09:15:52 +0100 Received: from linux by shell.armlinux.org.uk with local (Exim 4.94.2) (envelope-from ) id 1ru6dx-0004vn-Gs; Tue, 09 Apr 2024 09:15:49 +0100 Date: Tue, 9 Apr 2024 09:15:49 +0100 From: "Russell King (Oracle)" To: Puranjay Mohan Cc: Andrii Nakryiko , Alexei Starovoitov , Mark Rutland , Andrew Morton , linux-arm-kernel , syzbot , LKML , linux-mm , syzkaller-bugs , bpf Subject: Re: [syzbot] [mm?] BUG: unable to handle kernel paging request in copy_from_kernel_nofault (2) Message-ID: References: <000000000000e9a8d80615163f2a@google.com> <20240403184149.0847a9d614f11b249529fd02@linux-foundation.org> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Sender: Russell King (Oracle) On Tue, Apr 09, 2024 at 07:45:54AM +0000, Puranjay Mohan wrote: > "Russell King (Oracle)" writes: > > > On Fri, Apr 05, 2024 at 10:50:30AM -0700, Andrii Nakryiko wrote: > >> On Fri, Apr 5, 2024 at 9:30 AM Alexei Starovoitov > >> wrote: > >> > > >> > On Fri, Apr 5, 2024 at 4:36 AM Russell King (Oracle) > >> > wrote: > >> > > > >> > > On Fri, Apr 05, 2024 at 12:02:36PM +0100, Mark Rutland wrote: > >> > > > On Thu, Apr 04, 2024 at 03:57:04PM -0700, Alexei Starovoitov wrote: > >> > > > > On Wed, Apr 3, 2024 at 6:56 PM Andrew Morton wrote: > >> > > > > > > >> > > > > > On Mon, 01 Apr 2024 22:19:25 -0700 syzbot wrote: > >> > > > > > > >> > > > > > > Hello, > >> > > > > > > >> > > > > > Thanks. Cc: bpf@vger.kernel.org > >> > > > > > >> > > > > I suspect the issue is not on bpf side. > >> > > > > Looks like the bug is somewhere in arm32 bits. > >> > > > > copy_from_kernel_nofault() is called from lots of places. > >> > > > > bpf is just one user that is easy for syzbot to fuzz. > >> > > > > Interestingly arm defines copy_from_kernel_nofault_allowed() > >> > > > > that should have filtered out user addresses. > >> > > > > In this case ffffffe9 is probably a kernel address? > >> > > > > >> > > > It's at the end of the kernel range, and it's ERR_PTR(-EINVAL). > >> > > > > >> > > > 0xffffffe9 is -0x16, which is -22, which is -EINVAL. > >> > > > > >> > > > > But the kernel is doing a write? > >> > > > > Which makes no sense, since copy_from_kernel_nofault is probe reading. > >> > > > > >> > > > It makes perfect sense; the read from 'src' happened, then the kernel tries to > >> > > > write the result to 'dst', and that