| // BUG: unable to handle kernel paging request in coalesced_mmio_write |
| // https://syzkaller.appspot.com/bug?id=99c7fd1372771e04077703cd8ab0822d1af20f7a |
| // status:open |
| // autogenerated by syzkaller (https://github.com/google/syzkaller) |
| |
| #define _GNU_SOURCE |
| |
| #include <endian.h> |
| #include <errno.h> |
| #include <fcntl.h> |
| #include <setjmp.h> |
| #include <signal.h> |
| #include <stdarg.h> |
| #include <stddef.h> |
| #include <stdint.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <sys/ioctl.h> |
| #include <sys/stat.h> |
| #include <sys/syscall.h> |
| #include <sys/types.h> |
| #include <unistd.h> |
| |
| #include <linux/kvm.h> |
| |
| static __thread int skip_segv; |
| static __thread jmp_buf segv_env; |
| |
| static void segv_handler(int sig, siginfo_t* info, void* ctx) |
| { |
| uintptr_t addr = (uintptr_t)info->si_addr; |
| const uintptr_t prog_start = 1 << 20; |
| const uintptr_t prog_end = 100 << 20; |
| if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && |
| (addr < prog_start || addr > prog_end)) { |
| _longjmp(segv_env, 1); |
| } |
| exit(sig); |
| } |
| |
| static void install_segv_handler(void) |
| { |
| struct sigaction sa; |
| memset(&sa, 0, sizeof(sa)); |
| sa.sa_handler = SIG_IGN; |
| syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); |
| syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); |
| memset(&sa, 0, sizeof(sa)); |
| sa.sa_sigaction = segv_handler; |
| sa.sa_flags = SA_NODEFER | SA_SIGINFO; |
| sigaction(SIGSEGV, &sa, NULL); |
| sigaction(SIGBUS, &sa, NULL); |
| } |
| |
| #define NONFAILING(...) \ |
| { \ |
| __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ |
| if (_setjmp(segv_env) == 0) { \ |
| __VA_ARGS__; \ |
| } \ |
| __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ |
| } |
| |
| const char kvm_asm16_cpl3[] = "\x0f\x20\xc0\x66\x83\xc8\x01\x0f\x22\xc0\xb8\xa0" |
| "\x00\x0f\x00\xd8\xb8\x2b\x00\x8e\xd8\x8e\xc0\x8e" |
| "\xe0\x8e\xe8\xbc\x00\x01\xc7\x06\x00\x01\x1d\xba" |
| "\xc7\x06\x02\x01\x23\x00\xc7\x06\x04\x01\x00\x01" |
| "\xc7\x06\x06\x01\x2b\x00\xcb"; |
| const char kvm_asm32_paged[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0"; |
| const char kvm_asm32_vm86[] = |
| "\x66\xb8\xb8\x00\x0f\x00\xd8\xea\x00\x00\x00\x00\xd0\x00"; |
| const char kvm_asm32_paged_vm86[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22" |
| "\xc0\x66\xb8\xb8\x00\x0f\x00\xd8\xea\x00" |
| "\x00\x00\x00\xd0\x00"; |
| const char kvm_asm64_enable_long[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22" |
| "\xc0\xea\xde\xc0\xad\x0b\x50\x00\x48\xc7" |
| "\xc0\xd8\x00\x00\x00\x0f\x00\xd8"; |
| const char kvm_asm64_init_vm[] = |
| "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\xea\xde\xc0\xad\x0b\x50\x00" |
| "\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x00\xd8\x48\xc7\xc1\x3a\x00\x00\x00\x0f" |
| "\x32\x48\x83\xc8\x05\x0f\x30\x0f\x20\xe0\x48\x0d\x00\x20\x00\x00\x0f\x22" |
| "\xe0\x48\xc7\xc1\x80\x04\x00\x00\x0f\x32\x48\xc7\xc2\x00\x60\x00\x00\x89" |
| "\x02\x48\xc7\xc2\x00\x70\x00\x00\x89\x02\x48\xc7\xc0\x00\x5f\x00\x00\xf3" |
| "\x0f\xc7\x30\x48\xc7\xc0\x08\x5f\x00\x00\x66\x0f\xc7\x30\x0f\xc7\x30\x48" |
| "\xc7\xc1\x81\x04\x00\x00\x0f\x32\x48\x83\xc8\x3f\x48\x21\xd0\x48\xc7\xc2" |
| "\x00\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x40\x00\x00\x48\xb8\x84\x9e" |
| "\x99\xf3\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x40\x00\x00\x48\xc7" |
| "\xc0\x81\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x83\x04\x00\x00\x0f\x32\x48" |
| "\x0d\xff\x6f\x03\x00\x48\x21\xd0\x48\xc7\xc2\x0c\x40\x00\x00\x0f\x79\xd0" |
| "\x48\xc7\xc1\x84\x04\x00\x00\x0f\x32\x48\x0d\xff\x17\x00\x00\x48\x21\xd0" |
| "\x48\xc7\xc2\x12\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x2c\x00\x00\x48" |
| "\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x28\x00\x00\x48\xc7" |
| "\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x02\x0c\x00\x00\x48\xc7\xc0" |
| "\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc0\x58\x00\x00\x00\x48\xc7\xc2\x00" |
| "\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x0c\x00\x00\x0f\x79\xd0\x48\xc7" |
| "\xc2\x06\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x0c\x00\x00\x0f\x79\xd0" |
| "\x48\xc7\xc2\x0a\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc0\xd8\x00\x00\x00\x48" |
| "\xc7\xc2\x0c\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x2c\x00\x00\x48\xc7" |
| "\xc0\x00\x05\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x4c\x00\x00\x48\xc7\xc0" |
| "\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x6c\x00\x00\x48\xc7\xc0\x00" |
| "\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x6c\x00\x00\x48\xc7\xc0\x00\x00" |
| "\x00\x00\x0f\x79\xd0\x0f\x20\xc0\x48\xc7\xc2\x00\x6c\x00\x00\x48\x89\xc0" |
| "\x0f\x79\xd0\x0f\x20\xd8\x48\xc7\xc2\x02\x6c\x00\x00\x48\x89\xc0\x0f\x79" |
| "\xd0\x0f\x20\xe0\x48\xc7\xc2\x04\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48" |
| "\xc7\xc2\x06\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7" |
| "\xc2\x08\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2" |
| "\x0a\x6c\x00\x00\x48\xc7\xc0\x00\x3a\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c" |
| "\x6c\x00\x00\x48\xc7\xc0\x00\x10\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x6c" |
| "\x00\x00\x48\xc7\xc0\x00\x38\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x6c\x00" |
| "\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x6c\x00\x00" |
| "\x48\x8b\x04\x25\x10\x5f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x00\x00\x00" |
| "\x48\xc7\xc0\x01\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x00\x00\x00\x48" |
| "\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x20\x00\x00\x48\xc7" |
| "\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x20\x00\x00\x48\xc7\xc0" |
| "\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x20\x00\x00\x48\xc7\xc0\x00" |
| "\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x20\x00\x00\x48\xc7\xc0\x00\x00" |
| "\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x77\x02\x00\x00\x0f\x32\x48\xc1\xe2\x20" |
| "\x48\x09\xd0\x48\xc7\xc2\x00\x2c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48\xc7" |
| "\xc2\x04\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2" |
| "\x0a\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e" |
| "\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x40" |
| "\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x40\x00" |
| "\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x40\x00\x00" |
| "\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x60\x00\x00\x48" |
| "\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x02\x60\x00\x00\x48\xc7" |
| "\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x1c\x20\x00\x00\x48\xc7\xc0" |
| "\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x20\x00\x00\x48\xc7\xc0\x00" |
| "\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x20\x00\x00\x48\xc7\xc0\x00\x00" |
| "\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x22\x20\x00\x00\x48\xc7\xc0\x00\x00\x00" |
| "\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00" |
| "\x0f\x79\xd0\x48\xc7\xc2\x02\x08\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f" |
| "\x79\xd0\x48\xc7\xc2\x04\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79" |
| "\xd0\x48\xc7\xc2\x06\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0" |
| "\x48\xc7\xc2\x08\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48" |
| "\xc7\xc2\x0a\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7" |
| "\xc2\x0c\x08\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2" |
| "\x0e\x08\x00\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12" |
| "\x68\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x68" |
