From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8303D191 for ; Thu, 12 May 2022 08:30:16 +0000 (UTC) Received: from kwepemi500013.china.huawei.com (unknown [172.30.72.55]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4KzPz05FRvzGpf9; Thu, 12 May 2022 16:27:24 +0800 (CST) Received: from M910t (10.110.54.157) by kwepemi500013.china.huawei.com (7.221.188.120) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Thu, 12 May 2022 16:30:13 +0800 Date: Thu, 12 May 2022 16:30:07 +0800 From: Changbin Du To: Craig Topper CC: Nick Desaulniers , Changbin Du , Paul Walmsley , Palmer Dabbelt , Albert Ou , Steven Rostedt , , , , , , , Subject: Re: riscv: llvm-compiler: calling convention violation: temporary register $t2 is used to pass the ninth function parameter Message-ID: <20220512083007.gdvlaq7ar2tyarza@M910t> References: <20220510065336.hlfjrc25ajed5zj4@M910t> <10BD31AB-C9F3-45FD-9A4A-EF7DC07C94D5@sifive.com> Precedence: bulk X-Mailing-List: llvm@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <10BD31AB-C9F3-45FD-9A4A-EF7DC07C94D5@sifive.com> X-Originating-IP: [10.110.54.157] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To kwepemi500013.china.huawei.com (7.221.188.120) X-CFilter-Loop: Reflected On Wed, May 11, 2022 at 01:07:14PM -0700, Craig Topper wrote: > I’m guessing that because the function is static, the calling convention was changed to fastcall which allows us to ignore the ABI. > I think so. But the mcount function assumes the ABI is not changed. > > On May 11, 2022, at 11:39 AM, Nick Desaulniers wrote: > > > > On Mon, May 9, 2022 at 11:54 PM Changbin Du wrote: > >> > >> [This is a resent to correct llvm mailist.] > >> > >> Hello, folks, > >> > >> Recently I encountered a kernel crash problem when using ftrace with 'perf ftrace' > >> command on risc-v kernel built with llvm. > >> > >> This crash only exists on llvm build, not reproducable with GCC. So I hope llvm > >> guys can take a look :) > >> > >> The llvm versions I have tried are llvm-13.0.0 and mainline (commit 102bc634cb > >> ("[runtime] Build compiler-rt with --unwindlib=none")). > >> > >> [ 612.947887][ T496] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000001 > >> [ 613.050789][ T496] Hardware name: riscv-virtio,qemu (DT) > >> [ 613.087976][ T496] epc : __find_rr_leaf+0x128/0x220 > >> [ 613.107493][ T496] ra : return_to_handler+0x22/0x24 > >> [ 613.125322][ T496] epc : ffffffff80a1915a ra : ffffffff80009506 sp : ff20000011e43860 > >> [ 613.150124][ T496] gp : ffffffff81812f40 tp : ff6000008bb01580 t0 : ff600000806cf0f0 > >> [ 613.173657][ T496] t1 : 000000000001b29a t2 : 0000000000000001 s0 : ff20000011e43920 > >> [ 613.187311][ T496] s1 : ff600000848c2a00 a0 : 0000000000000002 a1 : 0000000000000002 > >> [ 613.202731][ T496] a2 : fffffffffffffffd a3 : ff6000009d287000 a4 : 00000000000002c0 > >> [ 613.213723][ T496] a5 : ff6000009d259b40 a6 : ffffffffffffff9c