aligns with the disassembly in the report > >> > > > below, which I beleive is: > >> > > > > >> > > > 8: e4942000 ldr r2, [r4], #0 <-- Read of 'src', fault fixup is elsewhere > >> > > > c: e3530000 cmp r3, #0 > >> > > > * 10: e5852000 str r2, [r5] <-- Write to 'dst' > >> > > > > >> > > > As above, it looks like 'dst' is ERR_PTR(-EINVAL). > >> > > > > >> > > > Are you certain that BPF is passing a sane value for 'dst'? Where does that > >> > > > come from in the first place? > >> > > > >> > > It looks to me like it gets passed in from the BPF program, and the > >> > > "type" for the argument is set to ARG_PTR_TO_UNINIT_MEM. What that > >> > > means for validation purposes, I've no idea, I'm not a BPF hacker. > >> > > > >> > > Obviously, if BPF is allowing copy_from_kernel_nofault() to be passed > >> > > an arbitary destination address, that would be a huge security hole. > >> > > >> > If that's the case that's indeed a giant security hole, > >> > but I doubt it. We would be crashing other archs as well. > >> > I cannot really tell whether arm32 JIT is on. > >> > If it is, it's likely a bug there. > >> > Puranjay, > >> > could you please take a look. > >> > > >> > >> I dumped the BPF program that repro.c is loading, it works on x86-64 > >> and there is nothing special there. We are probe-reading 5 bytes from > >> somewhere into the stack. Everything is unaligned here, but stays > >> within a well-defined memory slot. > >> > >> Note the r3 = (s8)r1, that's a new-ish thing, maybe bug is somewhere > >> there (but then it would be JIT, not verifier itself) > >> > >> 0: (7a) *(u64 *)(r10 -8) = 896542069 > >> 1: (bf) r1 = r10 > >> 2: (07) r1 += -7 > >> 3: (b7) r2 = 5 > >> 4: (bf) r3 = (s8)r1 > >> 5: (85) call bpf_probe_read_kernel#-72390 > > > > I have started looking into this, the issue only reproduces when the JIT > is enabled. With the interpreter, it works fine. > > I used GDB to dump the JITed BPF program: > > 0xbf00012c: push {r4, r5, r6, r7, r8, r9, r11, lr} > 0xbf000130: mov r11, sp > 0xbf000134: mov r3, #0 > 0xbf000138: sub r2, sp, #80 @ 0x50 > 0xbf00013c: sub sp, sp, #88 @ 0x58 > 0xbf000140: strd r2, [r11, #-64] @ 0xffffffc0 > 0xbf000144: mov r2, #0 > 0xbf000148: strd r2, [r11, #-72] @ 0xffffffb8 > 0xbf00014c: mov r2, r0 > 0xbf000150: movw r8, #9589 @ 0x2575 > 0xbf000154: movt r8, #13680 @ 