| "\x00\x00\x48\xc7\xc0\x00\x3a\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x68\x00" |
| "\x00\x48\xc7\xc0\x00\x10\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x18\x68\x00\x00" |
| "\x48\xc7\xc0\x00\x38\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x48\x00\x00\x48" |
| "\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x48\x00\x00\x48\xc7" |
| "\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x48\x00\x00\x48\xc7\xc0" |
| "\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x48\x00\x00\x48\xc7\xc0\xff" |
| "\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x48\x00\x00\x48\xc7\xc0\xff\xff" |
| "\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f" |
| "\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x48\x00\x00\x48\xc7\xc0\x00\x00\x00\x00" |
| "\x0f\x79\xd0\x48\xc7\xc2\x0e\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f" |
| "\x79\xd0\x48\xc7\xc2\x10\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79" |
| "\xd0\x48\xc7\xc2\x12\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0" |
| "\x48\xc7\xc2\x14\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48" |
| "\xc7\xc2\x16\x48\x00\x00\x48\xc7\xc0\x9b\x20\x00\x00\x0f\x79\xd0\x48\xc7" |
| "\xc2\x18\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2" |
| "\x1a\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1c" |
| "\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x48" |
| "\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x48\x00" |
| "\x00\x48\xc7\xc0\x82\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x22\x48\x00\x00" |
| "\x48\xc7\xc0\x8b\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1c\x68\x00\x00\x48" |
| "\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x68\x00\x00\x48\xc7" |
| "\xc0\x00\x91\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x68\x00\x00\x48\xc7\xc0" |
| "\x02\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x28\x00\x00\x48\xc7\xc0\x00" |
| "\x05\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x28\x00\x00\x48\xc7\xc0\x00\x00" |
| "\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x28\x00\x00\x48\xc7\xc0\x00\x00\x00" |
| "\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00" |
| "\x0f\x79\xd0\x48\xc7\xc2\x10\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f" |
| "\x79\xd0\x0f\x20\xc0\x48\xc7\xc2\x00\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0" |
| "\x0f\x20\xd8\x48\xc7\xc2\x02\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20" |
| "\xe0\x48\xc7\xc2\x04\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48\xc7\xc0\x18" |
| "\x5f\x00\x00\x48\x8b\x10\x48\xc7\xc0\x20\x5f\x00\x00\x48\x8b\x08\x48\x31" |
| "\xc0\x0f\x78\xd0\x48\x31\xc8\x0f\x79\xd0\x0f\x01\xc2\x48\xc7\xc2\x00\x44" |
| "\x00\x00\x0f\x78\xd0\xf4"; |
| const char kvm_asm64_vm_exit[] = "\x48\xc7\xc3\x00\x44\x00\x00\x0f\x78\xda\x48" |
| "\xc7\xc3\x02\x44\x00\x00\x0f\x78\xd9\x48\xc7" |
| "\xc0\x00\x64\x00\x00\x0f\x78\xc0\x48\xc7\xc3" |
| "\x1e\x68\x00\x00\x0f\x78\xdb\xf4"; |
| const char kvm_asm64_cpl3[] = |
| "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\xea\xde\xc0\xad\x0b\x50\x00" |
| "\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x00\xd8\x48\xc7\xc0\x6b\x00\x00\x00\x8e" |
| "\xd8\x8e\xc0\x8e\xe0\x8e\xe8\x48\xc7\xc4\x80\x0f\x00\x00\x48\xc7\x04\x24" |
| "\x1d\xba\x00\x00\x48\xc7\x44\x24\x04\x63\x00\x00\x00\x48\xc7\x44\x24\x08" |
| "\x80\x0f\x00\x00\x48\xc7\x44\x24\x0c\x6b\x00\x00\x00\xcb"; |
| |
| #define ADDR_TEXT 0x0000 |
| #define ADDR_GDT 0x1000 |
| #define ADDR_LDT 0x1800 |
| #define ADDR_PML4 0x2000 |
| #define ADDR_PDP 0x3000 |
| #define ADDR_PD 0x4000 |
| #define ADDR_STACK0 0x0f80 |
| #define ADDR_VAR_HLT 0x2800 |
| #define ADDR_VAR_SYSRET 0x2808 |
| #define ADDR_VAR_SYSEXIT 0x2810 |
| #define ADDR_VAR_IDT 0x3800 |
| #define ADDR_VAR_TSS64 0x3a00 |
| #define ADDR_VAR_TSS64_CPL3 0x3c00 |
| #define ADDR_VAR_TSS16 0x3d00 |
| #define ADDR_VAR_TSS16_2 0x3e00 |
| #define ADDR_VAR_TSS16_CPL3 0x3f00 |
| #define ADDR_VAR_TSS32 0x4800 |
| #define ADDR_VAR_TSS32_2 0x4a00 |
| #define ADDR_VAR_TSS32_CPL3 0x4c00 |
| #define ADDR_VAR_TSS32_VM86 0x4e00 |
| #define ADDR_VAR_VMXON_PTR 0x5f00 |
| #define ADDR_VAR_VMCS_PTR 0x5f08 |
| #define ADDR_VAR_VMEXIT_PTR 0x5f10 |
| #define ADDR_VAR_VMWRITE_FLD 0x5f18 |
| #define ADDR_VAR_VMWRITE_VAL 0x5f20 |
| #define ADDR_VAR_VMXON 0x6000 |
| #define ADDR_VAR_VMCS 0x7000 |
| #define ADDR_VAR_VMEXIT_CODE 0x9000 |
| #define ADDR_VAR_USER_CODE 0x9100 |
| #define ADDR_VAR_USER_CODE2 0x9120 |
| |
| #define SEL_LDT (1 << 3) |
| #define SEL_CS16 (2 << 3) |
| #define SEL_DS16 (3 << 3) |
| #define SEL_CS16_CPL3 ((4 << 3) + 3) |
| #define SEL_DS16_CPL3 ((5 << 3) + 3) |
| #define SEL_CS32 (6 << 3) |
| #define SEL_DS32 (7 << 3) |
| #define SEL_CS32_CPL3 ((8 << 3) + 3) |
| #define SEL_DS32_CPL3 ((9 << 3) + 3) |
| #define SEL_CS64 (10 << 3) |
| #define SEL_DS64 (11 << 3) |
| #define SEL_CS64_CPL3 ((12 << 3) + 3) |
| #define SEL_DS64_CPL3 ((13 << 3) + 3) |
| #define SEL_CGATE16 (14 << 3) |
| #define SEL_TGATE16 (15 << 3) |
| #define SEL_CGATE32 (16 << 3) |
| #define SEL_TGATE32 (17 << 3) |
| #define SEL_CGATE64 (18 << 3) |
| #define SEL_CGATE64_HI (19 << 3) |
| #define SEL_TSS16 (20 << 3) |
| #define SEL_TSS16_2 (21 << 3) |
| #define SEL_TSS16_CPL3 ((22 << 3) + 3) |
| #define SEL_TSS32 (23 << 3) |
| #define SEL_TSS32_2 (24 << 3) |
| #define SEL_TSS32_CPL3 ((25 << 3) + 3) |
| #define SEL_TSS32_VM86 (26 << 3) |
| #define SEL_TSS64 (27 << 3) |
| #define SEL_TSS64_HI (28 << 3) |
| #define SEL_TSS64_CPL3 ((29 << 3) + 3) |
| #define SEL_TSS64_CPL3_HI (30 << 3) |
| |
| #define MSR_IA32_FEATURE_CONTROL 0x3a |
| #define MSR_IA32_VMX_BASIC 0x480 |
| #define MSR_IA32_SMBASE 0x9e |
| #define MSR_IA32_SYSENTER_CS 0x174 |
| #define MSR_IA32_SYSENTER_ESP 0x175 |
| #define MSR_IA32_SYSENTER_EIP 0x176 |
| #define MSR_IA32_STAR 0xC0000081 |
| #define MSR_IA32_LSTAR 0xC0000082 |
| #define MSR_IA32_VMX_PROCBASED_CTLS2 0x48B |
| |
| #define NEXT_INSN $0xbadc0de |
| #define PREFIX_SIZE 0xba1d |
| |
| #define KVM_SMI _IO(KVMIO, 0xb7) |
| |
| #define CR0_PE 1 |
| #define CR0_MP (1 << 1) |
| #define CR0_EM (1 << 2) |
| #define CR0_TS (1 << 3) |
| #define CR0_ET (1 << 4) |
| #define CR0_NE (1 << 5) |
| #define CR0_WP (1 << 16) |
| #define CR0_AM (1 << 18) |
| #define CR0_NW (1 << 29) |
| #define CR0_CD (1 << 30) |
| #define CR0_PG (1 << 31) |
| |
| #define CR4_VME 1 |
| #define CR4_PVI (1 << 1) |
| #define CR4_TSD (1 << 2) |
| #define CR4_DE (1 << 3) |
| #define CR4_PSE (1 << 4) |
| #define CR4_PAE (1 << 5) |
| #define CR4_MCE (1 << 6) |
| #define CR4_PGE (1 << 7) |
| #define CR4_PCE (1 << 8) |
| #define CR4_OSFXSR (1 << 8) |
| #define CR4_OSXMMEXCPT (1 << 10) |
| #define CR4_UMIP (1 << 11) |
| #define CR4_VMXE (1 << 13) |
| #define CR4_SMXE (1 << 14) |
| #define CR4_FSGSBASE (1 << 16) |
| #define CR4_PCIDE (1 << 17) |
| #define CR4_OSXSAVE (1 << 18) |
| #define CR4_SMEP (1 << 20) |
| #define CR4_SMAP (1 << 21) |
| #define CR4_PKE (1 << 22) |
| |
| #define EFER_SCE 1 |
| #define EFER_LME (1 << 8) |
| #define EFER_LMA (1 << 10) |
| #define EFER_NXE (1 << 11) |
| #define EFER_SVME (1 << 12) |
| #define EFER_LMSLE (1 << 13) |
| #define EFER_FFXSR (1 << 14) |
| #define EFER_TCE (1 << 15) |
| #define PDE32_PRESENT 1 |
| #define PDE32_RW (1 << 1) |
| #define PDE32_USER (1 << 2) |
| #define PDE32_PS (1 << 7) |
| #define PDE64_PRESENT 1 |
| #define PDE64_RW (1 << 1) |
| #define PDE64_USER (1 << 2) |
| #define PDE64_ACCESSED (1 << 5) |
| #define PDE64_DIRTY (1 << 6) |
| #define PDE64_PS (1 << 7) |
| #define PDE64_G (1 << 8) |
| |
| struct tss16 { |
| uint16_t prev; |
| uint16_t sp0; |
| uint16_t ss0; |
| uint16_t sp1; |
| uint16_t ss1; |
| uint16_t sp2; |
| uint16_t ss2; |
| uint16_t ip; |
| uint16_t flags; |
| uint16_t ax; |
| uint16_t cx; |
| uint16_t dx; |
