From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.3 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E6682C433DB for ; Thu, 11 Mar 2021 10:42:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9A4DB64F94 for ; Thu, 11 Mar 2021 10:42:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232402AbhCKKmK (ORCPT ); Thu, 11 Mar 2021 05:42:10 -0500 Received: from imap3.hz.codethink.co.uk ([176.9.8.87]:57496 "EHLO imap3.hz.codethink.co.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232213AbhCKKmB (ORCPT ); Thu, 11 Mar 2021 05:42:01 -0500 Received: from cpc79921-stkp12-2-0-cust288.10-2.cable.virginm.net ([86.16.139.33] helo=[192.168.0.18]) by imap3.hz.codethink.co.uk with esmtpsa (Exim 4.92 #3 (Debian)) id 1lKIlH-0006rS-9X; Thu, 11 Mar 2021 10:41:47 +0000 Subject: Re: [syzbot] BUG: unable to handle kernel access to user memory in schedule_tail To: Dmitry Vyukov , Alex Ghiti Cc: syzbot , Paul Walmsley , Palmer Dabbelt , Albert Ou , linux-riscv , Daniel Bristot de Oliveira , Benjamin Segall , dietmar.eggemann@arm.com, Juri Lelli , LKML , Mel Gorman , Ingo Molnar , Peter Zijlstra , Steven Rostedt , syzkaller-bugs , Vincent Guittot References: <000000000000b74f1b05bd316729@google.com> <9a0823f4-de19-c2a2-5333-41c6caadbc11@ghiti.fr> From: Ben Dooks Organization: Codethink Limited. Message-ID: <384bb562-dd57-c6c7-03d7-8e222da7c368@codethink.co.uk> Date: Thu, 11 Mar 2021 10:41:45 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 11/03/2021 06:52, Dmitry Vyukov wrote: > On Thu, Mar 11, 2021 at 7:50 AM Dmitry Vyukov wrote: >> >> On Thu, Mar 11, 2021 at 7:40 AM Alex Ghiti wrote: >>> >>> Hi Ben, >>> >>> Le 3/10/21 à 5:24 PM, Ben Dooks a écrit : >>>> On 10/03/2021 17:16, Dmitry Vyukov wrote: >>>>> On Wed, Mar 10, 2021 at 5:46 PM syzbot >>>>> wrote: >>>>>> >>>>>> Hello, >>>>>> >>>>>> syzbot found the following issue on: >>>>>> >>>>>> HEAD commit: 0d7588ab riscv: process: Fix no prototype for >>>>>> arch_dup_tas.. >>>>>> git tree: >>>>>> git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes >>>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=1212c6e6d00000 >>>>>> kernel config: >>>>>> https://syzkaller.appspot.com/x/.config?x=e3c595255fb2d136 >>>>>> dashboard link: >>>>>> https://syzkaller.appspot.com/bug?extid=e74b94fe601ab9552d69 >>>>>> userspace arch: riscv64 >>>>>> >>>>>> Unfortunately, I don't have any reproducer for this issue yet. >>>>>> >>>>>> IMPORTANT: if you fix the issue, please add the following tag to the >>>>>> commit: >>>>>> Reported-by: syzbot+e74b94fe601ab9552d69@syzkaller.appspotmail.com >>>>> >>>>> +riscv maintainers >>>>> >>>>> This is riscv64-specific. >>>>> I've seen similar crashes in put_user in other places. It looks like >>>>> put_user crashes in the user address is not mapped/protected (?). >>>> >>>> The unmapped case should have been handled. >>>> >>>> I think this issue is that the check for user-mode access added. From >>>> what I read the code may be wrong in >>>> >>>> + if (!user_mode(regs) && addr < TASK_SIZE && >>>> + unlikely(!