a7 : ffffffffffffffff > >> [ 613.226648][ T496] s2 : 0000000000000001 s3 : ff20000011e439d8 s4 : ffffffff8160d140 > >> [ 613.246571][ T496] s5 : 0000000000000002 s6 : 0000000000000000 s7 : 0000000000000000 > >> [ 613.264681][ T496] s8 : 0000000000000064 s9 : 0000000000000000 s10: 0000000000400000 > >> [ 613.277999][ T496] s11: ff600000848c2aa8 t3 : 0000000000000290 t4 : 00000000004002c0 > >> [ 613.303729][ T496] t5 : 00000000ffffffff t6 : ff6000009d2872d0 > >> [ 613.322145][ T496] status: 0000000200000120 badaddr: 0000000000000001 cause: 000000000000000d > >> [ 613.346228][ T496] [] ip6_pol_route+0xb6/0x602 > >> [ 613.365722][ T496] [] ip6_pol_route_output+0x2c/0x34 > >> [ 613.386374][ T496] [] fib6_rule_lookup+0x36/0xa0 > >> [ 613.401865][ T496] [] ip6_route_output_flags_noref+0xd6/0xea > >> [ 613.412776][ T496] [] ip6_route_output_flags+0x52/0xd4 > >> [ 613.432013][ T496] [] ip6_dst_lookup_tail+0x68/0x23a > >> [ 613.456198][ T496] [] ip6_sk_dst_lookup_flow+0x132/0x1cc > >> [ 613.513174][ T496] [] ret_from_syscall+0x0/0x2 > >> [ 613.518973][ T496] [] return_to_handler+0x0/0x24 > >> [ 613.563961][ T496] Kernel panic - not syncing: Fatal exception > >> [ 613.572278][ T496] SMP: stopping secondary CPUs > >> [ 613.587449][ T496] ---[ end Kernel panic - not syncing: Fatal exception ]--- > >> > >> The crash happened when dereferencing the point 'mpri' at route.c:758. > >> > >> (gdb) l *__find_rr_leaf+0x128 > >> 0xffffffff809da9c4 is in __find_rr_leaf (net/ipv6/route.c:758). > >> 753 > >> 754 if (strict & RT6_LOOKUP_F_REACHABLE) > >> 755 rt6_probe(nh); > >> 756 > >> 757 /* note that m can be RT6_NUD_FAIL_PROBE at this point */ > >> 758 if (m > *mpri) { > >> 759 *do_rr = match_do_rr; > >> 760 *mpri = m; > >> 761 rc = true; > >> 762 } > >> > >> Adding some logs, I found the problem. The ninth passed parameter of function > >> __find_rr_leaf() which is the address of local variable 'mpri', is changed to > >> value '0x1' when inside the function __find_rr_leaf. > >> Here is the code snippet and full link > >> https://github.com/torvalds/linux/blob/9cb7c013420f98fa6fd12fc6a5dc055170c108db/net/ipv6/route.c. > >> > >> static void find_rr_leaf(struct fib6_node *fn, struct fib6_info *leaf, > >> struct fib6_info *rr_head, int oif, int strict, > >> bool *do_rr, struct fib6_result *res) > >> { > >> u32 metric = rr_head->fib6_metric; > >> struct fib6_info *cont = NULL; > >> int mpri = -1; > >> > >> __find_rr_leaf(rr_head, NULL, metric, res, &cont, > >> oif, strict, do_rr, &mpri); > >> ... > >> } > >> > >> Then debugging with gdb, I found this probably is a compiler bug. We can see the > >> local function __find_rr_leaf() is not optimized out and the compiler generates > >> a local symbol for it. The find_rr_leaf() (inlined by fib6_table_lookup) invokes > >> this function with 'jalr' instruction. > >> > >> (gdb) disassemble fib6_table_lookup > >> Dump of assembler