| uint16_t bx; |
| uint16_t sp; |
| uint16_t bp; |
| uint16_t si; |
| uint16_t di; |
| uint16_t es; |
| uint16_t cs; |
| uint16_t ss; |
| uint16_t ds; |
| uint16_t ldt; |
| } __attribute__((packed)); |
| |
| struct tss32 { |
| uint16_t prev, prevh; |
| uint32_t sp0; |
| uint16_t ss0, ss0h; |
| uint32_t sp1; |
| uint16_t ss1, ss1h; |
| uint32_t sp2; |
| uint16_t ss2, ss2h; |
| uint32_t cr3; |
| uint32_t ip; |
| uint32_t flags; |
| uint32_t ax; |
| uint32_t cx; |
| uint32_t dx; |
| uint32_t bx; |
| uint32_t sp; |
| uint32_t bp; |
| uint32_t si; |
| uint32_t di; |
| uint16_t es, esh; |
| uint16_t cs, csh; |
| uint16_t ss, ssh; |
| uint16_t ds, dsh; |
| uint16_t fs, fsh; |
| uint16_t gs, gsh; |
| uint16_t ldt, ldth; |
| uint16_t trace; |
| uint16_t io_bitmap; |
| } __attribute__((packed)); |
| |
| struct tss64 { |
| uint32_t reserved0; |
| uint64_t rsp[3]; |
| uint64_t reserved1; |
| uint64_t ist[7]; |
| uint64_t reserved2; |
| uint32_t reserved3; |
| uint32_t io_bitmap; |
| } __attribute__((packed)); |
| |
| static void fill_segment_descriptor(uint64_t* dt, uint64_t* lt, |
| struct kvm_segment* seg) |
| { |
| uint16_t index = seg->selector >> 3; |
| uint64_t limit = seg->g ? seg->limit >> 12 : seg->limit; |
| uint64_t sd = (limit & 0xffff) | (seg->base & 0xffffff) << 16 | |
| (uint64_t)seg->type << 40 | (uint64_t)seg->s << 44 | |
| (uint64_t)seg->dpl << 45 | (uint64_t)seg->present << 47 | |
| (limit & 0xf0000ULL) << 48 | (uint64_t)seg->avl << 52 | |
| (uint64_t)seg->l << 53 | (uint64_t)seg->db << 54 | |
| (uint64_t)seg->g << 55 | (seg->base & 0xff000000ULL) << 56; |
| NONFAILING(dt[index] = sd); |
| NONFAILING(lt[index] = sd); |
| } |
| |
| static void fill_segment_descriptor_dword(uint64_t* dt, uint64_t* lt, |
| struct kvm_segment* seg) |
| { |
| fill_segment_descriptor(dt, lt, seg); |
| uint16_t index = seg->selector >> 3; |
| NONFAILING(dt[index + 1] = 0); |
| NONFAILING(lt[index + 1] = 0); |
| } |
| |
| static void setup_syscall_msrs(int cpufd, uint16_t sel_cs, uint16_t sel_cs_cpl3) |
| { |
| char buf[sizeof(struct kvm_msrs) + 5 * sizeof(struct kvm_msr_entry)]; |
| memset(buf, 0, sizeof(buf)); |
| struct kvm_msrs* msrs = (struct kvm_msrs*)buf; |
| struct kvm_msr_entry* entries = msrs->entries; |
| msrs->nmsrs = 5; |
| entries[0].index = MSR_IA32_SYSENTER_CS; |
| entries[0].data = sel_cs; |
| entries[1].index = MSR_IA32_SYSENTER_ESP; |
| entries[1].data = ADDR_STACK0; |
| entries[2].index = MSR_IA32_SYSENTER_EIP; |
| entries[2].data = ADDR_VAR_SYSEXIT; |
| entries[3].index = MSR_IA32_STAR; |
| entries[3].data = ((uint64_t)sel_cs << 32) | ((uint64_t)sel_cs_cpl3 << 48); |
| entries[4].index = MSR_IA32_LSTAR; |
| entries[4].data = ADDR_VAR_SYSRET; |
| ioctl(cpufd, KVM_SET_MSRS, msrs); |
| } |
| |
| static void setup_32bit_idt(struct kvm_sregs* sregs, char* host_mem, |
| uintptr_t guest_mem) |
| { |
| sregs->idt.base = guest_mem + ADDR_VAR_IDT; |
| sregs->idt.limit = 0x1ff; |
| uint64_t* idt = (uint64_t*)(host_mem + sregs->idt.base); |
| int i; |
| for (i = 0; i < 32; i++) { |
| struct kvm_segment gate; |
| gate.selector = i << 3; |
| switch (i % 6) { |
| case 0: |
| gate.type = 6; |
| gate.base = SEL_CS16; |
| break; |
| case 1: |
| gate.type = 7; |
| gate.base = SEL_CS16; |
| break; |
| case 2: |
| gate.type = 3; |
| gate.base = SEL_TGATE16; |
| break; |
| case 3: |
| gate.type = 14; |
| gate.base = SEL_CS32; |
| break; |
| case 4: |
| gate.type = 15; |
| gate.base = SEL_CS32; |
| break; |
| case 6: |
| gate.type = 11; |
| gate.base = SEL_TGATE32; |
| break; |
| } |
| gate.limit = guest_mem + ADDR_VAR_USER_CODE2; |
| gate.present = 1; |
| gate.dpl = 0; |
| gate.s = 0; |
| gate.g = 0; |
| gate.db = 0; |
| gate.l = 0; |
| gate.avl = 0; |
| fill_segment_descriptor(idt, idt, &gate); |
| } |
| } |
| |
| static void setup_64bit_idt(struct kvm_sregs* sregs, char* host_mem, |
| uintptr_t guest_mem) |
| { |
| sregs->idt.base = guest_mem + ADDR_VAR_IDT; |
| sregs->idt.limit = 0x1ff; |
| uint64_t* idt = (uint64_t*)(host_mem + sregs->idt.base); |
| int i; |
| for (i = 0; i < 32; i++) { |
| struct kvm_segment gate; |
| gate.selector = (i * 2) << 3; |
| gate.type = (i & 1) ? 14 : 15; |
| gate.base = SEL_CS64; |
| gate.limit = guest_mem + ADDR_VAR_USER_CODE2; |
| gate.present = 1; |
| gate.dpl = 0; |
| gate.s = 0; |
| gate.g = 0; |
| gate.db = 0; |
| gate.l = 0; |
| gate.avl = 0; |
| fill_segment_descriptor_dword(idt, idt, &gate); |
| } |
| } |
| |
| struct kvm_text { |
| uintptr_t typ; |
| const void* text; |
| uintptr_t size; |
| }; |
| |
| struct kvm_opt { |
| uint64_t typ; |
| uint64_t val; |
| }; |
| |
| #define KVM_SETUP_PAGING (1 << 0) |
| #define KVM_SETUP_PAE (1 << 1) |
| #define KVM_SETUP_PROTECTED (1 << 2) |
| #define KVM_SETUP_CPL3 (1 << 3) |
| #define KVM_SETUP_VIRT86 (1 << 4) |
| #define KVM_SETUP_SMM (1 << 5) |
| #define KVM_SETUP_VM (1 << 6) |
| static long syz_kvm_setup_cpu(volatile long a0, volatile long a1, |
| volatile long a2, volatile long a3, |
| volatile long a4, volatile long a5, |
| volatile long a6, volatile long a7) |
| { |
| const int vmfd = a0; |
| const int cpufd = a1; |
| char* const host_mem = (char*)a2; |
| const struct kvm_text* const text_array_ptr = (struct kvm_text*)a3; |
| const uintptr_t text_count = a4; |
| const uintptr_t flags = a5; |
| const struct kvm_opt* const opt_array_ptr = (struct kvm_opt*)a6; |
| uintptr_t opt_count = a7; |
| const uintptr_t page_size = 4 << 10; |
| const uintptr_t ioapic_page = 10; |
| const uintptr_t guest_mem_size = 24 * page_size; |
| const uintptr_t guest_mem = 0; |
| (void)text_count; |
| int text_type = 0; |
| const void* text = 0; |
| uintptr_t text_size = 0; |
| NONFAILING(text_type = text_array_ptr[0].typ); |
| NONFAILING(text = text_array_ptr[0].text); |
| NONFAILING(text_size = text_array_ptr[0].size); |
| uintptr_t i; |
| for (i = 0; i < guest_mem_size / page_size; i++) { |
| struct kvm_userspace_memory_region memreg; |
| memreg.slot = i; |
| memreg.flags = 0; |
| memreg.guest_phys_addr = guest_mem + i * page_size; |
| if (i == ioapic_page) |
| memreg.guest_phys_addr = 0xfec00000; |
| memreg.memory_size = page_size; |
| memreg.userspace_addr = (uintptr_t)host_mem + i * page_size; |
| ioctl(vmfd, KVM_SET_USER_MEMORY_REGION, &memreg); |
| } |
| struct kvm_userspace_memory_region memreg; |
| memreg.slot = 1 + (1 << 16); |
| memreg.flags = 0; |
| memreg.guest_phys_addr = 0x30000; |
| memreg.memory_size = 64 << 10; |
| memreg.userspace_addr = (uintptr_t)host_mem; |
| ioctl(vmfd, KVM_SET_USER_MEMORY_REGION, &memreg); |
| struct kvm_sregs sregs; |
| if (ioctl(cpufd, KVM_GET_SREGS, &sregs)) |
| return -1; |
| struct kvm_regs regs; |
| memset(®s, 0, sizeof(regs)); |
| regs.rip = guest_mem + ADDR_TEXT; |
| regs.rsp = ADDR_STACK0; |
| sregs.gdt.base = guest_mem + ADDR_GDT; |
| sregs.gdt.limit = 256 * sizeof(uint64_t) - 1; |
| uint64_t* gdt = (uint64_t*)(host_mem + sregs.gdt.base); |
| struct kvm_segment seg_ldt; |
| seg_ldt.selector = SEL_LDT; |
| seg_ldt.type = 2; |
| seg_ldt.base = guest_mem + ADDR_LDT; |
| seg_ldt.limit = 256 * sizeof(uint64_t) - 1; |
| seg_ldt.present = 1; |
| seg_ldt.dpl = 0; |
| seg_ldt.s = 0; |
| seg_ldt.g = 0; |
| seg_ldt.db = 1; |
| seg_ldt.l = 0; |
| sregs.ldt = seg_ldt; |
| uint64_t* ldt = (uint64_t*)(host_mem + sregs.ldt.base); |
| struct kvm_segment seg_cs16; |
| seg_cs16.selector = SEL_CS16; |
| seg_cs16.type = 11; |
| seg_cs16.base = 0; |
| seg_cs16.limit = 0xfffff; |
| seg_cs16.present = 1; |
| seg_cs16.dpl = 0; |
| seg_cs16.s = 1; |
| seg_cs16.g = 0; |
| seg_cs16.db = 0; |
| seg_cs16.l = 0; |
| struct kvm_segment seg_ds16 = seg_cs16; |
| seg_ds16.selector = SEL_DS16; |
| seg_ds16.type = 3; |
| struct kvm_segment seg_cs16_cpl3 = seg_cs16; |
| seg_cs16_cpl3.selector = SEL_CS16_CPL3; |
| seg_cs16_cpl3.dpl = 3; |