0x3570 > 0xbf000158: mov r9, #0 > 0xbf00015c: ldr r6, [r11, #-64] @ 0xffffffc0 > 0xbf000160: str r8, [r6, #-8] > 0xbf000164: str r9, [r6, #-4] > 0xbf000168: ldrd r2, [r11, #-64] @ 0xffffffc0 > 0xbf00016c: movw r8, #65529 @ 0xfff9 > 0xbf000170: movt r8, #65535 @ 0xffff > 0xbf000174: movw r9, #65535 @ 0xffff > 0xbf000178: movt r9, #65535 @ 0xffff > 0xbf00017c: adds r2, r2, r8 > 0xbf000180: adc r3, r3, r9 > 0xbf000184: mov r6, #5 > 0xbf000188: mov r7, #0 > 0xbf00018c: strd r6, [r11, #-8] > 0xbf000190: ldrd r6, [r11, #-16] Up to this point, it looks correct. r2/r3 contain the stack pointer which corresponds to the instruction at "2:" > 0xbf000194: lsl r2, r2, #24 > 0xbf000198: asr r2, r2, #24 > 0xbf00019c: str r2, [r11, #-16] This then narrows the 64-bit pointer down to just 8!!! bits, but this is what the instruction at "4:" is asking for. However, it looks like it's happening to BPF's "r1" rather than "r3" and this is probably where the problem lies. I haven't got time to analyse this further this morning - I'm only around sporadically today. I'll try to look deeper at this later on. -- RMK's Patch system: https://www.armlinux.org.uk/developer/patches/ FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last! From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A9C21C67861 for ; Tue, 9 Apr 2024 08:18:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=2wFsh8wpfsyWWv28ALGkVbUDGlVqV+ac/E+fydeIt+U=; b=TteXrNIGp/sYfx BBHSOUCO3DbQLGtwIL3rW8H+3XK2AWOyNpn6g7E0hKMjmkpuLQAEgW+xvivQ8bGPG6+fz8qp9Fjsp YOW27Imgqff6H+zsY6oDlsMpEQwdHyP1z8zeAywk9MT01eoRYs3Raf9bG4Lo/WdjN3GoRNc/aG2nH NchHYiaYuncy6eOthDILLZoQKlyI/jPEIpPyVYmQK2vCtInTecDPb8+PrAbHUexN7phpXCxQi9FiR edCyc1/ELoHntEQEu2Hwvw+BvfctkeeLRNubKRO3YHryu9zQkEQxPJ20fIyb8wSjO8at7OJH7rU9E w2XOmyKcdNf72XO1Jj3Q==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1ru6gJ-00000000v3p-0SQe; Tue, 09 Apr 2024 08:18:15 +0000 Received: from pandora.armlinux.org.uk ([2001:4d48:ad52:32c8:5054:ff:fe00:142]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1ru6g7-00000000uQz-1vsU for linux-arm-kernel@lists.infradead.org; Tue, 09 Apr 2024 08:18:13 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=armlinux.org.uk; s=pandora-2019; h=Sender:In-Reply-To: Content-Transfer-Encoding:Content-Type:MIME-Version:References:Message-ID: Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=RRSBY6/rtPwcAAaFW3HJTN9NeVlK6dzskGTvl9SWwlk=; b=Tkch436qG2RJnWFcSMxqYvcDnX