code for function fib6_table_lookup: > >> [snip] > >> 0xffffffff80a1240e <+412>: beqz a1,0xffffffff80a12436 > >> 0xffffffff80a12410 <+414>: slli a1,s9,0x20 > >> 0xffffffff80a12414 <+418>: srli a1,a1,0x20 > >> 0xffffffff80a12416 <+420>: sext.w a2,a1 > >> 0xffffffff80a1241a <+424>: addi a7,s0,-125 > >> 0xffffffff80a1241e <+428>: addi t2,s0,-124 > >> 0xffffffff80a12422 <+432>: li a1,0 > >> 0xffffffff80a12424 <+434>: mv a3,s10 > >> 0xffffffff80a12426 <+436>: li a4,0 > >> 0xffffffff80a12428 <+438>: ld a5,-152(s0) > >> 0xffffffff80a1242c <+442>: mv a6,s8 > >> 0xffffffff80a1242e <+444>: auipc ra,0x7 > >> 0xffffffff80a12432 <+448>: jalr -686(ra) # 0xffffffff80a19180 <__find_rr_leaf> > >> [snip] > >> > >> And at line route.c:758, the value of point 'mpri' is stored in temporary register > >> $t2 and $s3 (copied from $t2). > >> > >> (gdb) info scope __find_rr_leaf > >> [snip] > >> Symbol mpri is multi-location: > >> Base address 0xffffffff80a10564 Range 0xffffffff80a19190-0xffffffff80a191ae: a variable in $t2 > >> Range 0xffffffff80a191c0-0xffffffff80a191d6: a variable in $s3 > >> Range 0xffffffff80a19200-0xffffffff80a19208: a variable in $s3 > >> Range 0xffffffff80a1921e-0xffffffff80a192fe: a variable in $s3 > >> Range 0xffffffff80a1930a-0xffffffff80a19356: a variable in $s3 > >> > >> Let's see when register $t2 is corrupted with single-step mode. Obviously, register > >> $t2 is changed by mcount function ftrace_caller(). This is why the bug happens > >> to ftrace. > >> > >> Dump of assembler code for function __find_rr_leaf: > >> 0xffffffff80a19180 <+0>: sd ra,-8(sp) # $t2 = 0xff200000120db7b4 > >> 0xffffffff80a19184 <+4>: auipc ra,0xff5f1 > >> 0xffffffff80a19188 <+8>: jalr -1744(ra) # 0xffffffff80009ab4 # $t2 = 0xff200000120db7b4 > >> => 0xffffffff80a1918c <+12>: ld ra,-8(sp) # $t2 = 0x1, bug, $t2 is corrupted!! > >> 0xffffffff80a19190 <+16>: addi sp,sp,-176 > >> [snip] > >> > >> So now we can come to a conclusion. The generated local function __find_rr_leaf() > >> violates the risc-v calling convention and leads to the panic. It should use stack > >> but *not* temporary register $t2 to pass the ninth parameter! It's okay if the > >> callsite can take care of local symbol callees, but the Function Instrumentation > >> features should be considerated carefully. > >> > >> For comparison, here is the result from gcc (9.2.0): > >> (gdb) info scope __find_rr_leaf > >> [snip] > >> Symbol mpri is a complex DWARF expression: > >> 0: DW_OP_fbreg 0, length 8. > >> > >> I also built a simple test function with 9 parameters by clang and same cflags, > >> but cannot reproduce it. Maybe it is conditional? > >> > >> Simple test code: > >> __attribute__ ((noinline)) > >> void test_func(int *a, int *b, int *c, int *d, int *e, int *f, int *g, int *h, int *i) > >> { > >> printf("__find_rr_leaf: %d\n", *i); > >> } > >> > >> int main(void) > >> { > >> int a,b,c,d,e,f,g,h,i = 100; > >> > >> test_func(&a,&b,&c,&d,&e,&f,&g,&h,&i); > >> return 0; > >> } > > > > Hmm...any chance you could come up with a more concise test case then > > using creduce [0] or cvise [1]? > > [0] https://embed.cs.utah.edu/creduce/ > > [1] https://github.com/marxin/cvise > > > > > >> > >> -- > >> Cheers, > >> Changbin Du > >> > > > > > > -- > > Thanks, > > ~Nick Desaulniers > -- Cheers, Changbin Du From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B9566C433F5 for ; Thu, 12 May 2022 08:30:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:CC:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=9e+NLfSTNS3gj5Nz33S9iCFS09Vr1/7OGSyUcDXFSh4=; b=PqLbe3iHmLnU8R Rii6ERsOQM9JJPpMDBzo2AQlXcfGxF7PWyKqNtkoURWh/dbvGCPdBTg/AogsqQkM5dQ0DWAH4Ijw/ tX/eUeuS+pGFZeMJr18z/03AzvskEB5lC2/PtPYtLQGIAaYq02iR6nvpxUwfl35noARQ7PkuEI6wX PyArNv8MEH4QmQouxe+fvUyKGCrAKxdB2QkxY0S1pKsrIpzX/hdvKu+7bjvSgDTQ5P7vUIAL5unWF H07vieN90ID70HjdK3FLsebh6nhXChtYnR8iLT2yuYHoUnab9vOq0WjB9xzg5nBrTl5VmGEzjaN/f M43MTJ4jpgGzcQ3gcynQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1np4DE-00B08t-3J; Thu, 12 May 2022 08:30:20 +0000 Received: from szxga02-in.huawei.com ([45.249.212.188]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1np4DA-00B07p-05 for linux-riscv@lists.infradead.org; Thu, 12 May 2022 08:30:18 +0000 Received: from kwepemi500013.china.huawei.com (unknown [172.30.72.55]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4KzPz05FRvzGpf9; Thu, 12 May 2022 16:27:24 +0800 (CST) Received: from M910t (10.110.54.157) by kwepemi500013.china.huawei.com (7.221.188.120) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Thu, 12 May 2022 16:30:13 +0800 Date: Thu, 12 May 2022 16:30:07 +0800 From: Changbin Du To: Craig Topper CC: Nick Desaulniers , Changbin Du , Paul Walmsley , Palmer Dabbelt , Albert Ou , Steven Rostedt , , , , , , , Subject: Re: riscv: llvm-compiler: calling convention violation: temporary register $t2 is used to pass the ninth function parameter Message-ID: <20220512083007.gdvlaq7ar2tyarza@M910t> References: <20220510065336.hlfjrc25ajed5zj4@M910t> <10BD31AB-C9F3-45FD-9A4A-EF7DC07C94D5@sifive.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <10BD31AB-C9F3-45FD-9A4A-EF7DC07C94D5@sifive.com> X-Originating-IP: [10.110.54.157] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To kwepemi500013.china.huawei.com (7.221.188.120) X-CFilter-Loop: Reflected X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220512_013016_439239_F93A1145 X-CRM114-Status: GOOD ( 33.92 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org T24gV2VkLCBNYXkgMTEsIDIwMjIgYXQgMDE6MDc6MTRQTSAtMDcwMCwgQ3JhaWcgVG9wcGVyIHdy b3RlOgo+IEnigJltIGd1ZXNzaW5nIHRoYXQgYmVjYXVzZSB0aGUgZnVuY3Rpb24gaXMgc3RhdGlj LCB0aGUgY2FsbGluZyBjb252ZW50aW9uIHdhcyBjaGFuZ2VkIHRvIGZhc3RjYWxsIHdoaWNoIGFs bG93cyB1cyB0byBpZ25vcmUgdGhlIEFCSS4KPiAKSSB0aGluayBzby4gQnV0IHRoZSBtY291bnQg