From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B53D0C433DB for ; Tue, 16 Mar 2021 08:54:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 85E8C64F50 for ; Tue, 16 Mar 2021 08:54:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235298AbhCPIxj (ORCPT ); Tue, 16 Mar 2021 04:53:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35450 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235451AbhCPIxK (ORCPT ); Tue, 16 Mar 2021 04:53:10 -0400 Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9BB75C06174A for ; Tue, 16 Mar 2021 01:53:09 -0700 (PDT) Received: by mail-qt1-x82a.google.com with SMTP id 94so11090333qtc.0 for ; Tue, 16 Mar 2021 01:53:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=HKbSarGgbfX8hj+ii99HysCuZO3715fP6jdqMmZf3jc=; b=cf+eKxGcxGmwL30yn/dlyMD1I3zGadZ7NwVYNnvXqAShdiUM5Enp8El9uD5aIoaYhs F/v48lAGCDsb73GPerfD9YcmtzS7f1TnVa5Xz09umQHpBHh3CKH9yN4Mzyx0dsAd7wvR r6wzNMFbUj/KxwZjv2scgU3AsjK0w4ztLKKkzwXDMfhzrlc/AmWWJpWb/STjP/6cvmcT YMT2hFsB/SO1oEIPUqxAs7ZWNxohAftWuemrMKMkE6+tj3vI4IaOJo6jja9VGKmWIE/9 Eyldj3/ydK/7fVzCIFcEt0VHEzV/WgtK4AUeeK8uQY+SjEtCa9YW2YMSjnh3yqJO6WmT T9yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=HKbSarGgbfX8hj+ii99HysCuZO3715fP6jdqMmZf3jc=; b=asrGt3WTlktxe5iVOLqr1BjWMGvFHHULt4WFxq3Oe9iCw8YpMQwOtC9aDhWs9aFq3x X4uffHpRF2THR362ICOLz2EMGAcigLj8VkPVTeqvccPcVa0nMyOywuJvVmC6V3LRRNnI jfmcZQhQDpFBXPi2A1vBPV4eo3zO9Abw8nlZXCLM9yuS+HnMfDNVFtCq7if5HSVUwRRJ BVtV725nUEed+vVy173YnOgoRpb/Rhyu3ctvqi+FVB7Djo2UxbkyKbzT9vBOgoJxw3F9 diga2OOpe8Z4vGLEa0np0z6UCVUWZumDoa3nA7DCvsqIatf+FNjV56gnSVzI/MpaLgA9 PYPw== X-Gm-Message-State: AOAM533y5b3tvCk0okM7VKlE7QgCse6cdTAkVsCl7vz6ydgkOthDA9Kf tmilifeDHOoJ6s+qywmFesq1uv2BXnf3BESnACKXrw== X-Google-Smtp-Source: ABdhPJzDpLlyJ0Cz5ptXBqO8zWFU1DW7UX34+An3Zee3jIAoNNR+Mch8xRu1PK085//2d5TG5L2yMpuEoQky7DAStYc= X-Received: by 2002:ac8:4558:: with SMTP id z24mr15262004qtn.66.1615884788308; Tue, 16 Mar 2021 01:53:08 -0700 (PDT) MIME-Version: 1.0 References: <000000000000b74f1b05bd316729@google.com> <84b0471d-42c1-175f-ae1d-a18c310c7f77@codethink.co.uk> <795597a1-ec87-e09e-d073-3daf10422abb@ghiti.fr> <12d4137e-6c14-bc41-4bbc-955ce46198d2@codethink.co.uk> In-Reply-To: <12d4137e-6c14-bc41-4bbc-955ce46198d2@codethink.co.uk> From: Dmitry Vyukov Date: Tue, 16 Mar 2021 09:52:56 +0100 Message-ID: Subject: Re: [syzbot] BUG: unable to handle kernel access to user memory in schedule_tail To: Ben Dooks Cc: Alex Ghiti , syzbot , Paul Walmsley , Palmer Dabbelt , Albert Ou , linux-riscv , Daniel Bristot de Oliveira , Benjamin Segall , dietmar.eggemann@arm.com, Juri Lelli , LKML , Mel Gorman , Ingo Molnar , Peter Zijlstra , Steven Rostedt , syzkaller-bugs , Vincent Guittot Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Mar 15, 2021 at 10:38 PM Ben Dooks wrot= e: > > On 13/03/2021 07:20, Dmitry Vyukov wrote: > > On Fri, Mar 12, 2021 at 9:12 PM Ben Dooks w= rote: > >> > >> On 12/03/2021 16:25, Alex Ghiti wrote: > >>> > >>> > >>> Le 3/12/21 =C3=A0 10:12 AM, Dmitry Vyukov a =C3=A9crit : > >>>> On Fri, Mar 12, 2021 at 2:50 PM Ben Dooks > >>>> wrote: > >>>>> > >>>>> On 10/03/2021 17:16, Dmitry Vyukov wrote: > >>>>>> On Wed, Mar 