| struct kvm_segment seg_ds16_cpl3 = seg_ds16; |
| seg_ds16_cpl3.selector = SEL_DS16_CPL3; |
| seg_ds16_cpl3.dpl = 3; |
| struct kvm_segment seg_cs32 = seg_cs16; |
| seg_cs32.selector = SEL_CS32; |
| seg_cs32.db = 1; |
| struct kvm_segment seg_ds32 = seg_ds16; |
| seg_ds32.selector = SEL_DS32; |
| seg_ds32.db = 1; |
| struct kvm_segment seg_cs32_cpl3 = seg_cs32; |
| seg_cs32_cpl3.selector = SEL_CS32_CPL3; |
| seg_cs32_cpl3.dpl = 3; |
| struct kvm_segment seg_ds32_cpl3 = seg_ds32; |
| seg_ds32_cpl3.selector = SEL_DS32_CPL3; |
| seg_ds32_cpl3.dpl = 3; |
| struct kvm_segment seg_cs64 = seg_cs16; |
| seg_cs64.selector = SEL_CS64; |
| seg_cs64.l = 1; |
| struct kvm_segment seg_ds64 = seg_ds32; |
| seg_ds64.selector = SEL_DS64; |
| struct kvm_segment seg_cs64_cpl3 = seg_cs64; |
| seg_cs64_cpl3.selector = SEL_CS64_CPL3; |
| seg_cs64_cpl3.dpl = 3; |
| struct kvm_segment seg_ds64_cpl3 = seg_ds64; |
| seg_ds64_cpl3.selector = SEL_DS64_CPL3; |
| seg_ds64_cpl3.dpl = 3; |
| struct kvm_segment seg_tss32; |
| seg_tss32.selector = SEL_TSS32; |
| seg_tss32.type = 9; |
| seg_tss32.base = ADDR_VAR_TSS32; |
| seg_tss32.limit = 0x1ff; |
| seg_tss32.present = 1; |
| seg_tss32.dpl = 0; |
| seg_tss32.s = 0; |
| seg_tss32.g = 0; |
| seg_tss32.db = 0; |
| seg_tss32.l = 0; |
| struct kvm_segment seg_tss32_2 = seg_tss32; |
| seg_tss32_2.selector = SEL_TSS32_2; |
| seg_tss32_2.base = ADDR_VAR_TSS32_2; |
| struct kvm_segment seg_tss32_cpl3 = seg_tss32; |
| seg_tss32_cpl3.selector = SEL_TSS32_CPL3; |
| seg_tss32_cpl3.base = ADDR_VAR_TSS32_CPL3; |
| struct kvm_segment seg_tss32_vm86 = seg_tss32; |
| seg_tss32_vm86.selector = SEL_TSS32_VM86; |
| seg_tss32_vm86.base = ADDR_VAR_TSS32_VM86; |
| struct kvm_segment seg_tss16 = seg_tss32; |
| seg_tss16.selector = SEL_TSS16; |
| seg_tss16.base = ADDR_VAR_TSS16; |
| seg_tss16.limit = 0xff; |
| seg_tss16.type = 1; |
| struct kvm_segment seg_tss16_2 = seg_tss16; |
| seg_tss16_2.selector = SEL_TSS16_2; |
| seg_tss16_2.base = ADDR_VAR_TSS16_2; |
| seg_tss16_2.dpl = 0; |
| struct kvm_segment seg_tss16_cpl3 = seg_tss16; |
| seg_tss16_cpl3.selector = SEL_TSS16_CPL3; |
| seg_tss16_cpl3.base = ADDR_VAR_TSS16_CPL3; |
| seg_tss16_cpl3.dpl = 3; |
| struct kvm_segment seg_tss64 = seg_tss32; |
| seg_tss64.selector = SEL_TSS64; |
| seg_tss64.base = ADDR_VAR_TSS64; |
| seg_tss64.limit = 0x1ff; |
| struct kvm_segment seg_tss64_cpl3 = seg_tss64; |
| seg_tss64_cpl3.selector = SEL_TSS64_CPL3; |
| seg_tss64_cpl3.base = ADDR_VAR_TSS64_CPL3; |
| seg_tss64_cpl3.dpl = 3; |
| struct kvm_segment seg_cgate16; |
| seg_cgate16.selector = SEL_CGATE16; |
| seg_cgate16.type = 4; |
| seg_cgate16.base = SEL_CS16 | (2 << 16); |
| seg_cgate16.limit = ADDR_VAR_USER_CODE2; |
| seg_cgate16.present = 1; |
| seg_cgate16.dpl = 0; |
| seg_cgate16.s = 0; |
| seg_cgate16.g = 0; |
| seg_cgate16.db = 0; |
| seg_cgate16.l = 0; |
| seg_cgate16.avl = 0; |
| struct kvm_segment seg_tgate16 = seg_cgate16; |
| seg_tgate16.selector = SEL_TGATE16; |
| seg_tgate16.type = 3; |
| seg_cgate16.base = SEL_TSS16_2; |
| seg_tgate16.limit = 0; |
| struct kvm_segment seg_cgate32 = seg_cgate16; |
| seg_cgate32.selector = SEL_CGATE32; |
| seg_cgate32.type = 12; |
| seg_cgate32.base = SEL_CS32 | (2 << 16); |
| struct kvm_segment seg_tgate32 = seg_cgate32; |
| seg_tgate32.selector = SEL_TGATE32; |
| seg_tgate32.type = 11; |
| seg_tgate32.base = SEL_TSS32_2; |
| seg_tgate32.limit = 0; |
| struct kvm_segment seg_cgate64 = seg_cgate16; |
| seg_cgate64.selector = SEL_CGATE64; |
| seg_cgate64.type = 12; |
| seg_cgate64.base = SEL_CS64; |
| int kvmfd = open("/dev/kvm", O_RDWR); |
| char buf[sizeof(struct kvm_cpuid2) + 128 * sizeof(struct kvm_cpuid_entry2)]; |
| memset(buf, 0, sizeof(buf)); |
| struct kvm_cpuid2* cpuid = (struct kvm_cpuid2*)buf; |
| cpuid->nent = 128; |
| ioctl(kvmfd, KVM_GET_SUPPORTED_CPUID, cpuid); |
| ioctl(cpufd, KVM_SET_CPUID2, cpuid); |
| close(kvmfd); |
| const char* text_prefix = 0; |
| int text_prefix_size = 0; |
| char* host_text = host_mem + ADDR_TEXT; |
| if (text_type == 8) { |
| if (flags & KVM_SETUP_SMM) { |
| if (flags & KVM_SETUP_PROTECTED) { |
| sregs.cs = seg_cs16; |
| sregs.ds = sregs.es = sregs.fs = sregs.gs = sregs.ss = seg_ds16; |
| sregs.cr0 |= CR0_PE; |
| } else { |
| sregs.cs.selector = 0; |
| sregs.cs.base = 0; |
| } |
| NONFAILING(*(host_mem + ADDR_TEXT) = 0xf4); |
| host_text = host_mem + 0x8000; |
| ioctl(cpufd, KVM_SMI, 0); |
| } else if (flags & KVM_SETUP_VIRT86) { |
| sregs.cs = seg_cs32; |
| sregs.ds = sregs.es = sregs.fs = sregs.gs = sregs.ss = seg_ds32; |
| sregs.cr0 |= CR0_PE; |
| sregs.efer |= EFER_SCE; |
| setup_syscall_msrs(cpufd, SEL_CS32, SEL_CS32_CPL3); |
| setup_32bit_idt(&sregs, host_mem, guest_mem); |
| if (flags & KVM_SETUP_PAGING) { |
| uint64_t pd_addr = guest_mem + ADDR_PD; |
| uint64_t* pd = (uint64_t*)(host_mem + ADDR_PD); |
| NONFAILING(pd[0] = PDE32_PRESENT | PDE32_RW | PDE32_USER | PDE32_PS); |
| sregs.cr3 = pd_addr; |
| sregs.cr4 |= CR4_PSE; |
| text_prefix = kvm_asm32_paged_vm86; |
| text_prefix_size = sizeof(kvm_asm32_paged_vm86) - 1; |
| } else { |
| text_prefix = kvm_asm32_vm86; |
| text_prefix_size = sizeof(kvm_asm32_vm86) - 1; |
| } |
| } else { |
| sregs.cs.selector = 0; |
| sregs.cs.base = 0; |
| } |
| } else if (text_type == 16) { |
| if (flags & KVM_SETUP_CPL3) { |
| sregs.cs = seg_cs16; |
| sregs.ds = sregs.es = sregs.fs = sregs.gs = sregs.ss = seg_ds16; |
| text_prefix = kvm_asm16_cpl3; |
| text_prefix_size = sizeof(kvm_asm16_cpl3) - 1; |
| } else { |
| sregs.cr0 |= CR0_PE; |
| sregs.cs = seg_cs16; |
| sregs.ds = sregs.es = sregs.fs = sregs.gs = sregs.ss = seg_ds16; |
| } |
| } else if (text_type == 32) { |
| sregs.cr0 |= CR0_PE; |
| sregs.efer |= EFER_SCE; |
| setup_syscall_msrs(cpufd, SEL_CS32, SEL_CS32_CPL3); |
| setup_32bit_idt(&sregs, host_mem, guest_mem); |
| if (flags & KVM_SETUP_SMM) { |
| sregs.cs = seg_cs32; |
| sregs.ds = sregs.es = sregs.fs = sregs.gs = sregs.ss = seg_ds32; |
| NONFAILING(*(host_mem + ADDR_TEXT) = 0xf4); |
| host_text = host_mem + 0x8000; |
| ioctl(cpufd, KVM_SMI, 0); |
| } else if (flags & KVM_SETUP_PAGING) { |
| sregs.cs = seg_cs32; |
| sregs.ds = sregs.es = sregs.fs = sregs.gs = sregs.ss = seg_ds32; |
| uint64_t pd_addr = guest_mem + ADDR_PD; |
| uint64_t* pd = (uint64_t*)(host_mem + ADDR_PD); |
| NONFAILING(pd[0] = PDE32_PRESENT | PDE32_RW | PDE32_USER | PDE32_PS); |
| sregs.cr3 = pd_addr; |
| sregs.cr4 |= CR4_PSE; |
| text_prefix = kvm_asm32_paged; |
| text_prefix_size = sizeof(kvm_asm32_paged) - 1; |
| } else if (flags & KVM_SETUP_CPL3) { |
| sregs.cs = seg_cs32_cpl3; |
| sregs.ds = sregs.es = sregs.fs = sregs.gs = sregs.ss = seg_ds32_cpl3; |
| } else { |
| sregs.cs = seg_cs32; |
| sregs.ds = sregs.es = sregs.fs = sregs.gs = sregs.ss = seg_ds32; |
| } |
| } else { |
| sregs.efer |= EFER_LME | EFER_SCE; |
| sregs.cr0 |= CR0_PE; |
| setup_syscall_msrs(cpufd, SEL_CS64, SEL_CS64_CPL3); |
| setup_64bit_idt(&sregs, host_mem, guest_mem); |
| sregs.cs = seg_cs32; |
| sregs.ds = sregs.es = sregs.fs = sregs.gs = sregs.ss = seg_ds32; |
| uint64_t pml4_addr = guest_mem + ADDR_PML4; |
| uint64_t* pml4 = (uint64_t*)(host_mem + ADDR_PML4); |
| uint64_t pdpt_addr = guest_mem + ADDR_PDP; |
| uint64_t* pdpt = (uint64_t*)(host_mem + ADDR_PDP); |
| uint64_t pd_addr = guest_mem + ADDR_PD; |
| uint64_t* pd = (uint64_t*)(host_mem + ADDR_PD); |
| NONFAILING(pml4[0] = PDE64_PRESENT | PDE64_RW | PDE64_USER | pdpt_addr); |
| NONFAILING(pdpt[0] = PDE64_PRESENT | PDE64_RW | PDE64_USER | pd_addr); |
| NONFAILING(pd[0] = PDE64_PRESENT | PDE64_RW | PDE64_USER | PDE64_PS); |
| sregs.cr3 = pml4_addr; |
| sregs.cr4 |= CR4_PAE; |
| if (flags & KVM_SETUP_VM) { |
| sregs.cr0 |= CR0_NE; |
| NONFAILING(*((uint64_t*)(host_mem + ADDR_VAR_VMXON_PTR)) = |
| ADDR_VAR_VMXON); |