ZnVuY3Rpb24gYXNzdW1lcyB0aGUgQUJJIGlzIG5vdCBjaGFuZ2VkLgoKPiA+IE9uIE1heSAxMSwg MjAyMiwgYXQgMTE6MzkgQU0sIE5pY2sgRGVzYXVsbmllcnMgPG5kZXNhdWxuaWVyc0Bnb29nbGUu Y29tPiB3cm90ZToKPiA+IAo+ID4gT24gTW9uLCBNYXkgOSwgMjAyMiBhdCAxMTo1NCBQTSBDaGFu Z2JpbiBEdSA8Y2hhbmdiaW4uZHVAaHVhd2VpLmNvbT4gd3JvdGU6Cj4gPj4gCj4gPj4gW1RoaXMg aXMgYSByZXNlbnQgdG8gY29ycmVjdCBsbHZtIG1haWxpc3QuXQo+ID4+IAo+ID4+IEhlbGxvLCBm b2xrcywKPiA+PiAKPiA+PiBSZWNlbnRseSBJIGVuY291bnRlcmVkIGEga2VybmVsIGNyYXNoIHBy b2JsZW0gd2hlbiB1c2luZyBmdHJhY2Ugd2l0aCAncGVyZiBmdHJhY2UnCj4gPj4gY29tbWFuZCBv biByaXNjLXYga2VybmVsIGJ1aWx0IHdpdGggbGx2bS4KPiA+PiAKPiA+PiBUaGlzIGNyYXNoIG9u bHkgZXhpc3RzIG9uIGxsdm0gYnVpbGQsIG5vdCByZXByb2R1Y2FibGUgd2l0aCBHQ0MuIFNvIEkg aG9wZSBsbHZtCj4gPj4gZ3V5cyBjYW4gdGFrZSBhIGxvb2sgOikKPiA+PiAKPiA+PiBUaGUgbGx2 bSB2ZXJzaW9ucyBJIGhhdmUgdHJpZWQgYXJlIGxsdm0tMTMuMC4wIGFuZCBtYWlubGluZSAoY29t bWl0IDEwMmJjNjM0Y2IKPiA+PiAoIltydW50aW1lXSBCdWlsZCBjb21waWxlci1ydCB3aXRoIC0t dW53aW5kbGliPW5vbmUiKSkuCj4gPj4gCj4gPj4gWyAgNjEyLjk0Nzg4N11bICBUNDk2XSBVbmFi bGUgdG8gaGFuZGxlIGtlcm5lbCBOVUxMIHBvaW50ZXIgZGVyZWZlcmVuY2UgYXQgdmlydHVhbCBh ZGRyZXNzIDAwMDAwMDAwMDAwMDAwMDEKPiA+PiBbICA2MTMuMDUwNzg5XVsgIFQ0OTZdIEhhcmR3 YXJlIG5hbWU6IHJpc2N2LXZpcnRpbyxxZW11IChEVCkKPiA+PiBbICA2MTMuMDg3OTc2XVsgIFQ0 OTZdIGVwYyA6IF9fZmluZF9ycl9sZWFmKzB4MTI4LzB4MjIwCj4gPj4gWyAgNjEzLjEwNzQ5M11b ICBUNDk2XSAgcmEgOiByZXR1cm5fdG9faGFuZGxlcisweDIyLzB4MjQKPiA+PiBbICA2MTMuMTI1 MzIyXVsgIFQ0OTZdIGVwYyA6IGZmZmZmZmZmODBhMTkxNWEgcmEgOiBmZmZmZmZmZjgwMDA5NTA2 IHNwIDogZmYyMDAwMDAxMWU0Mzg2MAo+ID4+IFsgIDYxMy4xNTAxMjRdWyAgVDQ5Nl0gIGdwIDog ZmZmZmZmZmY4MTgxMmY0MCB0cCA6IGZmNjAwMDAwOGJiMDE1ODAgdDAgOiBmZjYwMDAwMDgwNmNm MGYwCj4gPj4gWyAgNjEzLjE3MzY1N11bICBUNDk2XSAgdDEgOiAwMDAwMDAwMDAwMDFiMjlhIHQy IDogMDAwMDAwMDAwMDAwMDAwMSBzMCA6IGZmMjAwMDAwMTFlNDM5MjAKPiA+PiBbICA2MTMuMTg3 MzExXVsgIFQ0OTZdICBzMSA6IGZmNjAwMDAwODQ4YzJhMDAgYTAgOiAwMDAwMDAwMDAwMDAwMDAy IGExIDogMDAwMDAwMDAwMDAwMDAwMgo+ID4+IFsgIDYxMy4yMDI3MzFdWyAgVDQ5Nl0gIGEyIDog ZmZmZmZmZmZmZmZmZmZmZCBhMyA6IGZmNjAwMDAwOWQyODcwMDAgYTQgOiAwMDAwMDAwMDAwMDAw MmMwCj4gPj4gWyAgNjEzLjIxMzcyM11bICBUNDk2XSAgYTUgOiBmZjYwMDAwMDlkMjU5YjQwIGE2 IDogZmZmZmZmZmZmZmZmZmY5YyBhNyA6IGZmZmZmZmZmZmZmZmZmZmYKPiA+PiBbICA2MTMuMjI2 NjQ4XVsgIFQ0OTZdICBzMiA6IDAwMDAwMDAwMDAwMDAwMDEgczMgOiBmZjIwMDAwMDExZTQzOWQ4 IHM0IDogZmZmZmZmZmY4MTYwZDE0MAo+ID4+IFsgIDYxMy4yNDY1NzFdWyAgVDQ5Nl0gIHM1IDog MDAwMDAwMDAwMDAwMDAwMiBzNiA6IDAwMDAwMDAwMDAwMDAwMDAgczcgOiAwMDAwMDAwMDAwMDAw MDAwCj4gPj4gWyAgNjEzLjI2NDY4MV1bICBUNDk2XSAgczggOiAwMDAwMDAwMDAwMDAwMDY0IHM5 IDogMDAwMDAwMDAwMDAwMDAwMCBzMTA6IDAwMDAwMDAwMDA0MDAwMDAKPiA+PiBbICA2MTMuMjc3 OTk5XVsgIFQ0OTZdICBzMTE6IGZmNjAwMDAwODQ4YzJhYTggdDMgOiAwMDAwMDAwMDAwMDAwMjkw IHQ0IDogMDAwMDAwMDAwMDQwMDJjMAo+ID4+IFsgIDYxMy4zMDM3MjldWyAgVDQ5Nl0gIHQ1IDog MDAwMDAwMDBmZmZmZmZmZiB0NiA6IGZmNjAwMDAwOWQyODcyZDAKPiA+PiBbICA2MTMuMzIyMTQ1 XVsgIFQ0OTZdIHN0YXR1czogMDAwMDAwMDIwMDAwMDEyMCBiYWRhZGRyOiAwMDAwMDAwMDAwMDAw MDAxIGNhdXNlOiAwMDAwMDAwMDAwMDAwMDBkCj4gPj4gWyAgNjEzLjM0NjIyOF1bICBUNDk2XSBb