10, 2021 at 5:46 PM syzbot > >>>>>> wrote: > >>>>>>> > >>>>>>> Hello, > >>>>>>> > >>>>>>> syzbot found the following issue on: > >>>>>>> > >>>>>>> HEAD commit: 0d7588ab riscv: process: Fix no prototype for > >>>>>>> arch_dup_tas.. > >>>>>>> git tree: > >>>>>>> git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fix= es > >>>>>>> console output: > >>>>>>> https://syzkaller.appspot.com/x/log.txt?x=3D1212c6e6d00000 > >>>>>>> kernel config: > >>>>>>> https://syzkaller.appspot.com/x/.config?x=3De3c595255fb2d136 > >>>>>>> dashboard link: > >>>>>>> https://syzkaller.appspot.com/bug?extid=3De74b94fe601ab9552d69 > >>>>>>> userspace arch: riscv64 > >>>>>>> > >>>>>>> Unfortunately, I don't have any reproducer for this issue yet. > >>>>>>> > >>>>>>> IMPORTANT: if you fix the issue, please add the following tag to > >>>>>>> the commit: > >>>>>>> Reported-by: syzbot+e74b94fe601ab9552d69@syzkaller.appspotmail.co= m > >>>>>> > >>>>>> +riscv maintainers > >>>>>> > >>>>>> This is riscv64-specific. > >>>>>> I've seen similar crashes in put_user in other places. It looks li= ke > >>>>>> put_user crashes in the user address is not mapped/protected (?). > >>>>> > >>>>> I've been having a look, and this seems to be down to access of the > >>>>> tsk->set_child_tid variable. I assume the fuzzing here is to pass a > >>>>> bad address to clone? > >>>>> > >>>>> From looking at the code, the put_user() code should have set th= e > >>>>> relevant SR_SUM bit (the value for this, which is 1<<18 is in the > >>>>> s2 register in the crash report) and from looking at the compiler > >>>>> output from my gcc-10, the code looks to be dong the relevant csrs > >>>>> and then csrc around the put_user > >>>>> > >>>>> So currently I do not understand how the above could have happened > >>>>> over than something re-tried the code seqeunce and ended up retryin= g > >>>>> the faulting instruction without the SR_SUM bit set. > >>>> > >>>> I would maybe blame qemu for randomly resetting SR_SUM, but it's > >>>> strange that 99% of these crashes are in schedule_tail. If it would = be > >>>> qemu, then they would be more evenly distributed... > >>>> > >>>> Another observation: looking at a dozen of crash logs, in none of > >>>> these cases fuzzer was actually trying to fuzz clone with some insan= e > >>>> arguments. So it looks like completely normal clone's (e..g coming > >>>> from pthread_create) result in this crash. > >>>> > >>>> I also wonder why there is ret_from_exception, is it normal? I see > >>>> handle_exception disables SR_SUM: > >>> > >>> csrrc does the right thing: it cleans SR_SUM bit in status but saves = the > >>> previous value that will get correctly restored. > >>> > >>> ("The CSRRC (Atomic Read and Clear Bits in CSR) instruction reads the > >>> value of the CSR, zero-extends the value to XLEN bits, and writes it = to > >>> integer registerrd. The initial value in integerregisterrs1is treate= d > >>> as a bit mask that specifies bit positions to be cleared in the CSR. = Any > >>> bitthat is high inrs1will cause the corresponding bit to be cleared i= n > >>> the CSR, if that CSR bit iswritable. Other