| NONFAILING(*((uint64_t*)(host_mem + ADDR_VAR_VMCS_PTR)) = ADDR_VAR_VMCS); |
| NONFAILING(memcpy(host_mem + ADDR_VAR_VMEXIT_CODE, kvm_asm64_vm_exit, |
| sizeof(kvm_asm64_vm_exit) - 1)); |
| NONFAILING(*((uint64_t*)(host_mem + ADDR_VAR_VMEXIT_PTR)) = |
| ADDR_VAR_VMEXIT_CODE); |
| text_prefix = kvm_asm64_init_vm; |
| text_prefix_size = sizeof(kvm_asm64_init_vm) - 1; |
| } else if (flags & KVM_SETUP_CPL3) { |
| text_prefix = kvm_asm64_cpl3; |
| text_prefix_size = sizeof(kvm_asm64_cpl3) - 1; |
| } else { |
| text_prefix = kvm_asm64_enable_long; |
| text_prefix_size = sizeof(kvm_asm64_enable_long) - 1; |
| } |
| } |
| struct tss16 tss16; |
| memset(&tss16, 0, sizeof(tss16)); |
| tss16.ss0 = tss16.ss1 = tss16.ss2 = SEL_DS16; |
| tss16.sp0 = tss16.sp1 = tss16.sp2 = ADDR_STACK0; |
| tss16.ip = ADDR_VAR_USER_CODE2; |
| tss16.flags = (1 << 1); |
| tss16.cs = SEL_CS16; |
| tss16.es = tss16.ds = tss16.ss = SEL_DS16; |
| tss16.ldt = SEL_LDT; |
| struct tss16* tss16_addr = (struct tss16*)(host_mem + seg_tss16_2.base); |
| NONFAILING(memcpy(tss16_addr, &tss16, sizeof(tss16))); |
| memset(&tss16, 0, sizeof(tss16)); |
| tss16.ss0 = tss16.ss1 = tss16.ss2 = SEL_DS16; |
| tss16.sp0 = tss16.sp1 = tss16.sp2 = ADDR_STACK0; |
| tss16.ip = ADDR_VAR_USER_CODE2; |
| tss16.flags = (1 << 1); |
| tss16.cs = SEL_CS16_CPL3; |
| tss16.es = tss16.ds = tss16.ss = SEL_DS16_CPL3; |
| tss16.ldt = SEL_LDT; |
| struct tss16* tss16_cpl3_addr = |
| (struct tss16*)(host_mem + seg_tss16_cpl3.base); |
| NONFAILING(memcpy(tss16_cpl3_addr, &tss16, sizeof(tss16))); |
| struct tss32 tss32; |
| memset(&tss32, 0, sizeof(tss32)); |
| tss32.ss0 = tss32.ss1 = tss32.ss2 = SEL_DS32; |
| tss32.sp0 = tss32.sp1 = tss32.sp2 = ADDR_STACK0; |
| tss32.ip = ADDR_VAR_USER_CODE; |
| tss32.flags = (1 << 1) | (1 << 17); |
| tss32.ldt = SEL_LDT; |
| tss32.cr3 = sregs.cr3; |
| tss32.io_bitmap = offsetof(struct tss32, io_bitmap); |
| struct tss32* tss32_addr = (struct tss32*)(host_mem + seg_tss32_vm86.base); |
| NONFAILING(memcpy(tss32_addr, &tss32, sizeof(tss32))); |
| memset(&tss32, 0, sizeof(tss32)); |
| tss32.ss0 = tss32.ss1 = tss32.ss2 = SEL_DS32; |
| tss32.sp0 = tss32.sp1 = tss32.sp2 = ADDR_STACK0; |
| tss32.ip = ADDR_VAR_USER_CODE; |
| tss32.flags = (1 << 1); |
| tss32.cr3 = sregs.cr3; |
| tss32.es = tss32.ds = tss32.ss = tss32.gs = tss32.fs = SEL_DS32; |
| tss32.cs = SEL_CS32; |
| tss32.ldt = SEL_LDT; |
| tss32.cr3 = sregs.cr3; |
| tss32.io_bitmap = offsetof(struct tss32, io_bitmap); |
| struct tss32* tss32_cpl3_addr = (struct tss32*)(host_mem + seg_tss32_2.base); |
| NONFAILING(memcpy(tss32_cpl3_addr, &tss32, sizeof(tss32))); |
| struct tss64 tss64; |
| memset(&tss64, 0, sizeof(tss64)); |
| tss64.rsp[0] = ADDR_STACK0; |
| tss64.rsp[1] = ADDR_STACK0; |
| tss64.rsp[2] = ADDR_STACK0; |
| tss64.io_bitmap = offsetof(struct tss64, io_bitmap); |
| struct tss64* tss64_addr = (struct tss64*)(host_mem + seg_tss64.base); |
| NONFAILING(memcpy(tss64_addr, &tss64, sizeof(tss64))); |
| memset(&tss64, 0, sizeof(tss64)); |
| tss64.rsp[0] = ADDR_STACK0; |
| tss64.rsp[1] = ADDR_STACK0; |
| tss64.rsp[2] = ADDR_STACK0; |
| tss64.io_bitmap = offsetof(struct tss64, io_bitmap); |
| struct tss64* tss64_cpl3_addr = |
| (struct tss64*)(host_mem + seg_tss64_cpl3.base); |
| NONFAILING(memcpy(tss64_cpl3_addr, &tss64, sizeof(tss64))); |
| if (text_size > 1000) |
| text_size = 1000; |
| if (text_prefix) { |
| NONFAILING(memcpy(host_text, text_prefix, text_prefix_size)); |
| void* patch = 0; |
| NONFAILING(patch = |
| memmem(host_text, text_prefix_size, "\xde\xc0\xad\x0b", 4)); |
| if (patch) |
| NONFAILING(*((uint32_t*)patch) = |
| guest_mem + ADDR_TEXT + ((char*)patch - host_text) + 6); |
| uint16_t magic = PREFIX_SIZE; |
| patch = 0; |
| NONFAILING(patch = |
| memmem(host_text, text_prefix_size, &magic, sizeof(magic))); |
| if (patch) |
| NONFAILING(*((uint16_t*)patch) = |
| guest_mem + ADDR_TEXT + text_prefix_size); |
| } |
| NONFAILING(memcpy((void*)(host_text + text_prefix_size), text, text_size)); |
| NONFAILING(*(host_text + text_prefix_size + text_size) = 0xf4); |
| NONFAILING(memcpy(host_mem + ADDR_VAR_USER_CODE, text, text_size)); |
| NONFAILING(*(host_mem + ADDR_VAR_USER_CODE + text_size) = 0xf4); |
| NONFAILING(*(host_mem + ADDR_VAR_HLT) = 0xf4); |
| NONFAILING(memcpy(host_mem + ADDR_VAR_SYSRET, "\x0f\x07\xf4", 3)); |
| NONFAILING(memcpy(host_mem + ADDR_VAR_SYSEXIT, "\x0f\x35\xf4", 3)); |
| NONFAILING(*(uint64_t*)(host_mem + ADDR_VAR_VMWRITE_FLD) = 0); |
| NONFAILING(*(uint64_t*)(host_mem + ADDR_VAR_VMWRITE_VAL) = 0); |
| if (opt_count > 2) |
| opt_count = 2; |
| for (i = 0; i < opt_count; i++) { |
| uint64_t typ = 0; |
| uint64_t val = 0; |
| NONFAILING(typ = opt_array_ptr[i].typ); |
| NONFAILING(val = opt_array_ptr[i].val); |
| switch (typ % 9) { |
| case 0: |
| sregs.cr0 ^= val & (CR0_MP | CR0_EM | CR0_ET | CR0_NE | CR0_WP | CR0_AM | |
| CR0_NW | CR0_CD); |
| break; |
| case 1: |
| sregs.cr4 ^= |
| val & (CR4_VME | CR4_PVI | CR4_TSD | CR4_DE | CR4_MCE | CR4_PGE | |
| CR4_PCE | CR4_OSFXSR | CR4_OSXMMEXCPT | CR4_UMIP | CR4_VMXE | |
| CR4_SMXE | CR4_FSGSBASE | CR4_PCIDE | CR4_OSXSAVE | CR4_SMEP | |
| CR4_SMAP | CR4_PKE); |
| break; |
| case 2: |
| sregs.efer ^= val & (EFER_SCE | EFER_NXE | EFER_SVME | EFER_LMSLE | |
| EFER_FFXSR | EFER_TCE); |
| break; |
| case 3: |
| val &= |
| ((1 << 8) | (1 << 9) | (1 << 10) | (1 << 12) | (1 << 13) | (1 << 14) | |
| (1 << 15) | (1 << 18) | (1 << 19) | (1 << 20) | (1 << 21)); |
| regs.rflags ^= val; |
| NONFAILING(tss16_addr->flags ^= val); |
| NONFAILING(tss16_cpl3_addr->flags ^= val); |
| NONFAILING(tss32_addr->flags ^= val); |
| NONFAILING(tss32_cpl3_addr->flags ^= val); |
| break; |
| case 4: |
| seg_cs16.type = val & 0xf; |
| seg_cs32.type = val & 0xf; |
| seg_cs64.type = val & 0xf; |
| break; |
| case 5: |
| seg_cs16_cpl3.type = val & 0xf; |
| seg_cs32_cpl3.type = val & 0xf; |
| seg_cs64_cpl3.type = val & 0xf; |
| break; |
| case 6: |
| seg_ds16.type = val & 0xf; |
| seg_ds32.type = val & 0xf; |
| seg_ds64.type = val & 0xf; |
| break; |
| case 7: |
| seg_ds16_cpl3.type = val & 0xf; |
| seg_ds32_cpl3.type = val & 0xf; |
| seg_ds64_cpl3.type = val & 0xf; |
| break; |
| case 8: |
| NONFAILING(*(uint64_t*)(host_mem + ADDR_VAR_VMWRITE_FLD) = |
| (val & 0xffff)); |
| NONFAILING(*(uint64_t*)(host_mem + ADDR_VAR_VMWRITE_VAL) = (val >> 16)); |
| break; |
| default: |
| exit(1); |
| } |
| } |
| regs.rflags |= 2; |
| fill_segment_descriptor(gdt, ldt, &seg_ldt); |
| fill_segment_descriptor(gdt, ldt, &seg_cs16); |
| fill_segment_descriptor(gdt, ldt, &seg_ds16); |
| fill_segment_descriptor(gdt, ldt, &seg_cs16_cpl3); |
| fill_segment_descriptor(gdt, ldt, &seg_ds16_cpl3); |
| fill_segment_descriptor(gdt, ldt, &seg_cs32); |
| fill_segment_descriptor(gdt, ldt, &seg_ds32); |
| fill_segment_descriptor(gdt, ldt, &seg_cs32_cpl3); |
| fill_segment_descriptor(gdt, ldt, &seg_ds32_cpl3); |
| fill_segment_descriptor(gdt, ldt, &seg_cs64); |
| fill_segment_descriptor(gdt, ldt, &seg_ds64); |
| fill_segment_descriptor(gdt, ldt, &seg_cs64_cpl3); |
| fill_segment_descriptor(gdt, ldt, &seg_ds64_cpl3); |
| fill_segment_descriptor(gdt, ldt, &seg_tss32); |
| fill_segment_descriptor(gdt, ldt, &seg_tss32_2); |
| fill_segment_descriptor(gdt, ldt, &seg_tss32_cpl3); |
| fill_segment_descriptor(gdt, ldt, &seg_tss32_vm86); |
| fill_segment_descriptor(gdt, ldt, &seg_tss16); |
| fill_segment_descriptor(gdt, ldt, &seg_tss16_2); |
| fill_segment_descriptor(gdt, ldt, &seg_tss16_cpl3); |
| fill_segment_descriptor_dword(gdt, ldt, &seg_tss64); |
| fill_segment_descriptor_dword(gdt, ldt, &seg_tss64_cpl3); |
| fill_segment_descriptor(gdt, ldt, &seg_cgate16); |
| fill_segment_descriptor(gdt, ldt, &seg_tgate16); |
| fill_segment_descriptor(gdt, ldt, &seg_cgate32); |
| fill_segment_descriptor(gdt, ldt, &seg_tgate32); |