PGZmZmZmZmZmODBhMTI1MjY+XSBpcDZfcG9sX3JvdXRlKzB4YjYvMHg2MDIKPiA+PiBbICA2MTMu MzY1NzIyXVsgIFQ0OTZdIFs8ZmZmZmZmZmY4MGExMzIxYT5dIGlwNl9wb2xfcm91dGVfb3V0cHV0 KzB4MmMvMHgzNAo+ID4+IFsgIDYxMy4zODYzNzRdWyAgVDQ5Nl0gWzxmZmZmZmZmZjgwYTFjMDI4 Pl0gZmliNl9ydWxlX2xvb2t1cCsweDM2LzB4YTAKPiA+PiBbICA2MTMuNDAxODY1XVsgIFQ0OTZd IFs8ZmZmZmZmZmY4MGExMzFkYT5dIGlwNl9yb3V0ZV9vdXRwdXRfZmxhZ3Nfbm9yZWYrMHhkNi8w eGVhCj4gPj4gWyAgNjEzLjQxMjc3Nl1bICBUNDk2XSBbPGZmZmZmZmZmODBhMTMyNzQ+XSBpcDZf cm91dGVfb3V0cHV0X2ZsYWdzKzB4NTIvMHhkNAo+ID4+IFsgIDYxMy40MzIwMTNdWyAgVDQ5Nl0g WzxmZmZmZmZmZjgwOWZmYjNhPl0gaXA2X2RzdF9sb29rdXBfdGFpbCsweDY4LzB4MjNhCj4gPj4g WyAgNjEzLjQ1NjE5OF1bICBUNDk2XSBbPGZmZmZmZmZmODA5ZmZlYzY+XSBpcDZfc2tfZHN0X2xv b2t1cF9mbG93KzB4MTMyLzB4MWNjCj4gPj4gWyAgNjEzLjUxMzE3NF1bICBUNDk2XSBbPGZmZmZm ZmZmODAwMDNjZDg+XSByZXRfZnJvbV9zeXNjYWxsKzB4MC8weDIKPiA+PiBbICA2MTMuNTE4OTcz XVsgIFQ0OTZdIFs8ZmZmZmZmZmY4MDAwOTRlND5dIHJldHVybl90b19oYW5kbGVyKzB4MC8weDI0 Cj4gPj4gWyAgNjEzLjU2Mzk2MV1bICBUNDk2XSBLZXJuZWwgcGFuaWMgLSBub3Qgc3luY2luZzog RmF0YWwgZXhjZXB0aW9uCj4gPj4gWyAgNjEzLjU3MjI3OF1bICBUNDk2XSBTTVA6IHN0b3BwaW5n IHNlY29uZGFyeSBDUFVzCj4gPj4gWyAgNjEzLjU4NzQ0OV1bICBUNDk2XSAtLS1bIGVuZCBLZXJu ZWwgcGFuaWMgLSBub3Qgc3luY2luZzogRmF0YWwgZXhjZXB0aW9uIF0tLS0KPiA+PiAKPiA+PiBU aGUgY3Jhc2ggaGFwcGVuZWQgd2hlbiBkZXJlZmVyZW5jaW5nIHRoZSBwb2ludCAnbXByaScgYXQg cm91dGUuYzo3NTguCj4gPj4gCj4gPj4gKGdkYikgbCAqX19maW5kX3JyX2xlYWYrMHgxMjgKPiA+ PiAweGZmZmZmZmZmODA5ZGE5YzQgaXMgaW4gX19maW5kX3JyX2xlYWYgKG5ldC9pcHY2L3JvdXRl LmM6NzU4KS4KPiA+PiA3NTMKPiA+PiA3NTQgICAgICAgICAgICAgaWYgKHN0cmljdCAmIFJUNl9M T09LVVBfRl9SRUFDSEFCTEUpCj4gPj4gNzU1ICAgICAgICAgICAgICAgICAgICAgcnQ2X3Byb2Jl KG5oKTsKPiA+PiA3NTYKPiA+PiA3NTcgICAgICAgICAgICAgLyogbm90ZSB0aGF0IG0gY2FuIGJl IFJUNl9OVURfRkFJTF9QUk9CRSBhdCB0aGlzIHBvaW50ICovCj4gPj4gNzU4ICAgICAgICAgICAg IGlmIChtID4gKm1wcmkpIHsKPiA+PiA3NTkgICAgICAgICAgICAgICAgICAgICAqZG9fcnIgPSBt YXRjaF9kb19ycjsKPiA+PiA3NjAgICAgICAgICAgICAgICAgICAgICAqbXByaSA9IG07Cj4gPj4g NzYxICAgICAgICAgICAgICAgICAgICAgcmMgPSB0cnVlOwo+ID4+IDc2MiAgICAgICAgICAgICB9 Cj4gPj4gCj4gPj4gQWRkaW5nIHNvbWUgbG9ncywgSSBmb3VuZCB0aGUgcHJvYmxlbS4gVGhlIG5p bnRoIHBhc3NlZCBwYXJhbWV0ZXIgb2YgZnVuY3Rpb24KPiA+PiBfX2ZpbmRfcnJfbGVhZigpIHdo aWNoIGlzIHRoZSBhZGRyZXNzIG9mIGxvY2FsIHZhcmlhYmxlICdtcHJpJywgaXMgY2hhbmdlZCB0 bwo+ID4+IHZhbHVlICcweDEnIHdoZW4gaW5zaWRlIHRoZSBmdW5jdGlvbiBfX2ZpbmRfcnJfbGVh Zi4KPiA+PiBIZXJlIGlzIHRoZSBjb2RlIHNuaXBwZXQgYW5kIGZ1bGwgbGluawo+ID4+IGh0dHBz Oi8vZ2l0aHViLmNvbS90b3J2YWxkcy9saW51eC9ibG9iLzljYjdjMDEzNDIwZjk4ZmE2ZmQxMmZj NmE1ZGMwNTUxNzBjMTA4ZGIvbmV0L2lwdjYvcm91dGUuYy4KPiA+PiAKPiA+PiBzdGF0aWMgdm9p ZCBmaW5kX3JyX2xlYWYoc3RydWN0IGZpYjZfbm9kZSAqZm4sIHN0cnVjdCBmaWI2X2luZm8gKmxl YWYsCj4gPj4gICAgICAgICAgICAgICAgICAgICAgICAgc3RydWN0IGZpYjZfaW5mbyAqcnJfaGVh ZCwgaW50IG9pZiwgaW50IHN0cmljdCwKPiA+PiAgICAgICAgICAgICAgICAgICAgICAgICBib29s ICpkb19yciwgc3RydWN0IGZpYjZfcmVzdWx0ICpyZXMpCj4gPj4gewo+ID4+ICAgICAgICB1MzIg bWV0cmljID0gcnJfaGVhZC0+ZmliNl9tZXRyaWM7Cj4gPj4gICAgICAgIHN0cnVjdCBmaWI2X2lu