bits in the CSR are > >>> unaffected.") > >> > >> I think there may also be an understanding issue on what the SR_SUM > >> bit does. I thought if it is set, M->U accesses would fault, which is > >> why it gets set early on. But from reading the uaccess code it looks > >> like the uaccess code sets it on entry and then clears on exit. > >> > >> I am very confused. Is there a master reference for rv64? > >> > >> https://people.eecs.berkeley.edu/~krste/papers/riscv-privileged-v1.9.p= df > >> seems to state PUM is the SR_SUM bit, and that (if set) disabled > >> > >> Quote: > >> The PUM (Protect User Memory) bit modifies the privilege with which > >> S-mode loads, stores, and instruction fetches access virtual memory. > >> When PUM=3D0, translation and protection behave as normal. When PUM=3D= 1, > >> S-mode memory accesses to pages that are accessible by U-mode (U=3D1 i= n > >> Figure 4.19) will fault. PUM has no effect when executing in U-mode > >> > >> > >>>> https://elixir.bootlin.com/linux/v5.12-rc2/source/arch/riscv/kernel/= entry.S#L73 > >>>> > >>> > >>> Still no luck for the moment, can't reproduce it locally, my test is > >>> maybe not that good (I created threads all day long in order to trigg= er > >>> the put_user of schedule_tail). > >> > >> It may of course depend on memory and other stuff. I did try to see if > >> it was possible to clone() with the child_tid address being a valid bu= t > >> not mapped page... > >> > >>> Given that the path you mention works most of the time, and that the > >>> status register in the stack trace shows the SUM bit is not set where= as > >>> it is set in put_user, I'm leaning toward some race condition (maybe = an > >>> interrupt that arrives at the "wrong" time) or a qemu issue as you > >>> mentioned. > >> > >> I suppose this is possible. From what I read it should get to the > >> point of being there with the SUM flag cleared, so either something > >> went wrong in trying to fix the instruction up or there's some other > >> error we're missing. > >> > >>> To eliminate qemu issues, do you have access to some HW ? Or to > >>> different qemu versions ? > >> > >> I do have access to a Microchip Polarfire board. I just need the > >> instructions on how to setup the test-code to make it work on the > >> hardware. > > > > For full syzkaller support, it would need to know how to reboot these > > boards and get access to the console. > > syzkaller has a stop-gap VM backend which just uses ssh to a physical > > machine and expects the kernel to reboot on its own after any crashes. > > > > But I actually managed to reproduce it in an even simpler setup. > > Assuming you have Go 1.15 and riscv64 cross-compiler gcc installed > > > > $ go get -u -d github.com/google/syzkaller/... > > $ cd $GOPATH/src/github.com/google/syzkaller > > $ make stress executor TARGETARCH=3Driscv64 > > $ scp bin/linux_riscv64/syz-execprog bin/linux_riscv64/syz-executor > > your_machine:/ > > > > Then run ./syz-stress on the machine. > > On the first run it crashed it with some other bug, on the second run > > I got the crash in schedule_tail. > > With qemu tcg I