(regs->status & SR_SUM))) >>>> + die_kernel_fault("access to user memory without uaccess routines", >>>> + addr, regs); >>>> >>>> I think the SR_SUM check might be wrong, as I read the standard the >>>> SR_SUM should be set to disable user-space access. So the check >>>> should be unlikely(regs->status & SR_SUM) to say access without >>>> having disabled the protection. >>> >>> The check that is done seems correct to me: "The SUM (permit Supervisor >>> User Memory access) bit modifies the privilege with which S-mode loads >>> and stores access virtual memory. *When SUM=0, S-mode memory accesses >>> to pages that are accessible by U-mode (U=1 in Figure 4.15) will fault*. >>> When SUM=1, these accesses are permitted.SUM has no effect when >>> page-based virtual memory is not in effect". >>> >>> I will try to reproduce the problem locally. >> >> Weird. It crashes with this all the time: >> https://syzkaller.appspot.com/bug?extid=e74b94fe601ab9552d69 >> >> Even on trivial programs that almost don't do anything. >> Maybe it's qemu bug? Do registers look sane in the dump? That SR_SUM, etc. >> >> >> 00:13:27 executing program 1: >> openat$drirender128(0xffffffffffffff9c, >> &(0x7f0000000040)='/dev/dri/renderD128\x00', 0x0, 0x0) >> >> [ 812.318182][ T4833] Unable to handle kernel access to user memory >> without uaccess routines at virtual address 00000000250b60d0 >> [ 812.322304][ T4833] Oops [#1] >> [ 812.323196][ T4833] Modules linked in: >> [ 812.324110][ T4833] CPU: 1 PID: 4833 Comm: syz-executor.1 Not >> tainted 5.12.0-rc2-syzkaller-00467-g0d7588ab9ef9 #0 >> [ 812.325862][ T4833] Hardware name: riscv-virtio,qemu (DT) >> [ 812.327561][ T4833] epc : schedule_tail+0x72/0xb2 >> [ 812.328640][ T4833] ra : schedule_tail+0x70/0xb2 >> [ 812.330088][ T4833] epc : ffffffe00008c8b0 ra : ffffffe00008c8ae sp >> : ffffffe0238bbec0 >> [ 812.331312][ T4833] gp : ffffffe005d25378 tp : ffffffe00a275b00 t0 >> : 0000000000000000 >> [ 812.333014][ T4833] t1 : 0000000000000001 t2 : 00000000000f4240 s0 >> : ffffffe0238bbee0 >> [ 812.334137][ T4833] s1 : 00000000250b60d0 a0 : 0000000000000036 a1 >> : 0000000000000003 >> [ 812.336063][ T4833] a2 : 1ffffffc0cfa8b00 a3 : ffffffe0000c80cc a4 >> : 7f467e72c6adf800 >> [ 812.337398][ T4833] a5 : 0000000000000000 a6 : 0000000000f00000 a7 >> : ffffffe0000f8c84 >> [ 812.339287][ T4833] s2 : 