| fill_segment_descriptor_dword(gdt, ldt, &seg_cgate64); |
| if (ioctl(cpufd, KVM_SET_SREGS, &sregs)) |
| return -1; |
| if (ioctl(cpufd, KVM_SET_REGS, ®s)) |
| return -1; |
| return 0; |
| } |
| |
| uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; |
| |
| int main(void) |
| { |
| syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); |
| install_segv_handler(); |
| intptr_t res = 0; |
| NONFAILING(memcpy((void*)0x20000180, "/dev/kvm\000", 9)); |
| res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000180, 0, 0); |
| if (res != -1) |
| r[0] = res; |
| res = syscall(__NR_ioctl, r[0], 0xae01, 0); |
| if (res != -1) |
| r[1] = res; |
| res = syscall(__NR_ioctl, r[1], 0xae41, 0); |
| if (res != -1) |
| r[2] = res; |
| NONFAILING(*(uint32_t*)0x20000000 = 0); |
| NONFAILING(*(uint32_t*)0x20000004 = 3); |
| NONFAILING(*(uint64_t*)0x20000008 = 0); |
| NONFAILING(*(uint64_t*)0x20000010 = 0x2000); |
| NONFAILING(*(uint64_t*)0x20000018 = 0x20000000); |
| syscall(__NR_ioctl, r[1], 0x4020ae46, 0x20000000); |
| NONFAILING(*(uint64_t*)0x200001c0 = 0); |
| NONFAILING(*(uint32_t*)0x200001c8 = 0x119000); |
| NONFAILING(*(uint32_t*)0x200001cc = 0); |
| syscall(__NR_ioctl, r[1], 0x4010ae67, 0x200001c0); |
| syz_kvm_setup_cpu(-1, r[2], 0x20006000, 0, 0x241, 0, 0, 0); |
| syscall(__NR_mmap, 0x20000000, 0x7000, 0x80000000003, 0x11, r[2], 0); |
| NONFAILING(*(uint64_t*)0x20006c40 = 0); |
| NONFAILING(*(uint32_t*)0x20006c48 = 0); |
| NONFAILING(*(uint64_t*)0x20006c50 = 0x20006800); |
| NONFAILING(*(uint64_t*)0x20006800 = 0); |
| NONFAILING(*(uint64_t*)0x20006808 = 0); |
| NONFAILING(*(uint64_t*)0x20006810 = 0); |
| NONFAILING(*(uint64_t*)0x20006818 = 0); |
| NONFAILING(*(uint64_t*)0x20006820 = 0); |
| NONFAILING(*(uint64_t*)0x20006828 = 0); |
| NONFAILING(*(uint64_t*)0x20006830 = 0x200018c0); |
| NONFAILING(*(uint32_t*)0x200018c0 = 0x1078); |
| NONFAILING(*(uint16_t*)0x200018c4 = 0x3e); |
| NONFAILING(*(uint16_t*)0x200018c6 = 1); |
| NONFAILING(*(uint32_t*)0x200018c8 = 0x70bd2d); |
| NONFAILING(*(uint32_t*)0x200018cc = 0x25dfdbfb); |
| NONFAILING(memcpy( |
| (void*)0x200018d0, |
| "\x86\x33\xb9\x78\x8a\xb0\xe7\x77\x5f\x93\xb4\xaf\x2d\x07\x34\x97\xab\xff" |
| "\x32\x2e\x75\x2a\xd2\x90\x22\x60\x73\x04\x24\x26\x0f\xdf\x3f\x7a\x93\x0c" |
| "\x07\x5f\x1c\xb1\xa8\x1f\x2b\x6d\x59\x6b\x87\x7a\xdf\xb4\x95\x18\x2b\xa5" |
| "\x0f\x73\x64\x2f\x8e\x84\x0a\xc7\xb6\xf9\x37\x25\x81\xf4\x5b\xfd\x4b\xaf" |
| "\x1a\x8c\xe2\x65\x44\x75\x37\x2c\x81\x24\xf4\x3c\x4b\x68\x95\xac\x13\xf3" |
| "\x9a\x98\x3b\xdd\x63\xd0\x2e\x70\x28\x36\x7d\xe8\x89\x62\xd1\x14\xa4\xe8" |
| "\xf9\xf6\x4a\x6b\x7f\xc7\xcf\xaf\xd9\xfc\xe0\x31\x6b\x2f\x10\x6a\x7d\x80" |
| "\xdc\x26\xf7\x5d\x6f\xfb\x55\xbf\x8f\x54\x1a\x37\x10\x59\x02\xc9\xff\xc4" |
| "\xcc\x6e\x14\xe6\x2a\x37\x0e\x01\xd3\x23\xed\xdb\x6e\x44\xa2\xb2\x04\xc1" |
| "\x0d\xc2\xcd\x8d\xac\xed\x50\x66\x6a\x09\x77\x78\x94\xfe\xfb\xaf\xfa\xe1" |
| "\xd9\x69\xe3\xfc\xbe\xc5\xf0\xd8\x09\xc1\xb9\x7a\xb8\xce\x6e\x43\x61\xd9" |
| "\xff\xd7\xee\x31\xbc\x99\xbb\xcd\x37\x39\x50\xc5\xe5\xc2\xb6\xba\x25\xfb" |
| "\xb9\xe2\xcb\x65\x17\x1d\xd8\x0a\xa4\x0f\x7f\x3e\x0c\x5b\xf0\x03\x95\x27" |
| "\x22\xf8\x99\x62\x9f\x7d\x3a\xa7\xf1\x8d\xe9\x70\x61\x1a\x2f\x54\x89\x52" |
| "\xbd\x25\x29\xd7\xfb\x27\x50\x17\xb9\x11\x4b\x70\x71\x31\x67\x83\x3b\x52" |
| "\xea\xc4\x8f\xc8\x7a\x5f\x84\x56\xec\x6f\x94\xe2\xfa\xda\xe6\x23\x42\x73" |
| "\xcc\x3f\x76\x9e\xf2\xc0\xfb\xd4\xa0\xd8\x14\xea\x2e\x6c\x1b\x4d\x3b\x18" |
| "\x16\x78\xca\x33\xcf\x94\xde\x81\x8e\x10\xab\x1f\x41\x3e\xb1\x7a\x32\x49" |
| "\x2b\x70\xd9\x39\x00\xee\x0c\x51\x0c\x0e\x96\x14\x69\x6e\x11\xc6\x87\xb2" |
| "\x8c\x43\xb6\xd8\x12\xe0\x3c\xbb\xe3\xd4\x57\x6c\x49\xa9\xb1\x30\x98\xe4" |
| "\xb4\x4e\x1f\xda\x1a\x12\xea\x89\x59\xd9\x54\xf1\xcc\x29\x0c\xb1\x9a\x90" |
| "\xe1\xf2\xe1\x1f\xee\x04\xaa\x4b\xa5\x3f\x75\xc7\x46\x4c\x39\x98\x59\x11" |
| "\xc5\x4f\x89\xdf\xb5\xd9\x9a\x26\x73\x3f\x30\xf0\x3d\x25\xcb\x32\xa9\x9a" |
| "\xc7\xb7\x46\x53\xa9\xca\xa3\x14\xb7\xaf\x2a\xd1\x49\x9c\x45\x9e\x00\x36" |
| "\xc3\x4d\xb5\x28\x2d\xee\xb8\x5c\x3f\x7a\xd9\x5d\x22\x94\x34\x77\x00\x34" |
| "\x92\xa8\xbc\x6e\x09\x5f\x18\x4f\x1c\xc5\x20\x0e\x2b\x54\x4a\x36\x51\xb1" |
| "\xca\xbf\xc4\xa6\x9d\x20\x2c\x44\x87\x19\x60\xef\x10\x92\xe5\x8f\x16\xa0" |
| "\xa0\x72\x49\x86\x37\xd0\x70\x67\x12\xac\xa1\x78\x38\x38\x35\xf0\x7b\xb3" |
| "\x38\x44\x63\x19\x8a\xc3\xec\x4b\x9f\x1e\xb4\x9a\x67\xa8\x19\x2e\xec\xcb" |
| "\xaf\x7c\x15\x8d\x65\x79\xa1\xf9\x92\x96\x52\x54\x1f\xc9\x06\x40\x39\x60" |
| "\xb5\xc9\xea\x82\x0a\x85\xba\xbc\xb7\x5b\x1e\xb6\x57\xe0\x21\xe9\xa0\xf9" |
| "\x6c\xef\x6c\x68\xc2\x73\x46\x34\xb8\x9a\x91\x7b\xd6\xa5\xdf\xeb\x83\x95" |
| "\x08\x9a\xaf\xe4\x24\xb8\xb7\x39\x62\x70\x79\x89\x7a\xe0\x28\x47\x9f\x10" |
| "\x83\x17\x7a\x67\xfe\xa3\x2b\x6c\x2d\xea\x82\x7e\x54\x1c\x47\x22\xe7\x9b" |
| "\x77\x6e\x29\xeb\xd6\x6b\x87\x40\xe7\x71\x53\x8f\xd4\x8a\x9a\xbf\xd4\x83" |
| "\xc1\xba\x45\x27\x53\x43\x00\x2a\xf2\x2a\x04\xec\xe6\x5b\x51\xe8\xda\xb5" |
| "\xd1\xc5\xfd\x3a\x5e\x68\x99\xcd\xb8\x3f\x64\xd1\xe5\x85\x3a\xab\x7c\xc8" |
| "\x1c\x64\xd8\x7c\x48\xc1\x05\x36\xce\xf5\x24\xbf\xef\x4b\x7d\x20\x8b\x10" |
| "\xa8\xe1\xc7\x48\xdc\x3a\x90\xf5\x33\x38\xc1\xcb\xa2\xc4\x69\x84\x79\xa9" |
| "\x6e\x2e\xa7\xec\x83\x33\x10\xb7\x50\x8a\x70\xe4\x63\xd2\x54\x6c\x00\xb4" |
| "\x3f\xcf\xe3\x6b\xa4\x9d\xa0\x74\x8f\x28\xb9\x99\x46\xfc\x35\x22\xb2\xb9" |
| "\x32\xa7\x71\x5a\x13\xdf\xdd\xad\x7a\x2e\x0e\x86\xdd\x2c\x5d\x25\x78\x0f" |
| "\xc6\x24\xa1\x73\x96\x36\x62\xa6\x15\x12\x1a\x16\x6d\xaf\x3b\x06\xc6\xe2" |
| "\xdd\xcc\x1a\xa3\x4d\xda\x92\x1e\xc2\xe7\xfb\x9a\xff\x8e\x04\x4b\xa5\xd8" |
| "\xf3\xdc\xa4\xb9\x3d\xcf\x08\x1e\x48\x0f\x3d\xf4\x6f\x51\x2b\x0d\xfa\xc3" |
| "\xda\xf5\x2d\xec\x03\x3a\x47\xef\x48\x70\x77\xdc\x57\xd7\x98\x23\x46\x39" |
| "\x07\x79\x04\x11\xff\xeb\xa7\xcf\xcf\x36\x37\x4d\xc1\xb3\x73\x6f\x08\x7f" |
| "\x69\xbe\x3c\xf9\x28\x98\x55\x86\xd2\xe7\x8e\xeb\xc3\x36\xae\xa4\xb7\x24" |
| "\x6f\xf0\x27\x3d\x29\xc6\xd8\x70\xd5\x93\xf0\x68\x3c\x6d\x43\xe3\xe5\xc2" |
| "\x81\x6c\xf2\x63\xdd\xbe\xce\xd1\x46\x6d\x64\x29\xe4\x20\xcf\x4a\x29\x8d" |
| "\x7f\xcf\x57\x61\x93\x59\x12\x81\xb0\x1b\x78\x2d\x42\x1a\x65\xb0\x8e\x21" |
| "\x7d\xb8\x36\x60\xd5\xa9\x5a\x9f\xa7\x4b\x47\xeb\x88\x90\x42\xbe\xbf\x3b" |
| "\x99\x89\x19\x29\x72\x6f\x91\xb2\x30\x16\xfd\x55\xa7\xb1\x02\xa6\x23\x90" |
| "\x00\xc8\xcb\x8b\xb5\x1f\xb5\x25\xe4\x41\x25\xcb\x1d\x75\x1a\xc1\x9e\x84" |
| "\x97\x64\x32\xc8\x07\xfb\xde\x4f\x5c\x1d\x69\xea\x1a\x52\xd6\x44\xf1\x42" |
| "\x71\xaa\xff\xe5\x0f\x59\x32\xeb\xe9\xd9\x0c\xe9\x39\x7f\xe8\xcf\xdc\xea" |
| "\xfc\x4d\xe0\xa6\xe7\xa1\x4a\x51\x05\xa8\xe0\x24\xc9\xd5\x3e\x23\x7f\x07" |
| "\xef\x1c\x24\x7e\xd4\xcb\x45\xdf\xd3\xa8\x44\x15\x49\xde\x63\x23\xd7\x69" |
| "\xf4\x7f\x3e\x1d\x46\xf3\x01\x70\x6f\xc6\x96\xc2\x1b\x8d\x42\xbc\xfd\x0d" |
| "\xab\xbd\x27\x10\xa1\xc5\xc7\x69\x24\x52\x55\x9a\xc1\x08\xb3\x33\xf7\xc9" |
| "\x2e\x26\x08\x62\x0e\x8d\xdc\x14\xcc\x2d\x7e\x5e\x11\x17\x4f\xa0\x5e\xcf" |
| "\xf3\xb7\xa0\x19\x25\xa5\x89\x37\x24\xdd\xbf\x4b\xe9\x70\x92\x25\xcd\xfe" |
| "\x33\xf4\xca\x09\xdc\xf1\x93\x8f\x40\x6e\xb4\xbe\xb2\x3d\x67\xd8\xc4\x14" |
| "\x1d\x59\x1d\x02\x86\x7a\x91\x48\x8f\xdf\xb1\x0e\xf3\xa5\x31\x27\xef\x4d" |
| "\x69\xa0\x7f\x39\xc7\x11\x1a\x35\x9f\xf0\xbb\xe6\x67\xd0\x19\x51\x89\x91" |
| "\xbe\x6f\xc2\x38\x6a\xe8\xdd\x6a\xfe\xf1\x6d\x34\xb1\x80\xc8\xf1\xfe\x8a" |
| "\x69\x46\x5a\xdf\x29\xaf\xe9\x50\x8a\x82\xe7\x46\x5b\xcb\x02\x03\xf8\x41" |
| "\x62\xeb\xa7\xc6\x73\x9c\xa8\xc7\x8c\xd8\xd4\x17\xb2\x74\xc4\xd1\x9d\xd9" |
| "\x11\xaa\xd0\xe8\x39\x1f\x1a\x89\xaa\x50\xe4\xb8\xc5\xe7\x86\x62\x9c\x6d" |
| "\x05\x9f\xae\x89\x8e\x36\xb5\xed\x56\x30\x37\x36\xd2\x3b\xb0\x18\x8d\x34" |
| "\xad\x8b\x0f\x29\xe9\x64\xb6\xf4\xdf\x6d\x96\x66\xa1\x29\x4e\x12\xfc\x31" |
| "\x91\xe1\x21\xca\x43\x05\x65\xd6\xec\xc8\x71\x90\xb8\x88\x05\x90\x1e\x1a" |