also added -slowdown=3D10 flag to syz-stress to scale > > all timeouts, if native execution is faster, then you don't need it. > > Ok, not sure what's going on. I get a lot of errors similar to: > > > > 2021/03/15 21:35:20 transitively unsupported: ioctl$SNAPSHOT_CREATE_IMA= GE: no syscalls can create resource fd_snapshot, enable some syscalls that = can create it [openat$snapshot] This is not an error, just a notification that some syscalls are not enabled in the kernel and won't be fuzzed. > Followed by: > > > 2021/03/15 21:35:48 executed 0 programs > > 2021/03/15 21:35:48 failed to create execution environment: failed to m= map shm file: invalid argument > > The qemu is 5.2.0 and root is Debian/unstable riscv64 (same as chroot > used to build the syz tools) This is an error. But I see it the first time ever. It comes from here: https://github.com/google/syzkaller/blob/fdb2bb2c23ee709880407f56307e2800ad= 27e9ae/pkg/osutil/osutil_unix.go#L119-L121 There should be pretty simple logic inside of syscall.Mmap. Perhaps you are using some older Go toolchain with incomplete riscv support? I think I've used 1.14 and 1.15. But there is already 1.16. You can always download a toolchain here: https://golang.org/dl/ From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 670EEC433DB for ; Tue, 16 Mar 2021 08:54:00 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E71EA64F50 for ; Tue, 16 Mar 2021 08:53:59 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E71EA64F50 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Cc:To:Subject:Message-ID:Date:From:In-Reply-To: References:MIME-Version:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=T6thWSeG4fv56LLUspLD1bqjG5WVle/ebyX8KI666JI=; b=fgt3zsXcA1qb0xTt29zeinEz0 PeRuy3vhOlRL/zlq6LzSv3vGFNkI66FO+7AP+JM1Xe2iSsm+CF4U6kuVFvhQChfeajNWOHLFLWFPj zFcYMNHIFIf94BPopePnYpXkazEmwJarApA4tZRlR4pk1AxT0K1MHcU8pE4ae0d32t8nzli9BuM/q MNlm1auS5rGoMy0KK1Qq0rp8jSX2O02NoBX4bOm4jJJSSI41Hx7dq8hxroPraevAnfxpYo4EpgFv2 EJj7QhpaGCCW1CzlcQ1Vqy8GBzu8Uckpwc9uiqQDLLXiMTJWeoRlFzLO833e7cWrjqBGUxGWJDO4Y 1V0/Q1C3Q==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lM5S0-000AJm-8T; Tue, 16 Mar 2021 08:53:16 +0000 Received: from mail-qt1-x832.google.com ([2607:f8b0:4864:20::832]) by desiato.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lM5Rt-000AIF-Qk for linux-riscv@lists.infradead.org; Tue, 16 Mar 2021 08:53:12 +0000 Received: by mail-qt1-x832.google.com with SMTP id h7so4295470qtx.3 for ; Tue, 16 Mar 2021 01:53:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=HKbSarGgbfX8hj+ii99HysCuZO3715fP6jdqMmZf3jc=; b=cf+eKxGcxGmwL30yn/dlyMD1I3zGadZ7NwVYNnvXqAShdiUM5Enp8El9uD5aIoaYhs F/v48lAGCDsb73GPerfD9YcmtzS7f1TnVa5Xz09umQHpBHh3CKH9yN4Mzyx0dsAd7wvR r6wzNMFbUj/KxwZjv2scgU3AsjK0w4ztLKKkzwXDMfhzrlc/AmWWJpWb/STjP/6cvmcT YMT2hFsB/SO1oEIPUqxAs7ZWNxohAftWuemrMKMkE6+tj3vI4IaOJo6jja9VGKmWIE/9 Eyldj3/ydK/7fVzCIFcEt0VHEzV/WgtK4AUeeK8uQY+SjEtCa9YW2YMSjnh3yqJO6WmT T9yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=HKbSarGgbfX8hj+ii99HysCuZO3715fP6jdqMmZf3jc=; b=PifcP30jvN2uhoKYx4GOqiEVnsMK257Af1RS4bW+61FpwWoiHZmpbhsKCPxIkm/1sh