KG41Odci/LVUbafwNby6jvXCU7pWNzdA7kTCzKMIXwBqhUsCZdJQ/m1WO7P1wwVr3UWL3FKQ84DTj 3Y0Nm7/Hb8z/7M+x6gGufi1w4MnaBd/4/kw/q8rIge2shXxnq0XNhUGsMBqnP7+8WgGYrD+R5O7RW NmzLSh2XxGZb86K7eqKxsrt/5DqkIIQfcns4vAJNATXV6HCg58Pn5e8GEpmAjVI2PqCA2s2GECvwP LzPvDC4wbDZCF//QQEu6xOkY4cHn4GnwTHJAMtx8aYcWFfb6kVs5yKlSvvAWZkkP7UAVJfivrERak 0CriE9Ug==; Received: from shell.armlinux.org.uk ([fd8f:7570:feb6:1:5054:ff:fe00:4ec]:38758) by pandora.armlinux.org.uk with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1ru6dz-000640-0N; Tue, 09 Apr 2024 09:15:52 +0100 Received: from linux by shell.armlinux.org.uk with local (Exim 4.94.2) (envelope-from ) id 1ru6dx-0004vn-Gs; Tue, 09 Apr 2024 09:15:49 +0100 Date: Tue, 9 Apr 2024 09:15:49 +0100 From: "Russell King (Oracle)" To: Puranjay Mohan Cc: Andrii Nakryiko , Alexei Starovoitov , Mark Rutland , Andrew Morton , linux-arm-kernel , syzbot , LKML , linux-mm , syzkaller-bugs , bpf Subject: Re: [syzbot] [mm?] BUG: unable to handle kernel paging request in copy_from_kernel_nofault (2) Message-ID: References: <000000000000e9a8d80615163f2a@google.com> <20240403184149.0847a9d614f11b249529fd02@linux-foundation.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240409_011803_689606_ED4BDDE1 X-CRM114-Status: GOOD ( 43.56 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org T24gVHVlLCBBcHIgMDksIDIwMjQgYXQgMDc6NDU6NTRBTSArMDAwMCwgUHVyYW5qYXkgTW9oYW4g d3JvdGU6Cj4gIlJ1c3NlbGwgS2luZyAoT3JhY2xlKSIgPGxpbnV4QGFybWxpbnV4Lm9yZy51az4g d3JpdGVzOgo+IAo+ID4gT24gRnJpLCBBcHIgMDUsIDIwMjQgYXQgMTA6NTA6MzBBTSAtMDcwMCwg QW5kcmlpIE5ha3J5aWtvIHdyb3RlOgo+ID4+IE9uIEZyaSwgQXByIDUsIDIwMjQgYXQgOTozMOKA r0FNIEFsZXhlaSBTdGFyb3ZvaXRvdgo+ID4+IDxhbGV4ZWkuc3Rhcm92b2l0b3ZAZ21haWwuY29t PiB3cm90ZToKPiA+PiA+Cj4gPj4gPiBPbiBGcmksIEFwciA1LCAyMDI0IGF0IDQ6MzbigK9BTSBS dXNzZWxsIEtpbmcgKE9yYWNsZSkKPiA+PiA+IDxsaW51eEBhcm1saW51eC5vcmcudWs+IHdyb3Rl Ogo+ID4+ID4gPgo+ID4+ID4gPiBPbiBGcmksIEFwciAwNSwgMjAyNCBhdCAxMjowMjozNlBNICsw MTAwLCBNYXJrIFJ1dGxhbmQgd3JvdGU6Cj4gPj4gPiA+ID4gT24gVGh1LCBBcHIgMDQsIDIwMjQg YXQgMDM6NTc6MDRQTSAtMDcwMCwgQWxleGVpIFN0YXJvdm9pdG92IHdyb3RlOgo+ID4+ID4gPiA+ ID4gT24gV2VkLCBBcHIgMywgMjAyNCBhdCA2OjU24oCvUE0gQW5kcmV3IE1vcnRvbiA8YWtwbUBs aW51eC1mb3VuZGF0aW9ub3JnPiB3cm90ZToKPiA+PiA+ID4gPiA+ID4KPiA+PiA+ID4gPiA+ID4g