0000000000040000 s3 : ffffffe0077a96c0 s4 >> : ffffffe020e67fe0 >> [ 812.340658][ T4833] s5 : 0000000000004020 s6 : ffffffe0077a9b58 s7 >> : ffffffe067d74850 >> [ 812.342492][ T4833] s8 : ffffffe067d73e18 s9 : 0000000000000000 >> s10: ffffffe00bd72280 >> [ 812.343668][ T4833] s11: 000000bd067bf638 t3 : 7f467e72c6adf800 t4 >> : ffffffc403ee7fb2 >> [ 812.345510][ T4833] t5 : ffffffc403ee7fba t6 : 0000000000040000 >> [ 812.347004][ T4833] status: 0000000000000120 badaddr: >> 00000000250b60d0 cause: 000000000000000f >> [ 812.348091][ T4833] Call Trace: >> [ 812.349291][ T4833] [] schedule_tail+0x72/0xb2 >> [ 812.350796][ T4833] [] ret_from_exception+0x0/0x14 >> [ 812.352799][ T4833] Dumping ftrace buffer: >> [ 812.354328][ T4833] (ftrace buffer empty) >> [ 812.428145][ T4833] ---[ end trace 94b077e4d677ee73 ]--- >> >> >> 00:10:42 executing program 1: >> bpf$ENABLE_STATS(0x20, 0x0, 0x0) >> bpf$ENABLE_STATS(0x20, 0x0, 0x0) >> >> [ 646.536862][ T5163] loop0: detected capacity change from 0 to 1 >> [ 646.566730][ T5165] Unable to handle kernel access to user memory >> without uaccess routines at virtual address 00000000032f80d0 >> [ 646.586024][ T5165] Oops [#1] >> [ 646.586640][ T5165] Modules linked in: >> [ 646.587350][ T5165] CPU: 1 PID: 5165 Comm: syz-executor.1 Not >> tainted 5.12.0-rc2-syzkaller-00467-g0d7588ab9ef9 #0 >> [ 646.588209][ T5165] Hardware name: riscv-virtio,qemu (DT) >> [ 646.589019][ T5165] epc : schedule_tail+0x72/0xb2 >> [ 646.589811][ T5165] ra : schedule_tail+0x70/0xb2 >> [ 646.590435][ T5165] epc : ffffffe00008c8b0 ra : ffffffe00008c8ae sp >> : ffffffe008013ec0 >> [ 646.591142][ T5165] gp : ffffffe005d25378 tp : ffffffe007634440 t0 >> : 0000000000000000 >> [ 646.591836][ T5165] t1 : 0000000000000001 t2 : 0000000000000008 s0 >> : ffffffe008013ee0 >> [ 646.592509][ T5165] s1 : 00000000032f80d0 a0 : 0000000000000004 a1 >> : 0000000000000003 >> [ 646.593188][ T5165] a2 : 1ffffffc0cfac500 a3 : ffffffe0000c80cc a4 >> : 8d229faaffda9500 >> [ 646.593878][ T5165] a5 : 0000000000000000 a6 : 0000000000f00000 a7 >> : ffffffe000082eba >> [ 646.594552][ T5165] s2 : 0000000000040000 s3 : ffffffe00c82c440 s4 >> : ffffffe00e61ffe0 >> [ 646.595253][ T5165] s5 : 0000000000004000 s6 : ffffffe067d57e00 s7 >> : ffffffe067d57850 >> [ 646.595938][ T5165] s8 : ffffffe067d56e18 s9 : ffffffe067d57e00 >> s10: ffffffe00c82c878 >> [ 646.596627][ T5165] s11: 000000967ba7a1cc t3 : 8d229faaffda9500 t4 >> : ffffffc4011bc79b >> [ 646.597319][ T5165] t5 : ffffffc4011bc79d t6 : ffffffe008de3ce8 >> [ 646.597909][ T5165] status: 0000000000000120 badaddr: >> 00000000032f80d0 cause: 000000000000000f >> [ 646.598682][ T5165] Call Trace: >> [ 646.599294][ T5165] [] schedule_tail+0x72/0xb2 >> [ 646.600115][ T5165] [] ret_from_exception+0x0/0x14 >> [ 646.601333][ T5165] Dumping ftrace buffer: >> [ 646.602322][ T5165] (ftrace buffer empty) >> [ 646.663691][ T5165] ---[ end trace e7b7847ce74cdfca ]--- > > Is it reasonable that schedule_tail is called from ret_from_exception? > Maybe the issue is in ret_from_exception? I see it does something with > registers. I'd not noticed this with an earlier kernel (5.10 and the user-fault check patches) but this may be an qemu issue? -- Ben Dooks http://www.codethink.co.uk/ Senior Engineer Codethink - Providing Genius https://www.codethink.co.uk/privacy.html From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.5 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D95EC433E6 for ; Thu, 11 Mar 2021 10:42:26 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 38A7A64FC1 for ; Thu, 11 Mar 2021 10:42:25 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 38A7A64FC1 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=codethink.co.uk Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:Date:Message-ID:From: References:Cc:To:Subject:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=pTaBfyWZAFtwOrBdSlXRfwukYz7URrSHuunYQSjzDlc=; b=NemuF6Sh5yIaSMkZC1GtfS2m0 Z7NMvPDd5jaLkxlOleoyS8T219/xOqaCsmmo7Qg+1CGgk+9m3KHV1Xph16qAaObUsSQBRCIXEXF0G /vZr/PaWAGTBGVYzZHY453rxVk+MY2HjCvbzNZu2k6ZOzDlsEZiaBmHgyVDFjBaPROnp65XCKpOjp avwfXcs7ybS6sGQSbytPnlWuMV8V9NfA525RHfUheX/aZQ+6QRGFiEqolCTowtnJoHTL1cA2jiR9B QV7UHJghgKtFuOxtzAaQMp/DcxMfyA85daP1xkAthliyIs9MCudwXhAf8G/apeAzj1ELMipXDgP0+ B96EfqItA==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lKIlf-008rEB-7T; Thu, 11 Mar 2021 10:42:11 +0000 Received: from imap3.hz.codethink.co.uk ([176.9.8.87]) by desiato.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lKIlX-008rCO-Gk for linux-riscv@lists.infradead.org; Thu, 11 Mar 2021 10:42:06 +0000 Received: from cpc79921-stkp12-2-0-cust288.10-2.cable.virginm.net ([86.16.139.33] helo=[192.168.0.18]) by imap3.hz.codethink.co.uk with esmtpsa (Exim 4.92 #3 (Debian)) id 1lKIlH-0006rS-9X; Thu, 11 Mar 2021 10:41:47 +0000 Subject: Re: [syzbot] BUG: unable to handle kernel access to user memory in schedule_tail To: Dmitry Vyukov , Alex Ghiti Cc: syzbot , Paul Walmsley , Palmer Dabbelt , Albert Ou , linux-riscv , Daniel Bristot de Oliveira , Benjamin Segall , dietmar.eggemann@arm.com, Juri Lelli , LKML , Mel Gorman , Ingo Molnar , Peter Zijlstra , Steven Rostedt , syzkaller-bugs , Vincent Guittot References: <000000000000b74f1b05bd316729@google.com> <9a0823f4-de19-c2a2-5333-41c6caadbc11@ghiti.fr> From: Ben Dooks Organization: Codethink Limited. Message-ID: <384bb562-dd57-c6c7-03d7-8e222da7c368@codethink.co.uk> Date: Thu, 11 Mar 2021 10:41:45 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.8.0 MIME-Version: 1.0 In-Reply-To: Content-Language: en-GB X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210311_104203_630656_713F0051 X-CRM114-Status: GOOD ( 21.90 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org T24gMTEvMDMvMjAyMSAwNjo1MiwgRG1pdHJ5IFZ5dWtvdiB3cm90ZToKPiBPbiBUaHUsIE1hciAx MSwgMjAyMSBhdCA3OjUwIEFNIERtaXRyeSBWeXVrb3YgPGR2eXVrb3ZAZ29vZ2xlLmNvbT4gd3Jv dGU6Cj4+Cj4+IE9uIFRodSwgTWFyIDExLCAyMDIxIGF0IDc6NDAgQU0gQWxleCBHaGl0aSA8YWxl eEBnaGl0aS5mcj4gd3JvdGU6Cj4+Pgo+Pj4gSGkgQmVuLAo+Pj4KPj4+IExlIDMvMTAvMjEgw6Ag NToyNCBQTSwgQmVuIERvb2tzIGEgw6ljcml0IDoKPj4+PiBPbiAxMC8wMy8yMDIxIDE3OjE2LCBE bWl0cnkgVnl1a292IHdyb3RlOgo+Pj4+PiBPbiBXZWQsIE1hciAxMCwgMjAyMSBhdCA1OjQ2IFBN IHN5emJvdAo+Pj4+PiA8c3l6Ym90K2U3NGI5NGZlNjAxYWI5NTUyZDY5QHN5emthbGxlci5hcHBz cG90bWFpbC5jb20+IHdyb3RlOgo+Pj4+Pj4KPj4+Pj4+IEhlbGxvLAo+Pj4+Pj4KPj4+Pj4+IHN5 emJvdCBmb3VuZCB0aGUgZm9sbG93aW5nIGlzc3VlIG9uOgo+Pj4+Pj4KPj4+Pj4+IEhFQUQgY29t bWl0OiAgICAwZDc1ODhhYiByaXNjdjogcHJvY2VzczogRml4IG5vIHByb3RvdHlwZSBmb3IKPj4+ Pj4+IGFyY2hfZHVwX3Rhcy4uCj4+Pj4+PiBnaXQgdHJlZToKPj4+Pj4+IGdpdDovL2dpdC5rZXJu ZWwub3JnL3B1Yi9zY20vbGludXgva2VybmVsL2dpdC9yaXNjdi9saW51eC5naXQgZml4ZXMKPj4+ Pj4+IGNvbnNvbGUgb3V0cHV0OiBodHRwczovL3N5emthbGxlci5hcHBzcG90LmNvbS94L2xvZy50 eHQ/eD0xMjEyYzZlNmQwMDAwMAo+Pj4+Pj4ga2VybmVsIGNvbmZpZzoKPj4+Pj4+IGh0dHBzOi8v c3l6a2FsbGVyLmFwcHNwb3QuY29tL3gvLmNvbmZpZz94PWUzYzU5NTI1NWZiMmQxMzYKPj4+Pj4+ IGRhc2hib2FyZCBsaW5rOgo+Pj4+Pj4gaHR0cHM6Ly9zeXprYWxsZXIuYXBwc3BvdC5jb20vYnVn P2V4dGlkPWU3NGI5NGZlNjAxYWI5NTUyZDY5Cj4+Pj4+PiB1c2Vyc3BhY2UgYXJjaDogcmlzY3Y2 NAo+Pj4+Pj4KPj4+Pj4+IFVuZm9ydHVuYXRlbHksIEkgZG9uJ3QgaGF2ZSBhbnkgcmVwcm9kdWNl ciBmb3IgdGhpcyBpc3N1ZSB5ZXQuCj4+Pj4+Pgo+Pj4+Pj4gSU1QT1JUQU5UOiBpZiB5b3UgZml4 IHRoZSBpc3N1ZSwgcGxlYXNlIGFkZCB0aGUgZm9sbG93aW5nIHRhZyB0byB0aGUKPj4+Pj4+IGNv bW1pdDoKPj4+Pj4+IFJlcG9ydGVkLWJ5OiBzeXpib3QrZTc0Yjk0ZmU2MDFhYjk1NTJkNjlAc3l6 a2FsbGVyLmFwcHNwb3RtYWlsLmNvbQo+Pj4+Pgo+Pj4+PiArcmlzY3YgbWFpbnRhaW5lcnMKPj4+ Pj4KPj4+Pj4gVGhpcyBpcyByaXNjdjY0LXNwZWNpZmljLgo+Pj4+PiBJJ3ZlIHNlZW4gc2ltaWxh ciBjcmFzaGVzIGluIHB1dF91c2VyIGluIG90aGVyIHBsYWNlcy4gSXQgbG9va3MgbGlrZQo+Pj4+ PiBwdXRfdXNlciBjcmFzaGVzIGluIHRoZSB1c2VyIGFkZHJlc3MgaXMgbm90IG1hcHBlZC9wcm90 ZWN0ZWQgKD8pLgo+Pj4+Cj4+Pj4gVGhlIHVubWFwcGVkIGNhc2Ugc2hvdWxkIGhhdmUgYmVlbiBo YW5kbGVkLgo+Pj4+Cj4+Pj4gSSB0aGluayB0aGlzIGlzc3VlIGlzIHRoYXQgdGhlIGNoZWNrIGZv ciB1c2VyLW1vZGUgYWNjZXNzIGFkZGVkLiBGcm9tCj4+Pj4gd2hhdCBJIHJlYWQgdGhlIGNvZGUg bWF5IGJlIHdyb25nIGluCj4+Pj4KPj4+PiArICAgIGlmICghdXNlcl9tb2RlKHJlZ3MpICYmIGFk ZHIgPCBUQVNLX1NJWkUgJiYKPj4+PiArICAgICAgICAgICAgdW5saWtlbHkoIShyZWdzLT5zdGF0 dXMgJiBTUl9TVU0pKSkKPj4+PiArICAgICAgICBkaWVfa2VybmVsX2ZhdWx0KCJhY2Nlc3MgdG8g