EPi+rJc1P2wkloXtdmfMMrH+D+AXZV3d/3tRRzO+jj1WpuOBUNXPAbg3W9odZS4bvSai YS7ABFwzug4BwLlNIL+ty9zxGnq8OgjOa541PIDe72WTYT9OBPmdtH8COugjJh7R0SAD tCxu6o3yqpoSWptvMTW2mZB3Mbmcamr87gRbXWTfL7cc3oHTbopRopUH1WAGJ/ejb+O0 Txad77anU7upxA5+zfc4+v37Q2EISqCicOcQnh0jAngfh2CZ92NlsE9CPRrHFqlekUWS PbwQ== X-Gm-Message-State: AOAM533JwiFhZKVHYqhO2EJcn4/VUfFcYg/aUcXebVRZLGQ0AHEiUIoK JhBL8pEWUvbpkOYNfBICXGehaUT+BgnrHkVorTeVJw== X-Google-Smtp-Source: ABdhPJzDpLlyJ0Cz5ptXBqO8zWFU1DW7UX34+An3Zee3jIAoNNR+Mch8xRu1PK085//2d5TG5L2yMpuEoQky7DAStYc= X-Received: by 2002:ac8:4558:: with SMTP id z24mr15262004qtn.66.1615884788308; Tue, 16 Mar 2021 01:53:08 -0700 (PDT) MIME-Version: 1.0 References: <000000000000b74f1b05bd316729@google.com> <84b0471d-42c1-175f-ae1d-a18c310c7f77@codethink.co.uk> <795597a1-ec87-e09e-d073-3daf10422abb@ghiti.fr> <12d4137e-6c14-bc41-4bbc-955ce46198d2@codethink.co.uk> In-Reply-To: <12d4137e-6c14-bc41-4bbc-955ce46198d2@codethink.co.uk> From: Dmitry Vyukov Date: Tue, 16 Mar 2021 09:52:56 +0100 Message-ID: Subject: Re: [syzbot] BUG: unable to handle kernel access to user memory in schedule_tail To: Ben Dooks Cc: Alex Ghiti , syzbot , Paul Walmsley , Palmer Dabbelt , Albert Ou , linux-riscv , Daniel Bristot de Oliveira , Benjamin Segall , dietmar.eggemann@arm.com, Juri Lelli , LKML , Mel Gorman , Ingo Molnar , Peter Zijlstra , Steven Rostedt , syzkaller-bugs , Vincent Guittot X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210316_085309_972361_9A54773E X-CRM114-Status: GOOD ( 58.54 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org T24gTW9uLCBNYXIgMTUsIDIwMjEgYXQgMTA6MzggUE0gQmVuIERvb2tzIDxiZW4uZG9va3NAY29k ZXRoaW5rLmNvLnVrPiB3cm90ZToKPgo+IE9uIDEzLzAzLzIwMjEgMDc6MjAsIERtaXRyeSBWeXVr b3Ygd3JvdGU6Cj4gPiBPbiBGcmksIE1hciAxMiwgMjAyMSBhdCA5OjEyIFBNIEJlbiBEb29rcyA8 YmVuLmRvb2tzQGNvZGV0aGluay5jby51az4gd3JvdGU6Cj4gPj4KPiA+PiBPbiAxMi8wMy8yMDIx IDE2OjI1LCBBbGV4IEdoaXRpIHdyb3RlOgo+ID4+Pgo+ID4+Pgo+ID4+PiBMZSAzLzEyLzIxIMOg IDEwOjEyIEFNLCBEbWl0cnkgVnl1a292IGEgw6ljcml0IDoKPiA+Pj4+IE9uIEZyaSwgTWFyIDEy LCAyMDIxIGF0IDI6NTAgUE0gQmVuIERvb2tzIDxiZW4uZG9va3NAY29kZXRoaW5rLmNvLnVrPgo+ ID4+Pj4gd3JvdGU6Cj4gPj4+Pj4KPiA+Pj4+PiBPbiAxMC8wMy8yMDIxIDE3OjE2LCBEbWl0cnkg Vnl1a292IHdyb3RlOgo+ID4+Pj4+PiBPbiBXZWQsIE1hciAxMCwgMjAyMSBhdCA1OjQ2IFBNIHN5 emJvdAo+ID4+Pj4+PiA8c3l6Ym90K2U3NGI5NGZlNjAxYWI5NTUyZDY5QHN5emthbGxlci5hcHBz cG90bWFpbC5jb20+IHdyb3RlOgo+ID4+Pj4+Pj4KPiA+Pj4+Pj4+IEhlbGxvLAo+ID4+Pj4+Pj4K PiA+Pj4+Pj4+IHN5emJvdCBmb3VuZCB0aGUgZm9sbG93aW5nIGlzc3VlIG9uOgo+ID4+Pj4+Pj4K PiA+Pj4+Pj4+IEhFQUQgY29tbWl0OiAgICAwZDc1ODhhYiByaXNjdjogcHJvY2VzczogRml4IG5v IHByb3RvdHlwZSBmb3IKPiA+Pj4+Pj4+IGFyY2hfZHVwX3Rhcy4uCj4gPj4+Pj4+PiBnaXQgdHJl ZToKPiA+Pj4+Pj4+IGdpdDovL2dpdC5rZXJuZWwub3JnL3B1Yi9zY20vbGludXgva2VybmVsL2dp dC9yaXNjdi9saW51eC5naXQgZml4ZXMKPiA+Pj4+Pj4+IGNvbnNvbGUgb3V0cHV0Ogo+ID4+Pj4+ Pj4gaHR0cHM6Ly9zeXprYWxsZXIuYXBwc3BvdC5jb20veC9sb2cudHh0P3g9MTIxMmM2ZTZkMDAw MDAKPiA+Pj4+Pj4+IGtlcm5lbCBjb25maWc6Cj4gPj4+Pj4+PiBodHRwczovL3N5emthbGxlci5h cHBzcG90LmNvbS94Ly5jb25maWc/eD1lM2M1OTUyNTVmYjJkMTM2Cj4gPj4+Pj4+PiBkYXNoYm9h cmQgbGluazoKPiA+Pj4+Pj4+IGh0dHBzOi8vc3l6a2FsbGVyLmFwcHNwb3QuY29tL2J1Zz9leHRp ZD1lNzRiOTRmZTYwMWFiOTU1MmQ2OQo+ID4+Pj4+Pj4gdXNlcnNwYWNlIGFyY2g6IHJpc2N2NjQK