T24gTW9uLCAwMSBBcHIgMjAyNCAyMjoxOToyNSAtMDcwMCBzeXpib3QgPHN5emJvdCsxODY1MjI2 NzBlNjcyMjY5MmQ4NkBzeXprYWxsZXIuYXBwc3BvdG1haWwuY29tPiB3cm90ZToKPiA+PiA+ID4g PiA+ID4KPiA+PiA+ID4gPiA+ID4gPiBIZWxsbywKPiA+PiA+ID4gPiA+ID4KPiA+PiA+ID4gPiA+ ID4gVGhhbmtzLiAgQ2M6IGJwZkB2Z2VyLmtlcm5lbC5vcmcKPiA+PiA+ID4gPiA+Cj4gPj4gPiA+ ID4gPiBJIHN1c3BlY3QgdGhlIGlzc3VlIGlzIG5vdCBvbiBicGYgc2lkZS4KPiA+PiA+ID4gPiA+ IExvb2tzIGxpa2UgdGhlIGJ1ZyBpcyBzb21ld2hlcmUgaW4gYXJtMzIgYml0cy4KPiA+PiA+ID4g PiA+IGNvcHlfZnJvbV9rZXJuZWxfbm9mYXVsdCgpIGlzIGNhbGxlZCBmcm9tIGxvdHMgb2YgcGxh Y2VzLgo+ID4+ID4gPiA+ID4gYnBmIGlzIGp1c3Qgb25lIHVzZXIgdGhhdCBpcyBlYXN5IGZvciBz eXpib3QgdG8gZnV6ei4KPiA+PiA+ID4gPiA+IEludGVyZXN0aW5nbHkgYXJtIGRlZmluZXMgY29w eV9mcm9tX2tlcm5lbF9ub2ZhdWx0X2FsbG93ZWQoKQo+ID4+ID4gPiA+ID4gdGhhdCBzaG91bGQg aGF2ZSBmaWx0ZXJlZCBvdXQgdXNlciBhZGRyZXNzZXMuCj4gPj4gPiA+ID4gPiBJbiB0aGlzIGNh c2UgZmZmZmZmZTkgaXMgcHJvYmFibHkgYSBrZXJuZWwgYWRkcmVzcz8KPiA+PiA+ID4gPgo+ID4+ ID4gPiA+IEl0J3MgYXQgdGhlIGVuZCBvZiB0aGUga2VybmVsIHJhbmdlLCBhbmQgaXQncyBFUlJf UFRSKC1FSU5WQUwpLgo+ID4+ID4gPiA+Cj4gPj4gPiA+ID4gMHhmZmZmZmZlOSBpcyAtMHgxNiwg d2hpY2ggaXMgLTIyLCB3aGljaCBpcyAtRUlOVkFMLgo+ID4+ID4gPiA+Cj4gPj4gPiA+ID4gPiBC dXQgdGhlIGtlcm5lbCBpcyBkb2luZyBhIHdyaXRlPwo+ID4+ID4gPiA+ID4gV2hpY2ggbWFrZXMg bm8gc2Vuc2UsIHNpbmNlIGNvcHlfZnJvbV9rZXJuZWxfbm9mYXVsdCBpcyBwcm9iZSByZWFkaW5n Lgo+ID4+ID4gPiA+Cj4gPj4gPiA+ID4gSXQgbWFrZXMgcGVyZmVjdCBzZW5zZTsgdGhlIHJlYWQg ZnJvbSAnc3JjJyBoYXBwZW5lZCwgdGhlbiB0aGUga2VybmVsIHRyaWVzIHRvCj4gPj4gPiA+ID4g d3JpdGUgdGhlIHJlc3VsdCB0byAnZHN0JywgYW5kIHRoYXQgYWxpZ25zIHdpdGggdGhlIGRpc2Fz c2VtYmx5IGluIHRoZSByZXBvcnQKPiA+PiA+ID4gPiBiZWxvdywgd2hpY2ggSSBiZWxlaXZlIGlz Ogo+ID4+ID4gPiA+Cj4gPj4gPiA+ID4gICAgICA4OiBlNDk0MjAwMCAgICAgICAgbGRyICAgICBy MiwgW3I0XSwgIzAgIDwtLSBSZWFkIG9mICdzcmMnLCBmYXVsdCBmaXh1cCBpcyBlbHNld2hlcmUK PiA+PiA+ID4gPiAgICAgIGM6IGUzNTMwMDAwICAgICAgICBjbXAgICAgIHIzLCAjMAo+ID4+ID4g PiA+ICAgKiAxMDogZTU4NTIwMDAgICAgICAgIHN0ciAgICAgcjIsIFtyNV0gICAgICA8LS0gV3Jp dGUgdG8gJ2RzdCcKPiA+PiA+ID4gPgo+ID4+ID4gPiA+IEFzIGFib3ZlLCBpdCBsb29rcyBsaWtl ICdkc3QnIGlzIEVSUl9QVFIoLUVJTlZBTCkuCj4gPj4gPiA+ID4KPiA+PiA+ID4gPiBBcmUgeW91 IGNlcnRhaW4gdGhhdCBCUEYgaXMgcGFzc2luZyBhIHNhbmUgdmFsdWUgZm9yICdkc3QnPyBXaGVy ZSBkb2VzIHRoYXQKPiA+PiA+ID4gPiBjb21lIGZyb20gaW4gdGhlIGZpcnN0IHBsYWNlPwo+ID4+ ID4gPgo+ID4+ID4gPiBJdCBsb29rcyB0byBtZSBsaWtlIGl0IGdldHMgcGFzc2VkIGluIGZyb20g dGhlIEJQRiBwcm9ncmFtLCBhbmQgdGhlCj4gPj4gPiA+ICJ0eXBlIiBmb3IgdGhlIGFyZ3VtZW50 