| "\x5e\x0f\xfd\x23\x54\xe5\x49\x76\x90\xaf\x64\x4d\x51\xb3\x43\xf0\xca\xe6" |
| "\x57\xe8\x21\x45\x09\xaf\x01\xa9\xc6\x55\xdd\x6f\x7a\xd5\x92\xff\xf9\xe6" |
| "\x59\x9d\x82\x3a\xe5\xe1\xa9\xe7\xc1\xfd\x8c\xd6\x0c\x87\x41\x32\x62\xc6" |
| "\x13\xd5\x76\xa9\x55\x16\xe9\xeb\xb9\x3a\x39\x45\x3d\x45\x83\xb3\x8b\xe6" |
| "\xd7\xc1\x76\x08\xca\xba\x2f\x93\x55\xc5\x3d\xeb\xc0\x9d\x17\x03\x13\xe0" |
| "\xff\x5f\x1d\xf5\xdc\xc6\xa3\xdc\x7f\x97\xdb\xe5\x47\xa8\x9b\x56\xf6\xa5" |
| "\xa8\xcc\x32\x66\x68\x5b\xf6\xf5\xcc\xbd\x56\x8a\xa2\x8c\x04\x21\x92\x35" |
| "\x61\x37\x3d\xb1\x10\xf6\x16\x1e\xe9\xb2\x58\xe5\x29\xc2\x60\x6b\xe1\x19" |
| "\x3d\x31\x60\x8e\xa6\xf9\x86\x2c\x9c\x50\xda\x07\x71\xd6\xf2\xed\x79\xf0" |
| "\x8a\x54\x10\x3b\x2d\xe8\xcb\xec\xe6\x98\xf4\x42\xa6\x56\x36\x83\x08\x2c" |
| "\xc9\xd0\xb2\x37\x7e\x98\x2e\xb0\x0a\xec\xab\x71\x9b\x56\x83\xa5\xd7\xa1" |
| "\x90\x6b\xab\x57\x18\x35\x12\x1e\x40\xe9\xd4\xd3\xde\x64\x88\x1c\x48\x1a" |
| "\xbb\xae\xef\xb6\xbb\x26\xb7\xd1\x51\x1a\x9e\xe5\x51\xb5\xee\x09\x9b\x85" |
| "\xc1\xe7\xd3\x54\xd6\x56\x15\x72\xf4\xf8\xb2\x9e\xa8\x30\xef\xbb\x53\xc0" |
| "\x81\x8d\xe3\xc1\xf8\x1e\x20\xeb\xb6\x68\x7d\x10\x58\x72\x58\x84\x13\xba" |
| "\xb0\xd3\x40\x42\x51\x23\xef\x72\x5b\x63\x38\x2e\x34\xfb\xb2\x84\x7b\x4b" |
| "\xeb\xa8\x36\xb3\x05\x8a\x2f\x24\x02\xd8\xee\xb8\x97\x4e\x1a\x7a\xbb\xa1" |
| "\x58\x2c\xd2\x43\x77\x8e\x24\x1e\x61\x91\xb7\x9d\xe8\x88\x24\xec\x2e\x28" |
| "\xd3\xad\x17\x18\x7e\x56\xcd\x1e\xeb\x27\x0e\x39\x41\x29\x61\x61\xc3\x57" |
| "\x7f\xd1\xc6\xab\x69\xba\x1e\x13\x99\x93\xb6\x2c\x2e\x32\x6a\xfe\xba\x5d" |
| "\xf7\x14\x50\x6f\x25\xb4\xb8\xf8\x54\xe5\x99\x7d\xa5\x86\xa3\x6f\xb8\x3c" |
| "\x1b\xbe\x0e\xcc\x1e\x87\x00\x2a\x63\xa9\x29\xc3\x86\x85\xb0\xaa\xee\x12" |
| "\xaf\x6e\x49\x2e\x65\xbc\x0f\x22\x0e\x66\xbf\x47\x82\x4c\x9d\xca\xdc\x85" |
| "\x11\x6b\x50\x62\x0e\x20\xd9\x8f\x6a\x18\x52\x69\x4f\x0d\xfc\x3c\xe0\xce" |
| "\xde\x0c\x80\xcb\xc3\xc5\xf9\xe0\x26\x32\xc5\xaa\xac\x12\x9b\xc4\x58\xbd" |
| "\xfd\x99\x75\x59\xaf\x63\x46\x72\x3d\x60\xd8\xfa\x39\x14\x11\x1a\x90\x4b" |
| "\xb6\xf1\xd7\x2f\x5c\x66\x3e\x80\x05\x2c\x70\xca\x7b\x93\x43\xa0\x9c\xf3" |
| "\x05\x26\x84\xba\xa0\x5c\xea\x6c\xa7\x7f\xc3\x4f\xa5\x07\x2b\xab\x95\x17" |
| "\xb9\x85\xd5\x4c\x6a\xbb\x9b\x32\x21\x18\x75\xec\x39\x14\x89\x50\xf6\x63" |
| "\x58\xfc\x88\x0d\x66\xb8\xd8\xaa\x92\xe4\xbc\x53\x41\x8f\xba\x29\x5a\x91" |
| "\xa4\x2e\x44\x5a\x24\x25\xfb\x16\x0a\x76\xd5\xf7\xd0\x3e\xcd\xe3\x85\x41" |
| "\xbb\x31\x39\x42\xd8\x6e\xea\xd8\xc5\xe0\x3c\x8f\x0c\x9b\x43\xa7\x78\x04" |
| "\xde\x71\x95\x37\x9a\x68\xaa\x19\xb8\x72\x31\x5d\xc3\x48\x7f\x09\x53\x67" |
| "\xf2\x93\xff\xc0\x75\x89\xa8\x37\xdf\xd2\xaf\x09\x42\x6d\x49\x3f\x4c\xb6" |
| "\x47\x0c\xcd\x0f\x81\x2a\xf9\xbb\x6d\x61\x04\x63\x7a\x0d\x14\x4f\x77\x73" |
| "\xae\xbb\x07\xbe\x69\x2d\xde\xa0\x8a\x4a\xf7\x4d\xcc\xf2\x1b\x27\xc0\x88" |
| "\x50\x61\x24\xdd\xbb\x9a\xa3\x2a\x0f\x41\x5c\xc5\x6f\x3d\x99\xfd\x2e\x06" |
| "\xc1\xd7\xfd\x69\xa8\x82\x74\xa2\x01\x92\xd5\x99\x4c\x97\x09\xf8\x55\x67" |
| "\x85\x0b\x19\x66\x30\x8e\x4d\xce\xbd\xf0\x93\x7d\xf8\x51\xc8\x6c\x03\xd8" |
| "\x02\x83\xab\x5e\xa4\x5b\xb1\x0a\x6d\x95\x37\x1d\xd8\x6d\x77\xdf\x78\x04" |
| "\x1f\x4e\xb3\xc9\x57\xcb\xe3\x52\xef\x4a\x94\xd0\x95\x39\x32\x77\xc5\x22" |
| "\x11\xa7\x6a\xa0\xa4\x2f\x15\x85\x29\x9f\xeb\xe6\x45\xad\xfb\xdc\x22\xe9" |
| "\x9a\x22\x20\xa2\x76\x5e\xc2\x12\x33\xdc\x59\x20\x6f\x4d\xa4\xb5\x43\x59" |
| "\x94\x60\x04\x9f\x1e\xca\x8e\x11\x11\xd2\xb5\x2a\x44\x3f\xbc\xeb\x4b\x08" |
| "\xe8\x25\x14\x63\xe8\x33\x7f\x01\x0f\x5b\x4f\x6a\x85\x4c\xbf\xed\xe7\xd3" |
| "\x5e\x6d\xb0\xe5\x18\x19\x2e\x02\x89\x84\x33\x53\x90\x91\xa6\xc0\xf4\x89" |
| "\x0a\x3c\x13\x0c\x4b\xd8\x27\x29\x23\xd9\xe1\x61\x66\xfe\x77\xe0\xf0\x1a" |
| "\xfe\x8d\x76\xd3\x6a\x48\xd6\x42\x98\x99\xd5\x0c\x33\xb3\xeb\xa6\x09\x77" |
| "\x27\x73\x52\xa8\xfb\x7c\xd0\xcd\xfb\x00\xbc\xf3\x8c\x5f\xdd\x83\xaf\x9a" |
| "\x62\x3c\x29\xa2\x70\x06\x3d\xb5\x26\xab\x3f\xe9\xad\xef\x0c\xb0\xc1\x1a" |
| "\xda\xa7\x98\xb0\x94\xf5\x76\x01\x7c\xf9\x1b\x45\xec\x50\x7a\x9f\x36\x92" |
| "\xb6\xe5\xa7\xb2\xf3\xdc\x7b\xa4\x23\xc7\x17\x3d\x6a\x30\x73\x87\x55\x17" |
| "\x54\xfb\x25\xac\xff\x0c\xa2\xea\xab\xd5\x03\xc4\xe9\x54\x6b\x13\x42\x72" |
| "\xb3\x73\x7a\x1e\x9f\xd0\x93\x5e\xc1\xb8\xcd\x77\x4e\x8b\x92\x49\xc0\xee" |
| "\x20\xbc\xd0\x57\x69\x44\xdb\x49\xe1\x54\x79\x26\xd1\x53\xdb\xe6\x3a\x96" |
| "\x66\x78\x2e\x83\xf8\xdd\x8d\xdd\x51\x94\xfd\xdd\x5c\x43\x3e\xde\x68\x97" |
| "\x33\xd5\x44\x1f\x0e\x29\xe7\x27\x7c\xb2\x4f\x05\x24\xfd\x52\x96\x10\x0a" |
| "\xfc\xfb\x79\x04\x3b\x72\x0c\xc6\x6c\xbe\x4e\x13\xab\x38\x2d\xef\x18\x67" |
| "\x7a\x3d\x39\xba\x93\xca\x4a\xcb\xdc\x2a\xd5\x69\x8f\xb3\xc3\xb9\x99\x6b" |
| "\x4f\x91\x7a\x26\x85\xec\x5d\x22\x47\x90\x1c\xa0\xa7\x06\x5b\x5c\x7c\x1c" |
| "\x53\x25\x53\x63\x99\x20\xaf\x93\xac\x71\xa2\x26\x77\x39\x79\x14\x4b\x47" |
| "\x1c\xdf\xf5\xb1\xbb\xd6\x5c\xf1\xe0\x53\xd5\xb8\xf1\x9a\xe6\x3b\x4a\xe1" |
| "\x9b\x8b\x4c\x20\xa5\xec\xbf\xa3\x5c\x5f\x93\x8f\xfc\x2e\x09\xbb\xc1\x51" |
| "\x5f\xe2\x21\xba\x57\x0f\xfc\x3d\x0b\x8b\xf7\x56\x92\x60\x21\xd1\xba\x01" |
| "\xa8\xab\xb1\x6d\xb2\xfe\x9a\x41\x44\x0b\x98\xab\xec\xfa\x1a\xe6\x32\xe4" |
| "\x1e\xab\xf3\x9f\x87\xd4\x40\xa0\x91\xba\xa8\xf4\xfd\xfa\xb6\x82\x88\x14" |
| "\x08\xe0\xab\x6e\x57\xd8\x0f\xb6\x25\xfb\xad\x77\x2e\x09\xd0\x69\xf1\xe8" |
| "\x10\xfd\x4e\x33\xce\xd4\xb6\x41\x79\xec\x2a\xf8\x8c\x4b\xd1\xb7\x63\xec" |
| "\x3d\x3c\x2e\x21\xd5\x7e\x81\x19\xde\xa8\xae\x38\x2c\x7c\x33\x56\x49\xfc" |
| "\x77\x9f\x8f\xab\x06\xc8\xa5\x36\x36\xf6\x70\xa2\xdc\xc9\x87\xf6\x31\x97" |
| "\x81\xdd\xc0\x75\xb9\x8b\x49\x67\x1a\x26\xda\x7f\x9b\xbe\xb5\x5a\xac\xe7" |
| "\x61\xdc\x39\x34\x68\x1a\xb9\x5b\xc0\xf1\x1f\xd1\x19\xd5\x11\x3e\x64\x82" |
| "\x24\x5d\xd9\xb9\xec\x0c\x82\x33\xc4\xd4\x33\x70\x96\x51\x97\x56\x96\xd2" |
| "\x4a\xc9\x71\xe8\xd2\x70\xd7\x6b\x37\xc1\xaa\x54\x2e\xf5\xb8\x42\x7d\x1a" |
| "\x85\x7d\xbe\x3e\xdc\x0f\xf6\x1b\x25\x8f\x9a\x0d\xb3\x2d\x47\x11\xa6\x00" |
| "\x8c\x91\xa1\x7c\xc4\x3f\x4a\xdf\xce\xaa\x6f\xce\x5b\x3c\x48\x98\xdb\xf0" |
| "\x73\x0e\x59\x50\xbb\x4f\xd1\x2b\x24\x00\xa6\x23\xac\x69\x19\xf5\x3a\x04" |
| "\x06\xd9\xf3\xad\x5e\x02\x4a\xea\x2c\x7c\x8f\xa8\x67\x7c\xb4\x10\x91\xf1" |
| "\xee\x40\x53\x6e\x3e\x71\x24\xdd\x5b\xbc\x2a\xf3\x5f\x55\xc3\x43\x45\x39" |
| "\xea\xe8\x03\x32\x2f\xe4\xc1\x42\x8f\x41\x01\x39\x95\xa2\xe8\x00\x06\x66" |
| "\xbf\x5a\x0e\x41\x85\xd4\x01\xed\xd2\xb7\x81\x81\xd5\xa6\x81\x73\xcd\x20" |
| "\xca\x5e\x57\xa0\x79\x81\x7b\x8a\x8c\xfb\x5d\x2e\x72\xd5\xea\x81\xb2\xcc" |
| "\xe6\xc2\xb6\x0c\xfe\x0a\x26\x5b\x34\x94\xc5\x29\x86\x8d\x34\xb5\xee\x41" |
| "\xbe\xa1\xa1\x64\xe7\x6e\x0a\x82\x6e\x8e\xc9\x9f\xc3\x88\xe0\xc4\x2d\xc7" |
| "\x4c\xbf\xfd\xf3\x98\xab\xf0\xf3\x18\x1f\xd5\x6d\x89\x26\x87\x84\x7c\x7b" |
| "\xd3\xac\x3b\xa5\xa4\xd8\xb3\x24\xbb\xbc\xef\x6f\x3e\x2f\x7b\xc0\x6b\xb4" |
| "\x66\x4f\xd2\x0d\xb2\x3d\xf9\x52\x6f\x25\x6e\x03\x64\xd3\x45\x93\xf3\xb0" |
| "\x0e\xf7\xe1\xe6\x16\xa6\x31\x3b\x97\x14\x7d\x84\xc3\x54\x2c\x67\xa8\x00" |
| "\x9a\x72\x1b\x2b\x1e\xea\x0e\xa4\xc4\xb3\x52\x72\x57\x10\xcc\x5d\x78\xb0" |
| "\x20\x0a\xf8\xd6\x12\xbb\x1c\x38\x52\x35\xf9\x8e\x27\xcd\xe3\xf7\x4d\x55" |
| "\x3a\x8e\x27\x08\x43\xf1\x81\xe9\x3d\x9c\x75\xde\xb4\x6b\xca\xd4\x41\x84" |
| "\x0a\xe7\xb6\xe0\xcc\xa8\x64\x67\x87\xff\x1a\x3d\x67\x21\x60\xe5\x24\xac" |
| "\xbf\x84\xcf\xe2\x03\xc9\x17\xed\xb5\x0e\xa3\xc6\xe8\xde\x3a\xe2\xa3\x3a" |
| "\xfd\xee\x14\x36\xd1\x6f\x0f\xe5\x78\x80\x3a\xd8\xd8\x7d\x18\xb2\xb9\x5d" |
| "\x64\xf5\xcc\x97\x5a\xa6\x58\xa7\x1d\x3a\x57\xdb\x89\x1e\x18\x8a\x53\xa3" |
| "\xd6\x62\x57\x9f\xad\xe4\xfa\x76\x6f\xe7\x29\x1d\x99\x1d\x0d\x21\xc6\x27" |
| "\x60\x8d\xc4\x27\xbd\xeb\x30\x76\xaf\x84\x45\x4d\x4c\xbd\x11\x94\x8f\x42" |
| "\x90\xaf\x09\xf2\x4d\xad\x62\x91\x6b\x48\x2c\xee\x95\x6d\xd5\x37\xfa\xe7" |