PiA+Pj4+Pj4+Cj4gPj4+Pj4+PiBVbmZvcnR1bmF0ZWx5LCBJIGRvbid0IGhhdmUgYW55IHJlcHJv ZHVjZXIgZm9yIHRoaXMgaXNzdWUgeWV0Lgo+ID4+Pj4+Pj4KPiA+Pj4+Pj4+IElNUE9SVEFOVDog aWYgeW91IGZpeCB0aGUgaXNzdWUsIHBsZWFzZSBhZGQgdGhlIGZvbGxvd2luZyB0YWcgdG8KPiA+ Pj4+Pj4+IHRoZSBjb21taXQ6Cj4gPj4+Pj4+PiBSZXBvcnRlZC1ieTogc3l6Ym90K2U3NGI5NGZl NjAxYWI5NTUyZDY5QHN5emthbGxlci5hcHBzcG90bWFpbC5jb20KPiA+Pj4+Pj4KPiA+Pj4+Pj4g K3Jpc2N2IG1haW50YWluZXJzCj4gPj4+Pj4+Cj4gPj4+Pj4+IFRoaXMgaXMgcmlzY3Y2NC1zcGVj aWZpYy4KPiA+Pj4+Pj4gSSd2ZSBzZWVuIHNpbWlsYXIgY3Jhc2hlcyBpbiBwdXRfdXNlciBpbiBv dGhlciBwbGFjZXMuIEl0IGxvb2tzIGxpa2UKPiA+Pj4+Pj4gcHV0X3VzZXIgY3Jhc2hlcyBpbiB0 aGUgdXNlciBhZGRyZXNzIGlzIG5vdCBtYXBwZWQvcHJvdGVjdGVkICg/KS4KPiA+Pj4+Pgo+ID4+ Pj4+IEkndmUgYmVlbiBoYXZpbmcgYSBsb29rLCBhbmQgdGhpcyBzZWVtcyB0byBiZSBkb3duIHRv IGFjY2VzcyBvZiB0aGUKPiA+Pj4+PiB0c2stPnNldF9jaGlsZF90aWQgdmFyaWFibGUuIEkgYXNz dW1lIHRoZSBmdXp6aW5nIGhlcmUgaXMgdG8gcGFzcyBhCj4gPj4+Pj4gYmFkIGFkZHJlc3MgdG8g Y2xvbmU/Cj4gPj4+Pj4KPiA+Pj4+PiAgICBGcm9tIGxvb2tpbmcgYXQgdGhlIGNvZGUsIHRoZSBw dXRfdXNlcigpIGNvZGUgc2hvdWxkIGhhdmUgc2V0IHRoZQo+ID4+Pj4+IHJlbGV2YW50IFNSX1NV TSBiaXQgKHRoZSB2YWx1ZSBmb3IgdGhpcywgd2hpY2ggaXMgMTw8MTggaXMgaW4gdGhlCj4gPj4+ Pj4gczIgcmVnaXN0ZXIgaW4gdGhlIGNyYXNoIHJlcG9ydCkgYW5kIGZyb20gbG9va2luZyBhdCB0 aGUgY29tcGlsZXIKPiA+Pj4+PiBvdXRwdXQgZnJvbSBteSBnY2MtMTAsIHRoZSBjb2RlIGxvb2tz IHRvIGJlIGRvbmcgdGhlIHJlbGV2YW50IGNzcnMKPiA+Pj4+PiBhbmQgdGhlbiBjc3JjIGFyb3Vu ZCB0aGUgcHV0X3VzZXIKPiA+Pj4+Pgo+ID4+Pj4+IFNvIGN1cnJlbnRseSBJIGRvIG5vdCB1bmRl cnN0YW5kIGhvdyB0aGUgYWJvdmUgY291bGQgaGF2ZSBoYXBwZW5lZAo+ID4+Pj4+IG92ZXIgdGhh biBzb21ldGhpbmcgcmUtdHJpZWQgdGhlIGNvZGUgc2VxZXVuY2UgYW5kIGVuZGVkIHVwIHJldHJ5 aW5nCj4gPj4+Pj4gdGhlIGZhdWx0aW5nIGluc3RydWN0aW9uIHdpdGhvdXQgdGhlIFNSX1NVTSBi aXQgc2V0Lgo+ID4+Pj4KPiA+Pj4+IEkgd291bGQgbWF5YmUgYmxhbWUgcWVtdSBmb3IgcmFuZG9t bHkgcmVzZXR0aW5nIFNSX1NVTSwgYnV0IGl0J3MKPiA+Pj4+IHN0cmFuZ2UgdGhhdCA5OSUgb2Yg dGhlc2UgY3Jhc2hlcyBhcmUgaW4gc2NoZWR1bGVfdGFpbC4gSWYgaXQgd291bGQgYmUKPiA+Pj4+ IHFlbXUsIHRoZW4gdGhleSB3b3VsZCBiZSBtb3JlIGV2ZW5seSBkaXN0cmlidXRlZC4uLgo+ID4+ Pj4KPiA+Pj4+IEFub3RoZXIgb2JzZXJ2YXRpb246IGxvb2tpbmcgYXQgYSBkb3plbiBvZiBjcmFz aCBsb2dzLCBpbiBub25lIG9mCj4gPj4+PiB0aGVzZSBjYXNlcyBmdXp6ZXIgd2FzIGFjdHVhbGx5 IHRyeWluZyB0byBmdXp6IGNsb25lIHdpdGggc29tZSBpbnNhbmUKPiA+Pj4+IGFyZ3VtZW50cy4g U28gaXQgbG9va3MgbGlrZSBjb21wbGV0ZWx5IG5vcm1hbCBjbG9uZSdzIChlLi5nIGNvbWluZwo+ ID4+Pj4gZnJvbSBwdGhyZWFkX2NyZWF0ZSkgcmVzdWx0IGluIHRoaXMgY3Jhc2guCj4gPj4+Pgo+ ID4+Pj4gSSBhbHNvIHdvbmRlciB3aHkgdGhlcmUgaXMgcmV0X2Zyb21fZXhjZXB0aW9uLCBpcyBp dCBub3JtYWw/IEkgc2VlCj4gPj4+PiBoYW5kbGVfZXhjZXB0aW9uIGRpc2FibGVzIFNSX1NVTToK PiA+Pj4KPiA+Pj4gY3NycmMgZG9lcyB0aGUgcmlnaHQgdGhpbmc6IGl0IGNsZWFucyBTUl9TVU0g Yml0IGluIHN0YXR1cyBidXQgc2F2ZXMgdGhlCj4gPj4+IHByZXZpb3VzIHZhbHVlIHRoYXQgd2ls bCBnZXQgY29ycmVjdGx5IHJlc3RvcmVkLgo+ID4+Pgo+ID4+PiAoIlRoZSBDU1JSQyAoQXRvbWlj IFJlYWQgYW5kIENsZWFyIEJpdHMgaW4gQ1NSKSBpbnN0cnVjdGlvbiByZWFkcyB0aGUKPiA+Pj4g dmFsdWUgb2YgdGhlIENTUiwgemVyby1leHRlbmRzIHRoZSB2YWx1ZSB0byBYTEVOIGJpdHMsIGFu ZCB3cml0ZXMgaXQgdG8KPiA+Pj4gaW50ZWdlciByZWdpc3RlcnJkLiAgVGhlIGluaXRpYWwgdmFs dWUgaW4gaW50ZWdlcnJlZ2lzdGVycnMxaXMgdHJlYXRlZAo+ID4+PiBhcyBhIGJpdCBtYXNrIHRo YXQgc3BlY2lmaWVzIGJpdCBwb3NpdGlvbnMgdG8gYmUgY2xlYXJlZCBpbiB0aGUgQ1NSLiBBbnkK