IGlzIHNldCB0byBBUkdfUFRSX1RPX1VOSU5JVF9NRU0uIFdoYXQgdGhhdAo+ID4+ID4gPiBtZWFu cyBmb3IgdmFsaWRhdGlvbiBwdXJwb3NlcywgSSd2ZSBubyBpZGVhLCBJJ20gbm90IGEgQlBGIGhh Y2tlci4KPiA+PiA+ID4KPiA+PiA+ID4gT2J2aW91c2x5LCBpZiBCUEYgaXMgYWxsb3dpbmcgY29w eV9mcm9tX2tlcm5lbF9ub2ZhdWx0KCkgdG8gYmUgcGFzc2VkCj4gPj4gPiA+IGFuIGFyYml0YXJ5 IGRlc3RpbmF0aW9uIGFkZHJlc3MsIHRoYXQgd291bGQgYmUgYSBodWdlIHNlY3VyaXR5IGhvbGUu Cj4gPj4gPgo+ID4+ID4gSWYgdGhhdCdzIHRoZSBjYXNlIHRoYXQncyBpbmRlZWQgYSBnaWFudCBz ZWN1cml0eSBob2xlLAo+ID4+ID4gYnV0IEkgZG91YnQgaXQuIFdlIHdvdWxkIGJlIGNyYXNoaW5n IG90aGVyIGFyY2hzIGFzIHdlbGwuCj4gPj4gPiBJIGNhbm5vdCByZWFsbHkgdGVsbCB3aGV0aGVy IGFybTMyIEpJVCBpcyBvbi4KPiA+PiA+IElmIGl0IGlzLCBpdCdzIGxpa2VseSBhIGJ1ZyB0aGVy ZS4KPiA+PiA+IFB1cmFuamF5LAo+ID4+ID4gY291bGQgeW91IHBsZWFzZSB0YWtlIGEgbG9vay4K PiA+PiA+Cj4gPj4gCj4gPj4gSSBkdW1wZWQgdGhlIEJQRiBwcm9ncmFtIHRoYXQgcmVwcm8uYyBp cyBsb2FkaW5nLCBpdCB3b3JrcyBvbiB4ODYtNjQKPiA+PiBhbmQgdGhlcmUgaXMgbm90aGluZyBz cGVjaWFsIHRoZXJlLiBXZSBhcmUgcHJvYmUtcmVhZGluZyA1IGJ5dGVzIGZyb20KPiA+PiBzb21l d2hlcmUgaW50byB0aGUgc3RhY2suIEV2ZXJ5dGhpbmcgaXMgdW5hbGlnbmVkIGhlcmUsIGJ1dCBz dGF5cwo+ID4+IHdpdGhpbiBhIHdlbGwtZGVmaW5lZCBtZW1vcnkgc2xvdC4KPiA+PiAKPiA+PiBO b3RlIHRoZSByMyA9IChzOClyMSwgdGhhdCdzIGEgbmV3LWlzaCB0aGluZywgbWF5YmUgYnVnIGlz IHNvbWV3aGVyZQo+ID4+IHRoZXJlIChidXQgdGhlbiBpdCB3b3VsZCBiZSBKSVQsIG5vdCB2ZXJp ZmllciBpdHNlbGYpCj4gPj4gCj4gPj4gICAgMDogKDdhKSAqKHU2NCAqKShyMTAgLTgpID0gODk2 NTQyMDY5Cj4gPj4gICAgMTogKGJmKSByMSA9IHIxMAo+ID4+ICAgIDI6ICgwNykgcjEgKz0gLTcK PiA+PiAgICAzOiAoYjcpIHIyID0gNQo+ID4+ICAgIDQ6IChiZikgcjMgPSAoczgpcjEKPiA+PiAg ICA1OiAoODUpIGNhbGwgYnBmX3Byb2JlX3JlYWRfa2VybmVsIy03MjM5MAo+ID4KPiAKPiBJIGhh dmUgc3RhcnRlZCBsb29raW5nIGludG8gdGhpcywgdGhlIGlzc3VlIG9ubHkgcmVwcm9kdWNlcyB3 aGVuIHRoZSBKSVQKPiBpcyBlbmFibGVkLiBXaXRoIHRoZSBpbnRlcnByZXRlciwgaXQgd29ya3Mg ZmluZS4KPiAKPiBJIHVzZWQgR0RCIHRvIGR1bXAgdGhlIEpJVGVkIEJQRiBwcm9ncmFtOgo+IAo+ ICAgIDB4YmYwMDAxMmM6ICBwdXNoICAgIHtyNCwgcjUsIHI2LCByNywgcjgsIHI5LCByMTEsIGxy fQo+ICAgIDB4YmYwMDAxMzA6ICBtb3YgICAgIHIxMSwgc3AKPiAgICAweGJmMDAwMTM0OiAgbW92 ICAgICByMywgIzAKPiAgICAweGJmMDAwMTM4OiAgc3ViICAgICByMiwgc3AsICM4MCAgICAgQCAw eDUwCj4gICAgMHhiZjAwMDEzYzogIHN1YiAgICAgc3AsIHNwLCAjODggICAgIEAgMHg1OAo+ICAg IDB4YmYwMDAxNDA6ICBzdHJkICAgIHIyLCBbcjExLCAjLTY0XSBAIDB4ZmZmZmZmYzAKPiAgICAw eGJmMDAwMTQ0OiAgbW92ICAgICByMiwgIzAKPiAgICAweGJmMDAwMTQ4OiAgc3RyZCAgICByMiwg