dXNlciBtZW1vcnkgd2l0aG91dCB1YWNjZXNzIHJvdXRpbmVzIiwKPj4+PiArICAgICAgICAgICAg ICAgIGFkZHIsIHJlZ3MpOwo+Pj4+Cj4+Pj4gSSB0aGluayB0aGUgU1JfU1VNIGNoZWNrIG1pZ2h0 IGJlIHdyb25nLCBhcyBJIHJlYWQgdGhlIHN0YW5kYXJkIHRoZQo+Pj4+IFNSX1NVTSBzaG91bGQg YmUgc2V0IHRvIGRpc2FibGUgdXNlci1zcGFjZSBhY2Nlc3MuIFNvIHRoZSBjaGVjawo+Pj4+IHNo b3VsZCBiZSB1bmxpa2VseShyZWdzLT5zdGF0dXMgJiBTUl9TVU0pIHRvIHNheSBhY2Nlc3Mgd2l0 aG91dAo+Pj4+IGhhdmluZyBkaXNhYmxlZCB0aGUgcHJvdGVjdGlvbi4KPj4+Cj4+PiBUaGUgY2hl Y2sgdGhhdCBpcyBkb25lIHNlZW1zIGNvcnJlY3QgdG8gbWU6ICJUaGUgU1VNIChwZXJtaXQgU3Vw ZXJ2aXNvcgo+Pj4gVXNlciBNZW1vcnkgYWNjZXNzKSBiaXQgbW9kaWZpZXMgdGhlIHByaXZpbGVn ZSB3aXRoIHdoaWNoIFMtbW9kZSBsb2Fkcwo+Pj4gYW5kIHN0b3JlcyBhY2Nlc3MgdmlydHVhbCBt ZW1vcnkuICAqV2hlbiBTVU09MCwgUy1tb2RlIG1lbW9yeSBhY2Nlc3Nlcwo+Pj4gdG8gcGFnZXMg dGhhdCBhcmUgYWNjZXNzaWJsZSBieSBVLW1vZGUgKFU9MSBpbiBGaWd1cmUgNC4xNSkgd2lsbCBm YXVsdCouCj4+PiAgICBXaGVuIFNVTT0xLCB0aGVzZSBhY2Nlc3NlcyBhcmUgcGVybWl0dGVkLlNV TSAgaGFzICBubyAgZWZmZWN0ICB3aGVuCj4+PiBwYWdlLWJhc2VkICB2aXJ0dWFsICBtZW1vcnkg IGlzICBub3QgIGluICBlZmZlY3QiLgo+Pj4KPj4+IEkgd2lsbCB0cnkgdG8gcmVwcm9kdWNlIHRo ZSBwcm9ibGVtIGxvY2FsbHkuCj4+Cj4+IFdlaXJkLiBJdCBjcmFzaGVzIHdpdGggdGhpcyBhbGwg dGhlIHRpbWU6Cj4+IGh0dHBzOi8vc3l6a2FsbGVyLmFwcHNwb3QuY29tL2J1Zz9leHRpZD1lNzRi OTRmZTYwMWFiOTU1MmQ2OQo+Pgo+PiBFdmVuIG9uIHRyaXZpYWwgcHJvZ3JhbXMgdGhhdCBhbG1v c3QgZG9uJ3QgZG8gYW55dGhpbmcuCj4+IE1heWJlIGl0J3MgcWVtdSBidWc/IERvIHJlZ2lzdGVy cyBsb29rIHNhbmUgaW4gdGhlIGR1bXA/IFRoYXQgU1JfU1VNLCBldGMuCj4+Cj4+Cj4+IDAwOjEz OjI3IGV4ZWN1dGluZyBwcm9ncmFtIDE6Cj4+IG9wZW5hdCRkcmlyZW5kZXIxMjgoMHhmZmZmZmZm ZmZmZmZmZjljLAo+PiAmKDB4N2YwMDAwMDAwMDQwKT0nL2Rldi9kcmkvcmVuZGVyRDEyOFx4MDAn LCAweDAsIDB4MCkKPj4KPj4gWyAgODEyLjMxODE4Ml1bIFQ0ODMzXSBVbmFibGUgdG8gaGFuZGxl IGtlcm5lbCBhY2Nlc3MgdG8gdXNlciBtZW1vcnkKPj4gd2l0aG91dCB1YWNjZXNzIHJvdXRpbmVz IGF0IHZpcnR1YWwgYWRkcmVzcyAwMDAwMDAwMDI1MGI2MGQwCj4+IFsgIDgxMi4zMjIzMDRdWyBU NDgzM10gT29wcyBbIzFdCj4+IFsgIDgxMi4zMjMxOTZdWyBUNDgzM10gTW9kdWxlcyBsaW5rZWQg aW46Cj4+IFsgIDgxMi4zMjQxMTBdWyBUNDgzM10gQ1BVOiAxIFBJRDogNDgzMyBDb21tOiBzeXot ZXhlY3V0b3IuMSBOb3QKPj4gdGFpbnRlZCA1LjEyLjAtcmMyLXN5emthbGxlci0wMDQ2Ny1nMGQ3 NTg4YWI5ZWY5ICMwCj4+IFsgIDgxMi4zMjU4NjJdWyBUNDgzM10gSGFyZHdhcmUgbmFtZTogcmlz Y3YtdmlydGlvLHFlbXUgKERUKQo+PiBbICA4MTIuMzI3NTYxXVsgVDQ4MzNdIGVwYyA6IHNjaGVk dWxlX3RhaWwrMHg3Mi8weGIyCj4+IFsgIDgxMi4zMjg2NDBdWyBUNDgzM10gIHJhIDogc2NoZWR1 bGVfdGFpbCsweDcwLzB4YjIKPj4gWyAgODEyLjMzMDA4OF1bIFQ0ODMzXSBlcGMgOiBmZmZmZmZl MDAwMDhjOGIwIHJhIDogZmZmZmZmZTAwMDA4YzhhZSBzcAo+PiA6IGZmZmZmZmUwMjM4YmJlYzAK Pj4gWyAgODEyLjMzMTMxMl1bIFQ0ODMzXSAgZ3AgOiBmZmZmZmZlMDA1ZDI1Mzc4IHRwIDogZmZm ZmZmZTAwYTI3NWIwMCB0MAo+PiA6IDAwMDAwMDAwMDAwMDAwMDAKPj4gWyAgODEyLjMzMzAxNF1b IFQ0ODMzXSAgdDEgOiAwMDAwMDAwMDAwMDAwMDAxIHQyIDogMDAwMDAwMDAwMDBmNDI0MCBzMAo+ PiA6IGZmZmZmZmUwMjM4YmJlZTAKPj4gWyAgODEyLjMzNDEzN11bIFQ0ODMzXSAgczEgOiAwMDAw MDAwMDI1MGI2MGQwIGEwIDogMDAwMDAwMDAwMDAwMDAzNiBhMQo+PiA6IDAwMDAwMDAwMDAwMDAw MDMKPj4gWyAgODEyLjMzNjA2M11bIFQ0ODMzXSAgYTIgOiAxZmZmZmZmYzBjZmE4YjAwIGEzIDog ZmZmZmZmZTAwMDBjODBjYyBhNAo+PiA6IDdmNDY3ZTcyYzZhZGY4MDAKPj4gWyAgODEyLjMzNzM5 OF1bIFQ0ODMzXSAgYTUgOiAwMDAwMDAwMDAwMDAwMDAwIGE2IDogMDAwMDAwMDAwMGYwMDAwMCBh Nwo+PiA6IGZmZmZmZmUwMDAwZjhjODQKPj4gWyAgODEyLjMzOTI4N11bIFQ0ODMzXSAgczIgOiAw MDAwMDAwMDAwMDQwMDAwIHMzIDogZmZmZmZmZTAwNzdhOTZjMCBzNAo+PiA6IGZmZmZmZmUwMjBl NjdmZTAKPj4gWyAgODEyLjM0MDY1OF1bIFQ0ODMzXSAgczUgOiAwMDAwMDAwMDAwMDA0MDIwIHM2 IDogZmZmZmZmZTAwNzdhOWI1OCBzNwo+PiA6IGZmZmZmZmUwNjdkNzQ4NTAKPj4gWyAgODEyLjM0 MjQ5Ml1bIFQ0ODMzXSAgczggOiBmZmZmZmZlMDY3ZDczZTE4IHM5IDogMDAwMDAwMDAwMDAwMDAw MAo+PiBzMTA6IGZmZmZmZmUwMGJkNzIyODAKPj4gWyAgODEyLjM0MzY2OF1bIFQ0ODMzXSAgczEx OiAwMDAwMDBiZDA2N2JmNjM4IHQzIDogN2Y0NjdlNzJjNmFkZjgwMCB0NAo+PiA6IGZmZmZmZmM0 MDNlZTdmYjIKPj4gWyAgODEyLjM0NTUxMF1bIFQ0ODMzXSAgdDUgOiBmZmZmZmZjNDAzZWU3ZmJh IHQ2IDogMDAwMDAwMDAwMDA0MDAwMAo+PiBbICA4MTIuMzQ3MDA0XVsgVDQ4MzNdIHN0YXR1czog MDAwMDAwMDAwMDAwMDEyMCBiYWRhZGRyOgo+PiAwMDAwMDAwMDI1MGI2MGQwIGNhdXNlOiAwMDAw MDAwMDAwMDAwMDBmCj4+IFsgIDgxMi4zNDgwOTFdWyBUNDgzM10gQ2FsbCBUcmFjZToKPj4gWyAg ODEyLjM0OTI5MV1bIFQ0ODMzXSBbPGZmZmZmZmUwMDAwOGM4YjA+XSBzY2hlZHVsZV90YWlsKzB4 NzIvMHhiMgo+PiBbICA4MTIuMzUwNzk2XVsgVDQ4MzNdIFs8ZmZmZmZmZTAwMDAwNTU3MD5dIHJl dF9mcm9tX2V4Y2VwdGlvbisweDAvMHgxNAo+PiBbICA4MTIuMzUyNzk5XVsgVDQ4MzNdIER1bXBp bmcgZnRyYWNlIGJ1ZmZlcjoKPj4gWyAgODEyLjM1NDMyOF1bIFQ0ODMzXSAgICAoZnRyYWNlIGJ1 ZmZlciBlbXB0eSkKPj4gWyAgODEyLjQyODE0NV1bIFQ0ODMzXSAtLS1bIGVuZCB0cmFjZSA5NGIw NzdlNGQ2NzdlZTczIF0tLS0KPj4KPj4KPj4gMDA6MTA6NDIgZXhlY3V0aW5nIHByb2dyYW0gMToK Pj4gYnBmJEVOQUJMRV9TVEFUUygweDIwLCAweDAsIDB4MCkKPj4gYnBmJEVOQUJMRV9TVEFUUygw eDIwLCAweDAsIDB4MCkKPj4KPj4gWyAgNjQ2LjUzNjg2Ml1bIFQ1MTYzXSBsb29wMDogZGV0ZWN0 ZWQgY2FwYWNpdHkgY2hhbmdlIGZyb20gMCB0byAxCj4+IFsgIDY0Ni41NjY3MzBdWyBUNTE2NV0g VW5hYmxlIHRvIGhhbmRsZSBrZXJuZWwgYWNjZXNzIHRvIHVzZXIgbWVtb3J5Cj4+IHdpdGhvdXQg dWFjY2VzcyByb3V0aW5lcyBhdCB2aXJ0dWFsIGFkZHJlc3MgMDAwMDAwMDAwMzJmODBkMAo+PiBb ICA2NDYuNTg2MDI0XVsgVDUxNjVdIE9vcHMgWyMxXQo+PiBbICA2NDYuNTg2NjQwXVsgVDUxNjVd IE1vZHVsZXMgbGlua2VkIGluOgo+PiBbICA2NDYuNTg3MzUwXVsgVDUxNjVdIENQVTogMSBQSUQ6 IDUxNjUgQ29tbTogc3l6LWV4ZWN1dG9yLjEgTm90Cj4+IHRhaW50ZWQgNS4xMi4wLXJjMi1zeXpr YWxsZXItMDA0NjctZzBkNzU4OGFiOWVmOSAjMAo+PiBbICA2NDYuNTg4MjA5XVsgVDUxNjVdIEhh cmR3YXJlIG5hbWU6IHJpc2N2LXZpcnRpbyxxZW11IChEVCkKPj4gWyAgNjQ2LjU4OTAxOV1bIFQ1 MTY1XSBlcGMgOiBzY2hlZHVsZV90YWlsKzB4NzIvMHhiMgo+PiBbICA2NDYuNTg5ODExXVsgVDUx NjVdICByYSA6IHNjaGVkdWxlX3RhaWwrMHg3MC8weGIyCj4+IFsgIDY0Ni41OTA0MzVdWyBUNTE2 NV0gZXBjIDogZmZmZmZmZTAwMDA4YzhiMCByYSA6IGZmZmZmZmUwMDAwOGM4YWUgc3AKPj4gOiBm