PiA+Pj4gYml0dGhhdCBpcyBoaWdoIGlucnMxd2lsbCBjYXVzZSB0aGUgY29ycmVzcG9uZGluZyBi aXQgdG8gYmUgY2xlYXJlZCBpbgo+ID4+PiB0aGUgQ1NSLCBpZiB0aGF0IENTUiBiaXQgaXN3cml0 YWJsZS4gIE90aGVyIGJpdHMgaW4gdGhlIENTUiBhcmUKPiA+Pj4gdW5hZmZlY3RlZC4iKQo+ID4+ Cj4gPj4gSSB0aGluayB0aGVyZSBtYXkgYWxzbyBiZSBhbiB1bmRlcnN0YW5kaW5nIGlzc3VlIG9u IHdoYXQgdGhlIFNSX1NVTQo+ID4+IGJpdCBkb2VzLiBJIHRob3VnaHQgaWYgaXQgaXMgc2V0LCBN LT5VIGFjY2Vzc2VzIHdvdWxkIGZhdWx0LCB3aGljaCBpcwo+ID4+IHdoeSBpdCBnZXRzIHNldCBl YXJseSBvbi4gQnV0IGZyb20gcmVhZGluZyB0aGUgdWFjY2VzcyBjb2RlIGl0IGxvb2tzCj4gPj4g bGlrZSB0aGUgdWFjY2VzcyBjb2RlIHNldHMgaXQgb24gZW50cnkgYW5kIHRoZW4gY2xlYXJzIG9u IGV4aXQuCj4gPj4KPiA+PiBJIGFtIHZlcnkgY29uZnVzZWQuIElzIHRoZXJlIGEgbWFzdGVyIHJl ZmVyZW5jZSBmb3IgcnY2ND8KPiA+Pgo+ID4+IGh0dHBzOi8vcGVvcGxlLmVlY3MuYmVya2VsZXku ZWR1L35rcnN0ZS9wYXBlcnMvcmlzY3YtcHJpdmlsZWdlZC12MS45LnBkZgo+ID4+IHNlZW1zIHRv IHN0YXRlIFBVTSBpcyB0aGUgU1JfU1VNIGJpdCwgYW5kIHRoYXQgKGlmIHNldCkgZGlzYWJsZWQK PiA+Pgo+ID4+IFF1b3RlOgo+ID4+ICAgIFRoZSBQVU0gKFByb3RlY3QgVXNlciBNZW1vcnkpIGJp dCBtb2RpZmllcyB0aGUgcHJpdmlsZWdlIHdpdGggd2hpY2gKPiA+PiBTLW1vZGUgbG9hZHMsIHN0 b3JlcywgYW5kIGluc3RydWN0aW9uIGZldGNoZXMgYWNjZXNzIHZpcnR1YWwgbWVtb3J5Lgo+ID4+ IFdoZW4gUFVNPTAsIHRyYW5zbGF0aW9uIGFuZCBwcm90ZWN0aW9uIGJlaGF2ZSBhcyBub3JtYWwu IFdoZW4gUFVNPTEsCj4gPj4gUy1tb2RlIG1lbW9yeSBhY2Nlc3NlcyB0byBwYWdlcyB0aGF0IGFy ZSBhY2Nlc3NpYmxlIGJ5IFUtbW9kZSAoVT0xIGluCj4gPj4gRmlndXJlIDQuMTkpIHdpbGwgZmF1 bHQuIFBVTSBoYXMgbm8gZWZmZWN0IHdoZW4gZXhlY3V0aW5nIGluIFUtbW9kZQo+ID4+Cj4gPj4K PiA+Pj4+IGh0dHBzOi8vZWxpeGlyLmJvb3RsaW4uY29tL2xpbnV4L3Y1LjEyLXJjMi9zb3VyY2Uv YXJjaC9yaXNjdi9rZXJuZWwvZW50cnkuUyNMNzMKPiA+Pj4+Cj4gPj4+Cj4gPj4+IFN0aWxsIG5v IGx1Y2sgZm9yIHRoZSBtb21lbnQsIGNhbid0IHJlcHJvZHVjZSBpdCBsb2NhbGx5LCBteSB0ZXN0 IGlzCj4gPj4+IG1heWJlIG5vdCB0aGF0IGdvb2QgKEkgY3JlYXRlZCB0aHJlYWRzIGFsbCBkYXkg bG9uZyBpbiBvcmRlciB0byB0cmlnZ2VyCj4gPj4+IHRoZSBwdXRfdXNlciBvZiBzY2hlZHVsZV90 YWlsKS4KPiA+Pgo+ID4+IEl0IG1heSBvZiBjb3Vyc2UgZGVwZW5kIG9uIG1lbW9yeSBhbmQgb3Ro ZXIgc3R1ZmYuIEkgZGlkIHRyeSB0byBzZWUgaWYKPiA+PiBpdCB3YXMgcG9zc2libGUgdG8gY2xv bmUoKSB3aXRoIHRoZSBjaGlsZF90aWQgYWRkcmVzcyBiZWluZyBhIHZhbGlkIGJ1dAo+ID4+IG5v dCBtYXBwZWQgcGFnZS4uLgo+ID4+Cj4gPj4+IEdpdmVuIHRoYXQgdGhlIHBhdGggeW91IG1lbnRp b24gd29ya3MgbW9zdCBvZiB0aGUgdGltZSwgYW5kIHRoYXQgdGhlCj4gPj4+IHN0YXR1cyByZWdp c3RlciBpbiB0aGUgc3RhY2sgdHJhY2Ugc2hvd3MgdGhlIFNVTSBiaXQgaXMgbm90IHNldCB3aGVy ZWFzCj4gPj4+IGl0IGlzIHNldCBpbiBwdXRfdXNlciwgSSdtIGxlYW5pbmcgdG93YXJkIHNvbWUg cmFjZSBjb25kaXRpb24gKG1heWJlIGFuCj4gPj4+IGludGVycnVwdCB0aGF0IGFycml2ZXMgYXQg dGhlICJ3cm9uZyIgdGltZSkgb3IgYSBxZW11IGlzc3VlIGFzIHlvdQo+ID4+PiBtZW50aW9uZWQu Cj4gPj4KPiA+PiBJIHN1cHBvc2UgdGhpcyBpcyBwb3NzaWJsZS4gRnJvbSB3aGF0IEkgcmVhZCBp dCBzaG91bGQgZ2V0IHRvIHRoZQo+ID4+IHBvaW50IG9mIGJlaW5nIHRoZXJlIHdpdGggdGhlIFNV TSBmbGFnIGNsZWFyZWQsIHNvIGVpdGhlciBzb21ldGhpbmcKPiA+PiB3ZW50IHdyb25nIGluIHRy eWluZyB0byBmaXggdGhlIGluc3RydWN0aW9uIHVwIG9yIHRoZXJlJ3Mgc29tZSBvdGhlcgo+ID4+ IGVycm9yIHdlJ3JlIG1pc3NpbmcuCj4gPj4KPiA+Pj4gVG8gZWxpbWluYXRlIHFlbXUgaXNzdWVz LCBkbyB5b3UgaGF2ZSBhY2Nlc3MgdG8gc29tZSBIVyA/IE9yIHRvCj4gPj4+IGRpZmZlcmVudCBx ZW11IHZlcnNpb25zID8KPiA+Pgo+ID4+IEkgZG8gaGF2ZSBhY2Nlc3MgdG8gYSBNaWNyb2NoaXAg