Zm8gKmNvbnQgPSBOVUxMOwo+ID4+ICAgICAgICBpbnQgbXByaSA9IC0xOwo+ID4+IAo+ID4+ICAg ICAgICBfX2ZpbmRfcnJfbGVhZihycl9oZWFkLCBOVUxMLCBtZXRyaWMsIHJlcywgJmNvbnQsCj4g Pj4gICAgICAgICAgICAgICAgICAgICAgIG9pZiwgc3RyaWN0LCBkb19yciwgJm1wcmkpOwo+ID4+ ICAgICAgICAuLi4KPiA+PiB9Cj4gPj4gCj4gPj4gVGhlbiBkZWJ1Z2dpbmcgd2l0aCBnZGIsIEkg Zm91bmQgdGhpcyBwcm9iYWJseSBpcyBhIGNvbXBpbGVyIGJ1Zy4gV2UgY2FuIHNlZSB0aGUKPiA+ PiBsb2NhbCBmdW5jdGlvbiBfX2ZpbmRfcnJfbGVhZigpIGlzIG5vdCBvcHRpbWl6ZWQgb3V0IGFu ZCB0aGUgY29tcGlsZXIgZ2VuZXJhdGVzCj4gPj4gYSBsb2NhbCBzeW1ib2wgZm9yIGl0LiBUaGUg ZmluZF9ycl9sZWFmKCkgKGlubGluZWQgYnkgZmliNl90YWJsZV9sb29rdXApIGludm9rZXMKPiA+ PiB0aGlzIGZ1bmN0aW9uIHdpdGggJ2phbHInIGluc3RydWN0aW9uLgo+ID4+IAo+ID4+IChnZGIp IGRpc2Fzc2VtYmxlIGZpYjZfdGFibGVfbG9va3VwCj4gPj4gRHVtcCBvZiBhc3NlbWJsZXIgY29k ZSBmb3IgZnVuY3Rpb24gZmliNl90YWJsZV9sb29rdXA6Cj4gPj4gICBbc25pcF0KPiA+PiAgIDB4 ZmZmZmZmZmY4MGExMjQwZSA8KzQxMj46ICAgYmVxeiAgICBhMSwweGZmZmZmZmZmODBhMTI0MzYg PGZpYjZfdGFibGVfbG9va3VwKzQ1Mj4KPiA+PiAgIDB4ZmZmZmZmZmY4MGExMjQxMCA8KzQxND46 ICAgc2xsaSAgICBhMSxzOSwweDIwCj4gPj4gICAweGZmZmZmZmZmODBhMTI0MTQgPCs0MTg+OiAg IHNybGkgICAgYTEsYTEsMHgyMAo+ID4+ICAgMHhmZmZmZmZmZjgwYTEyNDE2IDwrNDIwPjogICBz ZXh0LncgIGEyLGExCj4gPj4gICAweGZmZmZmZmZmODBhMTI0MWEgPCs0MjQ+OiAgIGFkZGkgICAg YTcsczAsLTEyNQo+ID4+ICAgMHhmZmZmZmZmZjgwYTEyNDFlIDwrNDI4PjogICBhZGRpICAgIHQy LHMwLC0xMjQKPiA+PiAgIDB4ZmZmZmZmZmY4MGExMjQyMiA8KzQzMj46ICAgbGkgICAgICBhMSww Cj4gPj4gICAweGZmZmZmZmZmODBhMTI0MjQgPCs0MzQ+OiAgIG12ICAgICAgYTMsczEwCj4gPj4g ICAweGZmZmZmZmZmODBhMTI0MjYgPCs0MzY+OiAgIGxpICAgICAgYTQsMAo+ID4+ICAgMHhmZmZm ZmZmZjgwYTEyNDI4IDwrNDM4PjogICBsZCAgICAgIGE1LC0xNTIoczApCj4gPj4gICAweGZmZmZm ZmZmODBhMTI0MmMgPCs0NDI+OiAgIG12ICAgICAgYTYsczgKPiA+PiAgIDB4ZmZmZmZmZmY4MGEx MjQyZSA8KzQ0ND46ICAgYXVpcGMgICByYSwweDcKPiA+PiAgIDB4ZmZmZmZmZmY4MGExMjQzMiA8 KzQ0OD46ICAgamFsciAgICAtNjg2KHJhKSAjIDB4ZmZmZmZmZmY4MGExOTE4MCA8X19maW5kX3Jy X2xlYWY+Cj4gPj4gICBbc25pcF0KPiA+PiAKPiA+PiBBbmQgYXQgbGluZSByb3V0ZS5jOjc1OCwg dGhlIHZhbHVlIG9mIHBvaW50ICdtcHJpJyBpcyBzdG9yZWQgaW4gdGVtcG9yYXJ5IHJlZ2lzdGVy Cj4gPj4gJHQyIGFuZCAkczMgKGNvcGllZCBmcm9tICR0MikuCj4gPj4gCj4gPj4gKGdkYikgaW5m byBzY29wZSBfX2ZpbmRfcnJfbGVhZgo+ID4+IFtzbmlwXQo+ID4+IFN5bWJvbCBtcHJpIGlzIG11 bHRpLWxvY2F0aW9uOgo+ID4+ICBCYXNlIGFkZHJlc3MgMHhmZmZmZmZmZjgwYTEwNTY0ICBSYW5n ZSAweGZmZmZmZmZmODBhMTkxOTAtMHhmZmZmZmZmZjgwYTE5MWFlOiBhIHZhcmlhYmxlIGluICR0 Mgo+ID4+ICBSYW5nZSAweGZmZmZmZmZmODBhMTkxYzAtMHhmZmZmZmZmZjgwYTE5MWQ2OiBhIHZh cmlhYmxlIGluICRzMwo+ID4+ICBSYW5nZSAweGZmZmZmZmZmODBhMTkyMDAtMHhmZmZmZmZmZjgw YTE5MjA4OiBhIHZhcmlhYmxlIGluICRzMwo+ID4+ICBSYW5nZSAweGZmZmZmZmZmODBhMTkyMWUt MHhmZmZmZmZmZjgwYTE5MmZlOiBhIHZhcmlhYmxlIGluICRzMwo+ID4+ICBSYW5nZSAweGZmZmZm ZmZmODBhMTkzMGEtMHhmZmZmZmZmZjgwYTE5MzU2OiBhIHZhcmlhYmxlIGluICRzMwo+ID4+IAo+ ID4+IExldCdzIHNlZSB3aGVuIHJlZ2lzdGVyICR0MiBpcyBjb3JydXB0ZWQgd2l0aCBzaW5nbGUt c3RlcCBtb2RlLiBPYnZpb3VzbHksIHJlZ2lzdGVyCj4gPj4gJHQyIGlzIGNoYW5nZWQgYnkgbWNv