| "\xb3\x89\x83\x03\xad\x3a\x10\xd4\x69\x25\x69\xa0\x73\xe7\x4b\xb6\x28\x68" |
| "\x98\x6d\x68\xdd\x7a\xa6\xe7\x95\xa5\xa6\x75\xa0\x33\xdd\x4d\x35\x95\xde" |
| "\x5d\x8b\x32\xf8\xa8\xe8\x1c\xd3\xe2\x83\x8e\xac\xa4\x00\x6d\x8d\x62\x49" |
| "\x95\x21\xf6\xe0\x3b\xfc\x05\x3e\x88\xca\x0a\xd3\x11\xac\x3f\x92\xf4\x1a" |
| "\x12\x75\xc9\xec\x9f\x8f\x1e\x42\x23\x64\x91\xe1\x10\xf4\x24\x53\xff\x33" |
| "\x30\x4d\x37\xd1\x69\x8c\xcd\xfa\xb4\x96\x9a\xf5\x4a\xd4\x4f\x18\x86\x86" |
| "\xe8\xc1\x18\x3a\x31\xd3\x56\xad\x79\xd2\x92\xff\x1d\x5b\x6b\x60\x02\x4b" |
| "\x12\x07\xb0\xfb\x7f\x47\xda\x5c\xc6\x92\x28\xa1\x1f\x9a\x3c\x8d\x25\xb7" |
| "\xe1\xc3\xb8\xce\xbc\xe9\x50\x63\xf9\xfb\xbd\x1d\xd1\x65\x07\xd8\x0a\x33" |
| "\x56\xfc\x18\xf7\x46\x7a\x36\x32\xbe\xcf\x30\x32\x29\x29\x43\xa6\x1d\x16" |
| "\xf1\x9a\x55\x23\x7e\xae\x43\x84\x9d\x56\xf6\x1f\x81\xc7\x69\x7a\xfa\xdd" |
| "\xf2\x04\x3c\x32\x9f\x3c\x66\xb5\xe3\xa1\x3f\xf9\x2a\xcb\xe9\xe3\x6f\xd4" |
| "\xda\x25\xcf\xfb\x63\xfe\xc3\x59\x4d\x13\x6b\xa9\xec\x2f\xf7\x8c\xca\x6b" |
| "\x23\x10\x11\x8c\x09\x53\xcf\x25\x67\xe4\x87\x40\x76\x34\x8d\xa0\x2c\x4f" |
| "\x06\xb4\x20\xec\x6c\x33\xe5\xad\x03\x26\xd5\xb1\x81\x16\xd7\x99\xa0\x05" |
| "\x1c\xbb\x29\x43\xca\x84\x3d\x42\xdc\xf8\xd4\x6f\x8b\x29\xfa\x81\x29\xd0" |
| "\x8a\x29\x55\x6b\x24\xe9\x5f\x4f\x4c\x69\x09\x73\xc7\x3f\xfe\x8b\x7e\xc7" |
| "\xb6\x11\x69\xe9\x87\x90\x27\x1a\xbe\x06\x54\x94\x50\x74\x6f\x5a\x0c\x6c" |
| "\x97\x89\xa5\xc9\xb5\xbb\x0a\xc2\x89\x3a\xf4\x77\x0c\xc8\x74\xb3\x10\x27" |
| "\x00\xff\x9d\x80\x03\x93\x8c\x62\x17\xff\x06\x50\x2c\xdd\xa0\x0e\xe7\xbd" |
| "\xfe\xef\x26\x49\x6c\x0c\x3e\xf2\xb3\x55\x7f\x30\x12\x6d\xa2\x86\x79\xf4" |
| "\xf1\x3a\xaa\xa4\x7e\x08\xa9\x6f\x02\xd2\x6d\xe4\x86\xf9\x4f\xef\x68\x1d" |
| "\x9d\xfb\x9e\x81\x2c\x1f\xff\xe3\x1a\x1f\xf0\xba\x43\x36\x98\x00\x80\x52" |
| "\x34\x57\xf2\x79\xd7\x35\x53\x80\x3d\x7d\xca\xa1\xfc\x58\x90\xed\x91\x25" |
| "\xc3\x18\xd7\x1a\xaf\x6a\x6a\x9e\x8b\x02\x8f\x37\x80\x50\x3d\x21\xff\x56" |
| "\x61\x3a\x4f\x44\xd0\x4e\xb1\xa5\x7b\x27\x7c\xea\xac\x31\xae\xa8\xd0\xac" |
| "\x6c\x7c\xc7\x2f\xa0\xb2\x10\x54\xa7\x30\x8a\x24\x25\x49\xe0\xe1\xab\xb5" |
| "\x8b\xd3\x3b\x61\x25\xea\x39\xca\x20\x24\x3f\x72\xbf\x2b\x2d\xbc\x11\xfa" |
| "\x55\xe1\x59\xd9\x1e\xb5\x53\xf2\x32\x0a\x08\x0a\x1f\x84\x2f\x8a\x6a\x5f" |
| "\x0f\x3b\x34\x7f\x35\x5b\xc4\x45\xb1\xfe\x60\xbc\x83\x39\xa6\x4e\xae\x32" |
| "\x3f\xf8\xac\x39\xf6\x81\x1e\x54\xa3\x55\xcd\x30\x9c\xab\xd2\xe3\xc9\xa8" |
| "\x65\x23\x46\xf9\x10\x7f\x89\xbe\x07\x6d\x71\x13\x90\x69\x01\x8c\x66\xbc" |
| "\x76\xae\x3e\x65\x96\xae\x36\xd3\x4d\x38\xae\x4d\x49\xe5\x44\x59\x67\xbc" |
| "\x08\x6f\xfe\x03\xd1\xd1\xb8\x4b\x29\xdf\xfa\x84\x21\xa8\x00\x8f\xcc\x22" |
| "\xed\x20\xfc\x69\x24\x07\x21\x76\x7a\xd7\x18\x40\x67\x9f\xbd\x94\xbb\x1b" |
| "\xb4\xce\x52\xa4\x96\x9c\xea\xa0\xea\x8c\x27\x49\x33\xdc\xbc\x44\x66\x4a" |
| "\x6f\x95\xc7\xd3\xbd\x38\x51\x22\x08\x17\xfc\x64\x1c\x02\x06\x7c\xda\x8b" |
| "\xec\x6e\x5c\x26\xc6\xa8\x55\x3e\xcb\x3f\x76\x0f\x39\x02\x2f\x0c\x22\x38" |
| "\x8f\x9f\x94\x57\xbc\x84\x5a\xe8\x29\x77\xd3\x3d\xb0\xfb\xef\x33\x2a\xf9" |
| "\x7a\x5f\x20\x77\xaf\x72\x10\xfa\x3e\xb9\xb7\x11\x89\x78\xf9\x99\x8a\x6e" |
| "\xf4\x56\x03\xda\x0c\xe2\x44\xed\xa9\x1c\x06\x7e\x72\x8e\xf2\x5d\x2c\x2d" |
| "\xf0\xaa\x09\x33\x0e\xef\xd0\xc0\x4d\x4d\xe1\xcd\xe8\x6b\xe7\xdd\x18\x9d" |
| "\xcb\xfc\x18\x85\xce\xf9\x7f\xf7\x4f\x40\xa3\x2a\x57\x95\x6e\xd7\x23\x74" |
| "\x36\x48\x2c\x14\xb1\x8a\x0b\x48\xde\x96\x98\x4f\x21\xfa\xa5\x74\xa7\xae" |
| "\x39\xae\xe3\xad\x91\x2a\x9e\xb6\x22\x2d\xc0\xac\xdc\x52\xc0\xc0\x6c\x46" |
| "\x8a\x14\xe8\x23\x9a\xec\x33\x21\x4c\x07\x37\x12\x29\xa7\x56\x6b\xa7\x35" |
| "\xe2\x8c\x01\xb3\x37\xb2\xa2\xfd\xaf\x80\x4a\xd1\xd9\x95\x23\xa2\xf6\x0a" |
| "\xdf\x36\xe2\xde\x93\xc6\xa5\x0c\xe3\xc4\x74\x79\x87\xb5\x02\x69\xd1\xb0" |
| "\x8d\x4d\x6a\x0b\x95\xd3\xb4\x53\xe8\x90\xe4\xc9\xe4\x16\x40\x4b\xeb\xcb" |
| "\x14\x09\x64\xca\x18\xd0\xd9\xb0\x30\x1c\xf8\xa4\xa8\xa3\x69\xbc\x0a\xe2" |
| "\x7e\x1b\x6b\x01\x37\x5c\x18\x5d\xdb\xe9\x2c\x68\x54\xdd\x5a\x9c\xc5\x43" |
| "\xd5\x8d\x64\x2d\x9c\x1c\x67\x0d\xad\xc0\x7d\x14\x83\x94\xed\xc1\xcc\xbb" |
| "\x38\xe5\x4d\x76\xa8\x51\x9d\xd3\x71\xc9\xf1\xdb\x66\x76\x0e\xd7\x83\x33" |
| "\xa0\xae\x9b\xa7\x9e\x9b\xa7\xe8\x62\xfb\xf7\x10\x35\xd2\x2c\xd7\x44\x5b" |
| "\x3f\x69\xeb\x2e\xb4\x9f\xa8\xc1\xe0\xb2\x80\xb8\xad\xa8\x4c\x33\x1c\x77" |
| "\xa1\x34\xde\xf7\x29\x71\xbf\x92\xdb\x94\xdd\x12\x3a\xa4\x79\x10\x10\x1e" |
| "\x7c\x2c\x11\x0b\xc9\xfa\xed\x51\x26\x69\xc0\xcd\x9f\x16\x24\xdb\xe4\xbf" |
| "\x13\x6b\x1d\x09\x7a\xe3\x27\xca\x51\x0f", |
| 4096)); |
| NONFAILING(*(uint16_t*)0x200028d0 = 0xc); |
| NONFAILING(*(uint16_t*)0x200028d2 = 0x55); |
| NONFAILING(*(uint16_t*)0x200028d4 = 8); |
| NONFAILING(*(uint16_t*)0x200028d6 = 0x4b); |
| NONFAILING(*(uint32_t*)0x200028d8 = -1); |
| NONFAILING(*(uint16_t*)0x200028dc = 0xc); |
| NONFAILING(*(uint16_t*)0x200028de = 0x33); |
| NONFAILING(*(uint16_t*)0x200028e0 = 8); |
| NONFAILING(*(uint16_t*)0x200028e2 = 0x74); |
| NONFAILING(*(uint32_t*)0x200028e4 = 0); |
| NONFAILING(*(uint16_t*)0x200028e8 = 0xc); |
| NONFAILING(*(uint16_t*)0x200028ea = 0xf); |
| NONFAILING(*(uint16_t*)0x200028ec = 8); |
| NONFAILING(*(uint16_t*)0x200028ee = 0x4b); |
| NONFAILING(*(uint32_t*)0x200028f0 = 0); |
| NONFAILING(*(uint16_t*)0x200028f4 = 0xc); |
| NONFAILING(*(uint16_t*)0x200028f6 = 0x14); |
| NONFAILING(*(uint64_t*)0x200028f8 = 0x105); |
| NONFAILING(*(uint16_t*)0x20002900 = 0x10); |
| NONFAILING(*(uint16_t*)0x20002902 = 0x95); |
| NONFAILING(*(uint16_t*)0x20002904 = 4); |
| NONFAILING(*(uint16_t*)0x20002906 = 0x15); |
| NONFAILING(*(uint16_t*)0x20002908 = 8); |
| NONFAILING(*(uint16_t*)0x2000290a = 0x7e); |
| NONFAILING(*(uint32_t*)0x2000290c = 0); |
| NONFAILING(*(uint16_t*)0x20002910 = 0x28); |
| NONFAILING(*(uint16_t*)0x20002912 = 0x66); |
| NONFAILING(*(uint16_t*)0x20002914 = 8); |
| NONFAILING(*(uint16_t*)0x20002916 = 0x30); |
| NONFAILING(*(uint32_t*)0x20002918 = 0); |
| NONFAILING(*(uint16_t*)0x2000291c = 8); |
| NONFAILING(*(uint16_t*)0x2000291e = 0x2f); |
| NONFAILING(*(uint32_t*)0x20002920 = r[1]); |
| NONFAILING(*(uint16_t*)0x20002924 = 0x14); |
| NONFAILING(*(uint16_t*)0x20002926 = 0x31); |
| NONFAILING(*(uint8_t*)0x20002928 = 0xfe); |
| NONFAILING(*(uint8_t*)0x20002929 = 0x80); |
| NONFAILING(*(uint8_t*)0x2000292a = 0); |
| NONFAILING(*(uint8_t*)0x2000292b = 0); |
| NONFAILING(*(uint8_t*)0x2000292c = 0); |
| NONFAILING(*(uint8_t*)0x2000292d = 0); |
| NONFAILING(*(uint8_t*)0x2000292e = 0); |
| NONFAILING(*(uint8_t*)0x2000292f = 0); |
| NONFAILING(*(uint8_t*)0x20002930 = 0); |
| NONFAILING(*(uint8_t*)0x20002931 = 0); |
| NONFAILING(*(uint8_t*)0x20002932 = 0); |
| NONFAILING(*(uint8_t*)0x20002933 = 0); |
| NONFAILING(*(uint8_t*)0x20002934 = 0); |
| NONFAILING(*(uint8_t*)0x20002935 = 0); |
| NONFAILING(*(uint8_t*)0x20002936 = 0); |
| NONFAILING(*(uint8_t*)0x20002937 = 0x26); |
| NONFAILING(*(uint64_t*)0x20006838 = 0x1078); |
| NONFAILING(*(uint64_t*)0x20006840 = 0); |
| NONFAILING(*(uint64_t*)0x20006848 = 0); |
| NONFAILING(*(uint64_t*)0x20006850 = 0); |
| NONFAILING(*(uint64_t*)0x20006858 = 0); |
| NONFAILING(*(uint64_t*)0x20006860 = 0); |
| NONFAILING(*(uint64_t*)0x20006868 = 0); |
| NONFAILING(*(uint64_t*)0x20006870 = 0); |
| NONFAILING(*(uint64_t*)0x20006878 = 0); |
| NONFAILING(*(uint64_t*)0x20006880 = 0); |
| NONFAILING(*(uint64_t*)0x20006888 = 0); |
| NONFAILING(*(uint64_t*)0x20006890 = 0); |
| NONFAILING(*(uint64_t*)0x20006898 = 0); |
| NONFAILING(*(uint64_t*)0x20006c58 = 0xa); |
| NONFAILING(*(uint64_t*)0x20006c60 = 0); |
| NONFAILING(*(uint64_t*)0x20006c68 = 0); |
| NONFAILING(*(uint32_t*)0x20006c70 = 0); |
| syscall(__NR_sendmsg, -1, 0x20006c40, 0x10); |
| syscall(__NR_ioctl, r[2], 0xae80, 0); |
| return 0; |
| } |