UG9sYXJmaXJlIGJvYXJkLiBJIGp1c3QgbmVlZCB0aGUKPiA+PiBpbnN0cnVjdGlvbnMgb24gaG93 IHRvIHNldHVwIHRoZSB0ZXN0LWNvZGUgdG8gbWFrZSBpdCB3b3JrIG9uIHRoZQo+ID4+IGhhcmR3 YXJlLgo+ID4KPiA+IEZvciBmdWxsIHN5emthbGxlciBzdXBwb3J0LCBpdCB3b3VsZCBuZWVkIHRv IGtub3cgaG93IHRvIHJlYm9vdCB0aGVzZQo+ID4gYm9hcmRzIGFuZCBnZXQgYWNjZXNzIHRvIHRo ZSBjb25zb2xlLgo+ID4gc3l6a2FsbGVyIGhhcyBhIHN0b3AtZ2FwIFZNIGJhY2tlbmQgd2hpY2gg anVzdCB1c2VzIHNzaCB0byBhIHBoeXNpY2FsCj4gPiBtYWNoaW5lIGFuZCBleHBlY3RzIHRoZSBr ZXJuZWwgdG8gcmVib290IG9uIGl0cyBvd24gYWZ0ZXIgYW55IGNyYXNoZXMuCj4gPgo+ID4gQnV0 IEkgYWN0dWFsbHkgbWFuYWdlZCB0byByZXByb2R1Y2UgaXQgaW4gYW4gZXZlbiBzaW1wbGVyIHNl dHVwLgo+ID4gQXNzdW1pbmcgeW91IGhhdmUgR28gMS4xNSBhbmQgcmlzY3Y2NCBjcm9zcy1jb21w aWxlciBnY2MgaW5zdGFsbGVkCj4gPgo+ID4gJCBnbyBnZXQgLXUgLWQgZ2l0aHViLmNvbS9nb29n bGUvc3l6a2FsbGVyLy4uLgo+ID4gJCBjZCAkR09QQVRIL3NyYy9naXRodWIuY29tL2dvb2dsZS9z eXprYWxsZXIKPiA+ICQgbWFrZSBzdHJlc3MgZXhlY3V0b3IgVEFSR0VUQVJDSD1yaXNjdjY0Cj4g PiAkIHNjcCBiaW4vbGludXhfcmlzY3Y2NC9zeXotZXhlY3Byb2cgYmluL2xpbnV4X3Jpc2N2NjQv c3l6LWV4ZWN1dG9yCj4gPiB5b3VyX21hY2hpbmU6Lwo+ID4KPiA+IFRoZW4gcnVuIC4vc3l6LXN0 cmVzcyBvbiB0aGUgbWFjaGluZS4KPiA+IE9uIHRoZSBmaXJzdCBydW4gaXQgY3Jhc2hlZCBpdCB3 aXRoIHNvbWUgb3RoZXIgYnVnLCBvbiB0aGUgc2Vjb25kIHJ1bgo+ID4gSSBnb3QgdGhlIGNyYXNo IGluIHNjaGVkdWxlX3RhaWwuCj4gPiBXaXRoIHFlbXUgdGNnIEkgYWxzbyBhZGRlZCAtc2xvd2Rv d249MTAgZmxhZyB0byBzeXotc3RyZXNzIHRvIHNjYWxlCj4gPiBhbGwgdGltZW91dHMsIGlmIG5h dGl2ZSBleGVjdXRpb24gaXMgZmFzdGVyLCB0aGVuIHlvdSBkb24ndCBuZWVkIGl0Lgo+Cj4gT2ss IG5vdCBzdXJlIHdoYXQncyBnb2luZyBvbi4gSSBnZXQgYSBsb3Qgb2YgZXJyb3JzIHNpbWlsYXIg dG86Cj4gPgo+ID4gMjAyMS8wMy8xNSAyMTozNToyMCB0cmFuc2l0aXZlbHkgdW5zdXBwb3J0ZWQ6 IGlvY3RsJFNOQVBTSE9UX0NSRUFURV9JTUFHRTogbm8gc3lzY2FsbHMgY2FuIGNyZWF0ZSByZXNv dXJjZSBmZF9zbmFwc2hvdCwgZW5hYmxlIHNvbWUgc3lzY2FsbHMgdGhhdCBjYW4gY3JlYXRlIGl0 IFtvcGVuYXQkc25hcHNob3RdCgpUaGlzIGlzIG5vdCBhbiBlcnJvciwganVzdCBhIG5vdGlmaWNh dGlvbiB0aGF0IHNvbWUgc3lzY2FsbHMgYXJlIG5vdAplbmFibGVkIGluIHRoZSBrZXJuZWwgYW5k IHdvbid0IGJlIGZ1enplZC4KCj4gRm9sbG93ZWQgYnk6Cj4KPiA+IDIwMjEvMDMvMTUgMjE6MzU6 NDggZXhlY3V0ZWQgMCBwcm9ncmFtcwo+ID4gMjAyMS8wMy8xNSAyMTozNTo0OCBmYWlsZWQgdG8g Y3JlYXRlIGV4ZWN1dGlvbiBlbnZpcm9ubWVudDogZmFpbGVkIHRvIG1tYXAgc2htIGZpbGU6IGlu dmFsaWQgYXJndW1lbnQKPgo+IFRoZSBxZW11IGlzIDUuMi4wIGFuZCByb290IGlzIERlYmlhbi91 bnN0YWJsZSByaXNjdjY0IChzYW1lIGFzIGNocm9vdAo+IHVzZWQgdG8gYnVpbGQgdGhlIHN5eiB0 b29scykKClRoaXMgaXMgYW4gZXJyb3IuIEJ1dCBJIHNlZSBpdCB0aGUgZmlyc3QgdGltZSBldmVy LgpJdCBjb21lcyBmcm9tIGhlcmU6Cmh0dHBzOi8vZ2l0aHViLmNvbS9nb29nbGUvc3l6a2FsbGVy L2Jsb2IvZmRiMmJiMmMyM2VlNzA5ODgwNDA3ZjU2MzA3ZTI4MDBhZDI3ZTlhZS9wa2cvb3N1dGls L29zdXRpbF91bml4LmdvI0wxMTktTDEyMQpUaGVyZSBzaG91bGQgYmUgcHJldHR5IHNpbXBsZSBs b2dpYyBpbnNpZGUgb2Ygc3lzY2FsbC5NbWFwLiBQZXJoYXBzCnlvdSBhcmUgdXNpbmcgc29tZSBv bGRlciBHbyB0b29sY2hhaW4gd2l0aCBpbmNvbXBsZXRlIHJpc2N2IHN1cHBvcnQ/CkkgdGhpbmsg SSd2ZSB1c2VkIDEuMTQgYW5kIDEuMTUuIEJ1dCB0aGVyZSBpcyBhbHJlYWR5IDEuMTYuIFlvdSBj YW4KYWx3YXlzIGRvd25sb2FkIGEgdG9vbGNoYWluIGhlcmU6Cmh0dHBzOi8vZ29sYW5nLm9yZy9k bC8KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCmxpbnV4 LXJpc2N2IG1haWxpbmcgbGlzdApsaW51eC1yaXNjdkBsaXN0cy5pbmZyYWRlYWQub3JnCmh0dHA6 Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8vbGludXgtcmlzY3YK