W3IxMSwgIy03Ml0gQCAweGZmZmZmZmI4Cj4gICAgMHhiZjAwMDE0YzogIG1vdiAgICAgcjIsIHIw Cj4gICAgMHhiZjAwMDE1MDogIG1vdncgICAgcjgsICM5NTg5ICAgICAgIEAgMHgyNTc1Cj4gICAg MHhiZjAwMDE1NDogIG1vdnQgICAgcjgsICMxMzY4MCAgICAgIEAgMHgzNTcwCj4gICAgMHhiZjAw MDE1ODogIG1vdiAgICAgcjksICMwCj4gICAgMHhiZjAwMDE1YzogIGxkciAgICAgcjYsIFtyMTEs ICMtNjRdIEAgMHhmZmZmZmZjMAo+ICAgIDB4YmYwMDAxNjA6ICBzdHIgICAgIHI4LCBbcjYsICMt OF0KPiAgICAweGJmMDAwMTY0OiAgc3RyICAgICByOSwgW3I2LCAjLTRdCj4gICAgMHhiZjAwMDE2 ODogIGxkcmQgICAgcjIsIFtyMTEsICMtNjRdIEAgMHhmZmZmZmZjMAo+ICAgIDB4YmYwMDAxNmM6 ICBtb3Z3ICAgIHI4LCAjNjU1MjkgICAgICBAIDB4ZmZmOQo+ICAgIDB4YmYwMDAxNzA6ICBtb3Z0 ICAgIHI4LCAjNjU1MzUgICAgICBAIDB4ZmZmZgo+ICAgIDB4YmYwMDAxNzQ6ICBtb3Z3ICAgIHI5 LCAjNjU1MzUgICAgICBAIDB4ZmZmZgo+ICAgIDB4YmYwMDAxNzg6ICBtb3Z0ICAgIHI5LCAjNjU1 MzUgICAgICBAIDB4ZmZmZgo+ICAgIDB4YmYwMDAxN2M6ICBhZGRzICAgIHIyLCByMiwgcjgKPiAg ICAweGJmMDAwMTgwOiAgYWRjICAgICByMywgcjMsIHI5Cj4gICAgMHhiZjAwMDE4NDogIG1vdiAg ICAgcjYsICM1Cj4gICAgMHhiZjAwMDE4ODogIG1vdiAgICAgcjcsICMwCj4gICAgMHhiZjAwMDE4 YzogIHN0cmQgICAgcjYsIFtyMTEsICMtOF0KPiAgICAweGJmMDAwMTkwOiAgbGRyZCAgICByNiwg W3IxMSwgIy0xNl0KClVwIHRvIHRoaXMgcG9pbnQsIGl0IGxvb2tzIGNvcnJlY3QuIHIyL3IzIGNv bnRhaW4gdGhlIHN0YWNrIHBvaW50ZXIKd2hpY2ggY29ycmVzcG9uZHMgdG8gdGhlIGluc3RydWN0 aW9uIGF0ICIyOiIKCj4gICAgMHhiZjAwMDE5NDogIGxzbCAgICAgcjIsIHIyLCAjMjQKPiAgICAw eGJmMDAwMTk4OiAgYXNyICAgICByMiwgcjIsICMyNAo+ICAgIDB4YmYwMDAxOWM6ICBzdHIgICAg IHIyLCBbcjExLCAjLTE2XQoKVGhpcyB0aGVuIG5hcnJvd3MgdGhlIDY0LWJpdCBwb2ludGVyIGRv d24gdG8ganVzdCA4ISEhIGJpdHMsIGJ1dCB0aGlzCmlzIHdoYXQgdGhlIGluc3RydWN0aW9uIGF0 ICI0OiIgaXMgYXNraW5nIGZvci4gSG93ZXZlciwgaXQgbG9va3MgbGlrZQppdCdzIGhhcHBlbmlu ZyB0byBCUEYncyAicjEiIHJhdGhlciB0aGFuICJyMyIgYW5kIHRoaXMgaXMgcHJvYmFibHkKd2hl cmUgdGhlIHByb2JsZW0gbGllcy4KCkkgaGF2ZW4ndCBnb3QgdGltZSB0byBhbmFseXNlIHRoaXMg ZnVydGhlciB0aGlzIG1vcm5pbmcgLSBJJ20gb25seQphcm91bmQgc3BvcmFkaWNhbGx5IHRvZGF5 LiBJJ2xsIHRyeSB0byBsb29rIGRlZXBlciBhdCB0aGlzIGxhdGVyIG9uLgoKLS0gClJNSydzIFBh dGNoIHN5c3RlbTogaHR0cHM6Ly93d3cuYXJtbGludXgub3JnLnVrL2RldmVsb3Blci9wYXRjaGVz LwpGVFRQIGlzIGhlcmUhIDgwTWJwcyBkb3duIDEwTWJwcyB1cC4gRGVjZW50IGNvbm5lY3Rpdml0 eSBhdCBsYXN0IQoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18KbGludXgtYXJtLWtlcm5lbCBtYWlsaW5nIGxpc3QKbGludXgtYXJtLWtlcm5lbEBsaXN0cy5p bmZyYWRlYWQub3JnCmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8v bGludXgtYXJtLWtlcm5lbAo=