dW50IGZ1bmN0aW9uIGZ0cmFjZV9jYWxsZXIoKS4gVGhpcyBpcyB3aHkgdGhlIGJ1ZyBoYXBwZW5z Cj4gPj4gdG8gZnRyYWNlLgo+ID4+IAo+ID4+IER1bXAgb2YgYXNzZW1ibGVyIGNvZGUgZm9yIGZ1 bmN0aW9uIF9fZmluZF9ycl9sZWFmOgo+ID4+ICAgMHhmZmZmZmZmZjgwYTE5MTgwIDwrMD46ICAg ICBzZCAgICAgIHJhLC04KHNwKSAgICMgICR0MiA9IDB4ZmYyMDAwMDAxMjBkYjdiNAo+ID4+ICAg MHhmZmZmZmZmZjgwYTE5MTg0IDwrND46ICAgICBhdWlwYyAgIHJhLDB4ZmY1ZjEKPiA+PiAgIDB4 ZmZmZmZmZmY4MGExOTE4OCA8Kzg+OiAgICAgamFsciAgICAtMTc0NChyYSkgIyAweGZmZmZmZmZm ODAwMDlhYjQgPGZ0cmFjZV9jYWxsZXI+ICMgICR0MiA9IDB4ZmYyMDAwMDAxMjBkYjdiNAo+ID4+ ID0+IDB4ZmZmZmZmZmY4MGExOTE4YyA8KzEyPjogICAgbGQgICAgICByYSwtOChzcCkgICAgIyAg JHQyID0gMHgxLCBidWcsICR0MiBpcyBjb3JydXB0ZWQhIQo+ID4+ICAgMHhmZmZmZmZmZjgwYTE5 MTkwIDwrMTY+OiAgICBhZGRpICAgIHNwLHNwLC0xNzYKPiA+PiAgIFtzbmlwXQo+ID4+IAo+ID4+ IFNvIG5vdyB3ZSBjYW4gY29tZSB0byBhIGNvbmNsdXNpb24uIFRoZSBnZW5lcmF0ZWQgbG9jYWwg ZnVuY3Rpb24gX19maW5kX3JyX2xlYWYoKQo+ID4+IHZpb2xhdGVzIHRoZSByaXNjLXYgY2FsbGlu ZyBjb252ZW50aW9uIGFuZCBsZWFkcyB0byB0aGUgcGFuaWMuIEl0IHNob3VsZCB1c2Ugc3RhY2sK PiA+PiBidXQgKm5vdCogdGVtcG9yYXJ5IHJlZ2lzdGVyICR0MiB0byBwYXNzIHRoZSBuaW50aCBw YXJhbWV0ZXIhIEl0J3Mgb2theSBpZiB0aGUKPiA+PiBjYWxsc2l0ZSBjYW4gdGFrZSBjYXJlIG9m IGxvY2FsIHN5bWJvbCBjYWxsZWVzLCBidXQgdGhlIEZ1bmN0aW9uIEluc3RydW1lbnRhdGlvbgo+ ID4+IGZlYXR1cmVzIHNob3VsZCBiZSBjb25zaWRlcmF0ZWQgY2FyZWZ1bGx5Lgo+ID4+IAo+ID4+ IEZvciBjb21wYXJpc29uLCBoZXJlIGlzIHRoZSByZXN1bHQgZnJvbSBnY2MgKDkuMi4wKToKPiA+ PiAoZ2RiKSBpbmZvIHNjb3BlIF9fZmluZF9ycl9sZWFmCj4gPj4gW3NuaXBdCj4gPj4gU3ltYm9s IG1wcmkgaXMgYSBjb21wbGV4IERXQVJGIGV4cHJlc3Npb246Cj4gPj4gICAgIDA6IERXX09QX2Zi cmVnIDAsIGxlbmd0aCA4Lgo+ID4+IAo+ID4+IEkgYWxzbyBidWlsdCBhIHNpbXBsZSB0ZXN0IGZ1 bmN0aW9uIHdpdGggOSBwYXJhbWV0ZXJzIGJ5IGNsYW5nIGFuZCBzYW1lIGNmbGFncywKPiA+PiBi dXQgY2Fubm90IHJlcHJvZHVjZSBpdC4gTWF5YmUgaXQgaXMgY29uZGl0aW9uYWw/Cj4gPj4gCj4g Pj4gU2ltcGxlIHRlc3QgY29kZToKPiA+PiBfX2F0dHJpYnV0ZV9fICgobm9pbmxpbmUpKQo+ID4+ IHZvaWQgdGVzdF9mdW5jKGludCAqYSwgaW50ICpiLCBpbnQgKmMsIGludCAqZCwgaW50ICplLCBp bnQgKmYsIGludCAqZywgaW50ICpoLCBpbnQgKmkpCj4gPj4gewo+ID4+ICAgICAgICBwcmludGYo Il9fZmluZF9ycl9sZWFmOiAlZFxuIiwgKmkpOwo+ID4+IH0KPiA+PiAKPiA+PiBpbnQgbWFpbih2 b2lkKQo+ID4+IHsKPiA+PiAgICAgICAgaW50IGEsYixjLGQsZSxmLGcsaCxpID0gMTAwOwo+ID4+ IAo+ID4+ICAgICAgICB0ZXN0X2Z1bmMoJmEsJmIsJmMsJmQsJmUsJmYsJmcsJmgsJmkpOwo+ID4+ ICAgICAgICByZXR1cm4gMDsKPiA+PiB9Cj4gPiAKPiA+IEhtbS4uLmFueSBjaGFuY2UgeW91IGNv dWxkIGNvbWUgdXAgd2l0aCBhIG1vcmUgY29uY2lzZSB0ZXN0IGNhc2UgdGhlbgo+ID4gdXNpbmcg Y3JlZHVjZSBbMF0gb3IgY3Zpc2UgWzFdPwo+ID4gWzBdIGh0dHBzOi8vZW1iZWQuY3MudXRhaC5l ZHUvY3JlZHVjZS8KPiA+IFsxXSBodHRwczovL2dpdGh1Yi5jb20vbWFyeGluL2N2aXNlCj4gPiAK PiA+IAo+ID4+IAo+ID4+IC0tCj4gPj4gQ2hlZXJzLAo+ID4+IENoYW5nYmluIER1Cj4gPj4gCj4g PiAKPiA+IAo+ID4gLS0gCj4gPiBUaGFua3MsCj4gPiB+TmljayBEZXNhdWxuaWVycwo+IAoKLS0g CkNoZWVycywKQ2hhbmdiaW4gRHUKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fCmxpbnV4LXJpc2N2IG1haWxpbmcgbGlzdApsaW51eC1yaXNjdkBsaXN0cy5p bmZyYWRlYWQub3JnCmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8v bGludXgtcmlzY3YK