ZmZmZmZlMDA4MDEzZWMwCj4+IFsgIDY0Ni41OTExNDJdWyBUNTE2NV0gIGdwIDogZmZmZmZmZTAw NWQyNTM3OCB0cCA6IGZmZmZmZmUwMDc2MzQ0NDAgdDAKPj4gOiAwMDAwMDAwMDAwMDAwMDAwCj4+ IFsgIDY0Ni41OTE4MzZdWyBUNTE2NV0gIHQxIDogMDAwMDAwMDAwMDAwMDAwMSB0MiA6IDAwMDAw MDAwMDAwMDAwMDggczAKPj4gOiBmZmZmZmZlMDA4MDEzZWUwCj4+IFsgIDY0Ni41OTI1MDldWyBU NTE2NV0gIHMxIDogMDAwMDAwMDAwMzJmODBkMCBhMCA6IDAwMDAwMDAwMDAwMDAwMDQgYTEKPj4g OiAwMDAwMDAwMDAwMDAwMDAzCj4+IFsgIDY0Ni41OTMxODhdWyBUNTE2NV0gIGEyIDogMWZmZmZm ZmMwY2ZhYzUwMCBhMyA6IGZmZmZmZmUwMDAwYzgwY2MgYTQKPj4gOiA4ZDIyOWZhYWZmZGE5NTAw Cj4+IFsgIDY0Ni41OTM4NzhdWyBUNTE2NV0gIGE1IDogMDAwMDAwMDAwMDAwMDAwMCBhNiA6IDAw MDAwMDAwMDBmMDAwMDAgYTcKPj4gOiBmZmZmZmZlMDAwMDgyZWJhCj4+IFsgIDY0Ni41OTQ1NTJd WyBUNTE2NV0gIHMyIDogMDAwMDAwMDAwMDA0MDAwMCBzMyA6IGZmZmZmZmUwMGM4MmM0NDAgczQK Pj4gOiBmZmZmZmZlMDBlNjFmZmUwCj4+IFsgIDY0Ni41OTUyNTNdWyBUNTE2NV0gIHM1IDogMDAw MDAwMDAwMDAwNDAwMCBzNiA6IGZmZmZmZmUwNjdkNTdlMDAgczcKPj4gOiBmZmZmZmZlMDY3ZDU3 ODUwCj4+IFsgIDY0Ni41OTU5MzhdWyBUNTE2NV0gIHM4IDogZmZmZmZmZTA2N2Q1NmUxOCBzOSA6 IGZmZmZmZmUwNjdkNTdlMDAKPj4gczEwOiBmZmZmZmZlMDBjODJjODc4Cj4+IFsgIDY0Ni41OTY2 MjddWyBUNTE2NV0gIHMxMTogMDAwMDAwOTY3YmE3YTFjYyB0MyA6IDhkMjI5ZmFhZmZkYTk1MDAg dDQKPj4gOiBmZmZmZmZjNDAxMWJjNzliCj4+IFsgIDY0Ni41OTczMTldWyBUNTE2NV0gIHQ1IDog ZmZmZmZmYzQwMTFiYzc5ZCB0NiA6IGZmZmZmZmUwMDhkZTNjZTgKPj4gWyAgNjQ2LjU5NzkwOV1b IFQ1MTY1XSBzdGF0dXM6IDAwMDAwMDAwMDAwMDAxMjAgYmFkYWRkcjoKPj4gMDAwMDAwMDAwMzJm ODBkMCBjYXVzZTogMDAwMDAwMDAwMDAwMDAwZgo+PiBbICA2NDYuNTk4NjgyXVsgVDUxNjVdIENh bGwgVHJhY2U6Cj4+IFsgIDY0Ni41OTkyOTRdWyBUNTE2NV0gWzxmZmZmZmZlMDAwMDhjOGIwPl0g c2NoZWR1bGVfdGFpbCsweDcyLzB4YjIKPj4gWyAgNjQ2LjYwMDExNV1bIFQ1MTY1XSBbPGZmZmZm ZmUwMDAwMDU1NzA+XSByZXRfZnJvbV9leGNlcHRpb24rMHgwLzB4MTQKPj4gWyAgNjQ2LjYwMTMz M11bIFQ1MTY1XSBEdW1waW5nIGZ0cmFjZSBidWZmZXI6Cj4+IFsgIDY0Ni42MDIzMjJdWyBUNTE2 NV0gICAgKGZ0cmFjZSBidWZmZXIgZW1wdHkpCj4+IFsgIDY0Ni42NjM2OTFdWyBUNTE2NV0gLS0t WyBlbmQgdHJhY2UgZTdiNzg0N2NlNzRjZGZjYSBdLS0tCj4gCj4gSXMgaXQgcmVhc29uYWJsZSB0 aGF0IHNjaGVkdWxlX3RhaWwgaXMgY2FsbGVkIGZyb20gcmV0X2Zyb21fZXhjZXB0aW9uPwo+IE1h eWJlIHRoZSBpc3N1ZSBpcyBpbiByZXRfZnJvbV9leGNlcHRpb24/IEkgc2VlIGl0IGRvZXMgc29t ZXRoaW5nIHdpdGgKPiByZWdpc3RlcnMuCgpJJ2Qgbm90IG5vdGljZWQgdGhpcyB3aXRoIGFuIGVh cmxpZXIga2VybmVsICg1LjEwIGFuZCB0aGUgdXNlci1mYXVsdApjaGVjayBwYXRjaGVzKSBidXQg dGhpcyBtYXkgYmUgYW4gcWVtdSBpc3N1ZT8KCgotLSAKQmVuIERvb2tzCQkJCWh0dHA6Ly93d3cu Y29kZXRoaW5rLmNvLnVrLwpTZW5pb3IgRW5naW5lZXIJCQkJQ29kZXRoaW5rIC0gUHJvdmlkaW5n IEdlbml1cwoKaHR0cHM6Ly93d3cuY29kZXRoaW5rLmNvLnVrL3ByaXZhY3kuaHRtbAoKX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KbGludXgtcmlzY3YgbWFp bGluZyBsaXN0CmxpbnV4LXJpc2N2QGxpc3RzLmluZnJhZGVhZC5vcmcKaHR0cDovL2xpc3RzLmlu ZnJhZGVhZC5vcmcvbWFpbG1hbi9saXN0aW5mby9saW51eC1yaXNjdgo=